Overview
overview
10Static
static
6AES-NI.exe
windows10-2004-x64
10Abrechnung.exe
windows10-2004-x64
8Box (2).exe
windows10-2004-x64
3Box.exe
windows10-2004-x64
3a66dde2298...43.exe
windows10-2004-x64
9a7768f4973...e0.exe
windows10-2004-x64
10aa7ff3bc28...1e.exe
windows10-2004-x64
7aace43af8d...99.exe
windows10-2004-x64
8ad3cc219a8...ws.dll
windows10-2004-x64
10aee03626b8...b1.exe
windows10-2004-x64
6afd3b729cf...2e.exe
windows10-2004-x64
10b56c4569d6...ss.exe
windows10-2004-x64
30.84762379...67.exe
windows10-2004-x64
3zsgblrbrum...ke.exe
windows10-2004-x64
3b7d9f11c16...b0.exe
windows10-2004-x64
5b8f60c64c7...af.exe
windows10-2004-x64
10Saldo.Pdf_...__.exe
windows10-2004-x64
bc557a7bfe...8f.exe
windows10-2004-x64
7bd2d4d4300...17.vbs
windows10-2004-x64
1be03e43db0...5F.exe
windows10-2004-x64
10be03e43db0...8A.exe
windows10-2004-x64
3be514549a2...1f.exe
windows10-2004-x64
9bfb8f7f6cb...-0.dll
windows10-2004-x64
8bldjad.ex1.exe
windows10-2004-x64
3bldjad.exe
windows10-2004-x64
3bldjad2.exe
windows10-2004-x64
5c145a26dd6...a0.exe
windows10-2004-x64
3c325092750...db.apk
windows10-2004-x64
3c36c46f4de...6e.exe
windows10-2004-x64
3c3dd2e3cf0...04.exe
windows10-2004-x64
3c71c26bf89...3_.exe
windows10-2004-x64
7c846282987...fd.exe
windows10-2004-x64
5Resubmissions
22-11-2024 22:54
241122-2vh7gaxmfl 1022-11-2024 03:27
241122-dzqkcatmht 1022-11-2024 03:16
241122-dsgc4atlgs 10Analysis
-
max time kernel
140s -
max time network
136s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
22-11-2024 22:54
Behavioral task
behavioral1
Sample
AES-NI.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
22 signatures
150 seconds
Behavioral task
behavioral2
Sample
Abrechnung.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral3
Sample
Box (2).exe
Resource
win10v2004-20241007-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral4
Sample
Box.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral5
Sample
a66dde22983583da6d3b1e5b9eb1e8fb019f5157eda508305942292c0d10fa43.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral6
Sample
a7768f4973ad7cf8217212a4d12dbae0.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
14 signatures
150 seconds
Behavioral task
behavioral7
Sample
aa7ff3bc285bcb4ec48bf2f361f0ad0a1d9fc8f17b7323d2f0615ade68973c1e.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral8
Sample
aace43af8d0932a7b01c5b8fb71c8199.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral9
Sample
ad3cc219a818047d6d3c38a8e4662e21dfedc858578cb2bde2c127d66dfeb7de_PonyNews.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral10
Sample
aee03626b83a88b71b06899116cb7ce4b8092365103d69792b0c2d7153f24cb1.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral11
Sample
afd3b729cf99fb9ea441f42862a4835d1d6eeb36ee535f9b206e3a00382c972e.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
20 signatures
150 seconds
Behavioral task
behavioral12
Sample
b56c4569d639e8ce104d9e52dffeba6d18813c058887a3404350904811f32d54_not_packed_maybe_useless.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral13
Sample
0.8476237917779167.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral14
Sample
zsgblrbrumorwxfizuke.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral15
Sample
b7d9f11c166fa1a4ceef446dd9c8561c77115cb3ce4910a056dd6a361338a2b0.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral16
Sample
b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
17 signatures
150 seconds
Behavioral task
behavioral17
Sample
Saldo.Pdf______________________________________________________________.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral18
Sample
bc557a7bfec430aab3a1b326f35c8d6c1d2de0532263df872b2280af65f32b8f.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral19
Sample
