Overview
overview
10Static
static
1036.exe
windows7-x64
336.exe
windows10-2004-x64
3Enalib.exe
windows7-x64
10Enalib.exe
windows10-2004-x64
10RDriver.exe
windows7-x64
8RDriver.exe
windows10-2004-x64
8SDriver.exe
windows7-x64
3SDriver.exe
windows10-2004-x64
3T.exe
windows7-x64
10T.exe
windows10-2004-x64
10autoruns.exe
windows7-x64
3autoruns.exe
windows10-2004-x64
3e.exe
windows7-x64
10e.exe
windows10-2004-x64
10fake jpg shit.lnk
windows7-x64
10fake jpg shit.lnk
windows10-2004-x64
10fake photo.lnk
windows7-x64
3fake photo.lnk
windows10-2004-x64
7noyjhoadw.exe
windows7-x64
10noyjhoadw.exe
windows10-2004-x64
10unins000.exe
windows7-x64
3unins000.exe
windows10-2004-x64
3use for by...ck.exe
windows7-x64
8use for by...ck.exe
windows10-2004-x64
8Analysis
-
max time kernel
30s -
max time network
29s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
24/01/2025, 13:13
Behavioral task
behavioral1
Sample
36.exe
Resource
win7-20241023-en
windows7-x64
3 signatures
30 seconds
Behavioral task
behavioral2
Sample
36.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
2 signatures
30 seconds
Behavioral task
behavioral3
Sample
Enalib.exe
Resource
win7-20240903-en
windows7-x64
9 signatures
30 seconds
Behavioral task
behavioral4
Sample
Enalib.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
9 signatures
30 seconds
Behavioral task
behavioral5
Sample
RDriver.exe
Resource
win7-20241010-en
windows7-x64
5 signatures
30 seconds
Behavioral task
behavioral6
Sample
RDriver.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
4 signatures
30 seconds
Behavioral task
behavioral7
Sample
SDriver.exe
Resource
win7-20240903-en
windows7-x64
1 signatures
30 seconds
Behavioral task
behavioral8
Sample
SDriver.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
1 signatures
30 seconds
Behavioral task
behavioral9
Sample
T.exe
Resource
win7-20240903-en
windows7-x64
9 signatures
30 seconds
Behavioral task
behavioral10
Sample
T.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
9 signatures
30 seconds
Behavioral task
behavioral11
Sample
autoruns.exe
Resource
win7-20240903-en
windows7-x64
6 signatures
30 seconds
Behavioral task
behavioral12
Sample
autoruns.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
5 signatures
30 seconds
Behavioral task
behavioral13
Sample
e.exe
Resource
win7-20240903-en
windows7-x64
4 signatures
30 seconds
Behavioral task
behavioral14
Sample
e.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
4 signatures
30 seconds
Behavioral task
behavioral15
Sample
fake jpg shit.lnk
Resource
win7-20241010-en
windows7-x64
7 signatures
30 seconds
Behavioral task
behavioral16
Sample
fake jpg shit.lnk
Resource
win10v2004-20241007-en
windows10-2004-x64
9 signatures
30 seconds
Behavioral task
behavioral17
Sample
fake photo.lnk
Resource
win7-20240729-en
windows7-x64
4 signatures
30 seconds
Behavioral task
behavioral18
Sample
fake photo.lnk
Resource
win10v2004-20241007-en
windows10-2004-x64
7 signatures
30 seconds
Behavioral task
behavioral19
Sample
noyjhoadw.exe
Resource
win7-20241010-en
windows7-x64
5 signatures
30 seconds
Behavioral task
behavioral20
Sample
noyjhoadw.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
4 signatures
30 seconds
Behavioral task
behavioral21
Sample
unins000.exe
Resource
win7-20240903-en
windows7-x64
5 signatures
30 seconds
Behavioral task
behavioral22
Sample
unins000.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
1 signatures
30 seconds
Behavioral task
behavioral23
Sample
use for bypassing taskmgr block.exe
Resource
win7-20240903-en
windows7-x64
17 signatures
30 seconds
Behavioral task
behavioral24
Sample
use for bypassing taskmgr block.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
16 signatures
30 seconds
General
-
Target
use for bypassing taskmgr block.exe
-
Size
4.3MB
-
MD5
94c60e6704b5dd11a139f2ffebde9135
-
SHA1
cd89f1cf9428a3eab554a3eb9ff6ca869e5bc368
-
SHA256
106bf123359d03963b1df1011fb8560aaf1c5e811de775dce1d8a53758a69102
-
SHA512
586bf326eae890379fcc7ad60e0a70384d069898aea46da32baf6bd60854df97b461019beaf17744ba3dfc0e70eb75970b977c30f035d296ae89763605d4ff6d
-
SSDEEP
49152:cGNq7FBhpRWa3viMRIcDdxw6dXF3W1QrL1UDq3P8mlp4DOXUxm:cGejpRWafEkRW6OHmrZXt
Score
8/10
Malware Config
Signatures
-
Drops file in Drivers directory 1 IoCs
description ioc Process File created C:\Windows\system32\Drivers\PROCEXP152.SYS use for bypassing taskmgr block64.exe -
Sets service image path in registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\PROCEXP152\ImagePath = "\\??\\C:\\Windows\\system32\\Drivers\\PROCEXP152.SYS" use for bypassing taskmgr block64.exe -
Executes dropped EXE 2 IoCs
pid Process 1504 use for bypassing taskmgr block64.exe 1208 Process not Found -
