Analysis
-
max time kernel
120s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
19-09-2024 06:42
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1e05962fe6a8dd015a0abd46e896fe9b86f6d7ae68eca0412cf033b4d539e734N.exe
Resource
win7-20240903-en
windows7-x64
10 signatures
120 seconds
Behavioral task
behavioral2
Sample
1e05962fe6a8dd015a0abd46e896fe9b86f6d7ae68eca0412cf033b4d539e734N.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
8 signatures
120 seconds
General
-
Target
1e05962fe6a8dd015a0abd46e896fe9b86f6d7ae68eca0412cf033b4d539e734N.exe
-
Size
9.9MB
-
MD5
8b333d82d155fa98d1673371a7518a90
-
SHA1
f8fbf6b8cfa81226badd460b5758a974b63719dd
-
SHA256
1e05962fe6a8dd015a0abd46e896fe9b86f6d7ae68eca0412cf033b4d539e734
-
SHA512
1a6c4dccad3852feed08cb7eaf10149889e2619450a0873e8e33b0e26134fd993bd10ec736d3496a62ebd420767273690a4443c721e1a2d0bc58154fe175acad
-
SSDEEP
196608:7HqnhgJuP3LAhCiVXCWeZLsA1oMuWr45hrr2P:US+LVReJWGhrr2P
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 4 IoCs
pid Process 1720 operatingwindows6.1.7600.16385.exe 1772 microsofteeintl.exe 1484 msdasqlrwindows.exe 2132 acrobatadobe.exe -
Loads dropped DLL 16 IoCs
pid Process 2104 1e05962fe6a8dd015a0abd46e896fe9b86f6d7ae68eca0412cf033b4d539e734N.exe 1720 operatingwindows6.1.7600.16385.exe 1720 operatingwindows6.1.7600.16385.exe 1720 operatingwindows6.1.7600.16385.exe 2104 1e05962fe6a8dd015a0abd46e896fe9b86f6d7ae68eca0412cf033b4d539e734N.exe 1772 microsofteeintl.exe 1772 microsofteeintl.exe 1772 microsofteeintl.exe 2104 1e05962fe6a8dd015a0abd46e896fe9b86f6d7ae68eca0412cf033b4d539e734N.exe 1484 msdasqlrwindows.exe 1484 msdasqlrwindows.exe 1484 msdasqlrwindows.exe 2104 1e05962fe6a8dd015a0abd46e896fe9b86f6d7ae68eca0412cf033b4d539e734N.exe 2132 acrobatadobe.exe 2132 acrobatadobe.exe 2132 acrobatadobe.exe -
Adds Run key to start application 2 TTPs 9 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\EngineSource = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1e05962fe6a8dd015a0abd46e896fe9b86f6d7ae68eca0412cf033b4d539e734N.exe" 1e05962fe6a8dd015a0abd46e896fe9b86f6d7ae68eca0412cf033b4d539e734N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\WindowsOperating = "c:\\program files (x86)\\common files\\system\\ja-jp\\operatingwindows6.1.7600.16385.exe" 1e05962fe6a8dd015a0abd46e896fe9b86f6d7ae68eca0412cf033b4d539e734N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\OperatingSystem6.1.7600.163857.0907131255 = "c:\\program files (x86)\\common files\\system\\ado\\es-es\\operatingsystem.exe" 1e05962fe6a8dd015a0abd46e896fe9b86f6d7ae68eca0412cf033b4d539e734N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\AiodAcrobat = "c:\\program files (x86)\\adobe\\reader 9.0\\esl\\acrobatadobe.exe" 1e05962fe6a8dd015a0abd46e896fe9b86f6d7ae68eca0412cf033b4d539e734N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\oledb32rmsdaorar = "c:\\program files (x86)\\common files\\system\\ole db\\it-it\\msdasqlrwindows.exe" 1e05962fe6a8dd015a0abd46e896fe9b86f6d7ae68eca0412cf033b4d539e734N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\EngineOffice = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1e05962fe6a8dd015a0abd46e896fe9b86f6d7ae68eca0412cf033b4d539e734N.exe" 1e05962fe6a8dd015a0abd46e896fe9b86f6d7ae68eca0412cf033b4d539e734N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\MicrosoftEEINTL = "c:\\program files (x86)\\common files\\microsoft shared\\equation\\1033\\microsofteeintl.exe" 1e05962fe6a8dd015a0abd46e896fe9b86f6d7ae68eca0412cf033b4d539e734N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\BCSSync = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\BCSSync.exe\" /DelayServices" 1e05962fe6a8dd015a0abd46e896fe9b86f6d7ae68eca0412cf033b4d539e734N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsWindows = "c:\\program files (x86)\\common files\\system\\ole db\\es-es\\systemsystem.exe" 1e05962fe6a8dd015a0abd46e896fe9b86f6d7ae68eca0412cf033b4d539e734N.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory 5 IoCs
description ioc Process File created C:\Windows\SysWOW64\ntdll.dll.dll 1e05962fe6a8dd015a0abd46e896fe9b86f6d7ae68eca0412cf033b4d539e734N.exe File created C:\Windows\SysWOW64\ntdll.dll.dll operatingwindows6.1.7600.16385.exe File created C:\Windows\SysWOW64\ntdll.dll.dll microsofteeintl.exe File created C:\Windows\SysWOW64\ntdll.dll.dll msdasqlrwindows.exe File created C:\Windows\SysWOW64\ntdll.dll.dll acrobatadobe.exe -
Drops file in Program Files directory 14 IoCs
description ioc Process File created C:\Program Files (x86)\Common Files\System\ja-JP\OperatingWindows6.1.7600.16385.exe 1e05962fe6a8dd015a0abd46e896fe9b86f6d7ae68eca0412cf033b4d539e734N.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Esl\RCX67EA.tmp 1e05962fe6a8dd015a0abd46e896fe9b86f6d7ae68eca0412cf033b4d539e734N.exe File opened for modification C:\Program Files (x86)\Common Files\System\Ole DB\it-IT\RCX6888.tmp 1e05962fe6a8dd015a0abd46e896fe9b86f6d7ae68eca0412cf033b4d539e734N.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Esl\AcrobatAdobe.exe 1e05962fe6a8dd015a0abd46e896fe9b86f6d7ae68eca0412cf033b4d539e734N.exe File created C:\Program Files (x86)\Common Files\SpeechEngines\Microsoft\TTS20\es-ES\MSTTSLocMicrosoft.exe 1e05962fe6a8dd015a0abd46e896fe9b86f6d7ae68eca0412cf033b4d539e734N.exe File opened for modification C:\Program Files (x86)\Common Files\System\ado\es-ES\RCX6829.tmp 1e05962fe6a8dd015a0abd46e896fe9b86f6d7ae68eca0412cf033b4d539e734N.exe File created C:\Program Files (x86)\Common Files\System\ado\es-ES\OperatingSystem.exe 1e05962fe6a8dd015a0abd46e896fe9b86f6d7ae68eca0412cf033b4d539e734N.exe File created C:\Program Files (x86)\Common Files\System\Ole DB\it-IT\msdasqlrWindows.exe 1e05962fe6a8dd015a0abd46e896fe9b86f6d7ae68eca0412cf033b4d539e734N.exe File created C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\1033\MicrosoftEEINTL.exe 1e05962fe6a8dd015a0abd46e896fe9b86f6d7ae68eca0412cf033b4d539e734N.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\1033\MicrosoftEEINTL.exe 1e05962fe6a8dd015a0abd46e896fe9b86f6d7ae68eca0412cf033b4d539e734N.