metasploit | 7282a85e6959e92e21513e5c5bbd21de7b3dd58bfa10a81d541afe5b07fc91b3

Analysis

max time kernel
148s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
19-09-2022 02:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7282a85e6959e92e21513e5c5bbd21de7b3dd58bfa10a81d541afe5b07fc91b3.exe
Size

87KB
MD5

1f625fa2de5d1cee01425cf6dd843a96
SHA1

696b3a4cf8da199176bcd3dc4c7f2493d81b001e
SHA256

7282a85e6959e92e21513e5c5bbd21de7b3dd58bfa10a81d541afe5b07fc91b3
SHA512

366a015b371b06de687638f2b3290e1725a2f1f7b59b997f8bf0151a960ca58ef3eab3a24d24578d0953715e416374e41f7222ba1f49faf6f6a67ccd9d2f35e0
SSDEEP

1536:mmXlt0LYNChwXVpvF4jr4ydBxhjrSmAPSOIXaIhltdqPTeHdjIzHx0evlcFnPqDL:DlCeF04I9ISOIXHhVqPa2zHCPG9e32

Score

10^/10

metasploit backdoor trojan upx

Malware Config

Extracted

Family

metasploit

Version

encoder/fnstenv_mov

Signatures

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit

Executes dropped EXE 20 IoCs

Processes:

windo.exewindo.exewindo.exewindo.exewindo.exewindo.exewindo.exewindo.exewindo.exewindo.exewindo.exewindo.exewindo.exewindo.exewindo.exewindo.exewindo.exewindo.exewindo.exewindo.exe

pid	process
4444	windo.exe
4780	windo.exe
4796	windo.exe
4536	windo.exe
176	windo.exe
212	windo.exe
1880	windo.exe
4816	windo.exe
1908	windo.exe
2996	windo.exe
3108	windo.exe
4388	windo.exe
3564	windo.exe
4220	windo.exe
3464	windo.exe
2268	windo.exe
2728	windo.exe
2132	windo.exe
4708	windo.exe
1808	windo.exe

UPX packed file 47 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/2328-135-0x0000000000400000-0x000000000048E000-memory.dmp	upx
behavioral2/memory/2328-137-0x0000000000400000-0x000000000048E000-memory.dmp	upx
behavioral2/memory/1612-138-0x0000000000400000-0x000000000040C000-memory.dmp	upx
behavioral2/memory/2328-139-0x0000000000400000-0x000000000048E000-memory.dmp	upx
behavioral2/memory/2328-140-0x0000000000400000-0x000000000048E000-memory.dmp	upx
C:\Windows\SysWOW64\windo.exe	upx
C:\Windows\SysWOW64\windo.exe	upx
C:\Windows\SysWOW64\windo.exe	upx
behavioral2/memory/4444-151-0x0000000000400000-0x000000000040C000-memory.dmp	upx
behavioral2/memory/2328-154-0x0000000000400000-0x000000000048E000-memory.dmp	upx
behavioral2/memory/4780-155-0x0000000000400000-0x000000000048E000-memory.dmp	upx
C:\Windows\SysWOW64\windo.exe	upx
C:\Windows\SysWOW64\windo.exe	upx
behavioral2/memory/4796-166-0x0000000000400000-0x000000000040C000-memory.dmp	upx
behavioral2/memory/4536-167-0x0000000000400000-0x000000000048E000-memory.dmp	upx
C:\Windows\SysWOW64\windo.exe	upx
C:\Windows\SysWOW64\windo.exe	upx
behavioral2/memory/176-178-0x0000000000400000-0x000000000040C000-memory.dmp	upx
behavioral2/memory/212-179-0x0000000000400000-0x000000000048E000-memory.dmp	upx
C:\Windows\SysWOW64\windo.exe	upx
C:\Windows\SysWOW64\windo.exe	upx
behavioral2/memory/1880-187-0x0000000000400000-0x000000000040C000-memory.dmp	upx
behavioral2/memory/4816-191-0x0000000000400000-0x000000000048E000-memory.dmp	upx
C:\Windows\SysWOW64\windo.exe	upx
C:\Windows\SysWOW64\windo.exe	upx
behavioral2/memory/1908-200-0x0000000000400000-0x000000000040C000-memory.dmp	upx
behavioral2/memory/2996-203-0x0000000000400000-0x000000000048E000-memory.dmp	upx
C:\Windows\SysWOW64\windo.exe	upx
C:\Windows\SysWOW64\windo.exe	upx
behavioral2/memory/3108-214-0x0000000000400000-0x000000000040C000-memory.dmp	upx
behavioral2/memory/4388-215-0x0000000000400000-0x000000000048E000-memory.dmp	upx
C:\Windows\SysWOW64\windo.exe	upx
C:\Windows\SysWOW64\windo.exe	upx
behavioral2/memory/3564-224-0x0000000000400000-0x000000000040C000-memory.dmp	upx
behavioral2/memory/4220-227-0x0000000000400000-0x000000000048E000-memory.dmp	upx
C:\Windows\SysWOW64\windo.exe	upx
C:\Windows\SysWOW64\windo.exe	upx
behavioral2/memory/3464-237-0x0000000000400000-0x000000000040C000-memory.dmp	upx
behavioral2/memory/2268-239-0x0000000000400000-0x000000000048E000-memory.dmp	upx
C:\Windows\SysWOW64\windo.exe	upx
C:\Windows\SysWOW64\windo.exe	upx
behavioral2/memory/2728-248-0x0000000000400000-0x000000000040C000-memory.dmp	upx
behavioral2/memory/2132-251-0x0000000000400000-0x000000000048E000-memory.dmp	upx
C:\Windows\SysWOW64\windo.exe	upx
C:\Windows\SysWOW64\windo.exe	upx
behavioral2/memory/4708-261-0x0000000000400000-0x000000000040C000-memory.dmp	upx
behavioral2/memory/1808-263-0x0000000000400000-0x000000000048E000-memory.dmp	upx

