Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
19-09-2024 06:40
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe
Resource
win7-20240903-en
windows7-x64
10 signatures
120 seconds
Behavioral task
behavioral2
Sample
2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
8 signatures
120 seconds
General
-
Target
2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe
-
Size
9.6MB
-
MD5
c0564b68734ba347816a60f257f65a00
-
SHA1
77b8bd5f2099defce01cbe1658aedc85aa5f896e
-
SHA256
2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788d
-
SHA512
7335c5a1abdfd4284d1aaf8ec4cdee130e221d1cb3ee3ea01cf45b0336277c6e3c0f458a3f3ae0f99a554650b33562940508573c85613a185f1ce0a77009c266
-
SSDEEP
196608:V7qnhgJuP3LAhCiVX5WvrOA1oMuWr45hrr2S:uS+Le+eJWGhrr2S
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 4 IoCs
pid Process 2952 windowsdexploitation6.1.7600.163857.0907131255.exe 2452 hxdsuimicrosoft2.05.50727.4039.exe 2524 systemsystem.exe 1788 windowsdexploitation.exe -
Loads dropped DLL 16 IoCs
pid Process 2888 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe 2952 windowsdexploitation6.1.7600.163857.0907131255.exe 2952 windowsdexploitation6.1.7600.163857.0907131255.exe 2952 windowsdexploitation6.1.7600.163857.0907131255.exe 2888 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe 2452 hxdsuimicrosoft2.05.50727.4039.exe 2452 hxdsuimicrosoft2.05.50727.4039.exe 2452 hxdsuimicrosoft2.05.50727.4039.exe 2888 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe 2524 systemsystem.exe 2524 systemsystem.exe 2524 systemsystem.exe 2888 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe 1788 windowsdexploitation.exe 1788 windowsdexploitation.exe 1788 windowsdexploitation.exe -
Adds Run key to start application 2 TTPs 9 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\BCSSync = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\BCSSync.exe\" /DelayServices" 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\dexploitationPhotoViewer = "c:\\program files (x86)\\windows photo viewer\\fr-fr\\windowsdexploitation.exe" 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicrosoftSystem = "c:\\program files (x86)\\common files\\system\\ado\\ja-jp\\microsoftwindows6.1.7600.16385.exe" 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsSystme6.1.7600.163857.0907131255 = "c:\\program files (x86)\\common files\\system\\fr-fr\\windowsdexploitation6.1.7600.163857.0907131255.exe" 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\FormatFilter = "c:\\program files (x86)\\common files\\microsoft shared\\filters\\microsoftodffilt.exe" 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\MicrosoftMicrosoft = "c:\\program files (x86)\\common files\\microsoft shared\\help\\1046\\hxdsuimicrosoft2.05.50727.4039.exe" 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\EngineOffice = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe" 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\EngineSource = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe" 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\SystemWindows = "c:\\program files (x86)\\common files\\microsoft shared\\ink\\1.0\\systemsystem.exe" 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory 5 IoCs
description ioc Process File created C:\Windows\SysWOW64\ntdll.dll.dll windowsdexploitation6.1.7600.163857.0907131255.exe File created C:\Windows\SysWOW64\ntdll.dll.dll hxdsuimicrosoft2.05.50727.4039.exe File created C:\Windows\SysWOW64\ntdll.dll.dll systemsystem.exe File created C:\Windows\SysWOW64\ntdll.dll.dll windowsdexploitation.exe File created C:\Windows\SysWOW64\ntdll.dll.dll 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe -
Drops file in Program Files directory 14 IoCs
description ioc Process File created C:\Program Files (x86)\Common Files\microsoft shared\Help\1046\HXDSUIMicrosoft2.05.50727.4039.exe 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe File created C:\Program Files (x86)\Common Files\microsoft shared\ink\1.0\SystemSystem.exe 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe File opened for modification C:\Program Files (x86)\Common Files\System\fr-FR\RCX67F9.tmp 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe File created C:\Program Files (x86)\Common Files\microsoft shared\Filters\Microsoftodffilt.exe 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe File created C:\Program Files (x86)\Windows Photo Viewer\fr-FR\Windowsdexploitation.exe 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Filters\RCX7D9D.tmp 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe File created C:\Program Files (x86)\Common Files\System\fr-FR\Windowsdexploitation6.1.7600.163857.0907131255.exe 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe File created C:\Program Files (x86)\Common Files\System\ado\ja-JP\MicrosoftWindows6.1.7600.16385.exe 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe File opened for modification C:\Program Files (x86)\Common Files\System\ado\ja-JP\RCX7D6D.tmp 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe File created C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\ShellShell.exe 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\ink\1.0\SystemSystem.exe 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\ink\1.0\RCX673B.tmp 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe File opened for modification C:\Program Files (x86)\Windows Photo Viewer\fr-FR\RCX679A.tmp 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Help\1046\RCX7DDC.tmp 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe -
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language windowsdexploitation6.1.7600.163857.0907131255.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hxdsuimicrosoft2.05.50727.4039.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language systemsystem.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language windowsdexploitation.exe -
Checks processor information in registry 2 TTPs 15 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString hxdsuimicrosoft2.05.50727.4039.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 systemsystem.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 windowsdexploitation.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString windowsdexploitation.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier windowsdexploitation.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString windowsdexploitation6.1.7600.163857.0907131255.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier hxdsuimicrosoft2.05.50727.4039.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier systemsystem.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 hxdsuimicrosoft2.05.50727.4039.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 windowsdexploitation6.1.7600.163857.0907131255.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier windowsdexploitation6.1.7600.163857.0907131255.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString systemsystem.