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\1033\RCX5080.tmp 1e05962fe6a8dd015a0abd46e896fe9b86f6d7ae68eca0412cf033b4d539e734N.exe File created C:\Program Files (x86)\Common Files\System\Ole DB\es-ES\SystemSystem.exe 1e05962fe6a8dd015a0abd46e896fe9b86f6d7ae68eca0412cf033b4d539e734N.exe File opened for modification C:\Program Files (x86)\Common Files\System\Ole DB\es-ES\RCX514C.tmp 1e05962fe6a8dd015a0abd46e896fe9b86f6d7ae68eca0412cf033b4d539e734N.exe File opened for modification C:\Program Files (x86)\Common Files\System\ja-JP\RCX5247.tmp 1e05962fe6a8dd015a0abd46e896fe9b86f6d7ae68eca0412cf033b4d539e734N.exe -
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1e05962fe6a8dd015a0abd46e896fe9b86f6d7ae68eca0412cf033b4d539e734N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language operatingwindows6.1.7600.16385.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language microsofteeintl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msdasqlrwindows.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language acrobatadobe.exe -
Checks processor information in registry 2 TTPs 15 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier 1e05962fe6a8dd015a0abd46e896fe9b86f6d7ae68eca0412cf033b4d539e734N.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 msdasqlrwindows.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 acrobatadobe.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString microsofteeintl.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier microsofteeintl.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString msdasqlrwindows.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString acrobatadobe.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 1e05962fe6a8dd015a0abd46e896fe9b86f6d7ae68eca0412cf033b4d539e734N.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString operatingwindows6.1.7600.16385.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier operatingwindows6.1.7600.16385.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 microsofteeintl.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier acrobatadobe.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 1e05962fe6a8dd015a0abd46e896fe9b86f6d7ae68eca0412cf033b4d539e734N.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 operatingwindows6.1.7600.16385.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier msdasqlrwindows.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2104 1e05962fe6a8dd015a0abd46e896fe9b86f6d7ae68eca0412cf033b4d539e734N.exe 2104 1e05962fe6a8dd015a0abd46e896fe9b86f6d7ae68eca0412cf033b4d539e734N.exe 2104 1e05962fe6a8dd015a0abd46e896fe9b86f6d7ae68eca0412cf033b4d539e734N.exe 2104 1e05962fe6a8dd015a0abd46e896fe9b86f6d7ae68eca0412cf033b4d539e734N.exe 2104 1e05962fe6a8dd015a0abd46e896fe9b86f6d7ae68eca0412cf033b4d539e734N.exe 2104 1e05962fe6a8dd015a0abd46e896fe9b86f6d7ae68eca0412cf033b4d539e734N.exe 2104 1e05962fe6a8dd015a0abd46e896fe9b86f6d7ae68eca0412cf033b4d539e734N.exe 1720 operatingwindows6.1.7600.16385.exe 2104 1e05962fe6a8dd015a0abd46e896fe9b86f6d7ae68eca0412cf033b4d539e734N.exe 2104 1e05962fe6a8dd015a0abd46e896fe9b86f6d7ae68eca0412cf033b4d539e734N.exe 