Analysis
-
max time kernel
79s -
max time network
119s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
25-11-2024 20:52
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0376107fac6e7b418b2fe8eedc5dd73e6ecd65ec0dadbfd205d48f852db87638.exe
Resource
win7-20240903-en
windows7-x64
4 signatures
120 seconds
Behavioral task
behavioral2
Sample
0376107fac6e7b418b2fe8eedc5dd73e6ecd65ec0dadbfd205d48f852db87638.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
15 signatures
120 seconds
General
-
Target
0376107fac6e7b418b2fe8eedc5dd73e6ecd65ec0dadbfd205d48f852db87638.exe
-
Size
1.3MB
-
MD5
3b716d0222278500c7dc8522b8b87662
-
SHA1
e87ab56a84a329b4d4b758bbadd49116efb6e94e
-
SHA256
0376107fac6e7b418b2fe8eedc5dd73e6ecd65ec0dadbfd205d48f852db87638
-
SHA512
2e20e0381e6dbe9db2f0b034519eddeb9ac3160072265cc68bb9dded302a1c14172ee8c7388e38c35b9266c0ad18afb0279a98af40bf8dda4fe36527789f038d
-
SSDEEP
24576:pJutuFWvPDnW22ibKGed8oZ2abjmiJlUafCz2BSTZQMS0fUwSB2dyKcjNyqkPL2:S0m2yKGUZ/bqgiax2eESB2dOkPa
Score
10/10
Malware Config
Extracted
Path
C:\Users\Admin\Contacts\HOW TO BACK FILES.txt
Family
targetcompany
Ransom Note
Hello
Your data has been stolen and encrypted
We will delete the stolen data and help with the recovery of encrypted files after payment has been made
Do not try to change or restore files yourself, this will break them
We provide free decryption for any 3 files up to 3MB in size on our website
How to contact with us:
1) Download and install TOR browser by this link: https://www.torproject.org/download/
2) If TOR blocked in your country and you can't access to the link then use any VPN software
3) Run TOR browser and open the site: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privateSignin
4) Copy your private ID in the input field. Your Private key: C514E620C478F964CB1D3B31
5) You will see chat, payment information and we can make free test decryption here
Our blog of leaked companies:
wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion
If you are unable to contact us through the site, then you can email us: [email protected]
Waiting for a response via mail can be several days. Do not use it if you have not tried contacting through the site.�
Emails
URLs
http://wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privateSignin
http://wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion
Signatures
-
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
description pid Process procid_target PID 5064 created 3560 5064 0376107fac6e7b418b2fe8eedc5dd73e6ecd65ec0dadbfd205d48f852db87638.exe 56 -
TargetCompany,Mallox
TargetCompany (aka Mallox) is a ransomware which encrypts files using a combination of ChaCha20, AES-128, and Curve25519, first seen in June 2021.
