Analysis
- max time kernel
148s - max time network
143s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
14/10/2026, 11:54
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1e5e347ef1cc46218d5e14f19e795a0f28bc5602d238c350da7eddcbd5a1d87c.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 1e5e347ef1cc46218d5e14f19e795a0f28bc5602d238c350da7eddcbd5a1d87c.exe
- Size 2.2MB
- Sample261014-n2zwxacw21
- SHA256 1e5e347ef1cc46218d5e14f19e795a0f28bc5602d238c350da7eddcbd5a1d87c
- MD5 838487818811ce9e2dbc75423687b996
- SHA1 5aec60c58504c037f2f3713d7d2bfce0cb14e0ef
- SHA512 66b6198fd1c80d18aac0faf0a0fc72ebc1240555e15569315f676a250a7659f641c2b7ebefd27029cfa33bc171e756dc891c1690ba8f33cdf207f80d1f044cc1
- SSDEEP 49152:DWxtFa5lOmeJQJwAYhyJesqEw/+SPT7tRIpCcP1IPoO2qk:DWxtI57eowAHeoe+mxRIpCgIQO2qk
- TLSH T16FB5E0227566C031C3731931597FE22681A8AE614F7485CFB7DC362E4A748C6AB3972F
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops file in System32 directory 31 IoCs
description ioc Process File opened for modification C:\Windows\System32\alg.exe 1e5e347ef1cc46218d5e14f19e795a0f28bc5602d238c350da7eddcbd5a1d87c.exe File opened for modification C:\Windows\System32\GameInputSvc.exe 1e5e347ef1cc46218d5e14f19e795a0f28bc5602d238c350da7eddcbd5a1d87c.exe File opened for modification C:\Windows\system32\AppVClient.exe 1e5e347ef1cc46218d5e14f19e795a0f28bc5602d238c350da7eddcbd5a1d87c.exe File opened for modification C:\Windows\system32\msiexec.exe 1e5e347ef1cc46218d5e14f19e795a0f28bc5602d238c350da7eddcbd5a1d87c.exe File opened for modification C:\Windows\System32\ReFsDedupSvc.exe 1e5e347ef1cc46218d5e14f19e795a0f28bc5602d238c350da7eddcbd5a1d87c.exe File opened for modification C:\Windows\system32\wbengine.exe 1e5e347ef1cc46218d5e14f19e795a0f28bc5602d238c350da7eddcbd5a1d87c.exe File opened for modification C:\Windows\System32\GameInputSvc.exe 1e5e347ef1cc46218d5e14f19e795a0f28bc5602d238c350da7eddcbd5a1d87c.exe File opened for modification C:\Windows\System32\snmptrap.exe 1e5e347ef1cc46218d5e14f19e795a0f28bc5602d238c350da7eddcbd5a1d87c.exe File opened for modification C:\Windows\system32\TieringEngineService.exe 1e5e347ef1cc46218d5e14f19e795a0f28bc5602d238c350da7eddcbd5a1d87c.exe File opened for modification C:\Windows\system32\AgentService.exe 1e5e347ef1cc46218d5e14f19e795a0f28bc5602d238c350da7eddcbd5a1d87c.exe File opened for modification C:\Windows\system32\vssvc.exe 1e5e347ef1cc46218d5e14f19e795a0f28bc5602d238c350da7eddcbd5a1d87c.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe 1e5e347ef1cc46218d5e14f19e795a0f28bc5602d238c350da7eddcbd5a1d87c.exe File opened for modification C:\Windows\system32\SearchIndexer.exe 1e5e347ef1cc46218d5e14f19e795a0f28bc5602d238c350da7eddcbd5a1d87c.exe File opened for modification C:\Windows\system32\msiexec.exe 1e5e347ef1cc46218d5e14f19e795a0f28bc5602d238c350da7eddcbd5a1d87c.exe File opened for modification C:\Windows\System32\ReFsDedupSvc.exe 1e5e347ef1cc46218d5e14f19e795a0f28bc5602d238c350da7eddcbd5a1d87c.exe File opened for modification C:\Windows\system32\locator.exe 1e5e347ef1cc46218d5e14f19e795a0f28bc5602d238c350da7eddcbd5a1d87c.exe File opened for modification C:\Windows\System32\vds.exe 1e5e347ef1cc46218d5e14f19e795a0f28bc5602d238c350da7eddcbd5a1d87c.exe