Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
17-12-2024 14:14
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
a39ad91fa7e488a5738da1d4cc058a4207d2797739cdd9f4d4a33709cc38cb52N.exe
Resource
win7-20240903-en
windows7-x64
21 signatures
120 seconds
General
-
Target
a39ad91fa7e488a5738da1d4cc058a4207d2797739cdd9f4d4a33709cc38cb52N.exe
-
Size
888KB
-
MD5
d9c444cad1cd385154a50278c9120030
-
SHA1
1c631f1e2b6308d1f87eb05dfdc09b696d064524
-
SHA256
a39ad91fa7e488a5738da1d4cc058a4207d2797739cdd9f4d4a33709cc38cb52
-
SHA512
0ed3710bf609c1a70ee2426cdb78d23659823bf757a794040e9dabc0aa2ca8f569f9cedf59258296020fad846683d72ec11e7afec465f4d52fb07cc296ab365a
-
SSDEEP
12288:DpqAgC/2OGAtkCP4cejGSOpRK3CGYxBjvrEH7TS:DpX/2+ttPJLfpRK3CGYvrEH7TS
Malware Config
Signatures
-
Floxif family
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe system3_.exe" a39ad91fa7e488a5738da1d4cc058a4207d2797739cdd9f4d4a33709cc38cb52N.exe -
Detects Floxif payload 1 IoCs
resource yara_rule behavioral1/files/0x00090000000120ce-2.dat floxif -
Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" a39ad91fa7e488a5738da1d4cc058a4207d2797739cdd9f4d4a33709cc38cb52N.exe -
Disables Task Manager via registry modification
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral1/files/0x00090000000120ce-2.dat acprotect -
Loads dropped DLL 1 IoCs
pid Process 1700 a39ad91fa7e488a5738da1d4cc058a4207d2797739cdd9f4d4a33709cc38cb52N.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\Yahoo Messengger = "C:\\Users\\Admin\\Desktop\\system3_.exe" a39ad91fa7e488a5738da1d4cc058a4207d2797739cdd9f4d4a33709cc38cb52N.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\e: a39ad91fa7e488a5738da1d4cc058a4207d2797739cdd9f4d4a33709cc38cb52N.exe File opened (read-only) \??\l: a39ad91fa7e488a5738da1d4cc058a4207d2797739cdd9f4d4a33709cc38cb52N.exe File opened (read-only) \??\y: a39ad91fa7e488a5738da1d4cc058a4207d2797739cdd9f4d4a33709cc38cb52N.exe File opened (read-only) \??\k: a39ad91fa7e488a5738da1d4cc058a4207d2797739cdd9f4d4a33709cc38cb52N.exe File opened (read-only) \??\o: a39ad91fa7e488a5738da1d4cc058a4207d2797739cdd9f4d4a33709cc38cb52N.exe File opened (read-only) \??\t: a39ad91fa7e488a5738da1d4cc058a4207d2797739cdd9f4d4a33709cc38cb52N.exe File opened (read-only) \??\v: a39ad91fa7e488a5738da1d4cc058a4207d2797739cdd9f4d4a33709cc38cb52N.exe File opened (read-only) \??\b: a39ad91fa7e488a5738da1d4cc058a4207d2797739cdd9f4d4a33709cc38cb52N.exe File opened (read-only) \??\j: a39ad91fa7e488a5738da1d4cc058a4207d2797739cdd9f4d4a33709cc38cb52N.exe File opened (read-only) \??\n: a39ad91fa7e488a5738da1d4cc058a4207d2797739cdd9f4d4a33709cc38cb52N.exe File opened (read-only) \??\p: a39ad91fa7e488a5738da1d4cc058a4207d2797739cdd9f4d4a33709cc38cb52N.exe File opened (read-only) \??\s: a39ad91fa7e488a5738da1d4cc058a4207d2797739cdd9f4d4a33709cc38cb52N.exe File opened (read-only) \??\u: a39ad91fa7e488a5738da1d4cc058a4207d2797739cdd9f4d4a33709cc38cb52N.exe File opened (read-only) \??\x: a39ad91fa7e488a5738da1d4cc058a4207d2797739cdd9f4d4a33709cc38cb52N.exe File opened (read-only) \??\a: a39ad91fa7e488a5738da1d4cc058a4207d2797739cdd9f4d4a33709cc38cb52N.exe File opened (read-only) \??\g: a39ad91fa7e488a5738da1d4cc058a4207d2797739cdd9f4d4a33709cc38cb52N.exe File opened (read-only) \??\h: a39ad91fa7e488a5738da1d4cc058a4207d2797739cdd9f4d4a33709cc38cb52N.exe File opened (read-only) \??\i: a39ad91fa7e488a5738da1d4cc058a4207d2797739cdd9f4d4a33709cc38cb52N.exe File opened (read-only) \??\m: a39ad91fa7e488a5738da1d4cc058a4207d2797739cdd9f4d4a33709cc38cb52N.exe File opened (read-only) \??\q: a39ad91fa7e488a5738da1d4cc058a4207d2797739cdd9f4d4a33709cc38cb52N.exe File opened (read-only) \??\r: a39ad91fa7e488a5738da1d4cc058a4207d2797739cdd9f4d4a33709cc38cb52N.exe File opened (read-only) \??\w: a39ad91fa7e488a5738da1d4cc058a4207d2797739cdd9f4d4a33709cc38cb52N.exe File opened (read-only) \??\z: a39ad91fa7e488a5738da1d4cc058a4207d2797739cdd9f4d4a33709cc38cb52N.exe -
AutoIT Executable 6 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/memory/1700-0-0x0000000000400000-0x00000000004E8000-memory.dmp autoit_exe behavioral1/files/0x0008000000016d47-11.dat autoit_exe behavioral1/memory/1700-77-0x0000000000400000-0x00000000004E8000-memory.dmp autoit_exe behavioral1/memory/1700-134-0x0000000000400000-0x00000000004E8000-memory.dmp autoit_exe behavioral1/memory/1700-149-0x0000000000400000-0x00000000004E8000-memory.dmp autoit_exe behavioral1/memory/1700-164-0x0000000000400000-0x00000000004E8000-memory.dmp autoit_exe -
Drops autorun.inf file 1 TTPs 3 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File created \??\f:\autorun.inf a39ad91fa7e488a5738da1d4cc058a4207d2797739cdd9f4d4a33709cc38cb52N.exe File opened for modification F:\\autorun.inf a39ad91fa7e488a5738da1d4cc058a4207d2797739cdd9f4d4a33709cc38cb52N.exe File created \??\d:\autorun.inf a39ad91fa7e488a5738da1d4cc058a4207d2797739cdd9f4d4a33709cc38cb52N.exe -
resource yara_rule behavioral1/files/0x00090000000120ce-2.dat upx behavioral1/memory/1700-4-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral1/memory/1700-68-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral1/memory/1700-76-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral1/memory/1700-148-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral1/memory/1700-152-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral1/memory/1700-155-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral1/memory/1700-158-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral1/memory/1700-161-0x0000000010000000-0x0000000010030000-memory.dmp upx -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files\Common Files\System\symsrv.dll a39ad91fa7e488a5738da1d4cc058a4207d2797739cdd9f4d4a33709cc38cb52N.exe File created \??\c:\program files\common files\system\symsrv.dll.000 a39ad91fa7e488a5738da1d4cc058a4207d2797739cdd9f4d4a33709cc38cb52N.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a39ad91fa7e488a5738da1d4cc058a4207d2797739cdd9f4d4a33709cc38cb52N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language at.