Analysis
-
max time kernel
150s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
19-10-2024 20:30
Behavioral task
behavioral1
Sample
41eba88da3b59ad7be8f21bc031c74d9341d5905b55d4de644eca7849a91e664.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
41eba88da3b59ad7be8f21bc031c74d9341d5905b55d4de644eca7849a91e664.exe
Resource
win10v2004-20241007-en
General
-
Target
41eba88da3b59ad7be8f21bc031c74d9341d5905b55d4de644eca7849a91e664.exe
-
Size
80KB
-
MD5
8253c8ad1432c453ccc6b26434436d9c
-
SHA1
f73e24cdebbe4a27e314072a11b602911bba0775
-
SHA256
41eba88da3b59ad7be8f21bc031c74d9341d5905b55d4de644eca7849a91e664
-
SHA512
3cacb2ca124d3c7505cf6ffe0706e1cda3a4e7fcfdd18f2c779da353dd3ffb1e4092259c68e90e42035869c31295975e8c397d7e9f6088e4a0b026594a554d21
-
SSDEEP
1536:dPvK/3zvzVQtCsscKvWYjzJxuOmb54vHTL6lm:diqCspGzVmb5uHv6lm
Malware Config
Extracted
blacknet
HacKed
https://lovegunny.net/
BN[GnFquUJG-0548378]
-
antivm
false
-
elevate_uac
true
-
install_name
WindowsUpdate.exe
-
splitter
|BN|
-
start_name
cde2f914e4cce7f13b2c1cec7b6da970
-
startup
false
-
usb_spread
true
Signatures
-
BlackNET payload 1 IoCs
resource yara_rule behavioral1/files/0x0007000000016cc5-50.dat family_blacknet -
Contains code to disable Windows Defender 1 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
resource yara_rule behavioral1/files/0x0007000000016cc5-50.dat disable_win_def -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" 41eba88da3b59ad7be8f21bc031c74d9341d5905b55d4de644eca7849a91e664.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" 41eba88da3b59ad7be8f21bc031c74d9341d5905b55d4de644eca7849a91e664.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" 41eba88da3b59ad7be8f21bc031c74d9341d5905b55d4de644eca7849a91e664.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection 41eba88da3b59ad7be8f21bc031c74d9341d5905b55d4de644eca7849a91e664.exe -
Executes dropped EXE 1 IoCs
pid Process 2560 WindowsUpdate.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features 41eba88da3b59ad7be8f21bc031c74d9341d5905b55d4de644eca7849a91e664.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features WindowsUpdate.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\cde2f914e4cce7f13b2c1cec7b6da970 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Microsoft\\MyClient\\WindowsUpdate.exe" 41eba88da3b59ad7be8f21bc031c74d9341d5905b55d4de644eca7849a91e664.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\SystemCertificates\CA\Certificates\D89E3BD43D5D909B47A18977AA9D5CE36CEE184C 41eba88da3b59ad7be8f21bc031c74d9341d5905b55d4de644eca7849a91e664.exe Set value (data) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\SystemCertificates\CA\Certificates\D89E3BD43D5D909B47A18977AA9D5CE36CEE184C\Blob = 