Overview
overview
10Static
static
8ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
1ฺฺฺK...ฺฺ
windows10_x64
8ฺฺฺK...ฺฺ
windows10_x64
3ฺฺฺK...ฺฺ
windows10_x64
1ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
8ฺฺฺK...ฺฺ
windows10_x64
1ฺฺฺK...ฺฺ
windows10_x64
1ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
3ฺฺฺK...ฺฺ
windows10_x64
8ฺฺฺK...ฺฺ
windows10_x64
3ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
8ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
1ฺฺฺK...ฺฺ
windows10_x64
1ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
1ฺฺฺK...ฺฺ
windows10_x64
4Resubmissions
18-11-2020 14:18
201118-dj27sn3f52 1018-11-2020 13:42
201118-1arz86e7w6 1018-11-2020 13:38
201118-n8jh228ctn 10Analysis
-
max time kernel
1793s -
max time network
356s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
18-11-2020 13:42
Static task
static1
Behavioral task
behavioral1
Sample
2019-09-02_22-41-10.bin.exe
Resource
win10v20201028
Behavioral task
behavioral2
Sample
31.bin.exe
Resource
win10v20201028
Behavioral task
behavioral3
Sample
3DMark 11 Advanced Edition.bin.exe
Resource
win10v20201028
Behavioral task
behavioral4
Sample
Archive.zip__ccacaxs2tbz2t6ob3e.bin.exe
Resource
win10v20201028
Behavioral task
behavioral5
Sample
CVE-2018-15982_PoC.swf
Resource
win10v20201028
Behavioral task
behavioral6
Sample
DiskInternals_Uneraser_v5_keygen.bin.exe
Resource
win10v20201028
Behavioral task
behavioral7
Sample
ForceOp 2.8.7 - By RaiSence.bin.exe
Resource
win10v20201028
Behavioral task
behavioral8
Sample
HYDRA.bin.exe
Resource
win10v20201028
Behavioral task
behavioral9
Sample
Keygen.bin.exe
Resource
win10v20201028
Behavioral task
behavioral10
Sample
LtHv0O2KZDK4M637.bin.exe
Resource
win10v20201028
Behavioral task
behavioral11
Sample
OnlineInstaller.bin.exe
Resource
win10v20201028
Behavioral task
behavioral12
Sample
Remouse.Micro.Micro.v3.5.3.serial.maker.by.aaocg.bin.exe
Resource
win10v20201028
Behavioral task
behavioral13
Sample
Treasure.Vault.3D.Screensaver.keygen.by.Paradox.bin.exe
Resource
win10v20201028
Behavioral task
behavioral14
Sample
VyprVPN.exe
Resource
win10v20201028
Behavioral task
behavioral15
Sample
WSHSetup[1].bin.exe
Resource
win10v20201028
Behavioral task
behavioral16
Sample
api.exe
Resource
win10v20201028
Behavioral task
behavioral17
Sample
efd97b1038e063779fb32a3ab35adc481679a5c6c8e3f4f69c44987ff08b6ea4.js
Resource
win10v20201028
Behavioral task
behavioral18
Sample
good.bin.exe
Resource
win10v20201028
Behavioral task
behavioral19
Sample
infected dot net installer.bin.exe
Resource
win10v20201028
Behavioral task
behavioral20
Sample
update.bin.exe
Resource
win10v20201028
Behavioral task
behavioral21
Sample
vir1.xls
Resource
win10v20201028
Behavioral task
behavioral22
Sample
xNet.dll
Resource
win10v20201028
Behavioral task
behavioral23
Sample
1.bin.exe
Resource
win10v20201028
Behavioral task
behavioral24
Sample
VPN/VyprVPN.exe
Resource
win10v20201028
Behavioral task
behavioral25
Sample
VPN/xNet.dll
Resource
win10v20201028
Behavioral task
behavioral26
Sample
WSHSetup[1].bin.exe
Resource
win10v20201028
General
-
Target
VPN/VyprVPN.exe
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 2 IoCs
Processes:
Clipper.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, C:\\Users\\Admin\\WinService.exe" Clipper.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, C:\\Users\\Admin\\WinService.exe" Clipper.exe -
Executes dropped EXE 35 IoCs
Processes:
joinResult.exeVyprVPN.exe1111.exeClipper.exeWinService.exeWinService.exeWinService.exeWinService.exeWinService.exeWinService.exeWinService.exeWinService.exeWinService.exeWinService.exeWinService.exeWinService.exeWinService.exeWinService.exeWinService.exeWinService.exeWinService.exeWinService.exeWinService.exeWinService.exeWinService.exeWinService.exeWinService.exeWinService.exeWinService.exeWinService.exeWinService.exeWinService.exeWinService.exeWinService.exeWinService.exepid process 2096 joinResult.exe 2164 VyprVPN.exe 4048 1111.exe 4012 Clipper.exe 3460 WinService.exe 3332 WinService.exe 3764 WinService.exe 1824 WinService.exe 944 WinService.exe 2600 WinService.exe 2244 WinService.exe 2572 WinService.exe 1316 WinService.exe 2344 WinService.exe 580 WinService.exe 684 WinService.exe 744 WinService.exe 4016 WinService.exe 3860 WinService.exe 2520 WinService.exe 2612 WinService.exe 3612 WinService.exe 2892 WinService.exe 3372 WinService.exe 4040 WinService.exe 3240 WinService.exe 2592 WinService.exe 1852 WinService.exe 2496 WinService.exe 2604 WinService.exe 2092 WinService.exe 1996 WinService.exe 3088 WinService.exe 3368 WinService.exe 492 WinService.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
1111.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Control Panel\International\Geo\Nation 1111.exe -
Loads dropped DLL 2 IoCs
Processes:
VyprVPN.exejoinResult.exepid process 3412 VyprVPN.exe 2096 joinResult.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
1111.exepid process 4048 1111.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
NSIS installer 4 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Roaming\1337\joinResult.exe nsis_installer_1 C:\Users\Admin\AppData\Roaming\1337\joinResult.exe nsis_installer_2 C:\Users\Admin\AppData\Roaming\1337\joinResult.exe nsis_installer_1 C:\Users\Admin\AppData\Roaming\1337\joinResult.exe nsis_installer_2 -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Modifies registry class 33 IoCs
Processes:
VyprVPN.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\NodeSlot = "2" VyprVPN.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU VyprVPN.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656} VyprVPN.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0" VyprVPN.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16" VyprVPN.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2 VyprVPN.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Documents" VyprVPN.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance VyprVPN.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4" VyprVPN.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616257" VyprVPN.exe Set value (data) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 14001f50e04fd020ea3a6910a2d808002b30309d0000 VyprVPN.exe Set value (data) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0 = 14002e80922b16d365937a46956b92703aca08af0000 VyprVPN.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags VyprVPN.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1" VyprVPN.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0" VyprVPN.exe Set value (data) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202 VyprVPN.exe Set value (data) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\MRUListEx = ffffffff VyprVPN.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance VyprVPN.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg VyprVPN.exe Set value (data) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000007800000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 VyprVPN.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings VyprVPN.