Analysis
-
max time kernel
1794s -
max time network
1799s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
15-02-2021 09:59
Static task
static1
Behavioral task
behavioral1
Sample
pass 12345...Kepserverex_5_5_14_493_crack_by_CORE.exe
Resource
win10v20201028
Behavioral task
behavioral2
Sample
pass 12345...Kepserverex_5_5_14_493_crack_by_CORE.exe
Resource
win10v20201028
Behavioral task
behavioral3
Sample
pass 12345...Kepserverex_5_5_14_493_crack_by_CORE.exe
Resource
win7v20201028
Behavioral task
behavioral4
Sample
pass 12345...Kepserverex_5_5_14_493_crack_by_CORE.exe
Resource
win10v20201028
General
-
Target
pass 12345...Kepserverex_5_5_14_493_crack_by_CORE.exe
-
Size
9.0MB
-
MD5
10a7ec6eec9d29e7cf84477015651b65
-
SHA1
c6b132ff8919f5da4959d68b5a9cf86919ccebee
-
SHA256
a252756f1326333e8587740cfecad63d80ffd26dd49d6b9699d685fb5096b730
-
SHA512
34c53db9f782e6899004673c3c531b58aacc2153554fd2ca06b47d80d21f8d536912f4ec7f7336738e24b034f5a567b32cf99015ee8c01259902b63a86722aaa
Malware Config
Extracted
azorult
http://kvaka.li/1210776429.php
Signatures
-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 2 IoCs
resource yara_rule behavioral1/memory/5104-221-0x0000000000400000-0x000000000042C000-memory.dmp family_redline behavioral1/memory/5104-222-0x0000000000423FCA-mapping.dmp family_redline -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
Nirsoft 4 IoCs
resource yara_rule behavioral1/files/0x0003000000015669-60.dat Nirsoft behavioral1/files/0x0003000000015669-58.dat Nirsoft behavioral1/files/0x00040000000197fe-70.dat Nirsoft behavioral1/files/0x00040000000197fe-71.dat Nirsoft -
Executes dropped EXE 35 IoCs
pid Process 2492 keygen-pr.exe 2300 keygen-step-1.exe 1240 keygen-step-3.exe 1280 keygen-step-4.exe 1092 key.exe 540 Setup.exe 1740 6489A2274AE24900.exe 1900 6489A2274AE24900.exe 1020 md2_2efs.exe 416 1613386588361.exe 1772 1613386590642.exe 4016 ThunderFW.exe 580 file.exe 1780 6717.tmp.exe 636 6803.tmp.exe 3996 68BF.tmp.exe 2076 6717.tmp.exe 3552 BTRSetp.exe 3260 installer.exe 3872 716824.7 3160 5199473.57 3388 3100462.34 4124 5484099.60 4256 Windows Host.exe 4420 gdrrr.exe 4544 jfiag3g_gg.exe 4656 jfiag3g_gg.exe 5104 6803.tmp.exe 4412 GDIView.exe 3264 GDIView.exe 1728 GDIView.exe 4636 GDIView.exe 4676 GDIView.exe 3308 jfiag3g_gg.exe 4884 jfiag3g_gg.exe -
resource yara_rule behavioral1/files/0x0002000000015614-31.dat office_xlm_macros -
resource yara_rule behavioral1/files/0x000100000001abb6-202.dat upx behavioral1/files/0x000100000001abb6-201.dat upx behavioral1/files/0x000200000001ab55-209.dat upx behavioral1/files/0x000200000001ab55-210.dat upx -
Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 3100462.34 Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 3100462.34 Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 5484099.60 Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 5484099.60 -
Loads dropped DLL 1 IoCs
pid Process 736 MsiExec.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral1/files/0x000100000001aba6-146.dat themida behavioral1/files/0x000100000001aba7-152.dat themida behavioral1/memory/3388-160-0x0000000000BC0000-0x0000000000BC1000-memory.dmp themida behavioral1/memory/4124-172-0x0000000000F70000-0x0000000000F71000-memory.dmp themida -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Host = "C:\\ProgramData\\Windows Host\\Windows Host.exe" 5199473.57 Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\haleng = "C:\\Users\\Admin\\AppData\\Local\\Temp\\haleng.exe" gdrrr.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA md2_2efs.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 3100462.34 Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 5484099.60 Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Setup.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 6489A2274AE24900.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 6489A2274AE24900.exe -
Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\V: msiexec.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 63 api.ipify.org 73 ip-api.com -
Writes to the Master Boot Record (MBR) 1 TTPs 3 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 Setup.exe File opened for modification \??\PhysicalDrive0 6489A2274AE24900.exe File opened for modification \??\PhysicalDrive0 6489A2274AE24900.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
pid Process 540 Setup.exe 3388 3100462.34 4124 5484099.60 -
Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 1740 set thread context of 1736 1740 6489A2274AE24900.exe 101 PID 1740 set thread context of 908 1740 6489A2274AE24900.exe 111 PID 1780 set thread context of 2076 1780 6717.tmp.exe 122 PID 636 set thread context of 5104 636 6803.tmp.exe 145 -
Drops file in Program Files directory 5 IoCs
description ioc Process File created C:\Program Files (x86)\gdiview\gdiview\GDIView.cfg GDIView.exe File opened for modification C:\Program Files (x86)\gdiview\gdiview\GDIView.cfg GDIView.exe File created C:\Program Files (x86)\gdiview\gdiview\GDIView.chm msiexec.exe File created C:\Program Files (x86)\gdiview\gdiview\GDIView.exe msiexec.exe File created C:\Program Files (x86)\gdiview\gdiview\readme.txt msiexec.exe -
Drops file in Windows directory 9 IoCs
description ioc Process File created C:\Windows\Installer\SourceHash{9A2A452C-3057-4F5E-8C7F-41B0D566B831} msiexec.exe File created C:\Windows\AppCompat\Programs\Amcache.hve.tmp WerFault.exe File created C:\Windows\Installer\f75f0d9.msi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSIF29E.tmp msiexec.exe File created C:\Windows\Installer\f75f0db.msi msiexec.exe File opened for modification C:\Windows\Installer\f75f0d9.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 3948 1020 WerFault.exe 98 -
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\0006 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2002 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc 6489A2274AE24900.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0018 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0054 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0002 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\FriendlyName 6489A2274AE24900.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0058 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\0006 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0055 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0038 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0058 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2003 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004C svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{4340a6c5-93fa-4706-972c-7b648008a5a7}\0008 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\FriendlyName svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004C svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2006 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0051 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\FriendlyName svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{4340a6c5-93fa-4706-972c-7b648008a5a7}\0008 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2003 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0065 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\CompatibleIDs svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\0008 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc 6489A2274AE24900.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\000A\ svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\CompatibleIDs svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0034 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000 6489A2274AE24900.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0008 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0008\ svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004E svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0004 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000 6489A2274AE24900.