030000000100000014000000d89e3bd43d5d909b47a18977aa9d5ce36cee184c1400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb040000000100000010000000285ec909c4ab0d2d57f5086b225799aa0f000000010000003000000013baa039635f1c5292a8c2f36aae7e1d25c025202e9092f5b0f53f5f752dfa9c71b3d1b8d9a6358fcee6ec75622fabf9190000000100000010000000ea6089055218053dd01e37e1d806eedf1800000001000000100000002aa1c05e2ae606f198c2c5e937c97aa22000000001000000850500003082058130820469a00302010202103972443af922b751d7d36c10dd313595300d06092a864886f70d01010c0500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3139303331323030303030305a170d3238313233313233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a381f23081ef301f0603551d23041830168014a0110a233e96f107ece2af29ef82a57fd030a4b4301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff30110603551d20040a300830060604551d200030430603551d1f043c303a3038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c303406082b0601050507010104283026302406082b060105050730018618687474703a2f2f6f6373702e636f6d6f646f63612e636f6d300d06092a864886f70d01010c05000382010100188751dc74213d9c8ae027b733d02eccecf0e6cb5e11de226f9b758e9e72fee4d6feaa1f9c962def034a7eaef48d6f723c433bc03febb8df5caaa9c6aef2fcd8eea37b43f686367c14e0cdf4f73ffedeb8b48af09196fefd43647efdccd201a17d7df81919c9422b13bf588bbaa4a266047688914e0c8914cea24dc932b3bae8141abc71f15bf0410b98000a220310e50cb1f9cd923719ed3bf1e43ab6f945132675afbbaaef3f7b773bd2c402913d1900d3175c39db3f7b180d45cd9385962f5ddf59164f3f51bdd545183fed4a8ee80661742316b50d50732744477f105d892a6b853114c4e8a96a4c80bc6a78cfb87f8e7672990c9dfed7910816a1a35f95 41eba88da3b59ad7be8f21bc031c74d9341d5905b55d4de644eca7849a91e664.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 WindowsUpdate.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e WindowsUpdate.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e WindowsUpdate.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d00f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e WindowsUpdate.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2092 41eba88da3b59ad7be8f21bc031c74d9341d5905b55d4de644eca7849a91e664.exe 2092 41eba88da3b59ad7be8f21bc031c74d9341d5905b55d4de644eca7849a91e664.exe 2092 41eba88da3b59ad7be8f21bc031c74d9341d5905b55d4de644eca7849a91e664.exe 2092 41eba88da3b59ad7be8f21bc031c74d9341d5905b55d4de644eca7849a91e664.exe 2092 41eba88da3b59ad7be8f21bc031c74d9341d5905b55d4de644eca7849a91e664.exe 2092 41eba88da3b59ad7be8f21bc031c74d9341d5905b55d4de644eca7849a91e664.exe 2092 41eba88da3b59ad7be8f21bc031c74d9341d5905b55d4de644eca7849a91e664.exe 2092 41eba88da3b59ad7be8f21bc031c74d9341d5905b55d4de644eca7849a91e664.exe 2092 41eba88da3b59ad7be8f21bc031c74d9341d5905b55d4de644eca7849a91e664.exe 2092 41eba88da3b59ad7be8f21bc031c74d9341d5905b55d4de644eca7849a91e664.exe 2092 41eba88da3b59ad7be8f21bc031c74d9341d5905b55d4de644eca7849a91e664.exe 2092 41eba88da3b59ad7be8f21bc031c74d9341d5905b55d4de644eca7849a91e664.exe 2092 41eba88da3b59ad7be8f21bc031c74d9341d5905b55d4de644eca7849a91e664.exe 2092 41eba88da3b59ad7be8f21bc031c74d9341d5905b55d4de644eca7849a91e664.exe 2092 41eba88da3b59ad7be8f21bc031c74d9341d5905b55d4de644eca7849a91e664.exe 2092 41eba88da3b59ad7be8f21bc031c74d9341d5905b55d4de644eca7849a91e664.exe 2092 41eba88da3b59ad7be8f21bc031c74d9341d5905b55d4de644eca7849a91e664.exe 2092 41eba88da3b59ad7be8f21bc031c74d9341d5905b55d4de644eca7849a91e664.exe 2092 41eba88da3b59ad7be8f21bc031c74d9341d5905b55d4de644eca7849a91e664.exe 2092 41eba88da3b59ad7be8f21bc031c74d9341d5905b55d4de644eca7849a91e664.exe 2092 41eba88da3b59ad7be8f21bc031c74d9341d5905b55d4de644eca7849a91e664.exe 2092 