Overview
overview
10Static
static
700FAEE82AB...AD.exe
windows7-x64
1001D2E2B398...A9.exe
windows7-x64
100B760ABF10...23.exe
windows7-x64
100B8E9BC319...20.exe
windows7-x64
100D0E7D8626...E5.exe
windows7-x64
100E9765528C...69.exe
windows7-x64
100c9fa52ace...7a.exe
windows7-x64
715f7ea290d...8c.exe
windows7-x64
101CB8203982...26.exe
windows7-x64
101CF69170F7...5E.exe
windows7-x64
101CFEDCBA10...0E.exe
windows7-x64
71DD70E8036...25.exe
windows7-x64
101E229029B2...DA.exe
windows7-x64
101F5FEB3211...6D.exe
windows7-x64
101FD11B5CBB...ED.exe
windows7-x64
1021977fc851...61.exe
windows7-x64
1021e1bc4340...01.exe
windows7-x64
72C3542B5D9...85.exe
windows7-x64
73ac7f91e37...38.exe
windows7-x64
103c0fe521f6...16.exe
windows7-x64
1041c53e90f0...4a.exe
windows7-x64
10467c2b23b7...be.exe
windows7-x64
105b79b6a814...b0.exe
windows7-x64
10712affaa8b...1).exe
windows7-x64
18b04af13b7...21.exe
windows7-x64
10Analysis
-
max time kernel
1559s -
max time network
1563s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
17-07-2024 19:21
Behavioral task
behavioral1
Sample
00FAEE82AB5B800CF6DBE97AFD39790B856AD1EC25DC7ED8F798ACA702BEE7AD.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
01D2E2B398D6017D5114464E39C40E9243AE492106CCA8B2D3EB1A95F9E228A9.exe
Resource
win7-20240704-en
Behavioral task
behavioral3
Sample
0B760ABF108DB9BF5EA14F96A53F6D8E1B36FCC28BC75114E923482157B89A23.exe
Resource
win7-20240705-en
Behavioral task
behavioral4
Sample
0B8E9BC31964C9433BD5CC20E556CFD0590C3B17B0DB23CDC3AD0547683F3820.exe
Resource
win7-20240705-en
Behavioral task
behavioral5
Sample
0D0E7D86268F7ACD51E9D4AC94F016034FB949B605B21405CBA0B5581E4532E5.exe
Resource
win7-20240705-en
Behavioral task
behavioral6
Sample
0E9765528C4E8FDCFF83FA07A78F5E73B41B3D9295159C823FE3B1F97C113469.exe
Resource
win7-20240708-en
Behavioral task
behavioral7
Sample
0c9fa52ace8019b43c91f4859ecddfde6705141b9283fef05c6c4c37a5c1777a.exe
Resource
win7-20240704-en
Behavioral task
behavioral8
Sample
15f7ea290d832bc32ebf660690b42616264fc0be8969934c1f8d7e5a5d3cd18c.exe
Resource
win7-20240704-en
Behavioral task
behavioral9
Sample
1CB82039822CB89811F42B2C3BDBB4256D85D66E942CD69F38D3CB123596C926.exe
Resource
win7-20240705-en
Behavioral task
behavioral10
Sample
1CF69170F7419E097EB71B514C01D2A028C95D0605F8B91C90A2E28B3216775E.exe
Resource
win7-20240705-en
Behavioral task
behavioral11
Sample
1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe
Resource
win7-20240705-en
Behavioral task
behavioral12
Sample
1DD70E803623D5311B71129976710B11A8942D206A5D8D86CDF8417255F15725.exe
Resource
win7-20240704-en
Behavioral task
behavioral13
Sample
1E229029B2D3FF00EDDE061B1AAF470EE437FA8196D97FAD2C2C6C9EDE5B44DA.exe
Resource
win7-20240708-en
Behavioral task
behavioral14
Sample
1F5FEB3211A640804B3951DE9EA2037EFCB0D6EE1019D8853F98DAFD6132A76D.exe
Resource
win7-20240705-en
Behavioral task
behavioral15
Sample
1FD11B5CBB32F4CD5E7947F25E900BB4E59C1C5A21922F0A842EC62C20FAF2ED.exe
Resource
win7-20240705-en
Behavioral task
behavioral16
Sample
21977fc851dfbcd7c5edcc24ef56750065fcd01e5c9fa4f270424f186a83b061.exe
Resource
win7-20240708-en
Behavioral task
behavioral17
Sample
21e1bc4340221fbccee28d59333c20b20755e34e2f3391b90837172bd07fbf01.exe
Resource
win7-20240708-en
Behavioral task
behavioral18
Sample
2C3542B5D9AB4EED2DD88CD74A02236A944AFD76E8717F65DCD544912229CA85.exe
Resource
win7-20240705-en
Behavioral task
behavioral19
Sample
3ac7f91e37572c0d15de4de96ab4719531c30536409fda4acb3e0071ab726338.exe
Resource
win7-20240708-en
Behavioral task
behavioral20
Sample
3c0fe521f6a9cfbfabc1f27a1a64dfc081a63aaaf2a6ce8cd831f6251ee85816.exe
Resource
win7-20240704-en
Behavioral task
behavioral21
Sample
41c53e90f0861b068eaa512edff28a586128f808b437122399347bcb3774914a.exe
Resource
win7-20240704-en
Behavioral task
behavioral22
Sample
467c2b23b785df7b45758143387e9cc5a588718ae0640b3f01b1c19679b011be.exe
Resource
win7-20240708-en
Behavioral task
behavioral23
Sample
5b79b6a81407caf12cf1894346a15e40c4dc017a35105119db3b23c7bf91c7b0.exe
Resource
win7-20240708-en
Behavioral task
behavioral24
Sample
712affaa8b84e8fb7d4e71feb6c1074185bc43b5a2f265fbfb248f7ed40a5489 (1).exe
Resource
win7-20240705-en
Behavioral task
behavioral25
Sample
8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe
Resource
win7-20240704-en
General
-
Target
1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe
-
Size
526KB
-
MD5
7b8dc7d090f8b8fae9fc8f7549ae6411
-
SHA1
20b5f05713e7634a79f448df747b694039df3d2b
-
SHA256
1cfedcba10b4c90789f2c4a6a1ce2c3d4197058e574942400f571bc5d06df70e
-
SHA512
d4fa012b06fa6c4bdc6905f7edbbe3a589a3be41d4b1f782625496423394cf7ea621d6b9b8510168bbef2720e96858b39a7615d3b849a95da3c0f94d17608b9f
-
SSDEEP
6144:gek+uyH2txMRwdckwb1E+4t9YwScDPWQ6ur4bRL6C:3kn06edqSI/6KU
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
ooaaya.exepid process 796 ooaaya.exe -
Drops file in System32 directory 3 IoCs
Processes:
1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exedescription ioc process File created C:\Windows\SysWOW64\ooaaya.exe 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe File opened for modification C:\WINDOWS\SysWOW64\OOAAYA.EXE 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe File opened for modification C:\Windows\SysWOW64\ooaaya.exe 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