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cacls.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language at.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cacls.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Main a39ad91fa7e488a5738da1d4cc058a4207d2797739cdd9f4d4a33709cc38cb52N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Default_Page_URL = "http://www.mydreamworld.50webs.com" a39ad91fa7e488a5738da1d4cc058a4207d2797739cdd9f4d4a33709cc38cb52N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Default_Search_URL = "http://www.mydreamworld.50webs.com" a39ad91fa7e488a5738da1d4cc058a4207d2797739cdd9f4d4a33709cc38cb52N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Search Page = "http://www.mydreamworld.50webs.com" a39ad91fa7e488a5738da1d4cc058a4207d2797739cdd9f4d4a33709cc38cb52N.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main a39ad91fa7e488a5738da1d4cc058a4207d2797739cdd9f4d4a33709cc38cb52N.exe -
Modifies Internet Explorer start page 1 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://www.mydreamworld.50webs.com" a39ad91fa7e488a5738da1d4cc058a4207d2797739cdd9f4d4a33709cc38cb52N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Start Page = "http://www.mydreamworld.50webs.com" a39ad91fa7e488a5738da1d4cc058a4207d2797739cdd9f4d4a33709cc38cb52N.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1700 a39ad91fa7e488a5738da1d4cc058a4207d2797739cdd9f4d4a33709cc38cb52N.exe 1700 a39ad91fa7e488a5738da1d4cc058a4207d2797739cdd9f4d4a33709cc38cb52N.exe 1700 a39ad91fa7e488a5738da1d4cc058a4207d2797739cdd9f4d4a33709cc38cb52N.exe 1700 a39ad91fa7e488a5738da1d4cc058a4207d2797739cdd9f4d4a33709cc38cb52N.exe 1700 a39ad91fa7e488a5738da1d4cc058a4207d2797739cdd9f4d4a33709cc38cb52N.exe 1700 a39ad91fa7e488a5738da1d4cc058a4207d2797739cdd9f4d4a33709cc38cb52N.exe 1700 a39ad91fa7e488a5738da1d4cc058a4207d2797739cdd9f4d4a33709cc38cb52N.exe 1700 a39ad91fa7e488a5738da1d4cc058a4207d2797739cdd9f4d4a33709cc38cb52N.exe 1700 a39ad91fa7e488a5738da1d4cc058a4207d2797739cdd9f4d4a33709cc38cb52N.exe 1700 a39ad91fa7e488a5738da1d4cc058a4207d2797739cdd9f4d4a33709cc38cb52N.exe 1700 a39ad91fa7e488a5738da1d4cc058a4207d2797739cdd9f4d4a33709cc38cb52N.exe 1700 a39ad91fa7e488a5738da1d4cc058a4207d2797739cdd9f4d4a33709cc38cb52N.exe 1700 a39ad91fa7e488a5738da1d4cc058a4207d2797739cdd9f4d4a33709cc38cb52N.exe 1700 a39ad91fa7e488a5738da1d4cc058a4207d2797739cdd9f4d4a33709cc38cb52N.exe 1700 a39ad91fa7e488a5738da1d4cc058a4207d2797739cdd9f4d4a33709cc38cb52N.exe 1700 a39ad91fa7e488a5738da1d4cc058a4207d2797739cdd9f4d4a33709cc38cb52N.exe 1700 a39ad91fa7e488a5738da1d4cc058a4207d2797739cdd9f4d4a33709cc38cb52N.exe 1700 a39ad91fa7e488a5738da1d4cc058a4207d2797739cdd9f4d4a33709cc38cb52N.exe 1700 a39ad91fa7e488a5738da1d4cc058a4207d2797739cdd9f4d4a33709cc38cb52N.exe 1700 a39ad91fa7e488a5738da1d4cc058a4207d2797739cdd9f4d4a33709cc38cb52N.exe 1700 a39ad91fa7e488a5738da1d4cc058a4207d2797739cdd9f4d4a33709cc38cb52N.exe 1700 a39ad91fa7e488a5738da1d4cc058a4207d2797739cdd9f4d4a33709cc38cb52N.exe 1700 a39ad91fa7e488a5738da1d4cc058a4207d2797739cdd9f4d4a33709cc38cb52N.exe 1700 a39ad91fa7e488a5738da1d4cc058a4207d2797739cdd9f4d4a33709cc38cb52N.exe 1700 a39ad91fa7e488a5738da1d4cc058a4207d2797739cdd9f4d4a33709cc38cb52N.exe 1700 a39ad91fa7e488a5738da1d4cc058a4207d2797739cdd9f4d4a33709cc38cb52N.exe 1700 a39ad91fa7e488a5738da1d4cc058a4207d2797739cdd9f4d4a33709cc38cb52N.exe 1700 a39ad91fa7e488a5738da1d4cc058a4207d2797739cdd9f4d4a33709cc38cb52N.exe 1700 a39ad91fa7e488a5738da1d4cc058a4207d2797739cdd9f4d4a33709cc38cb52N.exe 1700 a39ad91fa7e488a5738da1d4cc058a4207d2797739cdd9f4d4a33709cc38cb52N.exe 1700 a39ad91fa7e488a5738da1d4cc058a4207d2797739cdd9f4d4a33709cc38cb52N.exe 1700 a39ad91fa7e488a5738da1d4cc058a4207d2797739cdd9f4d4a33709cc38cb52N.exe 1700 a39ad91fa7e488a5738da1d4cc058a4207d2797739cdd9f4d4a33709cc38cb52N.exe 1700 a39ad91fa7e488a5738da1d4cc058a4207d2797739cdd9f4d4a33709cc38cb52N.exe 1700 a39ad91fa7e488a5738da1d4cc058a4207d2797739cdd9f4d4a33709cc38cb52N.exe 1700 a39ad91fa7e488a5738da1d4cc058a4207d2797739cdd9f4d4a33709cc38cb52N.exe 1700 a39ad91fa7e488a5738da1d4cc058a4207d2797739cdd9f4d4a33709cc38cb52N.exe 1700 a39ad91fa7e488a5738da1d4cc058a4207d2797739cdd9f4d4a33709cc38cb52N.exe 1700 a39ad91fa7e488a5738da1d4cc058a4207d2797739cdd9f4d4a33709cc38cb52N.exe 1700 a39ad91fa7e488a5738da1d4cc058a4207d2797739cdd9f4d4a33709cc38cb52N.exe 1700 a39ad91fa7e488a5738da1d4cc058a4207d2797739cdd9f4d4a33709cc38cb52N.exe 1700 a39ad91fa7e488a5738da1d4cc058a4207d2797739cdd9f4d4a33709cc38cb52N.exe 1700 a39ad91fa7e488a5738da1d4cc058a4207d2797739cdd9f4d4a33709cc38cb52N.exe 1700 a39ad91fa7e488a5738da1d4cc058a4207d2797739cdd9f4d4a33709cc38cb52N.exe 1700 a39ad91fa7e488a5738da1d4cc058a4207d2797739cdd9f4d4a33709cc38cb52N.exe 1700 a39ad91fa7e488a5738da1d4cc058a4207d2797739cdd9f4d4a33709cc38cb52N.exe 1700 a39ad91fa7e488a5738da1d4cc058a4207d2797739cdd9f4d4a33709cc38cb52N.exe 1700 a39ad91fa7e488a5738da1d4cc058a4207d2797739cdd9f4d4a33709cc38cb52N.exe 1700 a39ad91fa7e488a5738da1d4cc058a4207d2797739cdd9f4d4a33709cc38cb52N.exe 1700 a39ad91fa7e488a5738da1d4cc058a4207d2797739cdd9f4d4a33709cc38cb52N.exe 1700 a39ad91fa7e488a5738da1d4cc058a4207d2797739cdd9f4d4a33709cc38cb52N.exe 1700 a39ad91fa7e488a5738da1d4cc058a4207d2797739cdd9f4d4a33709cc38cb52N.exe 1700 a39ad91fa7e488a5738da1d4cc058a4207d2797739cdd9f4d4a33709cc38cb52N.exe 1700 a39ad91fa7e488a5738da1d4cc058a4207d2797739cdd9f4d4a33709cc38cb52N.exe 1700 a39ad91fa7e488a5738da1d4cc058a4207d2797739cdd9f4d4a33709cc38cb52N.exe 1700 a39ad91fa7e488a5738da1d4cc058a4207d2797739cdd9f4d4a33709cc38cb52N.exe 1700 a39ad91fa7e488a5738da1d4cc058a4207d2797739cdd9f4d4a33709cc38cb52N.exe 1700 a39ad91fa7e488a5738da1d4cc058a4207d2797739cdd9f4d4a33709cc38cb52N.exe 1700 a39ad91fa7e488a5738da1d4cc058a4207d2797739cdd9f4d4a33709cc38cb52N.exe 1700 a39ad91fa7e488a5738da1d4cc058a4207d2797739cdd9f4d4a33709cc38cb52N.exe 1700 a39ad91fa7e488a5738da1d4cc058a4207d2797739cdd9f4d4a33709cc38cb52N.exe 1700 a39ad91fa7e488a5738da1d4cc058a4207d2797739cdd9f4d4a33709cc38cb52N.exe 1700 a39ad91fa7e488a5738da1d4cc058a4207d2797739cdd9f4d4a33709cc38cb52N.exe 1700 a39ad91fa7e488a5738da1d4cc058a4207d2797739cdd9f4d4a33709cc38cb52N.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1700 a39ad91fa7e488a5738da1d4cc058a4207d2797739cdd9f4d4a33709cc38cb52N.exe -
