2b3db408736780f5a310e346ce63ac4f02903b68b50b92adcc1114de39ba6234

Analysis

max time kernel
150s
max time network
153s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
19/09/2022, 03:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2b3db408736780f5a310e346ce63ac4f02903b68b50b92adcc1114de39ba6234.exe
Size

416KB
MD5

3aca89171aafa331f7fcad5fd67c7bc6
SHA1

99751e625d782fe8e5398a6b81dc697d819a8da2
SHA256

2b3db408736780f5a310e346ce63ac4f02903b68b50b92adcc1114de39ba6234
SHA512

b8b9d7298ab50bc3dd6df6af82e666444aeff9beefd77ce474176e56a5db9f47ddbd0b77fbb77d8dd3aa4db9a85049cd836d2382856c15656d758af259076651
SSDEEP

12288:TDLOhQiq/baOtDO5k+XWsJQrrUmhiK2thyHRU:TDuQiqjklWhiTyHRU

Score

10^/10

evasion persistence upx

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	ynS4WJZ6.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	raeava.exe

Executes dropped EXE 7 IoCs

pid	Process
1172	ynS4WJZ6.exe
1508	raeava.exe
620	2aid.exe
1612	2aid.exe
1652	3aid.exe
336	csrss.exe
848	4aid.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1612-83-0x0000000000400000-0x000000000040D000-memory.dmp	upx
behavioral1/memory/1612-85-0x0000000000400000-0x000000000040D000-memory.dmp	upx
behavioral1/memory/1612-86-0x0000000000400000-0x000000000040D000-memory.dmp	upx
behavioral1/memory/1612-90-0x0000000000400000-0x000000000040D000-memory.dmp	upx
behavioral1/memory/1612-91-0x0000000000400000-0x000000000040D000-memory.dmp	upx
behavioral1/memory/1612-93-0x0000000000400000-0x000000000040D000-memory.dmp	upx

Deletes itself 1 IoCs

pid	Process
1692	cmd.exe

Loads dropped DLL 10 IoCs

pid	Process
1900	2b3db408736780f5a310e346ce63ac4f02903b68b50b92adcc1114de39ba6234.exe
1900	2b3db408736780f5a310e346ce63ac4f02903b68b50b92adcc1114de39ba6234.exe
1172	ynS4WJZ6.exe
1172	ynS4WJZ6.exe
1900	2b3db408736780f5a310e346ce63ac4f02903b68b50b92adcc1114de39ba6234.exe
1900	2b3db408736780f5a310e346ce63ac4f02903b68b50b92adcc1114de39ba6234.exe
1900	2b3db408736780f5a310e346ce63ac4f02903b68b50b92adcc1114de39ba6234.exe
1900	2b3db408736780f5a310e346ce63ac4f02903b68b50b92adcc1114de39ba6234.exe
1900	2b3db408736780f5a310e346ce63ac4f02903b68b50b92adcc1114de39ba6234.exe
1900	2b3db408736780f5a310e346ce63ac4f02903b68b50b92adcc1114de39ba6234.exe

