Analysis
-
max time kernel
57s -
max time network
70s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
13-05-2021 12:57
Static task
static1
Behavioral task
behavioral1
Sample
60fc9ffc71a54eded9926892b8efc5dae4d2df975a60024515f77c5d50ad5c52.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
60fc9ffc71a54eded9926892b8efc5dae4d2df975a60024515f77c5d50ad5c52.exe
Resource
win10v20210408
General
-
Target
60fc9ffc71a54eded9926892b8efc5dae4d2df975a60024515f77c5d50ad5c52.exe
-
Size
44KB
-
MD5
823fde8a4ca8415307babdd3289e2a32
-
SHA1
79dc71878ec6cb168e729b9f38137d2cc6c45ebd
-
SHA256
60fc9ffc71a54eded9926892b8efc5dae4d2df975a60024515f77c5d50ad5c52
-
SHA512
2bbd8626688cfe3b3bd5fae6f10cb8bd3bd576eea71283623c7b9856fa4bc792e5cda2976a0ffbbbaee960d248a16045568e7a8194ac3a16a4b14554f9c4c9dc
Malware Config
Signatures
-
Modifies system executable filetype association 2 TTPs 1 IoCs
Processes:
cmd.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\60fc9ffc71a54eded9926892b8efc5dae4d2df975a60024515f77c5d50ad5c52.exe " cmd.exe -
Sets file execution options in registry 2 TTPs
-
Drops file in System32 directory 1 IoCs
Processes:
60fc9ffc71a54eded9926892b8efc5dae4d2df975a60024515f77c5d50ad5c52.exedescription ioc process File opened for modification \??\c:\Windows\SysWOW64\regedit.exe 60fc9ffc71a54eded9926892b8efc5dae4d2df975a60024515f77c5d50ad5c52.exe -
Drops file in Program Files directory 64 IoCs
Processes:
60fc9ffc71a54eded9926892b8efc5dae4d2df975a60024515f77c5d50ad5c52.exedescription ioc process File opened for modification \??\c:\Program Files\Mozilla Firefox\maintenanceservice.exe 60fc9ffc71a54eded9926892b8efc5dae4d2df975a60024515f77c5d50ad5c52.exe File opened for modification \??\c:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\template.exe 60fc9ffc71a54eded9926892b8efc5dae4d2df975a60024515f77c5d50ad5c52.exe File opened for modification \??\c:\Program Files (x86)\Common Files\microsoft shared\DW\DW20.EXE 60fc9ffc71a54eded9926892b8efc5dae4d2df975a60024515f77c5d50ad5c52.exe File opened for modification \??\c:\Program Files (x86)\Common Files\microsoft shared\TextConv\WksConv\Wkconv.exe 60fc9ffc71a54eded9926892b8efc5dae4d2df975a60024515f77c5d50ad5c52.exe File opened for modification \??\c:\Program Files (x86)\Internet Explorer\ielowutil.exe 60fc9ffc71a54eded9926892b8efc5dae4d2df975a60024515f77c5d50ad5c52.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\CNFNOT32.EXE 60fc9ffc71a54eded9926892b8efc5dae4d2df975a60024515f77c5d50ad5c52.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\chrome_proxy.exe 60fc9ffc71a54eded9926892b8efc5dae4d2df975a60024515f77c5d50ad5c52.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\jre\bin\kinit.exe 60fc9ffc71a54eded9926892b8efc5dae4d2df975a60024515f77c5d50ad5c52.exe File opened for modification \??\c:\Program Files (x86)\Windows Media Player\wmprph.exe 60fc9ffc71a54eded9926892b8efc5dae4d2df975a60024515f77c5d50ad5c52.exe File opened for modification \??\c:\Program Files (x86)\Common Files\microsoft shared\Source Engine\OSE.EXE 60fc9ffc71a54eded9926892b8efc5dae4d2df975a60024515f77c5d50ad5c52.exe File opened for modification \??\c:\Program Files\Windows Media Player\wmpshare.exe 60fc9ffc71a54eded9926892b8efc5dae4d2df975a60024515f77c5d50ad5c52.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\jre\bin\ssvagent.exe 60fc9ffc71a54eded9926892b8efc5dae4d2df975a60024515f77c5d50ad5c52.exe File opened for modification \??\c:\Program Files\Java\jre7\bin\klist.exe 60fc9ffc71a54eded9926892b8efc5dae4d2df975a60024515f77c5d50ad5c52.