Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
144s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
29/08/2024, 17:46
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b5c571cbe24b37359eb4018bac19e37a2ffc6108d6d1cb5c8c22640397c47596.exe
Resource
win7-20240729-en
windows7-x64
16 signatures
150 seconds
Behavioral task
behavioral2
Sample
b5c571cbe24b37359eb4018bac19e37a2ffc6108d6d1cb5c8c22640397c47596.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
14 signatures
150 seconds
General
-
Target
b5c571cbe24b37359eb4018bac19e37a2ffc6108d6d1cb5c8c22640397c47596.exe
-
Size
2.2MB
-
MD5
af67f113f6de4648aadc9d7a0be4d0ca
-
SHA1
d7697c61fe6ca142da8d9a3b14af32ad78778622
-
SHA256
b5c571cbe24b37359eb4018bac19e37a2ffc6108d6d1cb5c8c22640397c47596
-
SHA512
0ac58161384ae0993fb23516f708db06bd05424c666569c17f7e4cd6e9a563ff28a6bf415e1c60f4492d8dbbbb618a2e7064b58839bf0380afe6e6d62ff0f3eb
-
SSDEEP
24576:Pe6u/p6D3RSWGDBqSfHfXBYnvakaYhF+Ma1eCFd1Zz9ItONK+ehkrh2J:POB6zYBvGv95F+MqZFdHwVhOcJ
Malware Config
Signatures
-
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
-
Executes dropped EXE 2 IoCs
pid Process 852 pptpcms.exe 2784 fssrv.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 b5c571cbe24b37359eb4018bac19e37a2ffc6108d6d1cb5c8c22640397c47596.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives 3 TTPs 42 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: b5c571cbe24b37359eb4018bac19e37a2ffc6108d6d1cb5c8c22640397c47596.exe File opened (read-only) \??\T: b5c571cbe24b37359eb4018bac19e37a2ffc6108d6d1cb5c8c22640397c47596.exe File opened (read-only) \??\I: fssrv.exe File opened (read-only) \??\N: fssrv.exe File opened (read-only) \??\X: b5c571cbe24b37359eb4018bac19e37a2ffc6108d6d1cb5c8c22640397c47596.exe File opened (read-only) \??\H: b5c571cbe24b37359eb4018bac19e37a2ffc6108d6d1cb5c8c22640397c47596.exe File opened (read-only) \??\U: b5c571cbe24b37359eb4018bac19e37a2ffc6108d6d1cb5c8c22640397c47596.exe File opened (read-only) \??\N: b5c571cbe24b37359eb4018bac19e37a2ffc6108d6d1cb5c8c22640397c47596.exe File opened (read-only) \??\G: fssrv.exe File opened (read-only) \??\Q: b5c571cbe24b37359eb4018bac19e37a2ffc6108d6d1cb5c8c22640397c47596.exe File opened (read-only) \??\X: fssrv.exe File opened (read-only) \??\W: fssrv.exe File opened (read-only) \??\V: fssrv.exe File opened (read-only) \??\L: fssrv.exe File opened (read-only) \??\Y: b5c571cbe24b37359eb4018bac19e37a2ffc6108d6d1cb5c8c22640397c47596.exe File opened (read-only) \??\I: b5c571cbe24b37359eb4018bac19e37a2ffc6108d6d1cb5c8c22640397c47596.exe File opened (read-only) \??\P: fssrv.exe File opened (read-only) \??\T: fssrv.exe File opened (read-only) \??\Q: fssrv.exe File opened (read-only) \??\K: b5c571cbe24b37359eb4018bac19e37a2ffc6108d6d1cb5c8c22640397c47596.exe File opened (read-only) \??\S: b5c571cbe24b37359eb4018bac19e37a2ffc6108d6d1cb5c8c22640397c47596.exe File opened (read-only) \??\H: fssrv.exe File opened (read-only) \??