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 VyprVPN.exe Set value (data) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff VyprVPN.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\LogicalViewMode = "1" VyprVPN.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1" VyprVPN.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell VyprVPN.exe Set value (data) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 00000000ffffffff VyprVPN.exe Set value (data) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 VyprVPN.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" VyprVPN.exe Set value (data) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 VyprVPN.exe Set value (data) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff VyprVPN.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0 VyprVPN.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell VyprVPN.exe -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
1111.exepid process 4048 1111.exe 4048 1111.exe -
Suspicious use of AdjustPrivilegeToken 32 IoCs
Processes:
Clipper.exeWinService.exeWinService.exeWinService.exeWinService.exeWinService.exeWinService.exeWinService.exeWinService.exeWinService.exeWinService.exeWinService.exeWinService.exeWinService.exeWinService.exeWinService.exeWinService.exeWinService.exeWinService.exeWinService.exeWinService.exeWinService.exeWinService.exeWinService.exeWinService.exeWinService.exeWinService.exeWinService.exeWinService.exeWinService.exeWinService.exeWinService.exedescription pid process Token: SeDebugPrivilege 4012 Clipper.exe Token: SeDebugPrivilege 3460 WinService.exe Token: SeDebugPrivilege 3332 WinService.exe Token: SeDebugPrivilege 3764 WinService.exe Token: SeDebugPrivilege 1824 WinService.exe Token: SeDebugPrivilege 944 WinService.exe Token: SeDebugPrivilege 2600 WinService.exe Token: SeDebugPrivilege 2244 WinService.exe Token: SeDebugPrivilege 2572 WinService.exe Token: SeDebugPrivilege 1316 WinService.exe Token: SeDebugPrivilege 2344 WinService.exe Token: SeDebugPrivilege 580 WinService.exe Token: SeDebugPrivilege 684 WinService.exe Token: SeDebugPrivilege 744 WinService.exe Token: SeDebugPrivilege 4016 WinService.exe Token: SeDebugPrivilege 3860 WinService.exe Token: SeDebugPrivilege 2520 WinService.exe Token: SeDebugPrivilege 2612 WinService.exe Token: SeDebugPrivilege 3612 WinService.exe Token: SeDebugPrivilege 2892 WinService.exe Token: SeDebugPrivilege 3372 WinService.exe Token: SeDebugPrivilege 4040 WinService.exe Token: SeDebugPrivilege 3240 WinService.exe Token: SeDebugPrivilege 2592 WinService.exe Token: SeDebugPrivilege 1852 WinService.exe Token: SeDebugPrivilege 2496 WinService.exe Token: SeDebugPrivilege 2604 WinService.exe Token: SeDebugPrivilege 2092 WinService.exe Token: SeDebugPrivilege 1996 WinService.exe Token: SeDebugPrivilege 3088 WinService.exe Token: SeDebugPrivilege 3368 WinService.exe Token: SeDebugPrivilege 492 WinService.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
1111.exeVyprVPN.exepid process 4048 1111.exe 2164 VyprVPN.exe 2164 VyprVPN.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
VyprVPN.exejoinResult.exeClipper.exe1111.execmd.exedescription pid process target process PID 3412 wrote to memory of 2096 3412 VyprVPN.exe joinResult.exe PID 3412 wrote to memory of 2096 3412 VyprVPN.exe joinResult.exe PID 3412 wrote to memory of 2096 3412 VyprVPN.exe joinResult.exe PID 3412 wrote to memory of 2164 3412 VyprVPN.exe VyprVPN.exe PID 3412 wrote to memory of 2164 3412 VyprVPN.exe VyprVPN.exe PID 3412 wrote to memory of 2164 3412 VyprVPN.exe VyprVPN.exe PID 2096 wrote to memory of 4048 2096 joinResult.exe 1111.exe PID 2096 wrote to memory of 4048 2096 joinResult.exe 1111.exe PID 2096 wrote to memory of 4048 2096 joinResult.exe 1111.exe PID 2096 wrote to memory of 4012 2096 joinResult.exe Clipper.exe PID 2096 wrote to memory of 4012 2096 joinResult.exe Clipper.exe PID 4012 wrote to memory of 2908 4012 Clipper.exe schtasks.exe PID 4012 wrote to memory of 2908 4012 Clipper.exe schtasks.exe PID 4012 wrote to memory of 3460 4012 Clipper.exe WinService.exe PID 4012 wrote to memory of 3460 4012 Clipper.exe WinService.exe PID 4048 wrote to memory of 3988 4048 1111.exe cmd.exe PID 4048 wrote to memory of 3988 4048 1111.exe cmd.exe PID 4048 wrote to memory of 3988 4048 1111.exe cmd.exe PID 3988 wrote to memory of 2088 3988 cmd.exe PING.EXE PID 3988 wrote to memory of 2088 3988 cmd.exe PING.EXE PID 3988 wrote to memory of 2088 3988 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\VPN\VyprVPN.exe"C:\Users\Admin\AppData\Local\Temp\VPN\VyprVPN.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\1337\joinResult.exe"C:\Users\Admin\AppData\Roaming\1337\joinResult.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\1337\1111.exe"C:\Users\Admin\AppData\Roaming\1337\1111.exe"3⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd.exe /C ping 1.1.1.1 -n 3 -w 3000 > Nul & Del /f /q "C:\Users\Admin\AppData\Roaming\1337\1111.exe"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping 1.1.1.1 -n 3 -w 30005⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Roaming\1337\Clipper.exe"C:\Users\Admin\AppData\Roaming\1337\Clipper.exe"3⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /sc MINUTE /mo 1 /tn "Windows Service" /tr "C:\Users\Admin\WinService.exe" /f4⤵
- Creates scheduled task(s)
-
C:\Users\Admin\WinService.exe"C:\Users\Admin\WinService.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\1337\VyprVPN.exe"C:\Users\Admin\AppData\Roaming\1337\VyprVPN.exe"2⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\WinService.exeC:\Users\Admin\WinService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\WinService.exeC:\Users\Admin\WinService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\WinService.exeC:\Users\Admin\WinService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\WinService.exeC:\Users\Admin\WinService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\WinService.exeC:\Users\Admin\WinService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}1⤵
-
C:\Users\Admin\WinService.exeC:\Users\Admin\WinService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\WinService.exeC:\Users\Admin\WinService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\WinService.exeC:\Users\Admin\WinService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\WinService.exeC:\Users\Admin\WinService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\WinService.exeC:\Users\Admin\WinService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\WinService.exeC:\Users\Admin\WinService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\WinService.exeC:\Users\Admin\WinService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\WinService.exeC:\Users\Admin\WinService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\WinService.exeC:\Users\Admin\WinService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\WinService.exeC:\Users\Admin\WinService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\WinService.exeC:\Users\Admin\WinService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\WinService.exeC:\Users\Admin\WinService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\WinService.exeC:\Users\Admin\WinService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\WinService.exeC:\Users\Admin\WinService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\WinService.exeC:\Users\Admin\WinService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\WinService.exeC:\Users\Admin\WinService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\WinService.exeC:\Users\Admin\WinService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\WinService.exeC:\Users\Admin\WinService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\WinService.exeC:\Users\Admin\WinService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\WinService.exeC:\Users\Admin\WinService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\WinService.exeC:\Users\Admin\WinService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\WinService.exeC:\Users\Admin\WinService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\WinService.exeC:\Users\Admin\WinService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\WinService.exeC:\Users\Admin\WinService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\WinService.exeC:\Users\Admin\WinService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\1337\1111.exe
-
C:\Users\Admin\AppData\Roaming\1337\1111.exe
-
C:\Users\Admin\AppData\Roaming\1337\Clipper.exe
-
C:\Users\Admin\AppData\Roaming\1337\Clipper.exe
-
C:\Users\Admin\AppData\Roaming\1337\VyprVPN.exe
-
C:\Users\Admin\AppData\Roaming\1337\VyprVPN.exe
-
C:\Users\Admin\AppData\Roaming\1337\joinResult.exeMD5
79022fbafee9fe740a5230f87bd33171
SHA142bf0f7bf41009fd0009535a8b1162cbe60dce6f
SHA256640c30cfa519be11c02c4e51bf18979a93266887cc9ef19076b3d0f1f20528b6
SHA51248e0d4a18d99dce4398de73895a157e13293115b52ee5158f9ea6fc73c4d5f4133e1cebba14ff5482b8c4f7dfeebfe3b003df1caf351314f1cc16944818df4b3
-
C:\Users\Admin\AppData\Roaming\1337\joinResult.exeMD5
79022fbafee9fe740a5230f87bd33171
SHA142bf0f7bf41009fd0009535a8b1162cbe60dce6f
SHA256640c30cfa519be11c02c4e51bf18979a93266887cc9ef19076b3d0f1f20528b6
SHA51248e0d4a18d99dce4398de73895a157e13293115b52ee5158f9ea6fc73c4d5f4133e1cebba14ff5482b8c4f7dfeebfe3b003df1caf351314f1cc16944818df4b3
-
C:\Users\Admin\WinService.exe
-
C:\Users\Admin\WinService.exe
-
C:\Users\Admin\WinService.exe
-
C:\Users\Admin\WinService.exe
-
C:\Users\Admin\WinService.exe
-
C:\Users\Admin\WinService.exe
-
C:\Users\Admin\WinService.exe
-
C:\Users\Admin\WinService.exe
-
C:\Users\Admin\WinService.exe
-
C:\Users\Admin\WinService.exe
-
C:\Users\Admin\WinService.exe
-
C:\Users\Admin\WinService.exe
-
C:\Users\Admin\WinService.exe
-
C:\Users\Admin\WinService.exe
-
C:\Users\Admin\WinService.exe
-
C:\Users\Admin\WinService.exe
-
C:\Users\Admin\WinService.exe
-
C:\Users\Admin\WinService.exe
-
C:\Users\Admin\WinService.exe
-
C:\Users\Admin\WinService.exe
-
C:\Users\Admin\WinService.exe
-
C:\Users\Admin\WinService.exe
-
C:\Users\Admin\WinService.exe
-
C:\Users\Admin\WinService.exe
-
C:\Users\Admin\WinService.exe
-
C:\Users\Admin\WinService.exe
-
C:\Users\Admin\WinService.exe
-
C:\Users\Admin\WinService.exe
-
C:\Users\Admin\WinService.exe
-
C:\Users\Admin\WinService.exe
-
C:\Users\Admin\WinService.exe
-
C:\Users\Admin\WinService.exe
-
\Users\Admin\AppData\Local\Temp\nsv2FB3.tmp\System.dll
-
\Users\Admin\AppData\Local\Temp\nsw3252.tmp\System.dll
-
memory/492-161-0x00007FFED9070000-0x00007FFED9A5C000-memory.dmpFilesize
9.9MB
-
memory/580-81-0x00007FFED9070000-0x00007FFED9A5C000-memory.dmpFilesize
9.9MB
-
memory/684-85-0x00007FFED9070000-0x00007FFED9A5C000-memory.dmpFilesize
9.9MB
-
memory/744-89-0x00007FFED9070000-0x00007FFED9A5C000-memory.dmpFilesize
9.9MB
-
memory/944-57-0x00007FFED9070000-0x00007FFED9A5C000-memory.dmpFilesize
9.9MB
-
memory/1316-73-0x00007FFED9070000-0x00007FFED9A5C000-memory.dmpFilesize
9.9MB
-
memory/1824-53-0x00007FFED9070000-0x00007FFED9A5C000-memory.dmpFilesize
9.9MB
-
memory/1852-133-0x00007FFED9070000-0x00007FFED9A5C000-memory.dmpFilesize
9.9MB
-
memory/1996-149-0x00007FFED9070000-0x00007FFED9A5C000-memory.dmpFilesize
9.9MB
-
memory/2088-36-0x0000000000000000-mapping.dmp
-
memory/2092-145-0x00007FFED9070000-0x00007FFED9A5C000-memory.dmpFilesize
9.9MB
-
memory/2096-1-0x0000000000000000-mapping.dmp
-
memory/2164-3-0x0000000000000000-mapping.dmp
-
memory/2164-9-0x0000000000550000-0x0000000000551000-memory.dmpFilesize
4KB
-
memory/2164-21-0x0000000005190000-0x0000000005191000-memory.dmpFilesize
4KB
-
memory/2164-27-0x00000000053A0000-0x00000000053A1000-memory.dmpFilesize
4KB
-
memory/2164-26-0x0000000005090000-0x0000000005091000-memory.dmpFilesize
4KB
-
memory/2164-8-0x0000000073B90000-0x000000007427E000-memory.dmpFilesize
6.9MB
-
memory/2164-15-0x00000000050F0000-0x00000000050F1000-memory.dmpFilesize
4KB
-
memory/2164-19-0x0000000005750000-0x0000000005751000-memory.dmpFilesize
4KB
-
memory/2244-65-0x00007FFED9070000-0x00007FFED9A5C000-memory.dmpFilesize
9.9MB
-
memory/2344-77-0x00007FFED9070000-0x00007FFED9A5C000-memory.dmpFilesize
9.9MB
-
memory/2496-137-0x00007FFED9070000-0x00007FFED9A5C000-memory.dmpFilesize
9.9MB
-
memory/2520-101-0x00007FFED9070000-0x00007FFED9A5C000-memory.dmpFilesize
9.9MB
-
memory/2572-69-0x00007FFED9070000-0x00007FFED9A5C000-memory.dmpFilesize
9.9MB
-
memory/2592-129-0x00007FFED9070000-0x00007FFED9A5C000-memory.dmpFilesize
9.9MB
-
memory/2600-61-0x00007FFED9070000-0x00007FFED9A5C000-memory.dmpFilesize
9.9MB
-
memory/2604-141-0x00007FFED9070000-0x00007FFED9A5C000-memory.dmpFilesize
9.9MB
-
memory/2612-105-0x00007FFED9070000-0x00007FFED9A5C000-memory.dmpFilesize
9.9MB
-
memory/2892-113-0x00007FFED9070000-0x00007FFED9A5C000-memory.dmpFilesize
9.9MB
-
memory/2908-28-0x0000000000000000-mapping.dmp
-
memory/3088-153-0x00007FFED9070000-0x00007FFED9A5C000-memory.dmpFilesize
9.9MB
-
memory/3240-125-0x00007FFED9070000-0x00007FFED9A5C000-memory.dmpFilesize
9.9MB
-
memory/3332-45-0x00007FFED9070000-0x00007FFED9A5C000-memory.dmpFilesize
9.9MB
-
memory/3368-157-0x00007FFED9070000-0x00007FFED9A5C000-memory.dmpFilesize
9.9MB
-
memory/3372-117-0x00007FFED9070000-0x00007FFED9A5C000-memory.dmpFilesize
9.9MB
-
memory/3460-32-0x00007FFED9070000-0x00007FFED9A5C000-memory.dmpFilesize
9.9MB
-
memory/3460-29-0x0000000000000000-mapping.dmp
-
memory/3612-109-0x00007FFED9070000-0x00007FFED9A5C000-memory.dmpFilesize
9.9MB
-
memory/3764-49-0x00007FFED9070000-0x00007FFED9A5C000-memory.dmpFilesize
9.9MB
-
memory/3860-97-0x00007FFED9070000-0x00007FFED9A5C000-memory.dmpFilesize
9.9MB
-
memory/3988-35-0x0000000000000000-mapping.dmp
-
memory/4012-14-0x0000000000000000-mapping.dmp
-
memory/4012-18-0x00007FFED9070000-0x00007FFED9A5C000-memory.dmpFilesize
9.9MB
-
memory/4012-24-0x0000000000550000-0x0000000000551000-memory.dmpFilesize
4KB
-
memory/4016-93-0x00007FFED9070000-0x00007FFED9A5C000-memory.dmpFilesize
9.9MB
-
memory/4040-121-0x00007FFED9070000-0x00007FFED9A5C000-memory.dmpFilesize
9.9MB
-
memory/4048-23-0x0000000003730000-0x0000000003731000-memory.dmpFilesize
4KB
-
memory/4048-22-0x0000000003630000-0x0000000003631000-memory.dmpFilesize
4KB
-
memory/4048-20-0x0000000003630000-0x0000000003631000-memory.dmpFilesize
4KB
-
memory/4048-11-0x0000000000000000-mapping.dmp