2104 1e05962fe6a8dd015a0abd46e896fe9b86f6d7ae68eca0412cf033b4d539e734N.exe 1772 microsofteeintl.exe 2104 1e05962fe6a8dd015a0abd46e896fe9b86f6d7ae68eca0412cf033b4d539e734N.exe 2104 1e05962fe6a8dd015a0abd46e896fe9b86f6d7ae68eca0412cf033b4d539e734N.exe 2104 1e05962fe6a8dd015a0abd46e896fe9b86f6d7ae68eca0412cf033b4d539e734N.exe 1484 msdasqlrwindows.exe 2104 1e05962fe6a8dd015a0abd46e896fe9b86f6d7ae68eca0412cf033b4d539e734N.exe 2104 1e05962fe6a8dd015a0abd46e896fe9b86f6d7ae68eca0412cf033b4d539e734N.exe 2104 1e05962fe6a8dd015a0abd46e896fe9b86f6d7ae68eca0412cf033b4d539e734N.exe 2132 acrobatadobe.exe 2104 1e05962fe6a8dd015a0abd46e896fe9b86f6d7ae68eca0412cf033b4d539e734N.exe 2104 1e05962fe6a8dd015a0abd46e896fe9b86f6d7ae68eca0412cf033b4d539e734N.exe 2104 1e05962fe6a8dd015a0abd46e896fe9b86f6d7ae68eca0412cf033b4d539e734N.exe 2104 1e05962fe6a8dd015a0abd46e896fe9b86f6d7ae68eca0412cf033b4d539e734N.exe 2104 1e05962fe6a8dd015a0abd46e896fe9b86f6d7ae68eca0412cf033b4d539e734N.exe 2104 1e05962fe6a8dd015a0abd46e896fe9b86f6d7ae68eca0412cf033b4d539e734N.exe 2104 1e05962fe6a8dd015a0abd46e896fe9b86f6d7ae68eca0412cf033b4d539e734N.exe 2104 1e05962fe6a8dd015a0abd46e896fe9b86f6d7ae68eca0412cf033b4d539e734N.exe 2104 1e05962fe6a8dd015a0abd46e896fe9b86f6d7ae68eca0412cf033b4d539e734N.exe 2104 1e05962fe6a8dd015a0abd46e896fe9b86f6d7ae68eca0412cf033b4d539e734N.exe 2104 1e05962fe6a8dd015a0abd46e896fe9b86f6d7ae68eca0412cf033b4d539e734N.exe 2104 1e05962fe6a8dd015a0abd46e896fe9b86f6d7ae68eca0412cf033b4d539e734N.exe 2104 1e05962fe6a8dd015a0abd46e896fe9b86f6d7ae68eca0412cf033b4d539e734N.exe 2104 1e05962fe6a8dd015a0abd46e896fe9b86f6d7ae68eca0412cf033b4d539e734N.exe 2104 1e05962fe6a8dd015a0abd46e896fe9b86f6d7ae68eca0412cf033b4d539e734N.exe 2104 1e05962fe6a8dd015a0abd46e896fe9b86f6d7ae68eca0412cf033b4d539e734N.exe 2104 1e05962fe6a8dd015a0abd46e896fe9b86f6d7ae68eca0412cf033b4d539e734N.exe 2104 1e05962fe6a8dd015a0abd46e896fe9b86f6d7ae68eca0412cf033b4d539e734N.exe 2104 1e05962fe6a8dd015a0abd46e896fe9b86f6d7ae68eca0412cf033b4d539e734N.exe 2104 1e05962fe6a8dd015a0abd46e896fe9b86f6d7ae68eca0412cf033b4d539e734N.exe 2104 1e05962fe6a8dd015a0abd46e896fe9b86f6d7ae68eca0412cf033b4d539e734N.exe 2104 1e05962fe6a8dd015a0abd46e896fe9b86f6d7ae68eca0412cf033b4d539e734N.exe 2104 1e05962fe6a8dd015a0abd46e896fe9b86f6d7ae68eca0412cf033b4d539e734N.exe 2104 1e05962fe6a8dd015a0abd46e896fe9b86f6d7ae68eca0412cf033b4d539e734N.exe 2104 1e05962fe6a8dd015a0abd46e896fe9b86f6d7ae68eca0412cf033b4d539e734N.exe 2104 1e05962fe6a8dd015a0abd46e896fe9b86f6d7ae68eca0412cf033b4d539e734N.exe 2104 1e05962fe6a8dd015a0abd46e896fe9b86f6d7ae68eca0412cf033b4d539e734N.exe 2104 1e05962fe6a8dd015a0abd46e896fe9b86f6d7ae68eca0412cf033b4d539e734N.exe 2104 1e05962fe6a8dd015a0abd46e896fe9b86f6d7ae68eca0412cf033b4d539e734N.exe 2104 1e05962fe6a8dd015a0abd46e896fe9b86f6d7ae68eca0412cf033b4d539e734N.exe 2104 1e05962fe6a8dd015a0abd46e896fe9b86f6d7ae68eca0412cf033b4d539e734N.exe 2104 1e05962fe6a8dd015a0abd46e896fe9b86f6d7ae68eca0412cf033b4d539e734N.exe 2104 