\U: fssrv.exe File opened (read-only) \??\O: fssrv.exe File opened (read-only) \??\M: fssrv.exe File opened (read-only) \??\J: fssrv.exe File opened (read-only) \??\R: fssrv.exe File opened (read-only) \??\G: b5c571cbe24b37359eb4018bac19e37a2ffc6108d6d1cb5c8c22640397c47596.exe File opened (read-only) \??\W: b5c571cbe24b37359eb4018bac19e37a2ffc6108d6d1cb5c8c22640397c47596.exe File opened (read-only) \??\V: b5c571cbe24b37359eb4018bac19e37a2ffc6108d6d1cb5c8c22640397c47596.exe File opened (read-only) \??\R: b5c571cbe24b37359eb4018bac19e37a2ffc6108d6d1cb5c8c22640397c47596.exe File opened (read-only) \??\L: b5c571cbe24b37359eb4018bac19e37a2ffc6108d6d1cb5c8c22640397c47596.exe File opened (read-only) \??\J: b5c571cbe24b37359eb4018bac19e37a2ffc6108d6d1cb5c8c22640397c47596.exe File opened (read-only) \??\Y: fssrv.exe File opened (read-only) \??\Z: b5c571cbe24b37359eb4018bac19e37a2ffc6108d6d1cb5c8c22640397c47596.exe File opened (read-only) \??\O: b5c571cbe24b37359eb4018bac19e37a2ffc6108d6d1cb5c8c22640397c47596.exe File opened (read-only) \??\Z: fssrv.exe File opened (read-only) \??\K: fssrv.exe File opened (read-only) \??\P: b5c571cbe24b37359eb4018bac19e37a2ffc6108d6d1cb5c8c22640397c47596.exe File opened (read-only) \??\M: b5c571cbe24b37359eb4018bac19e37a2ffc6108d6d1cb5c8c22640397c47596.exe File opened (read-only) \??\E: fssrv.exe File opened (read-only) \??\S: fssrv.exe -
Drops file in System32 directory 16 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\dhcpeng.exe b5c571cbe24b37359eb4018bac19e37a2ffc6108d6d1cb5c8c22640397c47596.exe File created C:\Windows\SysWOW64\dhcpeng.exe b5c571cbe24b37359eb4018bac19e37a2ffc6108d6d1cb5c8c22640397c47596.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE fssrv.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies fssrv.exe File created C:\Windows\SysWOW64\netsys.scr b5c571cbe24b37359eb4018bac19e37a2ffc6108d6d1cb5c8c22640397c47596.exe File opened for modification C:\Windows\SysWOW64\fssrv.exe b5c571cbe24b37359eb4018bac19e37a2ffc6108d6d1cb5c8c22640397c47596.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\Contacts fssrv.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 fssrv.exe File opened for modification C:\Windows\SysWOW64\pptpcms.exe b5c571cbe24b37359eb4018bac19e37a2ffc6108d6d1cb5c8c22640397c47596.exe File opened for modification C:\Windows\SysWOW64\netsys.scr b5c571cbe24b37359eb4018bac19e37a2ffc6108d6d1cb5c8c22640397c47596.exe File created C:\Windows\SysWOW64\fsobj.scr b5c571cbe24b37359eb4018bac19e37a2ffc6108d6d1cb5c8c22640397c47596.exe File created C:\Windows\SysWOW64\fssrv.exe b5c571cbe24b37359eb4018bac19e37a2ffc6108d6d1cb5c8c22640397c47596.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\Contacts\desktop.ini fssrv.exe File created C:\Windows\SysWOW64\pptpcms.exe b5c571cbe24b37359eb4018bac19e37a2ffc6108d6d1cb5c8c22640397c47596.exe File opened for modification C:\Windows\SysWOW64\fsobj.scr b5c571cbe24b37359eb4018bac19e37a2ffc6108d6d1cb5c8c22640397c47596.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 fssrv.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b5c571cbe24b37359eb4018bac19e37a2ffc6108d6d1cb5c8c22640397c47596.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pptpcms.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fssrv.exe -
