Analysis
-
max time kernel
151s -
max time network
148s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
01-02-2022 11:50
Static task
static1
Behavioral task
behavioral1
Sample
69e1bef1f8d32fa37d5809f923039b5cd35b11ac6f4c56b0fa5851395f4ae436.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
69e1bef1f8d32fa37d5809f923039b5cd35b11ac6f4c56b0fa5851395f4ae436.exe
Resource
win10v2004-en-20220112
General
-
Target
69e1bef1f8d32fa37d5809f923039b5cd35b11ac6f4c56b0fa5851395f4ae436.exe
-
Size
178KB
-
MD5
5f0497a125d9102611b56aa478069140
-
SHA1
3cf78faf32b1ee7bfdacf82f90e0e0bb34b82997
-
SHA256
69e1bef1f8d32fa37d5809f923039b5cd35b11ac6f4c56b0fa5851395f4ae436
-
SHA512
bfd767d7a2d169603c2e58c8ccf1ac08acabdd05c771d9aa9e8c775e4d60fdd58a84ca52149a686b1938afb7a93652df923e8eef517367888bca130bbb5092f2
Malware Config
Signatures
-
Modifies system executable filetype association 2 TTPs 1 IoCs
Processes:
69e1bef1f8d32fa37d5809f923039b5cd35b11ac6f4c56b0fa5851395f4ae436.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" 69e1bef1f8d32fa37d5809f923039b5cd35b11ac6f4c56b0fa5851395f4ae436.exe -
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
-
Executes dropped EXE 2 IoCs
Processes:
69e1bef1f8d32fa37d5809f923039b5cd35b11ac6f4c56b0fa5851395f4ae436.exeaguhe.exepid process 652 69e1bef1f8d32fa37d5809f923039b5cd35b11ac6f4c56b0fa5851395f4ae436.exe 632 aguhe.exe -
Loads dropped DLL 6 IoCs
Processes:
69e1bef1f8d32fa37d5809f923039b5cd35b11ac6f4c56b0fa5851395f4ae436.exe69e1bef1f8d32fa37d5809f923039b5cd35b11ac6f4c56b0fa5851395f4ae436.exepid process 1632 69e1bef1f8d32fa37d5809f923039b5cd35b11ac6f4c56b0fa5851395f4ae436.exe 1632 69e1bef1f8d32fa37d5809f923039b5cd35b11ac6f4c56b0fa5851395f4ae436.exe 652 69e1bef1f8d32fa37d5809f923039b5cd35b11ac6f4c56b0fa5851395f4ae436.exe 652 69e1bef1f8d32fa37d5809f923039b5cd35b11ac6f4c56b0fa5851395f4ae436.exe 1632 69e1bef1f8d32fa37d5809f923039b5cd35b11ac6f4c56b0fa5851395f4ae436.exe 1632 69e1bef1f8d32fa37d5809f923039b5cd35b11ac6f4c56b0fa5851395f4ae436.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
aguhe.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Windows\CurrentVersion\Run\{9365BF94-E936-2ACE-6862-787FAE1E5B44} = "C:\\Users\\Admin\\AppData\\Roaming\\Pode\\aguhe.exe" aguhe.exe Key created \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Windows\Currentversion\Run aguhe.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
69e1bef1f8d32fa37d5809f923039b5cd35b11ac6f4c56b0fa5851395f4ae436.exedescription pid process target process PID 652 set thread context of 1560 652 69e1bef1f8d32fa37d5809f923039b5cd35b11ac6f4c56b0fa5851395f4ae436.exe cmd.exe -
Drops file in Program Files directory 64 IoCs
Processes:
69e1bef1f8d32fa37d5809f923039b5cd35b11ac6f4c56b0fa5851395f4ae436.exedescription ioc process File opened for modification C:\PROGRA~3\PACKAG~1\{F4220~1\VC_RED~1.EXE 69e1bef1f8d32fa37d5809f923039b5cd35b11ac6f4c56b0fa5851395f4ae436.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DW20.EXE 69e1bef1f8d32fa37d5809f923039b5cd35b11ac6f4c56b0fa5851395f4ae436.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GO664E~1.EXE 69e1bef1f8d32fa37d5809f923039b5cd35b11ac6f4c56b0fa5851395f4ae436.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ACCICONS.EXE 69e1bef1f8d32fa37d5809f923039b5cd35b11ac6f4c56b0fa5851395f4ae436.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\GRAPH.EXE 69e1bef1f8d32fa37d5809f923039b5cd35b11ac6f4c56b0fa5851395f4ae436.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\1033\ONELEV.EXE 69e1bef1f8d32fa37d5809f923039b5cd35b11ac6f4c56b0fa5851395f4ae436.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSTORE.EXE 69e1bef1f8d32fa37d5809f923039b5cd35b11ac6f4c56b0fa5851395f4ae436.exe File opened for modification C:\PROGRA~2\WI4223~1\sidebar.exe 69e1bef1f8d32fa37d5809f923039b5cd35b11ac6f4c56b0fa5851395f4ae436.