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Mfg svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0002 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\300A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\000A svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\ConfigFlags svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\HardwareID svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\000A svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Mfg svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\0009 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc 6489A2274AE24900.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\0008 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0003 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004D svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2002 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0038 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0004 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\0016 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0004\ svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000 6489A2274AE24900.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\FriendlyName 6489A2274AE24900.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0002 svchost.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 6717.tmp.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 6717.tmp.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 816 timeout.exe -
Kills process with taskkill 1 IoCs
pid Process 3144 taskkill.exe -
Modifies data under HKEY_USERS 3 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\PegasPc file.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\windows\CurrentVersion\Internet Settings\Connections svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\OnDemandInterfaceCache svchost.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\6C0CE2DD0584C47CAC18839F14055F19FA270CDD Setup.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\6C0CE2DD0584C47CAC18839F14055F19FA270CDD\Blob = 0300000001000000140000006c0ce2dd0584c47cac18839f14055f19fa270cdd2000000001000000500500003082054c30820434a0030201020206016de34cff62300d06092a864886f70d01010b05003081aa313b303906035504030c32436861726c65732050726f78792043412028313920e58d81e69c8820323031392c204445534b544f502d424e41543131552931253023060355040b0c1c68747470733a2f2f636861726c657370726f78792e636f6d2f73736c3111300f060355040a0c08584b3732204c74643111300f06035504070c084175636b6c616e643111300f06035504080c084175636b6c616e64310b3009060355040613024e5a301e170d3030303130313030303030305a170d3438313231353039313533375a3081aa313b303906035504030c32436861726c65732050726f78792043412028313920e58d81e69c8820323031392c204445534b544f502d424e41543131552931253023060355040b0c1c68747470733a2f2f636861726c657370726f78792e636f6d2f73736c3111300f060355040a0c08584b3732204c74643111300f06035504070c084175636b6c616e643111300f06035504080c084175636b6c616e64310b3009060355040613024e5a30820122300d06092a864886f70d01010105000382010f003082010a0282010100ae86c5043ed34d99f44fa3052ea34047a7fbbe33188b1dc2ca645ca3249e85e54b4921d4998fda6a22247c32d9087d742af3bf850803ae8c1e25faad53fb8fd823b7353d9a3ac992bf917f693826c790e53a540b120b6553508ec9585e467d310bd3ef9fb61731deb522eb78f43f824b34be36782db7a8cb162cd22247b14e4c5ae633ed66542354a59971bddc59160ecdc521b4477c93ca9e624e0af00298602300f5dc368819c3cb9f02604636888276b3a498570473b5328b0834f327c34285e333da9207e12f0edbb654c8cf11e3cc7cba17a52cd7cd42c10ae095a2e4eb9d3e3f361488243f0584af40e72d6e6e182149bfb8342384f60f12e14734258d0203010001a382017430820170300f0603551d130101ff040530030101ff3082012c06096086480186f842010d0482011d138201195468697320526f6f74206365727469666963617465207761732067656e65726174656420627920436861726c65732050726f787920666f722053534c2050726f7879696e672e20496620746869732063657274696669636174652069732070617274206f66206