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE 60fc9ffc71a54eded9926892b8efc5dae4d2df975a60024515f77c5d50ad5c52.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\chrome.exe 60fc9ffc71a54eded9926892b8efc5dae4d2df975a60024515f77c5d50ad5c52.exe File opened for modification \??\c:\Program Files\Java\jre7\bin\kinit.exe 60fc9ffc71a54eded9926892b8efc5dae4d2df975a60024515f77c5d50ad5c52.exe File opened for modification \??\c:\Program Files\Java\jre7\bin\jp2launcher.exe 60fc9ffc71a54eded9926892b8efc5dae4d2df975a60024515f77c5d50ad5c52.exe File opened for modification \??\c:\Program Files (x86)\Windows Media Player\wmpenc.exe 60fc9ffc71a54eded9926892b8efc5dae4d2df975a60024515f77c5d50ad5c52.exe File opened for modification \??\c:\Program Files\Windows Media Player\wmplayer.exe 60fc9ffc71a54eded9926892b8efc5dae4d2df975a60024515f77c5d50ad5c52.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32Info.exe 60fc9ffc71a54eded9926892b8efc5dae4d2df975a60024515f77c5d50ad5c52.exe File opened for modification \??\c:\Program Files (x86)\Internet Explorer\ieinstal.exe 60fc9ffc71a54eded9926892b8efc5dae4d2df975a60024515f77c5d50ad5c52.exe File opened for modification \??\c:\Program Files\7-Zip\7zFM.exe 60fc9ffc71a54eded9926892b8efc5dae4d2df975a60024515f77c5d50ad5c52.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\jdb.exe 60fc9ffc71a54eded9926892b8efc5dae4d2df975a60024515f77c5d50ad5c52.exe File opened for modification \??\c:\Program Files (x86)\Windows NT\Accessories\wordpad.exe 60fc9ffc71a54eded9926892b8efc5dae4d2df975a60024515f77c5d50ad5c52.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\jre\bin\pack200.exe 60fc9ffc71a54eded9926892b8efc5dae4d2df975a60024515f77c5d50ad5c52.exe File opened for modification \??\c:\Program Files\Java\jre7\bin\rmid.exe 60fc9ffc71a54eded9926892b8efc5dae4d2df975a60024515f77c5d50ad5c52.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\SC_Reader.exe 60fc9ffc71a54eded9926892b8efc5dae4d2df975a60024515f77c5d50ad5c52.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\misc.exe 60fc9ffc71a54eded9926892b8efc5dae4d2df975a60024515f77c5d50ad5c52.exe File opened for modification \??\c:\Program Files\Common Files\Microsoft Shared\ink\TabTip.exe 60fc9ffc71a54eded9926892b8efc5dae4d2df975a60024515f77c5d50ad5c52.exe File opened for modification \??\c:\Program Files\Windows Media Player\wmprph.exe 60fc9ffc71a54eded9926892b8efc5dae4d2df975a60024515f77c5d50ad5c52.exe File opened for modification \??\c:\Program Files\Java\jre7\bin\orbd.exe 60fc9ffc71a54eded9926892b8efc5dae4d2df975a60024515f77c5d50ad5c52.exe File opened for modification \??\c:\Program Files\Microsoft Office\Office14\MSOHTMED.EXE 60fc9ffc71a54eded9926892b8efc5dae4d2df975a60024515f77c5d50ad5c52.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE 60fc9ffc71a54eded9926892b8efc5dae4d2df975a60024515f77c5d50ad5c52.exe File opened for modification \??\c:\Program Files\Common Files\Microsoft Shared\ink\FlickLearningWizard.exe 60fc9ffc71a54eded9926892b8efc5dae4d2df975a60024515f77c5d50ad5c52.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\jcmd.exe 60fc9ffc71a54eded9926892b8efc5dae4d2df975a60024515f77c5d50ad5c52.exe File opened for modification \??\c:\Program Files (x86)\Common Files\microsoft shared\ink\TabTip32.exe 60fc9ffc71a54eded9926892b8efc5dae4d2df975a60024515f77c5d50ad5c52.exe File opened for modification \??\c:\Program Files (x86)\Google\Update\1.3.35.452\GoogleUpdateBroker.exe 60fc9ffc71a54eded9926892b8efc5dae4d2df975a60024515f77c5d50ad5c52.