Analysis
-
max time kernel
22s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20250314-en -
resource tags
arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system -
submitted
28/03/2025, 09:16
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
f53f84ac24e0ae43cd5b59a0e031d6423f8dce2400d21e0d59ea5511b57f256f.exe
Resource
win7-20241010-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
f53f84ac24e0ae43cd5b59a0e031d6423f8dce2400d21e0d59ea5511b57f256f.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
f53f84ac24e0ae43cd5b59a0e031d6423f8dce2400d21e0d59ea5511b57f256f.exe
-
Size
60KB
-
MD5
dfac83994c43a8cba786c678f383e8f3
-
SHA1
e809a61e0288fd77c3bbf43f55064fd2041f1df0
-
SHA256
f53f84ac24e0ae43cd5b59a0e031d6423f8dce2400d21e0d59ea5511b57f256f
-
SHA512
750831e315d847ba49985908ec1ebca591e3deb93396731199e03a0091f438d65be46b1876603e23d2a6622ff12e61d65d36d3e16c739258d5c36f8a36cc7031
-
SSDEEP
768:b8KivX+gIMiYzTBO6d3tG4t29U4mvn+KxXWgQUfhNu5NhmncHhs50Z1Iw6Wx:bhivX0MDzTQmtG4tSd6+f+hgnh0p+Z5
Score
7/10
Malware Config
Signatures
-
Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
-
Deletes itself 1 IoCs
pid Process 1184 f53f84ac24e0ae43cd5b59a0e031d6423f8dce2400d21e0d59ea5511b57f256f.exe -
Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\V: f53f84ac24e0ae43cd5b59a0e031d6423f8dce2400d21e0d59ea5511b57f256f.exe File opened (read-only) \??\Y: f53f84ac24e0ae43cd5b59a0e031d6423f8dce2400d21e0d59ea5511b57f256f.exe File opened (read-only) \??\O: f53f84ac24e0ae43cd5b59a0e031d6423f8dce2400d21e0d59ea5511b57f256f.exe File opened (read-only) \??\F: f53f84ac24e0ae43cd5b59a0e031d6423f8dce2400d21e0d59ea5511b57f256f.exe File opened (read-only) \??\A: f53f84ac24e0ae43cd5b59a0e031d6423f8dce2400d21e0d59ea5511b57f256f.exe File opened (read-only) \??\J: f53f84ac24e0ae43cd5b59a0e031d6423f8dce2400d21e0d59ea5511b57f256f.exe File opened (read-only) \??\K: f53f84ac24e0ae43cd5b59a0e031d6423f8dce2400d21e0d59ea5511b57f256f.exe File opened (read-only) \??\Z: f53f84ac24e0ae43cd5b59a0e031d6423f8dce2400d21e0d59ea5511b57f256f.exe File opened (read-only) \??\N: f53f84ac24e0ae43cd5b59a0e031d6423f8dce2400d21e0d59ea5511b57f256f.exe File opened (read-only) \??\U: f53f84ac24e0ae43cd5b59a0e031d6423f8dce2400d21e0d59ea5511b57f256f.exe File opened (read-only) \??\P: f53f84ac24e0ae43cd5b59a0e031d6423f8dce2400d21e0d59ea5511b57f256f.exe File opened (read-only) \??\S: f53f84ac24e0ae43cd5b59a0e031d6423f8dce2400d21e0d59ea5511b57f256f.exe File opened (read-only) \??\G: f53f84ac24e0ae43cd5b59a0e031d6423f8dce2400d21e0d59ea5511b57f256f.exe File opened (read-only) \??\B: f53f84ac24e0ae43cd5b59a0e031d6423f8dce2400d21e0d59ea5511b57f256f.exe File opened (read-only) \??\M: f53f84ac24e0ae43cd5b59a0e031d6423f8dce2400d21e0d59ea5511b57f256f.exe File opened (read-only) \??\D: f53f84ac24e0ae43cd5b59a0e031d6423f8dce2400d21e0d59ea5511b57f256f.exe File opened (read-only) \??\E: f53f84ac24e0ae43cd5b59a0e031d6423f8dce2400d21e0d59ea5511b57f256f.exe File opened (read-only) \??\T: f53f84ac24e0ae43cd5b59a0e031d6423f8dce2400d21e0d59ea5511b57f256f.exe File opened (read-only) \??\I: f53f84ac24e0ae43cd5b59a0e031d6423f8dce2400d21e0d59ea5511b57f256f.exe File opened (read-only) \??\H: f53f84ac24e0ae43cd5b59a0e031d6423f8dce2400d21e0d59ea5511b57f256f.exe File opened (read-only) \??\L: f53f84ac24e0ae43cd5b59a0e031d6423f8dce2400d21e0d59ea5511b57f256f.exe File opened (read-only) \??\X: f53f84ac24e0ae43cd5b59a0e031d6423f8dce2400d21e0d59ea5511b57f256f.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jre-1.8\lib\javaws.jar.2f2d015d5765 f53f84ac24e0ae43cd5b59a0e031d6423f8dce2400d21e0d59ea5511b57f256f.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectProMSDNR_Retail-ul-phn.xrm-ms.cb0ec6bbb903 f53f84ac24e0ae43cd5b59a0e031d6423f8dce2400d21e0d59ea5511b57f256f.exe File created C:\Program Files\Common Files\microsoft shared\ink\da-DK\Restore-My-Files.txt f53f84ac24e0ae43cd5b59a0e031d6423f8dce2400d21e0d59ea5511b57f256f.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\Restore-My-Files.txt f53f84ac24e0ae43cd5b59a0e031d6423f8dce2400d21e0d59ea5511b57f256f.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.69\Locales\kk.pak.cbb078e7e91f f53f84ac24e0ae43cd5b59a0e031d6423f8dce2400d21e0d59ea5511b57f256f.exe File opened for modification C:\Program Files\Java\jdk-1.8\lib\orb.idl.2f7e52bfb5e7 f53f84ac24e0ae43cd5b59a0e031d6423f8dce2400d21e0d59ea5511b57f256f.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019VL_MAK_AE-ul-phn.xrm-ms.e25abbb2806a f53f84ac24e0ae43cd5b59a0e031d6423f8dce2400d21e0d59ea5511b57f256f.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_PrepidBypass-ppd.xrm-ms.c2a061eee036 f53f84ac24e0ae43cd5b59a0e031d6423f8dce2400d21e0d59ea5511b57f256f.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Retail-pl.xrm-ms.c38e4eb3a10b f53f84ac24e0ae43cd5b59a0e031d6423f8dce2400d21e0d59ea5511b57f256f.exe File opened for modification C:\Program Files\Mozilla Firefox\browser\VisualElements\PrivateBrowsing_150.png.80af2c343ecc f53f84ac24e0ae43cd5b59a0e031d6423f8dce2400d21e0d59ea5511b57f256f.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\C2RManifest.proofing.msi.16.en-us.xml.a38a2ad3c1ab f53f84ac24e0ae43cd5b59a0e031d6423f8dce2400d21e0d59ea5511b57f256f.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Retail-ppd.xrm-ms.f27f8e62703a f53f84ac24e0ae43cd5b59a0e031d6423f8dce2400d21e0d59ea5511b57f256f.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Retail-ul-oob.xrm-ms.e16d8f979d2f f53f84ac24e0ae43cd5b59a0e031d6423f8dce2400d21e0d59ea5511b57f256f.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_OEM_Perp-ul-phn.xrm-ms.8cbf302012c8 f53f84ac24e0ae43cd5b59a0e031d6423f8dce2400d21e0d59ea5511b57f256f.exe File opened for modification C:\Program Files\Java\jdk-1.8\legal\jdk\santuario.md.ddf92753411b f53f84ac24e0ae43cd5b59a0e031d6423f8dce2400d21e0d59ea5511b57f256f.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\Restore-My-Files.txt f53f84ac24e0ae43cd5b59a0e031d6423f8dce2400d21e0d59ea5511b57f256f.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\is\LC_MESSAGES\vlc.mo.a0ef4c545e6c f53f84ac24e0ae43cd5b59a0e031d6423f8dce2400d21e0d59ea5511b57f256f.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Restore-My-Files.txt f53f84ac24e0ae43cd5b59a0e031d6423f8dce2400d21e0d59ea5511b57f256f.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MEDIA\DRUMROLL.WAV.e7e501958f5d f53f84ac24e0ae43cd5b59a0e031d6423f8dce2400d21e0d59ea5511b57f256f.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\StorageConnectors.api.64d9be3806f0 f53f84ac24e0ae43cd5b59a0e031d6423f8dce2400d21e0d59ea5511b57f256f.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_SubTest-ul-oob.xrm-ms.e641a48a8452 f53f84ac24e0ae43cd5b59a0e031d6423f8dce2400d21e0d59ea5511b57f256f.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_MAK-pl.xrm-ms.e0a1428c82d4 f53f84ac24e0ae43cd5b59a0e031d6423f8dce2400d21e0d59ea5511b57f256f.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.contrast-black_scale-100.png.68056e0c0a64 f53f84ac24e0ae43cd5b59a0e031d6423f8dce2400d21e0d59ea5511b57f256f.