Adds Run key to start application 2 TTPs 53 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\raeava = "C:\\Users\\Admin\\raeava.exe /Q"	raeava.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\raeava = "C:\\Users\\Admin\\raeava.exe /W"	raeava.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\raeava = "C:\\Users\\Admin\\raeava.exe /b"	raeava.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\raeava = "C:\\Users\\Admin\\raeava.exe /B"	raeava.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\raeava = "C:\\Users\\Admin\\raeava.exe /f"	raeava.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\raeava = "C:\\Users\\Admin\\raeava.exe /d"	raeava.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\raeava = "C:\\Users\\Admin\\raeava.exe /m"	raeava.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\raeava = "C:\\Users\\Admin\\raeava.exe /U"	raeava.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\raeava = "C:\\Users\\Admin\\raeava.exe /L"	raeava.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\raeava = "C:\\Users\\Admin\\raeava.exe /a"	raeava.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\raeava = "C:\\Users\\Admin\\raeava.exe /O"	raeava.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\raeava = "C:\\Users\\Admin\\raeava.exe /X"	raeava.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\raeava = "C:\\Users\\Admin\\raeava.exe /J"	raeava.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\raeava = "C:\\Users\\Admin\\raeava.exe /N"	raeava.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\raeava = "C:\\Users\\Admin\\raeava.exe /K"	raeava.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\raeava = "C:\\Users\\Admin\\raeava.exe /p"	raeava.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\raeava = "C:\\Users\\Admin\\raeava.exe /M"	raeava.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\raeava = "C:\\Users\\Admin\\raeava.exe /z"	raeava.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\raeava = "C:\\Users\\Admin\\raeava.exe /o"	ynS4WJZ6.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\raeava = "C:\\Users\\Admin\\raeava.exe /q"	raeava.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\raeava = "C:\\Users\\Admin\\raeava.exe /I"	raeava.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\raeava = "C:\\Users\\Admin\\raeava.exe /C"	raeava.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\	ynS4WJZ6.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\raeava = "C:\\Users\\Admin\\raeava.exe /P"	raeava.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\raeava = "C:\\Users\\Admin\\raeava.exe /w"	raeava.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\raeava = "C:\\Users\\Admin\\raeava.exe /A"	raeava.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\raeava = "C:\\Users\\Admin\\raeava.exe /H"	raeava.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\raeava = "C:\\Users\\Admin\\raeava.exe /R"	raeava.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\raeava = "C:\\Users\\Admin\\raeava.exe /h"	raeava.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\raeava = "C:\\Users\\Admin\\raeava.exe /D"	raeava.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\raeava = "C:\\Users\\Admin\\raeava.exe /k"	raeava.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\raeava = "C:\\Users\\Admin\\raeava.exe /T"	raeava.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\raeava = "C:\\Users\\Admin\\raeava.exe /l"	raeava.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\raeava = "C:\\Users\\Admin\\raeava.exe /o"	raeava.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\raeava = "C:\\Users\\Admin\\raeava.exe /g"	raeava.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\raeava = "C:\\Users\\Admin\\raeava.exe /E"	raeava.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\raeava = "C:\\Users\\Admin\\raeava.exe /j"	raeava.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\raeava = "C:\\Users\\Admin\\raeava.exe /G"	raeava.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\raeava = "C:\\Users\\Admin\\raeava.exe /v"	raeava.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\raeava = "C:\\Users\\Admin\\raeava.exe /x"	raeava.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\raeava = "C:\\Users\\Admin\\raeava.exe /Y"	raeava.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\raeava = "C:\\Users\\Admin\\raeava.exe /V"	raeava.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\raeava = "C:\\Users\\Admin\\raeava.exe /i"	raeava.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\raeava = "C:\\Users\\Admin\\raeava.exe /r"	raeava.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\raeava = "C:\\Users\\Admin\\raeava.exe /n"	raeava.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\raeava = "C:\\Users\\Admin\\raeava.exe /y"	raeava.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\	raeava.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\raeava = "C:\\Users\\Admin\\raeava.exe /t"	raeava.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\raeava = "C:\\Users\\Admin\\raeava.exe /Z"	raeava.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\raeava = "C:\\Users\\Admin\\raeava.exe /u"	raeava.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\raeava = "C:\\Users\\Admin\\raeava.exe /F"	raeava.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\raeava = "C:\\Users\\Admin\\raeava.exe /e"	raeava.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\raeava = "C:\\Users\\Admin\\raeava.exe /c"	raeava.exe

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File created	\systemroot\assembly\GAC_64\Desktop.ini	csrss.exe
File created	\systemroot\assembly\GAC_32\Desktop.ini	csrss.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 620 set thread context of 1612	620	2aid.exe	34
PID 1652 set thread context of 1516	1652	3aid.exe	36

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Enumerates processes with tasklist 1 TTPs 2 IoCs

