Analysis
-
max time kernel
151s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
21-05-2022 11:41
General
-
Target
CONTRACTS DOCUMENTS.exe
-
Size
215KB
-
MD5
b5a64ee18bd52e91671491580ae349da
-
SHA1
0a5ec3756c34db4a9eb9a1e54a0867f9c98c6f3d
-
SHA256
380b98b82eca0b9f9ea4a86ea9ee60c579bc68d75a75db5d800074a8c50a0a52
-
SHA512
9fc1a1faed034a8e1247e1b6daeb83bbcc4f58ce3aadd5df21213837de5d3252c8801aeb7031be6c73fa00cc23ef85d218b724b0da3d9f6cbcd7dd3eaec9c6f9
Score
10/10
Malware Config
Extracted
Family
formbook
Version
3.9
Campaign
nfl
Decoy
giacamp.net
qb51.party
mashalevine.com
russiasexdating.com
jitangyy.com
morockin.com
karoreiss.com
tractionhero.today
bienvenueenprovence.net
stormharbour.info
61999h.com
tryandcert.com
bestwaytosuccess.com
laobaochang.com
otomatiktente.com
rehpb.info
ivpdqb.info
dc-wv-wv-ie-q.com
goingmagic.com
cimachain.com
Signatures
-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Formbook Payload 13 IoCs
-
Checks computer location settings 2 TTPs 26 IoCs
Looks up country code configured in the registry, likely geofence.
-
Drops startup file 2 IoCs
-
Suspicious use of SetThreadContext 57 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Gathers network information 2 TTPs 4 IoCs
Uses commandline utility to view network configuration.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious behavior: MapViewOfSection 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\CONTRACTS DOCUMENTS.exe"C:\Users\Admin\AppData\Local\Temp\CONTRACTS DOCUMENTS.exe"2⤵
- Checks computer location settings
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\CONTRACTS DOCUMENTS.exe"C:\Users\Admin\AppData\Local\Temp\CONTRACTS DOCUMENTS.exe"3⤵
- Checks computer location settings
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"4⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\CONTRACTS DOCUMENTS.exe"C:\Users\Admin\AppData\Local\Temp\CONTRACTS DOCUMENTS.exe"4⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"5⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\CONTRACTS DOCUMENTS.exe"C:\Users\Admin\AppData\Local\Temp\CONTRACTS DOCUMENTS.exe"5⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"6⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\CONTRACTS DOCUMENTS.exe"C:\Users\Admin\AppData\Local\Temp\CONTRACTS DOCUMENTS.exe"6⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"7⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\CONTRACTS DOCUMENTS.exe"C:\Users\Admin\AppData\Local\Temp\CONTRACTS DOCUMENTS.exe"7⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"8⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"8⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"8⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"8⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\CONTRACTS DOCUMENTS.exe"C:\Users\Admin\AppData\Local\Temp\CONTRACTS DOCUMENTS.exe"8⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"9⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"9⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\CONTRACTS DOCUMENTS.exe"C:\Users\Admin\AppData\Local\Temp\CONTRACTS DOCUMENTS.exe"9⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"10⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\CONTRACTS DOCUMENTS.exe"C:\Users\Admin\AppData\Local\Temp\CONTRACTS DOCUMENTS.exe"10⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"11⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\CONTRACTS DOCUMENTS.exe"C:\Users\Admin\AppData\Local\Temp\CONTRACTS DOCUMENTS.exe"11⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"12⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"12⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\CONTRACTS DOCUMENTS.exe"C:\Users\Admin\AppData\Local\Temp\CONTRACTS DOCUMENTS.exe"12⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"13⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"13⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"13⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\CONTRACTS DOCUMENTS.exe"C:\Users\Admin\AppData\Local\Temp\CONTRACTS DOCUMENTS.exe"13⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"14⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\CONTRACTS DOCUMENTS.exe"C:\Users\Admin\AppData\Local\Temp\CONTRACTS DOCUMENTS.exe"14⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"15⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\CONTRACTS DOCUMENTS.exe"C:\Users\Admin\AppData\Local\Temp\CONTRACTS DOCUMENTS.exe"15⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"16⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\CONTRACTS DOCUMENTS.exe"C:\Users\Admin\AppData\Local\Temp\CONTRACTS DOCUMENTS.exe"16⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"17⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"17⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\CONTRACTS DOCUMENTS.exe"C:\Users\Admin\AppData\Local\Temp\CONTRACTS DOCUMENTS.exe"17⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"18⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\CONTRACTS DOCUMENTS.exe"C:\Users\Admin\AppData\Local\Temp\CONTRACTS DOCUMENTS.exe"18⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"19⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"19⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\CONTRACTS DOCUMENTS.exe"C:\Users\Admin\AppData\Local\Temp\CONTRACTS DOCUMENTS.exe"19⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"20⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\CONTRACTS DOCUMENTS.exe"C:\Users\Admin\AppData\Local\Temp\CONTRACTS DOCUMENTS.exe"20⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"21⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\CONTRACTS DOCUMENTS.exe"C:\Users\Admin\AppData\Local\Temp\CONTRACTS DOCUMENTS.exe"21⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"22⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\CONTRACTS DOCUMENTS.exe"C:\Users\Admin\AppData\Local\Temp\CONTRACTS DOCUMENTS.exe"22⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"23⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\CONTRACTS DOCUMENTS.exe"C:\Users\Admin\AppData\Local\Temp\CONTRACTS DOCUMENTS.exe"23⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"24⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\CONTRACTS DOCUMENTS.exe"C:\Users\Admin\AppData\Local\Temp\CONTRACTS DOCUMENTS.exe"24⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"25⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\CONTRACTS DOCUMENTS.exe"C:\Users\Admin\AppData\Local\Temp\CONTRACTS DOCUMENTS.exe"25⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"26⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"26⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"26⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\CONTRACTS DOCUMENTS.exe"C:\Users\Admin\AppData\Local\Temp\CONTRACTS DOCUMENTS.exe"26⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"27⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\CONTRACTS DOCUMENTS.exe"C:\Users\Admin\AppData\Local\Temp\CONTRACTS DOCUMENTS.exe"27⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"28⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"28⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\CONTRACTS DOCUMENTS.exe"C:\Users\Admin\AppData\Local\Temp\CONTRACTS DOCUMENTS.exe"28⤵
-
C:\Windows\SysWOW64\wscript.exe"C:\Windows\SysWOW64\wscript.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\SysWOW64\svchost.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\systray.exe"C:\Windows\SysWOW64\systray.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\colorcpl.exe"C:\Windows\SysWOW64\colorcpl.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵
-
C:\Windows\SysWOW64\ipconfig.exe"C:\Windows\SysWOW64\ipconfig.exe"2⤵
- Gathers network information
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\SysWOW64\explorer.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\SysWOW64\rundll32.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\wscript.exe"C:\Windows\SysWOW64\wscript.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\SysWOW64\svchost.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\NETSTAT.EXE"C:\Windows\SysWOW64\NETSTAT.EXE"2⤵
- Gathers network information
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
C:\Windows\SysWOW64\cscript.exe"C:\Windows\SysWOW64\cscript.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\help.exe"C:\Windows\SysWOW64\help.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\NETSTAT.EXE"C:\Windows\SysWOW64\NETSTAT.EXE"2⤵
- Gathers network information
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵
-
C:\Windows\SysWOW64\WWAHost.exe"C:\Windows\SysWOW64\WWAHost.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\systray.exe"C:\Windows\SysWOW64\systray.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵
-
C:\Windows\SysWOW64\NETSTAT.EXE"C:\Windows\SysWOW64\NETSTAT.EXE"2⤵
- Gathers network information
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\SysWOW64\svchost.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\colorcpl.exe"C:\Windows\SysWOW64\colorcpl.exe"2⤵
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\SysWOW64\explorer.exe"2⤵
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
C:\Windows\SysWOW64\colorcpl.exe"C:\Windows\SysWOW64\colorcpl.exe"2⤵
-
C:\Windows\SysWOW64\wscript.exe"C:\Windows\SysWOW64\wscript.exe"2⤵
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\SysWOW64\svchost.exe"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HJdyTuap.exeFilesize
216KB
MD53be793cc456c24741f474e0a7e9e9dda
SHA123f715eb3ea125162234fa5aedbe3e79a4287412
SHA256b9a289e4b32a9d4592cf63aad42628937ce83fb51be4742f1fd8c1ddf747b389
SHA51234a02e675d57ca4e0d1b32cc68ac99bca9858fad49611e6103077977b04afb91d8b0f6daf8bd104b3ea8fae7a16b233deb76f96e9a0bfe0df76a8b8942844ce0
-
memory/372-251-0x0000000000000000-mapping.dmp
-
memory/716-231-0x0000000000000000-mapping.dmp
-
memory/732-176-0x0000000000000000-mapping.dmp
-
memory/984-246-0x0000000000000000-mapping.dmp
-
memory/1032-223-0x0000000000000000-mapping.dmp
-
memory/1104-175-0x0000000000000000-mapping.dmp
-
memory/1104-177-0x00000000031C0000-0x000000000350A000-memory.dmpFilesize
3.3MB
-
memory/1104-178-0x0000000001810000-0x0000000001824000-memory.dmpFilesize
80KB
-
memory/1160-331-0x0000000000000000-mapping.dmp
-
memory/1168-210-0x0000000000AE0000-0x0000000000B07000-memory.dmpFilesize
156KB
-
memory/1168-209-0x0000000000000000-mapping.dmp
-
memory/1168-212-0x00000000028A0000-0x0000000002BEA000-memory.dmpFilesize
3.3MB
-
memory/1168-211-0x0000000000800000-0x000000000082A000-memory.dmpFilesize
168KB
-
memory/1212-232-0x0000000000000000-mapping.dmp
-
memory/1256-255-0x0000000000000000-mapping.dmp
-
memory/1396-242-0x0000000000000000-mapping.dmp
-
memory/1456-274-0x0000000000000000-mapping.dmp
-
memory/1456-146-0x0000000000000000-mapping.dmp
-
memory/1464-260-0x0000000000000000-mapping.dmp
-
memory/1524-315-0x0000000000000000-mapping.dmp
-
memory/1604-142-0x0000000000000000-mapping.dmp
-
memory/1660-227-0x0000000000000000-mapping.dmp
-
memory/1824-192-0x0000000003480000-0x00000000037CA000-memory.dmpFilesize
3.3MB
-
memory/1824-190-0x0000000000DF0000-0x0000000001223000-memory.dmpFilesize
4.2MB
-
memory/1824-191-0x0000000000CE0000-0x0000000000D0A000-memory.dmpFilesize
168KB
-
memory/1824-189-0x0000000000000000-mapping.dmp
-
memory/1952-326-0x0000000000000000-mapping.dmp
-
memory/1956-316-0x0000000000000000-mapping.dmp
-
memory/1956-185-0x0000000000000000-mapping.dmp
-
memory/2204-304-0x0000000000000000-mapping.dmp
-
memory/2244-250-0x0000000000000000-mapping.dmp
-
memory/2272-166-0x0000000000000000-mapping.dmp
-
memory/2272-168-0x0000000002760000-0x0000000002AAA000-memory.dmpFilesize
3.3MB
-
memory/2272-169-0x00000000026B0000-0x00000000026C4000-memory.dmpFilesize
80KB
-
memory/2308-270-0x0000000000000000-mapping.dmp
-
memory/2312-237-0x0000000000000000-mapping.dmp
-
memory/2316-172-0x0000000000C30000-0x0000000000C49000-memory.dmpFilesize
100KB
-
memory/2316-174-0x0000000002850000-0x0000000002B9A000-memory.dmpFilesize
3.3MB
-
memory/2316-173-0x0000000000890000-0x00000000008BA000-memory.dmpFilesize
168KB
-
memory/2316-171-0x0000000000000000-mapping.dmp
-
memory/2320-204-0x0000000000000000-mapping.dmp
-
memory/2328-144-0x0000000000000000-mapping.dmp
-
memory/2328-149-0x00000000028E0000-0x00000000028F4000-memory.dmpFilesize
80KB
-
memory/2328-145-0x0000000000400000-0x000000000042A000-memory.dmpFilesize
168KB
-
memory/2328-148-0x0000000002A50000-0x0000000002D9A000-memory.dmpFilesize
3.3MB
-
memory/2480-291-0x0000000000000000-mapping.dmp
-
memory/2592-214-0x0000000000000000-mapping.dmp
-
memory/2600-336-0x0000000000000000-mapping.dmp
-
memory/2628-217-0x000000000B5D0000-0x000000000B777000-memory.dmpFilesize
1.7MB
-
memory/2628-198-0x00000000035A0000-0x0000000003662000-memory.dmpFilesize
776KB
-
memory/2628-150-0x00000000032E0000-0x0000000003393000-memory.dmpFilesize
716KB
-
memory/2628-179-0x0000000008F70000-0x00000000090F4000-memory.dmpFilesize
1.5MB
-
memory/2628-188-0x000000000B250000-0x000000000B3CF000-memory.dmpFilesize
1.5MB
-
memory/2628-156-0x00000000033A0000-0x000000000344F000-memory.dmpFilesize
700KB
-
memory/2628-170-0x0000000008810000-0x0000000008949000-memory.dmpFilesize
1.2MB
-
memory/2628-138-0x0000000002FD0000-0x00000000030AA000-memory.dmpFilesize
872KB
-
memory/2628-161-0x0000000008C90000-0x0000000008E27000-memory.dmpFilesize
1.6MB
-
memory/2628-208-0x000000000B3D0000-0x000000000B53F000-memory.dmpFilesize
1.4MB
-
memory/2668-160-0x0000000001360000-0x0000000001374000-memory.dmpFilesize
80KB
-
memory/2668-157-0x0000000000000000-mapping.dmp
-
memory/2668-159-0x0000000002EC0000-0x000000000320A000-memory.dmpFilesize
3.3MB
-
memory/2756-300-0x0000000000000000-mapping.dmp
-
memory/2868-283-0x0000000000000000-mapping.dmp
-
memory/2872-167-0x0000000000000000-mapping.dmp
-
memory/2884-203-0x0000000000000000-mapping.dmp
-
memory/2884-206-0x0000000002FE0000-0x0000000002FF4000-memory.dmpFilesize
80KB
-
memory/2884-207-0x0000000003120000-0x000000000346A000-memory.dmpFilesize
3.3MB
-
memory/2884-205-0x0000000000400000-0x000000000042A000-memory.dmpFilesize
168KB
-
memory/3052-265-0x0000000000000000-mapping.dmp
-
memory/3120-322-0x0000000000000000-mapping.dmp
-
memory/3224-294-0x0000000000000000-mapping.dmp
-
memory/3284-218-0x0000000000000000-mapping.dmp
-
memory/3284-219-0x00000000006D0000-0x00000000006DE000-memory.dmpFilesize
56KB
-
memory/3284-221-0x0000000001900000-0x0000000001C4A000-memory.dmpFilesize
3.3MB
-
memory/3284-220-0x0000000000EC0000-0x0000000000EEA000-memory.dmpFilesize
168KB
-
memory/3336-183-0x00000000019C0000-0x0000000001D0A000-memory.dmpFilesize
3.3MB
-
memory/3336-180-0x0000000000000000-mapping.dmp
-
memory/3336-181-0x00000000006F0000-0x00000000006FB000-memory.dmpFilesize
44KB
-
memory/3336-182-0x00000000012F0000-0x000000000131A000-memory.dmpFilesize
168KB
-
memory/3468-132-0x0000000000000000-mapping.dmp
-
memory/3468-135-0x0000000000400000-0x000000000042A000-memory.dmpFilesize
168KB
-
memory/3468-136-0x00000000027E0000-0x0000000002B2A000-memory.dmpFilesize
3.3MB
-
memory/3468-137-0x0000000000A60000-0x0000000000A74000-memory.dmpFilesize
80KB
-
memory/3480-155-0x0000000002600000-0x0000000002693000-memory.dmpFilesize
588KB
-
memory/3480-143-0x0000000002860000-0x0000000002BAA000-memory.dmpFilesize
3.3MB
-
memory/3480-139-0x0000000000000000-mapping.dmp
-
memory/3480-140-0x0000000000AE0000-0x0000000000B07000-memory.dmpFilesize
156KB
-
memory/3480-141-0x0000000000700000-0x000000000072A000-memory.dmpFilesize
168KB
-
memory/3548-278-0x0000000000000000-mapping.dmp
-
memory/3660-194-0x0000000000000000-mapping.dmp
-
memory/3836-154-0x0000000001800000-0x0000000001B4A000-memory.dmpFilesize
3.3MB
-
memory/3836-152-0x00000000006D0000-0x00000000006DE000-memory.dmpFilesize
56KB
-
memory/3836-153-0x0000000000BA0000-0x0000000000BCA000-memory.dmpFilesize
168KB
-
memory/3836-151-0x0000000000000000-mapping.dmp
-
memory/3848-284-0x0000000000000000-mapping.dmp
-
memory/3856-269-0x0000000000000000-mapping.dmp
-
memory/3900-186-0x0000000002D30000-0x000000000307A000-memory.dmpFilesize
3.3MB
-
memory/3900-187-0x0000000002C90000-0x0000000002CA4000-memory.dmpFilesize
80KB
-
memory/3900-184-0x0000000000000000-mapping.dmp
-
memory/4052-224-0x0000000002EF0000-0x000000000323A000-memory.dmpFilesize
3.3MB
-
memory/4052-222-0x0000000000000000-mapping.dmp
-
memory/4236-200-0x0000000000ED0000-0x0000000000EE4000-memory.dmpFilesize
80KB
-
memory/4236-201-0x0000000000620000-0x000000000064A000-memory.dmpFilesize
168KB
-
memory/4236-202-0x0000000002670000-0x00000000029BA000-memory.dmpFilesize
3.3MB
-
memory/4236-199-0x0000000000000000-mapping.dmp
-
memory/4252-158-0x0000000000000000-mapping.dmp
-
memory/4260-134-0x00000000053B0000-0x00000000053B3000-memory.dmpFilesize
12KB
-
memory/4260-130-0x00000000004A0000-0x00000000004DC000-memory.dmpFilesize
240KB
-
memory/4260-131-0x0000000004DB0000-0x0000000004DB3000-memory.dmpFilesize
12KB
-
memory/4320-279-0x0000000000000000-mapping.dmp
-
memory/4332-216-0x0000000000C90000-0x0000000000CA4000-memory.dmpFilesize
80KB
-
memory/4332-213-0x0000000000000000-mapping.dmp
-
memory/4332-215-0x0000000002980000-0x0000000002CCA000-memory.dmpFilesize
3.3MB
-
memory/4480-259-0x0000000000000000-mapping.dmp
-
memory/4540-299-0x0000000000000000-mapping.dmp
-
memory/4560-330-0x0000000000000000-mapping.dmp
-
memory/4576-311-0x0000000000000000-mapping.dmp
-
memory/4700-193-0x0000000000000000-mapping.dmp
-
memory/4700-197-0x00000000012F0000-0x0000000001304000-memory.dmpFilesize
80KB
-
memory/4700-196-0x0000000002E90000-0x00000000031DA000-memory.dmpFilesize
3.3MB
-
memory/4700-195-0x0000000000400000-0x000000000042A000-memory.dmpFilesize
168KB
-
memory/4816-305-0x0000000000000000-mapping.dmp
-
memory/4904-241-0x0000000000000000-mapping.dmp
-
memory/5008-133-0x0000000000000000-mapping.dmp
-
memory/5028-165-0x00000000032E0000-0x000000000362A000-memory.dmpFilesize
3.3MB
-
memory/5028-164-0x0000000001230000-0x000000000125A000-memory.dmpFilesize
168KB
-
memory/5028-163-0x0000000000600000-0x0000000000606000-memory.dmpFilesize
24KB
-
memory/5028-162-0x0000000000000000-mapping.dmp