WitFoo-Artifact ::: message={"device_id":"18acc81076e241c088970c7453ac7d82","timestamp":"2023-11-28T00:40:56Z","behavior_id":"4748","filename":"GeoComplyUpdate.exe","filepath":"\\Device\\HarddiskVolume3\\Program Files (x86)\\GeoComply\\PlayerLocationCheck\\Update\\GeoComplyUpdate.exe","alleged_filetype":"exe","cmdline":"\"C:\\Program Files (x86)\\GeoComply\\\\PlayerLocationCheck\\Update\\GeoComplyUpdate.exe\" /config=C:\\Program Files (x86)\\GeoComply\\\\PlayerLocationCheck\\Update\\GeoComplyUpdate.xml","scenario":"NGAV","objective":"Falcon Detection Method","tactic":"Malware","tactic_id":"CSTA0001","technique":"PUP","technique_id":"CST0013","display_name":"Detect OnWrite Adware/PUP Hash","description":"A file written to the file-system was classified as Adware/PUP based on its SHA256 hash.","severity":30,"confidence":100,"ioc_type":"hash_sha256","ioc_value":"6c7b762db04c70d286c9fba229383ca55818c09e70dd53ff8174570214a772de","ioc_source":"file_write","ioc_description":"\\Device\\HarddiskVolume3\\Windows\\Temp\\tmp12032boscorpaa\\PlayerLocationCheck\\Application\\PlayerLocationCheck.exe","user_name":"alice","user_id":"S-1-5-18","control_graph_id":"ctg:18acc81076e241c088970c7453ac7d82:146029350302","triggering_process_graph_id":"pid:18acc81076e241c088970c7453ac7d82:1180399338305","sha256":"6c7b762db04c70d286c9fba229383ca55818c09e70dd53ff8174570214a772de","md5":"","parent_details":{"parent_sha256":"","parent_md5":"","parent_cmdline":"","parent_process_graph_id":""},"pattern_disposition":128,"pattern_disposition_details":{"indicator":false,"detect":false,"inddet_mask":false,"sensor_only":false,"rooting":false,"kill_process":false,"kill_subprocess":false,"quarantine_moscorpine":false,"quarantine_file":true,"policy_disabled":false,"kill_parent":false,"operation_blocked":false,"process_blocked":false,"registry_operation_blocked":false,"critical_process_disabled":false,"bootup_safeguard_enabled":false,"fs_operation_blocked":false,"handle_operation_downgraded":false,"kill_action_failed":false,"blocking_unsupported_or_disabled":false,"suspend_process":false,"suspend_parent":false}} ::: clientIP=2.35.19.214 ::: fileHash=6c7b762db04c70d286c9fba229383ca55818c09e70dd53ff8174570214a772de ::: fileName=GeoComplyUpdate.exe ::: filePath=\Device\HarddiskVolume3\Program Files (x86)\GeoComply\PlayerLocationCheck\Update\GeoComplyUpdate.exe ::: userName=alice ::: clientMAC=50eb71a0776a ::: created_at=2023-11-28T00:40:56Z ::: streamName=Crowdstrike Detection ::: messageType=endpoint_protection_event ::: pipelineName=Crowdstrike Detection ::: severityCode=4 ::: startTimeUTC=2023-11-28T00:40:56Z ::: clientHostname=PGRIMES-LT2.undefined ::: pipelineEntrypoint=dispatch
Product: Falcon
Vendor: Crowdstrike