Suspicious use of WriteProcessMemory 32 IoCs
description pid Process procid_target PID 1700 wrote to memory of 1060 1700 a39ad91fa7e488a5738da1d4cc058a4207d2797739cdd9f4d4a33709cc38cb52N.exe 30 PID 1700 wrote to memory of 1060 1700 a39ad91fa7e488a5738da1d4cc058a4207d2797739cdd9f4d4a33709cc38cb52N.exe 30 PID 1700 wrote to memory of 1060 1700 a39ad91fa7e488a5738da1d4cc058a4207d2797739cdd9f4d4a33709cc38cb52N.exe 30 PID 1700 wrote to memory of 1060 1700 a39ad91fa7e488a5738da1d4cc058a4207d2797739cdd9f4d4a33709cc38cb52N.exe 30 PID 1060 wrote to memory of 2904 1060 cmd.exe 32 PID 1060 wrote to memory of 2904 1060 cmd.exe 32 PID 1060 wrote to memory of 2904 1060 cmd.exe 32 PID 1060 wrote to memory of 2904 1060 cmd.exe 32 PID 1700 wrote to memory of 2756 1700 a39ad91fa7e488a5738da1d4cc058a4207d2797739cdd9f4d4a33709cc38cb52N.exe 33 PID 1700 wrote to memory of 2756 1700 a39ad91fa7e488a5738da1d4cc058a4207d2797739cdd9f4d4a33709cc38cb52N.exe 33 PID 1700 wrote to memory of 2756 1700 a39ad91fa7e488a5738da1d4cc058a4207d2797739cdd9f4d4a33709cc38cb52N.exe 33 PID 1700 wrote to memory of 2756 1700 a39ad91fa7e488a5738da1d4cc058a4207d2797739cdd9f4d4a33709cc38cb52N.exe 33 PID 2756 wrote to memory of 1936 2756 cmd.exe 35 PID 2756 wrote to memory of 1936 2756 cmd.exe 35 PID 2756 wrote to memory of 1936 2756 cmd.exe 35 PID 2756 wrote to memory of 1936 2756 cmd.exe 35 PID 1700 wrote to memory of 844 1700 a39ad91fa7e488a5738da1d4cc058a4207d2797739cdd9f4d4a33709cc38cb52N.exe 39 PID 1700 wrote to memory of 844 1700 a39ad91fa7e488a5738da1d4cc058a4207d2797739cdd9f4d4a33709cc38cb52N.exe 39 PID 1700 wrote to memory of 844 1700 a39ad91fa7e488a5738da1d4cc058a4207d2797739cdd9f4d4a33709cc38cb52N.exe 39 PID 1700 wrote to memory of 844 1700 a39ad91fa7e488a5738da1d4cc058a4207d2797739cdd9f4d4a33709cc38cb52N.exe 39 PID 844 wrote to memory of 2532 844 cmd.exe 41 PID 844 wrote to memory of 2532 844 cmd.exe 41 PID 844 wrote to memory of 2532 844 cmd.exe 41 PID 844 wrote to memory of 2532 844 cmd.exe 41 PID 1700 wrote to memory of 2128 1700 a39ad91fa7e488a5738da1d4cc058a4207d2797739cdd9f4d4a33709cc38cb52N.exe 42 PID 1700 wrote to memory of 2128 1700 a39ad91fa7e488a5738da1d4cc058a4207d2797739cdd9f4d4a33709cc38cb52N.exe 42 PID 1700 wrote to memory of 2128 1700 a39ad91fa7e488a5738da1d4cc058a4207d2797739cdd9f4d4a33709cc38cb52N.exe 42 PID 1700 wrote to memory of 2128 1700 a39ad91fa7e488a5738da1d4cc058a4207d2797739cdd9f4d4a33709cc38cb52N.exe 42 PID 2128 wrote to memory of 1484 2128 cmd.exe 44 PID 2128 wrote to memory of 1484 2128 cmd.exe 44 PID 2128 wrote to memory of 1484 2128 cmd.exe 44 PID 2128 wrote to memory of 1484 2128 cmd.exe 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\a39ad91fa7e488a5738da1d4cc058a4207d2797739cdd9f4d4a33709cc38cb52N.exe"C:\Users\Admin\AppData\Local\Temp\a39ad91fa7e488a5738da1d4cc058a4207d2797739cdd9f4d4a33709cc38cb52N.exe"1⤵