Modifies Control Panel 5 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\Desktop b5c571cbe24b37359eb4018bac19e37a2ffc6108d6d1cb5c8c22640397c47596.exe Set value (str) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\Desktop\ScreenSaveBackup b5c571cbe24b37359eb4018bac19e37a2ffc6108d6d1cb5c8c22640397c47596.exe Set value (str) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\SysWOW64\\fsobj.scr" b5c571cbe24b37359eb4018bac19e37a2ffc6108d6d1cb5c8c22640397c47596.exe Set value (str) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\Desktop\ScreenSaveUtility = "C:\\Windows\\SysWOW64\\netsys.scr" b5c571cbe24b37359eb4018bac19e37a2ffc6108d6d1cb5c8c22640397c47596.exe Set value (str) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\Desktop\ScreenSaveTimeOut = "60" b5c571cbe24b37359eb4018bac19e37a2ffc6108d6d1cb5c8c22640397c47596.exe -
Modifies data under HKEY_USERS 12 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced fssrv.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\EnableBalloonTips = "0" fssrv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\WAB fssrv.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\WAB\NamedProps = 0420060000000000c00000000000004608000000000000800e0000000100330032003800350034000000000001800e0000000100330032003800350035000000000002800e0000000100330032003800350036000000000003800e000000010033003200380035003700000000000f800e0000000100330032003800310032000000000010800e0000000100330032003800310033000000000011800e0000000100330032003800310034000000000012800e0000000100330032003800300032000000813284c18505d011b29000aa003cf6760b000000000004800e0000000100330032003700360039000000000005800e0000000100330032003700370030000000000006800e0000000100330032003700370031000000000007800e0000000100330032003700370032000000000008800e0000000100330032003700370033000000000009800e000000010033003200370037003400000000000a800e000000010033003200370037003500000000000b800e000000010033003200370037003600000000000c800e000000010033003200370037003700000000000d800e000000010033003200370037003800000000000e800e0000000100330032003700370039000000 fssrv.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" fssrv.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\WAB\NamedProps = 0420060000000000c00000000000004604000000000000800e0000000100330032003800350034000000000001800e0000000100330032003800350035000000000002800e0000000100330032003800350036000000000003800e0000000100330032003800350037000000 fssrv.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\WAB\NamedPropCount = "1" fssrv.