Overview
overview
10Static
static
1000b9b6cf27...f7.exe
windows7-x64
305500734fe...81.exe
windows7-x64
0b75e2fadf...c5.exe
windows7-x64
80d5fa75218...64.exe
windows7-x64
101760c5727e...9c.exe
windows7-x64
101fe99fb7c5...81.exe
windows7-x64
102336173567...98.exe
windows7-x64
102522b83852...03.exe
windows7-x64
102af6bc16f2...b2.exe
windows7-x64
103d9f9c162e...64.exe
windows7-x64
83db846a796...e5.exe
windows7-x64
10493813116f...dc.exe
windows7-x64
104d61a61265...08.exe
windows7-x64
10510827ce68...c5.exe
windows7-x64
105642f8bd3b...2a.exe
windows7-x64
106c37d14d5a...4c.exe
windows7-x64
106c3c9af653...c3.exe
windows7-x64
1077186e57b2...20.exe
windows7-x64
107bca70a81c...61.exe
windows7-x64
108e934dcd46...88.exe
windows7-x64
109a75c8e353...60.exe
windows7-x64
109e067453f0...f3.exe
windows7-x64
10Mydoom Ran...06.exe
windows7-x64
10Mydoom Ran...5c.exe
windows7-x64
10Mydoom Ran...fc.exe
windows7-x64
10Mydoom Ran...59.exe
windows7-x64
10Mydoom Ran...64.exe
windows7-x64
10Mydoom Ran...76.exe
windows7-x64
10a9a89ed0d1...0f.exe
windows7-x64
10b4ab8f5c8b...95.exe
windows7-x64
10c034313090...ef.exe
windows7-x64
8c45a330cf8...24.exe
windows7-x64
10Resubmissions
21-08-2024 19:30
240821-x76q3sweqg 1021-08-2024 17:42
240821-v92h2avgpj 1012-06-2024 16:01
240612-tgps4a1bqh 10Analysis
-
max time kernel
1556s -
max time network
1557s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
21-08-2024 17:42
Behavioral task
behavioral1
Sample
00b9b6cf27deeda8de99d1719ef724808afa92080026df8dd17159be8ea420f7.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
05500734fe07ac2b5bc89aa12b090203c4b74851cb0d62bd388f27ec6d6caa81.exe
Resource
win7-20240708-en
Behavioral task
behavioral3
Sample
0b75e2fadffc45dff940e58f5b6f8d99832426bb880f432f98d853308b29c9c5.exe
Resource
win7-20240708-en
Behavioral task
behavioral4
Sample
0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe
Resource
win7-20240704-en
Behavioral task
behavioral5
Sample
1760c5727e5568d3b18a1cbf0d50c311613699af8233c96fb3eee197f438ce9c.exe
Resource
win7-20240708-en
Behavioral task
behavioral6
Sample
1fe99fb7c527a90826896e695f23e712375358df3c7aa9163af6b96d872a9f81.exe
Resource
win7-20240705-en
Behavioral task
behavioral7
Sample
23361735678f37d77510b22306c727a987f84c87143bb0062f3d76413c36fc98.exe
Resource
win7-20240704-en
Behavioral task
behavioral8
Sample
2522b83852588bc0f7f620f9b4fe3a9337b9608be335d3958d190275f333df03.exe
Resource
win7-20240704-en
Behavioral task
behavioral9
Sample
2af6bc16f25822d6d2f1429bc15f3d47f6c0bcb026ba387249d173fc753919b2.exe
Resource
win7-20240708-en
Behavioral task
behavioral10
Sample
3d9f9c162e130c197301adb5a4e141f2e1ae8a19c85b457c429e8410a5c91464.exe
Resource
win7-20240705-en
Behavioral task
behavioral11
Sample
3db846a796caa001666df8f7cae709fff02f984711b0e70e0e79c457d631b4e5.exe
Resource
win7-20240708-en
Behavioral task
behavioral12
Sample
493813116f32ad6f455676cd54e32a2167ece845038202614cbb49e126f5afdc.exe
Resource
win7-20240708-en
Behavioral task
behavioral13
Sample
4d61a61265cdd942cff973609170529eaf19579b5d17e64deccbd6f6f1fdfa08.exe
Resource
win7-20240704-en
Behavioral task
behavioral14
Sample
510827ce687ad00545a1726c25a00f65e7d685b7dcd857fc6f11a0392feee5c5.exe
Resource
win7-20240705-en
Behavioral task
behavioral15
Sample
5642f8bd3bc151349ded1a3c160c037c26194c9da2b7ace5d8ca11cddb57612a.exe
Resource
win7-20240704-en
Behavioral task
behavioral16
Sample
6c37d14d5ad674e4c0fa8df0a999be6b27399936c9ff16f7fb30b802addb7b4c.exe
Resource
win7-20240705-en
Behavioral task
behavioral17
Sample
6c3c9af653a28977257ce971ed701b1b893cdf67d5c57baa44a9d76c28675dc3.exe
Resource
win7-20240704-en
Behavioral task
behavioral18
Sample
77186e57b2eeb3ed4b56cfe280d5eeea3155d9502217cda824600bc93d365320.exe
Resource
win7-20240704-en
Behavioral task
behavioral19
Sample
7bca70a81cc9e1067e99e313802a4cc095f79bbc3a1aa86b7b3b9eabf3748e61.exe
Resource
win7-20240729-en
Behavioral task
behavioral20
Sample
8e934dcd46eb57d42712d097deab6ce00ef1ce2db87d03f8d3d8e8c10da7e088.exe
Resource
win7-20240704-en
Behavioral task
behavioral21
Sample
9a75c8e353df060ec927ada5990402b57764275f2a860d9cf500a661ec3de060.exe
Resource
win7-20240708-en
Behavioral task
behavioral22
Sample
9e067453f09c5cbfa4c5a74fe3e70d7d8e66a25057e6c35240dce5a40ec31bf3.exe
