Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
21-09-2022 10:46
General
-
Target
太太希Jw的 rA.exe
-
Size
499KB
-
MD5
73aac8ac5dc4ded42398f9fe2a191c19
-
SHA1
4f3ed7fa592f4ae4c4462928543dcbd4997f2549
-
SHA256
6672b26a03db7ec5d61e90ce7827c422cb6a8a942cc1c77f92f97e263a35d8e5
-
SHA512
cc5459746e50fe49d87f5facbb7ee79c1554697e54df2a615ace177ef0f439d134f188e19f51a1f866486237d3a79fa381d362b7da942dc74e00f675bc3cb58d
-
SSDEEP
12288:0osBGYb7Hku+M1e02kE15gLXOCYeHcUiK9DRB1R5//+P25wENJYWfaBFyutY4ld2:cBGO7HkwGkE15AXOCYeHcU7
Score
10/10
Malware Config
Extracted
Family
formbook
Campaign
v4qp
Decoy
je1XQKU1LfJPVLk=
nvf41a7FsTLs6uB/g+CR
U7mryF6DctZn6GEjr9Bm4g==
1SONGrPdh7wGEOXp3g==
2xX859r7qOFq7GYkr9Bm4g==
IYtzVUx0Oo0HmZawLQAARDvBf4dL
NH3iuBPNSzZTvpw/4KaG
rDehfiqIPbdMBS8G1g==
xhb2uJ0eBwo7k3djqxh60xoNt4VoeQ==
AFtKux3JgPGRkx3xUsciR6piSg==
m+3VoJadWcBvOAPpzKUNPoAxyplS
1DWKULdka3mxIKhEqGxQr7gxyplS
DGlFGBqWi5CtrCX9alyTuPzq
muvVM4slyTfxORwAZisVksCM78aSEVo=
D3biNgUbyg9E5pl+
/+1QLPssvl/Xxg==
I4lzTjaAcc1iBS8G1g==
wSwc4MmbShojhlZCrniTuPzq
jN5YO6ZXSfJPVLk=
4TUS4+ANuqHCRTM9sniTuPzq
Extracted
Family
xloader
Version
2.9
Campaign
v4qp
Decoy
je1XQKU1LfJPVLk=
nvf41a7FsTLs6uB/g+CR
U7mryF6DctZn6GEjr9Bm4g==
1SONGrPdh7wGEOXp3g==
2xX859r7qOFq7GYkr9Bm4g==
IYtzVUx0Oo0HmZawLQAARDvBf4dL
NH3iuBPNSzZTvpw/4KaG
rDehfiqIPbdMBS8G1g==
xhb2uJ0eBwo7k3djqxh60xoNt4VoeQ==
AFtKux3JgPGRkx3xUsciR6piSg==
m+3VoJadWcBvOAPpzKUNPoAxyplS
1DWKULdka3mxIKhEqGxQr7gxyplS
DGlFGBqWi5CtrCX9alyTuPzq
muvVM4slyTfxORwAZisVksCM78aSEVo=
D3biNgUbyg9E5pl+
/+1QLPssvl/Xxg==
I4lzTjaAcc1iBS8G1g==
wSwc4MmbShojhlZCrniTuPzq
jN5YO6ZXSfJPVLk=
4TUS4+ANuqHCRTM9sniTuPzq
Signatures
-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Xloader payload 4 IoCs
-
Checks computer location settings 2 TTPs 54 IoCs
Looks up country code configured in the registry, likely geofence.
-
Suspicious use of SetThreadContext 56 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious behavior: MapViewOfSection 5 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"2⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"{path}"3⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"3⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"{path}"4⤵
-
C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"{path}"4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"4⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"{path}"5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"5⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"{path}"6⤵
-
C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"{path}"6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"6⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"{path}"7⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"7⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"{path}"8⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"8⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"{path}"9⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"9⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"{path}"10⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"10⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"{path}"11⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"11⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"{path}"12⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"12⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"{path}"13⤵
-
C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"{path}"13⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"13⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"{path}"14⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"14⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"{path}"15⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"15⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"{path}"16⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"16⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"{path}"17⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"17⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"{path}"18⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"18⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"{path}"19⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"19⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"{path}"20⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"20⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"{path}"21⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"21⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"{path}"22⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"22⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"{path}"23⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"23⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"{path}"24⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"24⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"{path}"25⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"25⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"{path}"26⤵
-
C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"{path}"26⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"26⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"{path}"27⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"27⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"{path}"28⤵
-
C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"{path}"28⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"28⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"{path}"29⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"29⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"{path}"30⤵
-
C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"{path}"30⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"30⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"{path}"31⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"31⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"{path}"32⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"32⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"{path}"33⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"33⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"{path}"34⤵
-
C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"34⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"{path}"35⤵
-
C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"35⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"{path}"36⤵
-
C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"36⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"{path}"37⤵
-
C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"37⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"{path}"38⤵
-
C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"38⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"{path}"39⤵
-
C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"39⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"{path}"40⤵
-
C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"40⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"{path}"41⤵
-
C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"41⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"{path}"42⤵
-
C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"42⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"{path}"43⤵
-
C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"43⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"{path}"44⤵
-
C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"{path}"44⤵
-
C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"44⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"{path}"45⤵
-
C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"45⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"{path}"46⤵
-
C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"46⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"{path}"47⤵
-
C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"47⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"{path}"48⤵
-
C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"48⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"{path}"49⤵
-
C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"{path}"49⤵
-
C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"{path}"49⤵
-
C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"{path}"49⤵
-
C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"49⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"{path}"50⤵
-
C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"50⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"{path}"51⤵
-
C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"51⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"{path}"52⤵
-
C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"52⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"{path}"53⤵
-
C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"53⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"{path}"54⤵
-
C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"54⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"{path}"55⤵
-
C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"55⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"{path}"56⤵
-
C:\Windows\SysWOW64\control.exe"C:\Windows\SysWOW64\control.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\太太希Jw的 rA.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\太太希Jw的 rA.exe.logFilesize
224B
MD59c4b66f77f12558c48b620ddfb44029d
SHA1446651db643b943ec37b9b3599655e211a4bc73e
SHA25642f723d18283fda6a0904046cc29ee8d10e562d20c7615259a46ae9c0e4c9708
SHA512983aed0ec15a79b716ac6dc080146e4ed098c117c31167053fb5971649dc621d1db5292fdd76f3010f094b75d57ea0bdb35bc829c6ba37e4d276b266361dee8e
-
memory/116-143-0x0000000000000000-mapping.dmp
-
memory/228-231-0x0000000000000000-mapping.dmp
-
memory/228-238-0x0000000074AA0000-0x0000000075051000-memory.dmpFilesize
5.7MB
-
memory/228-235-0x0000000074AA0000-0x0000000075051000-memory.dmpFilesize
5.7MB
-
memory/716-305-0x0000000000000000-mapping.dmp
-
memory/776-298-0x0000000000000000-mapping.dmp
-
memory/840-236-0x0000000001040000-0x000000000138A000-memory.dmpFilesize
3.3MB
-
memory/840-233-0x0000000000000000-mapping.dmp
-
memory/860-216-0x0000000000000000-mapping.dmp
-
memory/860-218-0x00000000010B0000-0x00000000013FA000-memory.dmpFilesize
3.3MB
-
memory/864-307-0x0000000000000000-mapping.dmp
-
memory/960-201-0x0000000074AA0000-0x0000000075051000-memory.dmpFilesize
5.7MB
-
memory/960-198-0x0000000074AA0000-0x0000000075051000-memory.dmpFilesize
5.7MB
-
memory/960-194-0x0000000000000000-mapping.dmp
-
memory/1092-193-0x00000000017E0000-0x0000000001B2A000-memory.dmpFilesize
3.3MB
-
memory/1092-191-0x0000000000000000-mapping.dmp
-
memory/1140-157-0x0000000074AA0000-0x0000000075051000-memory.dmpFilesize
5.7MB
-
memory/1140-251-0x0000000000000000-mapping.dmp
-
memory/1140-152-0x0000000000000000-mapping.dmp
-
memory/1140-254-0x0000000001960000-0x0000000001CAA000-memory.dmpFilesize
3.3MB
-
memory/1140-162-0x0000000074AA0000-0x0000000075051000-memory.dmpFilesize
5.7MB
-
memory/1176-155-0x0000000000000000-mapping.dmp
-
memory/1176-158-0x0000000001680000-0x00000000019CA000-memory.dmpFilesize
3.3MB
-
memory/1180-226-0x0000000074AA0000-0x0000000075051000-memory.dmpFilesize
5.7MB
-
memory/1180-219-0x0000000000000000-mapping.dmp
-
memory/1180-223-0x0000000074AA0000-0x0000000075051000-memory.dmpFilesize
5.7MB
-
memory/1212-315-0x0000000000000000-mapping.dmp
-
memory/1224-209-0x0000000000000000-mapping.dmp
-
memory/1340-261-0x0000000000000000-mapping.dmp
-
memory/1384-183-0x0000000000000000-mapping.dmp
-
memory/1384-186-0x0000000000F30000-0x000000000127A000-memory.dmpFilesize
3.3MB
-
memory/1396-147-0x0000000000000000-mapping.dmp
-
memory/1480-213-0x0000000000000000-mapping.dmp
-
memory/1480-220-0x0000000074AA0000-0x0000000075051000-memory.dmpFilesize
5.7MB
-
memory/1480-215-0x0000000074AA0000-0x0000000075051000-memory.dmpFilesize
5.7MB
-
memory/1492-229-0x00000000010A0000-0x00000000013EA000-memory.dmpFilesize
3.3MB
-
memory/1492-227-0x0000000000000000-mapping.dmp
-
memory/1512-285-0x0000000000000000-mapping.dmp
-
memory/1624-288-0x0000000000000000-mapping.dmp
-
memory/1628-249-0x0000000000000000-mapping.dmp
-
memory/1628-256-0x0000000074AA0000-0x0000000075051000-memory.dmpFilesize
5.7MB
-
memory/1628-253-0x0000000074AA0000-0x0000000075051000-memory.dmpFilesize
5.7MB
-
memory/1744-164-0x0000000000000000-mapping.dmp
-
memory/1744-167-0x0000000001900000-0x0000000001C4A000-memory.dmpFilesize
3.3MB
-
memory/1820-199-0x0000000000E90000-0x00000000011DA000-memory.dmpFilesize
3.3MB
-
memory/1820-196-0x0000000000000000-mapping.dmp
-
memory/1824-267-0x0000000000000000-mapping.dmp
-
memory/2252-245-0x0000000074AA0000-0x0000000075051000-memory.dmpFilesize
5.7MB
-
memory/2252-250-0x0000000074AA0000-0x0000000075051000-memory.dmpFilesize
5.7MB
-
memory/2252-243-0x0000000000000000-mapping.dmp
-
memory/2444-273-0x0000000000000000-mapping.dmp
-
memory/2692-232-0x0000000074AA0000-0x0000000075051000-memory.dmpFilesize
5.7MB
-
memory/2692-225-0x0000000000000000-mapping.dmp
-
memory/2692-230-0x0000000074AA0000-0x0000000075051000-memory.dmpFilesize
5.7MB
-
memory/2704-161-0x0000000007990000-0x0000000007B05000-memory.dmpFilesize
1.5MB
-
memory/2704-139-0x0000000002950000-0x0000000002A37000-memory.dmpFilesize
924KB
-
memory/2704-187-0x0000000007990000-0x0000000007B05000-memory.dmpFilesize
1.5MB
-
memory/2880-214-0x0000000074AA0000-0x0000000075051000-memory.dmpFilesize
5.7MB
-
memory/2880-206-0x0000000000000000-mapping.dmp
-
memory/2880-208-0x0000000074AA0000-0x0000000075051000-memory.dmpFilesize
5.7MB
-
memory/2888-282-0x0000000000000000-mapping.dmp
-
memory/2984-175-0x0000000000000000-mapping.dmp
-
memory/2984-182-0x0000000074AA0000-0x0000000075051000-memory.dmpFilesize
5.7MB
-
memory/2984-179-0x0000000074AA0000-0x0000000075051000-memory.dmpFilesize
5.7MB
-
memory/3004-301-0x0000000000000000-mapping.dmp
-
memory/3012-300-0x0000000000000000-mapping.dmp
-
memory/3056-210-0x0000000000000000-mapping.dmp
-
memory/3056-212-0x0000000001830000-0x0000000001B7A000-memory.dmpFilesize
3.3MB
-
memory/3116-146-0x0000000074AA0000-0x0000000075051000-memory.dmpFilesize
5.7MB
-
memory/3116-132-0x0000000074AA0000-0x0000000075051000-memory.dmpFilesize
5.7MB
-
memory/3164-311-0x0000000000000000-mapping.dmp
-
memory/3256-170-0x0000000074AA0000-0x0000000075051000-memory.dmpFilesize
5.7MB
-
memory/3256-159-0x0000000000000000-mapping.dmp
-
memory/3256-166-0x0000000074AA0000-0x0000000075051000-memory.dmpFilesize
5.7MB
-
memory/3280-246-0x0000000000000000-mapping.dmp
-
memory/3280-248-0x00000000017D0000-0x0000000001B1A000-memory.dmpFilesize
3.3MB
-
memory/3336-292-0x0000000000000000-mapping.dmp
-
memory/3388-275-0x0000000000000000-mapping.dmp
-
memory/3464-279-0x0000000000000000-mapping.dmp
-
memory/3476-255-0x0000000000000000-mapping.dmp
-
memory/3560-269-0x0000000000000000-mapping.dmp
-
memory/3640-174-0x0000000001310000-0x000000000165A000-memory.dmpFilesize
3.3MB
-
memory/3640-171-0x0000000000000000-mapping.dmp
-
memory/3712-168-0x0000000000000000-mapping.dmp
-
memory/3712-173-0x0000000074AA0000-0x0000000075051000-memory.dmpFilesize
5.7MB
-
memory/3712-176-0x0000000074AA0000-0x0000000075051000-memory.dmpFilesize
5.7MB
-
memory/3748-205-0x00000000015D0000-0x000000000191A000-memory.dmpFilesize
3.3MB
-
memory/3748-203-0x0000000000000000-mapping.dmp
-
memory/3780-181-0x0000000000000000-mapping.dmp
-
memory/3780-185-0x0000000074AA0000-0x0000000075051000-memory.dmpFilesize
5.7MB
-
memory/3780-189-0x0000000074AA0000-0x0000000075051000-memory.dmpFilesize
5.7MB
-
memory/3840-195-0x0000000074AA0000-0x0000000075051000-memory.dmpFilesize
5.7MB
-
memory/3840-188-0x0000000000000000-mapping.dmp
-
memory/3840-190-0x0000000074AA0000-0x0000000075051000-memory.dmpFilesize
5.7MB
-
memory/3872-239-0x0000000000000000-mapping.dmp
-
memory/3872-242-0x00000000012E0000-0x000000000162A000-memory.dmpFilesize
3.3MB
-
memory/3932-140-0x0000000000000000-mapping.dmp
-
memory/3932-142-0x0000000000A70000-0x0000000000A9C000-memory.dmpFilesize
176KB
-
memory/3932-169-0x0000000000A70000-0x0000000000A9C000-memory.dmpFilesize
176KB
-
memory/3932-141-0x0000000000A30000-0x0000000000A57000-memory.dmpFilesize
156KB
-
memory/3932-144-0x0000000002BD0000-0x0000000002F1A000-memory.dmpFilesize
3.3MB
-
memory/3932-160-0x0000000002970000-0x0000000002A00000-memory.dmpFilesize
576KB
-
memory/3964-200-0x0000000000000000-mapping.dmp
-
memory/3964-202-0x0000000074AA0000-0x0000000075051000-memory.dmpFilesize
5.7MB
-
memory/3964-207-0x0000000074AA0000-0x0000000075051000-memory.dmpFilesize
5.7MB
-
memory/4084-224-0x0000000001280000-0x00000000015CA000-memory.dmpFilesize
3.3MB
-
memory/4084-221-0x0000000000000000-mapping.dmp
-
memory/4256-180-0x0000000001270000-0x00000000015BA000-memory.dmpFilesize
3.3MB
-
memory/4256-177-0x0000000000000000-mapping.dmp
-
memory/4300-136-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/4300-134-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/4300-137-0x0000000001170000-0x00000000014BA000-memory.dmpFilesize
3.3MB
-
memory/4300-138-0x0000000001010000-0x0000000001021000-memory.dmpFilesize
68KB
-
memory/4300-133-0x0000000000000000-mapping.dmp
-
memory/4472-154-0x0000000074AA0000-0x0000000075051000-memory.dmpFilesize
5.7MB
-
memory/4472-149-0x0000000074AA0000-0x0000000075051000-memory.dmpFilesize
5.7MB
-
memory/4472-145-0x0000000000000000-mapping.dmp
-
memory/4480-318-0x0000000000000000-mapping.dmp
-
memory/4572-263-0x0000000000000000-mapping.dmp
-
memory/4712-287-0x0000000000000000-mapping.dmp
-
memory/4752-244-0x0000000074AA0000-0x0000000075051000-memory.dmpFilesize
5.7MB
-
memory/4752-241-0x0000000074AA0000-0x0000000075051000-memory.dmpFilesize
5.7MB
-
memory/4752-237-0x0000000000000000-mapping.dmp
-
memory/4848-294-0x0000000000000000-mapping.dmp
-
memory/4952-148-0x0000000000000000-mapping.dmp
-
memory/4952-151-0x00000000010B0000-0x00000000013FA000-memory.dmpFilesize
3.3MB
-
memory/4956-258-0x0000000000000000-mapping.dmp
-
memory/5036-163-0x0000000000000000-mapping.dmp
-
memory/5052-314-0x0000000000000000-mapping.dmp