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\WAB\NamedProps = 0420060000000000c00000000000004604000000000000800e0000000100330032003800350034000000000001800e0000000100330032003800350035000000000002800e0000000100330032003800350036000000000003800e0000000100330032003800350037000000813284c18505d011b29000aa003cf6760b000000000004800e0000000100330032003700360039000000000005800e0000000100330032003700370030000000000006800e0000000100330032003700370031000000000007800e0000000100330032003700370032000000000008800e0000000100330032003700370033000000000009800e000000010033003200370037003400000000000a800e000000010033003200370037003500000000000b800e000000010033003200370037003600000000000c800e000000010033003200370037003700000000000d800e000000010033003200370037003800000000000e800e0000000100330032003700370039000000 fssrv.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\WAB\NamedPropCount = "2" fssrv.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\WAB\NamedProps = 0420060000000000c00000000000004607000000000000800e0000000100330032003800350034000000000001800e0000000100330032003800350035000000000002800e0000000100330032003800350036000000000003800e000000010033003200380035003700000000000f800e0000000100330032003800310032000000000010800e0000000100330032003800310033000000000011800e0000000100330032003800310034000000813284c18505d011b29000aa003cf6760b000000000004800e0000000100330032003700360039000000000005800e0000000100330032003700370030000000000006800e0000000100330032003700370031000000000007800e0000000100330032003700370032000000000008800e0000000100330032003700370033000000000009800e000000010033003200370037003400000000000a800e000000010033003200370037003500000000000b800e000000010033003200370037003600000000000c800e000000010033003200370037003700000000000d800e000000010033003200370037003800000000000e800e0000000100330032003700370039000000 fssrv.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix fssrv.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" fssrv.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4068 b5c571cbe24b37359eb4018bac19e37a2ffc6108d6d1cb5c8c22640397c47596.exe 4068 b5c571cbe24b37359eb4018bac19e37a2ffc6108d6d1cb5c8c22640397c47596.exe 4068 b5c571cbe24b37359eb4018bac19e37a2ffc6108d6d1cb5c8c22640397c47596.exe 4068 b5c571cbe24b37359eb4018bac19e37a2ffc6108d6d1cb5c8c22640397c47596.exe 4068 b5c571cbe24b37359eb4018bac19e37a2ffc6108d6d1cb5c8c22640397c47596.exe 4068 b5c571cbe24b37359eb4018bac19e37a2ffc6108d6d1cb5c8c22640397c47596.exe 4068 b5c571cbe24b37359eb4018bac19e37a2ffc6108d6d1cb5c8c22640397c47596.exe 4068 b5c571cbe24b37359eb4018bac19e37a2ffc6108d6d1cb5c8c22640397c47596.exe 4068 b5c571cbe24b37359eb4018bac19e37a2ffc6108d6d1cb5c8c22640397c47596.exe 4068 b5c571cbe24b37359eb4018bac19e37a2ffc6108d6d1cb5c8c22640397c47596.exe 4068 b5c571cbe24b37359eb4018bac19e37a2ffc6108d6d1cb5c8c22640397c47596.exe 4068 b5c571cbe24b37359eb4018bac19e37a2ffc6108d6d1cb5c8c22640397c47596.exe 4068 b5c571cbe24b37359eb4018bac19e37a2ffc6108d6d1cb5c8c22640397c47596.exe 4068 b5c571cbe24b37359eb4018bac19e37a2ffc6108d6d1cb5c8c22640397c47596.exe 4068 b5c571cbe24b37359eb4018bac19e37a2ffc6108d6d1cb5c8c22640397c47596.exe 4068 b5c571cbe24b37359eb4018bac19e37a2ffc6108d6d1cb5c8c22640397c47596.exe 4068 b5c571cbe24b37359eb4018bac19e37a2ffc6108d6d1cb5c8c22640397c47596.exe 4068 b5c571cbe24b37359eb4018bac19e37a2ffc6108d6d1cb5c8c22640397c47596.exe 4068 b5c571cbe24b37359eb4018bac19e37a2ffc6108d6d1cb5c8c22640397c47596.exe 4068 b5c571cbe24b37359eb4018bac19e37a2ffc6108d6d1cb5c8c22640397c47596.exe 4068 b5c571cbe24b37359eb4018bac19e37a2ffc6108d6d1cb5c8c22640397c47596.exe 4068 b5c571cbe24b37359eb4018bac19e37a2ffc6108d6d1cb5c8c22640397c47596.exe 4068 b5c571cbe24b37359eb4018bac19e37a2ffc6108d6d1cb5c8c22640397c47596.exe 4068 b5c571cbe24b37359eb4018bac19e37a2ffc6108d6d1cb5c8c22640397c47596.exe 4068 b5c571cbe24b37359eb4018bac19e37a2ffc6108d6d1cb5c8c22640397c47596.exe 4068 b5c571cbe24b37359eb4018bac19e37a2ffc6108d6d1cb5c8c22640397c47596.exe 4068 b5c571cbe24b37359eb4018bac19e37a2ffc6108d6d1cb5c8c22640397c47596.exe 4068 b5c571cbe24b37359eb4018bac19e37a2ffc6108d6d1cb5c8c22640397c47596.exe 4068 b5c571cbe24b37359eb4018bac19e37a2ffc6108d6d1cb5c8c22640397c47596.exe 4068 b5c571cbe24b37359eb4018bac19e37a2ffc6108d6d1cb5c8c22640397c47596.exe 4068 b5c571cbe24b37359eb4018bac19e37a2ffc6108d6d1cb5c8c22640397c47596.exe 4068 b5c571cbe24b37359eb4018bac19e37a2ffc6108d6d1cb5c8c22640397c47596.exe 4068 b5c571cbe24b37359eb4018bac19e37a2ffc6108d6d1cb5c8c22640397c47596.exe 4068 b5c571cbe24b37359eb4018bac19e37a2ffc6108d6d1cb5c8c22640397c47596.exe 4068 b5c571cbe24b37359eb4018bac19e37a2ffc6108d6d1cb5c8c22640397c47596.exe 4068 b5c571cbe24b37359eb4018bac19e37a2ffc6108d6d1cb5c8c22640397c47596.exe 4068 b5c571cbe24b37359eb4018bac19e37a2ffc6108d6d1cb5c8c22640397c47596.exe 4068 b5c571cbe24b37359eb4018bac19e37a2ffc6108d6d1cb5c8c22640397c47596.exe 4068 b5c571cbe24b37359eb4018bac19e37a2ffc6108d6d1cb5c8c22640397c47596.exe 4068 b5c571cbe24b37359eb4018bac19e37a2ffc6108d6d1cb5c8c22640397c47596.exe 4068 b5c571cbe24b37359eb4018bac19e37a2ffc6108d6d1cb5c8c22640397c47596.exe 4068 b5c571cbe24b37359eb4018bac19e37a2ffc6108d6d1cb5c8c22640397c47596.exe 4068 b5c571cbe24b37359eb4018bac19e37a2ffc6108d6d1cb5c8c22640397c47596.exe 4068 b5c571cbe24b37359eb4018bac19e37a2ffc6108d6d1cb5c8c22640397c47596.exe 4068 b5c571cbe24b37359eb4018bac19e37a2ffc6108d6d1cb5c8c22640397c47596.exe 4068 b5c571cbe24b37359eb4018bac19e37a2ffc6108d6d1cb5c8c22640397c47596.exe 4068 b5c571cbe24b37359eb4018bac19e37a2ffc6108d6d1cb5c8c22640397c47596.exe 4068 b5c571cbe24b37359eb4018bac19e37a2ffc6108d6d1cb5c8c22640397c47596.exe 4068 b5c571cbe24b37359eb4018bac19e37a2ffc6108d6d1cb5c8c22640397c47596.exe 4068 b5c571cbe24b37359eb4018bac19e37a2ffc6108d6d1cb5c8c22640397c47596.exe 4068 b5c571cbe24b37359eb4018bac19e37a2ffc6108d6d1cb5c8c22640397c47596.exe 4068 b5c571cbe24b37359eb4018bac19e37a2ffc6108d6d1cb5c8c22640397c47596.exe 