120636572746966696361746520636861696e2c2074686973206d65616e73207468617420796f752772652062726f7773696e67207468726f75676820436861726c65732050726f787920776974682053534c2050726f7879696e6720656e61626c656420666f72207468697320776562736974652e20506c656173652073656520687474703a2f2f636861726c657370726f78792e636f6d2f73736c20666f72206d6f726520696e666f726d6174696f6e2e300e0603551d0f0101ff040403020204301d0603551d0e04160414f8d0dc54367cf794020f8b92783a5d8a91251f9f300d06092a864886f70d01010b05000382010100662271eb9d5c744c88382de98ba37320e6312104d04273a92007a8670976d6530e6347d00bbded1319bb6754f36237596095922911e3661a70354f6ba0b797a76258be7adebb8c8dbeeed977760b80271d74b2444d92f6c1337a379b73545b251de5f8812b9625abbbfaedc15f8c6c374b9b26dd0fef035185f5899d8819e689dc6db5f0babbfd637c52b1bec80115b889faeed493d4112d744954ad3abe6607c41a4a2d657ba330ed131fa4e8c25bb28ee181dcef8da91c17bfd30a23c8eae81b152ed85ff938afc32b34ffdaffbdb72d9bb04067bfc87f579eba9637b165ea008ea7408bc8265f33c039bf60f506d245a6b53017afc8e161d70ed5b0d76576 Setup.exe -
Runs ping.exe 1 TTPs 5 IoCs
pid Process 2908 PING.EXE 584 PING.EXE 804 PING.EXE 3896 PING.EXE 3688 PING.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 416 1613386588361.exe 416 1613386588361.exe 3948 WerFault.exe 3948 WerFault.exe 3948 WerFault.exe 3948 WerFault.exe 3948 WerFault.exe 3948 WerFault.exe 3948 WerFault.exe 3948 WerFault.exe 3948 WerFault.exe 3948 WerFault.exe 3948 WerFault.exe 3948 WerFault.exe 3948 WerFault.exe 3948 WerFault.exe 3948 WerFault.exe 1772 1613386590642.exe 1772 1613386590642.exe 3824 taskmgr.exe 3824 taskmgr.exe 3824 taskmgr.exe 3824 taskmgr.exe 3824 taskmgr.exe 3824 taskmgr.exe 3824 taskmgr.exe 3824 taskmgr.exe 3824 taskmgr.exe 3824 taskmgr.exe 3824 taskmgr.exe 3824 taskmgr.exe 3824 taskmgr.exe 3824 taskmgr.exe 3824 taskmgr.exe 3824 taskmgr.exe 3824 taskmgr.exe 3824 taskmgr.exe 3824 taskmgr.exe 3824 taskmgr.exe 3824 taskmgr.exe 3824 taskmgr.exe 3824 taskmgr.exe 3824 taskmgr.exe 3824 taskmgr.exe 3824 taskmgr.exe 3824 taskmgr.exe 3824 taskmgr.exe 3824 taskmgr.exe 580 file.exe 580 file.exe 2076 6717.tmp.exe 2076 6717.tmp.exe 580 file.exe 580 file.exe 3872 716824.7 3872 716824.7 4656 jfiag3g_gg.exe 4656 jfiag3g_gg.exe 3388 3100462.34 3388 3100462.34 2468 msiexec.exe 2468 msiexec.exe 5104 6803.tmp.exe 5104 6803.tmp.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1484 msiexec.exe Token: SeIncreaseQuotaPrivilege 1484 msiexec.exe Token: SeSecurityPrivilege 2468 msiexec.exe Token: SeCreateTokenPrivilege 1484 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1484 msiexec.exe Token: SeLockMemoryPrivilege 1484 msiexec.exe Token: SeIncreaseQuotaPrivilege 1484 msiexec.exe Token: SeMachineAccountPrivilege 1484 msiexec.exe Token: SeTcbPrivilege 1484 msiexec.exe Token: SeSecurityPrivilege 1484 msiexec.exe Token: SeTakeOwnershipPrivilege 1484 msiexec.exe Token: SeLoadDriverPrivilege 1484 msiexec.exe Token: SeSystemProfilePrivilege 1484 msiexec.exe Token: SeSystemtimePrivilege 1484 msiexec.exe Token: SeProfSingleProcessPrivilege 1484 msiexec.exe Token: SeIncBasePriorityPrivilege 1484 msiexec.exe Token: SeCreatePagefilePrivilege 1484 msiexec.exe Token: SeCreatePermanentPrivilege 1484 msiexec.exe Token: SeBackupPrivilege 1484 msiexec.exe Token: SeRestorePrivilege 1484 msiexec.exe Token: SeShutdownPrivilege 1484 msiexec.exe Token: SeDebugPrivilege 1484 msiexec.exe Token: SeAuditPrivilege 1484 msiexec.exe Token: SeSystemEnvironmentPrivilege 1484 msiexec.exe Token: SeChangeNotifyPrivilege 1484 msiexec.exe Token: SeRemoteShutdownPrivilege 1484 msiexec.exe Token: SeUndockPrivilege 1484 msiexec.exe Token: SeSyncAgentPrivilege 1484 msiexec.exe Token: SeEnableDelegationPrivilege 1484 msiexec.exe Token: SeManageVolumePrivilege 1484 msiexec.exe Token: SeImpersonatePrivilege 1484 msiexec.exe Token: SeCreateGlobalPrivilege 1484 msiexec.exe Token: SeCreateTokenPrivilege 1484 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1484 msiexec.exe Token: SeLockMemoryPrivilege 