41eba88da3b59ad7be8f21bc031c74d9341d5905b55d4de644eca7849a91e664.exe 2092 41eba88da3b59ad7be8f21bc031c74d9341d5905b55d4de644eca7849a91e664.exe 2092 41eba88da3b59ad7be8f21bc031c74d9341d5905b55d4de644eca7849a91e664.exe 2092 41eba88da3b59ad7be8f21bc031c74d9341d5905b55d4de644eca7849a91e664.exe 2092 41eba88da3b59ad7be8f21bc031c74d9341d5905b55d4de644eca7849a91e664.exe 2092 41eba88da3b59ad7be8f21bc031c74d9341d5905b55d4de644eca7849a91e664.exe 2092 41eba88da3b59ad7be8f21bc031c74d9341d5905b55d4de644eca7849a91e664.exe 2092 41eba88da3b59ad7be8f21bc031c74d9341d5905b55d4de644eca7849a91e664.exe 2092 41eba88da3b59ad7be8f21bc031c74d9341d5905b55d4de644eca7849a91e664.exe 2092 41eba88da3b59ad7be8f21bc031c74d9341d5905b55d4de644eca7849a91e664.exe 2092 41eba88da3b59ad7be8f21bc031c74d9341d5905b55d4de644eca7849a91e664.exe 2092 41eba88da3b59ad7be8f21bc031c74d9341d5905b55d4de644eca7849a91e664.exe 2092 41eba88da3b59ad7be8f21bc031c74d9341d5905b55d4de644eca7849a91e664.exe 2092 41eba88da3b59ad7be8f21bc031c74d9341d5905b55d4de644eca7849a91e664.exe 2092 41eba88da3b59ad7be8f21bc031c74d9341d5905b55d4de644eca7849a91e664.exe 2092 41eba88da3b59ad7be8f21bc031c74d9341d5905b55d4de644eca7849a91e664.exe 2092 41eba88da3b59ad7be8f21bc031c74d9341d5905b55d4de644eca7849a91e664.exe 2092 41eba88da3b59ad7be8f21bc031c74d9341d5905b55d4de644eca7849a91e664.exe 2092 41eba88da3b59ad7be8f21bc031c74d9341d5905b55d4de644eca7849a91e664.exe 2092 41eba88da3b59ad7be8f21bc031c74d9341d5905b55d4de644eca7849a91e664.exe 2092 41eba88da3b59ad7be8f21bc031c74d9341d5905b55d4de644eca7849a91e664.exe 2092 41eba88da3b59ad7be8f21bc031c74d9341d5905b55d4de644eca7849a91e664.exe 2092 41eba88da3b59ad7be8f21bc031c74d9341d5905b55d4de644eca7849a91e664.exe 2092 41eba88da3b59ad7be8f21bc031c74d9341d5905b55d4de644eca7849a91e664.exe 2092 41eba88da3b59ad7be8f21bc031c74d9341d5905b55d4de644eca7849a91e664.exe 2092 41eba88da3b59ad7be8f21bc031c74d9341d5905b55d4de644eca7849a91e664.exe 2092 41eba88da3b59ad7be8f21bc031c74d9341d5905b55d4de644eca7849a91e664.exe 2092 41eba88da3b59ad7be8f21bc031c74d9341d5905b55d4de644eca7849a91e664.exe 2092 41eba88da3b59ad7be8f21bc031c74d9341d5905b55d4de644eca7849a91e664.exe 2092 41eba88da3b59ad7be8f21bc031c74d9341d5905b55d4de644eca7849a91e664.exe 2092 41eba88da3b59ad7be8f21bc031c74d9341d5905b55d4de644eca7849a91e664.exe 2092 41eba88da3b59ad7be8f21bc031c74d9341d5905b55d4de644eca7849a91e664.exe 2092 41eba88da3b59ad7be8f21bc031c74d9341d5905b55d4de644eca7849a91e664.exe 2092 41eba88da3b59ad7be8f21bc031c74d9341d5905b55d4de644eca7849a91e664.exe 2092 41eba88da3b59ad7be8f21bc031c74d9341d5905b55d4de644eca7849a91e664.exe 2092 41eba88da3b59ad7be8f21bc031c74d9341d5905b55d4de644eca7849a91e664.exe 2092 41eba88da3b59ad7be8f21bc031c74d9341d5905b55d4de644eca7849a91e664.exe 2092 41eba88da3b59ad7be8f21bc031c74d9341d5905b55d4de644eca7849a91e664.exe 2092 41eba88da3b59ad7be8f21bc031c74d9341d5905b55d4de644eca7849a91e664.exe 2092 41eba88da3b59ad7be8f21bc031c74d9341d5905b55d4de644eca7849a91e664.exe 2092 41eba88da3b59ad7be8f21bc031c74d9341d5905b55d4de644eca7849a91e664.exe 2092 41eba88da3b59ad7be8f21bc031c74d9341d5905b55d4de644eca7849a91e664.exe 2092 41eba88da3b59ad7be8f21bc031c74d9341d5905b55d4de644eca7849a91e664.