bd2d4d43009623941f49554f5932188154fc9d16d820e00db1281d057468b017.vbs
Resource
win10v2004-20241007-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral20
Sample
be03e43db0b190b879c893102a76183231ea39ec51206d25651a3cacffa8d81d_Dumped_TDS=4F8C315F.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral21
Sample
be03e43db0b190b879c893102a76183231ea39ec51206d25651a3cacffa8d81d_TDS=4F90A68A.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral22
Sample
be514549a2e654706aeeaa15c8cffce504f0e271c904fe07d865f3999ebaa61f.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral23
Sample
bfb8f7f6cbe24330a310e5c7cbe99ed4_api-ms-win-system-wer-l1-1-0.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral24
Sample
bldjad.ex1.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral25
Sample
bldjad.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral26
Sample
bldjad2.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral27
Sample
c145a26dd6d200080c16300456e7c0bc95f2b71f56d94136619e239e466a04a0.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral28
Sample
c325092750dd55898c47be7ec8a7622c3bf8d1a79c40b160ef7901c2ef18f5db.apk
Resource
win10v2004-20241007-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral29
Sample
c36c46f4de045ef332decc006694db6e.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral30
Sample
c3dd2e3cf0ebeec7a6c280e187a044a32b54b369a78aaaa89c600a0767b49704.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral31
Sample
c71c26bf894feb5dbedb2cf2477258f3edf3133a3c22c68ab378ba65ecf251d3_.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral32
Sample
c8462829871b7bdb005f4dd881d253aa255a1b2f6f3d89edb1d609b51f5d04fd.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
3 signatures
150 seconds
General
-
Target
a7768f4973ad7cf8217212a4d12dbae0.exe
-
Size
380KB
-
MD5
a7768f4973ad7cf8217212a4d12dbae0
-
SHA1
143c52e5bf3978c7b1a544ccc9405afd17d77f55
-
SHA256
c8ea293b1ad5343dde79c6e095c134e4100fdaf47c84eac5e3012eae0b0125a2
-
SHA512
058cc6690f9910ead6441f7128f85cb6669f04a7a949bf0b464b42d7813695cf77f7fff539b742a829464cb1ad41ca0682df120e008095b9739e561f488201d5
-
SSDEEP
6144:Uzv+kSZBbdH19ex4T02J4fqz22tvymTiB62iKnWKKmDTcNwjreOwIbN8CCg4mnw8:UzcRD02J4Sq2vHGB67KWKKmDzrCg44w8
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Users\\Admin\\AppData\\Local\\Temp\\a7768f4973ad7cf8217212a4d12dbae0.exe" a7768f4973ad7cf8217212a4d12dbae0.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" a7768f4973ad7cf8217212a4d12dbae0.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" a7768f4973ad7cf8217212a4d12dbae0.exe -
AutoIT Executable 3 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral6/memory/4900-1-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral6/memory/4900-2-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral6/memory/4900-3-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe -
resource yara_rule behavioral6/memory/4900-0-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral6/memory/4900-1-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral6/memory/4900-2-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral6/memory/4900-3-0x0000000000400000-0x00000000004C2000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 47 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a7768f4973ad7cf8217212a4d12dbae0.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe -
Kills process with taskkill 23 IoCs
pid Process 4272 taskkill.exe 624 taskkill.exe 5096 taskkill.exe 4576 taskkill.exe 3636 taskkill.exe 3528 taskkill.exe 1376 taskkill.exe 4580 taskkill.exe 4760 taskkill.exe 4444 taskkill.exe 3276 taskkill.exe 2996 taskkill.exe 2080 taskkill.exe 2036 taskkill.exe 2656 taskkill.exe 1820 taskkill.exe 5108 taskkill.exe 3108 taskkill.exe 4072 taskkill.exe 1888 taskkill.exe 716 taskkill.exe 920 taskkill.exe 1972 taskkill.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4900 a7768f4973ad7cf8217212a4d12dbae0.exe 4900 a7768f4973ad7cf8217212a4d12dbae0.exe 4900 a7768f4973ad7cf8217212a4d12dbae0.exe 4900 a7768f4973ad7cf8217212a4d12dbae0.exe 4900 a7768f4973ad7cf8217212a4d12dbae0.exe 4900 a7768f4973ad7cf8217212a4d12dbae0.exe 4900 a7768f4973ad7cf8217212a4d12dbae0.exe 4900 a7768f4973ad7cf8217212a4d12dbae0.exe 4900 a7768f4973ad7cf8217212a4d12dbae0.exe 4900 a7768f4973ad7cf8217212a4d12dbae0.exe 4900 a7768f4973ad7cf8217212a4d12dbae0.exe 4900 a7768f4973ad7cf8217212a4d12dbae0.exe 4900 a7768f4973ad7cf8217212a4d12dbae0.exe 4900 a7768f4973ad7cf8217212a4d12dbae0.exe 4900 a7768f4973ad7cf8217212a4d12dbae0.exe 4900 a7768f4973ad7cf8217212a4d12dbae0.exe 4900 a7768f4973ad7cf8217212a4d12dbae0.exe 4900 a7768f4973ad7cf8217212a4d12dbae0.exe 4900 a7768f4973ad7cf8217212a4d12dbae0.exe 4900 a7768f4973ad7cf8217212a4d12dbae0.exe 4900 a7768f4973ad7cf8217212a4d12dbae0.exe 4900 a7768f4973ad7cf8217212a4d12dbae0.exe 4900 a7768f4973ad7cf8217212a4d12dbae0.exe 4900 a7768f4973ad7cf8217212a4d12dbae0.exe 4900 a7768f4973ad7cf8217212a4d12dbae0.exe 4900 a7768f4973ad7cf8217212a4d12dbae0.exe 4900 a7768f4973ad7cf8217212a4d12dbae0.exe 4900 a7768f4973ad7cf8217212a4d12dbae0.exe 4900 a7768f4973ad7cf8217212a4d12dbae0.exe 4900 a7768f4973ad7cf8217212a4d12dbae0.exe 4900 a7768f4973ad7cf8217212a4d12dbae0.exe 4900 a7768f4973ad7cf8217212a4d12dbae0.exe 4900 a7768f4973ad7cf8217212a4d12dbae0.exe 4900 a7768f4973ad7cf8217212a4d12dbae0.exe 4900 a7768f4973ad7cf8217212a4d12dbae0.exe 4900 a7768f4973ad7cf8217212a4d12dbae0.exe 4900 a7768f4973ad7cf8217212a4d12dbae0.exe 4900 a7768f4973ad7cf8217212a4d12dbae0.exe 4900 a7768f4973ad7cf8217212a4d12dbae0.exe 4900 a7768f4973ad7cf8217212a4d12dbae0.exe 4900 a7768f4973ad7cf8217212a4d12dbae0.exe 4900 a7768f4973ad7cf8217212a4d12dbae0.exe 4900 a7768f4973ad7cf8217212a4d12dbae0.exe 4900 a7768f4973ad7cf8217212a4d12dbae0.exe 4900 a7768f4973ad7cf8217212a4d12dbae0.exe 4900 a7768f4973ad7cf8217212a4d12dbae0.exe 4900 a7768f4973ad7cf8217212a4d12dbae0.exe 4900 a7768f4973ad7cf8217212a4d12dbae0.exe 4900 a7768f4973ad7cf8217212a4d12dbae0.exe 4900 a7768f4973ad7cf8217212a4d12dbae0.exe 4900 a7768f4973ad7cf8217212a4d12dbae0.exe 4900 a7768f4973ad7cf8217212a4d12dbae0.exe 4900 a7768f4973ad7cf8217212a4d12dbae0.exe 4900 a7768f4973ad7cf8217212a4d12dbae0.exe 4900 a7768f4973ad7cf8217212a4d12dbae0.exe 4900 a7768f4973ad7cf8217212a4d12dbae0.exe 4900 a7768f4973ad7cf8217212a4d12dbae0.exe 4900 a7768f4973ad7cf8217212a4d12dbae0.exe 4900 a7768f4973ad7cf8217212a4d12dbae0.exe 4900 a7768f4973ad7cf8217212a4d12dbae0.exe 4900 a7768f4973ad7cf8217212a4d12dbae0.exe 4900 a7768f4973ad7cf8217212a4d12dbae0.exe 4900 a7768f4973ad7cf8217212a4d12dbae0.exe 4900 a7768f4973ad7cf8217212a4d12dbae0.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4900 a7768f4973ad7cf8217212a4d12dbae0.exe -
Suspicious use of AdjustPrivilegeToken 23 IoCs
description pid Process Token: SeDebugPrivilege 3636 taskkill.exe Token: SeDebugPrivilege 3528 taskkill.exe Token: SeDebugPrivilege 1820 taskkill.exe Token: SeDebugPrivilege 716 taskkill.exe Token: SeDebugPrivilege 920 taskkill.exe Token: SeDebugPrivilege 1972 taskkill.exe Token: SeDebugPrivilege 3108 taskkill.exe Token: SeDebugPrivilege 2080 taskkill.exe Token: SeDebugPrivilege 1376 taskkill.exe Token: SeDebugPrivilege 2036 taskkill.exe Token: SeDebugPrivilege 2656 taskkill.exe Token: SeDebugPrivilege 4272 taskkill.exe Token: SeDebugPrivilege 4580 taskkill.exe Token: SeDebugPrivilege 5108 taskkill.exe Token: SeDebugPrivilege 4072 taskkill.exe Token: SeDebugPrivilege 624 taskkill.exe Token: SeDebugPrivilege 4760 taskkill.exe Token: SeDebugPrivilege 5096 taskkill.exe Token: SeDebugPrivilege 4444 taskkill.exe Token: SeDebugPrivilege 4576 taskkill.exe Token: SeDebugPrivilege 3276 taskkill.exe Token: SeDebugPrivilege 2996 taskkill.exe Token: SeDebugPrivilege 1888 taskkill.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4900 a7768f4973ad7cf8217212a4d12dbae0.exe 4900 a7768f4973ad7cf8217212a4d12dbae0.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4900 wrote to memory of 3276 4900 a7768f4973ad7cf8217212a4d12dbae0.exe 83 PID 4900 wrote to memory of 3276 4900 a7768f4973ad7cf8217212a4d12dbae0.exe 83 PID 4900 wrote to memory of 3276 4900 a7768f4973ad7cf8217212a4d12dbae0.exe 83 PID 3276 wrote to memory of 3636 3276 cmd.exe 85 PID 3276 wrote to memory of 3636 3276 cmd.exe 85 PID 3276 wrote to memory of 3636 3276 cmd.exe 85 PID 4900 wrote to memory of 5024 4900 a7768f4973ad7cf8217212a4d12dbae0.exe 87 PID 4900 wrote to memory of 5024 4900 a7768f4973ad7cf8217212a4d12dbae0.exe 87 PID 4900 wrote to memory of 5024 4900 a7768f4973ad7cf8217212a4d12dbae0.exe 87 PID 5024 wrote to memory of 3528 5024 cmd.exe 89 PID 5024 wrote to memory of 3528 5024 cmd.exe 89 PID 5024 wrote to memory of 3528 5024 cmd.exe 89 PID 4900 wrote to memory of 1332 4900 a7768f4973ad7cf8217212a4d12dbae0.exe 90 PID 4900 wrote to memory of 1332 4900 a7768f4973ad7cf8217212a4d12dbae0.exe 90 PID 4900 wrote to memory of 1332 4900 a7768f4973ad7cf8217212a4d12dbae0.exe 90 PID 1332 wrote to memory of 1820 1332 cmd.exe 92 PID 1332 wrote to memory of 1820 1332 cmd.exe 92 PID 1332 wrote to memory of 1820 1332 cmd.exe 92 PID 4900 wrote to memory of 3912 4900 a7768f4973ad7cf8217212a4d12dbae0.exe 93 PID 4900 wrote to memory of 3912 4900 a7768f4973ad7cf8217212a4d12dbae0.exe 93 PID 4900 wrote to memory of 3912 4900 a7768f4973ad7cf8217212a4d12dbae0.exe 93 PID 3912 wrote to memory of 716 3912 cmd.exe 95 PID 3912 wrote to memory of 716 3912 cmd.exe 95 PID 3912 wrote to memory of 716 3912 cmd.exe 95 PID 4900 wrote to memory of 684 4900 a7768f4973ad7cf8217212a4d12dbae0.exe 96 PID 4900 wrote to memory of 684 4900 a7768f4973ad7cf8217212a4d12dbae0.exe 96 PID 4900 wrote to memory of 684 4900 a7768f4973ad7cf8217212a4d12dbae0.exe 96 PID 684 wrote to memory of 920 684 cmd.exe 98 PID 684 wrote to memory of 920 684 cmd.exe 98 PID 684 wrote to memory of 920 684 cmd.exe 98 PID 4900 wrote to memory of 2132 4900 a7768f4973ad7cf8217212a4d12dbae0.exe 99 PID 4900 wrote to memory of 2132 4900 a7768f4973ad7cf8217212a4d12dbae0.exe 99 PID 4900 wrote to memory of 2132 4900 a7768f4973ad7cf8217212a4d12dbae0.exe 99 PID 2132 wrote to memory of 1972 2132 cmd.exe 101 PID 2132 wrote to memory of 1972 2132 cmd.exe 101 PID 2132 wrote to memory of 1972 2132 cmd.exe 101 PID 4900 wrote to memory of 4472 4900 a7768f4973ad7cf8217212a4d12dbae0.exe 102 PID 4900 wrote to memory of 4472 4900 a7768f4973ad7cf8217212a4d12dbae0.exe 102 PID 4900 wrote to memory of 4472 4900 a7768f4973ad7cf8217212a4d12dbae0.exe 102 PID 4472 wrote to memory of 3108 4472 cmd.exe 104 PID 4472 wrote to memory of 3108 4472 cmd.exe 104 PID 4472 wrote to memory of 3108 4472 cmd.exe 104 PID 4900 wrote to memory of 3332 4900 a7768f4973ad7cf8217212a4d12dbae0.exe 105 PID 4900 wrote to memory of 3332 4900 a7768f4973ad7cf8217212a4d12dbae0.exe 105 PID 4900 wrote to memory of 3332 4900 a7768f4973ad7cf8217212a4d12dbae0.exe 105 PID 3332 wrote to memory of 2080 3332 cmd.exe 107 PID 3332 wrote to memory of 2080 3332 cmd.exe 107 PID 3332 wrote to memory of 2080 3332 cmd.exe 107 PID 4900 wrote to memory of 2364 4900 a7768f4973ad7cf8217212a4d12dbae0.exe 108 PID 4900 wrote to memory of 2364 4900 a7768f4973ad7cf8217212a4d12dbae0.exe 108 PID 4900 wrote to memory of 2364 4900 a7768f4973ad7cf8217212a4d12dbae0.exe 108 PID 2364 wrote to memory of 1376 2364 cmd.exe 110 PID 2364 wrote to memory of 1376 2364 cmd.exe 110 PID 2364 wrote to memory of 1376 2364 cmd.exe 110 PID 4900 wrote to memory of 4432 4900 a7768f4973ad7cf8217212a4d12dbae0.exe 111 PID 4900 wrote to memory of 4432 4900 a7768f4973ad7cf8217212a4d12dbae0.exe 111 PID 4900 wrote to memory of 4432 4900 a7768f4973ad7cf8217212a4d12dbae0.exe 111 PID 4432 wrote to memory of 2036 4432 cmd.exe 115 PID 4432 wrote to memory of 2036 4432 cmd.exe 115 PID 4432 wrote to memory of 2036 4432 cmd.exe 115 PID 4900 wrote to memory of 1516 4900 a7768f4973ad7cf8217212a4d12dbae0.exe 116 PID 4900 wrote to memory of 1516 4900 a7768f4973ad7cf8217212a4d12dbae0.exe 116 PID 4900 wrote to memory of 1516 4900 a7768f4973ad7cf8217212a4d12dbae0.exe 116 PID 1516 wrote to memory of 2656 1516 cmd.exe 119 -
System policy modification 1 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer a7768f4973ad7cf8217212a4d12dbae0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoViewContextMenu = "1" a7768f4973ad7cf8217212a4d12dbae0.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System a7768f4973ad7cf8217212a4d12dbae0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" a7768f4973ad7cf8217212a4d12dbae0.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a7768f4973ad7cf8217212a4d12dbae0.exe"C:\Users\Admin\AppData\Local\Temp\a7768f4973ad7cf8217212a4d12dbae0.exe"1⤵
- Modifies WinLogon for persistence
- UAC bypass
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4900 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /f /im explorer.exe2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3276 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im explorer.exe3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3636
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /f /im explorer.exe2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5024 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im explorer.exe3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3528
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /f /im explorer.exe2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1332 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im explorer.exe3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1820
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /f /im explorer.exe2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3912 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im explorer.exe3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:716
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /f /im explorer.exe2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:684 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im explorer.exe3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:920
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /f /im explorer.exe2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2132 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im explorer.exe3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1972
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /f /im explorer.exe2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4472 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im explorer.exe3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3108
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /f /im explorer.exe2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3332 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im explorer.exe3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2080
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /f /im explorer.exe2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2364 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im explorer.exe3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1376
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /f /im explorer.exe2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4432 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im explorer.exe3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2036
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /f /im explorer.exe2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1516 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im explorer.exe3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2656
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /f /im explorer.exe2⤵
- System Location Discovery: System Language Discovery
PID:4568 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im explorer.exe3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4272
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /f /im explorer.exe2⤵
- System Location Discovery: System Language Discovery
PID:4632 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im explorer.exe3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4580
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /f /im explorer.exe2⤵
- System Location Discovery: System Language Discovery
PID:3928 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im explorer.exe3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5108
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /f /im explorer.exe2⤵
- System Location Discovery: System Language Discovery
PID:2008 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im explorer.exe3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4072
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /f /im explorer.exe2⤵
- System Location Discovery: System Language Discovery
PID:1760 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im explorer.exe3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:624
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /f /im explorer.exe2⤵
- System Location Discovery: System Language Discovery
PID:1740 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im explorer.exe3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4760
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /f /im explorer.exe2⤵
- System Location Discovery: System Language Discovery
PID:640 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im explorer.exe3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5096
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /f /im explorer.exe2⤵
- System Location Discovery: System Language Discovery
PID:652 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im explorer.exe3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4444
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /f /im explorer.exe2⤵
- System Location Discovery: System Language Discovery
PID:4508 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im explorer.exe3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4576
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /f /im explorer.exe2⤵
- System Location Discovery: System Language Discovery
PID:4352 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im explorer.exe3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3276
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /f /im explorer.exe2⤵
- System Location Discovery: System Language Discovery
PID:1928 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im explorer.exe3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2996
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /f /im explorer.exe2⤵
- System Location Discovery: System Language Discovery
PID:760 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im explorer.exe3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1888
-
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Winlogon Helper DLL
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
3