-
Targetcompany family
-
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
pid Process 3376 bcdedit.exe 3272 bcdedit.exe -
Renames multiple (3441) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VersionString.vbs 0376107fac6e7b418b2fe8eedc5dd73e6ecd65ec0dadbfd205d48f852db87638.exe -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\A: InstallUtil.exe File opened (read-only) \??\G: InstallUtil.exe File opened (read-only) \??\K: InstallUtil.exe File opened (read-only) \??\P: InstallUtil.exe File opened (read-only) \??\R: InstallUtil.exe File opened (read-only) \??\X: InstallUtil.exe File opened (read-only) \??\Z: InstallUtil.exe File opened (read-only) \??\D: InstallUtil.exe File opened (read-only) \??\E: InstallUtil.exe File opened (read-only) \??\O: InstallUtil.exe File opened (read-only) \??\Q: InstallUtil.exe File opened (read-only) \??\W: InstallUtil.exe File opened (read-only) \??\S: InstallUtil.exe File opened (read-only) \??\T: InstallUtil.exe File opened (read-only) \??\U: InstallUtil.exe File opened (read-only) \??\V: InstallUtil.exe File opened (read-only) \??\B: InstallUtil.exe File opened (read-only) \??\H: InstallUtil.exe File opened (read-only) \??\I: InstallUtil.exe File opened (read-only) \??\J: InstallUtil.exe File opened (read-only) \??\L: InstallUtil.exe File opened (read-only) \??\M: InstallUtil.exe File opened (read-only) \??\N: InstallUtil.exe File opened (read-only) \??\Y: InstallUtil.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 6 api.ipify.org -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 5064 set thread context of 4948 5064 0376107fac6e7b418b2fe8eedc5dd73e6ecd65ec0dadbfd205d48f852db87638.exe 84 -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-32_contrast-black.png InstallUtil.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.SkypeApp_14.53.77.0_neutral_split.scale-125_kzf8qxf38zg5c\Assets\Images\SkypeLogo.scale-125.png InstallUtil.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Place\RTL\contrast-white\SmallTile.scale-125.png InstallUtil.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppPackageAppList.targetsize-256_altform-unplated_contrast-white.png InstallUtil.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ca-es\HOW TO BACK FILES.txt InstallUtil.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\ar-ae\HOW TO BACK FILES.txt InstallUtil.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\C2RManifest.PowerView.PowerView.x-none.msi.16.x-none.xml InstallUtil.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Trial2-ppd.xrm-ms InstallUtil.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\Weather_TileMediumSquare.scale-200.png InstallUtil.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\Cartridges\HOW TO BACK FILES.txt InstallUtil.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Work\contrast-white\HOW TO BACK FILES.txt InstallUtil.exe File created C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\sr-Latn-RS\HOW TO BACK FILES.txt InstallUtil.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OFFSYMXL.TTF InstallUtil.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.XboxApp_48.49.31001.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\GamesXboxHubAppList.scale-200_contrast-high.png InstallUtil.exe File created C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\lt-LT\HOW TO BACK FILES.txt InstallUtil.exe File created C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\PeopleAppAssets\HOW TO BACK FILES.txt InstallUtil.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\HOW TO BACK FILES.txt InstallUtil.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PROOF\MSHY7EN.LEX InstallUtil.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\STRTEDGE\THMBNAIL.PNG InstallUtil.exe File created C:\Program Files\VideoLAN\VLC\locale\es_MX\HOW TO BACK FILES.txt InstallUtil.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\nls\en-gb\HOW TO BACK FILES.txt InstallUtil.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\fi-fi\HOW TO BACK FILES.txt InstallUtil.exe File created C:\Program Files\VideoLAN\VLC\locale\he\HOW TO BACK FILES.txt InstallUtil.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\en-il\HOW TO BACK FILES.txt InstallUtil.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsFeedbackHub_1.1907.3152.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\InsiderHubMedTile.scale-125_contrast-white.png InstallUtil.exe File created C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_neutral_split.scale-200_8wekyb3d8bbwe\microsoft.system.package.metadata\HOW TO BACK FILES.txt InstallUtil.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HOW TO BACK FILES.txt InstallUtil.exe File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\es\HOW TO BACK FILES.txt InstallUtil.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Home\contrast-white\SmallTile.scale-125.png InstallUtil.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\AppPackageStoreLogo.scale-200.png InstallUtil.exe File created C:\Program Files\Java\jre-1.8\lib\ext\HOW TO BACK FILES.txt InstallUtil.exe File created C:\Program Files\Microsoft Office\root\Integration\Addons\HOW TO BACK FILES.txt InstallUtil.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EURO\HOW TO BACK FILES.txt InstallUtil.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\SplashScreen.scale-150.png InstallUtil.exe File created C:\Program Files\VideoLAN\VLC\locale\ne\LC_MESSAGES\HOW TO BACK FILES.txt InstallUtil.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ug\LC_MESSAGES\HOW TO BACK FILES.txt InstallUtil.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\eu-es\HOW TO BACK FILES.txt InstallUtil.exe File created C:\Program Files (x86)\Windows Media Player\Icons\HOW TO BACK FILES.txt InstallUtil.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Grace-ppd.xrm-ms InstallUtil.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\HOW TO BACK FILES.txt InstallUtil.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\flavormap.properties InstallUtil.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\WordR_Retail-ppd.xrm-ms InstallUtil.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\Images\Ratings\Yelp7.scale-125.png InstallUtil.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WebMediaExtensions_1.0.20875.0_neutral_split.scale-125_8wekyb3d8bbwe\HOW TO BACK FILES.txt InstallUtil.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\HOW TO BACK FILES.txt InstallUtil.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\fi-fi\HOW TO BACK FILES.txt InstallUtil.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\HOW TO BACK FILES.txt InstallUtil.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\AccessR_OEM_Perp-ppd.xrm-ms InstallUtil.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.scale-140.png InstallUtil.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsAlarms_10.1906.2182.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AlarmsSmallTile.contrast-white_scale-125.png InstallUtil.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\Weather_LogoSmall.targetsize-32_altform-unplated.png InstallUtil.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\ru-ru\HOW TO BACK FILES.txt InstallUtil.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\pt-br\HOW TO BACK FILES.txt InstallUtil.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\da-dk\HOW TO BACK FILES.txt InstallUtil.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppPackageStoreLogo.scale-200_contrast-black.png InstallUtil.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\ext\meta-index InstallUtil.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Grace-ppd.xrm-ms InstallUtil.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppTiles\contrast-black\MapsStoreLogo.scale-125.png InstallUtil.