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Fonts\private\LHANDW.TTF.26f3d6cec4f6 f53f84ac24e0ae43cd5b59a0e031d6423f8dce2400d21e0d59ea5511b57f256f.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_OEM_Perp-ul-oob.xrm-ms.87a82c3b25f3 f53f84ac24e0ae43cd5b59a0e031d6423f8dce2400d21e0d59ea5511b57f256f.exe File created C:\Program Files\VideoLAN\VLC\plugins\video_output\Restore-My-Files.txt f53f84ac24e0ae43cd5b59a0e031d6423f8dce2400d21e0d59ea5511b57f256f.exe File created C:\Program Files\VideoLAN\VLC\lua\Restore-My-Files.txt f53f84ac24e0ae43cd5b59a0e031d6423f8dce2400d21e0d59ea5511b57f256f.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlusVL_MAK-ul-oob.xrm-ms.be0db0d2e49a f53f84ac24e0ae43cd5b59a0e031d6423f8dce2400d21e0d59ea5511b57f256f.exe File created C:\Program Files (x86)\Common Files\System\ja-JP\Restore-My-Files.txt f53f84ac24e0ae43cd5b59a0e031d6423f8dce2400d21e0d59ea5511b57f256f.exe File opened for modification C:\Program Files\Microsoft Office\root\vreg\proof.en-us.msi.16.en-us.vreg.dat.9f7ce013055b f53f84ac24e0ae43cd5b59a0e031d6423f8dce2400d21e0d59ea5511b57f256f.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\classlist.15796f8b89e3 f53f84ac24e0ae43cd5b59a0e031d6423f8dce2400d21e0d59ea5511b57f256f.exe File opened for modification C:\Program Files\Java\jdk-1.8\legal\javafx\webkit.md.9da6383103e9 f53f84ac24e0ae43cd5b59a0e031d6423f8dce2400d21e0d59ea5511b57f256f.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\SETLANG.HXS.e905ef8f95e7 f53f84ac24e0ae43cd5b59a0e031d6423f8dce2400d21e0d59ea5511b57f256f.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail-pl.xrm-ms.7c8bf4102258 f53f84ac24e0ae43cd5b59a0e031d6423f8dce2400d21e0d59ea5511b57f256f.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\WINWORD_K_COL.HXK.64d2b5080af0 f53f84ac24e0ae43cd5b59a0e031d6423f8dce2400d21e0d59ea5511b57f256f.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\jfr\Restore-My-Files.txt f53f84ac24e0ae43cd5b59a0e031d6423f8dce2400d21e0d59ea5511b57f256f.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\currency.data.a2cb6a5240aa f53f84ac24e0ae43cd5b59a0e031d6423f8dce2400d21e0d59ea5511b57f256f.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\MondoVL_KMS_Client-ppd.xrm-ms.1c8798708228 f53f84ac24e0ae43cd5b59a0e031d6423f8dce2400d21e0d59ea5511b57f256f.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusEDUR_SubTrial-ul-oob.xrm-ms.9395050113a9 f53f84ac24e0ae43cd5b59a0e031d6423f8dce2400d21e0d59ea5511b57f256f.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\TURABIAN.XSL.852dab3b39f3 f53f84ac24e0ae43cd5b59a0e031d6423f8dce2400d21e0d59ea5511b57f256f.exe File opened for modification C:\Program Files\Internet Explorer\es-ES\ieinstal.exe.mui.3bdfe7e9e731 f53f84ac24e0ae43cd5b59a0e031d6423f8dce2400d21e0d59ea5511b57f256f.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_OEM_Perp-pl.xrm-ms.50d88bccd2e4 f53f84ac24e0ae43cd5b59a0e031d6423f8dce2400d21e0d59ea5511b57f256f.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\WordR_OEM_Perp-pl.xrm-ms.4890db242a9c f53f84ac24e0ae43cd5b59a0e031d6423f8dce2400d21e0d59ea5511b57f256f.exe File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Consolas-Verdana.xml.1c5c439086d8 f53f84ac24e0ae43cd5b59a0e031d6423f8dce2400d21e0d59ea5511b57f256f.exe File opened for modification C:\Program Files\7-Zip\Lang\tk.txt.aa339acac8e2 f53f84ac24e0ae43cd5b59a0e031d6423f8dce2400d21e0d59ea5511b57f256f.