Loads dropped DLL 1 IoCs
pid Process 2340 use for bypassing taskmgr block.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\A: use for bypassing taskmgr block64.exe File opened (read-only) \??\I: use for bypassing taskmgr block64.exe File opened (read-only) \??\L: use for bypassing taskmgr block64.exe File opened (read-only) \??\M: use for bypassing taskmgr block64.exe File opened (read-only) \??\R: use for bypassing taskmgr block64.exe File opened (read-only) \??\V: use for bypassing taskmgr block64.exe File opened (read-only) \??\X: use for bypassing taskmgr block64.exe File opened (read-only) \??\G: use for bypassing taskmgr block64.exe File opened (read-only) \??\J: use for bypassing taskmgr block64.exe File opened (read-only) \??\K: use for bypassing taskmgr block64.exe File opened (read-only) \??\N: use for bypassing taskmgr block64.exe File opened (read-only) \??\O: use for bypassing taskmgr block64.exe File opened (read-only) \??\P: use for bypassing taskmgr block64.exe File opened (read-only) \??\Q: use for bypassing taskmgr block64.exe File opened (read-only) \??\T: use for bypassing taskmgr block64.exe File opened (read-only) \??\Z: use for bypassing taskmgr block64.exe File opened (read-only) \??\B: use for bypassing taskmgr block64.exe File opened (read-only) \??\E: use for bypassing taskmgr block64.exe File opened (read-only) \??\H: use for bypassing taskmgr block64.exe File opened (read-only) \??\S: use for bypassing taskmgr block64.exe File opened (read-only) \??\U: use for bypassing taskmgr block64.exe File opened (read-only) \??\W: use for bypassing taskmgr block64.exe File opened (read-only) \??\Y: use for bypassing taskmgr block64.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language use for bypassing taskmgr block.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz use for bypassing taskmgr block64.exe Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 use for bypassing taskmgr block64.exe -
Modifies data under HKEY_USERS 3 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19 use for bypassing taskmgr block64.exe Key created \REGISTRY\USER\S-1-5-20 use for bypassing taskmgr block64.exe Key created \REGISTRY\USER\.Default use for bypassing taskmgr block64.exe -
Modifies system certificate store 2 TTPs 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43 use for bypassing taskmgr block64.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 0f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d432000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 use for bypassing taskmgr block64.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa62000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 use for bypassing taskmgr block64.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d43190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 use for bypassing taskmgr block64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436 use for bypassing taskmgr block64.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde use for bypassing taskmgr block64.exe -
Suspicious behavior: EnumeratesProcesses 31 IoCs
pid Process 1504 use for bypassing taskmgr block64.exe 1504 use for bypassing taskmgr block64.exe 1504 use for bypassing taskmgr block64.exe 1504 use for bypassing taskmgr block64.exe 1504 use for bypassing taskmgr block64.exe 1504 use for bypassing taskmgr block64.exe 1504 use for bypassing taskmgr block64.exe 1504 use for bypassing taskmgr block64.exe 1504 use for bypassing taskmgr block64.exe 1504 use for bypassing taskmgr block64.exe 1504 use for bypassing taskmgr block64.exe 1504 use for bypassing taskmgr block64.exe 1504 use for bypassing taskmgr block64.exe 1504 use for bypassing taskmgr block64.exe 1504 use for bypassing taskmgr block64.exe 1504 use for bypassing taskmgr block64.exe 1504 use for bypassing taskmgr block64.exe 1504 use for bypassing taskmgr block64.exe 1504 use for bypassing taskmgr block64.exe 1504 use for bypassing taskmgr block64.exe 1504 use for bypassing taskmgr block64.exe 1504 use for bypassing taskmgr block64.exe 1504 use for bypassing taskmgr block64.exe 1504 use for bypassing taskmgr block64.exe 1504 use for bypassing taskmgr block64.exe 1504 use for bypassing taskmgr block64.exe 1504 use for bypassing taskmgr block64.exe 1504 use for bypassing taskmgr block64.exe 1504 use for bypassing taskmgr block64.exe 1504 use for bypassing taskmgr block64.exe 1504 use for bypassing taskmgr block64.exe -
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 1504 use for bypassing taskmgr block64.exe -
Suspicious use of AdjustPrivilegeToken 13 IoCs
