Analysis
-
max time kernel
137s -
max time network
138s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
16-05-2021 00:21
Static task
static1
Behavioral task
behavioral1
Sample
7148ca8cc9041482682156ca16a1e83eba1333e16f41e80e522363a55ff2a0db.exe
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
7148ca8cc9041482682156ca16a1e83eba1333e16f41e80e522363a55ff2a0db.exe
Resource
win10v20210410
windows10_x64
0 signatures
0 seconds
General
-
Target
7148ca8cc9041482682156ca16a1e83eba1333e16f41e80e522363a55ff2a0db.exe
-
Size
88KB
-
MD5
b9fd952b27bc30f2561efbd2b2919ec7
-
SHA1
a8066d045f15b399bd1cb684b687537f56eb703f
-
SHA256
7148ca8cc9041482682156ca16a1e83eba1333e16f41e80e522363a55ff2a0db
-
SHA512
55d9eee46fedf05e33a64a66382a26903140c25a55500adbbab1a4f87cae530abe9a1da98a4f5b61a0a9d10835fc883f21eba438e00e1c907edd3e5848fafd7e
Score
10/10
Malware Config
Signatures
-
Modifies system executable filetype association 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\7148ca8cc9041482682156ca16a1e83eba1333e16f41e80e522363a55ff2a0db.exe " cmd.exe -
Sets file execution options in registry 2 TTPs
-
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification \??\c:\Windows\SysWOW64\regedit.exe 7148ca8cc9041482682156ca16a1e83eba1333e16f41e80e522363a55ff2a0db.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\kinit.exe 7148ca8cc9041482682156ca16a1e83eba1333e16f41e80e522363a55ff2a0db.exe File opened for modification \??\c:\Program Files\Java\jre7\bin\rmid.exe 7148ca8cc9041482682156ca16a1e83eba1333e16f41e80e522363a55ff2a0db.exe File opened for modification \??\c:\Program Files (x86)\Common Files\microsoft shared\DW\DW20.EXE 7148ca8cc9041482682156ca16a1e83eba1333e16f41e80e522363a55ff2a0db.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\MSPUB.EXE 7148ca8cc9041482682156ca16a1e83eba1333e16f41e80e522363a55ff2a0db.exe File opened for modification \??\c:\Program Files (x86)\Windows Media Player\wmlaunch.exe 7148ca8cc9041482682156ca16a1e83eba1333e16f41e80e522363a55ff2a0db.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\rmid.exe 7148ca8cc9041482682156ca16a1e83eba1333e16f41e80e522363a55ff2a0db.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec64.exe 7148ca8cc9041482682156ca16a1e83eba1333e16f41e80e522363a55ff2a0db.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\jre\bin\ssvagent.exe 7148ca8cc9041482682156ca16a1e83eba1333e16f41e80e522363a55ff2a0db.exe File opened for modification \??\c:\Program Files (x86)\Windows Media Player\wmplayer.exe 7148ca8cc9041482682156ca16a1e83eba1333e16f41e80e522363a55ff2a0db.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\jre\bin\keytool.exe 7148ca8cc9041482682156ca16a1e83eba1333e16f41e80e522363a55ff2a0db.exe File opened for modification \??\c:\Program Files\Java\jre7\bin\javacpl.exe 7148ca8cc9041482682156ca16a1e83eba1333e16f41e80e522363a55ff2a0db.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\MSOHTMED.EXE 7148ca8cc9041482682156ca16a1e83eba1333e16f41e80e522363a55ff2a0db.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe 7148ca8cc9041482682156ca16a1e83eba1333e16f41e80e522363a55ff2a0db.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\jsadebugd.exe 7148ca8cc9041482682156ca16a1e83eba1333e16f41e80e522363a55ff2a0db.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\ONELEV.EXE 7148ca8cc9041482682156ca16a1e83eba1333e16f41e80e522363a55ff2a0db.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\jre\bin\javaws.exe 7148ca8cc9041482682156ca16a1e83eba1333e16f41e80e522363a55ff2a0db.exe File opened for modification \??\c:\Program Files\Mozilla Firefox\updater.exe 7148ca8cc9041482682156ca16a1e83eba1333e16f41e80e522363a55ff2a0db.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\jhat.exe 7148ca8cc9041482682156ca16a1e83eba1333e16f41e80e522363a55ff2a0db.exe File opened for modification \??\c:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe 7148ca8cc9041482682156ca16a1e83eba1333e16f41e80e522363a55ff2a0db.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\MSOUC.EXE 7148ca8cc9041482682156ca16a1e83eba1333e16f41e80e522363a55ff2a0db.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\javap.exe 7148ca8cc9041482682156ca16a1e83eba1333e16f41e80e522363a55ff2a0db.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\javaws.exe 7148ca8cc9041482682156ca16a1e83eba1333e16f41e80e522363a55ff2a0db.exe File opened for modification \??\c:\Program Files (x86)\Windows Media Player\WMPDMC.exe 7148ca8cc9041482682156ca16a1e83eba1333e16f41e80e522363a55ff2a0db.exe File opened for modification \??\c:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\template.exe 7148ca8cc9041482682156ca16a1e83eba1333e16f41e80e522363a55ff2a0db.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\misc.exe 7148ca8cc9041482682156ca16a1e83eba1333e16f41e80e522363a55ff2a0db.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\WORDICON.EXE 7148ca8cc9041482682156ca16a1e83eba1333e16f41e80e522363a55ff2a0db.exe File opened for modification \??\c:\Program Files\7-Zip\7zG.exe 7148ca8cc9041482682156ca16a1e83eba1333e16f41e80e522363a55ff2a0db.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\wsimport.exe 7148ca8cc9041482682156ca16a1e83eba1333e16f41e80e522363a55ff2a0db.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\jre\bin\javaw.exe 7148ca8cc9041482682156ca16a1e83eba1333e16f41e80e522363a55ff2a0db.exe File opened for modification \??\c:\Program Files\Windows Media Player\WMPSideShowGadget.exe 7148ca8cc9041482682156ca16a1e83eba1333e16f41e80e522363a55ff2a0db.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\MSACCESS.EXE 7148ca8cc9041482682156ca16a1e83eba1333e16f41e80e522363a55ff2a0db.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE 7148ca8cc9041482682156ca16a1e83eba1333e16f41e80e522363a55ff2a0db.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\rmic.exe 7148ca8cc9041482682156ca16a1e83eba1333e16f41e80e522363a55ff2a0db.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\unpack200.exe 7148ca8cc9041482682156ca16a1e83eba1333e16f41e80e522363a55ff2a0db.exe File opened for modification \??\c:\Program Files (x86)\Google\Update\1.3.35.452\GoogleCrashHandler.exe 7148ca8cc9041482682156ca16a1e83eba1333e16f41e80e522363a55ff2a0db.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\jre\bin\java-rmi.exe 7148ca8cc9041482682156ca16a1e83eba1333e16f41e80e522363a55ff2a0db.exe File opened for modification \??\c:\Program Files (x86)\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPREARM.EXE 7148ca8cc9041482682156ca16a1e83eba1333e16f41e80e522363a55ff2a0db.exe File opened for modification \??\c:\Program Files\Mozilla Firefox\pingsender.exe 7148ca8cc9041482682156ca16a1e83eba1333e16f41e80e522363a55ff2a0db.exe File opened for modification \??\c:\Program Files (x86)\Common Files\microsoft shared\ink\TabTip32.exe 7148ca8cc9041482682156ca16a1e83eba1333e16f41e80e522363a55ff2a0db.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\javah.exe 7148ca8cc9041482682156ca16a1e83eba1333e16f41e80e522363a55ff2a0db.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\jre\bin\orbd.exe 7148ca8cc9041482682156ca16a1e83eba1333e16f41e80e522363a55ff2a0db.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\CLVIEW.EXE 7148ca8cc9041482682156ca16a1e83eba1333e16f41e80e522363a55ff2a0db.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE 7148ca8cc9041482682156ca16a1e83eba1333e16f41e80e522363a55ff2a0db.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\jcmd.exe 7148ca8cc9041482682156ca16a1e83eba1333e16f41e80e522363a55ff2a0db.exe File opened for modification \??\c:\Program Files (x86)\Google\Temp\GUME011.tmp\GoogleUpdateSetup.exe 7148ca8cc9041482682156ca16a1e83eba1333e16f41e80e522363a55ff2a0db.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\jre\bin\tnameserv.exe 7148ca8cc9041482682156ca16a1e83eba1333e16f41e80e522363a55ff2a0db.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\jre\bin\unpack200.exe 7148ca8cc9041482682156ca16a1e83eba1333e16f41e80e522363a55ff2a0db.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\jre\lib\launcher.exe 7148ca8cc9041482682156ca16a1e83eba1333e16f41e80e522363a55ff2a0db.exe File opened for modification \??\c:\Program Files\Java\jre7\bin\java-rmi.exe 7148ca8cc9041482682156ca16a1e83eba1333e16f41e80e522363a55ff2a0db.exe File opened for modification \??\c:\Program Files\Java\jre7\bin\keytool.exe 7148ca8cc9041482682156ca16a1e83eba1333e16f41e80e522363a55ff2a0db.exe File opened for modification \??\c:\Program Files (x86)\Google\Update\1.3.35.452\GoogleUpdateCore.exe 7148ca8cc9041482682156ca16a1e83eba1333e16f41e80e522363a55ff2a0db.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\jconsole.exe 7148ca8cc9041482682156ca16a1e83eba1333e16f41e80e522363a55ff2a0db.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\native2ascii.exe 7148ca8cc9041482682156ca16a1e83eba1333e16f41e80e522363a55ff2a0db.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\SCANPST.EXE 7148ca8cc9041482682156ca16a1e83eba1333e16f41e80e522363a55ff2a0db.exe File opened for modification \??\c:\Program Files (x86)\Windows Sidebar\sidebar.exe 7148ca8cc9041482682156ca16a1e83eba1333e16f41e80e522363a55ff2a0db.exe File opened for modification \??\c:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\ODeploy.exe 7148ca8cc9041482682156ca16a1e83eba1333e16f41e80e522363a55ff2a0db.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\Wordconv.exe 7148ca8cc9041482682156ca16a1e83eba1333e16f41e80e522363a55ff2a0db.exe File opened for modification \??\c:\Program Files\Windows Sidebar\sidebar.exe 7148ca8cc9041482682156ca16a1e83eba1333e16f41e80e522363a55ff2a0db.exe File opened for modification \??\c:\Program Files\Java\jre7\bin\unpack200.exe 7148ca8cc9041482682156ca16a1e83eba1333e16f41e80e522363a55ff2a0db.exe File opened for modification \??\c:\Program Files\Mozilla Firefox\plugin-hang-ui.exe 7148ca8cc9041482682156ca16a1e83eba1333e16f41e80e522363a55ff2a0db.exe File opened for modification \??\c:\Program Files\Windows Media Player\setup_wm.exe 7148ca8cc9041482682156ca16a1e83eba1333e16f41e80e522363a55ff2a0db.exe File opened for modification \??\c:\Program Files (x86)\Common Files\microsoft shared\EQUATION\EQNEDT32.EXE 7148ca8cc9041482682156ca16a1e83eba1333e16f41e80e522363a55ff2a0db.exe File opened for modification \??\c:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe 7148ca8cc9041482682156ca16a1e83eba1333e16f41e80e522363a55ff2a0db.exe File opened for modification \??\c:\Program Files (x86)\Google\Update\1.3.35.452\GoogleUpdateSetup.exe 7148ca8cc9041482682156ca16a1e83eba1333e16f41e80e522363a55ff2a0db.exe -
Drops file in Windows directory 12 IoCs
description ioc Process File opened for modification \??\c:\Windows\fveupdate.exe 7148ca8cc9041482682156ca16a1e83eba1333e16f41e80e522363a55ff2a0db.exe File opened for modification \??\c:\Windows\hh.exe 7148ca8cc9041482682156ca16a1e83eba1333e16f41e80e522363a55ff2a0db.exe File opened for modification \??\c:\Windows\splwow64.exe 7148ca8cc9041482682156ca16a1e83eba1333e16f41e80e522363a55ff2a0db.exe File opened for modification \??\c:\Windows\twunk_16.exe 7148ca8cc9041482682156ca16a1e83eba1333e16f41e80e522363a55ff2a0db.exe File opened for modification \??\c:\Windows\twunk_32.exe 7148ca8cc9041482682156ca16a1e83eba1333e16f41e80e522363a55ff2a0db.exe File opened for modification \??\c:\Windows\winhlp32.exe 7148ca8cc9041482682156ca16a1e83eba1333e16f41e80e522363a55ff2a0db.exe File opened for modification \??\c:\Windows\bfsvc.exe 7148ca8cc9041482682156ca16a1e83eba1333e16f41e80e522363a55ff2a0db.exe File opened for modification \??\c:\Windows\explorer.exe 7148ca8cc9041482682156ca16a1e83eba1333e16f41e80e522363a55ff2a0db.exe File opened for modification \??\c:\Windows\HelpPane.exe 7148ca8cc9041482682156ca16a1e83eba1333e16f41e80e522363a55ff2a0db.exe File opened for modification \??\c:\Windows\notepad.exe 7148ca8cc9041482682156ca16a1e83eba1333e16f41e80e522363a55ff2a0db.exe File opened for modification \??\c:\Windows\write.exe 7148ca8cc9041482682156ca16a1e83eba1333e16f41e80e522363a55ff2a0db.exe File opened for modification \??\c:\Windows\Boot\PCAT\memtest.exe 7148ca8cc9041482682156ca16a1e83eba1333e16f41e80e522363a55ff2a0db.exe -
Modifies registry class 14 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\zipfile\Shell cmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\jpgfile\Shell\Open\Command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\7148ca8cc9041482682156ca16a1e83eba1333e16f41e80e522363a55ff2a0db.exe " cmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\7148ca8cc9041482682156ca16a1e83eba1333e16f41e80e522363a55ff2a0db.exe " cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\zipfile\Shell\Open cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\zipfile\Shell\Open\Command cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\jpgfile\Shell\Open\Command cmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\7148ca8cc9041482682156ca16a1e83eba1333e16f41e80e522363a55ff2a0db.exe " cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\jpgfile\Shell\Open cmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\zipfile\Shell\Open\Command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\7148ca8cc9041482682156ca16a1e83eba1333e16f41e80e522363a55ff2a0db.exe " cmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.txt \ = " exefile" cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\jpgfile cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\zipfile cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.txt cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\jpgfile\Shell cmd.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1088 7148ca8cc9041482682156ca16a1e83eba1333e16f41e80e522363a55ff2a0db.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1088 7148ca8cc9041482682156ca16a1e83eba1333e16f41e80e522363a55ff2a0db.exe -
Suspicious use of WriteProcessMemory 40 IoCs
description pid Process procid_target PID 1088 wrote to memory of 1464 1088 7148ca8cc9041482682156ca16a1e83eba1333e16f41e80e522363a55ff2a0db.exe 26 PID 1088 wrote to memory of 1464 1088 7148ca8cc9041482682156ca16a1e83eba1333e16f41e80e522363a55ff2a0db.exe 26 PID 1088 wrote to memory of 1464 1088 7148ca8cc9041482682156ca16a1e83eba1333e16f41e80e522363a55ff2a0db.exe 26 PID 1088 wrote to memory of 1464 1088 7148ca8cc9041482682156ca16a1e83eba1333e16f41e80e522363a55ff2a0db.exe 26 PID 1088 wrote to memory of 1348 1088 7148ca8cc9041482682156ca16a1e83eba1333e16f41e80e522363a55ff2a0db.exe 31 PID 1088 wrote to memory of 1348 1088 7148ca8cc9041482682156ca16a1e83eba1333e16f41e80e522363a55ff2a0db.exe 31 PID 1088 wrote to memory of 1348 1088 7148ca8cc9041482682156ca16a1e83eba1333e16f41e80e522363a55ff2a0db.exe 31 PID 1088 wrote to memory of 1348 1088 7148ca8cc9041482682156ca16a1e83eba1333e16f41e80e522363a55ff2a0db.exe 31 PID 1088 wrote to memory of 828 1088 7148ca8cc9041482682156ca16a1e83eba1333e16f41e80e522363a55ff2a0db.exe 32 PID 1088 wrote to memory of 828 1088 7148ca8cc9041482682156ca16a1e83eba1333e16f41e80e522363a55ff2a0db.exe 32 PID 1088 wrote to memory of 828 1088 7148ca8cc9041482682156ca16a1e83eba1333e16f41e80e522363a55ff2a0db.exe 32 PID 1088 wrote to memory of 828 1088 7148ca8cc9041482682156ca16a1e83eba1333e16f41e80e522363a55ff2a0db.exe 32 PID 1088 wrote to memory of 1568 1088 7148ca8cc9041482682156ca16a1e83eba1333e16f41e80e522363a55ff2a0db.exe 36 PID 1088 wrote to memory of 1568 1088 7148ca8cc9041482682156ca16a1e83eba1333e16f41e80e522363a55ff2a0db.exe 36 PID 1088 wrote to memory of 1568 1088 7148ca8cc9041482682156ca16a1e83eba1333e16f41e80e522363a55ff2a0db.exe 36 PID 1088 wrote