4068 b5c571cbe24b37359eb4018bac19e37a2ffc6108d6d1cb5c8c22640397c47596.exe 4068 b5c571cbe24b37359eb4018bac19e37a2ffc6108d6d1cb5c8c22640397c47596.exe 4068 b5c571cbe24b37359eb4018bac19e37a2ffc6108d6d1cb5c8c22640397c47596.exe 4068 b5c571cbe24b37359eb4018bac19e37a2ffc6108d6d1cb5c8c22640397c47596.exe 4068 b5c571cbe24b37359eb4018bac19e37a2ffc6108d6d1cb5c8c22640397c47596.exe 4068 b5c571cbe24b37359eb4018bac19e37a2ffc6108d6d1cb5c8c22640397c47596.exe 4068 b5c571cbe24b37359eb4018bac19e37a2ffc6108d6d1cb5c8c22640397c47596.exe 4068 b5c571cbe24b37359eb4018bac19e37a2ffc6108d6d1cb5c8c22640397c47596.exe 4068 b5c571cbe24b37359eb4018bac19e37a2ffc6108d6d1cb5c8c22640397c47596.exe 4068 b5c571cbe24b37359eb4018bac19e37a2ffc6108d6d1cb5c8c22640397c47596.exe 4068 b5c571cbe24b37359eb4018bac19e37a2ffc6108d6d1cb5c8c22640397c47596.exe 4068 b5c571cbe24b37359eb4018bac19e37a2ffc6108d6d1cb5c8c22640397c47596.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4068 b5c571cbe24b37359eb4018bac19e37a2ffc6108d6d1cb5c8c22640397c47596.exe Token: SeChangeNotifyPrivilege 4068 b5c571cbe24b37359eb4018bac19e37a2ffc6108d6d1cb5c8c22640397c47596.exe Token: SeBackupPrivilege 4068 b5c571cbe24b37359eb4018bac19e37a2ffc6108d6d1cb5c8c22640397c47596.exe Token: SeBackupPrivilege 4068 b5c571cbe24b37359eb4018bac19e37a2ffc6108d6d1cb5c8c22640397c47596.exe Token: SeBackupPrivilege 4068 b5c571cbe24b37359eb4018bac19e37a2ffc6108d6d1cb5c8c22640397c47596.exe Token: SeBackupPrivilege 4068 b5c571cbe24b37359eb4018bac19e37a2ffc6108d6d1cb5c8c22640397c47596.exe Token: SeBackupPrivilege 4068 b5c571cbe24b37359eb4018bac19e37a2ffc6108d6d1cb5c8c22640397c47596.exe Token: SeBackupPrivilege 4068 b5c571cbe24b37359eb4018bac19e37a2ffc6108d6d1cb5c8c22640397c47596.exe Token: SeBackupPrivilege 4068 b5c571cbe24b37359eb4018bac19e37a2ffc6108d6d1cb5c8c22640397c47596.exe Token: SeBackupPrivilege 4068 b5c571cbe24b37359eb4018bac19e37a2ffc6108d6d1cb5c8c22640397c47596.exe Token: SeBackupPrivilege 4068 b5c571cbe24b37359eb4018bac19e37a2ffc6108d6d1cb5c8c22640397c47596.exe Token: SeBackupPrivilege 4068 b5c571cbe24b37359eb4018bac19e37a2ffc6108d6d1cb5c8c22640397c47596.exe Token: SeBackupPrivilege 4068 b5c571cbe24b37359eb4018bac19e37a2ffc6108d6d1cb5c8c22640397c47596.exe Token: SeBackupPrivilege 4068 b5c571cbe24b37359eb4018bac19e37a2ffc6108d6d1cb5c8c22640397c47596.exe Token: SeBackupPrivilege 4068 b5c571cbe24b37359eb4018bac19e37a2ffc6108d6d1cb5c8c22640397c47596.exe Token: SeBackupPrivilege 4068 b5c571cbe24b37359eb4018bac19e37a2ffc6108d6d1cb5c8c22640397c47596.exe Token: SeBackupPrivilege 4068 b5c571cbe24b37359eb4018bac19e37a2ffc6108d6d1cb5c8c22640397c47596.exe Token: SeBackupPrivilege 4068 b5c571cbe24b37359eb4018bac19e37a2ffc6108d6d1cb5c8c22640397c47596.exe Token: SeBackupPrivilege 4068 b5c571cbe24b37359eb4018bac19e37a2ffc6108d6d1cb5c8c22640397c47596.exe Token: SeBackupPrivilege 4068 b5c571cbe24b37359eb4018bac19e37a2ffc6108d6d1cb5c8c22640397c47596.exe Token: SeBackupPrivilege 