1e05962fe6a8dd015a0abd46e896fe9b86f6d7ae68eca0412cf033b4d539e734N.exe 2104 1e05962fe6a8dd015a0abd46e896fe9b86f6d7ae68eca0412cf033b4d539e734N.exe 2104 1e05962fe6a8dd015a0abd46e896fe9b86f6d7ae68eca0412cf033b4d539e734N.exe 2104 1e05962fe6a8dd015a0abd46e896fe9b86f6d7ae68eca0412cf033b4d539e734N.exe 2104 1e05962fe6a8dd015a0abd46e896fe9b86f6d7ae68eca0412cf033b4d539e734N.exe 2104 1e05962fe6a8dd015a0abd46e896fe9b86f6d7ae68eca0412cf033b4d539e734N.exe 2104 1e05962fe6a8dd015a0abd46e896fe9b86f6d7ae68eca0412cf033b4d539e734N.exe 2104 1e05962fe6a8dd015a0abd46e896fe9b86f6d7ae68eca0412cf033b4d539e734N.exe 2104 1e05962fe6a8dd015a0abd46e896fe9b86f6d7ae68eca0412cf033b4d539e734N.exe 2104 1e05962fe6a8dd015a0abd46e896fe9b86f6d7ae68eca0412cf033b4d539e734N.exe 2104 1e05962fe6a8dd015a0abd46e896fe9b86f6d7ae68eca0412cf033b4d539e734N.exe 2104 1e05962fe6a8dd015a0abd46e896fe9b86f6d7ae68eca0412cf033b4d539e734N.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 2104 wrote to memory of 1720 2104 1e05962fe6a8dd015a0abd46e896fe9b86f6d7ae68eca0412cf033b4d539e734N.exe 31 PID 2104 wrote to memory of 1720 2104 1e05962fe6a8dd015a0abd46e896fe9b86f6d7ae68eca0412cf033b4d539e734N.exe 31 PID 2104 wrote to memory of 1720 2104 1e05962fe6a8dd015a0abd46e896fe9b86f6d7ae68eca0412cf033b4d539e734N.exe 31 PID 2104 wrote to memory of 1720 2104 1e05962fe6a8dd015a0abd46e896fe9b86f6d7ae68eca0412cf033b4d539e734N.exe 31 PID 2104 wrote to memory of 1720 2104 1e05962fe6a8dd015a0abd46e896fe9b86f6d7ae68eca0412cf033b4d539e734N.exe 31 PID 2104 wrote to memory of 1720 2104 1e05962fe6a8dd015a0abd46e896fe9b86f6d7ae68eca0412cf033b4d539e734N.exe 31 PID 2104 wrote to memory of 1720 2104 1e05962fe6a8dd015a0abd46e896fe9b86f6d7ae68eca0412cf033b4d539e734N.exe 31 PID 2104 wrote to memory of 1772 2104 1e05962fe6a8dd015a0abd46e896fe9b86f6d7ae68eca0412cf033b4d539e734N.exe 32 PID 2104 wrote to memory of 1772 2104 1e05962fe6a8dd015a0abd46e896fe9b86f6d7ae68eca0412cf033b4d539e734N.exe 32 PID 2104 wrote to memory of 1772 2104 1e05962fe6a8dd015a0abd46e896fe9b86f6d7ae68eca0412cf033b4d539e734N.exe 32 PID 2104 wrote to memory of 1772 2104 1e05962fe6a8dd015a0abd46e896fe9b86f6d7ae68eca0412cf033b4d539e734N.exe 32 PID 2104 wrote to memory of 1772 2104 1e05962fe6a8dd015a0abd46e896fe9b86f6d7ae68eca0412cf033b4d539e734N.exe 32 PID 2104 wrote to memory of 1772 2104 1e05962fe6a8dd015a0abd46e896fe9b86f6d7ae68eca0412cf033b4d539e734N.exe 32 PID 2104 wrote to memory of 1772 2104 1e05962fe6a8dd015a0abd46e896fe9b86f6d7ae68eca0412cf033b4d539e734N.exe 32 PID 2104 wrote to memory of 1484 2104 1e05962fe6a8dd015a0abd46e896fe9b86f6d7ae68eca0412cf033b4d539e734N.exe 33 PID 2104 wrote to memory of 1484 2104 1e05962fe6a8dd015a0abd46e896fe9b86f6d7ae68eca0412cf033b4d539e734N.exe 33 PID 2104 wrote to memory of 1484 2104 1e05962fe6a8dd015a0abd46e896fe9b86f6d7ae68eca0412cf033b4d539e734N.exe 33 PID 2104 wrote to memory of 1484 2104 1e05962fe6a8dd015a0abd46e896fe9b86f6d7ae68eca0412cf033b4d539e734N.exe 33 PID 2104 wrote to memory of 1484 2104 1e05962fe6a8dd015a0abd46e896fe9b86f6d7ae68eca0412cf033b4d539e734N.exe 33 PID 2104 wrote to memory of 1484 2104 