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Retail-pl.xrm-ms.3e437ed6dc0e f53f84ac24e0ae43cd5b59a0e031d6423f8dce2400d21e0d59ea5511b57f256f.exe File opened for modification C:\Program Files\Common Files\System\msadc\it-IT\msadcer.dll.mui.9e128f161cae f53f84ac24e0ae43cd5b59a0e031d6423f8dce2400d21e0d59ea5511b57f256f.exe File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Calibri-Cambria.xml.fe25d892e4ca f53f84ac24e0ae43cd5b59a0e031d6423f8dce2400d21e0d59ea5511b57f256f.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Grace-ppd.xrm-ms.8445c2686eb0 f53f84ac24e0ae43cd5b59a0e031d6423f8dce2400d21e0d59ea5511b57f256f.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019MSDNR_Retail-ul-phn.xrm-ms.07686cbba5f3 f53f84ac24e0ae43cd5b59a0e031d6423f8dce2400d21e0d59ea5511b57f256f.exe File opened for modification C:\Program Files\Java\jre-1.8\legal\jdk\xalan.md.2d4668c1d319 f53f84ac24e0ae43cd5b59a0e031d6423f8dce2400d21e0d59ea5511b57f256f.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.69\Locales\mk.pak.df7ea24f4517 f53f84ac24e0ae43cd5b59a0e031d6423f8dce2400d21e0d59ea5511b57f256f.exe File opened for modification C:\Program Files\Google\Chrome\Application\133.0.6943.60\Locales\fr.pak.e744a08b8d53 f53f84ac24e0ae43cd5b59a0e031d6423f8dce2400d21e0d59ea5511b57f256f.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalPipcR_OEM_Perp-ul-phn.xrm-ms.847ff8181a50 f53f84ac24e0ae43cd5b59a0e031d6423f8dce2400d21e0d59ea5511b57f256f.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.contrast-black_scale-80.png.31aa98ad5705 f53f84ac24e0ae43cd5b59a0e031d6423f8dce2400d21e0d59ea5511b57f256f.exe File created C:\Program Files\VideoLAN\VLC\locale\nl\Restore-My-Files.txt f53f84ac24e0ae43cd5b59a0e031d6423f8dce2400d21e0d59ea5511b57f256f.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Locales\ur.pak.38b982b4aa7c f53f84ac24e0ae43cd5b59a0e031d6423f8dce2400d21e0d59ea5511b57f256f.exe File created C:\Program Files\Microsoft Office\root\Office16\Library\Analysis\Restore-My-Files.txt f53f84ac24e0ae43cd5b59a0e031d6423f8dce2400d21e0d59ea5511b57f256f.exe File created C:\Program Files\VideoLAN\VLC\locale\mai\LC_MESSAGES\Restore-My-Files.txt f53f84ac24e0ae43cd5b59a0e031d6423f8dce2400d21e0d59ea5511b57f256f.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Retail-pl.xrm-ms.aa78d146386e f53f84ac24e0ae43cd5b59a0e031d6423f8dce2400d21e0d59ea5511b57f256f.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Trial-pl.xrm-ms.5e9ac7564c9e f53f84ac24e0ae43cd5b59a0e031d6423f8dce2400d21e0d59ea5511b57f256f.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp3-ppd.xrm-ms.a370d04f4177 f53f84ac24e0ae43cd5b59a0e031d6423f8dce2400d21e0d59ea5511b57f256f.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.43\EdgeUpdate.dat.6f244803155b f53f84ac24e0ae43cd5b59a0e031d6423f8dce2400d21e0d59ea5511b57f256f.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Grace-ul-oob.xrm-ms.2186a4554f1d f53f84ac24e0ae43cd5b59a0e031d6423f8dce2400d21e0d59ea5511b57f256f.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f53f84ac24e0ae43cd5b59a0e031d6423f8dce2400d21e0d59ea5511b57f256f.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 1184 f53f84ac24e0ae43cd5b59a0e031d6423f8dce2400d21e0d59ea5511b57f256f.exe -
Suspicious use of AdjustPrivilegeToken 46 IoCs
description pid Process Token: SeDebugPrivilege 1184 f53f84ac24e0ae43cd5b59a0e031d6423f8dce2400d21e0d59ea5511b57f256f.exe Token: SeBackupPrivilege 1380 vssvc.exe Token: SeRestorePrivilege 1380 vssvc.exe Token: SeAuditPrivilege 1380 vssvc.exe Token: SeIncreaseQuotaPrivilege 4948 WMIC.exe Token: SeSecurityPrivilege 4948 WMIC.exe Token: SeTakeOwnershipPrivilege 4948 WMIC.exe Token: SeLoadDriverPrivilege 4948 WMIC.exe Token: SeSystemProfilePrivilege 4948 WMIC.exe Token: SeSystemtimePrivilege 4948 WMIC.exe Token: SeProfSingleProcessPrivilege 4948 WMIC.exe Token: SeIncBasePriorityPrivilege 4948 WMIC.exe Token: SeCreatePagefilePrivilege 4948 WMIC.exe Token: SeBackupPrivilege 4948 WMIC.exe Token: SeRestorePrivilege 4948 WMIC.exe Token: SeShutdownPrivilege 4948 WMIC.exe Token: SeDebugPrivilege 4948 WMIC.exe Token: SeSystemEnvironmentPrivilege 4948 WMIC.exe Token: SeRemoteShutdownPrivilege 4948 WMIC.exe Token: SeUndockPrivilege 4948 WMIC.exe Token: SeManageVolumePrivilege 4948 WMIC.exe Token: 33 4948 WMIC.exe Token: 34 4948 WMIC.exe Token: 35 4948 WMIC.exe Token: 36 4948 WMIC.exe Token: SeIncreaseQuotaPrivilege 4948 WMIC.exe Token: SeSecurityPrivilege 4948 WMIC.exe Token: SeTakeOwnershipPrivilege 4948 WMIC.exe Token: SeLoadDriverPrivilege 4948 WMIC.exe Token: SeSystemProfilePrivilege 4948 WMIC.exe Token: SeSystemtimePrivilege 4948 WMIC.exe Token: SeProfSingleProcessPrivilege 4948 WMIC.exe Token: SeIncBasePriorityPrivilege 4948 WMIC.exe Token: SeCreatePagefilePrivilege 4948 WMIC.exe Token: SeBackupPrivilege 4948 WMIC.exe Token: SeRestorePrivilege 4948 WMIC.exe Token: SeShutdownPrivilege 4948 WMIC.exe Token: SeDebugPrivilege 4948 WMIC.exe Token: SeSystemEnvironmentPrivilege 4948 WMIC.exe Token: SeRemoteShutdownPrivilege 4948 WMIC.exe Token: SeUndockPrivilege 4948 WMIC.exe Token: SeManageVolumePrivilege 4948 WMIC.exe Token: 33 4948 WMIC.exe Token: 34 4948 WMIC.exe Token: 35 4948 WMIC.exe Token: 36 4948 WMIC.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1184 wrote to memory of 5032 1184 f53f84ac24e0ae43cd5b59a0e031d6423f8dce2400d21e0d59ea5511b57f256f.exe 92 PID 1184 wrote to memory of 5032 1184 f53f84ac24e0ae43cd5b59a0e031d6423f8dce2400d21e0d59ea5511b57f256f.exe 92 PID 5032 wrote to memory of 4948 5032 cmd.exe 94 PID 5032 wrote to memory of 4948 5032 cmd.exe 94 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\f53f84ac24e0ae43cd5b59a0e031d6423f8dce2400d21e0d59ea5511b57f256f.exe"C:\Users\Admin\AppData\Local\Temp\f53f84ac24e0ae43cd5b59a0e031d6423f8dce2400d21e0d59ea5511b57f256f.exe"1⤵
- Deletes itself
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1184 -
C:\Windows\SYSTEM32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{F3901E1E-EF65-4703-B123-FE6E411FD552}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:5032 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{F3901E1E-EF65-4703-B123-FE6E411FD552}'" delete3⤵
- Suspicious use of AdjustPrivilegeToken
PID:4948
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1380
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\ResiliencyLinks\WidevineCdm\_platform_specific\win_x64\widevinecdm.dll.sig.DATA.735e2e2331fb
Filesize1KB
MD56309bb7d16937a94be986d5995de0ba1
SHA128856c06d1ef4ee9c790d95d30adbd0d09567a1a
SHA2564ccb123510113921f3292f84cf027fe4c85cb0ec55a175bb9796dccee84696d2
SHA51203b058272b352217b6c018d091dcf3b5fd83f9072a823335ca8d669293389a334a19293abff8c638f67f34f395ca483a979bbfec19ee88deb0e97cc6050ebafe
-
Filesize
6KB
MD584ca17a0259396d7c74382234f55f4e0
SHA1b5a764178ce87efe0e12c2859dd3064810f192c0
SHA256114e28c227be2b32f48fc80a8fb17332d28e3bfd3098beb3ba9b92ad709f7762
SHA512d6728ea917a8f6591b20149b258b9ece3bf872038fe3b2272063024d04d6db6361e777eb3e49896b8b5079393be457b369d6bd8b017d04e6f19b94de00c4aec9