File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe 1e5e347ef1cc46218d5e14f19e795a0f28bc5602d238c350da7eddcbd5a1d87c.exe File opened for modification C:\Windows\System32\msdtc.exe 1e5e347ef1cc46218d5e14f19e795a0f28bc5602d238c350da7eddcbd5a1d87c.exe File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe 1e5e347ef1cc46218d5e14f19e795a0f28bc5602d238c350da7eddcbd5a1d87c.exe File opened for modification C:\Windows\SysWow64\perfhost.exe 1e5e347ef1cc46218d5e14f19e795a0f28bc5602d238c350da7eddcbd5a1d87c.exe File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe 1e5e347ef1cc46218d5e14f19e795a0f28bc5602d238c350da7eddcbd5a1d87c.exe File opened for modification C:\Windows\System32\msdtc.exe 1e5e347ef1cc46218d5e14f19e795a0f28bc5602d238c350da7eddcbd5a1d87c.exe File opened for modification C:\Windows\System32\SensorDataService.exe 1e5e347ef1cc46218d5e14f19e795a0f28bc5602d238c350da7eddcbd5a1d87c.exe File opened for modification C:\Windows\System32\alg.exe 1e5e347ef1cc46218d5e14f19e795a0f28bc5602d238c350da7eddcbd5a1d87c.exe File opened for modification C:\Windows\system32\AppVClient.exe 1e5e347ef1cc46218d5e14f19e795a0f28bc5602d238c350da7eddcbd5a1d87c.exe File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe 1e5e347ef1cc46218d5e14f19e795a0f28bc5602d238c350da7eddcbd5a1d87c.exe File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe 1e5e347ef1cc46218d5e14f19e795a0f28bc5602d238c350da7eddcbd5a1d87c.exe File opened for modification C:\Windows\SysWow64\perfhost.exe 1e5e347ef1cc46218d5e14f19e795a0f28bc5602d238c350da7eddcbd5a1d87c.exe File opened for modification C:\Windows\system32\locator.exe 1e5e347ef1cc46218d5e14f19e795a0f28bc5602d238c350da7eddcbd5a1d87c.exe File opened for modification C:\Windows\System32\SensorDataService.exe 1e5e347ef1cc46218d5e14f19e795a0f28bc5602d238c350da7eddcbd5a1d87c.exe -
resource yara_rule behavioral2/files/0x0001000000009337-29.dat upx behavioral2/files/0x00010000000093af-30.dat upx behavioral2/files/0x0001000000009952-31.dat upx behavioral2/files/0x000100000001b952-34.dat upx behavioral2/files/0x0001000000009cd6-35.dat upx behavioral2/files/0x0001000000009cfe-36.dat upx behavioral2/files/0x000300000001a192-37.dat upx behavioral2/files/0x000100000000b974-38.dat upx behavioral2/files/0x000100000000df21-39.dat upx behavioral2/files/0x0001000000009fd4-40.dat upx behavioral2/files/0x0001000000009b92-41.dat upx behavioral2/files/0x0001000000006215-42.dat upx behavioral2/files/0x000100000000a050-43.dat upx - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe 1e5e347ef1cc46218d5e14f19e795a0f28bc5602d238c350da7eddcbd5a1d87c.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe 1e5e347ef1cc46218d5e14f19e795a0f28bc5602d238c350da7eddcbd5a1d87c.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe 1e5e347ef1cc46218d5e14f19e795a0f28bc5602d238c350da7eddcbd5a1d87c.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe 1e5e347ef1cc46218d5e14f19e795a0f28bc5602d238c350da7eddcbd5a1d87c.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe 1e5e347ef1cc46218d5e14f19e795a0f28bc5602d238c350da7eddcbd5a1d87c.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe 1e5e347ef1cc46218d5e14f19e795a0f28bc5602d238c350da7eddcbd5a1d87c.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe 1e5e347ef1cc46218d5e14f19e795a0f28bc5602d238c350da7eddcbd5a1d87c.