Drops file in System32 directory 32 IoCs

Processes:

windo.exewindo.exewindo.exewindo.exewindo.exewindo.exewindo.exewindo.exewindo.exewindo.exe7282a85e6959e92e21513e5c5bbd21de7b3dd58bfa10a81d541afe5b07fc91b3.exewindo.exewindo.exewindo.exewindo.exewindo.exewindo.exewindo.exewindo.exewindo.exewindo.exe

description	ioc	process
File created	C:\Windows\SysWOW64\windo.exe	windo.exe
File opened for modification	C:\Windows\SysWOW64\windo.exe	windo.exe
File created	C:\Windows\SysWOW64\windo.exe	windo.exe
File opened for modification	C:\Windows\SysWOW64\windo.exe	windo.exe
File opened for modification	C:\Windows\SysWOW64\windo.exe	windo.exe
File created	C:\Windows\SysWOW64\windo.exe	windo.exe
File opened for modification	C:\Windows\SysWOW64\windo.exe	windo.exe
File created	C:\Windows\SysWOW64\windo.exe	windo.exe
File created	C:\Windows\SysWOW64\windo.exe	windo.exe
File opened for modification	C:\Windows\SysWOW64\windo.exe	windo.exe
File created	C:\Windows\SysWOW64\windo.exe	7282a85e6959e92e21513e5c5bbd21de7b3dd58bfa10a81d541afe5b07fc91b3.exe
File opened for modification	C:\Windows\SysWOW64\windo.exe	windo.exe
File opened for modification	C:\Windows\SysWOW64\windo.exe	windo.exe
File opened for modification	C:\Windows\SysWOW64\windo.exe	7282a85e6959e92e21513e5c5bbd21de7b3dd58bfa10a81d541afe5b07fc91b3.exe
File opened for modification	C:\Windows\SysWOW64\windo.exe	windo.exe
File created	C:\Windows\SysWOW64\windo.exe	windo.exe
File opened for modification	C:\Windows\SysWOW64\windo.exe	windo.exe
File opened for modification	C:\Windows\SysWOW64\windo.exe	windo.exe
File opened for modification	C:\Windows\SysWOW64\windo.exe	windo.exe
File created	C:\Windows\SysWOW64\windo.exe	windo.exe
File opened for modification	C:\Windows\SysWOW64\windo.exe	windo.exe
File opened for modification	C:\Windows\SysWOW64\windo.exe	windo.exe
File opened for modification	C:\Windows\SysWOW64\windo.exe	windo.exe
File opened for modification	C:\Windows\SysWOW64\windo.exe	windo.exe
File opened for modification	C:\Windows\SysWOW64\windo.exe	windo.exe
File opened for modification	C:\Windows\SysWOW64\windo.exe	windo.exe
File opened for modification	C:\Windows\SysWOW64\windo.exe	windo.exe
File opened for modification	C:\Windows\SysWOW64\windo.exe	windo.exe
File created	C:\Windows\SysWOW64\windo.exe	windo.exe
File created	C:\Windows\SysWOW64\windo.exe	windo.exe
File created	C:\Windows\SysWOW64\windo.exe	windo.exe
File opened for modification	C:\Windows\SysWOW64\windo.exe	windo.exe

Suspicious use of SetThreadContext 11 IoCs

Processes:

