Analysis
-
max time kernel
149s -
max time network
141s -
platform
windows10-ltsc 2021_x64 -
resource
win10ltsc2021-20241023-en -
resource tags
arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system -
submitted
06-11-2024 06:26
Behavioral task
behavioral1
Sample
311edf744c2e90d7bfc550c893478f43d1d7977694d5dcecf219795f3eb99b86.exe
Resource
win10ltsc2021-20241023-en
windows10-ltsc 2021-x64
12 signatures
150 seconds
General
-
Target
311edf744c2e90d7bfc550c893478f43d1d7977694d5dcecf219795f3eb99b86.exe
-
Size
145KB
-
MD5
76b23dd72a883d8b1302bb4a514b7967
-
SHA1
338e19e8a3615c29d8a825ebba66cf55fa0caa2c
-
SHA256
311edf744c2e90d7bfc550c893478f43d1d7977694d5dcecf219795f3eb99b86
-
SHA512
39d98f914ec9d8551a894306163bc726f035f9228f3f198de78555988cea5a7b423be8c2a19913c76b996220a81a9b3a257b7f0af67913aa8a50b77321b17735
-
SSDEEP
1536:azICS4AAwczUUf8y8gvMH+1zGSNAojMP95D1xDtCYU0GsvgtwjECrozUYj3PeAU2:pqJogYkcSNm9V7DtCCGsg+AmYylQhTT
Score
9/10
Malware Config
Signatures
-
Renames multiple (538) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 2 IoCs
description ioc Process File opened for modification C:\$Recycle.Bin\S-1-5-21-641261377-2215826147-608237349-1000\desktop.ini 311edf744c2e90d7bfc550c893478f43d1d7977694d5dcecf219795f3eb99b86.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-641261377-2215826147-608237349-1000\desktop.ini 311edf744c2e90d7bfc550c893478f43d1d7977694d5dcecf219795f3eb99b86.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 311edf744c2e90d7bfc550c893478f43d1d7977694d5dcecf219795f3eb99b86.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe -
Modifies registry class 6 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.FihqnBxYm\ = "FihqnBxYm" 311edf744c2e90d7bfc550c893478f43d1d7977694d5dcecf219795f3eb99b86.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FihqnBxYm\DefaultIcon 311edf744c2e90d7bfc550c893478f43d1d7977694d5dcecf219795f3eb99b86.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FihqnBxYm 311edf744c2e90d7bfc550c893478f43d1d7977694d5dcecf219795f3eb99b86.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FihqnBxYm\DefaultIcon\ = "C:\\ProgramData\\FihqnBxYm.ico" 311edf744c2e90d7bfc550c893478f43d1d7977694d5dcecf219795f3eb99b86.exe Key created \REGISTRY\USER\S-1-5-21-641261377-2215826147-608237349-1000_Classes\Local Settings OpenWith.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.FihqnBxYm 311edf744c2e90d7bfc550c893478f43d1d7977694d5dcecf219795f3eb99b86.