Overview
overview
10Static
static
830bc4934d7...f0.exe
windows10-2004-x64
6338fdf3626...13.exe
windows10-2004-x64
1342933cb4c...20.exe
windows10-2004-x64
9343ace5874...03.exe
windows10-2004-x64
834818CE171...49.dll
windows10-2004-x64
8360390_crypt.exe
windows10-2004-x64
3360390_tree.cmd
windows10-2004-x64
73896f8a370...e_.exe
windows10-2004-x64
73a061ee07d...8c.dll
windows10-2004-x64
33af4fa2bff...d1.dll
windows10-2004-x64
33bb691982d...21.exe
windows10-2004-x64
93e3f980ab6...95.exe
windows10-2004-x64
73e3f980ab6...26.exe
windows10-2004-x64
33e75e8238a..._2.exe
windows10-2004-x64
6400cad56ff...9a.exe
windows10-2004-x64
940b3cb2a21...0c.exe
windows10-2004-x64
9425c42d610...5F.exe
windows10-2004-x64
10425c42d610...FF.exe
windows10-2004-x64
342d77128db...e7.exe
windows10-2004-x64
74561647.exe
windows10-2004-x64
9457C9141EC...C8.exe
windows10-2004-x64
1046a9660c57...83.exe
windows10-2004-x64
746ca6b1972...FB.exe
windows10-2004-x64
746ca6b1972...FC.exe
windows10-2004-x64
34e60f3c8ea...5b.exe
windows10-2004-x64
84f0b660543...B3.exe
windows10-2004-x64
104f0b660543...BB.exe
windows10-2004-x64
34f5bff6416...09.exe
windows10-2004-x64
7Versamento...__.exe
windows10-2004-x64
4fda5e7e8e...00.exe
windows10-2004-x64
75 Rules for Snort.doc
windows10-2004-x64
1502de64ee4...c2.exe
windows10-2004-x64
9Analysis
-
max time kernel
424s -
max time network
435s -
platform
windows10-2004_x64 -
resource
win10v2004-20250314-en -
resource tags
arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system -
submitted
24/03/2025, 22:22
Behavioral task
behavioral1
Sample
30bc4934d7e29c8c4c4c9be0510fc7558fddf8db666a0343784c5cf1587b3af0.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral2
Sample
338fdf3626aa4a48a5972f291aacf3d6172dd920fe16ac4da4dd6c5b999d2f13.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
342933cb4cbb31a2c30ac1733afc318a6e5cd0226160a59197686d635ec71b20.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral4
Sample
343ace5874a5854858e11e6c196007bffc045717ed29db9b03f23d01568e8303.exe
Resource
win10v2004-20250313-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
34818CE171EA150B91429AC1DD6FBE49.dll
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral6
Sample
360390_crypt.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
360390_tree.cmd
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral8
Sample
3896f8a37034429e9784d767765d85ef6dcde105320568516fac4e31400514db.exe_.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
3a061ee07d87a6bb13e613e000e9f685cbffb96bd7024a9e7b4cb0be9a4af38c.dll
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral10
Sample
3af4fa2bffaab37fd557ae8146ae0a29ba0faf6d99ad8a1a8d5bf598ac9a23d1.dll
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
3bb691982de416a7a4e57b91211e80bea82dcca7b4bdbf25c0c80451dc138421.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral12
Sample
3e3f980ab668ccde6aafee60ce16e3c35cd91e9b59bff20ce1615d5fb362a458_Dumped_TDS=4FBA3695.exe
Resource
win10v2004-20250313-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
3e3f980ab668ccde6aafee60ce16e3c35cd91e9b59bff20ce1615d5fb362a458_TDS=4FBADA26.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral14
Sample
3e75e8238a6bbd8817164658696198af_72889f61171de37d6b4d59016c55ec52__2.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
400cad56ff3d210346cf6c4795aeb607e5b211b3dc4a8421b9437621c254239a.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral16
Sample
40b3cb2a210fafdaabdebefe1430862bd1192a80fcde84f51ceb387136d1410c.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
425c42d6108db6b6b5cbda7a5417b5f55225c47ac588f5f0a293c2b07a78d14b_Dumped_TDS=4F8C315F.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral18
Sample
425c42d6108db6b6b5cbda7a5417b5f55225c47ac588f5f0a293c2b07a78d14b_TDS=4F9906FF.exe
Resource
win10v2004-20250313-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
42d77128db6bea33966478f01aecda1cf6c17bf9ab5d5782650c1b32cd63bae7.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral20
Sample
4561647.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
457C9141ECDD9E9CFC61551FEA2BCB86AFF56CC8.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral22
Sample
46a9660c57e244636a28df62e0879300a62552ab9b5cfd4708ff677af7453883.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
46ca6b1972c81eab77202146184afe95b797bd4e3788c59e8036e748b55fc28c_Dumped_TDS=4FB252FB.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral24
Sample
46ca6b1972c81eab77202146184afe95b797bd4e3788c59e8036e748b55fc28c_TDS=4FB566FC.exe
Resource
win10v2004-20250313-en
windows10-2004-x64
Behavioral task
behavioral25
Sample
4e60f3c8eaa0441d4ffdced18aa04153bb91b5470bc5441ba5878f7760ca9b5b.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral26