Process Discovery

T1057

pid	Process
1248	tasklist.exe
1728	tasklist.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1172	ynS4WJZ6.exe
1172	ynS4WJZ6.exe
1612	2aid.exe
1652	3aid.exe
1652	3aid.exe
1652	3aid.exe
1612	2aid.exe
1612	2aid.exe
1612	2aid.exe
1612	2aid.exe
1612	2aid.exe
1612	2aid.exe
1612	2aid.exe
1508	raeava.exe
1652	3aid.exe
1508	raeava.exe
1508	raeava.exe
1612	2aid.exe
1612	2aid.exe
1508	raeava.exe
1612	2aid.exe
1612	2aid.exe
1508	raeava.exe
1612	2aid.exe
1508	raeava.exe
1508	raeava.exe
1612	2aid.exe
1508	raeava.exe
1612	2aid.exe
1612	2aid.exe
1508	raeava.exe
1612	2aid.exe
1508	raeava.exe
1612	2aid.exe
1508	raeava.exe
1612	2aid.exe
1612	2aid.exe
1508	raeava.exe
1612	2aid.exe
1612	2aid.exe
1508	raeava.exe
1508	raeava.exe
1612	2aid.exe
1612	2aid.exe
1508	raeava.exe
1612	2aid.exe
1612	2aid.exe
1508	raeava.exe
1612	2aid.exe
1508	raeava.exe
1508	raeava.exe
1612	2aid.exe
1508	raeava.exe
1612	2aid.exe
1612	2aid.exe
1612	2aid.exe
1612	2aid.exe
1612	2aid.exe
1508	raeava.exe
1612	2aid.exe
1508	raeava.exe
1508	raeava.exe
1508	raeava.exe
1612	2aid.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1248	tasklist.exe
Token: SeDebugPrivilege	1652	3aid.exe
Token: SeDebugPrivilege	1652	3aid.exe
Token: SeDebugPrivilege	1728	tasklist.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1392	Explorer.EXE
1392	Explorer.EXE

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
1392	Explorer.EXE
1392	Explorer.EXE

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
1900	2b3db408736780f5a310e346ce63ac4f02903b68b50b92adcc1114de39ba6234.exe
1172	ynS4WJZ6.exe
1508	raeava.exe
620	2aid.exe
848	4aid.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
336	csrss.exe

Suspicious use of WriteProcessMemory 52 IoCs

description	pid	Process	procid_target
PID 1900 wrote to memory of 1172	1900	2b3db408736780f5a310e346ce63ac4f02903b68b50b92adcc1114de39ba6234.exe	27
PID 1900 wrote to memory of 1172	1900	2b3db408736780f5a310e346ce63ac4f02903b68b50b92adcc1114de39ba6234.exe	27
PID 1900 wrote to memory of 1172	1900	2b3db408736780f5a310e346ce63ac4f02903b68b50b92adcc1114de39ba6234.exe	27
PID 1900 wrote to memory of 1172	1900	2b3db408736780f5a310e346ce63ac4f02903b68b50b92adcc1114de39ba6234.exe	27
PID 1172 wrote to memory of 1508	1172	ynS4WJZ6.exe	28
PID 1172 wrote to memory of 1508	1172	ynS4WJZ6.exe	28
PID 1172 wrote to memory of 1508	1172	ynS4WJZ6.exe	28
PID 1172 wrote to memory of 1508	1172	ynS4WJZ6.exe	28
PID 1172 wrote to memory of 1456	1172	ynS4WJZ6.exe	29
PID 1172 wrote to memory of 1456	1172	ynS4WJZ6.exe	29
PID 1172 wrote to memory of 1456	1172	ynS4WJZ6.exe	29
PID 1172 wrote to memory of 1456	1172	ynS4WJZ6.exe	29
PID 1456 wrote to memory of 1248	1456	cmd.exe	31
PID 1456 wrote to memory of 1248	1456	cmd.exe	31
PID 1456 wrote to memory of 1248	1456	cmd.exe	31
PID 1456 wrote to memory of 1248	1456	cmd.exe	31
PID 1900 wrote to memory of 620	1900	2b3db408736780f5a310e346ce63ac4f02903b68b50b92adcc1114de39ba6234.exe	33
PID 1900 wrote to memory of 620	1900	2b3db408736780f5a310e346ce63ac4f02903b68b50b92adcc1114de39ba6234.exe	33
PID 1900 wrote to memory of 620	1900	2b3db408736780f5a310e346ce63ac4f02903b68b50b92adcc1114de39ba6234.exe	33
PID 1900 wrote to memory of 620	1900	2b3db408736780f5a310e346ce63ac4f02903b68b50b92adcc1114de39ba6234.exe	33
PID 620 wrote to memory of 1612	620	2aid.exe	34
PID 620 wrote to memory of 1612	620	2aid.exe	34
PID 620 wrote to memory of 1612	620	2aid.exe	34
PID 620 wrote to memory of 1612	620	2aid.exe	34
PID 620 wrote to memory of 1612	620	2aid.exe	34
PID 620 wrote to memory of 1612	620	2aid.exe	34
PID 620 wrote to memory of 1612	620	2aid.exe	34
PID 620 wrote to memory of 1612	620	2aid.exe	34
PID 1900 wrote to memory of 1652	1900	2b3db408736780f5a310e346ce63ac4f02903b68b50b92adcc1114de39ba6234.exe	35
PID 1900 wrote to memory of 1652	1900	2b3db408736780f5a310e346ce63ac4f02903b68b50b92adcc1114de39ba6234.exe	35
PID 1900 wrote to memory of 1652	1900	2b3db408736780f5a310e346ce63ac4f02903b68b50b92adcc1114de39ba6234.exe	35
PID 1900 wrote to memory of 1652	1900	2b3db408736780f5a310e346ce63ac4f02903b68b50b92adcc1114de39ba6234.exe	35
PID 1652 wrote to memory of 1392	1652	3aid.exe	14
PID 1652 wrote to memory of 336	1652	3aid.exe	1
PID 1652 wrote to memory of 1516	1652	3aid.exe	36
PID 1652 wrote to memory of 1516	1652	3aid.exe	36
PID 1652 wrote to memory of 1516	1652	3aid.exe	36
PID 1652 wrote to memory of 1516	1652	3aid.exe	36
PID 1652 wrote to memory of 1516	1652	3aid.exe	36
PID 1900 wrote to memory of 848	1900	2b3db408736780f5a310e346ce63ac4f02903b68b50b92adcc1114de39ba6234.exe	38
PID 1900 wrote to memory of 848	1900	2b3db408736780f5a310e346ce63ac4f02903b68b50b92adcc1114de39ba6234.exe	38
PID 1900 wrote to memory of 848	1900	2b3db408736780f5a310e346ce63ac4f02903b68b50b92adcc1114de39ba6234.exe	38
PID 1900 wrote to memory of 848	1900	2b3db408736780f5a310e346ce63ac4f02903b68b50b92adcc1114de39ba6234.exe	38
PID 1900 wrote to memory of 1692	1900	2b3db408736780f5a310e346ce63ac4f02903b68b50b92adcc1114de39ba6234.exe	39
PID 1900 wrote to memory of 1692	1900	2b3db408736780f5a310e346ce63ac4f02903b68b50b92adcc1114de39ba6234.exe	39
PID 1900 wrote to memory of 1692	1900	2b3db408736780f5a310e346ce63ac4f02903b68b50b92adcc1114de39ba6234.exe	39
PID 1900 wrote to memory of 1692	1900	2b3db408736780f5a310e346ce63ac4f02903b68b50b92adcc1114de39ba6234.exe	39
PID 1692 wrote to memory of 1728	1692	cmd.exe	41
PID 1692 wrote to memory of 1728	1692	cmd.exe	41
PID 1692 wrote to memory of 1728	1692	cmd.exe	41
PID 1692 wrote to memory of 1728	1692	cmd.exe	41
PID 336 wrote to memory of 868	336	csrss.exe	20