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe 1e5e347ef1cc46218d5e14f19e795a0f28bc5602d238c350da7eddcbd5a1d87c.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe 1e5e347ef1cc46218d5e14f19e795a0f28bc5602d238c350da7eddcbd5a1d87c.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe 1e5e347ef1cc46218d5e14f19e795a0f28bc5602d238c350da7eddcbd5a1d87c.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe 1e5e347ef1cc46218d5e14f19e795a0f28bc5602d238c350da7eddcbd5a1d87c.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe 1e5e347ef1cc46218d5e14f19e795a0f28bc5602d238c350da7eddcbd5a1d87c.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe 1e5e347ef1cc46218d5e14f19e795a0f28bc5602d238c350da7eddcbd5a1d87c.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe 1e5e347ef1cc46218d5e14f19e795a0f28bc5602d238c350da7eddcbd5a1d87c.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe 1e5e347ef1cc46218d5e14f19e795a0f28bc5602d238c350da7eddcbd5a1d87c.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe 1e5e347ef1cc46218d5e14f19e795a0f28bc5602d238c350da7eddcbd5a1d87c.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe 1e5e347ef1cc46218d5e14f19e795a0f28bc5602d238c350da7eddcbd5a1d87c.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe 1e5e347ef1cc46218d5e14f19e795a0f28bc5602d238c350da7eddcbd5a1d87c.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe 1e5e347ef1cc46218d5e14f19e795a0f28bc5602d238c350da7eddcbd5a1d87c.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe 1e5e347ef1cc46218d5e14f19e795a0f28bc5602d238c350da7eddcbd5a1d87c.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe 1e5e347ef1cc46218d5e14f19e795a0f28bc5602d238c350da7eddcbd5a1d87c.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe 1e5e347ef1cc46218d5e14f19e795a0f28bc5602d238c350da7eddcbd5a1d87c.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe 1e5e347ef1cc46218d5e14f19e795a0f28bc5602d238c350da7eddcbd5a1d87c.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe 1e5e347ef1cc46218d5e14f19e795a0f28bc5602d238c350da7eddcbd5a1d87c.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe 1e5e347ef1cc46218d5e14f19e795a0f28bc5602d238c350da7eddcbd5a1d87c.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE 1e5e347ef1cc46218d5e14f19e795a0f28bc5602d238c350da7eddcbd5a1d87c.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe 1e5e347ef1cc46218d5e14f19e795a0f28bc5602d238c350da7eddcbd5a1d87c.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe 1e5e347ef1cc46218d5e14f19e795a0f28bc5602d238c350da7eddcbd5a1d87c.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe 1e5e347ef1cc46218d5e14f19e795a0f28bc5602d238c350da7eddcbd5a1d87c.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe 1e5e347ef1cc46218d5e14f19e795a0f28bc5602d238c350da7eddcbd5a1d87c.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe 1e5e347ef1cc46218d5e14f19e795a0f28bc5602d238c350da7eddcbd5a1d87c.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe 1e5e347ef1cc46218d5e14f19e795a0f28bc5602d238c350da7eddcbd5a1d87c.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe 1e5e347ef1cc46218d5e14f19e795a0f28bc5602d238c350da7eddcbd5a1d87c.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe 1e5e347ef1cc46218d5e14f19e795a0f28bc5602d238c350da7eddcbd5a1d87c.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe 1e5e347ef1cc46218d5e14f19e795a0f28bc5602d238c350da7eddcbd5a1d87c.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe 1e5e347ef1cc46218d5e14f19e795a0f28bc5602d238c350da7eddcbd5a1d87c.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe 1e5e347ef1cc46218d5e14f19e795a0f28bc5602d238c350da7eddcbd5a1d87c.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe 1e5e347ef1cc46218d5e14f19e795a0f28bc5602d238c350da7eddcbd5a1d87c.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 1e5e347ef1cc46218d5e14f19e795a0f28bc5602d238c350da7eddcbd5a1d87c.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe 1e5e347ef1cc46218d5e14f19e795a0f28bc5602d238c350da7eddcbd5a1d87c.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe 1e5e347ef1cc46218d5e14f19e795a0f28bc5602d238c350da7eddcbd5a1d87c.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe 1e5e347ef1cc46218d5e14f19e795a0f28bc5602d238c350da7eddcbd5a1d87c.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe 1e5e347ef1cc46218d5e14f19e795a0f28bc5602d238c350da7eddcbd5a1d87c.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe 1e5e347ef1cc46218d5e14f19e795a0f28bc5602d238c350da7eddcbd5a1d87c.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe 1e5e347ef1cc46218d5e14f19e795a0f28bc5602d238c350da7eddcbd5a1d87c.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe 1e5e347ef1cc46218d5e14f19e795a0f28bc5602d238c350da7eddcbd5a1d87c.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe 1e5e347ef1cc46218d5e14f19e795a0f28bc5602d238c350da7eddcbd5a1d87c.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe 1e5e347ef1cc46218d5e14f19e795a0f28bc5602d238c350da7eddcbd5a1d87c.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe 1e5e347ef1cc46218d5e14f19e795a0f28bc5602d238c350da7eddcbd5a1d87c.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe 1e5e347ef1cc46218d5e14f19e795a0f28bc5602d238c350da7eddcbd5a1d87c.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe 1e5e347ef1cc46218d5e14f19e795a0f28bc5602d238c350da7eddcbd5a1d87c.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe 1e5e347ef1cc46218d5e14f19e795a0f28bc5602d238c350da7eddcbd5a1d87c.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe 1e5e347ef1cc46218d5e14f19e795a0f28bc5602d238c350da7eddcbd5a1d87c.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe 1e5e347ef1cc46218d5e14f19e795a0f28bc5602d238c350da7eddcbd5a1d87c.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe 1e5e347ef1cc46218d5e14f19e795a0f28bc5602d238c350da7eddcbd5a1d87c.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe 1e5e347ef1cc46218d5e14f19e795a0f28bc5602d238c350da7eddcbd5a1d87c.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe 1e5e347ef1cc46218d5e14f19e795a0f28bc5602d238c350da7eddcbd5a1d87c.exe File opened for modification C:\Program Files\Mozilla Firefox\nmhproxy.exe 1e5e347ef1cc46218d5e14f19e795a0f28bc5602d238c350da7eddcbd5a1d87c.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe 1e5e347ef1cc46218d5e14f19e795a0f28bc5602d238c350da7eddcbd5a1d87c.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe 1e5e347ef1cc46218d5e14f19e795a0f28bc5602d238c350da7eddcbd5a1d87c.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe 1e5e347ef1cc46218d5e14f19e795a0f28bc5602d238c350da7eddcbd5a1d87c.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe 1e5e347ef1cc46218d5e14f19e795a0f28bc5602d238c350da7eddcbd5a1d87c.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe 1e5e347ef1cc46218d5e14f19e795a0f28bc5602d238c350da7eddcbd5a1d87c.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe 1e5e347ef1cc46218d5e14f19e795a0f28bc5602d238c350da7eddcbd5a1d87c.exe - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 1e5e347ef1cc46218d5e14f19e795a0f28bc5602d238c350da7eddcbd5a1d87c.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 1e5e347ef1cc46218d5e14f19e795a0f28bc5602d238c350da7eddcbd5a1d87c.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1e5e347ef1cc46218d5e14f19e795a0f28bc5602d238c350da7eddcbd5a1d87c.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1e5e347ef1cc46218d5e14f19e795a0f28bc5602d238c350da7eddcbd5a1d87c.exe - Suspicious behavior: EnumeratesProcesses 24 IoCs
pid Process 2476 1e5e347ef1cc46218d5e14f19e795a0f28bc5602d238c350da7eddcbd5a1d87c.exe 2476 1e5e347ef1cc46218d5e14f19e795a0f28bc5602d238c350da7eddcbd5a1d87c.exe 2476 1e5e347ef1cc46218d5e14f19e795a0f28bc5602d238c350da7eddcbd5a1d87c.exe 2476 1e5e347ef1cc46218d5e14f19e795a0f28bc5602d238c350da7eddcbd5a1d87c.exe 2476 1e5e347ef1cc46218d5e14f19e795a0f28bc5602d238c350da7eddcbd5a1d87c.exe 2476 1e5e347ef1cc46218d5e14f19e795a0f28bc5602d238c350da7eddcbd5a1d87c.exe 2476 1e5e347ef1cc46218d5e14f19e795a0f28bc5602d238c350da7eddcbd5a1d87c.exe 2476 1e5e347ef1cc46218d5e14f19e795a0f28bc5602d238c350da7eddcbd5a1d87c.exe 2476 1e5e347ef1cc46218d5e14f19e795a0f28bc5602d238c350da7eddcbd5a1d87c.exe 2476 1e5e347ef1cc46218d5e14f19e795a0f28bc5602d238c350da7eddcbd5a1d87c.exe 2476 1e5e347ef1cc46218d5e14f19e795a0f28bc5602d238c350da7eddcbd5a1d87c.exe 2476 1e5e347ef1cc46218d5e14f19e795a0f28bc5602d238c350da7eddcbd5a1d87c.exe 2476 1e5e347ef1cc46218d5e14f19e795a0f28bc5602d238c350da7eddcbd5a1d87c.exe 2476 1e5e347ef1cc46218d5e14f19e795a0f28bc5602d238c350da7eddcbd5a1d87c.exe 2476 1e5e347ef1cc46218d5e14f19e795a0f28bc5602d238c350da7eddcbd5a1d87c.exe 2476 1e5e347ef1cc46218d5e14f19e795a0f28bc5602d238c350da7eddcbd5a1d87c.exe 2476 1e5e347ef1cc46218d5e14f19e795a0f28bc5602d238c350da7eddcbd5a1d87c.exe 2476 1e5e347ef1cc46218d5e14f19e795a0f28bc5602d238c350da7eddcbd5a1d87c.exe 2476 1e5e347ef1cc46218d5e14f19e795a0f28bc5602d238c350da7eddcbd5a1d87c.exe 2476 1e5e347ef1cc46218d5e14f19e795a0f28bc5602d238c350da7eddcbd5a1d87c.exe 2476 1e5e347ef1cc46218d5e14f19e795a0f28bc5602d238c350da7eddcbd5a1d87c.exe 2476 1e5e347ef1cc46218d5e14f19e795a0f28bc5602d238c350da7eddcbd5a1d87c.exe 2476 1e5e347ef1cc46218d5e14f19e795a0f28bc5602d238c350da7eddcbd5a1d87c.exe 2476 1e5e347ef1cc46218d5e14f19e795a0f28bc5602d238c350da7eddcbd5a1d87c.exe - Suspicious use of AdjustPrivilegeToken 7 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 4116 1e5e347ef1cc46218d5e14f19e795a0f28bc5602d238c350da7eddcbd5a1d87c.exe Token: SeTakeOwnershipPrivilege 4116 1e5e347ef1cc46218d5e14f19e795a0f28bc5602d238c350da7eddcbd5a1d87c.exe Token: SeTakeOwnershipPrivilege 2476 1e5e347ef1cc46218d5e14f19e795a0f28bc5602d238c350da7eddcbd5a1d87c.exe Token: SeDebugPrivilege 2476 1e5e347ef1cc46218d5e14f19e795a0f28bc5602d238c350da7eddcbd5a1d87c.exe Token: SeDebugPrivilege 2476 1e5e347ef1cc46218d5e14f19e795a0f28bc5602d238c350da7eddcbd5a1d87c.exe Token: SeDebugPrivilege 2476 1e5e347ef1cc46218d5e14f19e795a0f28bc5602d238c350da7eddcbd5a1d87c.exe Token: SeDebugPrivilege 2476 1e5e347ef1cc46218d5e14f19e795a0f28bc5602d238c350da7eddcbd5a1d87c.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 4116 wrote to memory of 2476 4116 1e5e347ef1cc46218d5e14f19e795a0f28bc5602d238c350da7eddcbd5a1d87c.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\1e5e347ef1cc46218d5e14f19e795a0f28bc5602d238c350da7eddcbd5a1d87c.exe"C:\Users\Admin\AppData\Local\Temp\1e5e347ef1cc46218d5e14f19e795a0f28bc5602d238c350da7eddcbd5a1d87c.exe"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4116 -
C:\Users\Admin\AppData\Local\Temp\1e5e347ef1cc46218d5e14f19e795a0f28bc5602d238c350da7eddcbd5a1d87c.exe"C:\Users\Admin\AppData\Local\Temp\1e5e347ef1cc46218d5e14f19e795a0f28bc5602d238c350da7eddcbd5a1d87c.exe" --ws2⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2476
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
- Size 2.9MB
- SHA256 abf639e23928b9b51533894ce2e51835ecec1f8db935feb0fd872ffbda282a1a
- MD5 11d8884f43d1a463d1886247882408de
- SHA1 62c08d505c6eb18ae7fa030b938a21641c71d750
- SHA512 45f96295935a0c122ba2ee2fc1034f05cd39efb99d86ae3d6d060cc52a255b35473adb8ba5394293efd269b34e55ffedbb0c44e02bd3d99955fa19f6415a06b3
- SSDEEP 49152:Zb+632BuPkFKRrdE6oh7stBhuXjfS4LWxn4PT7tRIpCcP1IPoO2qk:v3q6gjBtxRIpCgIQO2qk
- TLSH T1E0E59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 1017KB
- SHA256 79057ec3a9ad528a1a285417054b72f32b98d1d021f6b56408629ea680d146b7
- MD5 8f26e62108431acfc89b4734d4821b30
- SHA1 90b951e5ec8097102037d48c47cc6dc7df3f29a5
- SHA512 a655f23677b651fa6fedfb6aac552dc95451538c90bbbe5ec4ef63b810c2b8de0f2f1723013b08b71d0246f067cd3cce429b622caf276e8dc443ffa326b3562a
- SSDEEP 24576:9XYfDtczAzQr61gT7tEuJu1pILcyD7I1mFOtyChUok6ywq2Z02Hg8yjrQ:otcZPT7tRIpCcP1IPoO2qk
- TLSH T1CB25022867D409F9DC679278C8E18502EE32B8514BA4E7CF07E499795F233D81D3EB52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
- Size 3.0MB
- SHA256 4c035225901b8ccb0a38385b9185b835bd1614cb3366523415bb9f7d8a47e553
- MD5 e7bd1eeef808d9e4100cb1945c0a3cac
- SHA1 40808e06fb0412979065d24f9fd8054513042f38
- SHA512 e4b458c7a1c9f81d898aea6bba4e36335ab540821cb5d87aa2680d25508f405871c861c3d2f2bb5f10358d1d5e1e65a7a5a5f7c865ccded306205733e04b63a4
- SSDEEP 49152:9B+taZ3usBWOBr4tEGp0bqx0z+n217aau1gldPT7tRIpCcP1IPoO2qk:ju6JmTxd2dVxRIpCgIQO2qk
- TLSH T19AE5AD13F1DA01E8D06AD478974A9233FA62BC490B35B6DF0A9073562E77EE46B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
- Size 1.2MB
- SHA256 96dfa740d41f8484bcfd2a90e1a37eece6ba08acda567a5a77522b0a6d756d91
- MD5 ab571f2f7989bccd4387ec48bd5ce895
- SHA1 d30fb04bd06b73de73defd6b6eefd1b7dcbffcca
- SHA512 2eaa27080a225f7ae177e23c17e1d7ea8a6fd1219b41ac3ec2be84b15863d24527ca6cc3150337b35d2ecb1cf39a41411b68fff30d0b1ca2558843c5d6e4db3f
- SSDEEP 24576:unwvtk9RX6wkyAIuQr61gT7tEuJu1pILcyD7I1mFOtyChUok6ywq2Z02Hg8yjrQ:LMnYIFPT7tRIpCcP1IPoO2qk
- TLSH T1B545E029EBDC04E5E077923C89E3460AF6B178691F31C2CF169A536E0E37AD45D3A721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\461744d97465cd71.bin
- Size 12KB
- SHA256 550f02f97557e0fff3d7cb00a6d2d81d0e3d0e9df8680c22bc5b8fa7321827d6
- MD5 69efb84f030fd8918a37d27690f20d1c
- SHA1 4b4299dfdb9db0edfceebf0bb66c232876446600
- SHA512 9233da0050398a8508f67923c62fdab14106ab02e42c3f2d2ab3b5a3804b8d44c130be330d3d5865dbe32e49d867087096d7dcd61db2fa71683bb33153e5ae9d
- SSDEEP 384:Av35TocXFglG0aUnjPGchhZgpf3LgUry/7R9:u3HXFgyGPRhi/L8R9
- TLSH T14742BF5EE16CA0CF989BF70217B192B41A0E7338B1402DF94FACF656728C6E21794431
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWow64\perfhost.exe
- Size 778KB
- SHA256 73c63dcbe860332a0b2d0088856ab16c24bd6827e6fcba83ec58d08fa99db9fa
- MD5 a24be8c70fa9aaf78f0f12a3915e31a9
- SHA1 b32720f4397db28851d66119f2af4f380a7d6108
- SHA512 2453e0f130da8514d2591e4bdf7f19739f74a673cf6e2f9e71ff66c3b2eda1e1e7dea0c0393905d42ef9aeabbcfe1a00e65a36270ca3b9b387d42d3fe584aff5
- SSDEEP 24576:w4IQr61gT7tEuJu1pILcyD7I1mFOtyChUok6ywq2Z02Hg8yjrQ:w4PPT7tRIpCcP1IPoO2qk
- TLSH T14B0523A08AEC490FD87976B010D596127D38B6614F99D1CF7EC47A6ECE2B28D0C2A617
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\GameInputSvc.exe
- Size 828KB
- SHA256 96f2953c1db5011b98eb83df953ee9026c0e155c75c0036532102a5659b483fa
- MD5 0a1661af3c1deca56ad449f67d18270f
- SHA1 2cf6df1fa317769984057315c086ec70e3b5405f
- SHA512 ba839c5295356733aa23546ee6453c7b4f07fc928ab4588e7daa8542a79c7994e527bc0d0dd306cb1b9e4ae4cfd1ac05030056be50cdd8b21c1bd292444e56be
- SSDEEP 24576:7GtQr61gT7tEuJu1pILcyD7I1mFOtyChUok6ywq2Z02Hg8yjrQ:7G8PT7tRIpCcP1IPoO2qk
- TLSH T12505237865FD258EC83AF6B450D16603BC3071604F6962DF1DD0BA3ACF1A2E8293ED56
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\ReFsDedupSvc.exe
- Size 2.8MB
- SHA256 22ef8b2fd4a7b49a194fd4d70ab73c82703f993d40df71c7215b29b77b56cc37
- MD5 9f06f85bf2c1812fdbe602920db699fe
- SHA1 cdd610994910532bff691b1a8395b08fa3a04477
- SHA512 2c165ef1954f99185ec82bfd4c17fac7c51c387ac4d18b6b2e9639bef8d6eed8c61a788740b2c88cccca60f1eb4cd98461ce8d3c77d359389837553955b21802
- SSDEEP 49152:DBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj5PT7tRIpCcP1IPoOW:sG05lO43b6xRIpCgIQO2qk
- TLSH T1FAD5C06A62EC11F9D0BBD17CD9C64A0BEBB23425033556CF02A486A91F27FF4597E312
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SensorDataService.exe
- Size 1.9MB
- SHA256 3413791fc5a7afe2a1b6d795f187ef3865f786833b141774ca10f3aec61bcd47
- MD5 881dd784ea64be7dd8b5288f76e3f5b5
- SHA1 733052ac400b8d698fa19a1844191d69936e5d9f
- SHA512 13d3f6d3302ca2985640040b98a399e00b0b961e92db7bfcce0e1ff224c45271af3f7470911590c9eadd086359b86c2964d55ea5cf24c203a71de58851fb0e16
- SSDEEP 24576:5NcwHdjbyQ4nLC18lb/EOjowL7FkKQr61gT7tEuJu1pILcyD7I1mFOtyChUok6yW:5Nc/zEOVHFIPT7tRIpCcP1IPoO2qk
- TLSH T167959C2623E901E4F5BBE1BE89679546FA717865173486CF0291811F1E73BF81C3AB32
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\alg.exe
- Size 944KB
- SHA256 f9562109795e2d54e9e0ed4659e5f9f2bc5403ba08ceb71b62e50ab447e399f7
- MD5 9d787d5de7a58a18f0cdf0eb3792d358
- SHA1 c6c53a41806388b7ca43338287c5bfe7f9648785
- SHA512 e12b76b37cb47d05bebfc93185fc17e3446ef8322a5e12e0ca2fb0ed6c14552a7afb15e49023099dc73ce9b3b6aec43e34438b6c53bfea3afc4aa5952be1f522
- SSDEEP 24576:96DIlQr61gT7tEuJu1pILcyD7I1mFOtyChUok6ywq2Z02Hg8yjrQ:96DIEPT7tRIpCcP1IPoO2qk
- TLSH T1E725015C63BA00BAD06BE07D81C20502EA72B1718B6656CF1AD4D57E8F63EDC793DE42
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\msdtc.exe
- Size 928KB
- SHA256 74931c0fe2572e37d004db38008d50e5910767f5deebb47288f8c96a2394f98a
- MD5 c4e633596ea374ccbc814e9fd2156ac0
- SHA1 df0428f9be4f347cb8834350faf00e1a4c4d787e
- SHA512 a3a5b9ceb236e6cd4fb87ec0af5a29fc4f73411a059445ce084ef0f32f3ffd2787382005f52ed8c7dd01451208aaed7c211abc3ab7ed756bcf63770caeb84838
- SSDEEP 24576:Oty+Qr61gT7tEuJu1pILcyD7I1mFOtyChUok6ywq2Z02Hg8yjrQ:Ot8PT7tRIpCcP1IPoO2qk
- TLSH T16A15225053DC508AE979667895E28251AE34BC204F6693CF2DD0FA3E9F3B3D82C35B16
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\AppVClient.exe
- Size 1.5MB
- SHA256 0f7fc2c4d60c97fd474cf888c498c6f8660e8fcfd538959743864e424211c83a
- MD5 90e39bacb5579f8817207d64d04367ed
- SHA1 24b6076c0436356ae6888c917f9e3cd6edd22ba5
- SHA512 fe25833b6e817c48f64b8069a1cfb1ec03976c7fa3041990b0644dc83353817d6e46c7dbfe797b764e894161853c1f8e9d6e9b4a0fca6100a506617f9133728f
- SSDEEP 24576:3TkNvNnaFeYhJNtmZBm/Qr61gT7tEuJu1pILcyD7I1mFOtyChUok6ywq2Z02Hg8f:3TMwBtOm+PT7tRIpCcP1IPoO2qk
- TLSH T1D775B06EAAF846E4D1FAD6B48D238512FA727461073293CF5290C13F4E279D89D39F21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
- Size 996KB
- SHA256 ca666c41d75d3256d3256e9e4d0692988639e061c6e09e8f7d1a4f4a8eed2e1b
- MD5 599e8c0e84fa9520ee8d7fc5637479de
- SHA1 44df8a3fb0a5238fa6100aa1fc08f840c3417f6e
- SHA512 82f0852c5093ceb29bb6a1bdbd49e6f01234aaa812c38121ea364e80a9d162db685e001be9fcd1e903422295b72ef5eb53769af07a24afbca509cfb965c8036b
- SSDEEP 24576:gPUr+NQLQr61gT7tEuJu1pILcyD7I1mFOtyChUok6ywq2Z02Hg8yjrQ:gJQiPT7tRIpCcP1IPoO2qk
- TLSH T1E525F26E66EC18E9E676F17C85824709FB71B4620B52D2CF06D0817E4F27AD86C3EB11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\locator.exe
- Size 792KB
- SHA256 2e9ad0b0dfbd91a52625fb192450ed69d48143432d2f641f35dadfaf1dddebd0
- MD5 bdde6dbb4364cffab75f676637a214f4
- SHA1 6b3d3ebc9bd7d89755d7f5d9a9c119ee05e2e4a9
- SHA512 1ba395ea7f8675c09ceb1c518421bd2823578b2679ae23254ce0b3f3ac6c06e22020a313d56c77ad21e7029decb134546bebfc73db463063bb7564e8965c26cf
- SSDEEP 24576:yxQr61gT7tEuJu1pILcyD7I1mFOtyChUok6ywq2Z02Hg8yjrQ:yYPT7tRIpCcP1IPoO2qk
- TLSH T1120523A489EC494FC975BAB410C15602BD34A2614FEE92CF3DD47A2ACB1F1DE083E567
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\msiexec.exe
- Size 936KB
- SHA256 2981f9580185a3ef5c3b918bd3381bf39beffa228a8e2f1a97ae2e10a01246de
- MD5 b1f7cc90ce7bd43b2d308e7f1708a237
- SHA1 590dd44b05cbb947d31a68e5839299d65a1ff02c
- SHA512 f004c18e52459443acb5dae3623771952b168d74edbb966d58713ede90bd34223ac6f63fffa5be9fde5752a50e7f3d823ca0e92a8c5e37284cd0488cdd3edf9a
- SSDEEP 24576:z6Uqjp/Qr61gT7tEuJu1pILcyD7I1mFOtyChUok6ywq2Z02Hg8yjrQ:z6U5PT7tRIpCcP1IPoO2qk
- TLSH T13B15226D56D854DAD439627094D182169D30B8320FBA91DF3AD8A67FCF366C8483FF22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
- Size 997KB
- SHA256 0270055f6900cc6863f8ff85cf900cbe06a95856903ff8aa38451b6c1aa51add
- MD5 a85eaec0c487da4adaa8204b4196d377
- SHA1 d68d7b66d61c4e10714dabfdf88096cc1f753053
- SHA512 d7d02158129ad612b690d715a91353278d9b072755ee52a530a0543b1f0c15414cd35d7ad32d8a89ef627873f25e9ebe190f6d6955e9bdca56aa640246449236
- SSDEEP 24576:dwu7OWvQr61gT7tEuJu1pILcyD7I1mFOtyChUok6ywq2Z02Hg8yjr:dwIOvPT7tRIpCcP1IPoO2q
- TLSH T1D525024576E80CFDE96792388587C136FBB2B8012E65D71F1BA0C65B5F273216D2EB20
- MD5 SHA1 SHA512 SSDEEP TLSH