Sample
4f0b6605434c1355b10950024eaa9f695822278f57c29275706c0e5b29b369b0_Dumped_TDS=4F9911B3.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral27
Sample
4f0b6605434c1355b10950024eaa9f695822278f57c29275706c0e5b29b369b0_TDS=4FA6FBBB.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral28
Sample
4f5bff64160044d9a769ab277ff85ba954e2a2e182c6da4d0672790cf1d48309.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral29
Sample
Versamento.Pdf______________________________________________________________.exe
Resource
win10v2004-20250313-en
windows10-2004-x64
Behavioral task
behavioral30
Sample
4fda5e7e8e682870e993f97ad26ba6b2.000.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral31
Sample
5 Rules for Snort.doc
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral32
Sample
502de64ee4fe0133a1ea5efa4919c03bbca1adc2.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
General
-
Target
4561647.exe
-
Size
7KB
-
MD5
ebbc82f619471384f392efd5c4d05883
-
SHA1
17d91b45c8615d0f09d1100d2be396cbcba21fde
-
SHA256
e972af26d5261da3daa1e12e11f357e1e4ce19cd43997f6b7a925a5b9cc8614c
-
SHA512
3e33bd22c440e9ab4a065d216467c1220780aa2a39a38ea4aec81d050d3e6048e87244341fbeac2cdefebae9fe987b713e0d4fcf34adf1390b5ccda6dd448241
-
SSDEEP
96:uP/EuJO5ER8KDGrru1M2mIspl5SgOj9/xVKzAQTH1osaxnkK:unE5ORTD91M2mIGyxhp2AQRONkK
Malware Config
Signatures
-
Renames multiple (1679) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-805952410-2104024357-1716932545-1000\Control Panel\International\Geo\Nation 4561647.exe -
Deletes itself 1 IoCs
pid Process 4956 WScript.exe -
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\T: 4561647.exe File opened (read-only) \??\Y: 4561647.exe File opened (read-only) \??\I: 4561647.exe File opened (read-only) \??\M: 4561647.exe File opened (read-only) \??\P: 4561647.exe File opened (read-only) \??\W: 4561647.exe File opened (read-only) \??\G: 4561647.exe File opened (read-only) \??\Q: 4561647.exe File opened (read-only) \??\R: 4561647.exe File opened (read-only) \??\U: 4561647.exe File opened (read-only) \??\V: 4561647.exe File opened (read-only) \??\J: 4561647.exe File opened (read-only) \??\N: 4561647.exe File opened (read-only) \??\S: 4561647.exe File opened (read-only) \??\X: 4561647.exe File opened (read-only) \??\Z: 4561647.exe File opened (read-only) \??\E: 4561647.exe File opened (read-only) \??\H: 4561647.exe File opened (read-only) \??\K: 4561647.exe File opened (read-only) \??\L: 4561647.exe File opened (read-only) \??\O: 4561647.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\nb-no\!_READ_ME_!.txt 4561647.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\!_READ_ME_!.txt 4561647.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\fr-fr\ui-strings.js._CRYPT 4561647.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\ca-es\ui-strings.js._CRYPT 4561647.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Locales\fil.pak._CRYPT 4561647.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\es-es\!_READ_ME_!.txt 4561647.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\!_READ_ME_!.txt 4561647.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\sv-se\ui-strings.js._CRYPT 4561647.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\ko-kr\ui-strings.js._CRYPT 4561647.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\cs-cz\ui-strings.js._CRYPT 4561647.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\eu-es\ui-strings.js._CRYPT 4561647.exe File created C:\Program Files (x86)\Windows Media Player\Media Renderer\RenderingControl_DMP.xml._CRYPT 4561647.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\ca-es\!_READ_ME_!.txt 4561647.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\Locales\en-US.pak._CRYPT 4561647.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.69\Locales\mi.pak._CRYPT 4561647.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\cs-cz\!_READ_ME_!.txt 4561647.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\root\!_READ_ME_!.txt 4561647.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\es-es\!_READ_ME_!.txt 4561647.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\es-es\!_READ_ME_!.txt 4561647.exe File created C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_CA\!_READ_ME_!.txt 4561647.exe File created C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_GB\affDescription.txt._CRYPT 4561647.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\Locales\kn.pak._CRYPT 4561647.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Locales\vi.pak._CRYPT 4561647.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\it-it\ui-strings.js._CRYPT 4561647.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ro-ro\ui-strings.js._CRYPT 4561647.