7282a85e6959e92e21513e5c5bbd21de7b3dd58bfa10a81d541afe5b07fc91b3.exewindo.exewindo.exewindo.exewindo.exewindo.exewindo.exewindo.exewindo.exewindo.exewindo.exe

description	pid	process	target process
PID 1612 set thread context of 2328	1612	7282a85e6959e92e21513e5c5bbd21de7b3dd58bfa10a81d541afe5b07fc91b3.exe	7282a85e6959e92e21513e5c5bbd21de7b3dd58bfa10a81d541afe5b07fc91b3.exe
PID 4444 set thread context of 4780	4444	windo.exe	windo.exe
PID 4796 set thread context of 4536	4796	windo.exe	windo.exe
PID 176 set thread context of 212	176	windo.exe	windo.exe
PID 1880 set thread context of 4816	1880	windo.exe	windo.exe
PID 1908 set thread context of 2996	1908	windo.exe	windo.exe
PID 3108 set thread context of 4388	3108	windo.exe	windo.exe
PID 3564 set thread context of 4220	3564	windo.exe	windo.exe
PID 3464 set thread context of 2268	3464	windo.exe	windo.exe
PID 2728 set thread context of 2132	2728	windo.exe	windo.exe
PID 4708 set thread context of 1808	4708	windo.exe	windo.exe

Suspicious use of SetWindowsHookEx 11 IoCs

Processes:

7282a85e6959e92e21513e5c5bbd21de7b3dd58bfa10a81d541afe5b07fc91b3.exewindo.exewindo.exewindo.exewindo.exewindo.exewindo.exewindo.exewindo.exewindo.exewindo.exe

pid	process
1612	7282a85e6959e92e21513e5c5bbd21de7b3dd58bfa10a81d541afe5b07fc91b3.exe
4444	windo.exe
4796	windo.exe
176	windo.exe
1880	windo.exe
1908	windo.exe
3108	windo.exe
3564	windo.exe
3464	windo.exe
2728	windo.exe
4708	windo.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

7282a85e6959e92e21513e5c5bbd21de7b3dd58bfa10a81d541afe5b07fc91b3.exe7282a85e6959e92e21513e5c5bbd21de7b3dd58bfa10a81d541afe5b07fc91b3.exewindo.exewindo.exewindo.exewindo.exewindo.exewindo.exewindo.exewindo.exewindo.exewindo.exe

description	pid	process	target process
PID 1612 wrote to memory of 2328	1612	7282a85e6959e92e21513e5c5bbd21de7b3dd58bfa10a81d541afe5b07fc91b3.exe	7282a85e6959e92e21513e5c5bbd21de7b3dd58bfa10a81d541afe5b07fc91b3.exe
PID 1612 wrote to memory of 2328	1612	7282a85e6959e92e21513e5c5bbd21de7b3dd58bfa10a81d541afe5b07fc91b3.exe	7282a85e6959e92e21513e5c5bbd21de7b3dd58bfa10a81d541afe5b07fc91b3.exe
PID 1612 wrote to memory of 2328	1612	7282a85e6959e92e21513e5c5bbd21de7b3dd58bfa10a81d541afe5b07fc91b3.exe	7282a85e6959e92e21513e5c5bbd21de7b3dd58bfa10a81d541afe5b07fc91b3.exe
PID 1612 wrote to memory of 2328	1612	7282a85e6959e92e21513e5c5bbd21de7b3dd58bfa10a81d541afe5b07fc91b3.exe	7282a85e6959e92e21513e5c5bbd21de7b3dd58bfa10a81d541afe5b07fc91b3.exe
PID 1612 wrote to memory of 2328	1612	7282a85e6959e92e21513e5c5bbd21de7b3dd58bfa10a81d541afe5b07fc91b3.exe	7282a85e6959e92e21513e5c5bbd21de7b3dd58bfa10a81d541afe5b07fc91b3.exe
PID 1612 wrote to memory of 2328	1612	7282a85e6959e92e21513e5c5bbd21de7b3dd58bfa10a81d541afe5b07fc91b3.exe	7282a85e6959e92e21513e5c5bbd21de7b3dd58bfa10a81d541afe5b07fc91b3.exe
PID 1612 wrote to memory of 2328	1612	7282a85e6959e92e21513e5c5bbd21de7b3dd58bfa10a81d541afe5b07fc91b3.exe	7282a85e6959e92e21513e5c5bbd21de7b3dd58bfa10a81d541afe5b07fc91b3.exe
PID 1612 wrote to memory of 2328	1612	7282a85e6959e92e21513e5c5bbd21de7b3dd58bfa10a81d541afe5b07fc91b3.exe	7282a85e6959e92e21513e5c5bbd21de7b3dd58bfa10a81d541afe5b07fc91b3.exe
PID 2328 wrote to memory of 4444	2328	7282a85e6959e92e21513e5c5bbd21de7b3dd58bfa10a81d541afe5b07fc91b3.exe	windo.exe
PID 2328 wrote to memory of 4444	2328	7282a85e6959e92e21513e5c5bbd21de7b3dd58bfa10a81d541afe5b07fc91b3.exe	windo.exe
PID 2328 wrote to memory of 4444	2328	7282a85e6959e92e21513e5c5bbd21de7b3dd58bfa10a81d541afe5b07fc91b3.exe	windo.exe
PID 4444 wrote to memory of 4780	4444	windo.exe	windo.exe
PID 4444 wrote to memory of 4780	4444	windo.exe	windo.exe
PID 4444 wrote to memory of 4780	4444	windo.exe	windo.exe
PID 4444 wrote to memory of 4780	4444	windo.exe	windo.exe
PID 4444 wrote to memory of 4780	4444	windo.exe	windo.exe
PID 4444 wrote to memory of 4780	4444	windo.exe	windo.exe
PID 4444 wrote to memory of 4780	4444	windo.exe	windo.exe
PID 4444 wrote to memory of 4780	4444	windo.exe	windo.exe
PID 4780 wrote to memory of 4796	4780	windo.exe	windo.exe
PID 4780 wrote to memory of 4796	4780	windo.exe	windo.exe
PID 4780 wrote to memory of 4796	4780	windo.exe	windo.exe
PID 4796 wrote to memory of 4536	4796	windo.exe	windo.exe
PID 4796 wrote to memory of 4536	4796	windo.exe	windo.exe
PID 4796 wrote to memory of 4536	4796	windo.exe	windo.exe
PID 4796 wrote to memory of 4536	4796	windo.exe	windo.exe
PID 4796 wrote to memory of 4536	4796	windo.exe	windo.exe
PID 4796 wrote to memory of 4536	4796	windo.exe	windo.exe
PID 4796 wrote to memory of 4536	4796	windo.exe	windo.exe
PID 4796 wrote to memory of 4536	4796	windo.exe	windo.exe
PID 4536 wrote to memory of 176	4536	windo.exe	windo.exe
PID 4536 wrote to memory of 176	4536	windo.exe	windo.exe
PID 4536 wrote to memory of 176	4536	windo.exe	windo.exe
PID 176 wrote to memory of 212	176	windo.exe	windo.exe
PID 176 wrote to memory of 212	176	windo.exe	windo.exe
PID 176 wrote to memory of 212	176	windo.exe	windo.exe
PID 176 wrote to memory of 212	176	windo.exe	windo.exe
PID 176 wrote to memory of 212	176	windo.exe	windo.exe
PID 176 wrote to memory of 212	176	windo.exe	windo.exe
PID 176 wrote to memory of 212	176	windo.exe	windo.exe
PID 176 wrote to memory of 212	176	windo.exe	windo.exe
PID 212 wrote to memory of 1880	212	windo.exe	windo.exe
PID 212 wrote to memory of 1880	212	windo.exe	windo.exe
PID 212 wrote to memory of 1880	212	windo.exe	windo.exe
PID 1880 wrote to memory of 4816	1880	windo.exe	windo.exe
PID 1880 wrote to memory of 4816	1880	windo.exe	windo.exe
PID 1880 wrote to memory of 4816	1880	windo.exe	windo.exe
PID 1880 wrote to memory of 4816	1880	windo.exe	windo.exe
PID 1880 wrote to memory of 4816	1880	windo.exe	windo.exe
PID 1880 wrote to memory of 4816	1880	windo.exe	windo.exe
PID 1880 wrote to memory of 4816	1880	windo.exe	windo.exe
PID 1880 wrote to memory of 4816	1880	windo.exe	windo.exe
PID 4816 wrote to memory of 1908	4816	windo.exe	windo.exe
PID 4816 wrote to memory of 1908	4816	windo.exe	windo.exe
PID 4816 wrote to memory of 1908	4816	windo.exe	windo.exe
PID 1908 wrote to memory of 2996	1908	windo.exe	windo.exe
PID 1908 wrote to memory of 2996	1908	windo.exe	windo.exe
PID 1908 wrote to memory of 2996	1908	windo.exe	windo.exe
PID 1908 wrote to memory of 2996	1908	windo.exe	windo.exe
PID 1908 wrote to memory of 2996	1908	windo.exe	windo.exe
PID 1908 wrote to memory of 2996	1908	windo.exe	windo.exe
PID 1908 wrote to memory of 2996	1908	windo.exe	windo.exe
PID 1908 wrote to memory of 2996	1908	windo.exe	windo.exe
PID 2996 wrote to memory of 3108	2996	windo.exe	windo.exe

C:\Users\Admin\AppData\Local\Temp\7282a85e6959e92e21513e5c5bbd21de7b3dd58bfa10a81d541afe5b07fc91b3.exe
"C:\Users\Admin\AppData\Local\Temp\7282a85e6959e92e21513e5c5bbd21de7b3dd58bfa10a81d541afe5b07fc91b3.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1612

C:\Users\Admin\AppData\Local\Temp\7282a85e6959e92e21513e5c5bbd21de7b3dd58bfa10a81d541afe5b07fc91b3.exe
C:\Users\Admin\AppData\Local\Temp\7282a85e6959e92e21513e5c5bbd21de7b3dd58bfa10a81d541afe5b07fc91b3.exe
2⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2328

C:\Windows\SysWOW64\windo.exe
C:\Windows\system32\windo.exe 1092 "C:\Users\Admin\AppData\Local\Temp\7282a85e6959e92e21513e5c5bbd21de7b3dd58bfa10a81d541afe5b07fc91b3.exe"
3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4444

C:\Windows\SysWOW64\windo.exe
C:\Windows\SysWOW64\windo.exe
4⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4780

C:\Windows\SysWOW64\windo.exe
C:\Windows\system32\windo.exe 1120 "C:\Windows\SysWOW64\windo.exe"
5⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4796

C:\Windows\SysWOW64\windo.exe
C:\Windows\SysWOW64\windo.exe
6⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4536

C:\Windows\SysWOW64\windo.exe
C:\Windows\system32\windo.exe 1092 "C:\Windows\SysWOW64\windo.exe"
7⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:176

C:\Windows\SysWOW64\windo.exe
C:\Windows\SysWOW64\windo.exe
8⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:212

C:\Windows\SysWOW64\windo.exe
C:\Windows\system32\windo.exe 1008 "C:\Windows\SysWOW64\windo.exe"
9⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1880

C:\Windows\SysWOW64\windo.exe
C:\Windows\SysWOW64\windo.exe
10⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4816

C:\Windows\SysWOW64\windo.exe
C:\Windows\system32\windo.exe 1096 "C:\Windows\SysWOW64\windo.exe"
11⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1908

C:\Windows\SysWOW64\windo.exe
C:\Windows\SysWOW64\windo.exe
12⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2996

C:\Windows\SysWOW64\windo.exe
C:\Windows\system32\windo.exe 1100 "C:\Windows\SysWOW64\windo.exe"
13⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:3108

C:\Windows\SysWOW64\windo.exe
C:\Windows\SysWOW64\windo.exe
14⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4388

C:\Windows\SysWOW64\windo.exe
C:\Windows\system32\windo.exe 1092 "C:\Windows\SysWOW64\windo.exe"
15⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:3564

C:\Windows\SysWOW64\windo.exe
C:\Windows\SysWOW64\windo.exe
16⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4220

C:\Windows\SysWOW64\windo.exe
C:\Windows\system32\windo.exe 1096 "C:\Windows\SysWOW64\windo.exe"
17⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:3464

C:\Windows\SysWOW64\windo.exe
C:\Windows\SysWOW64\windo.exe
18⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2268

C:\Windows\SysWOW64\windo.exe
C:\Windows\system32\windo.exe 980 "C:\Windows\SysWOW64\windo.exe"
19⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:2728

C:\Windows\SysWOW64\windo.exe
C:\Windows\SysWOW64\windo.exe
20⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2132

C:\Windows\SysWOW64\windo.exe
C:\Windows\system32\windo.exe 1092 "C:\Windows\SysWOW64\windo.exe"
21⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:4708

C:\Windows\SysWOW64\windo.exe
C:\Windows\SysWOW64\windo.exe
22⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1808

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2629973501-4017243118-3254762364-1000\6ad18a64f9c40a36e38b79aa7f592c9a_e32e1c79-b88e-4709-94fb-81034ca3398e
Filesize
51B

MD5
61bfbe324dc9dd3bc734b901e2a3f3f8

SHA1
0aa45f2b0810829afcced650bdf390d33981f18e

SHA256
bfe26d0c9783577aedf056ac26ccb15855cd2f25fb30bdc7e8581f2be5da66dc

SHA512
3957f2e0158f52f457fdc45e7e2716e68b9236fbebab02a35587ad9b0fd8f96878665d9f5d8770f5beb0e2b5f7da5769f963d77f27ffa953eb0cdffdfa5b9389

Download Submit
C:\Windows\SysWOW64\windo.exe
Filesize
87KB

MD5
1f625fa2de5d1cee01425cf6dd843a96

SHA1
696b3a4cf8da199176bcd3dc4c7f2493d81b001e

SHA256
7282a85e6959e92e21513e5c5bbd21de7b3dd58bfa10a81d541afe5b07fc91b3

SHA512
366a015b371b06de687638f2b3290e1725a2f1f7b59b997f8bf0151a960ca58ef3eab3a24d24578d0953715e416374e41f7222ba1f49faf6f6a67ccd9d2f35e0