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1736 311edf744c2e90d7bfc550c893478f43d1d7977694d5dcecf219795f3eb99b86.exe 1736 311edf744c2e90d7bfc550c893478f43d1d7977694d5dcecf219795f3eb99b86.exe 1736 311edf744c2e90d7bfc550c893478f43d1d7977694d5dcecf219795f3eb99b86.exe 1736 311edf744c2e90d7bfc550c893478f43d1d7977694d5dcecf219795f3eb99b86.exe 1736 311edf744c2e90d7bfc550c893478f43d1d7977694d5dcecf219795f3eb99b86.exe 1736 311edf744c2e90d7bfc550c893478f43d1d7977694d5dcecf219795f3eb99b86.exe 1736 311edf744c2e90d7bfc550c893478f43d1d7977694d5dcecf219795f3eb99b86.exe 1736 311edf744c2e90d7bfc550c893478f43d1d7977694d5dcecf219795f3eb99b86.exe 1736 311edf744c2e90d7bfc550c893478f43d1d7977694d5dcecf219795f3eb99b86.exe 1736 311edf744c2e90d7bfc550c893478f43d1d7977694d5dcecf219795f3eb99b86.exe 1736 311edf744c2e90d7bfc550c893478f43d1d7977694d5dcecf219795f3eb99b86.exe 1736 311edf744c2e90d7bfc550c893478f43d1d7977694d5dcecf219795f3eb99b86.exe 1736 311edf744c2e90d7bfc550c893478f43d1d7977694d5dcecf219795f3eb99b86.exe 1736 311edf744c2e90d7bfc550c893478f43d1d7977694d5dcecf219795f3eb99b86.exe 1736 311edf744c2e90d7bfc550c893478f43d1d7977694d5dcecf219795f3eb99b86.exe 1736 311edf744c2e90d7bfc550c893478f43d1d7977694d5dcecf219795f3eb99b86.exe 1736 311edf744c2e90d7bfc550c893478f43d1d7977694d5dcecf219795f3eb99b86.exe 1736 311edf744c2e90d7bfc550c893478f43d1d7977694d5dcecf219795f3eb99b86.exe 1736 311edf744c2e90d7bfc550c893478f43d1d7977694d5dcecf219795f3eb99b86.exe 1736 311edf744c2e90d7bfc550c893478f43d1d7977694d5dcecf219795f3eb99b86.exe 1736 311edf744c2e90d7bfc550c893478f43d1d7977694d5dcecf219795f3eb99b86.exe 1736 311edf744c2e90d7bfc550c893478f43d1d7977694d5dcecf219795f3eb99b86.exe 1736 311edf744c2e90d7bfc550c893478f43d1d7977694d5dcecf219795f3eb99b86.exe 1736 311edf744c2e90d7bfc550c893478f43d1d7977694d5dcecf219795f3eb99b86.exe 1736 311edf744c2e90d7bfc550c893478f43d1d7977694d5dcecf219795f3eb99b86.exe 1736 311edf744c2e90d7bfc550c893478f43d1d7977694d5dcecf219795f3eb99b86.exe 1736 311edf744c2e90d7bfc550c893478f43d1d7977694d5dcecf219795f3eb99b86.exe 1736 311edf744c2e90d7bfc550c893478f43d1d7977694d5dcecf219795f3eb99b86.exe 1736 311edf744c2e90d7bfc550c893478f43d1d7977694d5dcecf219795f3eb99b86.exe 1736 311edf744c2e90d7bfc550c893478f43d1d7977694d5dcecf219795f3eb99b86.exe 1736 311edf744c2e90d7bfc550c893478f43d1d7977694d5dcecf219795f3eb99b86.exe 1736 311edf744c2e90d7bfc550c893478f43d1d7977694d5dcecf219795f3eb99b86.exe 1736 311edf744c2e90d7bfc550c893478f43d1d7977694d5dcecf219795f3eb99b86.exe 1736 311edf744c2e90d7bfc550c893478f43d1d7977694d5dcecf219795f3eb99b86.exe 1736 311edf744c2e90d7bfc550c893478f43d1d7977694d5dcecf219795f3eb99b86.exe 1736 311edf744c2e90d7bfc550c893478f43d1d7977694d5dcecf219795f3eb99b86.exe 1736 311edf744c2e90d7bfc550c893478f43d1d7977694d5dcecf219795f3eb99b86.exe 1736 311edf744c2e90d7bfc550c893478f43d1d7977694d5dcecf219795f3eb99b86.exe 1736 311edf744c2e90d7bfc550c893478f43d1d7977694d5dcecf219795f3eb99b86.exe 1736 311edf744c2e90d7bfc550c893478f43d1d7977694d5dcecf219795f3eb99b86.exe 1736 311edf744c2e90d7bfc550c893478f43d1d7977694d5dcecf219795f3eb99b86.exe 1736 311edf744c2e90d7bfc550c893478f43d1d7977694d5dcecf219795f3eb99b86.exe 1736 311edf744c2e90d7bfc550c893478f43d1d7977694d5dcecf219795f3eb99b86.exe 1736 311edf744c2e90d7bfc550c893478f43d1d7977694d5dcecf219795f3eb99b86.exe 