ooaaya.exedescription pid process target process PID 796 set thread context of 2488 796 ooaaya.exe svchost.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exepid process 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe -
Suspicious behavior: MapViewOfSection 23 IoCs
Processes:
1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exepid process 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe -
Suspicious use of AdjustPrivilegeToken 18 IoCs
Processes:
1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exedescription pid process Token: SeDebugPrivilege 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe Token: SeTakeOwnershipPrivilege 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe Token: SeRestorePrivilege 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe Token: SeBackupPrivilege 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe Token: SeChangeNotifyPrivilege 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe Token: SeTakeOwnershipPrivilege 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe Token: SeRestorePrivilege 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe Token: SeBackupPrivilege 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe Token: SeChangeNotifyPrivilege 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe Token: SeTakeOwnershipPrivilege 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe Token: SeRestorePrivilege 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe Token: SeBackupPrivilege 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe Token: SeChangeNotifyPrivilege 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe Token: SeTakeOwnershipPrivilege 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe Token: SeRestorePrivilege 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe Token: SeBackupPrivilege 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe Token: SeChangeNotifyPrivilege 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe Token: SeIncBasePriorityPrivilege 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exedescription pid process target process PID 2524 wrote to memory of 384 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe wininit.exe PID 2524 wrote to memory of 384 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe wininit.exe PID 2524 wrote to memory of 384 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe wininit.exe PID 2524 wrote to memory of 384 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe wininit.exe PID 2524 wrote to memory of 384 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe wininit.exe PID 2524 wrote to memory of 392 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe csrss.exe PID 2524 wrote to memory of 392 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe csrss.exe PID 2524 wrote to memory of 392 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe csrss.exe PID 2524 wrote to memory of 392 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe csrss.exe PID 2524 wrote to memory of 392 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe csrss.exe PID 2524 wrote to memory of 424 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe winlogon.exe PID 2524 wrote to memory of 424 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe winlogon.exe PID 2524 wrote to memory of 424 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe winlogon.exe PID 2524 wrote to memory of 424 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe winlogon.exe PID 2524 wrote to memory of 424 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe winlogon.exe PID 2524 wrote to memory of 480 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe services.exe PID 2524 wrote to memory of 480 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe services.exe PID 2524 wrote to memory of 480 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe services.exe PID 2524 wrote to memory of 480 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe services.exe PID 2524 wrote to memory of 480 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe services.exe PID 2524 wrote to memory of 488 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe lsass.exe PID 2524 wrote to memory of 488 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe lsass.exe PID 2524 wrote to memory of 488 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe lsass.exe PID 2524 wrote to memory of 488 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe lsass.exe PID 2524 wrote to memory of 488 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe lsass.exe PID 2524 wrote to memory of 496 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe lsm.exe PID 2524 wrote to memory of 496 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe lsm.exe PID 2524 wrote to memory of 496 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe lsm.exe PID 2524 wrote to memory of 496 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe lsm.exe PID 2524 wrote to memory of 496 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe lsm.exe PID 2524 wrote to memory of 596 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe svchost.exe PID 2524 wrote to memory of 596 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe svchost.exe PID 2524 wrote to memory of 596 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe svchost.exe PID 2524 wrote to memory of 596 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe svchost.exe PID 2524 wrote to memory of 596 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe svchost.exe PID 2524 wrote to memory of 672 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe svchost.exe PID 2524 wrote to memory of 672 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe svchost.exe PID 2524 wrote to memory of 672 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe svchost.exe PID 2524 wrote to memory of 672 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe svchost.exe PID 2524 wrote to memory of 672 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe svchost.exe PID 2524 wrote to memory of 740 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe svchost.exe PID 2524 wrote to memory of 740 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe svchost.exe PID 2524 wrote to memory of 740 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe svchost.exe PID 2524 wrote to memory of 740 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe svchost.exe PID 2524 wrote to memory of 740 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe svchost.exe PID 2524 wrote to memory of 808 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe svchost.exe PID 2524 wrote to memory of 808 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe svchost.exe PID 2524 wrote to memory of 808 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe svchost.exe PID 2524 wrote to memory of 808 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe svchost.exe PID 2524 wrote to memory of 808 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe svchost.exe PID 2524 wrote to memory of 844 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe svchost.exe PID 2524 wrote to memory of 844 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe svchost.exe PID 2524 wrote to memory of 844 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe svchost.exe PID 2524 wrote to memory of 844 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe svchost.exe PID 2524 wrote to memory of 844 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe svchost.exe PID 2524 wrote to memory of 960 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe svchost.exe PID 2524 wrote to memory of 960 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe svchost.exe PID 2524 wrote to memory of 960 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe svchost.exe PID 2524 wrote to memory of 960 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe svchost.exe PID 2524 wrote to memory of 960 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe svchost.exe PID 2524 wrote to memory of 280 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe svchost.exe PID 2524 wrote to memory of 280 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe svchost.exe PID 2524 wrote to memory of 280 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe svchost.exe PID 2524 wrote to memory of 280 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe svchost.exe
Processes
-
C:\Windows\system32\wininit.exewininit.exe1⤵
-
C:\Windows\system32\services.exeC:\Windows\system32\services.exe2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch3⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}4⤵
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe4⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RPCSS3⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted3⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted3⤵
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"4⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs3⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService3⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService3⤵
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe3⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork3⤵
-
C:\Windows\system32\taskhost.exe"taskhost.exe"3⤵
-
C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"3⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation3⤵
-
C:\Windows\system32\sppsvc.exeC:\Windows\system32\sppsvc.exe3⤵
-
C:\Windows\SysWOW64\ooaaya.exeC:\Windows\SysWOW64\ooaaya.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\svchost.exesvchost.exe4⤵
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe2⤵
-
C:\Windows\system32\lsm.exeC:\Windows\system32\lsm.exe2⤵
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe"C:\Users\Admin\AppData\Local\Temp\1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe"2⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\SysWOW64\ooaaya.exeFilesize
526KB
MD57b8dc7d090f8b8fae9fc8f7549ae6411
SHA120b5f05713e7634a79f448df747b694039df3d2b
SHA2561cfedcba10b4c90789f2c4a6a1ce2c3d4197058e574942400f571bc5d06df70e
SHA512d4fa012b06fa6c4bdc6905f7edbbe3a589a3be41d4b1f782625496423394cf7ea621d6b9b8510168bbef2720e96858b39a7615d3b849a95da3c0f94d17608b9f
-
memory/796-6-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/2488-7-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2488-11-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/2488-9-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/2524-0-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/2524-2-0x0000000077A4F000-0x0000000077A50000-memory.dmpFilesize
4KB
-
memory/2524-1-0x0000000077A50000-0x0000000077A51000-memory.dmpFilesize
4KB
-
memory/2524-12-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB