Analysis
-
max time kernel
151s -
max time network
121s -
platform
windows7_x64 -
resource
win7-en-20211104 -
submitted
06-12-2021 03:13
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Trojan.GenericKD.38184020.11638.15716.exe
Resource
win7-en-20211104
Behavioral task
behavioral2
Sample
SecuriteInfo.com.Trojan.GenericKD.38184020.11638.15716.exe
Resource
win10-en-20211014
General
-
Target
SecuriteInfo.com.Trojan.GenericKD.38184020.11638.15716.exe
-
Size
120KB
-
MD5
73073649b02ccf2809aee7713ee72ee2
-
SHA1
b724c23ed90ddf15412aa917d87422274521e48a
-
SHA256
dcd20edf47f46b27c1b81cf03d18dc00aecff1d1eba9f0a0e55e1182f4a2f0b6
-
SHA512
2c3688c829ee654a5eb65d3633478a01072ccedb69724bcb71d059823ab0a486a30867207c3d05ad56fc7005e46fa78690c152f019a5e0cd4ea92a11357a59e4
Malware Config
Signatures
-
Downloads MZ/PE file
-
Executes dropped EXE 3 IoCs
Processes:
7z.exe7z.exeRegHost.exepid process 2032 7z.exe 1056 7z.exe 1412 RegHost.exe -
Processes:
resource yara_rule C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe upx \Users\Admin\AppData\Roaming\Microsoft\RegHost.exe upx C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe upx \Users\Admin\AppData\Roaming\Microsoft\RegHost.exe upx -
Loads dropped DLL 5 IoCs
Processes:
cmd.exe7z.exe7z.exeexplorer.exepid process 1160 cmd.exe 2032 7z.exe 1056 7z.exe 1752 explorer.exe 1752 explorer.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
RegHost.exeSecuriteInfo.com.Trojan.GenericKD.38184020.11638.15716.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe -FromAutoRun" RegHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe -FromAutoRun" SecuriteInfo.com.Trojan.GenericKD.38184020.11638.15716.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs
Processes:
bfsvc.exeexplorer.exepid process 980 bfsvc.exe 980 bfsvc.exe 980 bfsvc.exe 980 bfsvc.exe 1752 explorer.exe 1752 explorer.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
SecuriteInfo.com.Trojan.GenericKD.38184020.11638.15716.exedescription pid process target process PID 684 set thread context of 980 684 SecuriteInfo.com.Trojan.GenericKD.38184020.11638.15716.exe bfsvc.exe PID 684 set thread context of 1752 684 SecuriteInfo.com.Trojan.GenericKD.38184020.11638.15716.exe explorer.exe -
Processes:
SecuriteInfo.com.Trojan.GenericKD.38184020.11638.15716.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25 SecuriteInfo.com.Trojan.GenericKD.38184020.11638.15716.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc252000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a SecuriteInfo.com.Trojan.GenericKD.38184020.11638.15716.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc35300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a82000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a SecuriteInfo.com.Trojan.GenericKD.38184020.11638.15716.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 040000000100000010000000d474de575c39b2d39c8583c5c065498a0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25190000000100000010000000ba4f3972e7aed9dccdc210db59da13c92000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a SecuriteInfo.com.Trojan.GenericKD.38184020.11638.15716.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
explorer.exepid process 1752 explorer.exe 1752 explorer.exe 1752 explorer.exe 1752 explorer.exe 1752 explorer.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
Processes:
7z.exe7z.exedescription pid process Token: SeRestorePrivilege 2032 7z.exe Token: 35 2032 7z.exe Token: SeSecurityPrivilege 2032 7z.exe Token: SeSecurityPrivilege 2032 7z.exe Token: SeRestorePrivilege 1056 7z.exe Token: 35 1056 7z.exe Token: SeSecurityPrivilege 1056 7z.exe Token: SeSecurityPrivilege 1056 7z.exe -
Suspicious use of WriteProcessMemory 61 IoCs
Processes:
SecuriteInfo.com.Trojan.GenericKD.38184020.11638.15716.execmd.execmd.exeexplorer.exedescription pid process target process PID 684 wrote to memory of 1160 684 SecuriteInfo.com.Trojan.GenericKD.38184020.11638.15716.exe cmd.exe PID 684 wrote to memory of 1160 684 SecuriteInfo.com.Trojan.GenericKD.38184020.11638.15716.exe cmd.exe PID 684 wrote to memory of 1160 684 SecuriteInfo.com.Trojan.GenericKD.38184020.11638.15716.exe cmd.exe PID 1160 wrote to memory of 2032 1160 cmd.exe 7z.exe PID 1160 wrote to memory of 2032 1160 cmd.exe 7z.exe PID 1160 wrote to memory of 2032 1160 cmd.exe 7z.exe PID 684 wrote to memory of 1012 684 SecuriteInfo.com.Trojan.GenericKD.38184020.11638.15716.exe cmd.exe PID 684 wrote to memory of 1012 684 SecuriteInfo.com.Trojan.GenericKD.38184020.11638.15716.exe cmd.exe PID 684 wrote to memory of 1012 684 SecuriteInfo.com.Trojan.GenericKD.38184020.11638.15716.exe cmd.exe PID 1012 wrote to memory of 1056 1012 cmd.exe 7z.exe PID 1012 wrote to memory of 1056 1012 cmd.exe 7z.exe PID 1012 wrote to memory of 1056 1012 cmd.exe 7z.exe PID 684 wrote to memory of 980 684 SecuriteInfo.com.Trojan.GenericKD.38184020.11638.15716.exe bfsvc.exe PID 684 wrote to memory of 980 684 SecuriteInfo.com.Trojan.GenericKD.38184020.11638.15716.exe bfsvc.exe PID 684 wrote to memory of 980 684 SecuriteInfo.com.Trojan.GenericKD.38184020.11638.15716.exe bfsvc.exe PID 684 wrote to memory of 980 684 SecuriteInfo.com.Trojan.GenericKD.38184020.11638.15716.exe bfsvc.exe PID 684 wrote to memory of 980 684 SecuriteInfo.com.Trojan.GenericKD.38184020.11638.15716.exe bfsvc.exe PID 684 wrote to memory of 980 684 SecuriteInfo.com.Trojan.GenericKD.38184020.11638.15716.exe bfsvc.exe PID 684 wrote to memory of 980 684 SecuriteInfo.com.Trojan.GenericKD.38184020.11638.15716.exe bfsvc.exe PID 684 wrote to memory of 980 684 SecuriteInfo.com.Trojan.GenericKD.38184020.11638.15716.exe bfsvc.exe PID 684 wrote to memory of 980 684 SecuriteInfo.com.Trojan.GenericKD.38184020.11638.15716.exe bfsvc.exe PID 684 wrote to memory of 980 684 SecuriteInfo.com.Trojan.GenericKD.38184020.11638.15716.exe bfsvc.exe PID 684 wrote to memory of 980 684 SecuriteInfo.com.Trojan.GenericKD.38184020.11638.15716.exe bfsvc.exe PID 684 wrote to memory of 980 684 SecuriteInfo.com.Trojan.GenericKD.38184020.11638.15716.exe bfsvc.exe PID 684 wrote to memory of 980 684 SecuriteInfo.com.Trojan.GenericKD.38184020.11638.15716.exe bfsvc.exe PID 684 wrote to memory of 980 684 SecuriteInfo.com.Trojan.GenericKD.38184020.11638.15716.exe bfsvc.exe PID 684 wrote to memory of 980 684 SecuriteInfo.com.Trojan.GenericKD.38184020.11638.15716.exe bfsvc.exe PID 684 wrote to memory of 980 684 SecuriteInfo.com.Trojan.GenericKD.38184020.11638.15716.exe bfsvc.exe PID 684 wrote to memory of 980 684 SecuriteInfo.com.Trojan.GenericKD.38184020.11638.15716.exe bfsvc.exe PID 684 wrote to memory of 980 684 SecuriteInfo.com.Trojan.GenericKD.38184020.11638.15716.exe bfsvc.exe PID 684 wrote to memory of 980 684 SecuriteInfo.com.Trojan.GenericKD.38184020.11638.15716.exe bfsvc.exe PID 684 wrote to memory of 980 684 SecuriteInfo.com.Trojan.GenericKD.38184020.11638.15716.exe bfsvc.exe PID 684 wrote to memory of 980 684 SecuriteInfo.com.Trojan.GenericKD.38184020.11638.15716.exe bfsvc.exe PID 684 wrote to memory of 980 684 SecuriteInfo.com.Trojan.GenericKD.38184020.11638.15716.exe bfsvc.exe PID 684 wrote to memory of 980 684 SecuriteInfo.com.Trojan.GenericKD.38184020.11638.15716.exe bfsvc.exe PID 684 wrote to memory of 980 684 SecuriteInfo.com.Trojan.GenericKD.38184020.11638.15716.exe bfsvc.exe PID 684 wrote to memory of 1752 684 SecuriteInfo.com.Trojan.GenericKD.38184020.11638.15716.exe explorer.exe PID 684 wrote to memory of 1752 684 SecuriteInfo.com.Trojan.GenericKD.38184020.11638.15716.exe explorer.exe PID 684 wrote to memory of 1752 684 SecuriteInfo.com.Trojan.GenericKD.38184020.11638.15716.exe explorer.exe PID 684 wrote to memory of 1752 684 SecuriteInfo.com.Trojan.GenericKD.38184020.11638.15716.exe explorer.exe PID 684 wrote to memory of 1752 684 SecuriteInfo.com.Trojan.GenericKD.38184020.11638.15716.exe explorer.exe PID 684 wrote to memory of 1752 684 SecuriteInfo.com.Trojan.GenericKD.38184020.11638.15716.exe explorer.exe PID 684 wrote to memory of 1752 684 SecuriteInfo.com.Trojan.GenericKD.38184020.11638.15716.exe explorer.exe PID 684 wrote to memory of 1752 684 SecuriteInfo.com.Trojan.GenericKD.38184020.11638.15716.exe explorer.exe PID 684 wrote to memory of 1752 684 SecuriteInfo.com.Trojan.GenericKD.38184020.11638.15716.exe explorer.exe PID 684 wrote to memory of 1752 684 SecuriteInfo.com.Trojan.GenericKD.38184020.11638.15716.exe explorer.exe PID 684 wrote to memory of 1752 684 SecuriteInfo.com.Trojan.GenericKD.38184020.11638.15716.exe explorer.exe PID 684 wrote to memory of 1752 684 SecuriteInfo.com.Trojan.GenericKD.38184020.11638.15716.exe explorer.exe PID 684 wrote to memory of 1752 684 SecuriteInfo.com.Trojan.GenericKD.38184020.11638.15716.exe explorer.exe PID 684 wrote to memory of 1752 684 SecuriteInfo.com.Trojan.GenericKD.38184020.11638.15716.exe explorer.exe PID 684 wrote to memory of 1752 684 SecuriteInfo.com.Trojan.GenericKD.38184020.11638.15716.exe explorer.exe PID 684 wrote to memory of 1752 684 SecuriteInfo.com.Trojan.GenericKD.38184020.11638.15716.exe explorer.exe PID 684 wrote to memory of 1752 684 SecuriteInfo.com.Trojan.GenericKD.38184020.11638.15716.exe explorer.exe PID 684 wrote to memory of 1752 684 SecuriteInfo.com.Trojan.GenericKD.38184020.11638.15716.exe explorer.exe PID 684 wrote to memory of 1752 684 SecuriteInfo.com.Trojan.GenericKD.38184020.11638.15716.exe explorer.exe PID 684 wrote to memory of 1752 684 SecuriteInfo.com.Trojan.GenericKD.38184020.11638.15716.exe explorer.exe PID 684 wrote to memory of 1752 684 SecuriteInfo.com.Trojan.GenericKD.38184020.11638.15716.exe explorer.exe PID 684 wrote to memory of 1752 684 SecuriteInfo.com.Trojan.GenericKD.38184020.11638.15716.exe explorer.exe PID 1752 wrote to memory of 1412 1752 explorer.exe RegHost.exe PID 1752 wrote to memory of 1412 1752 explorer.exe RegHost.exe PID 1752 wrote to memory of 1412 1752 explorer.exe RegHost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.GenericKD.38184020.11638.15716.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.GenericKD.38184020.11638.15716.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\Microsoft\7z.exe x C:\Users\Admin\AppData\Roaming\Microsoft\RegHost_Temp.zip * -p"8311417383488996" -oC:\Users\Admin\AppData\Roaming\Microsoft\2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\7z.exeC:\Users\Admin\AppData\Roaming\Microsoft\7z.exe x C:\Users\Admin\AppData\Roaming\Microsoft\RegHost_Temp.zip * -p"8311417383488996" -oC:\Users\Admin\AppData\Roaming\Microsoft\3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\Microsoft\7z.exe x C:\Users\Admin\AppData\Roaming\Microsoft\RegData_Temp.zip * -p"9249970918899184" -oC:\Users\Admin\AppData\Roaming\Microsoft\2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\7z.exeC:\Users\Admin\AppData\Roaming\Microsoft\7z.exe x C:\Users\Admin\AppData\Roaming\Microsoft\RegData_Temp.zip * -p"9249970918899184" -oC:\Users\Admin\AppData\Roaming\Microsoft\3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\bfsvc.exeC:\Windows\bfsvc.exe -log 0 -ftime 60 -pool eu1-etc.ethermine.org:4444 -wal 0xa6ceE57d9638dA506ff99899c6C018292Ef4826C -coin etc -worker EasyMiner_Bot -clKernel 32⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Windows\explorer.exeC:\Windows\bfsvc.exe -log 0 -ftime 60 -pool eu1-etc.ethermine.org:4444 -wal 0xa6ceE57d9638dA506ff99899c6C018292Ef4826C -coin etc -worker EasyMiner_Bot -clKernel 32⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\7z.dllMD5
42336b5fc6be24babfb87699c858fb27
SHA138ae0db53b22d2e2f52bfdf25b14d79f8feca7aa
SHA256b5508c1dab79939770ed9aa151b6731af075e84c34a316d36fc90388d3a7af07
SHA512f091cb629231811b14ff7d40d8e8ad5e9e0c389f5c56679efb26e33dc189575f062f16f4e4b7e6caea4c268c07955bfb461ca6e86a16778c37d4cb833c8dc3f3
-
C:\Users\Admin\AppData\Roaming\Microsoft\7z.exeMD5
86e8388e83be8909d148518cf7b6e083
SHA14f7fdcf3abc0169b591e502842be074a5188c2c9
SHA2564120c9e964ea7ed9f267ba921367a50f7b0895febe008a10aa91c0c69b966f17
SHA5122d34d381aacd3ef7482e7580dd39760e09805a6bd8380776a40743018218ae18cc9c09aea2f54568f46f9ab12c9042a675c2956e9bc746ddc5afb22bb26e3c5e
-
C:\Users\Admin\AppData\Roaming\Microsoft\7z.exeMD5
86e8388e83be8909d148518cf7b6e083
SHA14f7fdcf3abc0169b591e502842be074a5188c2c9
SHA2564120c9e964ea7ed9f267ba921367a50f7b0895febe008a10aa91c0c69b966f17
SHA5122d34d381aacd3ef7482e7580dd39760e09805a6bd8380776a40743018218ae18cc9c09aea2f54568f46f9ab12c9042a675c2956e9bc746ddc5afb22bb26e3c5e
-
C:\Users\Admin\AppData\Roaming\Microsoft\RegData_Temp.exeMD5
67a55e73dc3e285f5ecad2f52e4606aa
SHA1280b8d8083aac33e1b05078bb6706f155cae47c7
SHA256fc0e21a8e33d53a30207d3e0e3dc9079e253fc623cc4835877cbc39ca7a826a3
SHA512e12b564cc866d3d50246c4326e0086daa3086adf8084f69c1f0fa49a091ed9a2c93ea07a2f6cc4eec30dea54492dbf12950e8e3e7f6c26208f7b57860f362efe
-
C:\Users\Admin\AppData\Roaming\Microsoft\RegData_Temp.zipMD5
1543b223f63fda679a94d034d23b27ba
SHA182eb69d0d096ff966679ce92c4fb2dd5a8dd6f1e
SHA25630868a1cadb90f598ec9d96f93650c90883941522134b2e0a2dfeca958958e34
SHA512270de3749322416e371d5177b974450e5e2fbca3570179d2f4811f1fda55aca4ea82cbd0a37d1b56ee8614be154373054b573da854a818caafb41b3cee502f78
-
C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exeMD5
73073649b02ccf2809aee7713ee72ee2
SHA1b724c23ed90ddf15412aa917d87422274521e48a
SHA256dcd20edf47f46b27c1b81cf03d18dc00aecff1d1eba9f0a0e55e1182f4a2f0b6
SHA5122c3688c829ee654a5eb65d3633478a01072ccedb69724bcb71d059823ab0a486a30867207c3d05ad56fc7005e46fa78690c152f019a5e0cd4ea92a11357a59e4
-
C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exeMD5
73073649b02ccf2809aee7713ee72ee2
SHA1b724c23ed90ddf15412aa917d87422274521e48a
SHA256dcd20edf47f46b27c1b81cf03d18dc00aecff1d1eba9f0a0e55e1182f4a2f0b6
SHA5122c3688c829ee654a5eb65d3633478a01072ccedb69724bcb71d059823ab0a486a30867207c3d05ad56fc7005e46fa78690c152f019a5e0cd4ea92a11357a59e4
-
C:\Users\Admin\AppData\Roaming\Microsoft\RegHost_Temp.exeMD5
9d99b4d43e4e7a0408c5fe99b4cc4afe
SHA1702436963243f0de2d431ec29b199505a0aa3b90
SHA256c9e36c039bfc370135feabad11840fe457caec3c4914351461f3f9e115194fb3
SHA51244620e76efc6d0cefc1c6f8eca77c0114d41fbf4d6e1f6ff2287286ff57aca1679a0428b35c757afb96fd31d99de8b9e1d956b89636d9c373248e5c5b5b05754
-
C:\Users\Admin\AppData\Roaming\Microsoft\RegHost_Temp.zipMD5
32ab3a6509fe78d666dcafc5be73f2e1
SHA1c16e1c2716b4ae5b9e5bfb9773d810344b539126
SHA256dd2170bbea158a2c2b8c262c2be9c8d91fc3e86efe7f607fce7a9224a389bdec
SHA512c31ee784de253c4f5c36990959d8e6f74b2b0eeecfd265cab2d5295be33f7af056e144d829adcd754c78e06023816cb3f576110314717ee7e50cc0af507f02fe
-
\Users\Admin\AppData\Roaming\Microsoft\7z.dllMD5
42336b5fc6be24babfb87699c858fb27
SHA138ae0db53b22d2e2f52bfdf25b14d79f8feca7aa
SHA256b5508c1dab79939770ed9aa151b6731af075e84c34a316d36fc90388d3a7af07
SHA512f091cb629231811b14ff7d40d8e8ad5e9e0c389f5c56679efb26e33dc189575f062f16f4e4b7e6caea4c268c07955bfb461ca6e86a16778c37d4cb833c8dc3f3
-
\Users\Admin\AppData\Roaming\Microsoft\7z.dllMD5
42336b5fc6be24babfb87699c858fb27
SHA138ae0db53b22d2e2f52bfdf25b14d79f8feca7aa
SHA256b5508c1dab79939770ed9aa151b6731af075e84c34a316d36fc90388d3a7af07
SHA512f091cb629231811b14ff7d40d8e8ad5e9e0c389f5c56679efb26e33dc189575f062f16f4e4b7e6caea4c268c07955bfb461ca6e86a16778c37d4cb833c8dc3f3
-
\Users\Admin\AppData\Roaming\Microsoft\7z.exeMD5
86e8388e83be8909d148518cf7b6e083
SHA14f7fdcf3abc0169b591e502842be074a5188c2c9
SHA2564120c9e964ea7ed9f267ba921367a50f7b0895febe008a10aa91c0c69b966f17
SHA5122d34d381aacd3ef7482e7580dd39760e09805a6bd8380776a40743018218ae18cc9c09aea2f54568f46f9ab12c9042a675c2956e9bc746ddc5afb22bb26e3c5e
-
\Users\Admin\AppData\Roaming\Microsoft\RegHost.exeMD5
73073649b02ccf2809aee7713ee72ee2
SHA1b724c23ed90ddf15412aa917d87422274521e48a
SHA256dcd20edf47f46b27c1b81cf03d18dc00aecff1d1eba9f0a0e55e1182f4a2f0b6
SHA5122c3688c829ee654a5eb65d3633478a01072ccedb69724bcb71d059823ab0a486a30867207c3d05ad56fc7005e46fa78690c152f019a5e0cd4ea92a11357a59e4
-
\Users\Admin\AppData\Roaming\Microsoft\RegHost.exeMD5
73073649b02ccf2809aee7713ee72ee2
SHA1b724c23ed90ddf15412aa917d87422274521e48a
SHA256dcd20edf47f46b27c1b81cf03d18dc00aecff1d1eba9f0a0e55e1182f4a2f0b6
SHA5122c3688c829ee654a5eb65d3633478a01072ccedb69724bcb71d059823ab0a486a30867207c3d05ad56fc7005e46fa78690c152f019a5e0cd4ea92a11357a59e4
-
memory/684-55-0x000007FEFB761000-0x000007FEFB763000-memory.dmpFilesize
8KB
-
memory/980-89-0x000007FFFFBD0000-0x000007FFFFFA1000-memory.dmpFilesize
3.8MB
-
memory/980-70-0x0000000140000000-0x0000000141660000-memory.dmpFilesize
22.4MB
-
memory/980-72-0x0000000140000000-0x0000000141660000-memory.dmpFilesize
22.4MB
-
memory/980-73-0x0000000140000000-0x0000000141660000-memory.dmpFilesize
22.4MB
-
memory/980-75-0x0000000140000000-0x0000000141660000-memory.dmpFilesize
22.4MB
-
memory/980-76-0x0000000140000000-0x0000000141660000-memory.dmpFilesize
22.4MB
-
memory/980-78-0x0000000140000000-0x0000000141660000-memory.dmpFilesize
22.4MB
-
memory/980-79-0x0000000140000000-0x0000000141660000-memory.dmpFilesize
22.4MB
-
memory/980-80-0x0000000140000000-0x0000000141660000-memory.dmpFilesize
22.4MB
-
memory/980-81-0x0000000140000000-0x0000000141660000-memory.dmpFilesize
22.4MB
-
memory/980-82-0x000000014165D878-mapping.dmp
-
memory/980-98-0x0000000140000000-0x0000000141660000-memory.dmpFilesize
22.4MB
-
memory/980-71-0x0000000140000000-0x0000000141660000-memory.dmpFilesize
22.4MB
-
memory/980-102-0x0000000140000000-0x0000000141660000-memory.dmpFilesize
22.4MB
-
memory/980-96-0x0000000140000000-0x0000000141660000-memory.dmpFilesize
22.4MB
-
memory/980-87-0x0000000140000000-0x0000000141660000-memory.dmpFilesize
22.4MB
-
memory/980-69-0x0000000140000000-0x0000000141660000-memory.dmpFilesize
22.4MB
-
memory/980-88-0x0000000140000000-0x0000000141660000-memory.dmpFilesize
22.4MB
-
memory/980-99-0x0000000140000000-0x0000000141660000-memory.dmpFilesize
22.4MB
-
memory/980-104-0x0000000140000000-0x0000000141660000-memory.dmpFilesize
22.4MB
-
memory/980-91-0x0000000140000000-0x0000000141660000-memory.dmpFilesize
22.4MB
-
memory/980-94-0x0000000140000000-0x0000000141660000-memory.dmpFilesize
22.4MB
-
memory/1012-63-0x0000000000000000-mapping.dmp
-
memory/1056-64-0x0000000000000000-mapping.dmp
-
memory/1160-56-0x0000000000000000-mapping.dmp
-
memory/1412-121-0x0000000000000000-mapping.dmp
-
memory/1752-84-0x0000000140000000-0x0000000140E38000-memory.dmpFilesize
14.2MB
-
memory/1752-109-0x0000000140000000-0x0000000140E38000-memory.dmpFilesize
14.2MB
-
memory/1752-95-0x0000000140000000-0x0000000140E38000-memory.dmpFilesize
14.2MB
-
memory/1752-100-0x0000000140000000-0x0000000140E38000-memory.dmpFilesize
14.2MB
-
memory/1752-105-0x0000000140000000-0x0000000140E38000-memory.dmpFilesize
14.2MB
-
memory/1752-106-0x0000000140000000-0x0000000140E38000-memory.dmpFilesize
14.2MB
-
memory/1752-107-0x0000000140E36784-mapping.dmp
-
memory/1752-113-0x0000000140000000-0x0000000140E38000-memory.dmpFilesize
14.2MB
-
memory/1752-112-0x0000000140000000-0x0000000140E38000-memory.dmpFilesize
14.2MB
-
memory/1752-111-0x0000000140000000-0x0000000140E38000-memory.dmpFilesize
14.2MB
-
memory/1752-110-0x0000000140000000-0x0000000140E38000-memory.dmpFilesize
14.2MB
-
memory/1752-101-0x0000000140000000-0x0000000140E38000-memory.dmpFilesize
14.2MB
-
memory/1752-116-0x0000000140000000-0x0000000140E38000-memory.dmpFilesize
14.2MB
-
memory/1752-114-0x0000000140000000-0x0000000140E38000-memory.dmpFilesize
14.2MB
-
memory/1752-115-0x000007FFFFBD0000-0x000007FFFFFA1000-memory.dmpFilesize
3.8MB
-
memory/1752-117-0x0000000140000000-0x0000000140E38000-memory.dmpFilesize
14.2MB
-
memory/1752-92-0x0000000140000000-0x0000000140E38000-memory.dmpFilesize
14.2MB
-
memory/1752-90-0x0000000140000000-0x0000000140E38000-memory.dmpFilesize
14.2MB
-
memory/1752-86-0x0000000140000000-0x0000000140E38000-memory.dmpFilesize
14.2MB
-
memory/1752-85-0x0000000140000000-0x0000000140E38000-memory.dmpFilesize
14.2MB
-
memory/2032-58-0x0000000000000000-mapping.dmp