Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
25-05-2022 02:17
Static task
static1
Behavioral task
behavioral1
Sample
0df3ade3af4c875ce8e834ad1c4e8052148173d8d95e757454279454a11c311f.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
0df3ade3af4c875ce8e834ad1c4e8052148173d8d95e757454279454a11c311f.exe
Resource
win10v2004-20220414-en
General
-
Target
0df3ade3af4c875ce8e834ad1c4e8052148173d8d95e757454279454a11c311f.exe
-
Size
4.8MB
-
MD5
b34ac778e2e106c5d747e6f33f01a863
-
SHA1
c17521f2ddb2a538158ce7f9cc44ada2f61c40aa
-
SHA256
0df3ade3af4c875ce8e834ad1c4e8052148173d8d95e757454279454a11c311f
-
SHA512
cee1861805d3875073410722e728570b185d5701a16d6c32c7adc54d2ad6e633f08dbc709f71ea3fbc151eb824830d6fb2ff63d08a3ccf4f15b74dc26da05c0f
Malware Config
Extracted
njrat
0.7d
System
videobabshering.ru:3389
b21bc800264adb97f1965cc7df1cb800
-
reg_key
b21bc800264adb97f1965cc7df1cb800
-
splitter
Y262SUCZ4UJJ
Signatures
-
Executes dropped EXE 3 IoCs
Processes:
System.exeWarface.exeSystem.exepid process 1000 System.exe 1448 Warface.exe 1036 System.exe -
Modifies Windows Firewall 1 TTPs
-
Drops startup file 2 IoCs
Processes:
System.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\b21bc800264adb97f1965cc7df1cb800.exe System.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\b21bc800264adb97f1965cc7df1cb800.exe System.exe -
Loads dropped DLL 3 IoCs
Processes:
0df3ade3af4c875ce8e834ad1c4e8052148173d8d95e757454279454a11c311f.exepid process 1800 0df3ade3af4c875ce8e834ad1c4e8052148173d8d95e757454279454a11c311f.exe 1800 0df3ade3af4c875ce8e834ad1c4e8052148173d8d95e757454279454a11c311f.exe 1800 0df3ade3af4c875ce8e834ad1c4e8052148173d8d95e757454279454a11c311f.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
System.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows\CurrentVersion\Run\b21bc800264adb97f1965cc7df1cb800 = "\"C:\\Windows\\System.exe\" .." System.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\b21bc800264adb97f1965cc7df1cb800 = "\"C:\\Windows\\System.exe\" .." System.exe -
Drops file in Windows directory 1 IoCs
Processes:
System.exedescription ioc process File created C:\Windows\System.exe System.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Processes:
IEXPLORE.EXEiexplore.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\DOMStorage\java.com\Total = "229" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\DOMStorage\java.com\Total = "42" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "224" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\DOMStorage\java.com\Total = "0" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "209" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\DOMStorage\java.com\Total = "266" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "42" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "229" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0a33ab1df6fd801 