9ff2f5482a3aed8291c0808256511cdb788bffcd9300000d3d0240e01918ba27

General

Target

9ff2f5482a3aed8291c0808256511cdb788bffcd9300000d3d0240e01918ba27.exe
Size

235KB
MD5

d7d5c04bd235005cf3431729f0f52416
SHA1

08a83329a9d6c8b4fb59e364679e189e3840277a
SHA256

9ff2f5482a3aed8291c0808256511cdb788bffcd9300000d3d0240e01918ba27
SHA512

354d0255a29fb724fc909cdba32918b3bc27abadf19be26f5e6adeb4b57e04c6058e96287412312ee5e4449d0fdbd45ffb0f1a76179ac14e84e76bd052aa5d66

Score

9^/10

persistence

Malware Config

Signatures

ServiceHost packer 9 IoCs

Detects ServiceHost packer used for .NET malware

Processes:

resource	yara_rule
behavioral2/memory/3588-8-0x0000000000000000-mapping.dmp	servicehost
behavioral2/memory/3588-9-0x0000000000000000-mapping.dmp	servicehost
behavioral2/memory/3588-10-0x0000000000000000-mapping.dmp	servicehost
behavioral2/memory/3588-11-0x0000000000000000-mapping.dmp	servicehost
behavioral2/memory/3588-12-0x0000000000000000-mapping.dmp	servicehost
behavioral2/memory/3588-14-0x0000000000000000-mapping.dmp	servicehost
behavioral2/memory/3588-15-0x0000000000000000-mapping.dmp	servicehost
behavioral2/memory/3588-16-0x0000000000000000-mapping.dmp	servicehost
behavioral2/memory/3588-17-0x0000000000000000-mapping.dmp	servicehost

Executes dropped EXE 1 IoCs

Processes:

zyusc.exe

pid process

3588 zyusc.exe

pid	process
3588	zyusc.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

zyusc.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\Currentversion\Run	zyusc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\Puwoyweb = "C:\\Users\\Admin\\AppData\\Roaming\\Ywud\\zyusc.exe"	zyusc.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

9ff2f5482a3aed8291c0808256511cdb788bffcd9300000d3d0240e01918ba27.exe

description	pid	process	target process
PID 1056 set thread context of 3556	1056	9ff2f5482a3aed8291c0808256511cdb788bffcd9300000d3d0240e01918ba27.exe	cmd.exe

Program crash 29 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
584	1056	WerFault.exe	9ff2f5482a3aed8291c0808256511cdb788bffcd9300000d3d0240e01918ba27.exe
3292	1056	WerFault.exe	9ff2f5482a3aed8291c0808256511cdb788bffcd9300000d3d0240e01918ba27.exe
3012	3588	WerFault.exe	zyusc.exe
3656	3588	WerFault.exe	zyusc.exe
2052	1056	WerFault.exe	9ff2f5482a3aed8291c0808256511cdb788bffcd9300000d3d0240e01918ba27.exe
740	1056	WerFault.exe	9ff2f5482a3aed8291c0808256511cdb788bffcd9300000d3d0240e01918ba27.exe
3868	1056	WerFault.exe	9ff2f5482a3aed8291c0808256511cdb788bffcd9300000d3d0240e01918ba27.exe
2524	1056	WerFault.exe	9ff2f5482a3aed8291c0808256511cdb788bffcd9300000d3d0240e01918ba27.exe
616	1056	WerFault.exe	9ff2f5482a3aed8291c0808256511cdb788bffcd9300000d3d0240e01918ba27.exe
3796	3588	WerFault.exe	zyusc.exe
1276	1056	WerFault.exe	9ff2f5482a3aed8291c0808256511cdb788bffcd9300000d3d0240e01918ba27.exe
3352	3588	WerFault.exe	zyusc.exe
3820	1056	WerFault.exe	9ff2f5482a3aed8291c0808256511cdb788bffcd9300000d3d0240e01918ba27.exe
2492	3588	WerFault.exe	zyusc.exe
1192	1056	WerFault.exe	9ff2f5482a3aed8291c0808256511cdb788bffcd9300000d3d0240e01918ba27.exe
1340	3588	WerFault.exe	zyusc.exe
2260	3588	WerFault.exe	zyusc.exe
2240	3588	WerFault.exe	zyusc.exe
2888	3588	WerFault.exe	zyusc.exe
3328	3588	WerFault.exe	zyusc.exe
1668	3588	WerFault.exe	zyusc.exe
388	3588	WerFault.exe	zyusc.exe
4028	3588	WerFault.exe	zyusc.exe
3732	3588	WerFault.exe	zyusc.exe
2672	3588	WerFault.exe	zyusc.exe
2596	3588	WerFault.exe	zyusc.exe
3628	3588	WerFault.exe	zyusc.exe
2360	3588	WerFault.exe	zyusc.exe
2128	3588	WerFault.exe	zyusc.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

Processes:

9ff2f5482a3aed8291c0808256511cdb788bffcd9300000d3d0240e01918ba27.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Privacy	9ff2f5482a3aed8291c0808256511cdb788bffcd9300000d3d0240e01918ba27.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Privacy\CleanCookies = "0"	9ff2f5482a3aed8291c0808256511cdb788bffcd9300000d3d0240e01918ba27.exe

Suspicious behavior: EnumeratesProcesses 104 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exezyusc.exe

pid	process
584	WerFault.exe
584	WerFault.exe
584	WerFault.exe
584	WerFault.exe
584	WerFault.exe
584	WerFault.exe
584	WerFault.exe
584	WerFault.exe
584	WerFault.exe
584	WerFault.exe
584	WerFault.exe
584	WerFault.exe
584	WerFault.exe
584	WerFault.exe
3292	WerFault.exe
3292	WerFault.exe
3292	WerFault.exe
3292	WerFault.exe
3292	WerFault.exe
3292	WerFault.exe
3292	WerFault.exe
3292	WerFault.exe
3292	WerFault.exe
3292	WerFault.exe
3292	WerFault.exe
3292	WerFault.exe
3292	WerFault.exe
3292	WerFault.exe
3012	WerFault.exe
3012	WerFault.exe
3012	WerFault.exe
3012	WerFault.exe
3012	WerFault.exe
3012	WerFault.exe
3012	WerFault.exe
3012	WerFault.exe
3012	WerFault.exe
3012	WerFault.exe
3012	WerFault.exe
3012	WerFault.exe
3012	WerFault.exe
3012	WerFault.exe
3656	WerFault.exe
3656	WerFault.exe
3656	WerFault.exe
3656	WerFault.exe
3656	WerFault.exe
3656	WerFault.exe
3656	WerFault.exe
3656	WerFault.exe
3656	WerFault.exe
3656	WerFault.exe
3656	WerFault.exe
3656	WerFault.exe
3656	WerFault.exe
3656	WerFault.exe
3588	zyusc.exe
3588	zyusc.exe
3588	zyusc.exe
3588	zyusc.exe
3588	zyusc.exe
3588	zyusc.exe
3588	zyusc.exe
3588	zyusc.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

Processes:

WerFault.exeWerFault.exe9ff2f5482a3aed8291c0808256511cdb788bffcd9300000d3d0240e01918ba27.exeWerFault.exeWerFault.exe

description	pid	process
Token: SeRestorePrivilege	584	WerFault.exe
Token: SeBackupPrivilege	584	WerFault.exe
Token: SeDebugPrivilege	584	WerFault.exe
Token: SeDebugPrivilege	3292	WerFault.exe
Token: SeSecurityPrivilege	1056	9ff2f5482a3aed8291c0808256511cdb788bffcd9300000d3d0240e01918ba27.exe
Token: SeSecurityPrivilege	1056	9ff2f5482a3aed8291c0808256511cdb788bffcd9300000d3d0240e01918ba27.exe
Token: SeDebugPrivilege	3012	WerFault.exe
Token: SeDebugPrivilege	3656	WerFault.exe
Token: SeSecurityPrivilege	1056	9ff2f5482a3aed8291c0808256511cdb788bffcd9300000d3d0240e01918ba27.exe
Token: SeSecurityPrivilege	1056	9ff2f5482a3aed8291c0808256511cdb788bffcd9300000d3d0240e01918ba27.exe

Suspicious use of WriteProcessMemory 74 IoCs

Processes:

9ff2f5482a3aed8291c0808256511cdb788bffcd9300000d3d0240e01918ba27.exezyusc.exe

description	pid	process	target process
PID 1056 wrote to memory of 3588	1056	9ff2f5482a3aed8291c0808256511cdb788bffcd9300000d3d0240e01918ba27.exe	zyusc.exe
PID 1056 wrote to memory of 3588	1056	9ff2f5482a3aed8291c0808256511cdb788bffcd9300000d3d0240e01918ba27.exe	zyusc.exe
PID 1056 wrote to memory of 3588	1056	9ff2f5482a3aed8291c0808256511cdb788bffcd9300000d3d0240e01918ba27.exe	zyusc.exe
PID 3588 wrote to memory of 2332	3588	zyusc.exe	sihost.exe
PID 3588 wrote to memory of 2332	3588	zyusc.exe	sihost.exe
PID 3588 wrote to memory of 2332	3588	zyusc.exe	sihost.exe
PID 3588 wrote to memory of 2332	3588	zyusc.exe	sihost.exe
PID 3588 wrote to memory of 2332	3588	zyusc.exe	sihost.exe
PID 3588 wrote to memory of 2340	3588	zyusc.exe	svchost.exe
PID 3588 wrote to memory of 2340	3588	zyusc.exe	svchost.exe
PID 3588 wrote to memory of 2340	3588	zyusc.exe	svchost.exe
PID 3588 wrote to memory of 2340	3588	zyusc.exe	svchost.exe
PID 3588 wrote to memory of 2340	3588	zyusc.exe	svchost.exe
PID 3588 wrote to memory of 2516	3588	zyusc.exe	taskhostw.exe
PID 3588 wrote to memory of 2516	3588	zyusc.exe	taskhostw.exe
PID 3588 wrote to memory of 2516	3588	zyusc.exe	taskhostw.exe
PID 3588 wrote to memory of 2516	3588	zyusc.exe	taskhostw.exe
PID 3588 wrote to memory of 2516	3588	zyusc.exe	taskhostw.exe
PID 3588 wrote to memory of 3040	3588	zyusc.exe	Explorer.EXE
PID 3588 wrote to memory of 3040	3588	zyusc.exe	Explorer.EXE
PID 3588 wrote to memory of 3040	3588	zyusc.exe	Explorer.EXE
PID 3588 wrote to memory of 3040	3588	zyusc.exe	Explorer.EXE
PID 3588 wrote to memory of 3040	3588	zyusc.exe	Explorer.EXE
PID 3588 wrote to memory of 3264	3588	zyusc.exe	ShellExperienceHost.exe
PID 3588 wrote to memory of 3264	3588	zyusc.exe	ShellExperienceHost.exe
PID 3588 wrote to memory of 3264	3588	zyusc.exe	ShellExperienceHost.exe
PID 3588 wrote to memory of 3264	3588	zyusc.exe	ShellExperienceHost.exe
PID 3588 wrote to memory of 3264	3588	zyusc.exe	ShellExperienceHost.exe
PID 3588 wrote to memory of 3276	3588	zyusc.exe	SearchUI.exe
PID 3588 wrote to memory of 3276	3588	zyusc.exe	SearchUI.exe
PID 3588 wrote to memory of 3276	3588	zyusc.exe	SearchUI.exe
PID 3588 wrote to memory of 3276	3588	zyusc.exe	SearchUI.exe
PID 3588 wrote to memory of 3276	3588	zyusc.exe	SearchUI.exe
PID 3588 wrote to memory of 3500	3588	zyusc.exe	RuntimeBroker.exe
PID 3588 wrote to memory of 3500	3588	zyusc.exe	RuntimeBroker.exe
PID 3588 wrote to memory of 3500	3588	zyusc.exe	RuntimeBroker.exe
PID 3588 wrote to memory of 3500	3588	zyusc.exe	RuntimeBroker.exe
PID 3588 wrote to memory of 3500	3588	zyusc.exe	RuntimeBroker.exe
PID 3588 wrote to memory of 3788	3588	zyusc.exe	DllHost.exe
PID 3588 wrote to memory of 3788	3588	zyusc.exe	DllHost.exe
PID 3588 wrote to memory of 3788	3588	zyusc.exe	DllHost.exe
PID 3588 wrote to memory of 3788	3588	zyusc.exe	DllHost.exe
PID 3588 wrote to memory of 3788	3588	zyusc.exe	DllHost.exe
PID 3588 wrote to memory of 1056	3588	zyusc.exe	9ff2f5482a3aed8291c0808256511cdb788bffcd9300000d3d0240e01918ba27.exe
PID 3588 wrote to memory of 1056	3588	zyusc.exe	9ff2f5482a3aed8291c0808256511cdb788bffcd9300000d3d0240e01918ba27.exe
PID 3588 wrote to memory of 1056	3588	zyusc.exe	9ff2f5482a3aed8291c0808256511cdb788bffcd9300000d3d0240e01918ba27.exe
PID 3588 wrote to memory of 1056	3588	zyusc.exe	9ff2f5482a3aed8291c0808256511cdb788bffcd9300000d3d0240e01918ba27.exe
PID 3588 wrote to memory of 1056	3588	zyusc.exe	9ff2f5482a3aed8291c0808256511cdb788bffcd9300000d3d0240e01918ba27.exe
PID 3588 wrote to memory of 1232	3588	zyusc.exe
PID 3588 wrote to memory of 1232	3588	zyusc.exe
PID 3588 wrote to memory of 1232	3588	zyusc.exe
PID 3588 wrote to memory of 1232	3588	zyusc.exe
PID 3588 wrote to memory of 1232	3588	zyusc.exe
PID 1056 wrote to memory of 3556	1056	9ff2f5482a3aed8291c0808256511cdb788bffcd9300000d3d0240e01918ba27.exe	cmd.exe
PID 1056 wrote to memory of 3556	1056	9ff2f5482a3aed8291c0808256511cdb788bffcd9300000d3d0240e01918ba27.exe	cmd.exe
PID 1056 wrote to memory of 3556	1056	9ff2f5482a3aed8291c0808256511cdb788bffcd9300000d3d0240e01918ba27.exe	cmd.exe
PID 1056 wrote to memory of 3556	1056	9ff2f5482a3aed8291c0808256511cdb788bffcd9300000d3d0240e01918ba27.exe	cmd.exe
PID 1056 wrote to memory of 3556	1056	9ff2f5482a3aed8291c0808256511cdb788bffcd9300000d3d0240e01918ba27.exe	cmd.exe
PID 1056 wrote to memory of 3556	1056	9ff2f5482a3aed8291c0808256511cdb788bffcd9300000d3d0240e01918ba27.exe	cmd.exe
PID 1056 wrote to memory of 3556	1056	9ff2f5482a3aed8291c0808256511cdb788bffcd9300000d3d0240e01918ba27.exe	cmd.exe
PID 1056 wrote to memory of 3556	1056	9ff2f5482a3aed8291c0808256511cdb788bffcd9300000d3d0240e01918ba27.exe	cmd.exe
PID 3588 wrote to memory of 2252	3588	zyusc.exe	Conhost.exe
PID 3588 wrote to memory of 2252	3588	zyusc.exe	Conhost.exe
PID 3588 wrote to memory of 2252	3588	zyusc.exe	Conhost.exe

c:\windows\system32\sihost.exe
sihost.exe
1⤵
PID:2332

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k unistacksvcgroup -s CDPUserSvc
1⤵
PID:2340

c:\windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2516

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3040

C:\Users\Admin\AppData\Local\Temp\9ff2f5482a3aed8291c0808256511cdb788bffcd9300000d3d0240e01918ba27.exe
"C:\Users\Admin\AppData\Local\Temp\9ff2f5482a3aed8291c0808256511cdb788bffcd9300000d3d0240e01918ba27.exe"
2⤵
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1056

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1056 -s 672
3⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:584

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1056 -s 708
3⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3292

C:\Users\Admin\AppData\Roaming\Ywud\zyusc.exe
"C:\Users\Admin\AppData\Roaming\Ywud\zyusc.exe"
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3588

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 664
4⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3012

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 636
4⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3656

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 804
4⤵
- Program crash
PID:3796

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 876
4⤵
- Program crash
PID:3352

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 760
4⤵
- Program crash
PID:2492

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 880
4⤵
- Program crash
PID:1340

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 836
4⤵
- Program crash
PID:2260

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 948
4⤵
- Program crash
PID:2240

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 772
4⤵
- Program crash
PID:2888

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 768
4⤵
- Program crash
PID:3328

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 1008
4⤵
- Program crash
PID:1668

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 1040
4⤵
- Program crash
PID:388

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 1140
4⤵
- Program crash
PID:4028

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 1212
4⤵
- Program crash
PID:3732

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 784
4⤵
- Program crash
PID:2672

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 1132
4⤵
- Program crash
PID:2596

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 1312
4⤵
- Program crash
PID:3628

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 1480
4⤵
- Program crash
PID:2360

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 1488
4⤵
- Program crash
PID:2128

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1056 -s 372
3⤵
- Program crash
PID:2052

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1056 -s 832
3⤵
- Program crash
PID:740

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1056 -s 844
3⤵
- Program crash
PID:3868

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1056 -s 848
3⤵
- Program crash
PID:2524

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1056 -s 924
3⤵
- Program crash
PID:616

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmpe7033ab8.bat"
3⤵
PID:3556

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
4⤵
PID:2252

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1056 -s 936
3⤵
- Program crash
PID:1276

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1056 -s 824
3⤵
- Program crash
PID:3820

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1056 -s 264
3⤵
- Program crash
PID:1192

C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe
"C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca
1⤵
PID:3264

C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe
"C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca
1⤵
PID:3276

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3500

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3788

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppXy7vb4pc2dr3kc93kfc509b1d0arkfb2x.mca
1⤵
PID:3320

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Puriv\orna.hen
MD5
308e41a8b4ef824e3b9d3279b8bbdaee

SHA1
43f19c1b88b59aede0c949842ea42eac685320dc

SHA256
6e533992484702164e377c32b3a32fe908d8871829b3d2821fbdddc8ad8f4b45

SHA512
7ee1c4dbc26cd0540d7342133db7460f482168417ef537f27aaa8d3bb59ed9efc0fc3cd1fc32bd31625ded71882d9054d5c0936683fa4d554b2a62435ec342dc

Download Submit
C:\Users\Admin\AppData\Roaming\Ywud\zyusc.exe
MD5
9e75d65568a5cf4f22bb0fb0a9bf9332

SHA1
1388e6792f112e1ab184c69ba3c64e4275621567

SHA256
12f51b2cd8a168941a281972cfbab95f8cf0a8d9428b6bea7e8b50cb32197c46

SHA512
70e276304c8f70c2f7b39760b94f9392a2a691ad4dad129155617ff02aa93d0e6d1ea94053bd10a881777d81b8bf4dc0192e704729d78ab2412b75fd5492590c

Download Submit
C:\Users\Admin\AppData\Roaming\Ywud\zyusc.exe
MD5
9e75d65568a5cf4f22bb0fb0a9bf9332

SHA1
1388e6792f112e1ab184c69ba3c64e4275621567

SHA256
12f51b2cd8a168941a281972cfbab95f8cf0a8d9428b6bea7e8b50cb32197c46

SHA512
70e276304c8f70c2f7b39760b94f9392a2a691ad4dad129155617ff02aa93d0e6d1ea94053bd10a881777d81b8bf4dc0192e704729d78ab2412b75fd5492590c

Download Submit
memory/584-1-0x0000000004E40000-0x0000000004E41000-memory.dmp

Filesize
4KB

Download
memory/584-0-0x0000000004690000-0x0000000004691000-memory.dmp

Filesize
4KB

Download
memory/1056-28-0x0000000000080000-0x00000000000BB000-memory.dmp

Filesize
236KB

Download
memory/3012-13-0x0000000004820000-0x0000000004821000-memory.dmp

Filesize
4KB

Download
memory/3012-7-0x00000000043E0000-0x00000000043E1000-memory.dmp

Filesize
4KB

Download
memory/3292-2-0x00000000048C0000-0x00000000048C1000-memory.dmp

Filesize
4KB

Download
memory/3292-3-0x0000000004EF0000-0x0000000004EF1000-memory.dmp

Filesize
4KB

Download
memory/3556-30-0x000000000012EA5B-mapping.dmp

Download
memory/3556-29-0x0000000000120000-0x000000000015B000-memory.dmp

Filesize
236KB

Download
memory/3588-16-0x0000000000000000-mapping.dmp

Download
memory/3588-21-0x0000000000000000-mapping.dmp

Download
memory/3588-14-0x0000000000000000-mapping.dmp

Download
memory/3588-15-0x0000000000000000-mapping.dmp

Download
memory/3588-11-0x0000000000000000-mapping.dmp

Download
memory/3588-17-0x0000000000000000-mapping.dmp

Download
memory/3588-4-0x0000000000000000-mapping.dmp

Download
memory/3588-19-0x0000000000000000-mapping.dmp

Download
memory/3588-20-0x0000000000000000-mapping.dmp

Download
memory/3588-12-0x0000000000000000-mapping.dmp

Download
memory/3588-22-0x0000000000000000-mapping.dmp

Download
memory/3588-8-0x0000000000000000-mapping.dmp

Download
memory/3588-24-0x0000000000000000-mapping.dmp

Download
memory/3588-25-0x0000000000000000-mapping.dmp

Download
memory/3588-26-0x0000000000000000-mapping.dmp

Download
memory/3588-27-0x0000000000000000-mapping.dmp

Download
memory/3588-10-0x0000000000000000-mapping.dmp

Download
memory/3588-9-0x0000000000000000-mapping.dmp

Download
memory/3656-23-0x0000000004E90000-0x0000000004E91000-memory.dmp

Filesize
4KB

Download
memory/3656-18-0x0000000004760000-0x0000000004761000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads