Analysis
-
max time kernel
144s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
23-11-2024 19:27
Static task
static1
Behavioral task
behavioral1
Sample
dfc453c8498400fd0f9cd272a842f6e4893a362e9476764a6aec751b224c7eb3.exe
Resource
win7-20240903-en
General
-
Target
dfc453c8498400fd0f9cd272a842f6e4893a362e9476764a6aec751b224c7eb3.exe
-
Size
1.8MB
-
MD5
72683bf9c6f350a7af5d18a98462fcdf
-
SHA1
1fd96a421e53351f72998a1a72f923b36e866a0b
-
SHA256
dfc453c8498400fd0f9cd272a842f6e4893a362e9476764a6aec751b224c7eb3
-
SHA512
989da907980a4bfab558aed381271e77a77fce8b88458767bdf9d893c540f95ea87f9b81388f4558e27e1b9316fe5df5974481c39a45186e7770826a9c54557d
-
SSDEEP
49152:eu/AKF/HKZIZwiv29BZlYif1AYO5regp:F/AE/HmIiie9TlYC1Anreg
Malware Config
Extracted
amadey
4.42
9c9aa5
http://185.215.113.43
-
install_dir
abc3bc1985
-
install_file
skotes.exe
-
strings_key
8a35cf2ea38c2817dba29a4b5b25dcf0
-
url_paths
/Zu7JuNko/index.php
Extracted
stealc
mars
http://185.215.113.206
-
url_path
/c4becf79229cb002.php
Signatures
-
Amadey family
-
Cryptbot family
-
Detects CryptBot payload 1 IoCs
CryptBot is a C++ stealer distributed widely in bundle with other software.
resource yara_rule behavioral1/memory/560-475-0x0000000069CC0000-0x000000006A71B000-memory.dmp family_cryptbot_v3 -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection 81e93b30a2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" 81e93b30a2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" 81e93b30a2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" 81e93b30a2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" 81e93b30a2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" 81e93b30a2.exe -
Stealc family
-
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
description pid Process procid_target PID 2940 created 1184 2940 rh.exe 21 -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 7 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ dfc453c8498400fd0f9cd272a842f6e4893a362e9476764a6aec751b224c7eb3.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ skotes.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ rh.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 44d412c5d7.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 10dfb4f667.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 81e93b30a2.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 92e94ce798.exe -
Downloads MZ/PE file
-
Uses browser remote debugging 2 TTPs 4 IoCs
Can be used control the browser and steal sensitive information such as credentials and session cookies.
pid Process 2688 chrome.exe 3388 chrome.exe 3272 chrome.exe 3780 chrome.exe -
Checks BIOS information in registry 2 TTPs 14 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 10dfb4f667.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion rh.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion skotes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion rh.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 44d412c5d7.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 81e93b30a2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion dfc453c8498400fd0f9cd272a842f6e4893a362e9476764a6aec751b224c7eb3.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 10dfb4f667.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 81e93b30a2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 92e94ce798.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion dfc453c8498400fd0f9cd272a842f6e4893a362e9476764a6aec751b224c7eb3.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 44d412c5d7.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 92e94ce798.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion skotes.exe -
Executes dropped EXE 10 IoCs
pid Process 2752 skotes.exe 2020 5468191780.exe 2940 rh.exe 1268 44d412c5d7.exe 888 10dfb4f667.exe 1756 d5965568ca.exe 2296 81e93b30a2.exe 560 92e94ce798.exe 3232 service123.exe 3688 service123.exe -
Identifies Wine through registry keys 2 TTPs 7 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Wine 10dfb4f667.exe Key opened \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Wine 81e93b30a2.exe Key opened \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Wine 92e94ce798.exe Key opened \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Wine dfc453c8498400fd0f9cd272a842f6e4893a362e9476764a6aec751b224c7eb3.exe Key opened \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Wine skotes.exe Key opened \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Wine rh.exe Key opened \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Wine 44d412c5d7.exe -
Loads dropped DLL 18 IoCs
pid Process 2504 dfc453c8498400fd0f9cd272a842f6e4893a362e9476764a6aec751b224c7eb3.exe 2504 dfc453c8498400fd0f9cd272a842f6e4893a362e9476764a6aec751b224c7eb3.exe 2752 skotes.exe 2020 5468191780.exe 2752 skotes.exe 2752 skotes.exe 2752 skotes.exe 2752 skotes.exe 2752 skotes.exe 2752 skotes.exe 2752 skotes.exe 560 92e94ce798.exe 560 92e94ce798.exe 3348 WerFault.exe 3348 WerFault.exe 3348 WerFault.exe 3232 service123.exe 3688 service123.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" 81e93b30a2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features 81e93b30a2.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\10dfb4f667.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1008507001\\10dfb4f667.exe" skotes.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\d5965568ca.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1008508001\\d5965568ca.exe" skotes.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\81e93b30a2.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1008509001\\81e93b30a2.exe" skotes.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\44d412c5d7.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1008506001\\44d412c5d7.exe" skotes.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/files/0x001500000001866d-158.dat autoit_exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 7 IoCs
pid Process 2504 dfc453c8498400fd0f9cd272a842f6e4893a362e9476764a6aec751b224c7eb3.exe 2752 skotes.exe 2940 rh.exe 1268 44d412c5d7.exe 888 10dfb4f667.exe 2296 81e93b30a2.exe 560 92e94ce798.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\Tasks\skotes.job dfc453c8498400fd0f9cd272a842f6e4893a362e9476764a6aec751b224c7eb3.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 3348 560 WerFault.exe 61 -
System Location Discovery: System Language Discovery 1 TTPs 16 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language skotes.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 81e93b30a2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dfc453c8498400fd0f9cd272a842f6e4893a362e9476764a6aec751b224c7eb3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dialer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d5965568ca.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 92e94ce798.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5468191780.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 10dfb4f667.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 44d412c5d7.exe -
Checks processor information in registry 2 TTPs 8 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 92e94ce798.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 92e94ce798.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Kills process with taskkill 5 IoCs
pid Process 2680 taskkill.exe 984 taskkill.exe 2828 taskkill.exe 2780 taskkill.exe 1792 taskkill.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_Classes\Local Settings firefox.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25 44d412c5d7.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc252000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a 44d412c5d7.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc35300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a82000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a 44d412c5d7.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3340 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 21 IoCs
pid Process 2504 dfc453c8498400fd0f9cd272a842f6e4893a362e9476764a6aec751b224c7eb3.exe 2752 skotes.exe 2940 rh.exe 2940 rh.exe 2940 rh.exe 2940 rh.exe 2940 rh.exe 1048 dialer.exe 1048 dialer.exe 1048 dialer.exe 1048 dialer.exe 1268 44d412c5d7.exe 888 10dfb4f667.exe 1756 d5965568ca.exe 1756 d5965568ca.exe 2296 81e93b30a2.exe 2296 81e93b30a2.exe 2296 81e93b30a2.exe 560 92e94ce798.exe 2688 chrome.exe 2688 chrome.exe -
Suspicious use of AdjustPrivilegeToken 10 IoCs
description pid Process Token: SeDebugPrivilege 2680 taskkill.exe Token: SeDebugPrivilege 984 taskkill.exe Token: SeDebugPrivilege 2828 taskkill.exe Token: SeDebugPrivilege 2780 taskkill.exe Token: SeDebugPrivilege 1792 taskkill.exe Token: SeDebugPrivilege 1360 firefox.exe Token: SeDebugPrivilege 1360 firefox.exe Token: SeDebugPrivilege 2296 81e93b30a2.exe Token: SeShutdownPrivilege 2688 chrome.exe Token: SeShutdownPrivilege 2688 chrome.exe -
Suspicious use of FindShellTrayWindow 49 IoCs
pid Process 2504 dfc453c8498400fd0f9cd272a842f6e4893a362e9476764a6aec751b224c7eb3.exe 1756 d5965568ca.exe 1756 d5965568ca.exe 1756 d5965568ca.exe 1756 d5965568ca.exe 1756 d5965568ca.exe 1756 d5965568ca.exe 1360 firefox.exe 1360 firefox.exe 1360 firefox.exe 1360 firefox.exe 1756 d5965568ca.exe 1756 d5965568ca.exe 1756 d5965568ca.exe 1756 d5965568ca.exe 2688 chrome.exe 2688 chrome.exe 2688 chrome.exe 2688 chrome.exe 2688 chrome.exe 2688 chrome.exe 2688 chrome.exe 2688 chrome.exe 2688 chrome.exe 2688 chrome.exe 2688 chrome.exe 2688 chrome.exe 2688 chrome.exe 2688 chrome.exe 2688 chrome.exe 2688 chrome.exe 2688 chrome.exe 2688 chrome.exe 2688 chrome.exe 2688 chrome.exe 2688 chrome.exe 2688 chrome.exe 2688 chrome.exe 2688 chrome.exe 2688 chrome.exe 2688 chrome.exe 2688 chrome.exe 2688 chrome.exe 2688 chrome.exe 2688 chrome.exe 2688 chrome.exe 2688 chrome.exe 2688 chrome.exe 2688 chrome.exe -
Suspicious use of SendNotifyMessage 13 IoCs
pid Process 1756 d5965568ca.exe 1756 d5965568ca.exe 1756 d5965568ca.exe 1756 d5965568ca.exe 1756 d5965568ca.exe 1756 d5965568ca.exe 1360 firefox.exe 1360 firefox.exe 1360 firefox.exe 1756 d5965568ca.exe 1756 d5965568ca.exe 1756 d5965568ca.exe 1756 d5965568ca.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2504 wrote to memory of 2752 2504 dfc453c8498400fd0f9cd272a842f6e4893a362e9476764a6aec751b224c7eb3.exe 31 PID 2504 wrote to memory of 2752 2504 dfc453c8498400fd0f9cd272a842f6e4893a362e9476764a6aec751b224c7eb3.exe 31 PID 2504 wrote to memory of 2752 2504 dfc453c8498400fd0f9cd272a842f6e4893a362e9476764a6aec751b224c7eb3.exe 31 PID 2504 wrote to memory of 2752 2504 dfc453c8498400fd0f9cd272a842f6e4893a362e9476764a6aec751b224c7eb3.exe 31 PID 2752 wrote to memory of 2020 2752 skotes.exe 33 PID 2752 wrote to memory of 2020 2752 skotes.exe 33 PID 2752 wrote to memory of 2020 2752 skotes.exe 33 PID 2752 wrote to memory of 2020 2752 skotes.exe 33 PID 2752 wrote to memory of 2940 2752 skotes.exe 35 PID 2752 wrote to memory of 2940 2752 skotes.exe 35 PID 2752 wrote to memory of 2940 2752 skotes.exe 35 PID 2752 wrote to memory of 2940 2752 skotes.exe 35 PID 2940 wrote to memory of 1048 2940 rh.exe 36 PID 2940 wrote to memory of 1048 2940 rh.exe 36 PID 2940 wrote to memory of 1048 2940 rh.exe 36 PID 2940 wrote to memory of 1048 2940 rh.exe 36 PID 2940 wrote to memory of 1048 2940 rh.exe 36 PID 2940 wrote to memory of 1048 2940 rh.exe 36 PID 2752 wrote to memory of 1268 2752 skotes.exe 37 PID 2752 wrote to memory of 1268 2752 skotes.exe 37 PID 2752 wrote to memory of 1268 2752 skotes.exe 37 PID 2752 wrote to memory of 1268 2752 skotes.exe 37 PID 2752 wrote to memory of 888 2752 skotes.exe 38 PID 2752 wrote to memory of 888 2752 skotes.exe 38 PID 2752 wrote to memory of 888 2752 skotes.exe 38 PID 2752 wrote to memory of 888 2752 skotes.exe 38 PID 2752 wrote to memory of 1756 2752 skotes.exe 39 PID 2752 wrote to memory of 1756 2752 skotes.exe 39 PID 2752 wrote to memory of 1756 2752 skotes.exe 39 PID 2752 wrote to memory of 1756 2752 skotes.exe 39 PID 1756 wrote to memory of 2680 1756 d5965568ca.exe 40 PID 1756 wrote to memory of 2680 1756 d5965568ca.exe 40 PID 1756 wrote to memory of 2680 1756 d5965568ca.exe 40 PID 1756 wrote to memory of 2680 1756 d5965568ca.exe 40 PID 1756 wrote to memory of 984 1756 d5965568ca.exe 43 PID 1756 wrote to memory of 984 1756 d5965568ca.exe 43 PID 1756 wrote to memory of 984 1756 d5965568ca.exe 43 PID 1756 wrote to memory of 984 1756 d5965568ca.exe 43 PID 1756 wrote to memory of 2828 1756 d5965568ca.exe 45 PID 1756 wrote to memory of 2828 1756 d5965568ca.exe 45 PID 1756 wrote to memory of 2828 1756 d5965568ca.exe 45 PID 1756 wrote to memory of 2828 1756 d5965568ca.exe 45 PID 1756 wrote to memory of 2780 1756 d5965568ca.exe 47 PID 1756 wrote to memory of 2780 1756 d5965568ca.exe 47 PID 1756 wrote to memory of 2780 1756 d5965568ca.exe 47 PID 1756 wrote to memory of 2780 1756 d5965568ca.exe 47 PID 1756 wrote to memory of 1792 1756 d5965568ca.exe 49 PID 1756 wrote to memory of 1792 1756 d5965568ca.exe 49 PID 1756 wrote to memory of 1792 1756 d5965568ca.exe 49 PID 1756 wrote to memory of 1792 1756 d5965568ca.exe 49 PID 1756 wrote to memory of 1652 1756 d5965568ca.exe 51 PID 1756 wrote to memory of 1652 1756 d5965568ca.exe 51 PID 1756 wrote to memory of 1652 1756 d5965568ca.exe 51 PID 1756 wrote to memory of 1652 1756 d5965568ca.exe 51 PID 1652 wrote to memory of 1360 1652 firefox.exe 52 PID 1652 wrote to memory of 1360 1652 firefox.exe 52 PID 1652 wrote to memory of 1360 1652 firefox.exe 52 PID 1652 wrote to memory of 1360 1652 firefox.exe 52 PID 1652 wrote to memory of 1360 1652 firefox.exe 52 PID 1652 wrote to memory of 1360 1652 firefox.exe 52 PID 1652 wrote to memory of 1360 1652 firefox.exe 52 PID 1652 wrote to memory of 1360 1652 firefox.exe 52 PID 1652 wrote to memory of 1360 1652 firefox.exe 52 PID 1652 wrote to memory of 1360 1652 firefox.exe 52 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1184
-
C:\Users\Admin\AppData\Local\Temp\dfc453c8498400fd0f9cd272a842f6e4893a362e9476764a6aec751b224c7eb3.exe"C:\Users\Admin\AppData\Local\Temp\dfc453c8498400fd0f9cd272a842f6e4893a362e9476764a6aec751b224c7eb3.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2504 -
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2752 -
C:\Users\Admin\AppData\Local\Temp\1008450001\5468191780.exe"C:\Users\Admin\AppData\Local\Temp\1008450001\5468191780.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2020
-
-
C:\Users\Admin\AppData\Local\Temp\1008496001\rh.exe"C:\Users\Admin\AppData\Local\Temp\1008496001\rh.exe"4⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2940
-
-
C:\Users\Admin\AppData\Local\Temp\1008506001\44d412c5d7.exe"C:\Users\Admin\AppData\Local\Temp\1008506001\44d412c5d7.exe"4⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
PID:1268
-
-
C:\Users\Admin\AppData\Local\Temp\1008507001\10dfb4f667.exe"C:\Users\Admin\AppData\Local\Temp\1008507001\10dfb4f667.exe"4⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:888
-
-
C:\Users\Admin\AppData\Local\Temp\1008508001\d5965568ca.exe"C:\Users\Admin\AppData\Local\Temp\1008508001\d5965568ca.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1756 -
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM firefox.exe /T5⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2680
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM chrome.exe /T5⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:984
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM msedge.exe /T5⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2828
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM opera.exe /T5⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2780
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM brave.exe /T5⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1792
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking5⤵
- Suspicious use of WriteProcessMemory
PID:1652 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking6⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1360 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1360.0.53165178\1256851922" -parentBuildID 20221007134813 -prefsHandle 1224 -prefMapHandle 1216 -prefsLen 20847 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {58e4b603-281d-42cf-a908-7d2950beb269} 1360 "\\.\pipe\gecko-crash-server-pipe.1360" 1304 46d6458 gpu7⤵PID:2936
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1360.1.1749405675\1424264473" -parentBuildID 20221007134813 -prefsHandle 1476 -prefMapHandle 1472 -prefsLen 21708 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e3e3204c-5527-4dcb-be8b-a6d65262e7c0} 1360 "\\.\pipe\gecko-crash-server-pipe.1360" 1504 d74b58 socket7⤵PID:2928
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1360.2.869987057\1994245555" -childID 1 -isForBrowser -prefsHandle 2104 -prefMapHandle 2100 -prefsLen 21746 -prefMapSize 233444 -jsInitHandle 900 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ac110e3d-117e-47fd-8e7d-c35e4051767c} 1360 "\\.\pipe\gecko-crash-server-pipe.1360" 2116 1a5d0d58 tab7⤵PID:1152
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1360.3.1137054940\439175226" -childID 2 -isForBrowser -prefsHandle 2936 -prefMapHandle 2932 -prefsLen 26216 -prefMapSize 233444 -jsInitHandle 900 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b9a3e955-a91a-4a29-af87-7cee3c76fc48} 1360 "\\.\pipe\gecko-crash-server-pipe.1360" 2948 d5d858 tab7⤵PID:1636
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1360.4.149917511\732012555" -childID 3 -isForBrowser -prefsHandle 3780 -prefMapHandle 3776 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 900 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d1d3e233-b0de-4d08-9154-9df36795e630} 1360 "\\.\pipe\gecko-crash-server-pipe.1360" 3792 1ff50458 tab7⤵PID:2108
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1360.5.1443867800\1325770309" -childID 4 -isForBrowser -prefsHandle 3812 -prefMapHandle 3876 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 900 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {6a210712-3667-458b-8f08-6e3065e53d94} 1360 "\\.\pipe\gecko-crash-server-pipe.1360" 3984 1ff51f58 tab7⤵PID:700
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1360.6.594797852\238641040" -childID 5 -isForBrowser -prefsHandle 4100 -prefMapHandle 4104 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 900 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {5685fff9-796d-4049-9c7c-fe26991e774e} 1360 "\\.\pipe\gecko-crash-server-pipe.1360" 4088 20a44558 tab7⤵PID:612
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1008509001\81e93b30a2.exe"C:\Users\Admin\AppData\Local\Temp\1008509001\81e93b30a2.exe"4⤵
- Modifies Windows Defender Real-time Protection settings
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Windows security modification
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2296
-
-
C:\Users\Admin\AppData\Local\Temp\1008510001\92e94ce798.exe"C:\Users\Admin\AppData\Local\Temp\1008510001\92e94ce798.exe"4⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:560 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --profile-directory="Default"5⤵
- Uses browser remote debugging
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2688 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6e19758,0x7fef6e19768,0x7fef6e197786⤵PID:944
-
-
C:\Windows\system32\ctfmon.exectfmon.exe6⤵PID:2288
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1160 --field-trial-handle=1400,i,1504561785364525445,2357988359704315535,131072 /prefetch:26⤵PID:3096
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1448 --field-trial-handle=1400,i,1504561785364525445,2357988359704315535,131072 /prefetch:86⤵PID:3104
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1660 --field-trial-handle=1400,i,1504561785364525445,2357988359704315535,131072 /prefetch:86⤵PID:3168
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --remote-debugging-port=9222 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2224 --field-trial-handle=1400,i,1504561785364525445,2357988359704315535,131072 /prefetch:16⤵
- Uses browser remote debugging
PID:3272
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --remote-debugging-port=9222 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2252 --field-trial-handle=1400,i,1504561785364525445,2357988359704315535,131072 /prefetch:16⤵
- Uses browser remote debugging
PID:3388
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1800 --field-trial-handle=1400,i,1504561785364525445,2357988359704315535,131072 /prefetch:26⤵PID:3696
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --remote-debugging-port=9222 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=2256 --field-trial-handle=1400,i,1504561785364525445,2357988359704315535,131072 /prefetch:16⤵
- Uses browser remote debugging
PID:3780
-
-
-
C:\Users\Admin\AppData\Local\Temp\service123.exe"C:\Users\Admin\AppData\Local\Temp\service123.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3232
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "ServiceData4" /tr "C:\Users\Admin\AppData\Local\Temp\/service123.exe" /st 00:01 /du 9800:59 /sc once /ri 1 /f5⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:3340
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 560 -s 9565⤵
- Loads dropped DLL
- Program crash
PID:3348
-
-
-
-
-
C:\Windows\SysWOW64\dialer.exe"C:\Windows\system32\dialer.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1048
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:3264
-
C:\Windows\system32\taskeng.exetaskeng.exe {580AC6AA-EDD8-4053-8614-3C80AE10BE4B} S-1-5-21-3290804112-2823094203-3137964600-1000:VORHPBAB\Admin:Interactive:[1]1⤵PID:3640
-
C:\Users\Admin\AppData\Local\Temp\service123.exeC:\Users\Admin\AppData\Local\Temp\/service123.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3688
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Modify Authentication Process
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Impair Defenses
2Disable or Modify Tools
2Modify Authentication Process
1Modify Registry
4Subvert Trust Controls
1Install Root Certificate
1Virtualization/Sandbox Evasion
2Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Modify Authentication Process
1Steal Web Session Cookie
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
264KB
MD5f50f89a0a91564d0b8a211f8921aa7de
SHA1112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\000007.dbtmp
Filesize16B
MD518e723571b00fb1694a3bad6c78e4054
SHA1afcc0ef32d46fe59e0483f9a3c891d3034d12f32
SHA2568af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa
SHA51243bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4k8o8gx5.default-release\activity-stream.discovery_stream.json.tmp
Filesize24KB
MD5d3b19e90076c7326c0d49fb843c2a91d
SHA15c872c415385416933589a8ec34dba196c219229
SHA256fe9c319a4421504fe5a17e4ed1a64ddd96585c94194ae3d4e97ec229c420b81d
SHA512619b9d38c099e4b92a336873a4f66f0c06dfd0adb2f2e39f76e9cd6f7ee0aebed23149c02aeecd8e66e0d5888eeca8284cf158c2672d05628583f50701b0104d
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4k8o8gx5.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl
Filesize13KB
MD5f99b4984bd93547ff4ab09d35b9ed6d5
SHA173bf4d313cb094bb6ead04460da9547106794007
SHA256402571262fd1f6dca336f822ceb0ec2a368a25dfe2f4bfa13b45c983e88b6069
SHA512cd0ed84a24d3faae94290aca1b5ef65eef4cfba8a983da9f88ee3268fc611484a72bd44ca0947c0ca8de174619debae4604e15e4b2c364e636424ba1d37e1759
-
Filesize
649KB
MD5e7aa83909ace3906ec75144cc33e024c
SHA1333ee9d7f4c683d8e0ed05bdadfbd2baade379e3
SHA25624443cd457177eeed9c584e5d5ad194303fd94269fdb0d72e0db598215a5c826
SHA512508fd7984ea8b9d8c8b2cd3c7c3587941a6ee4627c7cf54fe56db7db75dbff0abdaf0db1b0c46876dc6ad0cc21735bd7a2f0351d5edeb735b2de796beef2ea72
-
Filesize
1.9MB
MD54cecb04d97630cc2d5cce80368b87fdd
SHA14f693736497e06c820b91597af84c6fece13408b
SHA25651698570a9c637ec0c9bc2b3ca6acb7edf3d7804c49b8eed33e82573950877dd
SHA512acdf93d12791a6a11b307fbbdc6df2b27a6e8de6b8cc015c4892304d4653e79ac58351600b53c7ea78d285d69df8e8f2e270cf9a168b187d372a3de17e84ec66
-
Filesize
1.8MB
MD5acc594995958c5cf5f107fe27db38f8e
SHA192b6e9ee6a4a61b292883566738f8b7e038f5eb1
SHA2562c3841d0070158d8f5824289380656aad74c190ddfd4ee8240eefbfd16988b89
SHA512e82304a2948ab275c1b243255ce5dc01e5e2763f766eaea6915f6e7be0d130ab7e92d52b38f8f1186d30c809a7da2697f06bf55eb9152a52c81a26df8f21373c
-
Filesize
1.7MB
MD56af05407143697f6c49bd94e5903f73a
SHA1003809f7aa6cb6ab5bf4ddb22dc659f22f0879ef
SHA256e4853246b4c0b4d13aa84e929cf4313961f176e893a8c1c29720a1eb7f68c5a7
SHA51242447c96152cfd43f6ba7d7533edc62e10e66eab6030c8914bcf1af64d6980b29d1ac6a960fb6a1e3699ce68a8fad92684f2c3ebe11009f911d2b98e49f61b5e
-
Filesize
900KB
MD57f05860baee4ff5da95e342eaee96e85
SHA1a909d75ee89b3123f66c6ab227106c66e8cb5fb7
SHA256dabb569816b302dccb1fa4c032f5e39a2660d32c3f95ece75e9ebf4144ce0b17
SHA512a963cabe33d4f92041a1731afae796add8fd1ebb448583edfa9cf1a7e427bad514881b9dbf3d404c700d3bb24beab89fad4266fbaefd1aef3e76d4fad05bc0d0
-
Filesize
2.7MB
MD59a939117e7e796c8036b7a92bac70c4f
SHA174fe3772448794929f7f18f1c72f4f388b573468
SHA256d94dec75c03b2044787f940bd7d96bf066eeada41e23854726ec54f2ff77bd72
SHA512a722c1af22a5b67f5618b080f561977dbe5686abe1923a618a67a9c643a4cf814c033869625585cd8bff603f342a8ccfe2103654d9d6cc2bd87d56c097b651ec
-
Filesize
4.2MB
MD515a46db0313993e635e8a7f4ae91f44a
SHA193f7e0d18cda291de56f04e2ad35fff64446eb62
SHA256aa421056287f6114a5932fc6fe92734a06fb0760567b1086774d25881b6bf4a1
SHA5121ebc9e6e2e35dac10752f4e11466f0310af10c9911f004f41455d175602a199cb17a91297733179d3d0ee59801431464da62fc1e4f8639f0ba244c16076c2258
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
442KB
MD585430baed3398695717b0263807cf97c
SHA1fffbee923cea216f50fce5d54219a188a5100f41
SHA256a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e
SHA51206511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1
-
Filesize
8.0MB
MD5a01c5ecd6108350ae23d2cddf0e77c17
SHA1c6ac28a2cd979f1f9a75d56271821d5ff665e2b6
SHA256345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42
SHA512b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4k8o8gx5.default-release\datareporting\glean\db\data.safe.bin
Filesize2KB
MD55948c66d241247a7afb1546fd4bd951e
SHA11a5f365019d2a5eb0961d9193a53b5f3eb3d3866
SHA256da1b2d6aa054d8e83c974fb06a4c3ca24835eb5d46764466de49eb83a093bee1
SHA512148f26d6eafdf6203bd0b5e1a77a417ce50a300a8935132e613aec0079b4bc74da74dfa1df177f2a54de07599bd2e962f84362dc10dd030e6f8fb29a81ee312a
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4k8o8gx5.default-release\datareporting\glean\pending_pings\bd2eaa42-b99b-4017-a564-041a3996efb6
Filesize745B
MD5c5ae5052c901037885938cc7b91cee06
SHA1bcd71602950ef5f34ac2dd35a76eb57bdb71e20d
SHA256f4366ef87a9aa51a9fc7e20d14f19eb8bc071c0f2d09d5c7577cca59942c359e
SHA512ce54a3ec63f945faa5f00e7adc5719207fcf269e007f46791aa893ccf83973af4eddb5ce11e742620631fdf896fb18956e34fe2c4ce2100b0f52c986093dd09d
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4k8o8gx5.default-release\datareporting\glean\pending_pings\c55a8c3f-988e-4f63-96ed-6a5ede6e5f00
Filesize13KB
MD5e907cc051383521b648e3abbc09c2884
SHA15dd394fc57c84d54d77048ca9157ef31a914468e
SHA25626fd787fb1c067d475d4ffb8ec2ad20f22c60b473efd04db9eba0ac9710b19a4
SHA512e8352ca501a1ee7b13890133f746b5b5020a02123e8ce5f8f9e14130020826ae78b04e4226a31ccf8ef68b801e63c4f6da8bdce39caceb08c35d28847560bc47
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4k8o8gx5.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll
Filesize997KB
MD5fe3355639648c417e8307c6d051e3e37
SHA1f54602d4b4778da21bc97c7238fc66aa68c8ee34
SHA2561ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e
SHA5128f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4k8o8gx5.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info
Filesize116B
MD53d33cdc0b3d281e67dd52e14435dd04f
SHA14db88689282fd4f9e9e6ab95fcbb23df6e6485db
SHA256f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b
SHA512a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4k8o8gx5.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt
Filesize479B
MD549ddb419d96dceb9069018535fb2e2fc
SHA162aa6fea895a8b68d468a015f6e6ab400d7a7ca6
SHA2562af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539
SHA51248386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4k8o8gx5.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json
Filesize372B
MD58be33af717bb1b67fbd61c3f4b807e9e
SHA17cf17656d174d951957ff36810e874a134dd49e0
SHA256e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd
SHA5126125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4k8o8gx5.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll
Filesize11.8MB
MD533bf7b0439480effb9fb212efce87b13
SHA1cee50f2745edc6dc291887b6075ca64d716f495a
SHA2568ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e
SHA512d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4k8o8gx5.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib
Filesize1KB
MD5688bed3676d2104e7f17ae1cd2c59404
SHA1952b2cdf783ac72fcb98338723e9afd38d47ad8e
SHA25633899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237
SHA5127a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4k8o8gx5.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig
Filesize1KB
MD5937326fead5fd401f6cca9118bd9ade9
SHA14526a57d4ae14ed29b37632c72aef3c408189d91
SHA25668a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81
SHA512b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2
-
Filesize
7KB
MD5245cba16d260b1ce37e2e0f67f68ae87
SHA18c0d2fe76f6456f76d416de1d3ead4611bcb2a22
SHA2562c550caf10fde913a0e41ccc021d9a1772052980e873d1ef9bef69f575910480
SHA5129c2cecdb29572ef35f7fa2d673baf0b6bb1df79a924c2fc787b928ebb810822e39b898b8edfe90afdf37e2133f4cb5ebc81930601714f5164baa0570d8c388c0
-
Filesize
7KB
MD5f6552f4a0f82080157ede9f364dbf6b6
SHA11f79478edde9bda0b01e3e7568ce23f4087f74ea
SHA256edf0736871a91e359a6d0cf325f3d3668e3498382a0b9269214fc4ad13642177
SHA5122efcb3b3d341f893339acd683b5a689429dfe8c91c3df35d5a7b7de21dac3a3dc0ebdf67ccbe36aa6c767a44709ad8a183e6de5d7b13367b58bea90dcd208a5a
-
Filesize
6KB
MD5c2402a3f569b838a970623e4df01a0ba
SHA1fa9e8e0dce3c4f99df2c317fbc3f714f60f26375
SHA256570cf3c652c0fc931eb6b248f29e4668ec69c4192ba3bdd484ba4aadbe67473e
SHA512c6d9a2e8b4bcbf17e26cc58d1997ebfea8ba8d4fd45bbe0fbf367c93a8d019e66070864dec008d21e5fe4d92d0d39434813ee51e3cc445897de7ce41b7aa2921
-
Filesize
6KB
MD560431f2579309ba0be48b261dc614b41
SHA1a3a3279c90499a7a3b3ca97d983a0195cf164af7
SHA256420e73cd9d79d9654c8f5b57ede3fec2c1cbeb4a15f449de3a020ab3cb7eab3e
SHA5126ffa61d046425103c86958c829b7aca7f32cd4ebcb4fa05f4b089c668dc76f0fdcea9215c5a1d6ed83ea781ac85d1fe75cfb5f5d55c1450242f444166188638c
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4k8o8gx5.default-release\sessionstore-backups\recovery.jsonlz4
Filesize4KB
MD5abc04591299c65c6c6f9f465f2cacbaf
SHA1a1218dd840a6d5865b1212251660b3b3427d17dd
SHA2561eba2261847322170fd2687148c12fa40d30491b23748c3f5c64c6b5389c4ff4
SHA512abe7384c0e4d24e1a664db62a23d23fa66dc23854d5a9dce4f14b43b1508bcd968e50da244910480138e3d35f6eee118a963bbe3199d1d26f5e66c302a2cd622
-
Filesize
1.8MB
MD572683bf9c6f350a7af5d18a98462fcdf
SHA11fd96a421e53351f72998a1a72f923b36e866a0b
SHA256dfc453c8498400fd0f9cd272a842f6e4893a362e9476764a6aec751b224c7eb3
SHA512989da907980a4bfab558aed381271e77a77fce8b88458767bdf9d893c540f95ea87f9b81388f4558e27e1b9316fe5df5974481c39a45186e7770826a9c54557d
-
Filesize
401KB
MD53535fcd3063a2965f1dd8f9b65ca8355
SHA11f5c89caf911a08415d55ce1687101b65871b122
SHA256086057602eec63ed064bd97c1643b20c727aa4a557d16bd26a763716414620fe
SHA5129b623500ffbe25d6dc08c3c90aeb8c123e9fc2841f0962b6fe57ca1d2ab44fb1062352e1d5ab1d506b156c0b25aaf96ca6267a36fd064c97c12df965bcd66929