Analysis
- max time kernel
148s - max time network
135s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/11/2026, 07:47
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
795dd6a9fc5a03faf56abb6b828664ff572ce55f22b8ad06c33ffc54c8f429cc.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
15 signatures
150 seconds
Behavioral task
behavioral2
Sample
795dd6a9fc5a03faf56abb6b828664ff572ce55f22b8ad06c33ffc54c8f429cc.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
15 signatures
150 seconds
General
- Target 795dd6a9fc5a03faf56abb6b828664ff572ce55f22b8ad06c33ffc54c8f429cc.exe
- Size 4.7MB
- Sample261102-jmlzaa1ydw
- SHA256 795dd6a9fc5a03faf56abb6b828664ff572ce55f22b8ad06c33ffc54c8f429cc
- MD5 ee522368aa98bccac6d99f6af3d5aa31
- SHA1 ab6c4632ce7af41ff2856551041af01025d393f1
- SHA512 784f7ee315cef227b5a69806bf15db8358abd58344dad99810b8036dbde5734e7527b39c1b8e6eb82f0f6ed989dcc14c0c5d9a17130f0d58cfe96e0e88bb3050
- SSDEEP 98304:VHfzBMytkx4FL8VdL0hvADfHraUkBqhJonrnYVoOUZgI:JzqyI4yVdDfLawkdOU
- TLSH T19836121137C1C075D1B31932DB78E65A0EBAAD314B3187CBB6983A6E1F34DC1AA39716
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 2 IoCs
pid Process 4400 795dd6a9fc5a03faf56abb6b828664ff572ce55f22b8ad06c33ffc54c8f429cc.exe 4400 795dd6a9fc5a03faf56abb6b828664ff572ce55f22b8ad06c33ffc54c8f429cc.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 795dd6a9fc5a03faf56abb6b828664ff572ce55f22b8ad06c33ffc54c8f429cc.exe File opened for modification \??\PHYSICALDRIVE0 795dd6a9fc5a03faf56abb6b828664ff572ce55f22b8ad06c33ffc54c8f429cc.exe - Drops file in System32 directory 20 IoCs
description ioc Process File opened for modification C:\Windows\System32\SensorDataService.exe 795dd6a9fc5a03faf56abb6b828664ff572ce55f22b8ad06c33ffc54c8f429cc.exe File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe 795dd6a9fc5a03faf56abb6b828664ff572ce55f22b8ad06c33ffc54c8f429cc.exe File opened for modification C:\Windows\System32\snmptrap.exe 795dd6a9fc5a03faf56abb6b828664ff572ce55f22b8ad06c33ffc54c8f429cc.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe 795dd6a9fc5a03faf56abb6b828664ff572ce55f22b8ad06c33ffc54c8f429cc.exe File opened for modification C:\Windows\System32\msdtc.exe 795dd6a9fc5a03faf56abb6b828664ff572ce55f22b8ad06c33ffc54c8f429cc.exe File opened for modification C:\Windows\System32\ReFsDedupSvc.exe 795dd6a9fc5a03faf56abb6b828664ff572ce55f22b8ad06c33ffc54c8f429cc.exe File opened for modification C:\Windows\system32\locator.exe 795dd6a9fc5a03faf56abb6b828664ff572ce55f22b8ad06c33ffc54c8f429cc.exe File opened for modification C:\Windows\system32\AgentService.exe 795dd6a9fc5a03faf56abb6b828664ff572ce55f22b8ad06c33ffc54c8f429cc.exe File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe 795dd6a9fc5a03faf56abb6b828664ff572ce55f22b8ad06c33ffc54c8f429cc.exe File opened for modification C:\Windows\system32\TieringEngineService.exe 795dd6a9fc5a03faf56abb6b828664ff572ce55f22b8ad06c33ffc54c8f429cc.exe File opened for modification C:\Windows\System32\alg.exe 795dd6a9fc5a03faf56abb6b828664ff572ce55f22b8ad06c33ffc54c8f429cc.exe File opened for modification C:\Windows\system32\AppVClient.exe 795dd6a9fc5a03faf56abb6b828664ff572ce55f22b8ad06c33ffc54c8f429cc.exe File opened for modification C:\Windows\system32\msiexec.exe 795dd6a9fc5a03faf56abb6b828664ff572ce55f22b8ad06c33ffc54c8f429cc.exe File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe 795dd6a9fc5a03faf56abb6b828664ff572ce55f22b8ad06c33ffc54c8f429cc.exe File opened for modification C:\Windows\System32\vds.exe 795dd6a9fc5a03faf56abb6b828664ff572ce55f22b8ad06c33ffc54c8f429cc.exe File opened for modification C:\Windows\system32\vssvc.exe 795dd6a9fc5a03faf56abb6b828664ff572ce55f22b8ad06c33ffc54c8f429cc.exe File opened for modification C:\Windows\system32\wbengine.exe 795dd6a9fc5a03faf56abb6b828664ff572ce55f22b8ad06c33ffc54c8f429cc.exe File opened for modification C:\Windows\system32\SearchIndexer.exe 795dd6a9fc5a03faf56abb6b828664ff572ce55f22b8ad06c33ffc54c8f429cc.exe File opened for modification C:\Windows\System32\GameInputSvc.exe 795dd6a9fc5a03faf56abb6b828664ff572ce55f22b8ad06c33ffc54c8f429cc.exe File opened for modification C:\Windows\SysWow64\perfhost.exe 795dd6a9fc5a03faf56abb6b828664ff572ce55f22b8ad06c33ffc54c8f429cc.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe 795dd6a9fc5a03faf56abb6b828664ff572ce55f22b8ad06c33ffc54c8f429cc.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe 795dd6a9fc5a03faf56abb6b828664ff572ce55f22b8ad06c33ffc54c8f429cc.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe 795dd6a9fc5a03faf56abb6b828664ff572ce55f22b8ad06c33ffc54c8f429cc.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe 795dd6a9fc5a03faf56abb6b828664ff572ce55f22b8ad06c33ffc54c8f429cc.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe 795dd6a9fc5a03faf56abb6b828664ff572ce55f22b8ad06c33ffc54c8f429cc.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe 795dd6a9fc5a03faf56abb6b828664ff572ce55f22b8ad06c33ffc54c8f429cc.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe 795dd6a9fc5a03faf56abb6b828664ff572ce55f22b8ad06c33ffc54c8f429cc.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe 795dd6a9fc5a03faf56abb6b828664ff572ce55f22b8ad06c33ffc54c8f429cc.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe 795dd6a9fc5a03faf56abb6b828664ff572ce55f22b8ad06c33ffc54c8f429cc.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe 795dd6a9fc5a03faf56abb6b828664ff572ce55f22b8ad06c33ffc54c8f429cc.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe 795dd6a9fc5a03faf56abb6b828664ff572ce55f22b8ad06c33ffc54c8f429cc.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe 795dd6a9fc5a03faf56abb6b828664ff572ce55f22b8ad06c33ffc54c8f429cc.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe 795dd6a9fc5a03faf56abb6b828664ff572ce55f22b8ad06c33ffc54c8f429cc.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe 795dd6a9fc5a03faf56abb6b828664ff572ce55f22b8ad06c33ffc54c8f429cc.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe 795dd6a9fc5a03faf56abb6b828664ff572ce55f22b8ad06c33ffc54c8f429cc.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe 795dd6a9fc5a03faf56abb6b828664ff572ce55f22b8ad06c33ffc54c8f429cc.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe 795dd6a9fc5a03faf56abb6b828664ff572ce55f22b8ad06c33ffc54c8f429cc.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe 795dd6a9fc5a03faf56abb6b828664ff572ce55f22b8ad06c33ffc54c8f429cc.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe 795dd6a9fc5a03faf56abb6b828664ff572ce55f22b8ad06c33ffc54c8f429cc.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe 795dd6a9fc5a03faf56abb6b828664ff572ce55f22b8ad06c33ffc54c8f429cc.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe 795dd6a9fc5a03faf56abb6b828664ff572ce55f22b8ad06c33ffc54c8f429cc.exe File opened for modification C:\Program Files\7-Zip\7zG.exe 795dd6a9fc5a03faf56abb6b828664ff572ce55f22b8ad06c33ffc54c8f429cc.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe 795dd6a9fc5a03faf56abb6b828664ff572ce55f22b8ad06c33ffc54c8f429cc.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe 795dd6a9fc5a03faf56abb6b828664ff572ce55f22b8ad06c33ffc54c8f429cc.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe 795dd6a9fc5a03faf56abb6b828664ff572ce55f22b8ad06c33ffc54c8f429cc.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_107515\javaws.exe 795dd6a9fc5a03faf56abb6b828664ff572ce55f22b8ad06c33ffc54c8f429cc.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe 795dd6a9fc5a03faf56abb6b828664ff572ce55f22b8ad06c33ffc54c8f429cc.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe 795dd6a9fc5a03faf56abb6b828664ff572ce55f22b8ad06c33ffc54c8f429cc.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe 795dd6a9fc5a03faf56abb6b828664ff572ce55f22b8ad06c33ffc54c8f429cc.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe 795dd6a9fc5a03faf56abb6b828664ff572ce55f22b8ad06c33ffc54c8f429cc.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe 795dd6a9fc5a03faf56abb6b828664ff572ce55f22b8ad06c33ffc54c8f429cc.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe 795dd6a9fc5a03faf56abb6b828664ff572ce55f22b8ad06c33ffc54c8f429cc.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe 795dd6a9fc5a03faf56abb6b828664ff572ce55f22b8ad06c33ffc54c8f429cc.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE 795dd6a9fc5a03faf56abb6b828664ff572ce55f22b8ad06c33ffc54c8f429cc.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe 795dd6a9fc5a03faf56abb6b828664ff572ce55f22b8ad06c33ffc54c8f429cc.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe 795dd6a9fc5a03faf56abb6b828664ff572ce55f22b8ad06c33ffc54c8f429cc.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe 795dd6a9fc5a03faf56abb6b828664ff572ce55f22b8ad06c33ffc54c8f429cc.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe 795dd6a9fc5a03faf56abb6b828664ff572ce55f22b8ad06c33ffc54c8f429cc.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe 795dd6a9fc5a03faf56abb6b828664ff572ce55f22b8ad06c33ffc54c8f429cc.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe 795dd6a9fc5a03faf56abb6b828664ff572ce55f22b8ad06c33ffc54c8f429cc.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe 795dd6a9fc5a03faf56abb6b828664ff572ce55f22b8ad06c33ffc54c8f429cc.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe 795dd6a9fc5a03faf56abb6b828664ff572ce55f22b8ad06c33ffc54c8f429cc.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe 795dd6a9fc5a03faf56abb6b828664ff572ce55f22b8ad06c33ffc54c8f429cc.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE 795dd6a9fc5a03faf56abb6b828664ff572ce55f22b8ad06c33ffc54c8f429cc.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe 795dd6a9fc5a03faf56abb6b828664ff572ce55f22b8ad06c33ffc54c8f429cc.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe 795dd6a9fc5a03faf56abb6b828664ff572ce55f22b8ad06c33ffc54c8f429cc.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe 795dd6a9fc5a03faf56abb6b828664ff572ce55f22b8ad06c33ffc54c8f429cc.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe 795dd6a9fc5a03faf56abb6b828664ff572ce55f22b8ad06c33ffc54c8f429cc.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe 795dd6a9fc5a03faf56abb6b828664ff572ce55f22b8ad06c33ffc54c8f429cc.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe 795dd6a9fc5a03faf56abb6b828664ff572ce55f22b8ad06c33ffc54c8f429cc.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe 795dd6a9fc5a03faf56abb6b828664ff572ce55f22b8ad06c33ffc54c8f429cc.exe File opened for modification C:\Program Files\InvokeCopy.exe 795dd6a9fc5a03faf56abb6b828664ff572ce55f22b8ad06c33ffc54c8f429cc.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe 795dd6a9fc5a03faf56abb6b828664ff572ce55f22b8ad06c33ffc54c8f429cc.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe 795dd6a9fc5a03faf56abb6b828664ff572ce55f22b8ad06c33ffc54c8f429cc.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe 795dd6a9fc5a03faf56abb6b828664ff572ce55f22b8ad06c33ffc54c8f429cc.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe 795dd6a9fc5a03faf56abb6b828664ff572ce55f22b8ad06c33ffc54c8f429cc.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe 795dd6a9fc5a03faf56abb6b828664ff572ce55f22b8ad06c33ffc54c8f429cc.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe 795dd6a9fc5a03faf56abb6b828664ff572ce55f22b8ad06c33ffc54c8f429cc.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe 795dd6a9fc5a03faf56abb6b828664ff572ce55f22b8ad06c33ffc54c8f429cc.exe File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe 795dd6a9fc5a03faf56abb6b828664ff572ce55f22b8ad06c33ffc54c8f429cc.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe 795dd6a9fc5a03faf56abb6b828664ff572ce55f22b8ad06c33ffc54c8f429cc.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe 795dd6a9fc5a03faf56abb6b828664ff572ce55f22b8ad06c33ffc54c8f429cc.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe 795dd6a9fc5a03faf56abb6b828664ff572ce55f22b8ad06c33ffc54c8f429cc.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe 795dd6a9fc5a03faf56abb6b828664ff572ce55f22b8ad06c33ffc54c8f429cc.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 795dd6a9fc5a03faf56abb6b828664ff572ce55f22b8ad06c33ffc54c8f429cc.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain 795dd6a9fc5a03faf56abb6b828664ff572ce55f22b8ad06c33ffc54c8f429cc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname 795dd6a9fc5a03faf56abb6b828664ff572ce55f22b8ad06c33ffc54c8f429cc.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 795dd6a9fc5a03faf56abb6b828664ff572ce55f22b8ad06c33ffc54c8f429cc.exe - Modifies registry class 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\ 795dd6a9fc5a03faf56abb6b828664ff572ce55f22b8ad06c33ffc54c8f429cc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\ 795dd6a9fc5a03faf56abb6b828664ff572ce55f22b8ad06c33ffc54c8f429cc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\ 795dd6a9fc5a03faf56abb6b828664ff572ce55f22b8ad06c33ffc54c8f429cc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\ 795dd6a9fc5a03faf56abb6b828664ff572ce55f22b8ad06c33ffc54c8f429cc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\ 795dd6a9fc5a03faf56abb6b828664ff572ce55f22b8ad06c33ffc54c8f429cc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\ 795dd6a9fc5a03faf56abb6b828664ff572ce55f22b8ad06c33ffc54c8f429cc.exe - Suspicious behavior: EnumeratesProcesses 26 IoCs
pid Process 4400 795dd6a9fc5a03faf56abb6b828664ff572ce55f22b8ad06c33ffc54c8f429cc.exe 4400 795dd6a9fc5a03faf56abb6b828664ff572ce55f22b8ad06c33ffc54c8f429cc.exe 4400 795dd6a9fc5a03faf56abb6b828664ff572ce55f22b8ad06c33ffc54c8f429cc.exe 4400 795dd6a9fc5a03faf56abb6b828664ff572ce55f22b8ad06c33ffc54c8f429cc.exe 4400 795dd6a9fc5a03faf56abb6b828664ff572ce55f22b8ad06c33ffc54c8f429cc.exe 4400 795dd6a9fc5a03faf56abb6b828664ff572ce55f22b8ad06c33ffc54c8f429cc.exe 4400 795dd6a9fc5a03faf56abb6b828664ff572ce55f22b8ad06c33ffc54c8f429cc.exe 4400 795dd6a9fc5a03faf56abb6b828664ff572ce55f22b8ad06c33ffc54c8f429cc.exe 4400 795dd6a9fc5a03faf56abb6b828664ff572ce55f22b8ad06c33ffc54c8f429cc.exe 4400 795dd6a9fc5a03faf56abb6b828664ff572ce55f22b8ad06c33ffc54c8f429cc.exe 4400 795dd6a9fc5a03faf56abb6b828664ff572ce55f22b8ad06c33ffc54c8f429cc.exe 4400 795dd6a9fc5a03faf56abb6b828664ff572ce55f22b8ad06c33ffc54c8f429cc.exe 4400 795dd6a9fc5a03faf56abb6b828664ff572ce55f22b8ad06c33ffc54c8f429cc.exe 4400 795dd6a9fc5a03faf56abb6b828664ff572ce55f22b8ad06c33ffc54c8f429cc.exe 4400 795dd6a9fc5a03faf56abb6b828664ff572ce55f22b8ad06c33ffc54c8f429cc.exe 4400 795dd6a9fc5a03faf56abb6b828664ff572ce55f22b8ad06c33ffc54c8f429cc.exe 4400 795dd6a9fc5a03faf56abb6b828664ff572ce55f22b8ad06c33ffc54c8f429cc.exe 4400 795dd6a9fc5a03faf56abb6b828664ff572ce55f22b8ad06c33ffc54c8f429cc.exe 4400 795dd6a9fc5a03faf56abb6b828664ff572ce55f22b8ad06c33ffc54c8f429cc.exe 4400 795dd6a9fc5a03faf56abb6b828664ff572ce55f22b8ad06c33ffc54c8f429cc.exe 4400 795dd6a9fc5a03faf56abb6b828664ff572ce55f22b8ad06c33ffc54c8f429cc.exe 4400 795dd6a9fc5a03faf56abb6b828664ff572ce55f22b8ad06c33ffc54c8f429cc.exe 4400 795dd6a9fc5a03faf56abb6b828664ff572ce55f22b8ad06c33ffc54c8f429cc.exe 4400 795dd6a9fc5a03faf56abb6b828664ff572ce55f22b8ad06c33ffc54c8f429cc.exe 4400 795dd6a9fc5a03faf56abb6b828664ff572ce55f22b8ad06c33ffc54c8f429cc.exe 4400 795dd6a9fc5a03faf56abb6b828664ff572ce55f22b8ad06c33ffc54c8f429cc.exe - Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 4400 795dd6a9fc5a03faf56abb6b828664ff572ce55f22b8ad06c33ffc54c8f429cc.exe Token: SeManageVolumePrivilege 4400 795dd6a9fc5a03faf56abb6b828664ff572ce55f22b8ad06c33ffc54c8f429cc.exe Token: SeDebugPrivilege 4400 795dd6a9fc5a03faf56abb6b828664ff572ce55f22b8ad06c33ffc54c8f429cc.exe Token: SeDebugPrivilege 4400 795dd6a9fc5a03faf56abb6b828664ff572ce55f22b8ad06c33ffc54c8f429cc.exe Token: SeDebugPrivilege 4400 795dd6a9fc5a03faf56abb6b828664ff572ce55f22b8ad06c33ffc54c8f429cc.exe Token: SeDebugPrivilege 4400 795dd6a9fc5a03faf56abb6b828664ff572ce55f22b8ad06c33ffc54c8f429cc.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 4400 795dd6a9fc5a03faf56abb6b828664ff572ce55f22b8ad06c33ffc54c8f429cc.exe 4400 795dd6a9fc5a03faf56abb6b828664ff572ce55f22b8ad06c33ffc54c8f429cc.exe - Suspicious use of SendNotifyMessage 2 IoCs
pid Process 4400 795dd6a9fc5a03faf56abb6b828664ff572ce55f22b8ad06c33ffc54c8f429cc.exe 4400 795dd6a9fc5a03faf56abb6b828664ff572ce55f22b8ad06c33ffc54c8f429cc.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4400 795dd6a9fc5a03faf56abb6b828664ff572ce55f22b8ad06c33ffc54c8f429cc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\795dd6a9fc5a03faf56abb6b828664ff572ce55f22b8ad06c33ffc54c8f429cc.exe"C:\Users\Admin\AppData\Local\Temp\795dd6a9fc5a03faf56abb6b828664ff572ce55f22b8ad06c33ffc54c8f429cc.exe"1⤵
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4400
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\[email protected]
- Size 3KB
- SHA256 2832ed50a72d399a6254c90ff9f7270e2d1be49aa817a263ada2514ead4e2fbc
- MD5 c52d2816a093ed6b32ba835fd23bc736
- SHA1 fb7dbecbd2416a3fe015a5225d583a0a7b58a899
- SHA512 552fa9aa4ffdb30a2e87bcc34f15306b146f8c9cc193a3669bec454e7e8052b414e2ed24c04aa59bfedcb5b0e0efd1f3fdf9895f5ed78f1270c2d2218d5a7d8a
- TLSH T168715B6B4FA16997D6DB27391F9C0910804E3ED16A251E5B21B0D7E84873462FF2E4D4
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\[email protected]\computer_rescue_icon.png
- Size 838B
- SHA256 e4b839057fcf4fa07d8e84e1a83f1096cf36c89a2f19f692d4ffbfd0706c62b4
- MD5 3090d2de85382dff85b62ba401ad154a
- SHA1 ef99c36242f2b16b8f5c124bf045d435cec0858e
- SHA512 05d16c277259fdcfada9aa2bfdb88de1356e7b1384ea24686821af3bf3c127d4ed2c1f26aeb4b87d23747fa4ea6e46f95756c980bf7501221384495219149665
- TLSH T1D70186E2E150E79C889F36075B0F65915DA214C2A143694F3DFFE995490B4CACBE0B94
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\[email protected]\custom_wnd.ini
- Size 2KB
- SHA256 045219484debeafdcedb04e6fd0c914cb4db13a712b2abdad75b33696f28f7ac
- MD5 9b112c4f740a4e1454b5c799f858727d
- SHA1 40349402d12d0de24332a99baf007054f6d46b1d
- SHA512 5d2c68cd2fe2444100a1a3031d33b1f6c186384af40c943d711e5b39a29bf9592e59e45d5b35fab59415db86b5abd926ee58aadd857a3868672ff3e648a63907
- TLSH T1A241769726F99006F9B78B62EA7118B16B32BD52AC1CC50C69D0954D84EBD85C5333F3
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\[email protected]\setup.ini
- Size 1KB
- SHA256 4af4a1f4b694d484eebcf7c7ed98ec884a22667bd0f3013a2baa6a6a211ccf19
- MD5 100911b7bb17e8560e0f36d9410aa645
- SHA1 3a5ede84fcab95262b0ce11dcf2259ace3597860
- SHA512 950e8ab8b6f9bbec594171e1912719671c4406e718e7255815c11f8938ad98ed1d65826a9b1f20f638600ae60f5eb96a1e7f004697cc0847ab5610efdfcca075
- TLSH T14821674CCB4297E3FA114477B227DA65E9BF170280D2766CB4700C5C7B68967BA0C3CA
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\[email protected]\soft_manager_icon.png
- Size 646B
- SHA256 4c2639778afba2c0d782996ea8a80152ed25ac2a954f3d525960583bddd12090
- MD5 8f7051f0e9b7b4ce87f82dc64fc57972
- SHA1 77b7122ee16b8d7141323e5b66b7a2f390265bcd
- SHA512 6ebf53ed208c4d6840678074f23fec27735939a948f277f8bf6d2cd6888a13ec6086147d417daf5eab7c3887e2ca4dc64a23579e93238f186faec2d46f8a2501
- TLSH T17AF09ED1D429FAD9DC0F22174A140916BD9205C6158A5B5B8E95D026283FECD5664F44
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\{4652ED40-A20E-49f8-812E-4E9B5624D25A}.tmp\360P2SP.dll
- Size 688KB
- SHA256 0eca2e140f973b2011c633d4d92e512a1f77e1da610cfe0f4538c0b451270016
- MD5 d875875eb3282b692ab10e946ea22361
- SHA1 34bcef8a8cb0e1db44671892ac3cbd74d3c541a8
- SHA512 972466310d3c145141320584b5f3e431c6888bda2ba1036f85e68e534ed6fb97ba04cbd46d8d9c401dc5857100dc1bff1bad82b50514f3e5c582522f22fd2b5c
- SSDEEP 12288:1IhyxJ3BYXF6WxYC2aeHACRYlH+ZOAyTjUnIgidGtAd8Rwb33+YnBsLS683wK9T7:ih8WxYCyYlaOYnliItjRwbH+YBsLS68N
- TLSH T133E4AF1337C08035E2BB0675DE699225AAF9BC704A358A9F63D0854D7E74BC3CA35B63
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\{8B400944-2CBF-43a3-A958-4C40CF5E19FF}.tmp
- Size 297KB
- SHA256 0ba9a3e6e4b89ed8c30c092845ecab5939afe4c701a130fdc6ecc9d0ec1a8386
- MD5 8039c279a02fea0387e8d51bdde541d5
- SHA1 a6a52ef6c01fde3a1a1c702c41777119dbdb203a
- SHA512 97f45bf13ff85ad252b46c8e62d2d114e84b3aef17aa2e3b21ce47b41b416d2000506ee9bfabbc055295817ce6d7d9771a038acfae514cca852ef861751c7254
- SSDEEP 6144:dl5TTOp1tnABtoSIkutXiC3NxDPYhroRN6AxPM1CKSNEZ4:1TmTAB+XddZAahrKGT
- TLSH T136542314E26310EFF1451C9F7E53B9289ED2D8F0A85F46177CC8A1367B12E1037AEA69
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\{917D9C14-5C1A-43d0-BF5E-9C67F238FBFE}.tmp
- Size 1.3MB
- SHA256 aa02bd7ab8bbf1c1ab138c20d0d7ebb6b5f2e2166e2184405e54d619526e9ac8
- MD5 4f688c8a30e46a14a868f07e283763f2
- SHA1 ba736a93ef1f07b1c7c24f4201b632f1cb18e73a
- SHA512 8a1f679bfa7a1d5667fac931ef9184cbe76e30c26ed1a63e97ce4afd8815dc1409edb560ee91fd3db57aa0be10d6c567f43fe887440a09897de09cd8dc7ba88a
- SSDEEP 24576:S25OCGNlwNr5PL8MqxJTFl9YioVgxuz4Z0dTeLieM1V9QPjQw:B0N2NFL8VB9iiL0dTeOt23
- TLSH T19355335E5C31EA2875BDAB56720CE3908DF4B3EB18CE0768ED59C8FC51666A403AD10F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\{9E76E9D1-93C5-4ecd-9D7A-7DA3B9FB2557}.tmp
- Size 1KB
- SHA256 d82df7afa80ab17cf1d298488c66902f192034b6bb18176f5bd5c5b74e348e79
- MD5 402c9d31e2079948e743562cb48af2a6
- SHA1 5111e39a19e0675a44369e03d4a82132f0d12977
- SHA512 27510489faa6562507cbdb0b5f545d9124d6ba59d41a65224dd6089a9c8331279ce83905b26d41453255bda660fbaae957e0e17d43350dfcb86603888177c760
- TLSH T1CE31B59113E447B22CB47C34318EF4148D8E3E572D620F49BAAE3588E180BCF166083E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\{A44B7723-4283-41b8-B9C0-6B1983C61382}.tmp\sites.dll
- Size 1.4MB
- SHA256 c1eb83993c85e01ee6ae84eb6e05744ff8c3ccc02c41d09c22286e3012ef46fc
- MD5 a2ff2c72e739e0cf4c73b623444ca39d
- SHA1 ff886e63c894a20f30c136a8264cfa33d41b8331
- SHA512 844dab35a1625d5bf1bd814a36fb80d5670d3dfee5cf65ad8be53784b486dcc08898b7577a323c7c7e1e83655f861ea86c5453cfa4c3d55353d329ef3af6320b
- SSDEEP 24576:l4LEubC/9euoUCi82BbjSyM5hGfzmzJHXW+U0:UEubUo1i3eymhGfizJHK0
- TLSH T1BC65AE1237D1C57BC17E1371DA1AB3F697FAE2301A35A547A7C84B1C2F30A83D629A52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\{DDC82FBB-EAEA-424b-BEAB-7D8055F8440B}.tmp
- Size 15KB
- SHA256 cbf7cd45fe193e0a438ce14b0176077762e984f897091a682f9e866983da9174
- MD5 3641846128e0a27a28ca0dba8942b896
- SHA1 88c40c9923ab48e0c01883a773e297541ce49882
- SHA512 15910e5a279f17ea06618cb8dcbb64fe8f8e6f5061fc14bca6a92ff2795cf64eaceb2067104358a014079550ca1b4f24200935e2f10b1ede6622d94794047550
- SSDEEP 384:9SmRt7jn8csHkzjhJuCwQ19rtw5srwat0ADwP0F43ec1:dt7bjsHkBwCwseat0AkdOc1
- TLSH T15B72E1BC494C50FFADE75D93661D8019693FA23F8F3561AAAECFA8A547C380110826D3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\{E9DDFC75-F3FE-4897-AFA9-F262B256F330}.tmp
- Size 14KB
- SHA256 ee7f804a1c73b6d6935ff731ae87aefbbd1abe16dc5ff315c5d8d91e283c902d
- MD5 10af715dfb97b8a187f81555c8e6068b
- SHA1 c108e08d53a6ec711f1ba70fdbd7561ce483cbcd
- SHA512 fdca596438fdd60c88de69367abc70d6cbff318d8381eb4155fa257690f26d95c9a13131f676654bed27be458a6df67cbe1d713de9826cf955723f6a92fc5bbb
- SSDEEP 384:QTbAFSIp6FghLfaAEYlYifrkou/Z1DTn8O5zV7qh:QTkoIp68SW1Tk1Z1P8O5zch
- TLSH T11F52D0A6364116DD21F5EC2D306434C8FF548C39A62EC5A50FEF31D15EB052BA683B32
- MD5 SHA1 SHA512 SSDEEP TLSH