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004863fcdc101a3947b120786fa95ba35b00000000020000000000106600000001000020000000c2e9762cc661d928389ed443e506f63a8a9cbfc954b6ff5a7231af45546b2472000000000e8000000002000020000000fbc10e6e67f0531e0068d62c81909ea867b3eebb7bc7d7b822ce2cf9dc67dc51200100003bff8f862d57acefc1c0290a37f368d0a229532545a41a1e3b50bbbea1c6bb51b141d73e5d310f691b14418cea909b5408f863b76e035feeaad296cdc18bf88fb70c97df3f7089c36cb1e0401015d28c983701b9496b5eb60f0676a32bfd88c1b70cc35fe24f2c35ccd34f80571171a077716f901ca0837b9f71ec299471bc63fdb84c0c9305d224b1a95b9c00961315f1bf09a6084661ba56cc25843f2f8637c40564f17f487576c9651a457a4bbfede850f3727e9c005f18e10b269313b40f419d8926b026870f0b2e374ae835bebb7bff896b99fa43e1cd77253c94723447371372aa8057d7347ff80ce3a0e31b9e64043cfffb1ba1e12de6a1d722e5b8d19edcc7af48e3093dc5ab2549156833c94eb3d6a735aee2207d8287529218b78e400000000593fb1c44cafabfcc69fdaef6dc667852bdfe3e951b0e4e8367b9aa890dcf649e6d3be7ee9ea5a99fd0891d64e078bfe61124ba999d1b5743d181bdf6de014c iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\DOMStorage\java.com IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "122" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\DOMStorage\java.com\Total = "122" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\DOMStorage IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\DOMStorage\java.com\ = "0" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "266" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004863fcdc101a3947b120786fa95ba35b00000000020000000000106600000001000020000000e9c155c00a2cf3f8f5ba9c2c1a01a6dbd07278161fd9f3f68f8ffb3b17083062000000000e80000000020000200000009f4cff8587abcbdbc81f2d0a69dc1b96abe4c6387cb529349e8cdac8c71731e120000000623a200ee7702d9b46461c2b6ebc95cacd87879784ef4982ccc0ba8468698af240000000f2d51772154a1ba53413d51052e2e433bcbb0426c4e600afb0136fcdd6d38244f90b09027aaa40578e97c2a597c9c3a80f7c8d7b5cf10454e4c5359eb0173529 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\DOMStorage\java.com\ = "122" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\DOMStorage\java.com\ = "224" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\DOMStorage\java.com\ = "22" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "360210888" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\DOMStorage\java.com\Total = "224" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\DOMStorage\java.com\ = "209" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "22" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\DOMStorage\java.com\Total = "22" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\DOMStorage\java.com\NumberOfSubdomains = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\DOMStorage\java.com\ = "42" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\DOMStorage\java.com\Total = "209" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\DOMStorage\java.com\ = "229" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D69FB281-DBD2-11EC-AB65-7EDEB47CBF10} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\DOMStorage\java.com\ = "266" IEXPLORE.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
System.exepid process 1000 System.exe 1000 System.exe 1000 System.exe 1000 System.exe 1000 System.exe 1000 System.exe 1000 System.exe 1000 System.exe 1000 System.exe 1000 System.exe 1000 System.exe 1000 System.exe 1000 System.exe 1000 System.exe 1000 System.exe 1000 System.exe 1000 System.exe 1000 System.exe 1000 System.exe 1000 System.exe 1000 System.exe 1000 System.exe 1000 System.exe 1000 System.exe 1000 System.exe 1000 System.exe 1000 System.exe 1000 System.exe 1000 System.exe 1000 System.exe 1000 System.exe 1000 System.exe 1000 System.exe 1000 System.exe 1000 System.exe 1000 System.exe 1000 System.exe 1000 System.exe 1000 System.exe 1000 System.exe 1000 System.exe 1000 System.exe 1000 System.exe 1000 System.exe 1000 System.exe 1000 System.exe 1000 System.exe 1000 System.exe 1000 System.exe 1000 System.exe 1000 System.exe 1000 System.exe 1000 System.exe 1000 System.exe 1000 System.exe 1000 System.exe 1000 System.exe 1000 System.exe 1000 System.exe 1000 System.exe 1000 System.exe 1000 System.exe 1000 System.exe 1000 System.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
IEXPLORE.EXEpid process 1168 IEXPLORE.EXE -
Suspicious use of AdjustPrivilegeToken 22 IoCs
Processes:
System.exeSystem.exedescription pid process Token: SeDebugPrivilege 1000 System.exe Token: SeDebugPrivilege 1036 System.exe Token: 33 1036 System.exe Token: SeIncBasePriorityPrivilege 1036 System.exe Token: 33 1036 System.exe Token: SeIncBasePriorityPrivilege 1036 System.exe Token: 33 1036 System.exe Token: SeIncBasePriorityPrivilege 1036 System.exe Token: 33 1036 System.exe Token: SeIncBasePriorityPrivilege 1036 System.exe Token: 33 1036 System.exe Token: SeIncBasePriorityPrivilege 1036 System.exe Token: 33 1036 System.exe Token: SeIncBasePriorityPrivilege 1036 System.exe Token: 33 1036 System.exe Token: SeIncBasePriorityPrivilege 1036 System.exe Token: 33 1036 System.exe Token: SeIncBasePriorityPrivilege 1036 System.exe Token: 33 1036 System.exe Token: SeIncBasePriorityPrivilege 1036 System.exe Token: 33 1036 System.exe Token: SeIncBasePriorityPrivilege 1036 System.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 1132 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 1132 iexplore.exe 1132 iexplore.exe 1168 IEXPLORE.EXE 1168 IEXPLORE.EXE 1168 IEXPLORE.EXE 1168 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
0df3ade3af4c875ce8e834ad1c4e8052148173d8d95e757454279454a11c311f.exeWarface.exeiexplore.exeSystem.exeSystem.exedescription pid process target process PID 1800 wrote to memory of 1000 1800 0df3ade3af4c875ce8e834ad1c4e8052148173d8d95e757454279454a11c311f.exe System.exe PID 1800 wrote to memory of 1000 1800 0df3ade3af4c875ce8e834ad1c4e8052148173d8d95e757454279454a11c311f.exe System.exe PID 1800 wrote to memory of 1000 1800 0df3ade3af4c875ce8e834ad1c4e8052148173d8d95e757454279454a11c311f.exe System.exe PID 1800 wrote to memory of 1000 1800 0df3ade3af4c875ce8e834ad1c4e8052148173d8d95e757454279454a11c311f.exe System.exe PID 1800 wrote to memory of 1448 1800 0df3ade3af4c875ce8e834ad1c4e8052148173d8d95e757454279454a11c311f.exe Warface.exe PID 1800 wrote to memory of 1448 1800 0df3ade3af4c875ce8e834ad1c4e8052148173d8d95e757454279454a11c311f.exe Warface.exe PID 1800 wrote to memory of 1448 1800 0df3ade3af4c875ce8e834ad1c4e8052148173d8d95e757454279454a11c311f.exe Warface.exe PID 1800 wrote to memory of 1448 1800 0df3ade3af4c875ce8e834ad1c4e8052148173d8d95e757454279454a11c311f.exe Warface.exe PID 1448 wrote to memory