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 2092 41eba88da3b59ad7be8f21bc031c74d9341d5905b55d4de644eca7849a91e664.exe Token: SeDebugPrivilege 2796 powershell.exe Token: SeDebugPrivilege 2560 WindowsUpdate.exe Token: SeDebugPrivilege 2344 powershell.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 2092 wrote to memory of 2796 2092 41eba88da3b59ad7be8f21bc031c74d9341d5905b55d4de644eca7849a91e664.exe 32 PID 2092 wrote to memory of 2796 2092 41eba88da3b59ad7be8f21bc031c74d9341d5905b55d4de644eca7849a91e664.exe 32 PID 2092 wrote to memory of 2796 2092 41eba88da3b59ad7be8f21bc031c74d9341d5905b55d4de644eca7849a91e664.exe 32 PID 2092 wrote to memory of 2560 2092 41eba88da3b59ad7be8f21bc031c74d9341d5905b55d4de644eca7849a91e664.exe 34 PID 2092 wrote to memory of 2560 2092 41eba88da3b59ad7be8f21bc031c74d9341d5905b55d4de644eca7849a91e664.exe 34 PID 2092 wrote to memory of 2560 2092 41eba88da3b59ad7be8f21bc031c74d9341d5905b55d4de644eca7849a91e664.exe 34 PID 2560 wrote to memory of 2344 2560 WindowsUpdate.exe 35 PID 2560 wrote to memory of 2344 2560 WindowsUpdate.exe 35 PID 2560 wrote to memory of 2344 2560 WindowsUpdate.exe 35
Processes
-
C:\Users\Admin\AppData\Local\Temp\41eba88da3b59ad7be8f21bc031c74d9341d5905b55d4de644eca7849a91e664.exe"C:\Users\Admin\AppData\Local\Temp\41eba88da3b59ad7be8f21bc031c74d9341d5905b55d4de644eca7849a91e664.exe"1⤵
- Modifies Windows Defender Real-time Protection settings
- Windows security modification
- Adds Run key to start application
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2092 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" Get-MpPreference -verbose2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2796
-
-
C:\Users\Admin\AppData\Local\Temp\Microsoft\MyClient\WindowsUpdate.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft\MyClient\WindowsUpdate.exe"2⤵
- Executes dropped EXE
- Windows security modification
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2560 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" Get-MpPreference -verbose3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2344
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
80KB
MD58253c8ad1432c453ccc6b26434436d9c
SHA1f73e24cdebbe4a27e314072a11b602911bba0775
SHA25641eba88da3b59ad7be8f21bc031c74d9341d5905b55d4de644eca7849a91e664
SHA5123cacb2ca124d3c7505cf6ffe0706e1cda3a4e7fcfdd18f2c779da353dd3ffb1e4092259c68e90e42035869c31295975e8c397d7e9f6088e4a0b026594a554d21
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize7KB
MD58908651dd93b18b47a7af9f3c23adc8a
SHA14e0777a89090b3d8ba25025554fd8e73ede1ceac
SHA2562be131f5f066ae9d3bfd12ded935e4858cd839212af1d1e5530d128817d639c4
SHA512dfaf1b98574416def9c55bd50282ead80d14f13ae4bc3e373c6f45b8df0e3d87c358738192cf3a39acf8d4be21ae604cd13b4121028eaa887505c5d17d2322c0
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\DWBEGIAYLJCFYPCALFLY.temp
Filesize7KB
MD5fac486660ce82d25c14a9f1402d87c70
SHA10838ef9ba1a6e5aceb013245a3efe21dd03da3ac
SHA256d274c8f0320009ce5af7fdd678546c0513680645b834e9badf4c07d1c5dc8921
SHA512c8f9af67c0ae4f28f7432d40c5b18b81aa552ed6338662359561228f809135760225c4d9a422fc3c2284bc106baea7a11a7f113271cfaab2daefbf0517f84556