1484 msiexec.exe Token: SeIncreaseQuotaPrivilege 1484 msiexec.exe Token: SeMachineAccountPrivilege 1484 msiexec.exe Token: SeTcbPrivilege 1484 msiexec.exe Token: SeSecurityPrivilege 1484 msiexec.exe Token: SeTakeOwnershipPrivilege 1484 msiexec.exe Token: SeLoadDriverPrivilege 1484 msiexec.exe Token: SeSystemProfilePrivilege 1484 msiexec.exe Token: SeSystemtimePrivilege 1484 msiexec.exe Token: SeProfSingleProcessPrivilege 1484 msiexec.exe Token: SeIncBasePriorityPrivilege 1484 msiexec.exe Token: SeCreatePagefilePrivilege 1484 msiexec.exe Token: SeCreatePermanentPrivilege 1484 msiexec.exe Token: SeBackupPrivilege 1484 msiexec.exe Token: SeRestorePrivilege 1484 msiexec.exe Token: SeShutdownPrivilege 1484 msiexec.exe Token: SeDebugPrivilege 1484 msiexec.exe Token: SeAuditPrivilege 1484 msiexec.exe Token: SeSystemEnvironmentPrivilege 1484 msiexec.exe Token: SeChangeNotifyPrivilege 1484 msiexec.exe Token: SeRemoteShutdownPrivilege 1484 msiexec.exe Token: SeUndockPrivilege 1484 msiexec.exe Token: SeSyncAgentPrivilege 1484 msiexec.exe Token: SeEnableDelegationPrivilege 1484 msiexec.exe Token: SeManageVolumePrivilege 1484 msiexec.exe Token: SeImpersonatePrivilege 1484 msiexec.exe Token: SeCreateGlobalPrivilege 1484 msiexec.exe Token: SeCreateTokenPrivilege 1484 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1484 msiexec.exe Token: SeLockMemoryPrivilege 1484 msiexec.exe -
Suspicious use of FindShellTrayWindow 56 IoCs
pid Process 1484 msiexec.exe 3824 taskmgr.exe 3824 taskmgr.exe 3824 taskmgr.exe 3824 taskmgr.exe 3824 taskmgr.exe 3824 taskmgr.exe 3824 taskmgr.exe 3824 taskmgr.exe 3824 taskmgr.exe 3824 taskmgr.exe 3824 taskmgr.exe 3824 taskmgr.exe 3824 taskmgr.exe 3824 taskmgr.exe 3824 taskmgr.exe 3824 taskmgr.exe 3824 taskmgr.exe 3824 taskmgr.exe 3824 taskmgr.exe 3824 taskmgr.exe 3824 taskmgr.exe 3824 taskmgr.exe 3824 taskmgr.exe 3824 taskmgr.exe 3824 taskmgr.exe 3824 taskmgr.exe 3824 taskmgr.exe 3824 taskmgr.exe 3824 taskmgr.exe 3824 taskmgr.exe 3824 taskmgr.exe 3824 taskmgr.exe 3824 taskmgr.exe 3824 taskmgr.exe 3824 taskmgr.exe 3824 taskmgr.exe 3824 taskmgr.exe 3824 taskmgr.exe 3824 taskmgr.exe 3824 taskmgr.exe 3824 taskmgr.exe 3824 taskmgr.exe 3824 taskmgr.exe 3824 taskmgr.exe 3824 taskmgr.exe 3824 taskmgr.exe 3824 taskmgr.exe 3824 taskmgr.exe 3824 taskmgr.exe 3824 taskmgr.exe 3824 taskmgr.exe 3824 taskmgr.exe 3824 taskmgr.exe 3824 taskmgr.exe 1484 msiexec.exe -
Suspicious use of SendNotifyMessage 54 IoCs
pid Process 3824 taskmgr.exe 3824 taskmgr.exe 3824 taskmgr.exe 3824 taskmgr.exe 3824 taskmgr.exe 3824 taskmgr.exe 3824 taskmgr.exe 3824 taskmgr.exe 3824 taskmgr.exe 3824 taskmgr.exe 3824 taskmgr.exe 3824 taskmgr.exe 3824 taskmgr.exe 3824 taskmgr.exe 3824 taskmgr.exe 3824 taskmgr.exe 3824 taskmgr.exe 3824 taskmgr.exe 3824 taskmgr.exe 3824 taskmgr.exe 3824 taskmgr.exe 3824 taskmgr.exe 3824 taskmgr.exe 3824 taskmgr.exe 3824 taskmgr.exe 3824 taskmgr.exe 3824 taskmgr.exe 3824 taskmgr.exe 3824 taskmgr.exe 3824 taskmgr.exe 3824 taskmgr.exe 3824 taskmgr.exe 3824 taskmgr.exe 3824 taskmgr.exe 3824 taskmgr.exe 3824 taskmgr.exe 3824 taskmgr.exe 3824 taskmgr.exe 3824 taskmgr.exe 3824 taskmgr.exe 3824 taskmgr.exe 3824 taskmgr.exe 3824 taskmgr.exe 3824 taskmgr.exe 3824 taskmgr.exe 3824 taskmgr.exe 3824 taskmgr.exe 3824 taskmgr.exe 3824 taskmgr.exe 3824 taskmgr.exe 3824 taskmgr.exe 3824 taskmgr.exe 3824 taskmgr.exe 3824 taskmgr.exe -
Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 540 Setup.exe 1740 6489A2274AE24900.exe 1900 6489A2274AE24900.exe 1736 firefox.exe 416 1613386588361.exe 908 firefox.exe 1772 1613386590642.exe 4016 ThunderFW.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 496 wrote to memory of 2060 496 pass 12345...Kepserverex_5_5_14_493_crack_by_CORE.exe 77 PID 496 wrote to memory of 2060 496 pass 12345...Kepserverex_5_5_14_493_crack_by_CORE.exe 77 PID 496 wrote to memory of 2060 496 pass 12345...Kepserverex_5_5_14_493_crack_by_CORE.exe 77 PID 2060 wrote to memory of 2492 2060 cmd.exe 80 PID 2060 wrote to memory of 2492 2060 cmd.exe 80 PID 2060 wrote to memory of 2492 2060 cmd.exe 80 PID 2060 wrote to memory of 2300 2060 cmd.exe 81 PID 2060 wrote to memory of 2300 2060 cmd.exe 81 PID 2060 wrote to memory of 2300 2060 cmd.exe 81 PID 2060 wrote to memory of 1240 2060 cmd.exe 82 PID 2060 wrote to memory of 1240 2060 cmd.exe 82 PID 2060 wrote to memory of 1240 2060 cmd.exe 82 PID 2060 wrote to memory of 1280 2060 cmd.exe 83 PID 2060 wrote to memory of 1280 2060 cmd.exe 83 PID 2060 wrote to memory of 1280 2060 cmd.exe 83 PID 2492 wrote to memory of 1092 2492 keygen-pr.exe 85 PID 2492 wrote to memory of 1092 2492 keygen-pr.exe 85 PID 2492 wrote to memory of 1092 2492 keygen-pr.exe 85 PID 1280 wrote to memory of 540 1280 keygen-step-4.exe 86 PID 1280 wrote to memory of 540 1280 keygen-step-4.exe 86 PID 1280 wrote to memory of 540 1280 keygen-step-4.exe 86 PID 1240 wrote to memory of 3812 1240 keygen-step-3.exe 88 PID 1240 wrote to memory of 3812 1240 keygen-step-3.exe 88 PID 1240 wrote to memory of 3812 1240 keygen-step-3.exe 88 PID 1092 wrote to memory of 2196 1092 key.exe 87 PID 1092 wrote to memory of 2196 1092 key.exe 87 PID 1092 wrote to memory of 2196 1092 key.exe 87 PID 3812 wrote to memory of 804 3812 cmd.exe 90 PID 3812 wrote to memory of 804 3812 cmd.exe 90 PID 3812 wrote to memory of 804 3812 cmd.exe 90 PID 540 wrote to memory of 1484 540 Setup.exe 91 PID 540 wrote to memory of 1484 540 Setup.exe 91 PID 540 wrote to memory of 1484 540 Setup.exe 91 PID 540 wrote to memory of 1740 540 Setup.exe 93 PID 540 wrote to memory of 1740 540 Setup.exe 93 PID 540 wrote to memory of 1740 540 Setup.exe 93 PID 540 wrote to memory of 1900 540 Setup.exe 94 PID 540 wrote to memory of 1900 540 Setup.exe 94 PID 540 wrote to memory of 1900 540 Setup.exe 94 PID 2468 wrote to memory of 736 2468 msiexec.exe 95 PID 2468 wrote to memory of 736 2468 msiexec.exe 95 PID 2468 wrote to memory of 736 2468 msiexec.exe 95 PID 540 wrote to memory of 2896 540 Setup.exe 96 PID 540 wrote to memory of 2896 540 Setup.exe 96 PID 540 wrote to memory of 2896 540 Setup.exe 96 PID 1280 wrote to memory of 1020 1280 keygen-step-4.exe 98 PID 1280 wrote to memory of 1020 1280 keygen-step-4.exe 98 PID 1280 wrote to memory of 1020 1280 keygen-step-4.exe 98 PID 2896 wrote to memory of 3896 2896 cmd.exe 99 PID 2896 wrote to memory of 3896 2896 cmd.exe 99 PID 2896 wrote to memory of 3896 2896 cmd.exe 99 PID 1900 wrote to memory of 2096 1900 6489A2274AE24900.exe 100 PID 1900 wrote to memory of 2096 1900 6489A2274AE24900.exe 100 PID 1900 wrote to memory of 2096 1900 6489A2274AE24900.exe 100 PID 1740 wrote to memory of 1736 1740 6489A2274AE24900.exe 101 PID 1740 wrote to memory of 1736 1740 6489A2274AE24900.exe 101 PID 1740 wrote to memory of 1736 1740 6489A2274AE24900.exe 101 PID 1740 wrote to memory of 1736 1740 6489A2274AE24900.exe 101 PID 1740 wrote to memory of 1736 1740 6489A2274AE24900.exe 101 PID 1740 wrote to memory of 1736 1740 6489A2274AE24900.exe 101 PID 2096 wrote to memory of 3144 2096 cmd.exe 103 PID 2096 wrote to memory of 3144 2096 cmd.exe 103 PID 2096 wrote to memory of 3144 2096 cmd.exe 103 PID 1740 wrote to memory of 416 1740 6489A2274AE24900.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\pass 12345...Kepserverex_5_5_14_493_crack_by_CORE.exe"C:\Users\Admin\AppData\Local\Temp\pass 12345...Kepserverex_5_5_14_493_crack_by_CORE.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:496 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:2060 -
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-pr.exekeygen-pr.exe -p83fsase3Ge3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2492 -
C:\Users\Admin\AppData\Local\Temp\RarSFX2\key.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX2\key.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1092 -
C:\Users\Admin\AppData\Local\Temp\RarSFX2\key.exeC:\Users\Admin\AppData\Local\Temp\RarSFX2\key.exe -txt -scanlocal -file:potato.dat5⤵PID:2196
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-1.exekeygen-step-1.exe3⤵
- Executes dropped EXE
PID:2300
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exekeygen-step-3.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1240 -
C:\Windows\SysWOW64\cmd.execmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exe"4⤵
- Suspicious use of WriteProcessMemory
PID:3812 -
C:\Windows\SysWOW64\PING.EXEping 1.1.1.1 -n 1 -w 30005⤵
- Runs ping.exe
PID:804
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-4.exekeygen-step-4.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1280 -
C:\Users\Admin\AppData\Local\Temp\RarSFX1\Setup.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX1\Setup.exe"4⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Writes to the Master Boot Record (MBR)
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies system certificate store
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:540 -
C:\Windows\SysWOW64\msiexec.exemsiexec.exe /i "C:\Users\Admin\AppData\Local\Temp\gdiview.msi"5⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1484
-
-
C:\Users\Admin\AppData\Local\Temp\6489A2274AE24900.exeC:\Users\Admin\AppData\Local\Temp\6489A2274AE24900.exe 0011 installp15⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetThreadContext
- Checks SCSI registry key(s)
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1740 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:1736
-
-
C:\Users\Admin\AppData\Roaming\1613386588361.exe"C:\Users\Admin\AppData\Roaming\1613386588361.exe" /sjson "C:\Users\Admin\AppData\Roaming\1613386588361.txt"6⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:416
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:908
-
-
C:\Users\Admin\AppData\Roaming\1613386590642.exe"C:\Users\Admin\AppData\Roaming\1613386590642.exe" /sjson "C:\Users\Admin\AppData\Roaming\1613386590642.txt"6⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1772
-
-
C:\Users\Admin\AppData\Local\Temp\download\ThunderFW.exeC:\Users\Admin\AppData\Local\Temp\download\ThunderFW.exe ThunderFW "C:\Users\Admin\AppData\Local\Temp\download\MiniThunderPlatform.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4016
-
-
C:\Windows\SysWOW64\cmd.execmd /c ping 127.0.0.1 -n 3 & del "C:\Users\Admin\AppData\Local\Temp\6489A2274AE24900.exe"6⤵PID:3832
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 37⤵
- Runs ping.exe
PID:2908
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\6489A2274AE24900.exeC:\Users\Admin\AppData\Local\Temp\6489A2274AE24900.exe 200 installp15⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Writes to the Master Boot Record (MBR)
- Checks SCSI registry key(s)
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1900 -
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe6⤵
- Suspicious use of WriteProcessMemory
PID:2096 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe7⤵
- Kills process with taskkill
PID:3144
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ping 127.0.0.1 -n 3 & del "C:\Users\Admin\AppData\Local\Temp\6489A2274AE24900.exe"6⤵PID:3356
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 37⤵
- Runs ping.exe
PID:3688
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ping 127.0.0.1 -n 3 & del "C:\Users\Admin\AppData\Local\Temp\RarSFX1\Setup.exe"5⤵
- Suspicious use of WriteProcessMemory
PID:2896 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 36⤵
- Runs ping.exe
PID:3896
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\md2_2efs.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX1\md2_2efs.exe"4⤵
- Executes dropped EXE
- Checks whether UAC is enabled
PID:1020 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1020 -s 13165⤵
- Drops file in Windows directory
- Program crash
- Suspicious behavior: EnumeratesProcesses
PID:3948
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\file.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX1\file.exe"4⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:580 -
C:\Users\Admin\AppData\Roaming\6717.tmp.exe"C:\Users\Admin\AppData\Roaming\6717.tmp.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1780 -
C:\Users\Admin\AppData\Roaming\6717.tmp.exe"C:\Users\Admin\AppData\Roaming\6717.tmp.exe"6⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:2076
-
-
-
C:\Users\Admin\AppData\Roaming\6803.tmp.exe"C:\Users\Admin\AppData\Roaming\6803.tmp.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:636 -
C:\Users\Admin\AppData\Roaming\6803.tmp.exe"{path}"6⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:5104
-
-
-
C:\Users\Admin\AppData\Roaming\68BF.tmp.exe"C:\Users\Admin\AppData\Roaming\68BF.tmp.exe"5⤵
- Executes dropped EXE
PID:3996 -
C:\Windows\SysWOW64\cmd.exe/c timeout /t 3 & del /f /q C:\Users\Admin\AppData\Roaming\68BF.tmp.exe6⤵PID:3428
-
C:\Windows\SysWOW64\timeout.exetimeout /t 37⤵
- Delays execution with timeout.exe
PID:816
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 && del "C:\Users\Admin\AppData\Local\Temp\RarSFX1\file.exe"5⤵PID:3136
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.16⤵
- Runs ping.exe
PID:584
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\BTRSetp.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX1\BTRSetp.exe"4⤵
- Executes dropped EXE
PID:3552 -
C:\Users\Admin\AppData\Local\Temp\RarSFX3\installer.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX3\installer.exe"5⤵
- Executes dropped EXE
PID:3260 -
C:\ProgramData\716824.7"C:\ProgramData\716824.7"6⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3872
-
-
C:\ProgramData\5199473.57"C:\ProgramData\5199473.57"6⤵
- Executes dropped EXE
- Adds Run key to start application
PID:3160 -
C:\ProgramData\Windows Host\Windows Host.exe"C:\ProgramData\Windows Host\Windows Host.exe"7⤵
- Executes dropped EXE
PID:4256
-
-
-
C:\ProgramData\3100462.34"C:\ProgramData\3100462.34"6⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:3388
-
-
C:\ProgramData\5484099.60"C:\ProgramData\5484099.60"6⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4124
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\gdrrr.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX1\gdrrr.exe"4⤵
- Executes dropped EXE
- Adds Run key to start application
PID:4420 -
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt5⤵
- Executes dropped EXE
PID:4544
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4656
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt5⤵
- Executes dropped EXE
PID:3308
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt5⤵
- Executes dropped EXE
PID:4884
-
-
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2468 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 0876EACBA2CC843DD3FC3848AA54DA74 C2⤵
- Loads dropped DLL
PID:736
-
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:4888
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3824
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵PID:1688
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s DsmSvc1⤵
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:4768
-
C:\Program Files (x86)\gdiview\gdiview\GDIView.exe"C:\Program Files (x86)\gdiview\gdiview\GDIView.exe"1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4412
-
C:\Windows\system32\compattelrunner.exeC:\Windows\system32\compattelrunner.exe -m:aeinv.dll -f:UpdateSoftwareInventoryW1⤵PID:4416
-
C:\Program Files (x86)\gdiview\gdiview\GDIView.exe"C:\Program Files (x86)\gdiview\gdiview\GDIView.exe"1⤵
- Executes dropped EXE
PID:3264
-
C:\Program Files (x86)\gdiview\gdiview\GDIView.exe"C:\Program Files (x86)\gdiview\gdiview\GDIView.exe"1⤵
- Executes dropped EXE
PID:1728
-
C:\Program Files (x86)\gdiview\gdiview\GDIView.exe"C:\Program Files (x86)\gdiview\gdiview\GDIView.exe"1⤵
- Executes dropped EXE
PID:4636
-
C:\Program Files (x86)\gdiview\gdiview\GDIView.exe"C:\Program Files (x86)\gdiview\gdiview\GDIView.exe"1⤵
- Executes dropped EXE
PID:4676