Resource
win7-20240708-en
Behavioral task
behavioral23
Sample
Mydoom Ransomwares/1a174a556ce8e7a22c66f515ae1591f775bb673e989d5a39334f901edccf5406.exe
Resource
win7-20240729-en
Behavioral task
behavioral24
Sample
Mydoom Ransomwares/1fb613ee3b0e7f96f5dea029aae31b86340b0724e88f84a76b386af84d1cf95c.exe
Resource
win7-20240704-en
Behavioral task
behavioral25
Sample
Mydoom Ransomwares/5458f18e36de21d20b713f7acd8575fc8a86330c466e1b9dc6f41bc81f3e79fc.exe
Resource
win7-20240704-en
Behavioral task
behavioral26
Sample
Mydoom Ransomwares/84ee7e5c055fd25204ca4969940292b03da9d45b5048cbb7f7ba8528b88a2859.exe
Resource
win7-20240704-en
Behavioral task
behavioral27
Sample
Mydoom Ransomwares/cc3b570fa8f87354f06a20d8873c45087684c217f1b434b3b0048acd96fe3e64.exe
Resource
win7-20240705-en
Behavioral task
behavioral28
Sample
Mydoom Ransomwares/dd286a4d79d0f4c2b906073c7f46680252ca09c1c39b0dc12c92097c56662876.exe
Resource
win7-20240708-en
Behavioral task
behavioral29
Sample
a9a89ed0d139fbc436794f5d3a8e58c547247039d8c86767b1e2f2bce40e390f.exe
Resource
win7-20240708-en
Behavioral task
behavioral30
Sample
b4ab8f5c8b97307b328ba30fdefdbe4341c4e2c576729fdb5c7329d5b07bb695.exe
Resource
win7-20240708-en
Behavioral task
behavioral31
Sample
c03431309015563257e5e118656d07ce136f151339054b9f66894ecf9dde9aef.exe
Resource
win7-20240708-en
General
-
Target
0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe
-
Size
9.4MB
-
MD5
813b749967045532f86e6442447bcd8b
-
SHA1
8d0615e7f7ba672a3fc94c05a9451f9d08797af7
-
SHA256
0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464
-
SHA512
47c16f403ab33ebb9e59c7c3a053dc29d0d654174d2be9153966ad9fc873e641f34ab44c7e38fb4c6fd376b384d4e1da0dacafb384e9abb1c7eb92cb32533877
-
SSDEEP
24576:GYx7SFGwWG8/Ad5kybgeK8uQY2ZqR7NlaDbTxnVhv2MMLdGIhJ:IFFbK8q2ZhDbTNv2MuV
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
resource yara_rule behavioral4/memory/2776-17-0x0000000000400000-0x0000000000538000-memory.dmp dcrat behavioral4/memory/2776-16-0x0000000000400000-0x0000000000538000-memory.dmp dcrat behavioral4/memory/2776-15-0x0000000000400000-0x0000000000538000-memory.dmp dcrat behavioral4/memory/2776-10-0x0000000000400000-0x0000000000538000-memory.dmp dcrat behavioral4/memory/2776-8-0x0000000000400000-0x0000000000538000-memory.dmp dcrat behavioral4/memory/2776-13-0x0000000000400000-0x0000000000538000-memory.dmp dcrat -
Executes dropped EXE 2 IoCs
pid Process 2844 lsass.exe 1912 lsass.exe -
Loads dropped DLL 2 IoCs
pid Process 2776 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 2776 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 16 IoCs
pid Process 2652 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 2652 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 2652 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 2652 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 2652 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 2652 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 2652 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 2652 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 2844 lsass.exe 2844 lsass.exe 2844 lsass.exe 2844 lsass.exe 2844 lsass.exe 2844 lsass.exe 2844 lsass.exe 2844 lsass.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 2652 set thread context of 2776 2652 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 40 PID 2844 set thread context of 1912 2844 lsass.exe 60 -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files\Uninstall Information\lsass.exe 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe File created C:\Program Files\Uninstall Information\6203df4a6bafc7c328ee7f6f8ca0a8a838a8a1b9 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 20 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lsass.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lsass.exe -
Delays execution with timeout.exe 6 IoCs
