875aa5d1a2ef2549a5cfc8704c928eeb3aff89a0f86554a29e09b2b7bb40c242

Analysis

max time kernel
120s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
20-09-2024 15:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Trojan.Win32.KillProc.exe
Size

21KB
MD5

cb0e53fbfed25bce10c6f6ff8d120990
SHA1

5d373097259b8e181976daf5e84706b14721cdaa
SHA256

875aa5d1a2ef2549a5cfc8704c928eeb3aff89a0f86554a29e09b2b7bb40c242
SHA512

5d4f680a509a3c14292c5918131d3b20cece5429584311e24b6c7f79977638bbc63ab0911a2643ea7ff12826fcc67be20e822f451ab237a6a2cf37b9a068b55e
SSDEEP

384:g58AcUoUQKNRYELxQUHDvmk3E+KDvB77777J77c77c77c72qh5X+1GlwnfUeCWhy:g5BOFKksO1mE9B77777J77c77c77c71V

Score

10^/10

discovery persistence upx

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 3 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe \"C:\\Windows\\3610F41.exe\""	Trojan.Win32.KillProc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe \"C:\\Windows\\3610F41.exe\""	3610F41.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe \"C:\\Windows\\3610F41.exe\""	3610F41RVTUUW.exe

Executes dropped EXE 5 IoCs

pid	Process
4268	3610F41.exe
5000	3610F41RVTUUW.exe
840	3610F41RVTUUW.exe
3760	3610F41.exe
772	3610F41.exe

UPX packed file 32 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2896-0-0x0000000000400000-0x000000000040F000-memory.dmp	upx
behavioral2/files/0x000700000002345a-7.dat	upx
behavioral2/files/0x0007000000023459-9.dat	upx
behavioral2/memory/5000-16-0x0000000000400000-0x000000000040F000-memory.dmp	upx
behavioral2/memory/840-24-0x0000000000400000-0x000000000040F000-memory.dmp	upx
behavioral2/memory/3760-29-0x0000000000400000-0x000000000040F000-memory.dmp	upx
behavioral2/memory/772-35-0x0000000000400000-0x000000000040F000-memory.dmp	upx
behavioral2/memory/2896-37-0x0000000000400000-0x000000000040F000-memory.dmp	upx
behavioral2/memory/4268-38-0x0000000000400000-0x000000000040F000-memory.dmp	upx
behavioral2/memory/5000-39-0x0000000000400000-0x000000000040F000-memory.dmp	upx
behavioral2/memory/4268-40-0x0000000000400000-0x000000000040F000-memory.dmp	upx
behavioral2/memory/5000-41-0x0000000000400000-0x000000000040F000-memory.dmp	upx
behavioral2/memory/5000-43-0x0000000000400000-0x000000000040F000-memory.dmp	upx
behavioral2/memory/4268-42-0x0000000000400000-0x000000000040F000-memory.dmp	upx
behavioral2/memory/4268-44-0x0000000000400000-0x000000000040F000-memory.dmp	upx
behavioral2/memory/5000-45-0x0000000000400000-0x000000000040F000-memory.dmp	upx
behavioral2/memory/4268-46-0x0000000000400000-0x000000000040F000-memory.dmp	upx
behavioral2/memory/5000-47-0x0000000000400000-0x000000000040F000-memory.dmp	upx
behavioral2/memory/4268-48-0x0000000000400000-0x000000000040F000-memory.dmp	upx
behavioral2/memory/5000-49-0x0000000000400000-0x000000000040F000-memory.dmp	upx
behavioral2/memory/5000-51-0x0000000000400000-0x000000000040F000-memory.dmp	upx
behavioral2/memory/4268-50-0x0000000000400000-0x000000000040F000-memory.dmp	upx
behavioral2/memory/4268-52-0x0000000000400000-0x000000000040F000-memory.dmp	upx
behavioral2/memory/5000-53-0x0000000000400000-0x000000000040F000-memory.dmp	upx
behavioral2/memory/5000-55-0x0000000000400000-0x000000000040F000-memory.dmp	upx
behavioral2/memory/4268-54-0x0000000000400000-0x000000000040F000-memory.dmp	upx
behavioral2/memory/5000-57-0x0000000000400000-0x000000000040F000-memory.dmp	upx
behavioral2/memory/4268-56-0x0000000000400000-0x000000000040F000-memory.dmp	upx
behavioral2/memory/5000-59-0x0000000000400000-0x000000000040F000-memory.dmp	upx
behavioral2/memory/4268-58-0x0000000000400000-0x000000000040F000-memory.dmp	upx
behavioral2/memory/4268-60-0x0000000000400000-0x000000000040F000-memory.dmp	upx
behavioral2/memory/5000-61-0x0000000000400000-0x000000000040F000-memory.dmp	upx