1736 311edf744c2e90d7bfc550c893478f43d1d7977694d5dcecf219795f3eb99b86.exe 1736 311edf744c2e90d7bfc550c893478f43d1d7977694d5dcecf219795f3eb99b86.exe 1736 311edf744c2e90d7bfc550c893478f43d1d7977694d5dcecf219795f3eb99b86.exe 1736 311edf744c2e90d7bfc550c893478f43d1d7977694d5dcecf219795f3eb99b86.exe 1736 311edf744c2e90d7bfc550c893478f43d1d7977694d5dcecf219795f3eb99b86.exe 1736 311edf744c2e90d7bfc550c893478f43d1d7977694d5dcecf219795f3eb99b86.exe 1736 311edf744c2e90d7bfc550c893478f43d1d7977694d5dcecf219795f3eb99b86.exe 1736 311edf744c2e90d7bfc550c893478f43d1d7977694d5dcecf219795f3eb99b86.exe 1736 311edf744c2e90d7bfc550c893478f43d1d7977694d5dcecf219795f3eb99b86.exe 1736 311edf744c2e90d7bfc550c893478f43d1d7977694d5dcecf219795f3eb99b86.exe 1736 311edf744c2e90d7bfc550c893478f43d1d7977694d5dcecf219795f3eb99b86.exe 1736 311edf744c2e90d7bfc550c893478f43d1d7977694d5dcecf219795f3eb99b86.exe 1736 311edf744c2e90d7bfc550c893478f43d1d7977694d5dcecf219795f3eb99b86.exe 1736 311edf744c2e90d7bfc550c893478f43d1d7977694d5dcecf219795f3eb99b86.exe 1736 311edf744c2e90d7bfc550c893478f43d1d7977694d5dcecf219795f3eb99b86.exe 1736 311edf744c2e90d7bfc550c893478f43d1d7977694d5dcecf219795f3eb99b86.exe 1736 311edf744c2e90d7bfc550c893478f43d1d7977694d5dcecf219795f3eb99b86.exe 1736 311edf744c2e90d7bfc550c893478f43d1d7977694d5dcecf219795f3eb99b86.exe 1736 311edf744c2e90d7bfc550c893478f43d1d7977694d5dcecf219795f3eb99b86.exe 1736 311edf744c2e90d7bfc550c893478f43d1d7977694d5dcecf219795f3eb99b86.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4592 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeAssignPrimaryTokenPrivilege 1736 311edf744c2e90d7bfc550c893478f43d1d7977694d5dcecf219795f3eb99b86.exe Token: SeBackupPrivilege 1736 311edf744c2e90d7bfc550c893478f43d1d7977694d5dcecf219795f3eb99b86.exe Token: SeDebugPrivilege 1736 311edf744c2e90d7bfc550c893478f43d1d7977694d5dcecf219795f3eb99b86.exe Token: 36 1736 311edf744c2e90d7bfc550c893478f43d1d7977694d5dcecf219795f3eb99b86.exe Token: SeImpersonatePrivilege 1736 311edf744c2e90d7bfc550c893478f43d1d7977694d5dcecf219795f3eb99b86.exe Token: SeIncBasePriorityPrivilege 1736 311edf744c2e90d7bfc550c893478f43d1d7977694d5dcecf219795f3eb99b86.exe Token: SeIncreaseQuotaPrivilege 1736 311edf744c2e90d7bfc550c893478f43d1d7977694d5dcecf219795f3eb99b86.exe Token: 33 1736 311edf744c2e90d7bfc550c893478f43d1d7977694d5dcecf219795f3eb99b86.exe Token: SeManageVolumePrivilege 1736 311edf744c2e90d7bfc550c893478f43d1d7977694d5dcecf219795f3eb99b86.exe Token: SeProfSingleProcessPrivilege 1736 311edf744c2e90d7bfc550c893478f43d1d7977694d5dcecf219795f3eb99b86.exe Token: SeRestorePrivilege 1736 311edf744c2e90d7bfc550c893478f43d1d7977694d5dcecf219795f3eb99b86.exe Token: SeSecurityPrivilege 1736 311edf744c2e90d7bfc550c893478f43d1d7977694d5dcecf219795f3eb99b86.exe Token: SeSystemProfilePrivilege 1736 