Download Submit
C:\Windows\SysWOW64\windo.exe
Filesize
87KB

MD5
1f625fa2de5d1cee01425cf6dd843a96

SHA1
696b3a4cf8da199176bcd3dc4c7f2493d81b001e

SHA256
7282a85e6959e92e21513e5c5bbd21de7b3dd58bfa10a81d541afe5b07fc91b3

SHA512
366a015b371b06de687638f2b3290e1725a2f1f7b59b997f8bf0151a960ca58ef3eab3a24d24578d0953715e416374e41f7222ba1f49faf6f6a67ccd9d2f35e0

Download Submit
C:\Windows\SysWOW64\windo.exe
Filesize
87KB

MD5
1f625fa2de5d1cee01425cf6dd843a96

SHA1
696b3a4cf8da199176bcd3dc4c7f2493d81b001e

SHA256
7282a85e6959e92e21513e5c5bbd21de7b3dd58bfa10a81d541afe5b07fc91b3

SHA512
366a015b371b06de687638f2b3290e1725a2f1f7b59b997f8bf0151a960ca58ef3eab3a24d24578d0953715e416374e41f7222ba1f49faf6f6a67ccd9d2f35e0

Download Submit
C:\Windows\SysWOW64\windo.exe
Filesize
87KB

MD5
1f625fa2de5d1cee01425cf6dd843a96

SHA1
696b3a4cf8da199176bcd3dc4c7f2493d81b001e

SHA256
7282a85e6959e92e21513e5c5bbd21de7b3dd58bfa10a81d541afe5b07fc91b3

SHA512
366a015b371b06de687638f2b3290e1725a2f1f7b59b997f8bf0151a960ca58ef3eab3a24d24578d0953715e416374e41f7222ba1f49faf6f6a67ccd9d2f35e0

Download Submit
C:\Windows\SysWOW64\windo.exe
Filesize
87KB

MD5
1f625fa2de5d1cee01425cf6dd843a96

SHA1
696b3a4cf8da199176bcd3dc4c7f2493d81b001e

SHA256
7282a85e6959e92e21513e5c5bbd21de7b3dd58bfa10a81d541afe5b07fc91b3

SHA512
366a015b371b06de687638f2b3290e1725a2f1f7b59b997f8bf0151a960ca58ef3eab3a24d24578d0953715e416374e41f7222ba1f49faf6f6a67ccd9d2f35e0

Download Submit
C:\Windows\SysWOW64\windo.exe
Filesize
87KB

MD5
1f625fa2de5d1cee01425cf6dd843a96

SHA1
696b3a4cf8da199176bcd3dc4c7f2493d81b001e

SHA256
7282a85e6959e92e21513e5c5bbd21de7b3dd58bfa10a81d541afe5b07fc91b3

SHA512
366a015b371b06de687638f2b3290e1725a2f1f7b59b997f8bf0151a960ca58ef3eab3a24d24578d0953715e416374e41f7222ba1f49faf6f6a67ccd9d2f35e0

Download Submit
C:\Windows\SysWOW64\windo.exe
Filesize
87KB

MD5
1f625fa2de5d1cee01425cf6dd843a96

SHA1
696b3a4cf8da199176bcd3dc4c7f2493d81b001e

SHA256
7282a85e6959e92e21513e5c5bbd21de7b3dd58bfa10a81d541afe5b07fc91b3

SHA512
366a015b371b06de687638f2b3290e1725a2f1f7b59b997f8bf0151a960ca58ef3eab3a24d24578d0953715e416374e41f7222ba1f49faf6f6a67ccd9d2f35e0

Download Submit
C:\Windows\SysWOW64\windo.exe
Filesize
87KB

MD5
1f625fa2de5d1cee01425cf6dd843a96

SHA1
696b3a4cf8da199176bcd3dc4c7f2493d81b001e

SHA256
7282a85e6959e92e21513e5c5bbd21de7b3dd58bfa10a81d541afe5b07fc91b3

SHA512
366a015b371b06de687638f2b3290e1725a2f1f7b59b997f8bf0151a960ca58ef3eab3a24d24578d0953715e416374e41f7222ba1f49faf6f6a67ccd9d2f35e0

Download Submit
C:\Windows\SysWOW64\windo.exe
Filesize
87KB

MD5
1f625fa2de5d1cee01425cf6dd843a96

SHA1
696b3a4cf8da199176bcd3dc4c7f2493d81b001e

SHA256
7282a85e6959e92e21513e5c5bbd21de7b3dd58bfa10a81d541afe5b07fc91b3

SHA512
366a015b371b06de687638f2b3290e1725a2f1f7b59b997f8bf0151a960ca58ef3eab3a24d24578d0953715e416374e41f7222ba1f49faf6f6a67ccd9d2f35e0

Download Submit
C:\Windows\SysWOW64\windo.exe
Filesize
87KB

MD5
1f625fa2de5d1cee01425cf6dd843a96

SHA1
696b3a4cf8da199176bcd3dc4c7f2493d81b001e

SHA256
7282a85e6959e92e21513e5c5bbd21de7b3dd58bfa10a81d541afe5b07fc91b3

SHA512
366a015b371b06de687638f2b3290e1725a2f1f7b59b997f8bf0151a960ca58ef3eab3a24d24578d0953715e416374e41f7222ba1f49faf6f6a67ccd9d2f35e0

Download Submit
C:\Windows\SysWOW64\windo.exe
Filesize
87KB

MD5
1f625fa2de5d1cee01425cf6dd843a96

SHA1
696b3a4cf8da199176bcd3dc4c7f2493d81b001e

SHA256
7282a85e6959e92e21513e5c5bbd21de7b3dd58bfa10a81d541afe5b07fc91b3

SHA512
366a015b371b06de687638f2b3290e1725a2f1f7b59b997f8bf0151a960ca58ef3eab3a24d24578d0953715e416374e41f7222ba1f49faf6f6a67ccd9d2f35e0

Download Submit
C:\Windows\SysWOW64\windo.exe
Filesize
87KB

MD5
1f625fa2de5d1cee01425cf6dd843a96

SHA1
696b3a4cf8da199176bcd3dc4c7f2493d81b001e

SHA256
7282a85e6959e92e21513e5c5bbd21de7b3dd58bfa10a81d541afe5b07fc91b3

SHA512
366a015b371b06de687638f2b3290e1725a2f1f7b59b997f8bf0151a960ca58ef3eab3a24d24578d0953715e416374e41f7222ba1f49faf6f6a67ccd9d2f35e0

Download Submit
C:\Windows\SysWOW64\windo.exe
Filesize
87KB

MD5
1f625fa2de5d1cee01425cf6dd843a96

SHA1
696b3a4cf8da199176bcd3dc4c7f2493d81b001e

SHA256
7282a85e6959e92e21513e5c5bbd21de7b3dd58bfa10a81d541afe5b07fc91b3

SHA512
366a015b371b06de687638f2b3290e1725a2f1f7b59b997f8bf0151a960ca58ef3eab3a24d24578d0953715e416374e41f7222ba1f49faf6f6a67ccd9d2f35e0

Download Submit
C:\Windows\SysWOW64\windo.exe
Filesize
87KB

MD5
1f625fa2de5d1cee01425cf6dd843a96

SHA1
696b3a4cf8da199176bcd3dc4c7f2493d81b001e

SHA256
7282a85e6959e92e21513e5c5bbd21de7b3dd58bfa10a81d541afe5b07fc91b3

SHA512
366a015b371b06de687638f2b3290e1725a2f1f7b59b997f8bf0151a960ca58ef3eab3a24d24578d0953715e416374e41f7222ba1f49faf6f6a67ccd9d2f35e0

Download Submit
C:\Windows\SysWOW64\windo.exe
Filesize
87KB

MD5
1f625fa2de5d1cee01425cf6dd843a96

SHA1
696b3a4cf8da199176bcd3dc4c7f2493d81b001e

SHA256
7282a85e6959e92e21513e5c5bbd21de7b3dd58bfa10a81d541afe5b07fc91b3

SHA512
366a015b371b06de687638f2b3290e1725a2f1f7b59b997f8bf0151a960ca58ef3eab3a24d24578d0953715e416374e41f7222ba1f49faf6f6a67ccd9d2f35e0

Download Submit
C:\Windows\SysWOW64\windo.exe
Filesize
87KB

MD5
1f625fa2de5d1cee01425cf6dd843a96

SHA1
696b3a4cf8da199176bcd3dc4c7f2493d81b001e

SHA256
7282a85e6959e92e21513e5c5bbd21de7b3dd58bfa10a81d541afe5b07fc91b3

SHA512
366a015b371b06de687638f2b3290e1725a2f1f7b59b997f8bf0151a960ca58ef3eab3a24d24578d0953715e416374e41f7222ba1f49faf6f6a67ccd9d2f35e0

Download Submit
C:\Windows\SysWOW64\windo.exe
Filesize
87KB

MD5
1f625fa2de5d1cee01425cf6dd843a96

SHA1
696b3a4cf8da199176bcd3dc4c7f2493d81b001e

SHA256
7282a85e6959e92e21513e5c5bbd21de7b3dd58bfa10a81d541afe5b07fc91b3

SHA512
366a015b371b06de687638f2b3290e1725a2f1f7b59b997f8bf0151a960ca58ef3eab3a24d24578d0953715e416374e41f7222ba1f49faf6f6a67ccd9d2f35e0

Download Submit
C:\Windows\SysWOW64\windo.exe
Filesize
87KB

MD5
1f625fa2de5d1cee01425cf6dd843a96

SHA1
696b3a4cf8da199176bcd3dc4c7f2493d81b001e

SHA256
7282a85e6959e92e21513e5c5bbd21de7b3dd58bfa10a81d541afe5b07fc91b3

SHA512
366a015b371b06de687638f2b3290e1725a2f1f7b59b997f8bf0151a960ca58ef3eab3a24d24578d0953715e416374e41f7222ba1f49faf6f6a67ccd9d2f35e0

Download Submit
C:\Windows\SysWOW64\windo.exe
Filesize
87KB

MD5
1f625fa2de5d1cee01425cf6dd843a96

SHA1
696b3a4cf8da199176bcd3dc4c7f2493d81b001e

SHA256
7282a85e6959e92e21513e5c5bbd21de7b3dd58bfa10a81d541afe5b07fc91b3

SHA512
366a015b371b06de687638f2b3290e1725a2f1f7b59b997f8bf0151a960ca58ef3eab3a24d24578d0953715e416374e41f7222ba1f49faf6f6a67ccd9d2f35e0

Download Submit
C:\Windows\SysWOW64\windo.exe
Filesize
87KB

MD5
1f625fa2de5d1cee01425cf6dd843a96

SHA1
696b3a4cf8da199176bcd3dc4c7f2493d81b001e

SHA256
7282a85e6959e92e21513e5c5bbd21de7b3dd58bfa10a81d541afe5b07fc91b3

SHA512
366a015b371b06de687638f2b3290e1725a2f1f7b59b997f8bf0151a960ca58ef3eab3a24d24578d0953715e416374e41f7222ba1f49faf6f6a67ccd9d2f35e0

Download Submit
C:\Windows\SysWOW64\windo.exe
Filesize
87KB

MD5
1f625fa2de5d1cee01425cf6dd843a96

SHA1
696b3a4cf8da199176bcd3dc4c7f2493d81b001e

SHA256
7282a85e6959e92e21513e5c5bbd21de7b3dd58bfa10a81d541afe5b07fc91b3

SHA512
366a015b371b06de687638f2b3290e1725a2f1f7b59b997f8bf0151a960ca58ef3eab3a24d24578d0953715e416374e41f7222ba1f49faf6f6a67ccd9d2f35e0

Download Submit
memory/176-168-0x0000000000000000-mapping.dmp

Download
memory/176-178-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/212-172-0x0000000000000000-mapping.dmp

Download
memory/212-179-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/1612-138-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/1808-256-0x0000000000000000-mapping.dmp

Download
memory/1808-263-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/1880-180-0x0000000000000000-mapping.dmp

Download
memory/1880-187-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/1908-192-0x0000000000000000-mapping.dmp

Download
memory/1908-200-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2132-251-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/2132-244-0x0000000000000000-mapping.dmp

Download
memory/2268-232-0x0000000000000000-mapping.dmp

Download
memory/2268-239-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/2328-140-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/2328-137-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/2328-134-0x0000000000000000-mapping.dmp

Download
memory/2328-135-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/2328-139-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/2328-154-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/2728-240-0x0000000000000000-mapping.dmp

Download
memory/2728-248-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2996-203-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/2996-196-0x0000000000000000-mapping.dmp

Download
memory/3108-204-0x0000000000000000-mapping.dmp

Download
memory/3108-214-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/3464-237-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/3464-228-0x0000000000000000-mapping.dmp

Download
memory/3564-216-0x0000000000000000-mapping.dmp

Download
memory/3564-224-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/4220-227-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/4220-220-0x0000000000000000-mapping.dmp

Download
memory/4388-208-0x0000000000000000-mapping.dmp

Download
memory/4388-215-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/4444-141-0x0000000000000000-mapping.dmp

Download
memory/4444-151-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/4536-167-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/4536-160-0x0000000000000000-mapping.dmp

Download
memory/4708-261-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/4708-252-0x0000000000000000-mapping.dmp

Download
memory/4780-147-0x0000000000000000-mapping.dmp

Download
memory/4780-155-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/4796-156-0x0000000000000000-mapping.dmp

Download
memory/4796-166-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/4816-191-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/4816-184-0x0000000000000000-mapping.dmp

Download