description pid Process Token: SeDebugPrivilege 1504 use for bypassing taskmgr block64.exe Token: SeBackupPrivilege 1504 use for bypassing taskmgr block64.exe Token: SeSecurityPrivilege 1504 use for bypassing taskmgr block64.exe Token: SeLoadDriverPrivilege 1504 use for bypassing taskmgr block64.exe Token: SeShutdownPrivilege 1504 use for bypassing taskmgr block64.exe Token: SeShutdownPrivilege 1504 use for bypassing taskmgr block64.exe Token: SeDebugPrivilege 1504 use for bypassing taskmgr block64.exe Token: SeImpersonatePrivilege 1504 use for bypassing taskmgr block64.exe Token: SeSecurityPrivilege 1504 use for bypassing taskmgr block64.exe Token: SeDebugPrivilege 1504 use for bypassing taskmgr block64.exe Token: SeBackupPrivilege 1504 use for bypassing taskmgr block64.exe Token: SeRestorePrivilege 1504 use for bypassing taskmgr block64.exe Token: SeDebugPrivilege 1504 use for bypassing taskmgr block64.exe -
Suspicious use of FindShellTrayWindow 27 IoCs
pid Process 1504 use for bypassing taskmgr block64.exe 1504 use for bypassing taskmgr block64.exe 1504 use for bypassing taskmgr block64.exe 1504 use for bypassing taskmgr block64.exe 1504 use for bypassing taskmgr block64.exe 1504 use for bypassing taskmgr block64.exe 1504 use for bypassing taskmgr block64.exe 1504 use for bypassing taskmgr block64.exe 1504 use for bypassing taskmgr block64.exe 1504 use for bypassing taskmgr block64.exe 1504 use for bypassing taskmgr block64.exe 1504 use for bypassing taskmgr block64.exe 1504 use for bypassing taskmgr block64.exe 1504 use for bypassing taskmgr block64.exe 1504 use for bypassing taskmgr block64.exe 1504 use for bypassing taskmgr block64.exe 1504 use for bypassing taskmgr block64.exe 1504 use for bypassing taskmgr block64.exe 1504 use for bypassing taskmgr block64.exe 1504 use for bypassing taskmgr block64.exe 1504 use for bypassing taskmgr block64.exe 1504 use for bypassing taskmgr block64.exe 1504 use for bypassing taskmgr block64.exe 1504 use for bypassing taskmgr block64.exe 1504 use for bypassing taskmgr block64.exe 1504 use for bypassing taskmgr block64.exe 1504 use for bypassing taskmgr block64.exe -
Suspicious use of SendNotifyMessage 27 IoCs
pid Process 1504 use for bypassing taskmgr block64.exe 1504 use for bypassing taskmgr block64.exe 1504 use for bypassing taskmgr block64.exe 1504 use for bypassing taskmgr block64.exe 1504 use for bypassing taskmgr block64.exe 1504 use for bypassing taskmgr block64.exe 1504 use for bypassing taskmgr block64.exe 1504 use for bypassing taskmgr block64.exe 1504 use for bypassing taskmgr block64.exe 1504 use for bypassing taskmgr block64.exe 1504 use for bypassing taskmgr block64.exe 1504 use for bypassing taskmgr block64.exe 1504 use for bypassing taskmgr block64.exe 1504 use for bypassing taskmgr block64.exe 1504 use for bypassing taskmgr block64.exe 1504 use for bypassing taskmgr block64.exe 1504 use for bypassing taskmgr block64.exe 1504 use for bypassing taskmgr block64.exe 1504 use for bypassing taskmgr block64.exe 1504 use for bypassing taskmgr block64.exe 1504 use for bypassing taskmgr block64.exe 1504 use for bypassing taskmgr block64.exe 1504 use for bypassing taskmgr block64.exe 1504 use for bypassing taskmgr block64.exe 1504 use for bypassing taskmgr block64.exe 1504 use for bypassing taskmgr block64.exe 1504 use for bypassing taskmgr block64.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2340 wrote to memory of 1504 2340 use for bypassing taskmgr block.exe 31 PID 2340 wrote to memory of 1504 2340 use for bypassing taskmgr block.exe 31 PID 2340 wrote to memory of 1504 2340 use for bypassing taskmgr block.exe 31 PID 2340 wrote to memory of 1504 2340 use for bypassing taskmgr block.exe 31 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\use for bypassing taskmgr block.exe"C:\Users\Admin\AppData\Local\Temp\use for bypassing taskmgr block.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2340 -
C:\Users\Admin\AppData\Local\Temp\use for bypassing taskmgr block64.exe"C:\Users\Admin\AppData\Local\Temp\use for bypassing taskmgr block.exe"2⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Executes dropped EXE
- Enumerates connected drives
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1504
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Modify Registry
2Subvert Trust Controls
1Install Root Certificate
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
2.3MB
MD5dfeea73e421c76deb18d5ca0800dccf2
SHA10497eba0b24d0f4500faad5ae96dbebab9c64608
SHA2568158dc0569972c10056f507cf9e72f4946600ce163c4c659a610480585cd4935
SHA51223ddc9f28314d4cf3b05d88b9e0b6fd69f9804f5e9c3f7703258ff2c5786721061321379fde53e21048d3c7cce1ff71e2872d48dcc580d059397fa0692335630