to memory of 1568 1088 7148ca8cc9041482682156ca16a1e83eba1333e16f41e80e522363a55ff2a0db.exe 36 PID 1088 wrote to memory of 1532 1088 7148ca8cc9041482682156ca16a1e83eba1333e16f41e80e522363a55ff2a0db.exe 34 PID 1088 wrote to memory of 1532 1088 7148ca8cc9041482682156ca16a1e83eba1333e16f41e80e522363a55ff2a0db.exe 34 PID 1088 wrote to memory of 1532 1088 7148ca8cc9041482682156ca16a1e83eba1333e16f41e80e522363a55ff2a0db.exe 34 PID 1088 wrote to memory of 1532 1088 7148ca8cc9041482682156ca16a1e83eba1333e16f41e80e522363a55ff2a0db.exe 34 PID 1088 wrote to memory of 288 1088 7148ca8cc9041482682156ca16a1e83eba1333e16f41e80e522363a55ff2a0db.exe 38 PID 1088 wrote to memory of 288 1088 7148ca8cc9041482682156ca16a1e83eba1333e16f41e80e522363a55ff2a0db.exe 38 PID 1088 wrote to memory of 288 1088 7148ca8cc9041482682156ca16a1e83eba1333e16f41e80e522363a55ff2a0db.exe 38 PID 1088 wrote to memory of 288 1088 7148ca8cc9041482682156ca16a1e83eba1333e16f41e80e522363a55ff2a0db.exe 38 PID 1088 wrote to memory of 524 1088 7148ca8cc9041482682156ca16a1e83eba1333e16f41e80e522363a55ff2a0db.exe 40 PID 1088 wrote to memory of 524 1088 7148ca8cc9041482682156ca16a1e83eba1333e16f41e80e522363a55ff2a0db.exe 40 PID 1088 wrote to memory of 524 1088 7148ca8cc9041482682156ca16a1e83eba1333e16f41e80e522363a55ff2a0db.exe 40 PID 1088 wrote to memory of 524 1088 7148ca8cc9041482682156ca16a1e83eba1333e16f41e80e522363a55ff2a0db.exe 40 PID 1348 wrote to memory of 756 1348 cmd.exe 43 PID 1348 wrote to memory of 756 1348 cmd.exe 43 PID 1348 wrote to memory of 756 1348 cmd.exe 43 PID 1348 wrote to memory of 756 1348 cmd.exe 43 PID 1348 wrote to memory of 304 1348 cmd.exe 44 PID 1348 wrote to memory of 304 1348 cmd.exe 44 PID 1348 wrote to memory of 304 1348 cmd.exe 44 PID 1348 wrote to memory of 304 1348 cmd.exe 44 PID 1348 wrote to memory of 568 1348 cmd.exe 45 PID 1348 wrote to memory of 568 1348 cmd.exe 45 PID 1348 wrote to memory of 568 1348 cmd.exe 45 PID 1348 wrote to memory of 568 1348 cmd.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\7148ca8cc9041482682156ca16a1e83eba1333e16f41e80e522363a55ff2a0db.exe"C:\Users\Admin\AppData\Local\Temp\7148ca8cc9041482682156ca16a1e83eba1333e16f41e80e522363a55ff2a0db.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1088 -
C:\Windows\SysWOW64\cmd.execmd.exe2⤵PID:1464
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\123.bat2⤵
- Suspicious use of WriteProcessMemory
PID:1348 -
C:\Windows\SysWOW64\reg.exereg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\ZhuDongFangYu.exe" /v debugger /t reg_sz /d "ntsd -d" /f3⤵PID:756
-
-
C:\Windows\SysWOW64\reg.exereg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\360tray.exe" /v debugger /t reg_sz /d "ntsd -d" /f3⤵PID:304
-
-
C:\Windows\SysWOW64\reg.exereg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\taskmgr.exe" /v debugger /t reg_sz /d "ntsd -d" /f3⤵PID:568
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c assoc .txt = exefile2⤵
- Modifies registry class
PID:828
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c ftype zipfile=C:\Users\Admin\AppData\Local\Temp\7148ca8cc9041482682156ca16a1e83eba1333e16f41e80e522363a55ff2a0db.exe2⤵
- Modifies registry class
PID:1532
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c ftype comfile=C:\Users\Admin\AppData\Local\Temp\7148ca8cc9041482682156ca16a1e83eba1333e16f41e80e522363a55ff2a0db.exe2⤵
- Modifies system executable filetype association
- Modifies registry class
PID:1568
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c ftype jpgfile=C:\Users\Admin\AppData\Local\Temp\7148ca8cc9041482682156ca16a1e83eba1333e16f41e80e522363a55ff2a0db.exe2⤵
- Modifies registry class
PID:288
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c ftype txtfile=C:\Users\Admin\AppData\Local\Temp\7148ca8cc9041482682156ca16a1e83eba1333e16f41e80e522363a55ff2a0db.exe2⤵
- Modifies registry class
PID:524
-