Analysis
-
max time kernel
149s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
28/09/2024, 11:50
Static task
static1
Behavioral task
behavioral1
Sample
procexp64.1.exe
Resource
win7-20240708-en
windows7-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
procexp64.1.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
0 signatures
150 seconds
General
-
Target
procexp64.1.exe
-
Size
2.3MB
-
MD5
dfeea73e421c76deb18d5ca0800dccf2
-
SHA1
0497eba0b24d0f4500faad5ae96dbebab9c64608
-
SHA256
8158dc0569972c10056f507cf9e72f4946600ce163c4c659a610480585cd4935
-
SHA512
23ddc9f28314d4cf3b05d88b9e0b6fd69f9804f5e9c3f7703258ff2c5786721061321379fde53e21048d3c7cce1ff71e2872d48dcc580d059397fa0692335630
-
SSDEEP
24576:KDdzFYrinOS7FJF3WJ/Et7/LSYUymq3PuPmjBp4Mjc7qWMWKEzy3J:KDdxw6dXF3W1QrL1UDq3P8mlp4DOZ
Score
8/10
Malware Config
Signatures
-
Drops file in Drivers directory 1 IoCs
description ioc Process File created C:\Windows\system32\Drivers\PROCEXP152.SYS procexp64.1.exe -
Sets service image path in registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\PROCEXP152\ImagePath = "\\??\\C:\\Windows\\system32\\Drivers\\PROCEXP152.SYS" procexp64.1.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Y: procexp64.1.exe File opened (read-only) \??\Z: procexp64.1.exe File opened (read-only) \??\E: procexp64.1.exe File opened (read-only) \??\H: procexp64.1.exe File opened (read-only) \??\K: procexp64.1.exe File opened (read-only) \??\O: procexp64.1.exe File opened (read-only) \??\N: procexp64.1.exe File opened (read-only) \??\Q: procexp64.1.exe File opened (read-only) \??\M: procexp64.1.exe File opened (read-only) \??\P: procexp64.1.exe File opened (read-only) \??\S: procexp64.1.exe File opened (read-only) \??\T: procexp64.1.exe File opened (read-only) \??\A: procexp64.1.exe File opened (read-only) \??\B: procexp64.1.exe File opened (read-only) \??\I: procexp64.1.exe File opened (read-only) \??\J: procexp64.1.exe File opened (read-only) \??\U: procexp64.1.exe File opened (read-only) \??\W: procexp64.1.exe File opened (read-only) \??\X: procexp64.1.exe File opened (read-only) \??\G: procexp64.1.exe File opened (read-only) \??\L: procexp64.1.exe File opened (read-only) \??\R: procexp64.1.exe File opened (read-only) \??\V: procexp64.1.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz procexp64.1.exe Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 procexp64.1.exe -
Modifies data under HKEY_USERS 3 IoCs
description ioc Process Key created \REGISTRY\USER\.Default procexp64.1.exe Key created \REGISTRY\USER\S-1-5-19 procexp64.1.exe Key created \REGISTRY\USER\S-1-5-20 procexp64.1.exe -
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde procexp64.1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43 procexp64.1.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 0f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d432000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 procexp64.1.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa62000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 procexp64.1.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d43190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 procexp64.1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436 procexp64.1.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2384 procexp64.1.exe 2384 procexp64.1.exe 2384 procexp64.1.exe 2384 procexp64.1.exe 2384 procexp64.1.exe 2384 procexp64.1.exe 2384 procexp64.1.exe 2384 procexp64.1.exe 2384 procexp64.1.exe 2384 procexp64.1.exe 2384 procexp64.1.exe 2384 procexp64.1.exe 2384 procexp64.1.exe 2384 procexp64.1.exe 2384 procexp64.1.exe 2384 procexp64.1.exe 2384 procexp64.1.exe 2384 procexp64.1.exe 2384 procexp64.1.exe 2384 procexp64.1.exe 2384 procexp64.1.exe 2384 procexp64.1.exe 2384 procexp64.1.exe 2384 procexp64.1.exe 2384 procexp64.1.exe 2384 procexp64.1.exe 2384 procexp64.1.exe 2384 procexp64.1.exe 2384 procexp64.1.exe 2384 procexp64.1.exe 2384 procexp64.1.exe 2384 procexp64.1.exe 2384 procexp64.1.exe 2384 procexp64.1.exe 2384 procexp64.1.exe 2384 procexp64.1.exe 2384 procexp64.1.exe 2384 procexp64.1.exe 2384 procexp64.1.exe 2384 procexp64.1.exe 2384 procexp64.1.exe 2384 procexp64.1.exe 2384 procexp64.1.exe 2384 procexp64.1.exe 2384 procexp64.1.exe 2384 procexp64.1.exe 2384 procexp64.1.exe 2384 procexp64.1.exe 2384 procexp64.1.exe 2384 procexp64.1.exe 2384 procexp64.1.exe 2384 procexp64.1.exe 2384 procexp64.1.exe 2384 procexp64.1.exe 2384 procexp64.1.exe 2384 procexp64.1.exe 2384 procexp64.1.exe 2384 procexp64.1.exe 2384 procexp64.1.exe 2384 procexp64.1.exe 2384 procexp64.1.exe 2384 procexp64.1.exe 2384 procexp64.1.exe 2384 procexp64.1.exe -
