Resubmissions
13/08/2024, 19:35
240813-ya2ljasdnb 1013/08/2024, 19:32
240813-x8xjsswhpn 1013/08/2024, 19:31
240813-x8dfxsscje 10Analysis
-
max time kernel
150s -
max time network
135s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
13/08/2024, 19:32
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
trucking instructions.exe
Resource
win7-20240708-en
windows7-x64
17 signatures
150 seconds
Behavioral task
behavioral2
Sample
trucking instructions.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
25 signatures
150 seconds
General
-
Target
trucking instructions.exe
-
Size
810KB
-
MD5
70e2e8e0e4af94e41c25c6576234f27b
-
SHA1
803f302773e43fadaa72613718905369ac47c20c
-
SHA256
f9898f9bbef6d022dd0ce4343009f8d8ec465322ec384723e565a7ff0db259e7
-
SHA512
4aedd3f377b7ec0242a2f4f1a879293cc6768c8199237f9fbd30f90bee51de2702d56ac567fdecf933c21ab67add29eb57b22cb1776ea5ff0b7c34ae5d425a54
-
SSDEEP
24576:GUI54C07YR3CHSSKnKu/k3zPHdPHdTSkc14:7MGYRSsK0k3j
Malware Config
Extracted
Family
agenttesla
Credentials
Protocol: smtp- Host:
mail.mahesh-ent.com - Port:
587 - Username:
[email protected] - Password:
M@hesh3981 - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
-
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 1600 powershell.exe 756 powershell.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation trucking instructions.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 26 api.ipify.org 27 api.ipify.org -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2904 set thread context of 1520 2904 trucking instructions.exe 100 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language trucking instructions.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language trucking instructions.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 taskmgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString taskmgr.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Software\Microsoft\Internet Explorer\GPU SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Internet Explorer\GPU SearchApp.exe -
Modifies data under HKEY_USERS 15 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "58" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1" LogonUI.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00 LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040" LogonUI.exe -
Modifies registry class 20 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search\Total = "23" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DomStorageState SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "185" SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search\Total = "56" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\MuiCache SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "152" SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\MuiCache StartMenuExperienceHost.exe Key created \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoft.windows.search SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\windows.search SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search\ = "56" SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search\ = "23" SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search SearchApp.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1668 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2904 trucking instructions.exe 756 powershell.exe 756 powershell.exe 1600 powershell.exe 1600 powershell.exe 2904 trucking instructions.exe 2904 trucking instructions.exe 1520 trucking instructions.exe 1520 trucking instructions.exe 1520 trucking instructions.exe 756 powershell.exe 1600 powershell.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe -
Suspicious behavior: LoadsDriver 64 IoCs
pid Process 1792 Process not Found 2456 Process not Found 4524 Process not Found 960 Process not Found 3460 Process not Found 4920 Process not Found 1764 Process not Found 2720 Process not Found 4340 Process not Found 1392 Process not Found 1028 Process not Found 404 Process not Found 1856 Process not Found 3216 Process not Found 3088 Process not Found 4420 Process not Found 1464 Process not Found 1844 Process not Found 4260 Process not Found 1936 Process not Found 5060 Process not Found 5000 Process not Found 2232 Process not Found 3404 Process not Found 1104 Process not Found 1412 Process not Found 1604 Process not Found 4916 Process not Found 408 Process not Found 3844 Process not Found 2472 Process not Found 4660 Process not Found 868 Process not Found 1712 Process not Found 4508 Process not Found 4492 Process not Found 3464 Process not Found 1360 Process not Found 4024 Process not Found 756 Process not Found 2824 Process not Found 3676 Process not Found 1920 Process not Found 1632 Process not Found 3128 Process not Found 4292 Process not Found 1564 Process not Found 4048 Process not Found 2988 Process not Found 4344 Process not Found 2748 Process not Found 4140 Process not Found 4232 Process not Found 1496 Process not Found 4752 Process not Found 3396 Process not Found 2900 Process not Found 3980 Process not Found 3548 Process not Found 4268 Process not Found 3052 Process not Found 448 Process not Found 4788 Process not Found 3992 Process not Found -
Suspicious use of AdjustPrivilegeToken 7 IoCs
description pid Process Token: SeDebugPrivilege 2904 trucking instructions.exe Token: SeDebugPrivilege 1600 powershell.exe Token: SeDebugPrivilege 756 powershell.exe Token: SeDebugPrivilege 1520 trucking instructions.exe Token: SeDebugPrivilege 5112 taskmgr.exe Token: SeSystemProfilePrivilege 5112 taskmgr.exe Token: SeCreateGlobalPrivilege 5112 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 1520 trucking instructions.exe 4688 StartMenuExperienceHost.exe 4136 SearchApp.exe 3524 LogonUI.exe -
Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 2904 wrote to memory of 756 2904 trucking instructions.exe 94 PID 2904 wrote to memory of 756 2904 trucking instructions.exe 94 PID 2904 wrote to memory of 756 2904 trucking instructions.exe 94 PID 2904 wrote to memory of 1600 2904 trucking instructions.exe 96 PID 2904 wrote to memory of 1600 2904 trucking instructions.exe 96 PID 2904 wrote to memory of 1600 2904 trucking instructions.exe 96 PID 2904 wrote to memory of 1668 2904 trucking instructions.exe 98 PID 2904 wrote to memory of 1668 2904 trucking instructions.exe 98 PID 2904 wrote to memory of 1668 2904 trucking instructions.exe 98 PID 2904 wrote to memory of 1520 2904 trucking instructions.exe 100 PID 2904 wrote to memory of 1520 2904 trucking instructions.exe 100 PID 2904 wrote to memory of 1520 2904 trucking instructions.exe 100 PID 2904 wrote to memory of 1520 2904 trucking instructions.exe 100 PID 2904 wrote to memory of 1520 2904 trucking instructions.exe 100 PID 2904 wrote to memory of 1520 2904 trucking instructions.exe 100 PID 2904 wrote to memory of 1520 2904 trucking instructions.exe 100 PID 2904 wrote to memory of 1520 2904 trucking instructions.exe 100
Processes
-
C:\Users\Admin\AppData\Local\Temp\trucking instructions.exe"C:\Users\Admin\AppData\Local\Temp\trucking instructions.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2904 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\trucking instructions.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:756
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\tepYWZPN.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1600
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\tepYWZPN" /XML "C:\Users\Admin\AppData\Local\Temp\tmpDC95.tmp"2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:1668
-
-
C:\Users\Admin\AppData\Local\Temp\trucking instructions.exe"C:\Users\Admin\AppData\Local\Temp\trucking instructions.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1520
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /71⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5112
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4688
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4136
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x0 /state0:0xa38e3055 /state1:0x41c64e6d1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:3524
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
4Credentials In Files
3Credentials in Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5968cb9309758126772781b83adb8a28f
SHA18da30e71accf186b2ba11da1797cf67f8f78b47c
SHA25692099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA5124bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3
-
Filesize
18KB
MD541339cde0905ac92ccb93540ca04d9a1
SHA1bb46c6a253c7ecb81e2692dc275d57a6c03f3558
SHA25630c4e47623b368ace7020a6374f76c90b3dd1d9a6bbb6c06d3ec6e48e800916f
SHA5128b06acebf717c98fdf32c8051ba574e3faa6c4d79d6a9af628f80124cde1d87827a600b51d1ef8ac3de5f44d347878b085ce52770e94af6658cce4359d1e007b
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
1KB
MD51195863c0ad93a1221ea971d1c9c5a43
SHA14339ec9f77b3d6fae28e9e15096dba2f29ab57b9
SHA25616e024f944df5de4b498b115bb355fb1e4c93f69bad661a20ad92e831902b92d
SHA5123bba7297fdf6de231308e5d972d8fafc5f709e4c4aa4f1cfa4af66ca8d5e6ac16e610f0b6efad4dde39f4adcacc6f35e0c46535baed4da1ebe630e0dfa5bb7c4