4068 b5c571cbe24b37359eb4018bac19e37a2ffc6108d6d1cb5c8c22640397c47596.exe Token: SeBackupPrivilege 4068 b5c571cbe24b37359eb4018bac19e37a2ffc6108d6d1cb5c8c22640397c47596.exe Token: SeBackupPrivilege 4068 b5c571cbe24b37359eb4018bac19e37a2ffc6108d6d1cb5c8c22640397c47596.exe Token: SeBackupPrivilege 4068 b5c571cbe24b37359eb4018bac19e37a2ffc6108d6d1cb5c8c22640397c47596.exe Token: SeBackupPrivilege 4068 b5c571cbe24b37359eb4018bac19e37a2ffc6108d6d1cb5c8c22640397c47596.exe Token: SeBackupPrivilege 4068 b5c571cbe24b37359eb4018bac19e37a2ffc6108d6d1cb5c8c22640397c47596.exe Token: SeBackupPrivilege 4068 b5c571cbe24b37359eb4018bac19e37a2ffc6108d6d1cb5c8c22640397c47596.exe Token: SeBackupPrivilege 4068 b5c571cbe24b37359eb4018bac19e37a2ffc6108d6d1cb5c8c22640397c47596.exe Token: SeBackupPrivilege 4068 b5c571cbe24b37359eb4018bac19e37a2ffc6108d6d1cb5c8c22640397c47596.exe Token: SeBackupPrivilege 4068 b5c571cbe24b37359eb4018bac19e37a2ffc6108d6d1cb5c8c22640397c47596.exe Token: SeBackupPrivilege 4068 b5c571cbe24b37359eb4018bac19e37a2ffc6108d6d1cb5c8c22640397c47596.exe Token: SeBackupPrivilege 4068 b5c571cbe24b37359eb4018bac19e37a2ffc6108d6d1cb5c8c22640397c47596.exe Token: SeBackupPrivilege 4068 b5c571cbe24b37359eb4018bac19e37a2ffc6108d6d1cb5c8c22640397c47596.exe Token: SeBackupPrivilege 4068 b5c571cbe24b37359eb4018bac19e37a2ffc6108d6d1cb5c8c22640397c47596.exe Token: SeBackupPrivilege 4068 b5c571cbe24b37359eb4018bac19e37a2ffc6108d6d1cb5c8c22640397c47596.exe Token: SeBackupPrivilege 4068 b5c571cbe24b37359eb4018bac19e37a2ffc6108d6d1cb5c8c22640397c47596.exe Token: SeBackupPrivilege 4068 b5c571cbe24b37359eb4018bac19e37a2ffc6108d6d1cb5c8c22640397c47596.exe Token: SeBackupPrivilege 4068 b5c571cbe24b37359eb4018bac19e37a2ffc6108d6d1cb5c8c22640397c47596.exe Token: SeBackupPrivilege 4068 b5c571cbe24b37359eb4018bac19e37a2ffc6108d6d1cb5c8c22640397c47596.exe Token: SeBackupPrivilege 4068 b5c571cbe24b37359eb4018bac19e37a2ffc6108d6d1cb5c8c22640397c47596.exe Token: SeBackupPrivilege 4068 b5c571cbe24b37359eb4018bac19e37a2ffc6108d6d1cb5c8c22640397c47596.exe Token: SeBackupPrivilege 4068 b5c571cbe24b37359eb4018bac19e37a2ffc6108d6d1cb5c8c22640397c47596.exe Token: SeBackupPrivilege 4068 b5c571cbe24b37359eb4018bac19e37a2ffc6108d6d1cb5c8c22640397c47596.exe Token: SeBackupPrivilege 4068 b5c571cbe24b37359eb4018bac19e37a2ffc6108d6d1cb5c8c22640397c47596.exe Token: SeBackupPrivilege 4068 b5c571cbe24b37359eb4018bac19e37a2ffc6108d6d1cb5c8c22640397c47596.exe Token: SeBackupPrivilege 4068 b5c571cbe24b37359eb4018bac19e37a2ffc6108d6d1cb5c8c22640397c47596.exe Token: SeBackupPrivilege 4068 b5c571cbe24b37359eb4018bac19e37a2ffc6108d6d1cb5c8c22640397c47596.exe Token: SeBackupPrivilege 4068 b5c571cbe24b37359eb4018bac19e37a2ffc6108d6d1cb5c8c22640397c47596.exe Token: SeBackupPrivilege 4068 b5c571cbe24b37359eb4018bac19e37a2ffc6108d6d1cb5c8c22640397c47596.exe Token: SeDebugPrivilege 2784 fssrv.exe Token: SeChangeNotifyPrivilege 2784 fssrv.exe Token: SeBackupPrivilege 2784 fssrv.exe Token: SeBackupPrivilege 2784 fssrv.exe Token: SeBackupPrivilege 2784 fssrv.exe Token: SeBackupPrivilege 2784 fssrv.exe Token: SeBackupPrivilege 2784 fssrv.exe Token: SeBackupPrivilege 2784 fssrv.exe Token: SeBackupPrivilege 2784 fssrv.exe Token: SeBackupPrivilege 2784 fssrv.exe Token: SeBackupPrivilege 2784 fssrv.exe Token: SeBackupPrivilege 2784 fssrv.exe Token: SeBackupPrivilege 2784 fssrv.exe Token: SeBackupPrivilege 2784 fssrv.exe Token: SeBackupPrivilege 2784 fssrv.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4068 wrote to memory of 852 4068 b5c571cbe24b37359eb4018bac19e37a2ffc6108d6d1cb5c8c22640397c47596.exe 94 PID 4068 wrote to memory of 852 4068 b5c571cbe24b37359eb4018bac19e37a2ffc6108d6d1cb5c8c22640397c47596.exe 94 PID 4068 wrote to memory of 852 4068 b5c571cbe24b37359eb4018bac19e37a2ffc6108d6d1cb5c8c22640397c47596.exe 94 -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 b5c571cbe24b37359eb4018bac19e37a2ffc6108d6d1cb5c8c22640397c47596.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b5c571cbe24b37359eb4018bac19e37a2ffc6108d6d1cb5c8c22640397c47596.exe"C:\Users\Admin\AppData\Local\Temp\b5c571cbe24b37359eb4018bac19e37a2ffc6108d6d1cb5c8c22640397c47596.exe"1⤵
- Accesses Microsoft Outlook profiles
- Enumerates connected drives
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- outlook_win_path
PID:4068 -
C:\Windows\SysWOW64\pptpcms.exeC:\Windows\SysWOW64\pptpcms.exe /combine local system2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:852
-
-
C:\Windows\SysWOW64\fssrv.exeC:\Windows\SysWOW64\fssrv.exe 40l1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2784
Network
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5933b3c5d3728ef6e08af4ae579c00d11
SHA142dbfbedd813e6dbea1398323f085a88fa014293
SHA25647f3405ab0da5af125bcc6ebb6d17a1573b090c54d7a0a00630ec170ccc4b9d1
SHA512054c8fe49dad9571f7a1c2d015fdf2cc3589113517dc246baa3e68a62c186243d860566fa6339beec07a29c480f57a1009db4f51b813dfae4c26193b82baea1b
-
Filesize
4B
MD559babb838a876914f6b5402512da3d41
SHA1eb72a9af96d374bc1d0045513ae1f4541060a7e5
SHA256443c07a2c83b7b0253a325d2b72ac757c3aa5b41cd749842bc74fb3ee9b26866
SHA5126c7f7fd694df9949b4716d009242b423216aa52e579414505406d6d3fcaa84fd8c9227e55eb80d28ba40068d80fd6f8be089f2b655ebc72872cd226236fa97ea
-
Filesize
2.2MB
MD5fad02385f8f25089176259da4b1acafd
SHA10439606cf5138e4a62f35c23f6e190e6e05d9997
SHA256efab1d2dd2dcab9990ae6a767fe38e01cf9bd7cc377340cd17da7c3b768b092c
SHA5129ae26d6c7ca0d936ea98a675e0cf8e5352b9e05fd85f3d00e4ba4d05b27b01a52d100913f4cfaee0fc59d4fc8eed76304d0d892f638acf951f3ebebfa0f08be1
-
Filesize
1.7MB
MD5e28c2987d1344d9b5264259011032c9f
SHA106e7d7dde7bad8de6439505ad81744839e17e76f
SHA2566fd81fb46ecda7d599d5b2e1f004ce16d4803179923a6c5398b266b8e70946ac
SHA5123843965e249ca6b4172136b465c945eea6cc6920368f049eb3485e2da3831f2331bc5035578edd6a784de3e108de59981f9fdb9c1f9aa6520e235ebccb4e3ede