1e05962fe6a8dd015a0abd46e896fe9b86f6d7ae68eca0412cf033b4d539e734N.exe 33 PID 2104 wrote to memory of 1484 2104 1e05962fe6a8dd015a0abd46e896fe9b86f6d7ae68eca0412cf033b4d539e734N.exe 33 PID 2104 wrote to memory of 2132 2104 1e05962fe6a8dd015a0abd46e896fe9b86f6d7ae68eca0412cf033b4d539e734N.exe 34 PID 2104 wrote to memory of 2132 2104 1e05962fe6a8dd015a0abd46e896fe9b86f6d7ae68eca0412cf033b4d539e734N.exe 34 PID 2104 wrote to memory of 2132 2104 1e05962fe6a8dd015a0abd46e896fe9b86f6d7ae68eca0412cf033b4d539e734N.exe 34 PID 2104 wrote to memory of 2132 2104 1e05962fe6a8dd015a0abd46e896fe9b86f6d7ae68eca0412cf033b4d539e734N.exe 34 PID 2104 wrote to memory of 2132 2104 1e05962fe6a8dd015a0abd46e896fe9b86f6d7ae68eca0412cf033b4d539e734N.exe 34 PID 2104 wrote to memory of 2132 2104 1e05962fe6a8dd015a0abd46e896fe9b86f6d7ae68eca0412cf033b4d539e734N.exe 34 PID 2104 wrote to memory of 2132 2104 1e05962fe6a8dd015a0abd46e896fe9b86f6d7ae68eca0412cf033b4d539e734N.exe 34
Processes
-
C:\Users\Admin\AppData\Local\Temp\1e05962fe6a8dd015a0abd46e896fe9b86f6d7ae68eca0412cf033b4d539e734N.exe"C:\Users\Admin\AppData\Local\Temp\1e05962fe6a8dd015a0abd46e896fe9b86f6d7ae68eca0412cf033b4d539e734N.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2104 -
\??\c:\program files (x86)\common files\system\ja-jp\operatingwindows6.1.7600.16385.exe"c:\program files (x86)\common files\system\ja-jp\operatingwindows6.1.7600.16385.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:1720
-
-
\??\c:\program files (x86)\common files\microsoft shared\equation\1033\microsofteeintl.exe"c:\program files (x86)\common files\microsoft shared\equation\1033\microsofteeintl.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:1772
-
-
\??\c:\program files (x86)\common files\system\ole db\it-it\msdasqlrwindows.exe"c:\program files (x86)\common files\system\ole db\it-it\msdasqlrwindows.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:1484
-
-
\??\c:\program files (x86)\adobe\reader 9.0\esl\acrobatadobe.exe"c:\program files (x86)\adobe\reader 9.0\esl\acrobatadobe.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:2132
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
9.9MB
MD59300461b7f7446c16c68edd4a5cf40df
SHA1f489b7c0743ad702103966a1f1b70b3db8941b3a
SHA256b0552644a47c92b9a7ce1da6caf34ca1d62215b393aba179b45529247e81b850
SHA512119b7d64cb2c23ec0895a23f45c905d641adc8cc2574bf656fc3ca1bccc954564c2ae88bd3c5435962f127197d2c7150c3e2264cd2a37f4cc918dfa427d57e61
-
Filesize
9.9MB
MD558f7398d2803ea99485728d45cc50bc9
SHA163e91bcb6195397851937ff9117baed34ab4250d
SHA25645e93f790cfb68572cfde40d7ac2c2796e314c8af582f12fe35055f983baf1d6
SHA512ac2884674a8d87aa218e040f84349064b659a67fbea707c576934734980cbfc79873aa9e364dc9b1db44a017adfa94487f2025d33c8165fd59ae9c73420baa6c
-
Filesize
9.9MB
MD58b333d82d155fa98d1673371a7518a90
SHA1f8fbf6b8cfa81226badd460b5758a974b63719dd
SHA2561e05962fe6a8dd015a0abd46e896fe9b86f6d7ae68eca0412cf033b4d539e734
SHA5121a6c4dccad3852feed08cb7eaf10149889e2619450a0873e8e33b0e26134fd993bd10ec736d3496a62ebd420767273690a4443c721e1a2d0bc58154fe175acad