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:336

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1392
- C:\Users\Admin\AppData\Local\Temp\2b3db408736780f5a310e346ce63ac4f02903b68b50b92adcc1114de39ba6234.exe
  "C:\Users\Admin\AppData\Local\Temp\2b3db408736780f5a310e346ce63ac4f02903b68b50b92adcc1114de39ba6234.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1900
- - C:\Users\Admin\ynS4WJZ6.exe
    C:\Users\Admin\ynS4WJZ6.exe
    3⤵
    - Modifies visiblity of hidden/system files in Explorer
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1172
  - - C:\Users\Admin\raeava.exe
      "C:\Users\Admin\raeava.exe"
      4⤵
      Modifies visiblity of hidden/system files in Explorer
      Executes dropped EXE
      Adds Run key to start application
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      PID:1508
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c tasklist&&del ynS4WJZ6.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1456
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:1248
- - C:\Users\Admin\2aid.exe
    C:\Users\Admin\2aid.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:620
  - - C:\Users\Admin\2aid.exe
      "C:\Users\Admin\2aid.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:1612
- - C:\Users\Admin\3aid.exe
    C:\Users\Admin\3aid.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1652
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe"
      4⤵
      PID:1516
- - C:\Users\Admin\4aid.exe
    C:\Users\Admin\4aid.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:848
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c tasklist&&del 2b3db408736780f5a310e346ce63ac4f02903b68b50b92adcc1114de39ba6234.exe
    3⤵
    - Deletes itself
    - Suspicious use of WriteProcessMemory
    PID:1692
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:1728

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs
1⤵
PID:868

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Discovery

Process Discovery

T1057

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\2aid.exe

Filesize
72KB

MD5
bfd48191f79f45416e67efe6a8f25d5d

SHA1
ae31da442af2fe6ef7f960c3a50a3250baeafd8e

SHA256
8271c7ff81aeb4d60ddf9b7c6c5c7e9a391324b999184f79bac6fcd411f804f5

SHA512
2b2ff2c152e6ddf98d5e1043b456f080178a61413aa37a12166759a32a7b8ae98e8adcd90c76d4601c7da1334589fe93e4691e51f90dac70d74e954d06a246b8

Download Submit
C:\Users\Admin\2aid.exe

Filesize
72KB

MD5
bfd48191f79f45416e67efe6a8f25d5d

SHA1
ae31da442af2fe6ef7f960c3a50a3250baeafd8e

SHA256
8271c7ff81aeb4d60ddf9b7c6c5c7e9a391324b999184f79bac6fcd411f804f5

SHA512
2b2ff2c152e6ddf98d5e1043b456f080178a61413aa37a12166759a32a7b8ae98e8adcd90c76d4601c7da1334589fe93e4691e51f90dac70d74e954d06a246b8

Download Submit
C:\Users\Admin\2aid.exe

Filesize
72KB

MD5
bfd48191f79f45416e67efe6a8f25d5d

SHA1
ae31da442af2fe6ef7f960c3a50a3250baeafd8e

SHA256
8271c7ff81aeb4d60ddf9b7c6c5c7e9a391324b999184f79bac6fcd411f804f5

SHA512
2b2ff2c152e6ddf98d5e1043b456f080178a61413aa37a12166759a32a7b8ae98e8adcd90c76d4601c7da1334589fe93e4691e51f90dac70d74e954d06a246b8

Download Submit
C:\Users\Admin\3aid.exe

Filesize
208KB

MD5
914c8e336d83ca18bde8ec3d6dd5d852

SHA1
85fd8a4c0114a421d05ca78be872def090b217b8

SHA256
0061ffc16cd3615e7d30f22a69d65642cb13f55a357da9f379ebe904168bbe5e

SHA512
578e6b94bf576359daf96cc097c5798c9a1b8f3a47ba3f4f0707503ce32f78fafb6f0540a95f2ba311223e14be8f192468a4f3c644fe9cff9198e8ead92c0673

Download Submit
C:\Users\Admin\3aid.exe

Filesize
208KB

MD5
914c8e336d83ca18bde8ec3d6dd5d852

SHA1
85fd8a4c0114a421d05ca78be872def090b217b8

SHA256
0061ffc16cd3615e7d30f22a69d65642cb13f55a357da9f379ebe904168bbe5e

SHA512
578e6b94bf576359daf96cc097c5798c9a1b8f3a47ba3f4f0707503ce32f78fafb6f0540a95f2ba311223e14be8f192468a4f3c644fe9cff9198e8ead92c0673