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 2384 procexp64.1.exe -
Suspicious use of AdjustPrivilegeToken 13 IoCs
description pid Process Token: SeDebugPrivilege 2384 procexp64.1.exe Token: SeBackupPrivilege 2384 procexp64.1.exe Token: SeSecurityPrivilege 2384 procexp64.1.exe Token: SeLoadDriverPrivilege 2384 procexp64.1.exe Token: SeShutdownPrivilege 2384 procexp64.1.exe Token: SeShutdownPrivilege 2384 procexp64.1.exe Token: SeDebugPrivilege 2384 procexp64.1.exe Token: SeImpersonatePrivilege 2384 procexp64.1.exe Token: SeSecurityPrivilege 2384 procexp64.1.exe Token: SeDebugPrivilege 2384 procexp64.1.exe Token: SeBackupPrivilege 2384 procexp64.1.exe Token: SeDebugPrivilege 2384 procexp64.1.exe Token: SeRestorePrivilege 2384 procexp64.1.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2384 procexp64.1.exe 2384 procexp64.1.exe 2384 procexp64.1.exe 2384 procexp64.1.exe 2384 procexp64.1.exe 2384 procexp64.1.exe 2384 procexp64.1.exe 2384 procexp64.1.exe 2384 procexp64.1.exe 2384 procexp64.1.exe 2384 procexp64.1.exe 2384 procexp64.1.exe 2384 procexp64.1.exe 2384 procexp64.1.exe 2384 procexp64.1.exe 2384 procexp64.1.exe 2384 procexp64.1.exe 2384 procexp64.1.exe 2384 procexp64.1.exe 2384 procexp64.1.exe 2384 procexp64.1.exe 2384 procexp64.1.exe 2384 procexp64.1.exe 2384 procexp64.1.exe 2384 procexp64.1.exe 2384 procexp64.1.exe 2384 procexp64.1.exe 2384 procexp64.1.exe 2384 procexp64.1.exe 2384 procexp64.1.exe 2384 procexp64.1.exe 2384 procexp64.1.exe 2384 procexp64.1.exe 2384 procexp64.1.exe 2384 procexp64.1.exe 2384 procexp64.1.exe 2384 procexp64.1.exe 2384 procexp64.1.exe 2384 procexp64.1.exe 2384 procexp64.1.exe 2384 procexp64.1.exe 2384 procexp64.1.exe 2384 procexp64.1.exe 2384 procexp64.1.exe 2384 procexp64.1.exe 2384 procexp64.1.exe 2384 procexp64.1.exe 2384 procexp64.1.exe 2384 procexp64.1.exe 2384 procexp64.1.exe 2384 procexp64.1.exe 2384 procexp64.1.exe 2384 procexp64.1.exe 2384 procexp64.1.exe 2384 procexp64.1.exe 2384 procexp64.1.exe 2384 procexp64.1.exe 2384 procexp64.1.exe 2384 procexp64.1.exe 2384 procexp64.1.exe 2384 procexp64.1.exe 2384 procexp64.1.exe 2384 procexp64.1.exe 2384 procexp64.1.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2384 procexp64.1.exe 2384 procexp64.1.exe 2384 procexp64.1.exe 2384 procexp64.1.exe 2384 procexp64.1.exe 2384 procexp64.1.exe 2384 procexp64.1.exe 2384 procexp64.1.exe 2384 procexp64.1.exe 2384 procexp64.1.exe 2384 procexp64.1.exe 2384 procexp64.1.exe 2384 procexp64.1.exe 2384 procexp64.1.exe 2384 procexp64.1.exe 2384 procexp64.1.exe 2384 procexp64.1.exe 2384 procexp64.1.exe 2384 procexp64.1.exe 2384 procexp64.1.exe 2384 procexp64.1.exe 2384 procexp64.1.exe 2384 procexp64.1.exe 2384 procexp64.1.exe 2384 procexp64.1.exe 2384 procexp64.1.exe 2384 procexp64.1.exe 2384 procexp64.1.exe 2384 procexp64.1.exe 2384 procexp64.1.exe 2384 procexp64.1.exe 2384 procexp64.1.exe 2384 procexp64.1.exe 2384 procexp64.1.exe 2384 procexp64.1.exe 2384 procexp64.1.exe 2384 procexp64.1.exe 2384 procexp64.1.exe 2384 procexp64.1.exe 2384 procexp64.1.exe 2384 procexp64.1.exe 2384 procexp64.1.exe 2384 procexp64.1.exe 2384 procexp64.1.exe 2384 procexp64.1.exe 2384 procexp64.1.exe 2384 procexp64.1.exe 2384 procexp64.1.exe 2384 procexp64.1.exe 2384 procexp64.1.exe 2384 procexp64.1.exe 2384 procexp64.1.exe 2384 procexp64.1.exe 2384 procexp64.1.exe 2384 procexp64.1.exe 2384 procexp64.1.exe 2384 procexp64.1.exe 2384 procexp64.1.exe 2384 procexp64.1.exe 2384 procexp64.1.exe 2384 procexp64.1.exe 2384 procexp64.1.exe 2384 procexp64.1.exe 2384 procexp64.1.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\procexp64.1.exe"C:\Users\Admin\AppData\Local\Temp\procexp64.1.exe"1⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Enumerates connected drives
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2384
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Modify Registry
2Subvert Trust Controls
1Install Root Certificate
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b