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ADOBEC~1.EXE 69e1bef1f8d32fa37d5809f923039b5cd35b11ac6f4c56b0fa5851395f4ae436.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\Setup.exe 69e1bef1f8d32fa37d5809f923039b5cd35b11ac6f4c56b0fa5851395f4ae436.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\SOURCE~1\OSE.EXE 69e1bef1f8d32fa37d5809f923039b5cd35b11ac6f4c56b0fa5851395f4ae436.exe File opened for modification C:\PROGRA~2\INTERN~1\iexplore.exe 69e1bef1f8d32fa37d5809f923039b5cd35b11ac6f4c56b0fa5851395f4ae436.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\misc.exe 69e1bef1f8d32fa37d5809f923039b5cd35b11ac6f4c56b0fa5851395f4ae436.exe File opened for modification C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE 69e1bef1f8d32fa37d5809f923039b5cd35b11ac6f4c56b0fa5851395f4ae436.exe File opened for modification C:\PROGRA~2\WINDOW~1\WinMail.exe 69e1bef1f8d32fa37d5809f923039b5cd35b11ac6f4c56b0fa5851395f4ae436.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\EQUATION\EQNEDT32.EXE 69e1bef1f8d32fa37d5809f923039b5cd35b11ac6f4c56b0fa5851395f4ae436.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\ink\mip.exe 69e1bef1f8d32fa37d5809f923039b5cd35b11ac6f4c56b0fa5851395f4ae436.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\TextConv\WksConv\Wkconv.exe 69e1bef1f8d32fa37d5809f923039b5cd35b11ac6f4c56b0fa5851395f4ae436.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE 69e1bef1f8d32fa37d5809f923039b5cd35b11ac6f4c56b0fa5851395f4ae436.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\VPREVIEW.EXE 69e1bef1f8d32fa37d5809f923039b5cd35b11ac6f4c56b0fa5851395f4ae436.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmplayer.exe 69e1bef1f8d32fa37d5809f923039b5cd35b11ac6f4c56b0fa5851395f4ae436.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DWTRIG20.EXE 69e1bef1f8d32fa37d5809f923039b5cd35b11ac6f4c56b0fa5851395f4ae436.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\CLVIEW.EXE 69e1bef1f8d32fa37d5809f923039b5cd35b11ac6f4c56b0fa5851395f4ae436.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOUC.EXE 69e1bef1f8d32fa37d5809f923039b5cd35b11ac6f4c56b0fa5851395f4ae436.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\POWERPNT.EXE 69e1bef1f8d32fa37d5809f923039b5cd35b11ac6f4c56b0fa5851395f4ae436.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\PPTICO.EXE 69e1bef1f8d32fa37d5809f923039b5cd35b11ac6f4c56b0fa5851395f4ae436.exe File opened for modification C:\PROGRA~2\WINDOW~1\wabmig.exe 69e1bef1f8d32fa37d5809f923039b5cd35b11ac6f4c56b0fa5851395f4ae436.exe File opened for modification C:\PROGRA~2\WI54FB~1\setup_wm.exe 69e1bef1f8d32fa37d5809f923039b5cd35b11ac6f4c56b0fa5851395f4ae436.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\Eula.exe 69e1bef1f8d32fa37d5809f923039b5cd35b11ac6f4c56b0fa5851395f4ae436.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\ODeploy.exe 69e1bef1f8d32fa37d5809f923039b5cd35b11ac6f4c56b0fa5851395f4ae436.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~2.EXE 69e1bef1f8d32fa37d5809f923039b5cd35b11ac6f4c56b0fa5851395f4ae436.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\INFOPATH.EXE 69e1bef1f8d32fa37d5809f923039b5cd35b11ac6f4c56b0fa5851395f4ae436.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ACROBR~1.EXE 69e1bef1f8d32fa37d5809f923039b5cd35b11ac6f4c56b0fa5851395f4ae436.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\IECONT~1.EXE 69e1bef1f8d32fa37d5809f923039b5cd35b11ac6f4c56b0fa5851395f4ae436.exe File opened for modification C:\PROGRA~2\WINDOW~2\ACCESS~1\wordpad.exe 69e1bef1f8d32fa37d5809f923039b5cd35b11ac6f4c56b0fa5851395f4ae436.exe File opened for modification C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE 69e1bef1f8d32fa37d5809f923039b5cd35b11ac6f4c56b0fa5851395f4ae436.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ONENOTE.EXE 69e1bef1f8d32fa37d5809f923039b5cd35b11ac6f4c56b0fa5851395f4ae436.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\SETUPF~1\{AC76B~1\Setup.exe 69e1bef1f8d32fa37d5809f923039b5cd35b11ac6f4c56b0fa5851395f4ae436.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBE_~1.EXE 69e1bef1f8d32fa37d5809f923039b5cd35b11ac6f4c56b0fa5851395f4ae436.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\LICLUA.EXE 69e1bef1f8d32fa37d5809f923039b5cd35b11ac6f4c56b0fa5851395f4ae436.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\BCSSync.exe 69e1bef1f8d32fa37d5809f923039b5cd35b11ac6f4c56b0fa5851395f4ae436.exe File opened for modification C:\PROGRA~2\WI54FB~1\WMPDMC.exe 69e1bef1f8d32fa37d5809f923039b5cd35b11ac6f4c56b0fa5851395f4ae436.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmpshare.exe 69e1bef1f8d32fa37d5809f923039b5cd35b11ac6f4c56b0fa5851395f4ae436.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\A3DUTI~1.EXE 69e1bef1f8d32fa37d5809f923039b5cd35b11ac6f4c56b0fa5851395f4ae436.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSTORDB.EXE 69e1bef1f8d32fa37d5809f923039b5cd35b11ac6f4c56b0fa5851395f4ae436.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\SELFCERT.EXE 69e1bef1f8d32fa37d5809f923039b5cd35b11ac6f4c56b0fa5851395f4ae436.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\WORDICON.EXE 69e1bef1f8d32fa37d5809f923039b5cd35b11ac6f4c56b0fa5851395f4ae436.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~3.EXE 69e1bef1f8d32fa37d5809f923039b5cd35b11ac6f4c56b0fa5851395f4ae436.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOSYNC.EXE 69e1bef1f8d32fa37d5809f923039b5cd35b11ac6f4c56b0fa5851395f4ae436.exe File opened for modification C:\PROGRA~2\MOZILL~1\UNINST~1.EXE 69e1bef1f8d32fa37d5809f923039b5cd35b11ac6f4c56b0fa5851395f4ae436.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmlaunch.exe 69e1bef1f8d32fa37d5809f923039b5cd35b11ac6f4c56b0fa5851395f4ae436.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\AcroRd32.exe 69e1bef1f8d32fa37d5809f923039b5cd35b11ac6f4c56b0fa5851395f4ae436.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ONENOTEM.EXE 69e1bef1f8d32fa37d5809f923039b5cd35b11ac6f4c56b0fa5851395f4ae436.exe File opened for modification C:\PROGRA~2\WINDOW~1\wab.exe 69e1bef1f8d32fa37d5809f923039b5cd35b11ac6f4c56b0fa5851395f4ae436.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmpconfig.exe 69e1bef1f8d32fa37d5809f923039b5cd35b11ac6f4c56b0fa5851395f4ae436.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe 69e1bef1f8d32fa37d5809f923039b5cd35b11ac6f4c56b0fa5851395f4ae436.exe File opened for modification C:\PROGRA~2\INTERN~1\ieinstal.exe 69e1bef1f8d32fa37d5809f923039b5cd35b11ac6f4c56b0fa5851395f4ae436.exe File opened for modification C:\PROGRA~2\INTERN~1\ielowutil.exe 69e1bef1f8d32fa37d5809f923039b5cd35b11ac6f4c56b0fa5851395f4ae436.exe File opened for modification C:\PROGRA~2\WINDOW~4\ImagingDevices.exe 69e1bef1f8d32fa37d5809f923039b5cd35b11ac6f4c56b0fa5851395f4ae436.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\FLTLDR.EXE 69e1bef1f8d32fa37d5809f923039b5cd35b11ac6f4c56b0fa5851395f4ae436.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOXMLED.EXE 69e1bef1f8d32fa37d5809f923039b5cd35b11ac6f4c56b0fa5851395f4ae436.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\Oarpmany.exe 69e1bef1f8d32fa37d5809f923039b5cd35b11ac6f4c56b0fa5851395f4ae436.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSQRY32.EXE 69e1bef1f8d32fa37d5809f923039b5cd35b11ac6f4c56b0fa5851395f4ae436.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\OIS.EXE 69e1bef1f8d32fa37d5809f923039b5cd35b11ac6f4c56b0fa5851395f4ae436.exe -
Drops file in Windows directory 1 IoCs
Processes:
69e1bef1f8d32fa37d5809f923039b5cd35b11ac6f4c56b0fa5851395f4ae436.exedescription ioc process File opened for modification C:\Windows\svchost.com 69e1bef1f8d32fa37d5809f923039b5cd35b11ac6f4c56b0fa5851395f4ae436.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Processes:
69e1bef1f8d32fa37d5809f923039b5cd35b11ac6f4c56b0fa5851395f4ae436.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\Privacy 69e1bef1f8d32fa37d5809f923039b5cd35b11ac6f4c56b0fa5851395f4ae436.exe Set value (int) \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\Privacy\CleanCookies = "0" 69e1bef1f8d32fa37d5809f923039b5cd35b11ac6f4c56b0fa5851395f4ae436.exe -
Modifies registry class 1 IoCs
Processes:
69e1bef1f8d32fa37d5809f923039b5cd35b11ac6f4c56b0fa5851395f4ae436.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" 69e1bef1f8d32fa37d5809f923039b5cd35b11ac6f4c56b0fa5851395f4ae436.exe -
NTFS ADS 1 IoCs
Processes:
WinMail.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Local Folders\Inbox\78794D00-00000001.eml:OECustomProperty WinMail.exe -
Suspicious behavior: EnumeratesProcesses 29 IoCs
Processes:
aguhe.exepid process 632 aguhe.exe 632 aguhe.exe 632 aguhe.exe 632 aguhe.exe 632 aguhe.exe 632 aguhe.exe 632 aguhe.exe 632 aguhe.exe 632 aguhe.exe 632 aguhe.exe 632 aguhe.exe 632 aguhe.exe 632 aguhe.exe 632 aguhe.exe 632 aguhe.exe 632 aguhe.exe 632 aguhe.exe 632 aguhe.exe 632 aguhe.exe 632 aguhe.exe 632 aguhe.exe 632 aguhe.exe 632 aguhe.exe 632 aguhe.exe 632 aguhe.exe 632 aguhe.exe 632 aguhe.exe 632 aguhe.exe 632 aguhe.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
69e1bef1f8d32fa37d5809f923039b5cd35b11ac6f4c56b0fa5851395f4ae436.exe69e1bef1f8d32fa37d5809f923039b5cd35b11ac6f4c56b0fa5851395f4ae436.exeWinMail.exedescription pid process Token: SeSecurityPrivilege 652 69e1bef1f8d32fa37d5809f923039b5cd35b11ac6f4c56b0fa5851395f4ae436.exe Token: SeSecurityPrivilege 1632 69e1bef1f8d32fa37d5809f923039b5cd35b11ac6f4c56b0fa5851395f4ae436.exe Token: SeSecurityPrivilege 1632 69e1bef1f8d32fa37d5809f923039b5cd35b11ac6f4c56b0fa5851395f4ae436.exe Token: SeManageVolumePrivilege 552 WinMail.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
WinMail.exepid process 552 WinMail.exe -
Suspicious use of SendNotifyMessage 1 IoCs
Processes:
WinMail.exepid process 552 WinMail.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
WinMail.exepid process 552 WinMail.exe -
Suspicious use of WriteProcessMemory 62 IoCs
Processes:
69e1bef1f8d32fa37d5809f923039b5cd35b11ac6f4c56b0fa5851395f4ae436.exe69e1bef1f8d32fa37d5809f923039b5cd35b11ac6f4c56b0fa5851395f4ae436.exeaguhe.exedescription pid process target process PID 1632 wrote to memory of 652 1632 69e1bef1f8d32fa37d5809f923039b5cd35b11ac6f4c56b0fa5851395f4ae436.exe 69e1bef1f8d32fa37d5809f923039b5cd35b11ac6f4c56b0fa5851395f4ae436.exe PID 1632 wrote to memory of 652 1632 69e1bef1f8d32fa37d5809f923039b5cd35b11ac6f4c56b0fa5851395f4ae436.exe 69e1bef1f8d32fa37d5809f923039b5cd35b11ac6f4c56b0fa5851395f4ae436.exe PID 1632 wrote to memory of 652 1632 69e1bef1f8d32fa37d5809f923039b5cd35b11ac6f4c56b0fa5851395f4ae436.exe 69e1bef1f8d32fa37d5809f923039b5cd35b11ac6f4c56b0fa5851395f4ae436.exe PID 1632 wrote to memory of 652 1632 69e1bef1f8d32fa37d5809f923039b5cd35b11ac6f4c56b0fa5851395f4ae436.exe 69e1bef1f8d32fa37d5809f923039b5cd35b11ac6f4c56b0fa5851395f4ae436.exe PID 652 wrote to memory of 632 652 69e1bef1f8d32fa37d5809f923039b5cd35b11ac6f4c56b0fa5851395f4ae436.exe aguhe.exe PID 652 wrote to memory of 632 652 69e1bef1f8d32fa37d5809f923039b5cd35b11ac6f4c56b0fa5851395f4ae436.exe aguhe.exe PID 652 wrote to memory of 632 652 69e1bef1f8d32fa37d5809f923039b5cd35b11ac6f4c56b0fa5851395f4ae436.exe aguhe.exe PID 652 wrote to memory of 632 652 69e1bef1f8d32fa37d5809f923039b5cd35b11ac6f4c56b0fa5851395f4ae436.exe aguhe.exe PID 632 wrote to memory of 1220 632 aguhe.exe taskhost.exe PID 632 wrote to memory of 1220 632 aguhe.exe taskhost.exe PID 632 wrote to memory of 1220 632 aguhe.exe taskhost.exe PID 632 wrote to memory of 1220 632 aguhe.exe taskhost.exe PID 632 wrote to memory of 1220 632 aguhe.exe taskhost.exe PID 632 wrote to memory of 1312 632 aguhe.exe Dwm.exe PID 632 wrote to memory of 1312 632 aguhe.exe Dwm.exe PID 632 wrote to memory of 1312 632 aguhe.exe Dwm.exe PID 632 wrote to memory of 1312 632 aguhe.exe Dwm.exe PID 632 wrote to memory of 1312 632 aguhe.exe Dwm.exe PID 632 wrote to memory of 1380 632 aguhe.exe Explorer.EXE PID 632 wrote to memory of 1380 632 aguhe.exe Explorer.EXE PID 632 wrote to memory of 1380 632 aguhe.exe Explorer.EXE PID 632 wrote to memory of 1380 632 aguhe.exe Explorer.EXE PID 632 wrote to memory of 1380 632 aguhe.exe Explorer.EXE PID 632 wrote to memory of 1632 632 aguhe.exe 69e1bef1f8d32fa37d5809f923039b5cd35b11ac6f4c56b0fa5851395f4ae436.exe PID 632 wrote to memory of 1632 632 aguhe.exe 69e1bef1f8d32fa37d5809f923039b5cd35b11ac6f4c56b0fa5851395f4ae436.exe PID 632 wrote to memory of 1632 632 aguhe.exe 69e1bef1f8d32fa37d5809f923039b5cd35b11ac6f4c56b0fa5851395f4ae436.exe PID 632 wrote to memory of 1632 632 aguhe.exe 69e1bef1f8d32fa37d5809f923039b5cd35b11ac6f4c56b0fa5851395f4ae436.exe PID 632 wrote to memory of 1632 632 aguhe.exe 69e1bef1f8d32fa37d5809f923039b5cd35b11ac6f4c56b0fa5851395f4ae436.exe PID 632 wrote to memory of 652 632 aguhe.exe 69e1bef1f8d32fa37d5809f923039b5cd35b11ac6f4c56b0fa5851395f4ae436.exe PID 632 wrote to memory of 652 632 aguhe.exe 69e1bef1f8d32fa37d5809f923039b5cd35b11ac6f4c56b0fa5851395f4ae436.exe PID 632 wrote to memory of 652 632 aguhe.exe 69e1bef1f8d32fa37d5809f923039b5cd35b11ac6f4c56b0fa5851395f4ae436.exe PID 632 wrote to memory of 652 632 aguhe.exe 69e1bef1f8d32fa37d5809f923039b5cd35b11ac6f4c56b0fa5851395f4ae436.exe PID 632 wrote to memory of 652 632 aguhe.exe 69e1bef1f8d32fa37d5809f923039b5cd35b11ac6f4c56b0fa5851395f4ae436.exe PID 632 wrote to memory of 552 632 aguhe.exe WinMail.exe PID 632 wrote to memory of 552 632 aguhe.exe WinMail.exe PID 632 wrote to memory of 552 632 aguhe.exe WinMail.exe PID 632 wrote to memory of 552 632 aguhe.exe WinMail.exe PID 632 wrote to memory of 552 632 aguhe.exe WinMail.exe PID 652 wrote to memory of 1560 652 69e1bef1f8d32fa37d5809f923039b5cd35b11ac6f4c56b0fa5851395f4ae436.exe cmd.exe PID 652 wrote to memory of 1560 652 69e1bef1f8d32fa37d5809f923039b5cd35b11ac6f4c56b0fa5851395f4ae436.exe cmd.exe PID 652 wrote to memory of 1560 652 69e1bef1f8d32fa37d5809f923039b5cd35b11ac6f4c56b0fa5851395f4ae436.exe cmd.exe PID 652 wrote to memory of 1560 652 69e1bef1f8d32fa37d5809f923039b5cd35b11ac6f4c56b0fa5851395f4ae436.exe cmd.exe PID 652 wrote to memory of 1560 652 69e1bef1f8d32fa37d5809f923039b5cd35b11ac6f4c56b0fa5851395f4ae436.exe cmd.exe PID 652 wrote to memory of 1560 652 69e1bef1f8d32fa37d5809f923039b5cd35b11ac6f4c56b0fa5851395f4ae436.exe cmd.exe PID 652 wrote to memory of 1560 652 69e1bef1f8d32fa37d5809f923039b5cd35b11ac6f4c56b0fa5851395f4ae436.exe cmd.exe PID 652 wrote to memory of 1560 652 69e1bef1f8d32fa37d5809f923039b5cd35b11ac6f4c56b0fa5851395f4ae436.exe cmd.exe PID 652 wrote to memory of 1560 652 69e1bef1f8d32fa37d5809f923039b5cd35b11ac6f4c56b0fa5851395f4ae436.exe cmd.exe PID 632 wrote to memory of 1144 632 aguhe.exe conhost.exe PID 632 wrote to memory of 1144 632 aguhe.exe conhost.exe PID 632 wrote to memory of 1144 632 aguhe.exe conhost.exe PID 632 wrote to memory of 1144 632 aguhe.exe conhost.exe PID 632 wrote to memory of 1144 632 aguhe.exe conhost.exe PID 632 wrote to memory of 1820 632 aguhe.exe DllHost.exe PID 632 wrote to memory of 1820 632 aguhe.exe DllHost.exe PID 632 wrote to memory of 1820 632 aguhe.exe DllHost.exe PID 632 wrote to memory of 1820 632 aguhe.exe DllHost.exe PID 632 wrote to memory of 1820 632 aguhe.exe DllHost.exe PID 632 wrote to memory of 1140 632 aguhe.exe DllHost.exe PID 632 wrote to memory of 1140 632 aguhe.exe DllHost.exe PID 632 wrote to memory of 1140 632 aguhe.exe DllHost.exe PID 632 wrote to memory of 1140 632 aguhe.exe DllHost.exe PID 632 wrote to memory of 1140 632 aguhe.exe DllHost.exe
Processes
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1312
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1380
-
C:\Users\Admin\AppData\Local\Temp\69e1bef1f8d32fa37d5809f923039b5cd35b11ac6f4c56b0fa5851395f4ae436.exe"C:\Users\Admin\AppData\Local\Temp\69e1bef1f8d32fa37d5809f923039b5cd35b11ac6f4c56b0fa5851395f4ae436.exe"2⤵
- Modifies system executable filetype association
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1632 -
C:\Users\Admin\AppData\Local\Temp\3582-490\69e1bef1f8d32fa37d5809f923039b5cd35b11ac6f4c56b0fa5851395f4ae436.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\69e1bef1f8d32fa37d5809f923039b5cd35b11ac6f4c56b0fa5851395f4ae436.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:652 -
C:\Users\Admin\AppData\Roaming\Pode\aguhe.exe"C:\Users\Admin\AppData\Roaming\Pode\aguhe.exe"4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:632 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmpe64b6248.bat"4⤵PID:1560
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1220
-
C:\Program Files\Windows Mail\WinMail.exe"C:\Program Files\Windows Mail\WinMail.exe" -Embedding1⤵
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:552
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "6871031631284458611160407992-130610544913415443131669032739-18365657871128565898"1⤵PID:1144
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}1⤵PID:1820
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:1140
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015MD5
c109096c5288a52ef43921bf74c8ea74
SHA1f8449c197266cb803efa85ad8a14fbd804cf9e6a
SHA256e02851ec41aa362ea114ddbd3a9a06fd34db9959b28d765bb4604b269e854fbc
SHA512d617dc4d06a468d94a07467c0b7244a71c868920f9ba4721d7c6a4c066ed2aec6267fabb6be8dc667a45ffa8552bf583fb8a4eceb8d4e3aedb1007ae63dae9f0
-
C:\Users\Admin\AppData\Local\Temp\3582-490\69e1bef1f8d32fa37d5809f923039b5cd35b11ac6f4c56b0fa5851395f4ae436.exeMD5
aee22ddceceba2503b463e15cafba795
SHA1fb18cb618673442963a024320e7fe399c9187198
SHA256d2416a5a7d0c232138684c04dbfb433000ff9c5f9b1dd0f5a8926f6aaef257a3
SHA512a7ff9c635aefaa9ffeead45f5aeac1437d104b8699ee236dbf81d4399e0960b5f61c4aba41d20df92c9c71134e3c7b187cee8eb5a3a7fe2a0ba81710ca16e022
-
C:\Users\Admin\AppData\Local\Temp\3582-490\69e1bef1f8d32fa37d5809f923039b5cd35b11ac6f4c56b0fa5851395f4ae436.exeMD5
aee22ddceceba2503b463e15cafba795
SHA1fb18cb618673442963a024320e7fe399c9187198
SHA256d2416a5a7d0c232138684c04dbfb433000ff9c5f9b1dd0f5a8926f6aaef257a3
SHA512a7ff9c635aefaa9ffeead45f5aeac1437d104b8699ee236dbf81d4399e0960b5f61c4aba41d20df92c9c71134e3c7b187cee8eb5a3a7fe2a0ba81710ca16e022
-
C:\Users\Admin\AppData\Local\Temp\tmpe64b6248.batMD5
3c1fbe96c5286a7fc0c8e40a77e53e98
SHA1ccdea5f2a3d711266702031e98e16daa87ea37c5
SHA256d70621955883947eaa73d248db907c7c50dc644a01d9ef9774d51b9f9fc7bf02
SHA512eb489aaac526da5fdabfc8847ada5057c7977c1ef4136502bc27c319906c0c48bc9da4c4519575e06166936edacaffe606ef016e9b9b479f662a8a2e92c3dcb1
-
C:\Users\Admin\AppData\Roaming\Amop\iczyp.issMD5
87cdd7325b2948b545df9f51dfe2f648
SHA19424817a49e7809cf51b320f74e55691f136ee74
SHA256b99b33bf4db6c625b5a26665f9e612e1c2b18e267d76ce6cce37a29796a7cac0
SHA512e027a3f15c9c2983fe5527c0dfa02f0909bdbca4906e7818f9335e7d35e44f4933ad53459db43b97a8351cf21d80ac9e7431738880a9a5635cc7b2bb6b1d35d0
-
C:\Users\Admin\AppData\Roaming\Pode\aguhe.exeMD5
ff44a8dde6c14b90f275a6fd99688b80
SHA10ebb7fd3309a3260fe8564c23557e1c4fbde5822
SHA256c819b3e50ebeef85f9c0e981234366e7d370fd8850fd61b27732241e0e32a944
SHA512d247c4488863bcce438a6173a4e7cb12294b24f93cc063da4e1856f681318f2cc583cf8028b43231abbadb9df9321f974b0ba4147e5e7f28988c56fa3a918ecc
-
C:\Users\Admin\AppData\Roaming\Pode\aguhe.exeMD5
ff44a8dde6c14b90f275a6fd99688b80
SHA10ebb7fd3309a3260fe8564c23557e1c4fbde5822
SHA256c819b3e50ebeef85f9c0e981234366e7d370fd8850fd61b27732241e0e32a944
SHA512d247c4488863bcce438a6173a4e7cb12294b24f93cc063da4e1856f681318f2cc583cf8028b43231abbadb9df9321f974b0ba4147e5e7f28988c56fa3a918ecc
-
\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXEMD5
9e2b9928c89a9d0da1d3e8f4bd96afa7
SHA1ec66cda99f44b62470c6930e5afda061579cde35
SHA2568899b4ed3446b7d55b54defbc1acb7c5392a4b3bc8ec2cdc7c31171708965043
SHA5122ca5ad1d0e12a8049de885b90b7f56fe77c868e0d6dae4ec4b6f3bc0bf7b2e73295cc9b1328c2b45357ffb0d7804622ab3f91a56140b098e93b691032d508156
-
\Users\Admin\AppData\Local\Temp\3582-490\69e1bef1f8d32fa37d5809f923039b5cd35b11ac6f4c56b0fa5851395f4ae436.exeMD5
aee22ddceceba2503b463e15cafba795
SHA1fb18cb618673442963a024320e7fe399c9187198
SHA256d2416a5a7d0c232138684c04dbfb433000ff9c5f9b1dd0f5a8926f6aaef257a3
SHA512a7ff9c635aefaa9ffeead45f5aeac1437d104b8699ee236dbf81d4399e0960b5f61c4aba41d20df92c9c71134e3c7b187cee8eb5a3a7fe2a0ba81710ca16e022
-
\Users\Admin\AppData\Local\Temp\3582-490\69e1bef1f8d32fa37d5809f923039b5cd35b11ac6f4c56b0fa5851395f4ae436.exeMD5
aee22ddceceba2503b463e15cafba795
SHA1fb18cb618673442963a024320e7fe399c9187198
SHA256d2416a5a7d0c232138684c04dbfb433000ff9c5f9b1dd0f5a8926f6aaef257a3
SHA512a7ff9c635aefaa9ffeead45f5aeac1437d104b8699ee236dbf81d4399e0960b5f61c4aba41d20df92c9c71134e3c7b187cee8eb5a3a7fe2a0ba81710ca16e022
-
\Users\Admin\AppData\Roaming\Pode\aguhe.exeMD5
ff44a8dde6c14b90f275a6fd99688b80
SHA10ebb7fd3309a3260fe8564c23557e1c4fbde5822
SHA256c819b3e50ebeef85f9c0e981234366e7d370fd8850fd61b27732241e0e32a944
SHA512d247c4488863bcce438a6173a4e7cb12294b24f93cc063da4e1856f681318f2cc583cf8028b43231abbadb9df9321f974b0ba4147e5e7f28988c56fa3a918ecc
-
\Users\Admin\AppData\Roaming\Pode\aguhe.exeMD5
ff44a8dde6c14b90f275a6fd99688b80
SHA10ebb7fd3309a3260fe8564c23557e1c4fbde5822
SHA256c819b3e50ebeef85f9c0e981234366e7d370fd8850fd61b27732241e0e32a944
SHA512d247c4488863bcce438a6173a4e7cb12294b24f93cc063da4e1856f681318f2cc583cf8028b43231abbadb9df9321f974b0ba4147e5e7f28988c56fa3a918ecc
-
\Users\Admin\AppData\Roaming\Pode\aguhe.exeMD5
ff44a8dde6c14b90f275a6fd99688b80
SHA10ebb7fd3309a3260fe8564c23557e1c4fbde5822
SHA256c819b3e50ebeef85f9c0e981234366e7d370fd8850fd61b27732241e0e32a944
SHA512d247c4488863bcce438a6173a4e7cb12294b24f93cc063da4e1856f681318f2cc583cf8028b43231abbadb9df9321f974b0ba4147e5e7f28988c56fa3a918ecc
-
memory/652-218-0x0000000000270000-0x0000000000297000-memory.dmpFilesize
156KB
-
memory/1220-66-0x0000000001DA0000-0x0000000001DC7000-memory.dmpFilesize
156KB
-
memory/1220-68-0x0000000001DA0000-0x0000000001DC7000-memory.dmpFilesize
156KB
-
memory/1220-67-0x0000000001DA0000-0x0000000001DC7000-memory.dmpFilesize
156KB
-
memory/1220-69-0x0000000001DA0000-0x0000000001DC7000-memory.dmpFilesize
156KB
-
memory/1220-70-0x0000000001DA0000-0x0000000001DC7000-memory.dmpFilesize
156KB
-
memory/1312-72-0x0000000001AC0000-0x0000000001AE7000-memory.dmpFilesize
156KB
-
memory/1312-75-0x0000000001AC0000-0x0000000001AE7000-memory.dmpFilesize
156KB
-
memory/1312-74-0x0000000001AC0000-0x0000000001AE7000-memory.dmpFilesize
156KB
-
memory/1312-73-0x0000000001AC0000-0x0000000001AE7000-memory.dmpFilesize
156KB
-
memory/1380-77-0x0000000002640000-0x0000000002667000-memory.dmpFilesize
156KB
-
memory/1380-78-0x0000000002640000-0x0000000002667000-memory.dmpFilesize
156KB
-
memory/1380-79-0x0000000002640000-0x0000000002667000-memory.dmpFilesize
156KB
-
memory/1380-80-0x0000000002640000-0x0000000002667000-memory.dmpFilesize
156KB
-
memory/1560-281-0x0000000000050000-0x0000000000077000-memory.dmpFilesize
156KB
-
memory/1632-98-0x0000000000240000-0x0000000000241000-memory.dmpFilesize
4KB
-
memory/1632-114-0x0000000000240000-0x0000000000241000-memory.dmpFilesize
4KB
-
memory/1632-90-0x0000000000240000-0x0000000000241000-memory.dmpFilesize
4KB
-
memory/1632-91-0x0000000000240000-0x0000000000241000-memory.dmpFilesize
4KB
-
memory/1632-92-0x0000000000240000-0x0000000000241000-memory.dmpFilesize
4KB
-
memory/1632-93-0x0000000000240000-0x0000000000241000-memory.dmpFilesize
4KB
-
memory/1632-94-0x0000000000240000-0x0000000000241000-memory.dmpFilesize
4KB
-
memory/1632-95-0x0000000000240000-0x0000000000241000-memory.dmpFilesize
4KB
-
memory/1632-96-0x0000000000240000-0x0000000000241000-memory.dmpFilesize
4KB
-
memory/1632-97-0x0000000000240000-0x0000000000241000-memory.dmpFilesize
4KB
-
memory/1632-55-0x0000000076141000-0x0000000076143000-memory.dmpFilesize
8KB
-
memory/1632-99-0x0000000000240000-0x0000000000241000-memory.dmpFilesize
4KB
-
memory/1632-101-0x0000000000240000-0x0000000000241000-memory.dmpFilesize
4KB
-
memory/1632-102-0x0000000000240000-0x0000000000241000-memory.dmpFilesize
4KB
-
memory/1632-100-0x0000000000240000-0x0000000000241000-memory.dmpFilesize
4KB
-
memory/1632-103-0x0000000000240000-0x0000000000241000-memory.dmpFilesize
4KB
-
memory/1632-104-0x0000000000240000-0x0000000000241000-memory.dmpFilesize
4KB
-
memory/1632-106-0x0000000000240000-0x0000000000241000-memory.dmpFilesize
4KB
-
memory/1632-105-0x0000000000240000-0x0000000000241000-memory.dmpFilesize
4KB
-
memory/1632-108-0x0000000000240000-0x0000000000241000-memory.dmpFilesize
4KB
-
memory/1632-107-0x0000000000240000-0x0000000000241000-memory.dmpFilesize
4KB
-
memory/1632-110-0x0000000000240000-0x0000000000241000-memory.dmpFilesize
4KB
-
memory/1632-109-0x0000000000240000-0x0000000000241000-memory.dmpFilesize
4KB
-
memory/1632-112-0x0000000000240000-0x0000000000241000-memory.dmpFilesize
4KB
-
memory/1632-111-0x0000000000240000-0x0000000000241000-memory.dmpFilesize
4KB
-
memory/1632-89-0x0000000000240000-0x0000000000241000-memory.dmpFilesize
4KB
-
memory/1632-113-0x0000000000240000-0x0000000000241000-memory.dmpFilesize
4KB
-
memory/1632-116-0x0000000000240000-0x0000000000241000-memory.dmpFilesize
4KB
-
memory/1632-115-0x0000000000240000-0x0000000000241000-memory.dmpFilesize
4KB
-
memory/1632-117-0x0000000000240000-0x0000000000241000-memory.dmpFilesize
4KB
-
memory/1632-119-0x0000000000240000-0x0000000000241000-memory.dmpFilesize
4KB
-
memory/1632-118-0x0000000000240000-0x0000000000241000-memory.dmpFilesize
4KB
-
memory/1632-121-0x0000000000240000-0x0000000000241000-memory.dmpFilesize
4KB
-
memory/1632-120-0x0000000000240000-0x0000000000241000-memory.dmpFilesize
4KB
-
memory/1632-123-0x0000000000240000-0x0000000000241000-memory.dmpFilesize
4KB
-
memory/1632-122-0x0000000000240000-0x0000000000241000-memory.dmpFilesize
4KB
-
memory/1632-125-0x0000000000240000-0x0000000000241000-memory.dmpFilesize
4KB
-
memory/1632-124-0x0000000000240000-0x0000000000241000-memory.dmpFilesize
4KB
-
memory/1632-126-0x0000000000240000-0x0000000000241000-memory.dmpFilesize
4KB
-
memory/1632-127-0x0000000000240000-0x0000000000241000-memory.dmpFilesize
4KB
-
memory/1632-139-0x0000000000240000-0x0000000000241000-memory.dmpFilesize
4KB
-
memory/1632-138-0x00000000023A0000-0x0000000002FEA000-memory.dmpFilesize
12.3MB
-
memory/1632-88-0x0000000000240000-0x0000000000241000-memory.dmpFilesize
4KB
-
memory/1632-87-0x0000000000240000-0x0000000000241000-memory.dmpFilesize
4KB
-
memory/1632-86-0x0000000000240000-0x0000000000241000-memory.dmpFilesize
4KB
-
memory/1632-82-0x00000000025F0000-0x0000000002617000-memory.dmpFilesize
156KB
-
memory/1632-83-0x00000000025F0000-0x0000000002617000-memory.dmpFilesize
156KB
-
memory/1632-84-0x00000000025F0000-0x0000000002617000-memory.dmpFilesize
156KB
-
memory/1632-85-0x00000000025F0000-0x0000000002617000-memory.dmpFilesize
156KB