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\jre\bin\java.exe 60fc9ffc71a54eded9926892b8efc5dae4d2df975a60024515f77c5d50ad5c52.exe File opened for modification \??\c:\Program Files\Java\jre7\bin\ktab.exe 60fc9ffc71a54eded9926892b8efc5dae4d2df975a60024515f77c5d50ad5c52.exe File opened for modification \??\c:\Program Files\Java\jre7\bin\rmiregistry.exe 60fc9ffc71a54eded9926892b8efc5dae4d2df975a60024515f77c5d50ad5c52.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\CLVIEW.EXE 60fc9ffc71a54eded9926892b8efc5dae4d2df975a60024515f77c5d50ad5c52.exe File opened for modification \??\c:\Program Files\Java\jre7\bin\javacpl.exe 60fc9ffc71a54eded9926892b8efc5dae4d2df975a60024515f77c5d50ad5c52.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Reader 9.0\Reader\LogTransport2.exe 60fc9ffc71a54eded9926892b8efc5dae4d2df975a60024515f77c5d50ad5c52.exe File opened for modification \??\c:\Program Files\Windows Media Player\wmlaunch.exe 60fc9ffc71a54eded9926892b8efc5dae4d2df975a60024515f77c5d50ad5c52.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\jconsole.exe 60fc9ffc71a54eded9926892b8efc5dae4d2df975a60024515f77c5d50ad5c52.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\xjc.exe 60fc9ffc71a54eded9926892b8efc5dae4d2df975a60024515f77c5d50ad5c52.exe File opened for modification \??\c:\Program Files\Mozilla Firefox\crashreporter.exe 60fc9ffc71a54eded9926892b8efc5dae4d2df975a60024515f77c5d50ad5c52.exe File opened for modification \??\c:\Program Files\Windows Media Player\wmpnetwk.exe 60fc9ffc71a54eded9926892b8efc5dae4d2df975a60024515f77c5d50ad5c52.exe File opened for modification \??\c:\Program Files\Windows Media Player\WMPSideShowGadget.exe 60fc9ffc71a54eded9926892b8efc5dae4d2df975a60024515f77c5d50ad5c52.exe File opened for modification \??\c:\Program Files (x86)\Windows Media Player\setup_wm.exe 60fc9ffc71a54eded9926892b8efc5dae4d2df975a60024515f77c5d50ad5c52.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\jps.exe 60fc9ffc71a54eded9926892b8efc5dae4d2df975a60024515f77c5d50ad5c52.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\rmic.exe 60fc9ffc71a54eded9926892b8efc5dae4d2df975a60024515f77c5d50ad5c52.exe File opened for modification \??\c:\Program Files\Windows Defender\MSASCui.exe 60fc9ffc71a54eded9926892b8efc5dae4d2df975a60024515f77c5d50ad5c52.exe File opened for modification \??\c:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\FLTLDR.EXE 60fc9ffc71a54eded9926892b8efc5dae4d2df975a60024515f77c5d50ad5c52.exe File opened for modification \??\c:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE 60fc9ffc71a54eded9926892b8efc5dae4d2df975a60024515f77c5d50ad5c52.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\javadoc.exe 60fc9ffc71a54eded9926892b8efc5dae4d2df975a60024515f77c5d50ad5c52.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\pack200.exe 60fc9ffc71a54eded9926892b8efc5dae4d2df975a60024515f77c5d50ad5c52.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\appletviewer.exe 60fc9ffc71a54eded9926892b8efc5dae4d2df975a60024515f77c5d50ad5c52.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\servertool.exe 60fc9ffc71a54eded9926892b8efc5dae4d2df975a60024515f77c5d50ad5c52.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec64.exe 60fc9ffc71a54eded9926892b8efc5dae4d2df975a60024515f77c5d50ad5c52.exe File opened for modification \??\c:\Program Files\Java\jre7\bin\keytool.exe 60fc9ffc71a54eded9926892b8efc5dae4d2df975a60024515f77c5d50ad5c52.exe File opened for modification \??\c:\Program Files (x86)\Google\Update\1.3.35.452\GoogleUpdate.exe 60fc9ffc71a54eded9926892b8efc5dae4d2df975a60024515f77c5d50ad5c52.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\setup.exe 60fc9ffc71a54eded9926892b8efc5dae4d2df975a60024515f77c5d50ad5c52.exe File opened for modification \??\c:\Program Files\Internet Explorer\ieinstal.exe 60fc9ffc71a54eded9926892b8efc5dae4d2df975a60024515f77c5d50ad5c52.exe -