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\TrafficHub\contrast-black\WideTile.scale-125.png InstallUtil.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.YourPhone_0.19051.7.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppTiles\contrast-white\MediumTile.scale-125_contrast-white.png InstallUtil.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\HOW TO BACK FILES.txt InstallUtil.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Windows.Photos_2019.19071.12548.0_neutral_split.scale-100_8wekyb3d8bbwe\AppxBlockMap.xml InstallUtil.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsStore_11910.1002.5.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\contrast-white\StoreAppList.scale-100.png InstallUtil.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_OEM_Perp-ppd.xrm-ms InstallUtil.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\TargetInfo.txt InstallUtil.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
pid Process 5064 0376107fac6e7b418b2fe8eedc5dd73e6ecd65ec0dadbfd205d48f852db87638.exe 4948 InstallUtil.exe 4948 InstallUtil.exe 4948 InstallUtil.exe 4948 InstallUtil.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 5064 0376107fac6e7b418b2fe8eedc5dd73e6ecd65ec0dadbfd205d48f852db87638.exe Token: SeDebugPrivilege 5064 0376107fac6e7b418b2fe8eedc5dd73e6ecd65ec0dadbfd205d48f852db87638.exe Token: SeTakeOwnershipPrivilege 4948 InstallUtil.exe Token: SeDebugPrivilege 4948 InstallUtil.exe Token: SeTakeOwnershipPrivilege 4948 InstallUtil.exe Token: SeTakeOwnershipPrivilege 4948 InstallUtil.exe Token: SeTakeOwnershipPrivilege 4948 InstallUtil.exe Token: SeTakeOwnershipPrivilege 4948 InstallUtil.exe Token: SeTakeOwnershipPrivilege 4948 InstallUtil.exe Token: SeTakeOwnershipPrivilege 4948 InstallUtil.exe Token: SeTakeOwnershipPrivilege 4948 InstallUtil.exe Token: SeTakeOwnershipPrivilege 4948 InstallUtil.exe Token: SeTakeOwnershipPrivilege 4948 InstallUtil.exe Token: SeTakeOwnershipPrivilege 4948 InstallUtil.exe Token: SeTakeOwnershipPrivilege 4948 InstallUtil.exe Token: SeTakeOwnershipPrivilege 4948 InstallUtil.exe Token: SeTakeOwnershipPrivilege 4948 InstallUtil.exe Token: SeTakeOwnershipPrivilege 4948 InstallUtil.exe Token: SeTakeOwnershipPrivilege 4948 InstallUtil.exe Token: SeTakeOwnershipPrivilege 4948 InstallUtil.exe Token: SeTakeOwnershipPrivilege 4948 InstallUtil.exe Token: SeTakeOwnershipPrivilege 4948 InstallUtil.exe Token: SeTakeOwnershipPrivilege 4948 InstallUtil.exe Token: SeTakeOwnershipPrivilege 4948 InstallUtil.exe Token: SeTakeOwnershipPrivilege 4948 InstallUtil.exe Token: SeTakeOwnershipPrivilege 4948 InstallUtil.exe Token: SeTakeOwnershipPrivilege 4948 InstallUtil.exe Token: SeTakeOwnershipPrivilege 4948 InstallUtil.exe Token: SeTakeOwnershipPrivilege 4948 InstallUtil.exe Token: SeTakeOwnershipPrivilege 4948 InstallUtil.exe Token: SeTakeOwnershipPrivilege 4948 InstallUtil.exe Token: SeTakeOwnershipPrivilege 4948 InstallUtil.exe Token: SeTakeOwnershipPrivilege 4948 InstallUtil.exe Token: SeTakeOwnershipPrivilege 4948 InstallUtil.exe Token: SeTakeOwnershipPrivilege 4948 InstallUtil.exe Token: SeTakeOwnershipPrivilege 4948 InstallUtil.exe Token: SeTakeOwnershipPrivilege 4948 InstallUtil.exe Token: SeTakeOwnershipPrivilege 4948 InstallUtil.exe Token: SeTakeOwnershipPrivilege 4948 InstallUtil.exe Token: SeTakeOwnershipPrivilege 4948 InstallUtil.exe Token: SeTakeOwnershipPrivilege 4948 InstallUtil.exe Token: SeTakeOwnershipPrivilege 4948 InstallUtil.exe Token: SeTakeOwnershipPrivilege 4948 InstallUtil.exe Token: SeTakeOwnershipPrivilege 4948 InstallUtil.exe Token: SeTakeOwnershipPrivilege 4948 InstallUtil.exe Token: SeTakeOwnershipPrivilege 4948 InstallUtil.exe Token: SeTakeOwnershipPrivilege 4948 InstallUtil.exe Token: SeTakeOwnershipPrivilege 4948 InstallUtil.exe Token: SeTakeOwnershipPrivilege 4948 InstallUtil.exe Token: SeTakeOwnershipPrivilege 4948 InstallUtil.exe Token: SeTakeOwnershipPrivilege 4948 InstallUtil.exe Token: SeTakeOwnershipPrivilege 4948 InstallUtil.exe Token: SeTakeOwnershipPrivilege 4948 InstallUtil.exe Token: SeTakeOwnershipPrivilege 4948 InstallUtil.exe Token: SeTakeOwnershipPrivilege 4948 InstallUtil.exe Token: SeTakeOwnershipPrivilege 4948 InstallUtil.exe Token: SeTakeOwnershipPrivilege 4948 InstallUtil.exe Token: SeTakeOwnershipPrivilege 4948 InstallUtil.exe Token: SeTakeOwnershipPrivilege 4948 InstallUtil.exe Token: SeTakeOwnershipPrivilege 4948 InstallUtil.exe Token: SeTakeOwnershipPrivilege 4948 InstallUtil.exe Token: SeTakeOwnershipPrivilege 4948 InstallUtil.exe Token: SeTakeOwnershipPrivilege 4948 InstallUtil.exe Token: SeTakeOwnershipPrivilege 4948 InstallUtil.exe -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 5064 wrote to memory of 4948 5064 0376107fac6e7b418b2fe8eedc5dd73e6ecd65ec0dadbfd205d48f852db87638.exe 84 PID 5064 wrote to memory of 4948 5064 0376107fac6e7b418b2fe8eedc5dd73e6ecd65ec0dadbfd205d48f852db87638.exe 84 PID 5064 wrote to memory of 4948 5064 0376107fac6e7b418b2fe8eedc5dd73e6ecd65ec0dadbfd205d48f852db87638.exe 84 PID 5064 wrote to memory of 4948 5064 0376107fac6e7b418b2fe8eedc5dd73e6ecd65ec0dadbfd205d48f852db87638.exe 84 PID 5064 wrote to memory of 4948 5064 0376107fac6e7b418b2fe8eedc5dd73e6ecd65ec0dadbfd205d48f852db87638.exe 84 PID 5064 wrote to memory of 4948 5064 0376107fac6e7b418b2fe8eedc5dd73e6ecd65ec0dadbfd205d48f852db87638.exe 84 PID 5064 wrote to memory of 4948 5064 0376107fac6e7b418b2fe8eedc5dd73e6ecd65ec0dadbfd205d48f852db87638.exe 84 PID 5064 wrote to memory of 4948 5064 0376107fac6e7b418b2fe8eedc5dd73e6ecd65ec0dadbfd205d48f852db87638.exe 84 PID 5064 wrote to memory of 4948 5064 0376107fac6e7b418b2fe8eedc5dd73e6ecd65ec0dadbfd205d48f852db87638.exe 84 PID 5064 wrote to memory of 4948 5064 0376107fac6e7b418b2fe8eedc5dd73e6ecd65ec0dadbfd205d48f852db87638.exe 84 PID 4948 wrote to memory of 1788 4948 InstallUtil.exe 85 PID 4948 wrote to memory of 1788 4948 InstallUtil.exe 85 PID 4948 wrote to memory of 5000 4948 InstallUtil.exe 87 PID 4948 wrote to memory of 5000 4948 InstallUtil.exe 87 PID 5000 wrote to memory of 3376 5000 cmd.exe 91 PID 5000 wrote to memory of 3376 5000 cmd.exe 91 PID 1788 wrote to memory of 3272 1788 cmd.exe 92 PID 1788 wrote to memory of 3272 1788 cmd.exe 92
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3560
-
C:\Users\Admin\AppData\Local\Temp\0376107fac6e7b418b2fe8eedc5dd73e6ecd65ec0dadbfd205d48f852db87638.exe"C:\Users\Admin\AppData\Local\Temp\0376107fac6e7b418b2fe8eedc5dd73e6ecd65ec0dadbfd205d48f852db87638.exe"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5064
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"2⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4948 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit /set {current} bootstatuspolicy ignoreallfailures3⤵
- Suspicious use of WriteProcessMemory
PID:1788 -
C:\Windows\system32\bcdedit.exebcdedit /set {current} bootstatuspolicy ignoreallfailures4⤵
- Modifies boot configuration data using bcdedit
PID:3272
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit /set {current} recoveryenabled no3⤵
- Suspicious use of WriteProcessMemory
PID:5000 -
C:\Windows\system32\bcdedit.exebcdedit /set {current} recoveryenabled no4⤵
- Modifies boot configuration data using bcdedit
PID:3376
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
196B
MD5f57c0474383aa9af742506ba8e03daf7
SHA1e1e3be64abd14af6570e6ed001928adbd42d30d3
SHA2564fc6f6d439b6a854dae8b771a0b42b472ef467defe3395bc210c9289de9f3a0b
SHA51214853189bbc39c201cfaa6152e7954ef768ec39767766d02d8df63c4d3dae29012261ec94c5eacc1025489fbdd8fbca581cd497e62ad973a333208d3515e8d56
-
Filesize
1KB
MD5803edc501cf82a5593af45eb4d37c3e8
SHA1383d8a5be88cbf5847d9bd63c4ea5d7477661c7c
SHA256b7f6aa7b231df04d18914c80cd286c3a68c607edc4b694d7453e52a2c7d36ef4
SHA512bba8118dac1f88bfb81b492003ce6b9b2cf122c6036534af663290c5d2b63de9e05aefa61c7d3e6e4f676d2fff983c7baee7e04451bb4c3a20aa7810ee150dda