311edf744c2e90d7bfc550c893478f43d1d7977694d5dcecf219795f3eb99b86.exe Token: SeTakeOwnershipPrivilege 1736 311edf744c2e90d7bfc550c893478f43d1d7977694d5dcecf219795f3eb99b86.exe Token: SeShutdownPrivilege 1736 311edf744c2e90d7bfc550c893478f43d1d7977694d5dcecf219795f3eb99b86.exe Token: SeDebugPrivilege 1736 311edf744c2e90d7bfc550c893478f43d1d7977694d5dcecf219795f3eb99b86.exe Token: SeBackupPrivilege 1736 311edf744c2e90d7bfc550c893478f43d1d7977694d5dcecf219795f3eb99b86.exe Token: SeBackupPrivilege 1736 311edf744c2e90d7bfc550c893478f43d1d7977694d5dcecf219795f3eb99b86.exe Token: SeSecurityPrivilege 1736 311edf744c2e90d7bfc550c893478f43d1d7977694d5dcecf219795f3eb99b86.exe Token: SeSecurityPrivilege 1736 311edf744c2e90d7bfc550c893478f43d1d7977694d5dcecf219795f3eb99b86.exe Token: SeBackupPrivilege 1736 311edf744c2e90d7bfc550c893478f43d1d7977694d5dcecf219795f3eb99b86.exe Token: SeBackupPrivilege 1736 311edf744c2e90d7bfc550c893478f43d1d7977694d5dcecf219795f3eb99b86.exe Token: SeSecurityPrivilege 1736 311edf744c2e90d7bfc550c893478f43d1d7977694d5dcecf219795f3eb99b86.exe Token: SeSecurityPrivilege 1736 311edf744c2e90d7bfc550c893478f43d1d7977694d5dcecf219795f3eb99b86.exe Token: SeBackupPrivilege 1736 311edf744c2e90d7bfc550c893478f43d1d7977694d5dcecf219795f3eb99b86.exe Token: SeBackupPrivilege 1736 311edf744c2e90d7bfc550c893478f43d1d7977694d5dcecf219795f3eb99b86.exe Token: SeSecurityPrivilege 1736 311edf744c2e90d7bfc550c893478f43d1d7977694d5dcecf219795f3eb99b86.exe Token: SeSecurityPrivilege 1736 311edf744c2e90d7bfc550c893478f43d1d7977694d5dcecf219795f3eb99b86.exe Token: SeBackupPrivilege 1736 311edf744c2e90d7bfc550c893478f43d1d7977694d5dcecf219795f3eb99b86.exe Token: SeBackupPrivilege 1736 311edf744c2e90d7bfc550c893478f43d1d7977694d5dcecf219795f3eb99b86.exe Token: SeSecurityPrivilege 1736 311edf744c2e90d7bfc550c893478f43d1d7977694d5dcecf219795f3eb99b86.exe Token: SeSecurityPrivilege 1736 311edf744c2e90d7bfc550c893478f43d1d7977694d5dcecf219795f3eb99b86.exe Token: SeBackupPrivilege 1736 311edf744c2e90d7bfc550c893478f43d1d7977694d5dcecf219795f3eb99b86.exe Token: SeBackupPrivilege 1736 311edf744c2e90d7bfc550c893478f43d1d7977694d5dcecf219795f3eb99b86.exe Token: SeSecurityPrivilege 1736 311edf744c2e90d7bfc550c893478f43d1d7977694d5dcecf219795f3eb99b86.exe Token: SeSecurityPrivilege 1736 311edf744c2e90d7bfc550c893478f43d1d7977694d5dcecf219795f3eb99b86.exe Token: SeBackupPrivilege 1736 311edf744c2e90d7bfc550c893478f43d1d7977694d5dcecf219795f3eb99b86.exe Token: SeBackupPrivilege 1736 311edf744c2e90d7bfc550c893478f43d1d7977694d5dcecf219795f3eb99b86.exe Token: SeSecurityPrivilege 1736 311edf744c2e90d7bfc550c893478f43d1d7977694d5dcecf219795f3eb99b86.exe Token: SeSecurityPrivilege 1736 311edf744c2e90d7bfc550c893478f43d1d7977694d5dcecf219795f3eb99b86.exe Token: SeBackupPrivilege 1736 311edf744c2e90d7bfc550c893478f43d1d7977694d5dcecf219795f3eb99b86.exe Token: SeBackupPrivilege 1736 311edf744c2e90d7bfc550c893478f43d1d7977694d5dcecf219795f3eb99b86.exe Token: SeSecurityPrivilege 1736 311edf744c2e90d7bfc550c893478f43d1d7977694d5dcecf219795f3eb99b86.exe Token: SeSecurityPrivilege 1736 311edf744c2e90d7bfc550c893478f43d1d7977694d5dcecf219795f3eb99b86.exe Token: SeBackupPrivilege 1736 311edf744c2e90d7bfc550c893478f43d1d7977694d5dcecf219795f3eb99b86.exe Token: SeBackupPrivilege 1736 311edf744c2e90d7bfc550c893478f43d1d7977694d5dcecf219795f3eb99b86.exe Token: SeSecurityPrivilege 1736 311edf744c2e90d7bfc550c893478f43d1d7977694d5dcecf219795f3eb99b86.exe Token: SeSecurityPrivilege 1736 311edf744c2e90d7bfc550c893478f43d1d7977694d5dcecf219795f3eb99b86.exe Token: SeBackupPrivilege 1736 311edf744c2e90d7bfc550c893478f43d1d7977694d5dcecf219795f3eb99b86.exe Token: SeBackupPrivilege 1736 311edf744c2e90d7bfc550c893478f43d1d7977694d5dcecf219795f3eb99b86.exe Token: SeSecurityPrivilege 1736 311edf744c2e90d7bfc550c893478f43d1d7977694d5dcecf219795f3eb99b86.exe Token: SeSecurityPrivilege 1736 311edf744c2e90d7bfc550c893478f43d1d7977694d5dcecf219795f3eb99b86.exe Token: SeBackupPrivilege 1736 311edf744c2e90d7bfc550c893478f43d1d7977694d5dcecf219795f3eb99b86.exe Token: SeBackupPrivilege 1736 311edf744c2e90d7bfc550c893478f43d1d7977694d5dcecf219795f3eb99b86.exe Token: SeSecurityPrivilege 1736 311edf744c2e90d7bfc550c893478f43d1d7977694d5dcecf219795f3eb99b86.exe Token: SeSecurityPrivilege 1736 311edf744c2e90d7bfc550c893478f43d1d7977694d5dcecf219795f3eb99b86.exe Token: SeBackupPrivilege 1736 311edf744c2e90d7bfc550c893478f43d1d7977694d5dcecf219795f3eb99b86.exe Token: SeBackupPrivilege 1736 311edf744c2e90d7bfc550c893478f43d1d7977694d5dcecf219795f3eb99b86.exe Token: SeSecurityPrivilege 1736 311edf744c2e90d7bfc550c893478f43d1d7977694d5dcecf219795f3eb99b86.exe Token: SeSecurityPrivilege 1736 311edf744c2e90d7bfc550c893478f43d1d7977694d5dcecf219795f3eb99b86.exe Token: SeBackupPrivilege 1736 311edf744c2e90d7bfc550c893478f43d1d7977694d5dcecf219795f3eb99b86.exe Token: SeBackupPrivilege 1736 311edf744c2e90d7bfc550c893478f43d1d7977694d5dcecf219795f3eb99b86.exe Token: SeSecurityPrivilege 1736 311edf744c2e90d7bfc550c893478f43d1d7977694d5dcecf219795f3eb99b86.exe Token: SeSecurityPrivilege 1736 311edf744c2e90d7bfc550c893478f43d1d7977694d5dcecf219795f3eb99b86.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 4592 taskmgr.exe 4592 taskmgr.exe 4592 taskmgr.exe 4592 taskmgr.exe 4592 taskmgr.exe 4592 taskmgr.exe 4592 taskmgr.exe 4592 taskmgr.exe 4592 taskmgr.exe 4592 taskmgr.exe 4592 taskmgr.exe 4592 taskmgr.exe 4592 taskmgr.exe 4592 taskmgr.exe 4592 taskmgr.exe 4592 taskmgr.exe 4592 taskmgr.exe 4592 taskmgr.exe 4592 taskmgr.exe 4592 taskmgr.exe 4592 taskmgr.exe 4592 taskmgr.exe 4592 taskmgr.exe 4592 taskmgr.exe 4592 taskmgr.exe 4592 taskmgr.exe 4592 taskmgr.exe 4592 taskmgr.exe 4592 taskmgr.exe 4592 taskmgr.exe 4592 taskmgr.exe 4592 taskmgr.exe 4592 taskmgr.exe 4592 taskmgr.exe 4592 taskmgr.exe 4592 taskmgr.exe 4592 taskmgr.exe 4592 taskmgr.exe 4592 taskmgr.exe 4592 taskmgr.exe 4592 taskmgr.exe 4592 taskmgr.exe 4592 taskmgr.exe 4592 taskmgr.exe 4592 taskmgr.exe 4592 taskmgr.exe 4592 taskmgr.exe 4592 taskmgr.exe 4592 taskmgr.exe 4592 taskmgr.exe 4592 taskmgr.exe 4592 taskmgr.exe 4592 taskmgr.exe 4592 taskmgr.exe 4592 taskmgr.exe 4592 taskmgr.exe 4592 taskmgr.exe 4592 taskmgr.exe 4592 taskmgr.exe 4592 taskmgr.exe 4592 taskmgr.exe 4592 taskmgr.exe 4592 taskmgr.exe 4592 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 4592 taskmgr.exe 4592 taskmgr.exe 4592 taskmgr.exe 4592 taskmgr.exe 4592 taskmgr.exe 4592 taskmgr.exe 4592 taskmgr.exe 4592 taskmgr.exe 4592 taskmgr.exe 4592 taskmgr.exe 4592 taskmgr.exe 4592 taskmgr.exe 4592 taskmgr.exe 4592 taskmgr.exe 4592 taskmgr.exe 4592 taskmgr.exe 4592 taskmgr.exe 4592 taskmgr.exe 4592 taskmgr.exe 4592 taskmgr.exe 4592 taskmgr.exe 4592 taskmgr.exe 4592 taskmgr.exe 4592 taskmgr.exe 4592 taskmgr.exe 4592 taskmgr.exe 4592 taskmgr.exe 4592 taskmgr.exe 4592 taskmgr.exe 4592 taskmgr.exe 4592 taskmgr.exe 4592 taskmgr.exe 4592 taskmgr.exe 4592 taskmgr.exe 4592 taskmgr.exe 4592 taskmgr.exe 4592 taskmgr.exe 4592 taskmgr.exe 4592 taskmgr.exe 4592 taskmgr.exe 4592 taskmgr.exe 4592 taskmgr.exe 4592 taskmgr.exe 4592 taskmgr.exe 4592 taskmgr.exe 4592 taskmgr.exe 4592 taskmgr.exe 4592 taskmgr.exe 4592 taskmgr.exe 4592 taskmgr.exe 4592 taskmgr.exe 4592 taskmgr.exe 4592 taskmgr.exe 4592 taskmgr.exe 4592 taskmgr.exe 4592 taskmgr.exe 4592 taskmgr.exe 4592 taskmgr.exe 4592 taskmgr.exe 4592 taskmgr.exe 4592 taskmgr.exe 4592 taskmgr.exe 4592 taskmgr.exe 4592 taskmgr.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3680 OpenWith.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\311edf744c2e90d7bfc550c893478f43d1d7977694d5dcecf219795f3eb99b86.exe"C:\Users\Admin\AppData\Local\Temp\311edf744c2e90d7bfc550c893478f43d1d7977694d5dcecf219795f3eb99b86.exe"1⤵
- Drops desktop.ini file(s)
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1736
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3680
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4592
Network
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129B
MD56f86430fd71536b6939002c86bc50307
SHA1786b5b401211dc438808eba1e256b6050529245d
SHA25600119260976026bfb0b4984f511438cb77c1f7bc07bd7b8ec9cab21cba335f7d
SHA512ff2b50af1be96328c80583e6e99173814adbf41de6f26420783718e14cedc1a13baa4bb558656002142ad81c2deb08bbfa52e91833ca9cd330bb78ca74874889
-
Filesize
129B
MD565c44be3ea6375e559bebb50880faf9c
SHA1bbde47cc38c6affc7d97d535617f1c842ccaedf2
SHA256a13ef47e13e77719c7bb10fe883abb9b5141be49bf0c5226dcbb966276304b82
SHA512ab391cffc5a00cfc6d88710b06957eac74c480f514de96d754aef6404c477f2a8333fc750a66e30eb2de930b40a9c1352074696d7c3051d546d0b69b742f0dc4