Download Submit
C:\Users\Admin\4aid.exe

Filesize
44KB

MD5
27ddac23e41b3aba1371229bc3114ebe

SHA1
70e7b60767a38a27d22b03415006c5a265fe5e93

SHA256
afa5e7176ef811c85155cb18eed520d12c1bedc2c3e3e1775a197c8a687e3614

SHA512
e18dc372eff827a6590c3ff9a83d428ce2fef6682b9a0ddf667489f5d148472b6f9f6239c4df68eae43c377a4c1f633c45221902044288cdbfdf20708cdd1ebd

Download Submit
C:\Users\Admin\raeava.exe

Filesize
292KB

MD5
2ae52a2d50b90ba6e7c29e074b012108

SHA1
82ada90a1b80516f5f45e704a2ea47671c4322ec

SHA256
f06729547467966639a0454c55149e4baece3e291462f4571bc7165bfe10b58d

SHA512
3952a7c2231e61758a61b11e92c6f4c55daffbb81ea0305984899154fca33b44a609a81b4747ab574ccbf627dbcd4460e8b0135c132445a59b989a6a0e566157

Download Submit
C:\Users\Admin\raeava.exe

Filesize
292KB

MD5
2ae52a2d50b90ba6e7c29e074b012108

SHA1
82ada90a1b80516f5f45e704a2ea47671c4322ec

SHA256
f06729547467966639a0454c55149e4baece3e291462f4571bc7165bfe10b58d

SHA512
3952a7c2231e61758a61b11e92c6f4c55daffbb81ea0305984899154fca33b44a609a81b4747ab574ccbf627dbcd4460e8b0135c132445a59b989a6a0e566157

Download Submit
C:\Users\Admin\ynS4WJZ6.exe

Filesize
292KB

MD5
b336ee551b4c80dde9f97aec73ea26bd

SHA1
fb0be70476d28d89187b369bf73a98fb040d9c0b

SHA256
a381f7f881ff01be2dda54067ea7e182044f130b7a69c339968262ec90180649

SHA512
5348846868a3f257c692dda8dfd9b7ddb0a39053de8f2b521dce7964139dbd07f5a5108a2186c491a152d932da8355b98d39babeec712175d9caeb0633784a52

Download Submit
C:\Users\Admin\ynS4WJZ6.exe

Filesize
292KB

MD5
b336ee551b4c80dde9f97aec73ea26bd

SHA1
fb0be70476d28d89187b369bf73a98fb040d9c0b

SHA256
a381f7f881ff01be2dda54067ea7e182044f130b7a69c339968262ec90180649

SHA512
5348846868a3f257c692dda8dfd9b7ddb0a39053de8f2b521dce7964139dbd07f5a5108a2186c491a152d932da8355b98d39babeec712175d9caeb0633784a52

Download Submit
C:\Windows\system32\consrv.dll

Filesize
53KB

MD5
d1c9e07123216e8836e7988794cd3c75

SHA1
a1061c34544c9377449e186074404e0dd1009994

SHA256
334bd46d5f3ba098c11827982715c0ff98e2aa1c2361b9702b222949e7e5730c

SHA512
06014da3030fa66fbf64f9dd0c9c229390c93dedcb2c6f53aff810a7d0054c05c514804ea9dbae3d6ec1f13b45b4dd844a7e1ec1706e5a7ae16be8e8a760898b

Download Submit
\??\globalroot\systemroot\assembly\temp\@

Filesize
2KB

MD5
7c31504aab7c6079e0ce2f146ebd8dbb

SHA1
10543f07b43be7d230de2d46cde9a13918a72bd2

SHA256
74e67e1a7daa4e571728e6f7fee475c89ff9764b90ee8766be2889853a5b7ba3

SHA512
16e720cf9d78bed7f911c64ea91a7185c055cf2b8ed34b5b11e071482ac0969f46c9fd2c19c715538c223e65790400b45826495885bab5da3843edc7d4f1742b

Download Submit
\Users\Admin\2aid.exe

Filesize
72KB

MD5
bfd48191f79f45416e67efe6a8f25d5d

SHA1
ae31da442af2fe6ef7f960c3a50a3250baeafd8e

SHA256
8271c7ff81aeb4d60ddf9b7c6c5c7e9a391324b999184f79bac6fcd411f804f5

SHA512
2b2ff2c152e6ddf98d5e1043b456f080178a61413aa37a12166759a32a7b8ae98e8adcd90c76d4601c7da1334589fe93e4691e51f90dac70d74e954d06a246b8

Download Submit
\Users\Admin\2aid.exe

Filesize
72KB

MD5
bfd48191f79f45416e67efe6a8f25d5d

SHA1
ae31da442af2fe6ef7f960c3a50a3250baeafd8e

SHA256
8271c7ff81aeb4d60ddf9b7c6c5c7e9a391324b999184f79bac6fcd411f804f5

SHA512
2b2ff2c152e6ddf98d5e1043b456f080178a61413aa37a12166759a32a7b8ae98e8adcd90c76d4601c7da1334589fe93e4691e51f90dac70d74e954d06a246b8

Download Submit
\Users\Admin\3aid.exe

Filesize
208KB

MD5
914c8e336d83ca18bde8ec3d6dd5d852

SHA1
85fd8a4c0114a421d05ca78be872def090b217b8

SHA256
0061ffc16cd3615e7d30f22a69d65642cb13f55a357da9f379ebe904168bbe5e

SHA512
578e6b94bf576359daf96cc097c5798c9a1b8f3a47ba3f4f0707503ce32f78fafb6f0540a95f2ba311223e14be8f192468a4f3c644fe9cff9198e8ead92c0673

Download Submit
\Users\Admin\3aid.exe

Filesize
208KB

MD5
914c8e336d83ca18bde8ec3d6dd5d852

SHA1
85fd8a4c0114a421d05ca78be872def090b217b8

SHA256
0061ffc16cd3615e7d30f22a69d65642cb13f55a357da9f379ebe904168bbe5e

SHA512
578e6b94bf576359daf96cc097c5798c9a1b8f3a47ba3f4f0707503ce32f78fafb6f0540a95f2ba311223e14be8f192468a4f3c644fe9cff9198e8ead92c0673

Download Submit
\Users\Admin\4aid.exe

Filesize
44KB

MD5
27ddac23e41b3aba1371229bc3114ebe

SHA1
70e7b60767a38a27d22b03415006c5a265fe5e93

SHA256
afa5e7176ef811c85155cb18eed520d12c1bedc2c3e3e1775a197c8a687e3614

SHA512
e18dc372eff827a6590c3ff9a83d428ce2fef6682b9a0ddf667489f5d148472b6f9f6239c4df68eae43c377a4c1f633c45221902044288cdbfdf20708cdd1ebd

Download Submit
\Users\Admin\4aid.exe

Filesize
44KB

MD5
27ddac23e41b3aba1371229bc3114ebe

SHA1
70e7b60767a38a27d22b03415006c5a265fe5e93

SHA256
afa5e7176ef811c85155cb18eed520d12c1bedc2c3e3e1775a197c8a687e3614

SHA512
e18dc372eff827a6590c3ff9a83d428ce2fef6682b9a0ddf667489f5d148472b6f9f6239c4df68eae43c377a4c1f633c45221902044288cdbfdf20708cdd1ebd

Download Submit
\Users\Admin\raeava.exe

Filesize
292KB

MD5
2ae52a2d50b90ba6e7c29e074b012108

SHA1
82ada90a1b80516f5f45e704a2ea47671c4322ec

SHA256
f06729547467966639a0454c55149e4baece3e291462f4571bc7165bfe10b58d

SHA512
3952a7c2231e61758a61b11e92c6f4c55daffbb81ea0305984899154fca33b44a609a81b4747ab574ccbf627dbcd4460e8b0135c132445a59b989a6a0e566157

Download Submit
\Users\Admin\raeava.exe

Filesize
292KB

MD5
2ae52a2d50b90ba6e7c29e074b012108

SHA1
82ada90a1b80516f5f45e704a2ea47671c4322ec

SHA256
f06729547467966639a0454c55149e4baece3e291462f4571bc7165bfe10b58d

SHA512
3952a7c2231e61758a61b11e92c6f4c55daffbb81ea0305984899154fca33b44a609a81b4747ab574ccbf627dbcd4460e8b0135c132445a59b989a6a0e566157

Download Submit
\Users\Admin\ynS4WJZ6.exe

Filesize
292KB

MD5
b336ee551b4c80dde9f97aec73ea26bd

SHA1
fb0be70476d28d89187b369bf73a98fb040d9c0b

SHA256
a381f7f881ff01be2dda54067ea7e182044f130b7a69c339968262ec90180649

SHA512
5348846868a3f257c692dda8dfd9b7ddb0a39053de8f2b521dce7964139dbd07f5a5108a2186c491a152d932da8355b98d39babeec712175d9caeb0633784a52

Download Submit
\Users\Admin\ynS4WJZ6.exe

Filesize
292KB

MD5
b336ee551b4c80dde9f97aec73ea26bd

SHA1
fb0be70476d28d89187b369bf73a98fb040d9c0b

SHA256
a381f7f881ff01be2dda54067ea7e182044f130b7a69c339968262ec90180649

SHA512
5348846868a3f257c692dda8dfd9b7ddb0a39053de8f2b521dce7964139dbd07f5a5108a2186c491a152d932da8355b98d39babeec712175d9caeb0633784a52

Download Submit
\Windows\System32\consrv.dll

Filesize
53KB

MD5
d1c9e07123216e8836e7988794cd3c75

SHA1
a1061c34544c9377449e186074404e0dd1009994

SHA256
334bd46d5f3ba098c11827982715c0ff98e2aa1c2361b9702b222949e7e5730c

SHA512
06014da3030fa66fbf64f9dd0c9c229390c93dedcb2c6f53aff810a7d0054c05c514804ea9dbae3d6ec1f13b45b4dd844a7e1ec1706e5a7ae16be8e8a760898b

Download Submit
memory/336-115-0x0000000001F90000-0x0000000001FA2000-memory.dmp

Filesize
72KB

Download
memory/868-125-0x0000000000480000-0x000000000048B000-memory.dmp

Filesize
44KB

Download
memory/868-136-0x0000000000490000-0x000000000049B000-memory.dmp

Filesize
44KB

Download
memory/868-133-0x0000000000480000-0x000000000048B000-memory.dmp

Filesize
44KB

Download
memory/868-138-0x0000000000490000-0x000000000049B000-memory.dmp

Filesize
44KB

Download
memory/868-129-0x0000000000480000-0x000000000048B000-memory.dmp

Filesize
44KB

Download
memory/868-135-0x0000000000470000-0x0000000000478000-memory.dmp

Filesize
32KB

Download
memory/868-137-0x0000000000470000-0x0000000000478000-memory.dmp

Filesize
32KB

Download
memory/1392-107-0x0000000002200000-0x0000000002206000-memory.dmp

Filesize
24KB

Download
memory/1392-103-0x0000000002200000-0x0000000002206000-memory.dmp

Filesize
24KB

Download
memory/1392-99-0x0000000002200000-0x0000000002206000-memory.dmp

Filesize
24KB

Download
memory/1612-91-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/1612-93-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/1612-83-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/1612-82-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/1612-85-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/1612-86-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/1612-90-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/1652-98-0x0000000030670000-0x00000000306A4000-memory.dmp

Filesize
208KB

Download
memory/1652-114-0x0000000030670000-0x00000000306A4000-memory.dmp

Filesize
208KB

Download
memory/1652-108-0x0000000000220000-0x000000000024B000-memory.dmp

Filesize
172KB

Download
memory/1652-109-0x0000000030670000-0x00000000306A4000-memory.dmp

Filesize
208KB

Download
memory/1900-56-0x0000000075A81000-0x0000000075A83000-memory.dmp

Filesize
8KB

Download