pid Process 1988 timeout.exe 2316 timeout.exe 2408 timeout.exe 2284 timeout.exe 2772 timeout.exe 820 timeout.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 4 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2788 schtasks.exe 2880 schtasks.exe 2596 schtasks.exe 2704 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 2652 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 2652 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 2652 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 2776 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 2844 lsass.exe 2844 lsass.exe 2844 lsass.exe 1912 lsass.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 2652 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe Token: SeDebugPrivilege 2776 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe Token: SeDebugPrivilege 2844 lsass.exe Token: SeDebugPrivilege 1912 lsass.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2652 wrote to memory of 1568 2652 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 31 PID 2652 wrote to memory of 1568 2652 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 31 PID 2652 wrote to memory of 1568 2652 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 31 PID 2652 wrote to memory of 1568 2652 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 31 PID 1568 wrote to memory of 2408 1568 cmd.exe 33 PID 1568 wrote to memory of 2408 1568 cmd.exe 33 PID 1568 wrote to memory of 2408 1568 cmd.exe 33 PID 1568 wrote to memory of 2408 1568 cmd.exe 33 PID 2652 wrote to memory of 1972 2652 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 34 PID 2652 wrote to memory of 1972 2652 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 34 PID 2652 wrote to memory of 1972 2652 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 34 PID 2652 wrote to memory of 1972 2652 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 34 PID 1972 wrote to memory of 2284 1972 cmd.exe 36 PID 1972 wrote to memory of 2284 1972 cmd.exe 36 PID 1972 wrote to memory of 2284 1972 cmd.exe 36 PID 1972 wrote to memory of 2284 1972 cmd.exe 36 PID 2652 wrote to memory of 2676 2652 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 37 PID 2652 wrote to memory of 2676 2652 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 37 PID 2652 wrote to memory of 2676 2652 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 37 PID 2652 wrote to memory of 2676 2652 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 37 PID 2676 wrote to memory of 2772 2676 cmd.exe 39 PID 2676 wrote to memory of 2772 2676 cmd.exe 39 PID 2676 wrote to memory of 2772 2676 cmd.exe 39 PID 2676 wrote to memory of 2772 2676 cmd.exe 39 PID 2652 wrote to memory of 2776 2652 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 40 PID 2652 wrote to memory of 2776 2652 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 40 PID 2652 wrote to memory of 2776 2652 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 40 PID 2652 wrote to memory of 2776 2652 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 40 PID 2652 wrote to memory of 2776 2652 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 40 PID 2652 wrote to memory of 2776 2652 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 40 PID 2652 wrote to memory of 2776 2652 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 40 PID 2652 wrote to memory of 2776 2652 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 40 PID 2652 wrote to memory of 2776 2652 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 40 PID 2652 wrote to memory of 2776 2652 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 40 PID 2776 wrote to memory of 2788 2776 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 42 PID 2776 wrote to memory of 2788 2776 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 42 PID 2776 wrote to memory of 2788 2776 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 42 PID 2776 wrote to memory of 2788 2776 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 42 PID 2776 wrote to memory of 2880 2776 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 44 PID 2776 wrote to memory of 2880 2776 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 44 PID 2776 wrote to memory of 2880 2776 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 44 PID 2776 wrote to memory of 2880 2776 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 44 PID 2776 wrote to memory of 2596 2776 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 46 PID 2776 wrote to memory of 2596 2776 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 46 PID 2776 wrote to memory of 2596 2776 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 46 PID 2776 wrote to memory of 2596 2776 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 46 PID 2776 wrote to memory of 2704 2776 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 48 PID 2776 wrote to memory of 2704 2776 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 48 PID 2776 wrote to memory of 2704 2776 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 48 PID 2776 wrote to memory of 2704 2776 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 48 PID 2776 wrote to memory of 2844 2776 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 50 PID 2776 wrote to memory of 2844 2776 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 50 PID 2776 wrote to memory of 2844 2776 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 50 PID 2776 wrote to memory of 2844 2776 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 50 PID 2844 wrote to memory of 2116 2844 lsass.exe 51 PID 2844 wrote to memory of 2116 2844 lsass.exe 51 PID 2844 wrote to memory of 2116 2844 lsass.exe 51 PID 2844 wrote to memory of 2116 2844 lsass.exe 51 PID 2116 wrote to memory of 820 2116 cmd.exe 53 PID 2116 wrote to memory of 820 2116 cmd.exe 53 PID 2116 wrote to memory of 820 2116 cmd.exe 53 PID 2116 wrote to memory of 820 2116 cmd.exe 53 PID 2844 wrote to memory of 1980 2844 lsass.exe 54 PID 2844 wrote to memory of 1980 2844 lsass.exe 54
Processes
-
C:\Users\Admin\AppData\Local\Temp\0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe"C:\Users\Admin\AppData\Local\Temp\0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2652 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1568 -
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:2408
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1972 -
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:2284
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2676 -
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:2772
-
-
-
C:\Users\Admin\AppData\Local\Temp\0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe"C:\Users\Admin\AppData\Local\Temp\0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe"2⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2776 -
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\5ba42562-3a8b-11ef-9d17-d685e2345d05\csrss.exe'" /rl HIGHEST /f3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2788
-
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "Idle" /sc ONLOGON /tr "'C:\PerfLogs\Admin\Idle.exe'" /rl HIGHEST /f3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2880
-
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "lsass" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\1033\lsass.exe'" /rl HIGHEST /f3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2596
-
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files\Uninstall Information\lsass.exe'" /rl HIGHEST /f3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2704
-
-
C:\Program Files\Uninstall Information\lsass.exe"C:\Program Files\Uninstall Information\lsass.exe"3⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 14⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2116 -
C:\Windows\SysWOW64\timeout.exetimeout 15⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:820
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 14⤵
- System Location Discovery: System Language Discovery
PID:1980 -
C:\Windows\SysWOW64\timeout.exetimeout 15⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:1988
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 14⤵
- System Location Discovery: System Language Discovery
PID:1956 -
C:\Windows\SysWOW64\timeout.exetimeout 15⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:2316
-
-
-
C:\Program Files\Uninstall Information\lsass.exe"C:\Program Files\Uninstall Information\lsass.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1912
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
9.4MB
MD5813b749967045532f86e6442447bcd8b
SHA18d0615e7f7ba672a3fc94c05a9451f9d08797af7
SHA2560d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464
SHA51247c16f403ab33ebb9e59c7c3a053dc29d0d654174d2be9153966ad9fc873e641f34ab44c7e38fb4c6fd376b384d4e1da0dacafb384e9abb1c7eb92cb32533877