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\3610F41.exe = "C:\\Windows\\3610F41.exe"	Trojan.Win32.KillProc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\3610F41.exe = "C:\\Windows\\3610F41.exe"	3610F41.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\3610F41.exe = "C:\\Windows\\3610F41.exe"	3610F41RVTUUW.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\3610F41.exe	Trojan.Win32.KillProc.exe
File opened for modification	C:\Windows\3610F41RVTUUW.exe	Trojan.Win32.KillProc.exe

System Location Discovery: System Language Discovery 1 TTPs 48 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TASKKILL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TASKKILL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TASKKILL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3610F41RVTUUW.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3610F41.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TASKKILL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TASKKILL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TASKKILL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TASKKILL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TASKKILL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3610F41.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TASKKILL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TASKKILL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TASKKILL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TASKKILL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TASKKILL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TASKKILL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TASKKILL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TASKKILL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TASKKILL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TASKKILL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Trojan.Win32.KillProc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TASKKILL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TASKKILL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TASKKILL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TASKKILL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TASKKILL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3610F41RVTUUW.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TASKKILL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TASKKILL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TASKKILL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TASKKILL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TASKKILL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TASKKILL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TASKKILL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TASKKILL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TASKKILL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TASKKILL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TASKKILL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TASKKILL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TASKKILL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TASKKILL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TASKKILL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3610F41.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TASKKILL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TASKKILL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TASKKILL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TASKKILL.exe

Kills process with taskkill 42 IoCs

evasion

pid	Process
5048	TASKKILL.exe
2648	TASKKILL.exe
216	TASKKILL.exe
4404	TASKKILL.exe
1128	TASKKILL.exe
3488	TASKKILL.exe
1280	TASKKILL.exe
4876	TASKKILL.exe
3672	TASKKILL.exe
4576	TASKKILL.exe
1956	TASKKILL.exe
728	TASKKILL.exe
1156	TASKKILL.exe
2444	TASKKILL.exe
2312	TASKKILL.exe
3900	TASKKILL.exe
1552	TASKKILL.exe
2904	TASKKILL.exe
1908	TASKKILL.exe
4436	TASKKILL.exe
1748	TASKKILL.exe
2216	TASKKILL.exe
4456	TASKKILL.exe
4892	TASKKILL.exe
4692	TASKKILL.exe
4640	TASKKILL.exe
2528	TASKKILL.exe
3208	TASKKILL.exe
2816	TASKKILL.exe
4856	TASKKILL.exe
1440	TASKKILL.exe
4088	TASKKILL.exe
4592	TASKKILL.exe
1456	TASKKILL.exe
4092	TASKKILL.exe
4672	TASKKILL.exe
4816	TASKKILL.exe
2288	TASKKILL.exe
4748	TASKKILL.exe
1840	TASKKILL.exe
4208	TASKKILL.exe
2740	TASKKILL.exe

Suspicious use of AdjustPrivilegeToken 42 IoCs

description	pid	Process
Token: SeDebugPrivilege	2740	TASKKILL.exe
Token: SeDebugPrivilege	1456	TASKKILL.exe
Token: SeDebugPrivilege	4816	TASKKILL.exe
Token: SeDebugPrivilege	1748	TASKKILL.exe
Token: SeDebugPrivilege	3208	TASKKILL.exe
Token: SeDebugPrivilege	1128	TASKKILL.exe
Token: SeDebugPrivilege	2444	TASKKILL.exe
Token: SeDebugPrivilege	2288	TASKKILL.exe
Token: SeDebugPrivilege	728	TASKKILL.exe
Token: SeDebugPrivilege	2528	TASKKILL.exe
Token: SeDebugPrivilege	4092	TASKKILL.exe
Token: SeDebugPrivilege	4404	TASKKILL.exe
Token: SeDebugPrivilege	3900	TASKKILL.exe
Token: SeDebugPrivilege	2816	TASKKILL.exe
Token: SeDebugPrivilege	2648	TASKKILL.exe
Token: SeDebugPrivilege	4856	TASKKILL.exe
Token: SeDebugPrivilege	4088	TASKKILL.exe
Token: SeDebugPrivilege	4876	TASKKILL.exe
Token: SeDebugPrivilege	1156	TASKKILL.exe
Token: SeDebugPrivilege	4456	TASKKILL.exe
Token: SeDebugPrivilege	1552	TASKKILL.exe
Token: SeDebugPrivilege	5048	TASKKILL.exe
Token: SeDebugPrivilege	4640	TASKKILL.exe
Token: SeDebugPrivilege	1440	TASKKILL.exe
Token: SeDebugPrivilege	1956	TASKKILL.exe
Token: SeDebugPrivilege	4208	TASKKILL.exe
Token: SeDebugPrivilege	1840	TASKKILL.exe
Token: SeDebugPrivilege	1280	TASKKILL.exe
Token: SeDebugPrivilege	2904	TASKKILL.exe
Token: SeDebugPrivilege	2216	TASKKILL.exe
Token: SeDebugPrivilege	4748	TASKKILL.exe
Token: SeDebugPrivilege	4892	TASKKILL.exe
Token: SeDebugPrivilege	4592	TASKKILL.exe
Token: SeDebugPrivilege	216	TASKKILL.exe
Token: SeDebugPrivilege	2312	TASKKILL.exe
Token: SeDebugPrivilege	3488	TASKKILL.exe
Token: SeDebugPrivilege	4576	TASKKILL.exe
Token: SeDebugPrivilege	1908	TASKKILL.exe
Token: SeDebugPrivilege	3672	TASKKILL.exe
Token: SeDebugPrivilege	4436	TASKKILL.exe
Token: SeDebugPrivilege	4692	TASKKILL.exe
Token: SeDebugPrivilege	4672	TASKKILL.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2896	Trojan.Win32.KillProc.exe
4268	3610F41.exe
5000	3610F41RVTUUW.exe
840	3610F41RVTUUW.exe
3760	3610F41.exe
772	3610F41.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2896 wrote to memory of 4404	2896	Trojan.Win32.KillProc.exe	82
PID 2896 wrote to memory of 4404	2896	Trojan.Win32.KillProc.exe	82
PID 2896 wrote to memory of 4404	2896	Trojan.Win32.KillProc.exe	82
PID 2896 wrote to memory of 2288	2896	Trojan.Win32.KillProc.exe	83
PID 2896 wrote to memory of 2288	2896	Trojan.Win32.KillProc.exe	83
PID 2896 wrote to memory of 2288	2896	Trojan.Win32.KillProc.exe	83
PID 2896 wrote to memory of 4816	2896	Trojan.Win32.KillProc.exe	84
PID 2896 wrote to memory of 4816	2896	Trojan.Win32.KillProc.exe	84
PID 2896 wrote to memory of 4816	2896	Trojan.Win32.KillProc.exe	84
PID 2896 wrote to memory of 4640	2896	Trojan.Win32.KillProc.exe	85
PID 2896 wrote to memory of 4640	2896	Trojan.Win32.KillProc.exe	85
PID 2896 wrote to memory of 4640	2896	Trojan.Win32.KillProc.exe	85
PID 2896 wrote to memory of 2740	2896	Trojan.Win32.KillProc.exe	86
PID 2896 wrote to memory of 2740	2896	Trojan.Win32.KillProc.exe	86
PID 2896 wrote to memory of 2740	2896	Trojan.Win32.KillProc.exe	86
PID 2896 wrote to memory of 4208	2896	Trojan.Win32.KillProc.exe	87
PID 2896 wrote to memory of 4208	2896	Trojan.Win32.KillProc.exe	87
PID 2896 wrote to memory of 4208	2896	Trojan.Win32.KillProc.exe	87
PID 2896 wrote to memory of 1128	2896	Trojan.Win32.KillProc.exe	88
PID 2896 wrote to memory of 1128	2896	Trojan.Win32.KillProc.exe	88
PID 2896 wrote to memory of 1128	2896	Trojan.Win32.KillProc.exe	88
PID 2896 wrote to memory of 728	2896	Trojan.Win32.KillProc.exe	89
PID 2896 wrote to memory of 728	2896	Trojan.Win32.KillProc.exe	89
PID 2896 wrote to memory of 728	2896	Trojan.Win32.KillProc.exe	89
PID 2896 wrote to memory of 4876	2896	Trojan.Win32.KillProc.exe	90
PID 2896 wrote to memory of 4876	2896	Trojan.Win32.KillProc.exe	90
PID 2896 wrote to memory of 4876	2896	Trojan.Win32.KillProc.exe	90
PID 2896 wrote to memory of 4092	2896	Trojan.Win32.KillProc.exe	91
PID 2896 wrote to memory of 4092	2896	Trojan.Win32.KillProc.exe	91
PID 2896 wrote to memory of 4092	2896	Trojan.Win32.KillProc.exe	91
PID 2896 wrote to memory of 1748	2896	Trojan.Win32.KillProc.exe	92
PID 2896 wrote to memory of 1748	2896	Trojan.Win32.KillProc.exe	92
PID 2896 wrote to memory of 1748	2896	Trojan.Win32.KillProc.exe	92
PID 2896 wrote to memory of 1552	2896	Trojan.Win32.KillProc.exe	93
PID 2896 wrote to memory of 1552	2896	Trojan.Win32.KillProc.exe	93
PID 2896 wrote to memory of 1552	2896	Trojan.Win32.KillProc.exe	93
PID 2896 wrote to memory of 1456	2896	Trojan.Win32.KillProc.exe	94
PID 2896 wrote to memory of 1456	2896	Trojan.Win32.KillProc.exe	94
PID 2896 wrote to memory of 1456	2896	Trojan.Win32.KillProc.exe	94
PID 2896 wrote to memory of 3900	2896	Trojan.Win32.KillProc.exe	95
PID 2896 wrote to memory of 3900	2896	Trojan.Win32.KillProc.exe	95
PID 2896 wrote to memory of 3900	2896	Trojan.Win32.KillProc.exe	95
PID 2896 wrote to memory of 4268	2896	Trojan.Win32.KillProc.exe	102
PID 2896 wrote to memory of 4268	2896	Trojan.Win32.KillProc.exe	102
PID 2896 wrote to memory of 4268	2896	Trojan.Win32.KillProc.exe	102
PID 4268 wrote to memory of 2648	4268	3610F41.exe	111
PID 4268 wrote to memory of 2648	4268	3610F41.exe	111
PID 4268 wrote to memory of 2648	4268	3610F41.exe	111
PID 4268 wrote to memory of 4088	4268	3610F41.exe	112
PID 4268 wrote to memory of 4088	4268	3610F41.exe	112
PID 4268 wrote to memory of 4088	4268	3610F41.exe	112
PID 4268 wrote to memory of 2444	4268	3610F41.exe	113
PID 4268 wrote to memory of 2444	4268	3610F41.exe	113
PID 4268 wrote to memory of 2444	4268	3610F41.exe	113
PID 4268 wrote to memory of 4456	4268	3610F41.exe	114
PID 4268 wrote to memory of 4456	4268	3610F41.exe	114
PID 4268 wrote to memory of 4456	4268	3610F41.exe	114
PID 4268 wrote to memory of 4576	4268	3610F41.exe	115
PID 4268 wrote to memory of 4576	4268	3610F41.exe	115
PID 4268 wrote to memory of 4576	4268	3610F41.exe	115
PID 4268 wrote to memory of 1440	4268	3610F41.exe	116
PID 4268 wrote to memory of 1440	4268	3610F41.exe	116
PID 4268 wrote to memory of 1440	4268	3610F41.exe	116
PID 4268 wrote to memory of 4856	4268	3610F41.exe	117

C:\Users\Admin\AppData\Local\Temp\Trojan.Win32.KillProc.exe
"C:\Users\Admin\AppData\Local\Temp\Trojan.Win32.KillProc.exe"
1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2896
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /S COMPUTERNAME /F /IM winlogon.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4404
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /S COMPUTERNAME /F /IM services.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2288
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /S COMPUTERNAME /F /IM lsass.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4816
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /S COMPUTERNAME /F /IM csrss.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4640
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /S COMPUTERNAME /F /IM smss.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2740
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /S COMPUTERNAME /F /IM inetinfo.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4208
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /S COMPUTERNAME /F /IM svchost.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1128
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /S COMPUTERNAME /F /IM winlogon.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:728
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /S COMPUTERNAME /F /IM services.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4876
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /S COMPUTERNAME /F /IM lsass.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4092
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /S COMPUTERNAME /F /IM csrss.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1748
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /S COMPUTERNAME /F /IM smss.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1552
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /S COMPUTERNAME /F /IM inetinfo.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1456
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /S COMPUTERNAME /F /IM svchost.exe /T
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3900
- C:\Windows\3610F41.exe
  C:\Windows\3610F41.exe
  2⤵
  - Modifies WinLogon for persistence
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4268
- - C:\Windows\SysWOW64\TASKKILL.exe
    TASKKILL /S COMPUTERNAME /F /IM winlogon.exe /T
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2648
- - C:\Windows\SysWOW64\TASKKILL.exe
    TASKKILL /S COMPUTERNAME /F /IM services.exe /T
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4088
- - C:\Windows\SysWOW64\TASKKILL.exe
    TASKKILL /S COMPUTERNAME /F /IM lsass.exe /T
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2444
- - C:\Windows\SysWOW64\TASKKILL.exe
    TASKKILL /S COMPUTERNAME /F /IM csrss.exe /T
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4456
- - C:\Windows\SysWOW64\TASKKILL.exe
    TASKKILL /S COMPUTERNAME /F /IM smss.exe /T
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4576
- - C:\Windows\SysWOW64\TASKKILL.exe
    TASKKILL /S COMPUTERNAME /F /IM inetinfo.exe /T
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1440
- - C:\Windows\SysWOW64\TASKKILL.exe
    TASKKILL /S COMPUTERNAME /F /IM svchost.exe /T
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4856
- - C:\Windows\SysWOW64\TASKKILL.exe
    TASKKILL /S COMPUTERNAME /F /IM winlogon.exe /T
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4748
- - C:\Windows\SysWOW64\TASKKILL.exe
    TASKKILL /S COMPUTERNAME /F /IM services.exe /T
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5048
- - C:\Windows\SysWOW64\TASKKILL.exe
    TASKKILL /S COMPUTERNAME /F /IM lsass.exe /T
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2816
- - C:\Windows\SysWOW64\TASKKILL.exe
    TASKKILL /S COMPUTERNAME /F /IM csrss.exe /T
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2216
- - C:\Windows\SysWOW64\TASKKILL.exe
    TASKKILL /S COMPUTERNAME /F /IM smss.exe /T
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1156
- - C:\Windows\SysWOW64\TASKKILL.exe
    TASKKILL /S COMPUTERNAME /F /IM inetinfo.exe /T
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3208
- - C:\Windows\SysWOW64\TASKKILL.exe
    TASKKILL /S COMPUTERNAME /F /IM svchost.exe /T
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2528
- - C:\Windows\3610F41RVTUUW.exe
    C:\Windows\3610F41RVTUUW.exe
    3⤵
    - Modifies WinLogon for persistence
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:5000
  - - C:\Windows\SysWOW64\TASKKILL.exe
      TASKKILL /S COMPUTERNAME /F /IM winlogon.exe /T
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4436
  - - C:\Windows\SysWOW64\TASKKILL.exe
      TASKKILL /S COMPUTERNAME /F /IM services.exe /T
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1908
  - - C:\Windows\SysWOW64\TASKKILL.exe
      TASKKILL /S COMPUTERNAME /F /IM lsass.exe /T
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4692
  - - C:\Windows\SysWOW64\TASKKILL.exe
      TASKKILL /S COMPUTERNAME /F /IM csrss.exe /T
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1956
  - - C:\Windows\SysWOW64\TASKKILL.exe
      TASKKILL /S COMPUTERNAME /F /IM smss.exe /T
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1840
  - - C:\Windows\SysWOW64\TASKKILL.exe
      TASKKILL /S COMPUTERNAME /F /IM inetinfo.exe /T
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4672
  - - C:\Windows\SysWOW64\TASKKILL.exe
      TASKKILL /S COMPUTERNAME /F /IM svchost.exe /T
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1280
  - - C:\Windows\SysWOW64\TASKKILL.exe
      TASKKILL /S COMPUTERNAME /F /IM winlogon.exe /T
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3488
  - - C:\Windows\SysWOW64\TASKKILL.exe
      TASKKILL /S COMPUTERNAME /F /IM services.exe /T
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3672
  - - C:\Windows\SysWOW64\TASKKILL.exe
      TASKKILL /S COMPUTERNAME /F /IM lsass.exe /T
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:216
  - - C:\Windows\SysWOW64\TASKKILL.exe
      TASKKILL /S COMPUTERNAME /F /IM csrss.exe /T
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4592
  - - C:\Windows\SysWOW64\TASKKILL.exe
      TASKKILL /S COMPUTERNAME /F /IM smss.exe /T
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2904
  - - C:\Windows\SysWOW64\TASKKILL.exe
      TASKKILL /S COMPUTERNAME /F /IM inetinfo.exe /T
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4892
  - - C:\Windows\SysWOW64\TASKKILL.exe
      TASKKILL /S COMPUTERNAME /F /IM svchost.exe /T
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2312
  - - C:\Windows\3610F41RVTUUW.exe
      C:\Windows\3610F41RVTUUW.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:840
  - - C:\Windows\3610F41.exe
      C:\Windows\3610F41.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:3760
- - C:\Windows\3610F41.exe
    C:\Windows\3610F41.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:772