Drops file in Windows directory 12 IoCs
Processes:
60fc9ffc71a54eded9926892b8efc5dae4d2df975a60024515f77c5d50ad5c52.exedescription ioc process File opened for modification \??\c:\Windows\splwow64.exe 60fc9ffc71a54eded9926892b8efc5dae4d2df975a60024515f77c5d50ad5c52.exe File opened for modification \??\c:\Windows\twunk_32.exe 60fc9ffc71a54eded9926892b8efc5dae4d2df975a60024515f77c5d50ad5c52.exe File opened for modification \??\c:\Windows\write.exe 60fc9ffc71a54eded9926892b8efc5dae4d2df975a60024515f77c5d50ad5c52.exe File opened for modification \??\c:\Windows\explorer.exe 60fc9ffc71a54eded9926892b8efc5dae4d2df975a60024515f77c5d50ad5c52.exe File opened for modification \??\c:\Windows\hh.exe 60fc9ffc71a54eded9926892b8efc5dae4d2df975a60024515f77c5d50ad5c52.exe File opened for modification \??\c:\Windows\notepad.exe 60fc9ffc71a54eded9926892b8efc5dae4d2df975a60024515f77c5d50ad5c52.exe File opened for modification \??\c:\Windows\twunk_16.exe 60fc9ffc71a54eded9926892b8efc5dae4d2df975a60024515f77c5d50ad5c52.exe File opened for modification \??\c:\Windows\winhlp32.exe 60fc9ffc71a54eded9926892b8efc5dae4d2df975a60024515f77c5d50ad5c52.exe File opened for modification \??\c:\Windows\Boot\PCAT\memtest.exe 60fc9ffc71a54eded9926892b8efc5dae4d2df975a60024515f77c5d50ad5c52.exe File opened for modification \??\c:\Windows\bfsvc.exe 60fc9ffc71a54eded9926892b8efc5dae4d2df975a60024515f77c5d50ad5c52.exe File opened for modification \??\c:\Windows\fveupdate.exe 60fc9ffc71a54eded9926892b8efc5dae4d2df975a60024515f77c5d50ad5c52.exe File opened for modification \??\c:\Windows\HelpPane.exe 60fc9ffc71a54eded9926892b8efc5dae4d2df975a60024515f77c5d50ad5c52.exe -
Modifies registry class 14 IoCs
Processes:
cmd.execmd.execmd.execmd.execmd.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\zipfile\Shell\Open\Command cmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\zipfile\Shell\Open\Command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\60fc9ffc71a54eded9926892b8efc5dae4d2df975a60024515f77c5d50ad5c52.exe " cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\jpgfile cmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\jpgfile\Shell\Open\Command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\60fc9ffc71a54eded9926892b8efc5dae4d2df975a60024515f77c5d50ad5c52.exe " cmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\60fc9ffc71a54eded9926892b8efc5dae4d2df975a60024515f77c5d50ad5c52.exe " cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\zipfile\Shell cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.txt cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\jpgfile\Shell\Open cmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\60fc9ffc71a54eded9926892b8efc5dae4d2df975a60024515f77c5d50ad5c52.exe " cmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.txt \ = " exefile" cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\jpgfile\Shell cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\jpgfile\Shell\Open\Command cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\zipfile cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\zipfile\Shell\Open cmd.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
60fc9ffc71a54eded9926892b8efc5dae4d2df975a60024515f77c5d50ad5c52.exepid process 368 60fc9ffc71a54eded9926892b8efc5dae4d2df975a60024515f77c5d50ad5c52.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
60fc9ffc71a54eded9926892b8efc5dae4d2df975a60024515f77c5d50ad5c52.exepid process 368 60fc9ffc71a54eded9926892b8efc5dae4d2df975a60024515f77c5d50ad5c52.exe -
Suspicious use of WriteProcessMemory 40 IoCs
Processes:
60fc9ffc71a54eded9926892b8efc5dae4d2df975a60024515f77c5d50ad5c52.execmd.exedescription pid process target process PID 368 wrote to memory of 1404 368 60fc9ffc71a54eded9926892b8efc5dae4d2df975a60024515f77c5d50ad5c52.exe cmd.exe PID 368 wrote to memory of 1404 368 60fc9ffc71a54eded9926892b8efc5dae4d2df975a60024515f77c5d50ad5c52.exe cmd.exe PID 368 wrote to memory of 1404 368 60fc9ffc71a54eded9926892b8efc5dae4d2df975a60024515f77c5d50ad5c52.exe cmd.exe PID 368 wrote to memory of 1404 368 60fc9ffc71a54eded9926892b8efc5dae4d2df975a60024515f77c5d50ad5c52.exe cmd.exe PID 368 wrote to memory of 1532 368 60fc9ffc71a54eded9926892b8efc5dae4d2df975a60024515f77c5d50ad5c52.exe cmd.exe PID 368 wrote to memory of 1532 368 60fc9ffc71a54eded9926892b8efc5dae4d2df975a60024515f77c5d50ad5c52.exe cmd.exe PID 368 wrote to memory of 1532 368 60fc9ffc71a54eded9926892b8efc5dae4d2df975a60024515f77c5d50ad5c52.exe cmd.exe PID 368 wrote to memory of 1532 368 60fc9ffc71a54eded9926892b8efc5dae4d2df975a60024515f77c5d50ad5c52.exe cmd.exe PID 368 wrote to memory of 1632 368 60fc9ffc71a54eded9926892b8efc5dae4d2df975a60024515f77c5d50ad5c52.exe cmd.exe PID 368 wrote to memory of 1632 368 60fc9ffc71a54eded9926892b8efc5dae4d2df975a60024515f77c5d50ad5c52.exe cmd.exe PID 368 wrote to memory of 1632 368 60fc9ffc71a54eded9926892b8efc5dae4d2df975a60024515f77c5d50ad5c52.exe cmd.exe PID 368 wrote to memory of 1632 368 60fc9ffc71a54eded9926892b8efc5dae4d2df975a60024515f77c5d50ad5c52.exe cmd.exe PID 368 wrote to memory of 316 368 60fc9ffc71a54eded9926892b8efc5dae4d2df975a60024515f77c5d50ad5c52.exe cmd.exe PID 368 wrote to memory of 316 368 60fc9ffc71a54eded9926892b8efc5dae4d2df975a60024515f77c5d50ad5c52.exe cmd.exe PID 368 wrote to memory of 316 368 60fc9ffc71a54eded9926892b8efc5dae4d2df975a60024515f77c5d50ad5c52.exe cmd.exe PID 368 wrote to memory of 316 368 60fc9ffc71a54eded9926892b8efc5dae4d2df975a60024515f77c5d50ad5c52.exe cmd.exe PID 368 wrote to memory of 588 368 60fc9ffc71a54eded9926892b8efc5dae4d2df975a60024515f77c5d50ad5c52.exe cmd.exe PID 368 wrote to memory of 588 368 60fc9ffc71a54eded9926892b8efc5dae4d2df975a60024515f77c5d50ad5c52.exe cmd.exe PID 368 wrote to memory of 588 368 60fc9ffc71a54eded9926892b8efc5dae4d2df975a60024515f77c5d50ad5c52.exe cmd.exe PID 368 wrote to memory of 588 368 60fc9ffc71a54eded9926892b8efc5dae4d2df975a60024515f77c5d50ad5c52.exe cmd.exe PID 1532 wrote to memory of 1572 1532 cmd.exe reg.exe PID 1532 wrote to memory of 1572 1532 cmd.exe reg.exe PID 1532 wrote to memory of 1572 1532 cmd.exe reg.exe PID 1532 wrote to memory of 1572 1532 cmd.exe reg.exe PID 368 wrote to memory of 1816 368 60fc9ffc71a54eded9926892b8efc5dae4d2df975a60024515f77c5d50ad5c52.exe cmd.exe PID 368 wrote to memory of 1816 368 60fc9ffc71a54eded9926892b8efc5dae4d2df975a60024515f77c5d50ad5c52.exe cmd.exe PID 368 wrote to memory of 1816 368 60fc9ffc71a54eded9926892b8efc5dae4d2df975a60024515f77c5d50ad5c52.exe cmd.exe PID 368 wrote to memory of 1816 368 60fc9ffc71a54eded9926892b8efc5dae4d2df975a60024515f77c5d50ad5c52.exe cmd.exe PID 368 wrote to memory of 324 368 60fc9ffc71a54eded9926892b8efc5dae4d2df975a60024515f77c5d50ad5c52.exe cmd.exe PID 368 wrote to memory of 324 368 60fc9ffc71a54eded9926892b8efc5dae4d2df975a60024515f77c5d50ad5c52.exe cmd.exe PID 368 wrote to memory of 324 368 60fc9ffc71a54eded9926892b8efc5dae4d2df975a60024515f77c5d50ad5c52.exe cmd.exe PID 368 wrote to memory of 324 368 60fc9ffc71a54eded9926892b8efc5dae4d2df975a60024515f77c5d50ad5c52.exe cmd.exe PID 1532 wrote to memory of 1952 1532 cmd.exe reg.exe PID 1532 wrote to memory of 1952 1532 cmd.exe reg.exe PID 1532 wrote to memory of 1952 1532 cmd.exe reg.exe PID 1532 wrote to memory of 1952 1532 cmd.exe reg.exe PID 1532 wrote to memory of 1984 1532 cmd.exe reg.exe PID 1532 wrote to memory of 1984 1532 cmd.exe reg.exe PID 1532 wrote to memory of 1984 1532 cmd.exe reg.exe PID 1532 wrote to memory of 1984 1532 cmd.exe reg.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\60fc9ffc71a54eded9926892b8efc5dae4d2df975a60024515f77c5d50ad5c52.exe"C:\Users\Admin\AppData\Local\Temp\60fc9ffc71a54eded9926892b8efc5dae4d2df975a60024515f77c5d50ad5c52.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd.exe2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c C:\123.bat2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exereg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\ZhuDongFangYu.exe" /v debugger /t reg_sz /d "ntsd -d" /f3⤵
-
C:\Windows\SysWOW64\reg.exereg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\360tray.exe" /v debugger /t reg_sz /d "ntsd -d" /f3⤵
-
C:\Windows\SysWOW64\reg.exereg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\taskmgr.exe" /v debugger /t reg_sz /d "ntsd -d" /f3⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c assoc .txt = exefile2⤵
- Modifies registry class
-
C:\Windows\SysWOW64\cmd.execmd.exe /c ftype comfile=C:\Users\Admin\AppData\Local\Temp\60fc9ffc71a54eded9926892b8efc5dae4d2df975a60024515f77c5d50ad5c52.exe2⤵
- Modifies system executable filetype association
- Modifies registry class
-
C:\Windows\SysWOW64\cmd.execmd.exe /c ftype zipfile=C:\Users\Admin\AppData\Local\Temp\60fc9ffc71a54eded9926892b8efc5dae4d2df975a60024515f77c5d50ad5c52.exe2⤵
- Modifies registry class
-
C:\Windows\SysWOW64\cmd.execmd.exe /c ftype jpgfile=C:\Users\Admin\AppData\Local\Temp\60fc9ffc71a54eded9926892b8efc5dae4d2df975a60024515f77c5d50ad5c52.exe2⤵
- Modifies registry class
-
C:\Windows\SysWOW64\cmd.execmd.exe /c ftype txtfile=C:\Users\Admin\AppData\Local\Temp\60fc9ffc71a54eded9926892b8efc5dae4d2df975a60024515f77c5d50ad5c52.exe2⤵
- Modifies registry class
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\123.batMD5
70170ba16a737a438223b88279dc6c85
SHA1cc066efa0fca9bc9f44013660dea6b28ddfd6a24
SHA256d3674f4b34a8ca8167160519aa5c66b6024eb09f4cb0c9278bc44370b0efec6a
SHA51237cc8c954544374d0a1ca4d012c9bd0b47781bc9bb8d0c15a8a95b9934893db3bedee867b984c20edabe54c39574abf7250de433aade6c0d544b8dd2c972c6da
-
memory/316-64-0x0000000000000000-mapping.dmp
-
memory/324-69-0x0000000000000000-mapping.dmp
-
memory/588-65-0x0000000000000000-mapping.dmp
-
memory/1404-61-0x0000000000000000-mapping.dmp
-
memory/1532-62-0x0000000000000000-mapping.dmp
-
memory/1572-67-0x0000000000000000-mapping.dmp
-
memory/1632-63-0x0000000000000000-mapping.dmp
-
memory/1632-70-0x0000000075C31000-0x0000000075C33000-memory.dmpFilesize
8KB
-
memory/1816-68-0x0000000000000000-mapping.dmp
-
memory/1952-71-0x0000000000000000-mapping.dmp
-
memory/1984-72-0x0000000000000000-mapping.dmp