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2888 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe 2888 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe 2888 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe 2888 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe 2888 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe 2888 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe 2888 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe 2952 windowsdexploitation6.1.7600.163857.0907131255.exe 2888 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe 2888 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe 2888 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe 2452 hxdsuimicrosoft2.05.50727.4039.exe 2888 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe 2888 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe 2888 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe 2524 systemsystem.exe 2888 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe 2888 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe 2888 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe 1788 windowsdexploitation.exe 2888 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe 2888 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe 2888 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe 2888 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe 2888 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe 2888 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe 2888 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe 2888 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe 2888 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe 2888 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe 2888 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe 2888 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe 2888 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe 2888 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe 2888 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe 2888 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe 2888 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe 2888 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe 2888 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe 2888 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe 2888 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe 2888 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe 2888 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe 2888 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe 2888 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe 2888 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe 2888 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe 2888 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe 2888 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe 2888 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe 2888 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe 2888 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe 2888 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe 2888 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe 2888 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe 2888 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe 2888 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe 2888 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe 2888 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe 2888 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe 2888 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe 2888 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe 2888 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe 2888 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 2888 wrote to memory of 2952 2888 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe 31 PID 2888 wrote to memory of 2952 2888 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe 31 PID 2888 wrote to memory of 2952 2888 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe 31 PID 2888 wrote to memory of 2952 2888 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe 31 PID 2888 wrote to memory of 2952 2888 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe 31 PID 2888 wrote to memory of 2952 2888 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe 31 PID 2888 wrote to memory of 2952 2888 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe 31 PID 2888 wrote to memory of 2452 2888 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe 32 PID 2888 wrote to memory of 2452 2888 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe 32 PID 2888 wrote to memory of 2452 2888 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe 32 PID 2888 wrote to memory of 2452 2888 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe 32 PID 2888 wrote to memory of 2452 2888 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe 32 PID 2888 wrote to memory of 2452 2888 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe 32 PID 2888 wrote to memory of 2452 2888 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe 32 PID 2888 wrote to memory of 2524 2888 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe 33 PID 2888 wrote to memory of 2524 2888 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe 33 PID 2888 wrote to memory of 2524 2888 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe 33 PID 2888 wrote to memory of 2524 2888 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe 33 PID 2888 wrote to memory of 2524 2888 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe 33 PID 2888 wrote to memory of 2524 2888 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe 33 PID 2888 wrote to memory of 2524 2888 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe 33 PID 2888 wrote to memory of 1788 2888 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe 34 PID 2888 wrote to memory of 1788 2888 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe 34 PID 2888 wrote to memory of 1788 2888 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe 34 PID 2888 wrote to memory of 1788 2888 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe 34 PID 2888 wrote to memory of 1788 2888 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe 34 PID 2888 wrote to memory of 1788 2888 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe 34 PID 2888 wrote to memory of 1788 2888 2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe 34
Processes
-
C:\Users\Admin\AppData\Local\Temp\2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe"C:\Users\Admin\AppData\Local\Temp\2ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788dN.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2888 -
\??\c:\program files (x86)\common files\system\fr-fr\windowsdexploitation6.1.7600.163857.0907131255.exe"c:\program files (x86)\common files\system\fr-fr\windowsdexploitation6.1.7600.163857.0907131255.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:2952
-
-
\??\c:\program files (x86)\common files\microsoft shared\help\1046\hxdsuimicrosoft2.05.50727.4039.exe"c:\program files (x86)\common files\microsoft shared\help\1046\hxdsuimicrosoft2.05.50727.4039.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:2452
-
-
\??\c:\program files (x86)\common files\microsoft shared\ink\1.0\systemsystem.exe"c:\program files (x86)\common files\microsoft shared\ink\1.0\systemsystem.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:2524
-
-
\??\c:\program files (x86)\windows photo viewer\fr-fr\windowsdexploitation.exe"c:\program files (x86)\windows photo viewer\fr-fr\windowsdexploitation.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:1788
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
9.7MB
MD57319d00dd1dd605a743a148b1695a7b9
SHA1c27aeab04a02d43490fee1930890d3cd61c05fe5
SHA256bb27729d2d071275163baf36f7ee2dbca55076ec9db89f1be348c1c557611cc7
SHA512160b0edf205e5fdca39fe0fcf59f7d22f76b24151517f91e8905974e737658ce74b9459e886c0ee5a91ad432945f5e1f7e48d2b26e27cde62abbfd063dfca8ab
-
Filesize
9.7MB
MD59e15199925074da62f4893990efda6de
SHA182ea4a11b09939518a96b49e0e8f0abab12486b2
SHA256e51c0842965eade979e1c5c8cfd8bbd108c7938be7dc99abc6c21f1a3042055e
SHA5120bd4f000087eedbe8a02be37f019ac5d3ec004c766bb824f2c9dfa91b0694af32bee40dcf93ceca0e7decca24e37fd9076c4031786e44580bd5150f05a9351d8
-
Filesize
9.6MB
MD5c0564b68734ba347816a60f257f65a00
SHA177b8bd5f2099defce01cbe1658aedc85aa5f896e
SHA2562ad13a954470be70ef212b64de1d4b0bb09c2d2b5af22e6792ed55d01df5788d
SHA5127335c5a1abdfd4284d1aaf8ec4cdee130e221d1cb3ee3ea01cf45b0336277c6e3c0f458a3f3ae0f99a554650b33562940508573c85613a185f1ce0a77009c266