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\pt-br\ui-strings.js._CRYPT 4561647.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\hu-hu\ui-strings.js._CRYPT 4561647.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\!_READ_ME_!.txt 4561647.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\es-es\ui-strings.js._CRYPT 4561647.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\zh-cn\ui-strings.js._CRYPT 4561647.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\en-ae\!_READ_ME_!.txt 4561647.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\sk-sk\ui-strings.js._CRYPT 4561647.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.69\Locales\is.pak._CRYPT 4561647.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\it-it\!_READ_ME_!.txt 4561647.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\eu-es\!_READ_ME_!.txt 4561647.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\win\CP1250.TXT._CRYPT 4561647.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\nb-no\!_READ_ME_!.txt 4561647.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\cs-cz\!_READ_ME_!.txt 4561647.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\ko-kr\!_READ_ME_!.txt 4561647.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\nl-nl\!_READ_ME_!.txt 4561647.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\zh-cn\!_READ_ME_!.txt 4561647.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\fr-ma\!_READ_ME_!.txt 4561647.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\zh-tw\ui-strings.js._CRYPT 4561647.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\hu-hu\ui-strings.js._CRYPT 4561647.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\nb-no\!_READ_ME_!.txt 4561647.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\en-gb\!_READ_ME_!.txt 4561647.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\fr-fr\!_READ_ME_!.txt 4561647.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Locales\az.pak._CRYPT 4561647.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.69\Locales\ur.pak._CRYPT 4561647.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\en-il\ui-strings.js._CRYPT 4561647.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\es-es\ui-strings.js._CRYPT 4561647.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\fr-ma\ui-strings.js._CRYPT 4561647.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Locales\fi.pak._CRYPT 4561647.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\fr-ma\ui-strings.js._CRYPT 4561647.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\root\!_READ_ME_!.txt 4561647.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\ca-es\ui-strings.js._CRYPT 4561647.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\pt-br\ui-strings.js._CRYPT 4561647.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\en-il\ui-strings.js._CRYPT 4561647.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\!_READ_ME_!.txt 4561647.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\ui-strings.js._CRYPT 4561647.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\sl-sl\!_READ_ME_!.txt 4561647.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\fr-fr\!_READ_ME_!.txt 4561647.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\hr-hr\ui-strings.js._CRYPT 4561647.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\da-dk\ui-strings.js._CRYPT 4561647.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4561647.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-805952410-2104024357-1716932545-1000_Classes\Local Settings 4561647.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1960 wrote to memory of 4956 1960 4561647.exe 98 PID 1960 wrote to memory of 4956 1960 4561647.exe 98 PID 1960 wrote to memory of 4956 1960 4561647.exe 98
Processes
-
C:\Users\Admin\AppData\Local\Temp\4561647.exe"C:\Users\Admin\AppData\Local\Temp\4561647.exe"1⤵
- Checks computer location settings
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1960 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4561647.vbs"2⤵
- Deletes itself
- System Location Discovery: System Language Discovery
PID:4956
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
502B
MD5b0952e65955eaeca0064f1a368acb216
SHA15b5074c950a480fcb920b8f3ff108cfcdeaec639
SHA256e1263206f1524bac3c87a1ad532780dc326415cfd01ee03e9775ff433e57ad4f
SHA5127610fa182d0ddf8879ae3178dc099be53cf5648ad3eb7f8acaef178ea1ccfa5f74bd8afe9a8a6b9066737f9faff2230d4e402017a197fcf7e51151cf6c64b3a6
-
Filesize
373B
MD59266e359efa382b829dd86da49d0e7e8
SHA1bb8556218ea57ed70329f6dbda2c1888c9721a09
SHA25633c495267c6443a04590300b55a1eb1499999fecc7e0f511218dfa7b08ea7979
SHA5127c9de391a3800a169b024c863cdd01f71f9deb4b5edecf849408882c5fe5c3141b856ed3d30117d2b3ac202e012e689c15514a9e24b09a5f6f1c3429bc20239a