- Modifies WinLogon for persistence
- Disables RegEdit via registry modification
- Loads dropped DLL
- Adds Run key to start application
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1700 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C AT /delete /yes2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1060 -
C:\Windows\SysWOW64\at.exeAT /delete /yes3⤵
- System Location Discovery: System Language Discovery
PID:2904
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Users\Admin\Desktop\system3_.exe2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2756 -
C:\Windows\SysWOW64\at.exeAT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Users\Admin\Desktop\system3_.exe3⤵
- System Location Discovery: System Language Discovery
PID:1936
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C cacls "C:\system volume information" /e /g "Admin":f2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:844 -
C:\Windows\SysWOW64\cacls.execacls "C:\system volume information" /e /g "Admin":f3⤵
- System Location Discovery: System Language Discovery
PID:2532
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C cacls "C:\system volume information" /e /g "Admin":f2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2128 -
C:\Windows\SysWOW64\cacls.execacls "C:\system volume information" /e /g "Admin":f3⤵
- System Location Discovery: System Language Discovery
PID:1484
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
175B
MD51130c911bf5db4b8f7cf9b6f4b457623
SHA148e734c4bc1a8b5399bff4954e54b268bde9d54c
SHA256eba08cc8182f379392a97f542b350ea0dbbe5e4009472f35af20e3d857eafdf1
SHA51294e2511ef2c53494c2aff0960266491ffc0e54e75185427d1ccedae27c286992c754ca94cbb0c9ea36e3f04cd4eb7f032c551cf2d4b309f292906303f1a75fa0
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\M4TQDAHL\setting[2].htm
Filesize167B
MD50104c301c5e02bd6148b8703d19b3a73
SHA17436e0b4b1f8c222c38069890b75fa2baf9ca620
SHA256446a6087825fa73eadb045e5a2e9e2adf7df241b571228187728191d961dda1f
SHA51284427b656a6234a651a6d8285c103645b861a18a6c5af4abb5cb4f3beb5a4f0df4a74603a0896c7608790fbb886dc40508e92d5709f44dca05dd46c8316d15bf
-
Filesize
102B
MD5948c74cd98911b420ff89dac13399bcb
SHA176dfc73518f003953923b1b4f2b973f4bb56a411
SHA25694a1ac3d574425ec8a3cc01675e4d787373d2a190dddd4f8ba507c49ca3fd42a
SHA512b31d82ede9d48e390a50a9dcf5c4c607c62638e8bc56f473250f9a56b7967d5de948abed69bbb2c35eb0112288faa5c438316b06ccbb36d289e93952b30e2ede
-
Filesize
888KB
MD5d9c444cad1cd385154a50278c9120030
SHA11c631f1e2b6308d1f87eb05dfdc09b696d064524
SHA256a39ad91fa7e488a5738da1d4cc058a4207d2797739cdd9f4d4a33709cc38cb52
SHA5120ed3710bf609c1a70ee2426cdb78d23659823bf757a794040e9dabc0aa2ca8f569f9cedf59258296020fad846683d72ec11e7afec465f4d52fb07cc296ab365a
-
Filesize
67KB
MD57574cf2c64f35161ab1292e2f532aabf
SHA114ba3fa927a06224dfe587014299e834def4644f
SHA256de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085
SHA5124db19f2d8d5bc1c7bbb812d3fa9c43b80fa22140b346d2760f090b73aed8a5177edb4bddc647a6ebd5a2db8565be5a1a36a602b0d759e38540d9a584ba5896ab