of 1132 1448 Warface.exe iexplore.exe PID 1448 wrote to memory of 1132 1448 Warface.exe iexplore.exe PID 1448 wrote to memory of 1132 1448 Warface.exe iexplore.exe PID 1448 wrote to memory of 1132 1448 Warface.exe iexplore.exe PID 1132 wrote to memory of 1168 1132 iexplore.exe IEXPLORE.EXE PID 1132 wrote to memory of 1168 1132 iexplore.exe IEXPLORE.EXE PID 1132 wrote to memory of 1168 1132 iexplore.exe IEXPLORE.EXE PID 1132 wrote to memory of 1168 1132 iexplore.exe IEXPLORE.EXE PID 1000 wrote to memory of 1036 1000 System.exe System.exe PID 1000 wrote to memory of 1036 1000 System.exe System.exe PID 1000 wrote to memory of 1036 1000 System.exe System.exe PID 1000 wrote to memory of 1036 1000 System.exe System.exe PID 1036 wrote to memory of 1844 1036 System.exe netsh.exe PID 1036 wrote to memory of 1844 1036 System.exe netsh.exe PID 1036 wrote to memory of 1844 1036 System.exe netsh.exe PID 1036 wrote to memory of 1844 1036 System.exe netsh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0df3ade3af4c875ce8e834ad1c4e8052148173d8d95e757454279454a11c311f.exe"C:\Users\Admin\AppData\Local\Temp\0df3ade3af4c875ce8e834ad1c4e8052148173d8d95e757454279454a11c311f.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\System.exe"C:\Users\Admin\AppData\Local\Temp\System.exe"2⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System.exe"C:\Windows\System.exe"3⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Windows\System.exe" "System.exe" ENABLE4⤵
-
C:\Users\Admin\AppData\Local\Temp\Warface.exe"C:\Users\Admin\AppData\Local\Temp\Warface.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://java.com/download3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1132 CREDAT:275457 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015Filesize
60KB
MD5308336e7f515478969b24c13ded11ede
SHA18fb0cf42b77dbbef224a1e5fc38abc2486320775
SHA256889b832323726a9f10ad03f85562048fdcfe20c9ff6f9d37412cf477b4e92ff9
SHA51261ad97228cd6c3909ef3ac5e4940199971f293bdd0d5eb7916e60469573a44b6287c0fa1e0b6c1389df35eb6c9a7d2a61fdb318d4a886a3821ef5a9dab3ac24f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
342B
MD5cf8f89d6f9830ce3f877e4f8becee2fd
SHA11361cf990f4fa029bdc4f87fa6d0374cccf71bc2
SHA256c553313fa0f254780653c2bc8a1f39999478c7f1bcdcf317abcbaa0c6f76a14d
SHA512b4d31717a6a534a9350ea243987f79c491bca28c17573b01d4b88ee240a1cea7cf029a01aef59ca54d1330a69db9fdee7de6eb5acd70cfcec96f2e84b8942890
-
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\ezmz917\imagestore.datFilesize
5KB
MD5aa7c8fdb6f42762d1e8a6d81f74ad5cc
SHA1f204f441677e719c25bd0673c46ff929eda6d22d
SHA256f5d01f1625455c709d7bde86b623aa3f0486c5289d561ee786e4429317b90031
SHA512e3bf2db421379cfc3bf987539b7e7c529fdb7bdcc78894a685b8ed833ad7c52196271ef6e55bb9ec96fb73406afc7043e8b695de7b4f49af5d8fa5e2543ec61d
-
C:\Users\Admin\AppData\Local\Temp\System.exeFilesize
31KB
MD500850380b4844288abf6be0dfb391865
SHA1bc4ec977aeacb084b50ff392868d49470ecfe841
SHA256d58947ddc3ed978e0d4223382d8dc090bc69b41de5bf90ddf2885e708b8ee1d0
SHA5124436c9eca2422ccc7f57cd3ff3b390c9d852e3ea10fe036b54cc2fabbcb00e459700d06fc254bb61067365348e2984d74e651cbc35a8d8036458c8f180776ad9
-
C:\Users\Admin\AppData\Local\Temp\System.exeFilesize
31KB
MD500850380b4844288abf6be0dfb391865
SHA1bc4ec977aeacb084b50ff392868d49470ecfe841
SHA256d58947ddc3ed978e0d4223382d8dc090bc69b41de5bf90ddf2885e708b8ee1d0
SHA5124436c9eca2422ccc7f57cd3ff3b390c9d852e3ea10fe036b54cc2fabbcb00e459700d06fc254bb61067365348e2984d74e651cbc35a8d8036458c8f180776ad9
-
C:\Users\Admin\AppData\Local\Temp\Warface.exeFilesize
4.7MB
MD55b8b41957540a193c2d3e4849a3c1c44
SHA1f558fb2ff08f93cfe3441b7637a19cebde13d3c3
SHA2562bf0d866559c542912f42e23325e140b3af0fce4da8e4e4f965104ac44e54efe
SHA512cd51a483d444095426f9731e55565aa2b791ccd2cd5fe1ac1d7ff69c32bf611b0ae7c6d9bc452637ee4a82e5cc03452ad7d6137b3a94d6754362bb904224f6f8
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\DUTQXZIT.txtFilesize
606B
MD597ae28bdb494acd1c396581b582cf43a
SHA1270f53c84a293a52484988355259a8854c753a74
SHA2564830f1abd3e92f074b3dc8c4b9e87fb302806b6c4491241e7de0ac319766b5c0
SHA5122db04cadacc2e89c6fb0540d440247872720feba538378a5c6f94bbd04db01dd3342bdd99516919e132cbeb12eeea1142b9bbac586471cc1c71bdac15d1b8d3b
-
C:\Windows\System.exeFilesize
31KB
MD500850380b4844288abf6be0dfb391865
SHA1bc4ec977aeacb084b50ff392868d49470ecfe841
SHA256d58947ddc3ed978e0d4223382d8dc090bc69b41de5bf90ddf2885e708b8ee1d0
SHA5124436c9eca2422ccc7f57cd3ff3b390c9d852e3ea10fe036b54cc2fabbcb00e459700d06fc254bb61067365348e2984d74e651cbc35a8d8036458c8f180776ad9
-
C:\Windows\System.exeFilesize
31KB
MD500850380b4844288abf6be0dfb391865
SHA1bc4ec977aeacb084b50ff392868d49470ecfe841
SHA256d58947ddc3ed978e0d4223382d8dc090bc69b41de5bf90ddf2885e708b8ee1d0
SHA5124436c9eca2422ccc7f57cd3ff3b390c9d852e3ea10fe036b54cc2fabbcb00e459700d06fc254bb61067365348e2984d74e651cbc35a8d8036458c8f180776ad9
-
\Users\Admin\AppData\Local\Temp\System.exeFilesize
31KB
MD500850380b4844288abf6be0dfb391865
SHA1bc4ec977aeacb084b50ff392868d49470ecfe841
SHA256d58947ddc3ed978e0d4223382d8dc090bc69b41de5bf90ddf2885e708b8ee1d0
SHA5124436c9eca2422ccc7f57cd3ff3b390c9d852e3ea10fe036b54cc2fabbcb00e459700d06fc254bb61067365348e2984d74e651cbc35a8d8036458c8f180776ad9
-
\Users\Admin\AppData\Local\Temp\Warface.exeFilesize
4.7MB
MD55b8b41957540a193c2d3e4849a3c1c44
SHA1f558fb2ff08f93cfe3441b7637a19cebde13d3c3
SHA2562bf0d866559c542912f42e23325e140b3af0fce4da8e4e4f965104ac44e54efe
SHA512cd51a483d444095426f9731e55565aa2b791ccd2cd5fe1ac1d7ff69c32bf611b0ae7c6d9bc452637ee4a82e5cc03452ad7d6137b3a94d6754362bb904224f6f8
-
\Users\Admin\AppData\Local\Temp\Warface.exeFilesize
4.7MB
MD55b8b41957540a193c2d3e4849a3c1c44
SHA1f558fb2ff08f93cfe3441b7637a19cebde13d3c3
SHA2562bf0d866559c542912f42e23325e140b3af0fce4da8e4e4f965104ac44e54efe
SHA512cd51a483d444095426f9731e55565aa2b791ccd2cd5fe1ac1d7ff69c32bf611b0ae7c6d9bc452637ee4a82e5cc03452ad7d6137b3a94d6754362bb904224f6f8
-
memory/1000-65-0x0000000073D00000-0x00000000742AB000-memory.dmpFilesize
5.7MB
-
memory/1000-56-0x0000000000000000-mapping.dmp
-
memory/1036-66-0x0000000000000000-mapping.dmp
-
memory/1036-70-0x0000000073D00000-0x00000000742AB000-memory.dmpFilesize
5.7MB
-
memory/1448-61-0x0000000000000000-mapping.dmp
-
memory/1800-54-0x0000000075C71000-0x0000000075C73000-memory.dmpFilesize
8KB
-
memory/1844-71-0x0000000000000000-mapping.dmp