Overview
overview
10Static
static
700FAEE82AB...AD.exe
windows7-x64
1001D2E2B398...A9.exe
windows7-x64
100B760ABF10...23.exe
windows7-x64
100B8E9BC319...20.exe
windows7-x64
100D0E7D8626...E5.exe
windows7-x64
100E9765528C...69.exe
windows7-x64
100c9fa52ace...7a.exe
windows7-x64
715f7ea290d...8c.exe
windows7-x64
101CB8203982...26.exe
windows7-x64
101CF69170F7...5E.exe
windows7-x64
101CFEDCBA10...0E.exe
windows7-x64
71DD70E8036...25.exe
windows7-x64
101E229029B2...DA.exe
windows7-x64
101F5FEB3211...6D.exe
windows7-x64
101FD11B5CBB...ED.exe
windows7-x64
1021977fc851...61.exe
windows7-x64
1021e1bc4340...01.exe
windows7-x64
72C3542B5D9...85.exe
windows7-x64
73ac7f91e37...38.exe
windows7-x64
103c0fe521f6...16.exe
windows7-x64
1041c53e90f0...4a.exe
windows7-x64
10467c2b23b7...be.exe
windows7-x64
105b79b6a814...b0.exe
windows7-x64
10712affaa8b...1).exe
windows7-x64
18b04af13b7...21.exe
windows7-x64
10Analysis
-
max time kernel
1559s -
max time network
1563s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
17-07-2024 19:21
Behavioral task
behavioral1
Sample
00FAEE82AB5B800CF6DBE97AFD39790B856AD1EC25DC7ED8F798ACA702BEE7AD.exe
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral2
Sample
01D2E2B398D6017D5114464E39C40E9243AE492106CCA8B2D3EB1A95F9E228A9.exe
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral3
Sample
0B760ABF108DB9BF5EA14F96A53F6D8E1B36FCC28BC75114E923482157B89A23.exe
Resource
win7-20240705-en
windows7-x64
Behavioral task
behavioral4
Sample
0B8E9BC31964C9433BD5CC20E556CFD0590C3B17B0DB23CDC3AD0547683F3820.exe
Resource
win7-20240705-en
windows7-x64
Behavioral task
behavioral5
Sample
0D0E7D86268F7ACD51E9D4AC94F016034FB949B605B21405CBA0B5581E4532E5.exe
Resource
win7-20240705-en
windows7-x64
Behavioral task
behavioral6
Sample
0E9765528C4E8FDCFF83FA07A78F5E73B41B3D9295159C823FE3B1F97C113469.exe
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral7
Sample
0c9fa52ace8019b43c91f4859ecddfde6705141b9283fef05c6c4c37a5c1777a.exe
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral8
Sample
15f7ea290d832bc32ebf660690b42616264fc0be8969934c1f8d7e5a5d3cd18c.exe
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral9
Sample
1CB82039822CB89811F42B2C3BDBB4256D85D66E942CD69F38D3CB123596C926.exe
Resource
win7-20240705-en
windows7-x64
Behavioral task
behavioral10
Sample
1CF69170F7419E097EB71B514C01D2A028C95D0605F8B91C90A2E28B3216775E.exe
Resource
win7-20240705-en
windows7-x64
Behavioral task
behavioral11
Sample
1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe
Resource
win7-20240705-en
windows7-x64
Behavioral task
behavioral12
Sample
1DD70E803623D5311B71129976710B11A8942D206A5D8D86CDF8417255F15725.exe
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral13
Sample
1E229029B2D3FF00EDDE061B1AAF470EE437FA8196D97FAD2C2C6C9EDE5B44DA.exe
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral14
Sample
1F5FEB3211A640804B3951DE9EA2037EFCB0D6EE1019D8853F98DAFD6132A76D.exe
Resource
win7-20240705-en
windows7-x64
Behavioral task
behavioral15
Sample
1FD11B5CBB32F4CD5E7947F25E900BB4E59C1C5A21922F0A842EC62C20FAF2ED.exe
Resource
win7-20240705-en
windows7-x64
Behavioral task
behavioral16
Sample
21977fc851dfbcd7c5edcc24ef56750065fcd01e5c9fa4f270424f186a83b061.exe
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral17
Sample
21e1bc4340221fbccee28d59333c20b20755e34e2f3391b90837172bd07fbf01.exe
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral18
Sample
2C3542B5D9AB4EED2DD88CD74A02236A944AFD76E8717F65DCD544912229CA85.exe
Resource
win7-20240705-en
windows7-x64
Behavioral task
behavioral19
Sample
3ac7f91e37572c0d15de4de96ab4719531c30536409fda4acb3e0071ab726338.exe
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral20
Sample
3c0fe521f6a9cfbfabc1f27a1a64dfc081a63aaaf2a6ce8cd831f6251ee85816.exe
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral21
Sample
41c53e90f0861b068eaa512edff28a586128f808b437122399347bcb3774914a.exe
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral22
Sample
467c2b23b785df7b45758143387e9cc5a588718ae0640b3f01b1c19679b011be.exe
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral23
Sample
5b79b6a81407caf12cf1894346a15e40c4dc017a35105119db3b23c7bf91c7b0.exe
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral24
Sample
712affaa8b84e8fb7d4e71feb6c1074185bc43b5a2f265fbfb248f7ed40a5489 (1).exe
Resource
win7-20240705-en
windows7-x64
Behavioral task
behavioral25
Sample
8b04af13b729b0634b1a3c83e5758f25aecb708480bf2e3df524e889b305c621.exe
Resource
win7-20240704-en
windows7-x64
General
-
Target
1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe
-
Size
526KB
-
MD5
7b8dc7d090f8b8fae9fc8f7549ae6411
-
SHA1
20b5f05713e7634a79f448df747b694039df3d2b
-
SHA256
1cfedcba10b4c90789f2c4a6a1ce2c3d4197058e574942400f571bc5d06df70e
-
SHA512
d4fa012b06fa6c4bdc6905f7edbbe3a589a3be41d4b1f782625496423394cf7ea621d6b9b8510168bbef2720e96858b39a7615d3b849a95da3c0f94d17608b9f
-
SSDEEP
6144:gek+uyH2txMRwdckwb1E+4t9YwScDPWQ6ur4bRL6C:3kn06edqSI/6KU
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 796 ooaaya.exe -
Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\SysWOW64\ooaaya.exe 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe File opened for modification C:\WINDOWS\SysWOW64\OOAAYA.EXE 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe File opened for modification C:\Windows\SysWOW64\ooaaya.exe 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 796 set thread context of 2488 796 ooaaya.exe 31 -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe -
Suspicious behavior: MapViewOfSection 23 IoCs
pid Process 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe -
Suspicious use of AdjustPrivilegeToken 18 IoCs
description pid Process Token: SeDebugPrivilege 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe Token: SeTakeOwnershipPrivilege 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe Token: SeRestorePrivilege 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe Token: SeBackupPrivilege 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe Token: SeChangeNotifyPrivilege 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe Token: SeTakeOwnershipPrivilege 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe Token: SeRestorePrivilege 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe Token: SeBackupPrivilege 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe Token: SeChangeNotifyPrivilege 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe Token: SeTakeOwnershipPrivilege 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe Token: SeRestorePrivilege 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe Token: SeBackupPrivilege 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe Token: SeChangeNotifyPrivilege 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe Token: SeTakeOwnershipPrivilege 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe Token: SeRestorePrivilege 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe Token: SeBackupPrivilege 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe Token: SeChangeNotifyPrivilege 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe Token: SeIncBasePriorityPrivilege 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2524 wrote to memory of 384 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe 3 PID 2524 wrote to memory of 384 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe 3 PID 2524 wrote to memory of 384 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe 3 PID 2524 wrote to memory of 384 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe 3 PID 2524 wrote to memory of 384 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe 3 PID 2524 wrote to memory of 392 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe 4 PID 2524 wrote to memory of 392 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe 4 PID 2524 wrote to memory of 392 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe 4 PID 2524 wrote to memory of 392 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe 4 PID 2524 wrote to memory of 392 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe 4 PID 2524 wrote to memory of 424 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe 5 PID 2524 wrote to memory of 424 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe 5 PID 2524 wrote to memory of 424 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe 5 PID 2524 wrote to memory of 424 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe 5 PID 2524 wrote to memory of 424 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe 5 PID 2524 wrote to memory of 480 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe 6 PID 2524 wrote to memory of 480 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe 6 PID 2524 wrote to memory of 480 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe 6 PID 2524 wrote to memory of 480 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe 6 PID 2524 wrote to memory of 480 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe 6 PID 2524 wrote to memory of 488 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe 7 PID 2524 wrote to memory of 488 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe 7 PID 2524 wrote to memory of 488 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe 7 PID 2524 wrote to memory of 488 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe 7 PID 2524 wrote to memory of 488 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe 7 PID 2524 wrote to memory of 496 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe 8 PID 2524 wrote to memory of 496 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe 8 PID 2524 wrote to memory of 496 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe 8 PID 2524 wrote to memory of 496 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe 8 PID 2524 wrote to memory of 496 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe 8 PID 2524 wrote to memory of 596 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe 9 PID 2524 wrote to memory of 596 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe 9 PID 2524 wrote to memory of 596 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe 9 PID 2524 wrote to memory of 596 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe 9 PID 2524 wrote to memory of 596 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe 9 PID 2524 wrote to memory of 672 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe 10 PID 2524 wrote to memory of 672 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe 10 PID 2524 wrote to memory of 672 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe 10 PID 2524 wrote to memory of 672 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe 10 PID 2524 wrote to memory of 672 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe 10 PID 2524 wrote to memory of 740 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe 11 PID 2524 wrote to memory of 740 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe 11 PID 2524 wrote to memory of 740 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe 11 PID 2524 wrote to memory of 740 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe 11 PID 2524 wrote to memory of 740 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe 11 PID 2524 wrote to memory of 808 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe 12 PID 2524 wrote to memory of 808 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe 12 PID 2524 wrote to memory of 808 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe 12 PID 2524 wrote to memory of 808 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe 12 PID 2524 wrote to memory of 808 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe 12 PID 2524 wrote to memory of 844 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe 13 PID 2524 wrote to memory of 844 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe 13 PID 2524 wrote to memory of 844 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe 13 PID 2524 wrote to memory of 844 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe 13 PID 2524 wrote to memory of 844 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe 13 PID 2524 wrote to memory of 960 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe 15 PID 2524 wrote to memory of 960 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe 15 PID 2524 wrote to memory of 960 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe 15 PID 2524 wrote to memory of 960 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe 15 PID 2524 wrote to memory of 960 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe 15 PID 2524 wrote to memory of 280 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe 16 PID 2524 wrote to memory of 280 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe 16 PID 2524 wrote to memory of 280 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe 16 PID 2524 wrote to memory of 280 2524 1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe 16
Processes
-
C:\Windows\system32\wininit.exewininit.exe1⤵PID:384
-
C:\Windows\system32\services.exeC:\Windows\system32\services.exe2⤵PID:480
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch3⤵PID:596
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}4⤵PID:1712
-
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe4⤵PID:1860
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RPCSS3⤵PID:672
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted3⤵PID:740
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted3⤵PID:808
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"4⤵PID:1160
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs3⤵PID:844
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService3⤵PID:960
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService3⤵PID:280
-
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe3⤵PID:1008
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork3⤵PID:1060
-
-
C:\Windows\system32\taskhost.exe"taskhost.exe"3⤵PID:1100
-
-
C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"3⤵PID:1032
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation3⤵PID:2448
-
-
C:\Windows\system32\sppsvc.exeC:\Windows\system32\sppsvc.exe3⤵PID:788
-
-
C:\Windows\SysWOW64\ooaaya.exeC:\Windows\SysWOW64\ooaaya.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:796 -
C:\Windows\SysWOW64\svchost.exesvchost.exe4⤵PID:2488
-
-
-
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe2⤵PID:488
-
-
C:\Windows\system32\lsm.exeC:\Windows\system32\lsm.exe2⤵PID:496
-
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵PID:392
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:424
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1200
-
C:\Users\Admin\AppData\Local\Temp\1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe"C:\Users\Admin\AppData\Local\Temp\1CFEDCBA10B4C90789F2C4A6A1CE2C3D4197058E574942400F571BC5D06DF70E.exe"2⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2524
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
526KB
MD57b8dc7d090f8b8fae9fc8f7549ae6411
SHA120b5f05713e7634a79f448df747b694039df3d2b
SHA2561cfedcba10b4c90789f2c4a6a1ce2c3d4197058e574942400f571bc5d06df70e
SHA512d4fa012b06fa6c4bdc6905f7edbbe3a589a3be41d4b1f782625496423394cf7ea621d6b9b8510168bbef2720e96858b39a7615d3b849a95da3c0f94d17608b9f