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\3610F41.exe

Filesize
23KB

MD5
5b0a12be3ae69b32fe5cce24cee796ce

SHA1
4ec7c2972a20e723002b574df371eadda9e6f345

SHA256
c090c5175b4247f4d6d118d0cef093421048f053be90ebf5b3f30442bbf458d8

SHA512
c62e517c48de04c035bfb404d8e4adbb8bfcd81c4fa9d01a6db6545d443058853183a1e9ff3dd73d436f925ec608f354f63784ac059a3b55b5304ccabc3ec989

Download Submit
C:\Windows\3610F41RVTUUW.exe

Filesize
16KB

MD5
dd8458aedbbd4a0ef1cc0030fe232d87

SHA1
425ce52efeed2db6d81d39b7c56555597578ab48

SHA256
11dce98da4350436be3a2bd90d320839d418c832883dc81e9f421ba0a9c4919b

SHA512
acf84e6a83eaefeea5beda5c000b878e662052964f1a2ec1e755cc3e4cef3b1db4f46c58b3e5939e5428ab9aa8363e8bea1ffdd1fd7c9d6806419f61faf29f72

Download Submit
memory/772-35-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/840-24-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/2896-37-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/2896-0-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/3760-29-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/4268-46-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/4268-38-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/4268-60-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/4268-40-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/4268-58-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/4268-56-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/4268-42-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/4268-44-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/4268-54-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/4268-52-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/4268-50-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/4268-48-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/5000-51-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/5000-49-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/5000-47-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/5000-16-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/5000-53-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/5000-55-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/5000-45-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/5000-57-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/5000-43-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/5000-59-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/5000-41-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/5000-39-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/5000-61-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads