70cce7995dad0582f82b67909c816df90b8d757e58d4f078b7690c7049971b3d

Analysis

max time kernel
151s
max time network
157s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/10/2022, 02:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

70cce7995dad0582f82b67909c816df90b8d757e58d4f078b7690c7049971b3d.exe
Size

412KB
MD5

29b91a8c1b5f6ee2ee190040f9c16977
SHA1

9c74f2f45743e81ffb9d621e801cde2ec9ebb495
SHA256

70cce7995dad0582f82b67909c816df90b8d757e58d4f078b7690c7049971b3d
SHA512

cd9c0c013339cd1098bc16f65c52a5c12652caaf2b31c9f989cc15c28c3461f8d434930d1e24044fffbe1c14637004317329d1dc1e1cfb0ee3a3de3bbbb6cc08
SSDEEP

12288:6Ev1PnyMvotKR3yDoPMVGHTsqItqaXljnnIbnI6stkArNEXS2cNgbusSMU:6EhI62NWXncNgbusSMU

Score

10^/10

evasion persistence upx

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	HQqGkIT8.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	baimaus.exe

Executes dropped EXE 7 IoCs

pid	Process
696	HQqGkIT8.exe
1716	baimaus.exe
1108	2tej.exe
1912	2tej.exe
1724	3tej.exe
336	csrss.exe
1700	4tej.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1912-83-0x0000000000400000-0x000000000040E000-memory.dmp	upx
behavioral1/memory/1912-85-0x0000000000400000-0x000000000040E000-memory.dmp	upx
behavioral1/memory/1912-86-0x0000000000400000-0x000000000040E000-memory.dmp	upx
behavioral1/memory/1912-90-0x0000000000400000-0x000000000040E000-memory.dmp	upx
behavioral1/memory/1912-91-0x0000000000400000-0x000000000040E000-memory.dmp	upx
behavioral1/memory/1912-93-0x0000000000400000-0x000000000040E000-memory.dmp	upx

Deletes itself 1 IoCs

pid	Process
1460	cmd.exe

Loads dropped DLL 10 IoCs

pid	Process
1672	70cce7995dad0582f82b67909c816df90b8d757e58d4f078b7690c7049971b3d.exe
1672	70cce7995dad0582f82b67909c816df90b8d757e58d4f078b7690c7049971b3d.exe
696	HQqGkIT8.exe
696	HQqGkIT8.exe
1672	70cce7995dad0582f82b67909c816df90b8d757e58d4f078b7690c7049971b3d.exe
1672	70cce7995dad0582f82b67909c816df90b8d757e58d4f078b7690c7049971b3d.exe
1672	70cce7995dad0582f82b67909c816df90b8d757e58d4f078b7690c7049971b3d.exe
1672	70cce7995dad0582f82b67909c816df90b8d757e58d4f078b7690c7049971b3d.exe
1672	70cce7995dad0582f82b67909c816df90b8d757e58d4f078b7690c7049971b3d.exe
1672	70cce7995dad0582f82b67909c816df90b8d757e58d4f078b7690c7049971b3d.exe

Adds Run key to start application 2 TTPs 52 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\baimaus = "C:\\Users\\Admin\\baimaus.exe /h"	baimaus.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\baimaus = "C:\\Users\\Admin\\baimaus.exe /H"	baimaus.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\baimaus = "C:\\Users\\Admin\\baimaus.exe /b"	baimaus.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\baimaus = "C:\\Users\\Admin\\baimaus.exe /W"	baimaus.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\baimaus = "C:\\Users\\Admin\\baimaus.exe /R"	baimaus.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\baimaus = "C:\\Users\\Admin\\baimaus.exe /a"	baimaus.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\baimaus = "C:\\Users\\Admin\\baimaus.exe /c"	baimaus.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\baimaus = "C:\\Users\\Admin\\baimaus.exe /U"	baimaus.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\baimaus = "C:\\Users\\Admin\\baimaus.exe /O"	baimaus.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\baimaus = "C:\\Users\\Admin\\baimaus.exe /q"	baimaus.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\baimaus = "C:\\Users\\Admin\\baimaus.exe /o"	baimaus.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\baimaus = "C:\\Users\\Admin\\baimaus.exe /E"	baimaus.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\baimaus = "C:\\Users\\Admin\\baimaus.exe /d"	baimaus.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\baimaus = "C:\\Users\\Admin\\baimaus.exe /B"	baimaus.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\baimaus = "C:\\Users\\Admin\\baimaus.exe /r"	baimaus.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\baimaus = "C:\\Users\\Admin\\baimaus.exe /Y"	baimaus.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\baimaus = "C:\\Users\\Admin\\baimaus.exe /m"	HQqGkIT8.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\baimaus = "C:\\Users\\Admin\\baimaus.exe /j"	baimaus.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\baimaus = "C:\\Users\\Admin\\baimaus.exe /P"	baimaus.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\baimaus = "C:\\Users\\Admin\\baimaus.exe /A"	baimaus.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\baimaus = "C:\\Users\\Admin\\baimaus.exe /G"	baimaus.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\baimaus = "C:\\Users\\Admin\\baimaus.exe /V"	baimaus.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\baimaus = "C:\\Users\\Admin\\baimaus.exe /v"	baimaus.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\baimaus = "C:\\Users\\Admin\\baimaus.exe /X"	baimaus.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\baimaus = "C:\\Users\\Admin\\baimaus.exe /L"	baimaus.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\baimaus = "C:\\Users\\Admin\\baimaus.exe /u"	baimaus.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\baimaus = "C:\\Users\\Admin\\baimaus.exe /Z"	baimaus.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\baimaus = "C:\\Users\\Admin\\baimaus.exe /F"	baimaus.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\baimaus = "C:\\Users\\Admin\\baimaus.exe /k"	baimaus.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\baimaus = "C:\\Users\\Admin\\baimaus.exe /z"	baimaus.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\baimaus = "C:\\Users\\Admin\\baimaus.exe /M"	baimaus.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\baimaus = "C:\\Users\\Admin\\baimaus.exe /T"	baimaus.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\baimaus = "C:\\Users\\Admin\\baimaus.exe /K"	baimaus.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\baimaus = "C:\\Users\\Admin\\baimaus.exe /g"	baimaus.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\baimaus = "C:\\Users\\Admin\\baimaus.exe /y"	baimaus.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\baimaus = "C:\\Users\\Admin\\baimaus.exe /s"	baimaus.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\baimaus = "C:\\Users\\Admin\\baimaus.exe /m"	baimaus.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\baimaus = "C:\\Users\\Admin\\baimaus.exe /C"	baimaus.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\baimaus = "C:\\Users\\Admin\\baimaus.exe /f"	baimaus.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\baimaus = "C:\\Users\\Admin\\baimaus.exe /x"	baimaus.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\	HQqGkIT8.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\baimaus = "C:\\Users\\Admin\\baimaus.exe /w"	baimaus.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\baimaus = "C:\\Users\\Admin\\baimaus.exe /i"	baimaus.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\	baimaus.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\baimaus = "C:\\Users\\Admin\\baimaus.exe /n"	baimaus.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\baimaus = "C:\\Users\\Admin\\baimaus.exe /D"	baimaus.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\baimaus = "C:\\Users\\Admin\\baimaus.exe /p"	baimaus.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\baimaus = "C:\\Users\\Admin\\baimaus.exe /e"	baimaus.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\baimaus = "C:\\Users\\Admin\\baimaus.exe /t"	baimaus.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\baimaus = "C:\\Users\\Admin\\baimaus.exe /S"	baimaus.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\baimaus = "C:\\Users\\Admin\\baimaus.exe /Q"	baimaus.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\baimaus = "C:\\Users\\Admin\\baimaus.exe /l"	baimaus.exe

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File created	\systemroot\assembly\GAC_64\Desktop.ini	csrss.exe
File created	\systemroot\assembly\GAC_32\Desktop.ini	csrss.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1108 set thread context of 1912	1108	2tej.exe	33
PID 1724 set thread context of 1036	1724	3tej.exe	36

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Enumerates processes with tasklist 1 TTPs 2 IoCs

Process Discovery

T1057

pid	Process
1592	tasklist.exe
1808	tasklist.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
696	HQqGkIT8.exe
696	HQqGkIT8.exe
1912	2tej.exe
1716	baimaus.exe
1724	3tej.exe
1724	3tej.exe
1724	3tej.exe
1716	baimaus.exe
1724	3tej.exe
1912	2tej.exe
1716	baimaus.exe
1716	baimaus.exe
1716	baimaus.exe
1912	2tej.exe
1912	2tej.exe
1716	baimaus.exe
1912	2tej.exe
1716	baimaus.exe
1716	baimaus.exe
1716	baimaus.exe
1912	2tej.exe
1716	baimaus.exe
1912	2tej.exe
1912	2tej.exe
1716	baimaus.exe
1716	baimaus.exe
1716	baimaus.exe
1912	2tej.exe
1912	2tej.exe
1912	2tej.exe
1716	baimaus.exe
1912	2tej.exe
1716	baimaus.exe
1912	2tej.exe
1716	baimaus.exe
1716	baimaus.exe
1912	2tej.exe
1912	2tej.exe
1716	baimaus.exe
1912	2tej.exe
1716	baimaus.exe
1912	2tej.exe
1912	2tej.exe
1716	baimaus.exe
1716	baimaus.exe
1912	2tej.exe
1912	2tej.exe
1912	2tej.exe
1716	baimaus.exe
1912	2tej.exe
1716	baimaus.exe
1716	baimaus.exe
1912	2tej.exe
1912	2tej.exe
1716	baimaus.exe
1912	2tej.exe
1912	2tej.exe
1716	baimaus.exe
1912	2tej.exe
1716	baimaus.exe
1716	baimaus.exe
1912	2tej.exe
1716	baimaus.exe
1912	2tej.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1808	tasklist.exe
Token: SeDebugPrivilege	1724	3tej.exe
Token: SeDebugPrivilege	1724	3tej.exe
Token: SeDebugPrivilege	1592	tasklist.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1260	Explorer.EXE
1260	Explorer.EXE

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
1260	Explorer.EXE
1260	Explorer.EXE

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
1672	70cce7995dad0582f82b67909c816df90b8d757e58d4f078b7690c7049971b3d.exe
696	HQqGkIT8.exe
1716	baimaus.exe
1108	2tej.exe
1700	4tej.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
336	csrss.exe

Suspicious use of WriteProcessMemory 52 IoCs

description	pid	Process	procid_target
PID 1672 wrote to memory of 696	1672	70cce7995dad0582f82b67909c816df90b8d757e58d4f078b7690c7049971b3d.exe	27
PID 1672 wrote to memory of 696	1672	70cce7995dad0582f82b67909c816df90b8d757e58d4f078b7690c7049971b3d.exe	27
PID 1672 wrote to memory of 696	1672	70cce7995dad0582f82b67909c816df90b8d757e58d4f078b7690c7049971b3d.exe	27
PID 1672 wrote to memory of 696	1672	70cce7995dad0582f82b67909c816df90b8d757e58d4f078b7690c7049971b3d.exe	27
PID 696 wrote to memory of 1716	696	HQqGkIT8.exe	28
PID 696 wrote to memory of 1716	696	HQqGkIT8.exe	28
PID 696 wrote to memory of 1716	696	HQqGkIT8.exe	28
PID 696 wrote to memory of 1716	696	HQqGkIT8.exe	28
PID 696 wrote to memory of 1096	696	HQqGkIT8.exe	29
PID 696 wrote to memory of 1096	696	HQqGkIT8.exe	29
PID 696 wrote to memory of 1096	696	HQqGkIT8.exe	29
PID 696 wrote to memory of 1096	696	HQqGkIT8.exe	29
PID 1672 wrote to memory of 1108	1672	70cce7995dad0582f82b67909c816df90b8d757e58d4f078b7690c7049971b3d.exe	31
PID 1672 wrote to memory of 1108	1672	70cce7995dad0582f82b67909c816df90b8d757e58d4f078b7690c7049971b3d.exe	31
PID 1672 wrote to memory of 1108	1672	70cce7995dad0582f82b67909c816df90b8d757e58d4f078b7690c7049971b3d.exe	31
PID 1672 wrote to memory of 1108	1672	70cce7995dad0582f82b67909c816df90b8d757e58d4f078b7690c7049971b3d.exe	31
PID 1096 wrote to memory of 1808	1096	cmd.exe	32
PID 1096 wrote to memory of 1808	1096	cmd.exe	32
PID 1096 wrote to memory of 1808	1096	cmd.exe	32
PID 1096 wrote to memory of 1808	1096	cmd.exe	32
PID 1108 wrote to memory of 1912	1108	2tej.exe	33
PID 1108 wrote to memory of 1912	1108	2tej.exe	33
PID 1108 wrote to memory of 1912	1108	2tej.exe	33
PID 1108 wrote to memory of 1912	1108	2tej.exe	33
PID 1108 wrote to memory of 1912	1108	2tej.exe	33
PID 1108 wrote to memory of 1912	1108	2tej.exe	33
PID 1108 wrote to memory of 1912	1108	2tej.exe	33
PID 1108 wrote to memory of 1912	1108	2tej.exe	33
PID 1672 wrote to memory of 1724	1672	70cce7995dad0582f82b67909c816df90b8d757e58d4f078b7690c7049971b3d.exe	35
PID 1672 wrote to memory of 1724	1672	70cce7995dad0582f82b67909c816df90b8d757e58d4f078b7690c7049971b3d.exe	35
PID 1672 wrote to memory of 1724	1672	70cce7995dad0582f82b67909c816df90b8d757e58d4f078b7690c7049971b3d.exe	35
PID 1672 wrote to memory of 1724	1672	70cce7995dad0582f82b67909c816df90b8d757e58d4f078b7690c7049971b3d.exe	35
PID 1724 wrote to memory of 1260	1724	3tej.exe	9
PID 1724 wrote to memory of 336	1724	3tej.exe	6
PID 1724 wrote to memory of 1036	1724	3tej.exe	36
PID 1724 wrote to memory of 1036	1724	3tej.exe	36
PID 1724 wrote to memory of 1036	1724	3tej.exe	36
PID 1724 wrote to memory of 1036	1724	3tej.exe	36
PID 1724 wrote to memory of 1036	1724	3tej.exe	36
PID 1672 wrote to memory of 1700	1672	70cce7995dad0582f82b67909c816df90b8d757e58d4f078b7690c7049971b3d.exe	38
PID 1672 wrote to memory of 1700	1672	70cce7995dad0582f82b67909c816df90b8d757e58d4f078b7690c7049971b3d.exe	38
PID 1672 wrote to memory of 1700	1672	70cce7995dad0582f82b67909c816df90b8d757e58d4f078b7690c7049971b3d.exe	38
PID 1672 wrote to memory of 1700	1672	70cce7995dad0582f82b67909c816df90b8d757e58d4f078b7690c7049971b3d.exe	38
PID 1672 wrote to memory of 1460	1672	70cce7995dad0582f82b67909c816df90b8d757e58d4f078b7690c7049971b3d.exe	39
PID 1672 wrote to memory of 1460	1672	70cce7995dad0582f82b67909c816df90b8d757e58d4f078b7690c7049971b3d.exe	39
PID 1672 wrote to memory of 1460	1672	70cce7995dad0582f82b67909c816df90b8d757e58d4f078b7690c7049971b3d.exe	39
PID 1672 wrote to memory of 1460	1672	70cce7995dad0582f82b67909c816df90b8d757e58d4f078b7690c7049971b3d.exe	39
PID 1460 wrote to memory of 1592	1460	cmd.exe	41
PID 1460 wrote to memory of 1592	1460	cmd.exe	41
PID 1460 wrote to memory of 1592	1460	cmd.exe	41
PID 1460 wrote to memory of 1592	1460	cmd.exe	41
PID 336 wrote to memory of 868	336	csrss.exe	20

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:336

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1260
- C:\Users\Admin\AppData\Local\Temp\70cce7995dad0582f82b67909c816df90b8d757e58d4f078b7690c7049971b3d.exe
  "C:\Users\Admin\AppData\Local\Temp\70cce7995dad0582f82b67909c816df90b8d757e58d4f078b7690c7049971b3d.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1672
- - C:\Users\Admin\HQqGkIT8.exe
    C:\Users\Admin\HQqGkIT8.exe
    3⤵
    - Modifies visiblity of hidden/system files in Explorer
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:696
  - - C:\Users\Admin\baimaus.exe
      "C:\Users\Admin\baimaus.exe"
      4⤵
      Modifies visiblity of hidden/system files in Explorer
      Executes dropped EXE
      Adds Run key to start application
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      PID:1716
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c tasklist&&del HQqGkIT8.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1096
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:1808
- - C:\Users\Admin\2tej.exe
    C:\Users\Admin\2tej.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1108
  - - C:\Users\Admin\2tej.exe
      "C:\Users\Admin\2tej.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:1912
- - C:\Users\Admin\3tej.exe
    C:\Users\Admin\3tej.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1724
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe"
      4⤵
      PID:1036
- - C:\Users\Admin\4tej.exe
    C:\Users\Admin\4tej.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1700
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c tasklist&&del 70cce7995dad0582f82b67909c816df90b8d757e58d4f078b7690c7049971b3d.exe
    3⤵
    - Deletes itself
    - Suspicious use of WriteProcessMemory
    PID:1460
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:1592

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs
1⤵
PID:868

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Discovery

Process Discovery

T1057

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\2tej.exe

Filesize
64KB

MD5
1b98630662dace204c7a75ac06ab322f

SHA1
f2ebc161d140ce66753f49bf505060216996cdd2

SHA256
88cec7cae39b32f0efa22677b747b6361d70ae8768553e57a8c6ae85b8965650

SHA512
430db374527ff2cc413fe1d2635aa0c1afe3aab3a7e8595988cc2a9816e9b0c1d7b5a9b863f77ed6ed27a718fd08bc6582a8a00b022de23209ce89a93aa524e0

Download Submit
C:\Users\Admin\2tej.exe

Filesize
64KB

MD5
1b98630662dace204c7a75ac06ab322f

SHA1
f2ebc161d140ce66753f49bf505060216996cdd2

SHA256
88cec7cae39b32f0efa22677b747b6361d70ae8768553e57a8c6ae85b8965650

SHA512
430db374527ff2cc413fe1d2635aa0c1afe3aab3a7e8595988cc2a9816e9b0c1d7b5a9b863f77ed6ed27a718fd08bc6582a8a00b022de23209ce89a93aa524e0

Download Submit
C:\Users\Admin\2tej.exe

Filesize
64KB

MD5
1b98630662dace204c7a75ac06ab322f

SHA1
f2ebc161d140ce66753f49bf505060216996cdd2

SHA256
88cec7cae39b32f0efa22677b747b6361d70ae8768553e57a8c6ae85b8965650

SHA512
430db374527ff2cc413fe1d2635aa0c1afe3aab3a7e8595988cc2a9816e9b0c1d7b5a9b863f77ed6ed27a718fd08bc6582a8a00b022de23209ce89a93aa524e0

Download Submit
C:\Users\Admin\3tej.exe

Filesize
204KB

MD5
666d8f00ccb49a2a23b174aa89c06ec2

SHA1
150f8e4aa5fbfb0df6f33a44885e46d43e789800

SHA256
c5d928569c84226a1737d057354a31e5019b464fb7093f1780e5116b486d5e5a

SHA512
0615f336b637db2041331660a98ebae4d36412c4bca64bb268f87cd20160ddf8a11eba097cd19333f1084bf81808b5e6647364cc88e87f85fa1848686881295f

Download Submit
C:\Users\Admin\3tej.exe

Filesize
204KB

MD5
666d8f00ccb49a2a23b174aa89c06ec2

SHA1
150f8e4aa5fbfb0df6f33a44885e46d43e789800

SHA256
c5d928569c84226a1737d057354a31e5019b464fb7093f1780e5116b486d5e5a

SHA512
0615f336b637db2041331660a98ebae4d36412c4bca64bb268f87cd20160ddf8a11eba097cd19333f1084bf81808b5e6647364cc88e87f85fa1848686881295f

Download Submit
C:\Users\Admin\4tej.exe

Filesize
44KB

MD5
a60c9c8d5563e0004be44141724b18c9

SHA1
b48757d94346720a169e1e13f0c58d7607040b84

SHA256
98f93a5fb1a578891416f057159de059e1a67228ac3c9e1196ff84706d594d2d

SHA512
bf26c8ec4a916e9dbbbdd881f2f598c4e2f6d560f1ccf27cd36377134c4c12c6505d0a00ab4e779a3b8b44021c2ec85658440b4e44d713fda86b6cdaa20bcb88

Download Submit
C:\Users\Admin\HQqGkIT8.exe

Filesize
292KB

MD5
f303cad3eb27fbe3210de3ceba0c383a

SHA1
2d6ee904f441820825872e6a1c25602bbc3f4fc7

SHA256
27ad34b399adb9be6b710ea1c3e43924d352f12b28459f5bbf1a4e99d62ab134

SHA512
b3cde21a385943fd5c5768dc842769307eef749c26847ca6109bb0ffe866fdbe6fd8f8564aa6390fddc5ce70371b342da9bfc37b6dd934f3b3d0a315e7476b0d

Download Submit
C:\Users\Admin\HQqGkIT8.exe

Filesize
292KB

MD5
f303cad3eb27fbe3210de3ceba0c383a

SHA1
2d6ee904f441820825872e6a1c25602bbc3f4fc7

SHA256
27ad34b399adb9be6b710ea1c3e43924d352f12b28459f5bbf1a4e99d62ab134

SHA512
b3cde21a385943fd5c5768dc842769307eef749c26847ca6109bb0ffe866fdbe6fd8f8564aa6390fddc5ce70371b342da9bfc37b6dd934f3b3d0a315e7476b0d

Download Submit
C:\Users\Admin\baimaus.exe

Filesize
292KB

MD5
8f1e6f0f3c4dc9c019b057fa053473fc

SHA1
a7ce767977f620b92fc3838fa7b92bcc4e1d8d34

SHA256
8c815dcd27dad43962543ebe14940a050ad258b1a65d2f224991e61ef4a9eeb7

SHA512
dd71affa899a2fc7dc47190547805bfdb6f60b1de9083c75d69346000d06f693b7b5808b083c5d115e2868dc16d5e24d9aa286392d3038b6ba5216a6a49c956e

Download Submit
C:\Users\Admin\baimaus.exe

Filesize
292KB

MD5
8f1e6f0f3c4dc9c019b057fa053473fc

SHA1
a7ce767977f620b92fc3838fa7b92bcc4e1d8d34

SHA256
8c815dcd27dad43962543ebe14940a050ad258b1a65d2f224991e61ef4a9eeb7

SHA512
dd71affa899a2fc7dc47190547805bfdb6f60b1de9083c75d69346000d06f693b7b5808b083c5d115e2868dc16d5e24d9aa286392d3038b6ba5216a6a49c956e

Download Submit
C:\Windows\system32\consrv.dll

Filesize
52KB

MD5
6bf2039986af96d98e08824ac6c383fd

SHA1
0bb6384656a96943cb427baa92446f987219a02e

SHA256
a3e03454ff636f4cdd0a95b856ea9e7857cd3ce0fd2bc6d528ab45781349103f

SHA512
fae378badcd6b45d69705d11fe5feb2d9f93fa444249c13aff9b150359ffdbcfe2b160731e193d3e19b6eef18d2ef01de41549a1c2bbdf59501f901511f9068e

Download Submit
\??\globalroot\systemroot\assembly\temp\@

Filesize
2KB

MD5
5bfeb2e8781675fa493027678a658687

SHA1
e63c9b5ddd2c8bfe126d90fcab60f836849da629

SHA256
8dcad125f6075f304625feffa31c506247e9a08731db509844620f04ec139b31

SHA512
b43934c9f4b689c391de5c212792e901c0e137d8192938081cec7add695459c134d60df29474fbcb5285ed1319b62095de89147f7710a3f96dec28393f64d2f5

Download Submit
\Users\Admin\2tej.exe

Filesize
64KB

MD5
1b98630662dace204c7a75ac06ab322f

SHA1
f2ebc161d140ce66753f49bf505060216996cdd2

SHA256
88cec7cae39b32f0efa22677b747b6361d70ae8768553e57a8c6ae85b8965650

SHA512
430db374527ff2cc413fe1d2635aa0c1afe3aab3a7e8595988cc2a9816e9b0c1d7b5a9b863f77ed6ed27a718fd08bc6582a8a00b022de23209ce89a93aa524e0

Download Submit
\Users\Admin\2tej.exe

Filesize
64KB

MD5
1b98630662dace204c7a75ac06ab322f

SHA1
f2ebc161d140ce66753f49bf505060216996cdd2

SHA256
88cec7cae39b32f0efa22677b747b6361d70ae8768553e57a8c6ae85b8965650

SHA512
430db374527ff2cc413fe1d2635aa0c1afe3aab3a7e8595988cc2a9816e9b0c1d7b5a9b863f77ed6ed27a718fd08bc6582a8a00b022de23209ce89a93aa524e0

Download Submit
\Users\Admin\3tej.exe

Filesize
204KB

MD5
666d8f00ccb49a2a23b174aa89c06ec2

SHA1
150f8e4aa5fbfb0df6f33a44885e46d43e789800

SHA256
c5d928569c84226a1737d057354a31e5019b464fb7093f1780e5116b486d5e5a

SHA512
0615f336b637db2041331660a98ebae4d36412c4bca64bb268f87cd20160ddf8a11eba097cd19333f1084bf81808b5e6647364cc88e87f85fa1848686881295f

Download Submit
\Users\Admin\3tej.exe

Filesize
204KB

MD5
666d8f00ccb49a2a23b174aa89c06ec2

SHA1
150f8e4aa5fbfb0df6f33a44885e46d43e789800

SHA256
c5d928569c84226a1737d057354a31e5019b464fb7093f1780e5116b486d5e5a

SHA512
0615f336b637db2041331660a98ebae4d36412c4bca64bb268f87cd20160ddf8a11eba097cd19333f1084bf81808b5e6647364cc88e87f85fa1848686881295f

Download Submit
\Users\Admin\4tej.exe

Filesize
44KB

MD5
a60c9c8d5563e0004be44141724b18c9

SHA1
b48757d94346720a169e1e13f0c58d7607040b84

SHA256
98f93a5fb1a578891416f057159de059e1a67228ac3c9e1196ff84706d594d2d

SHA512
bf26c8ec4a916e9dbbbdd881f2f598c4e2f6d560f1ccf27cd36377134c4c12c6505d0a00ab4e779a3b8b44021c2ec85658440b4e44d713fda86b6cdaa20bcb88

Download Submit
\Users\Admin\4tej.exe

Filesize
44KB

MD5
a60c9c8d5563e0004be44141724b18c9

SHA1
b48757d94346720a169e1e13f0c58d7607040b84

SHA256
98f93a5fb1a578891416f057159de059e1a67228ac3c9e1196ff84706d594d2d

SHA512
bf26c8ec4a916e9dbbbdd881f2f598c4e2f6d560f1ccf27cd36377134c4c12c6505d0a00ab4e779a3b8b44021c2ec85658440b4e44d713fda86b6cdaa20bcb88

Download Submit
\Users\Admin\HQqGkIT8.exe

Filesize
292KB

MD5
f303cad3eb27fbe3210de3ceba0c383a

SHA1
2d6ee904f441820825872e6a1c25602bbc3f4fc7

SHA256
27ad34b399adb9be6b710ea1c3e43924d352f12b28459f5bbf1a4e99d62ab134

SHA512
b3cde21a385943fd5c5768dc842769307eef749c26847ca6109bb0ffe866fdbe6fd8f8564aa6390fddc5ce70371b342da9bfc37b6dd934f3b3d0a315e7476b0d

Download Submit
\Users\Admin\HQqGkIT8.exe

Filesize
292KB

MD5
f303cad3eb27fbe3210de3ceba0c383a

SHA1
2d6ee904f441820825872e6a1c25602bbc3f4fc7

SHA256
27ad34b399adb9be6b710ea1c3e43924d352f12b28459f5bbf1a4e99d62ab134

SHA512
b3cde21a385943fd5c5768dc842769307eef749c26847ca6109bb0ffe866fdbe6fd8f8564aa6390fddc5ce70371b342da9bfc37b6dd934f3b3d0a315e7476b0d

Download Submit
\Users\Admin\baimaus.exe

Filesize
292KB

MD5
8f1e6f0f3c4dc9c019b057fa053473fc

SHA1
a7ce767977f620b92fc3838fa7b92bcc4e1d8d34

SHA256
8c815dcd27dad43962543ebe14940a050ad258b1a65d2f224991e61ef4a9eeb7

SHA512
dd71affa899a2fc7dc47190547805bfdb6f60b1de9083c75d69346000d06f693b7b5808b083c5d115e2868dc16d5e24d9aa286392d3038b6ba5216a6a49c956e

Download Submit
\Users\Admin\baimaus.exe

Filesize
292KB

MD5
8f1e6f0f3c4dc9c019b057fa053473fc

SHA1
a7ce767977f620b92fc3838fa7b92bcc4e1d8d34

SHA256
8c815dcd27dad43962543ebe14940a050ad258b1a65d2f224991e61ef4a9eeb7

SHA512
dd71affa899a2fc7dc47190547805bfdb6f60b1de9083c75d69346000d06f693b7b5808b083c5d115e2868dc16d5e24d9aa286392d3038b6ba5216a6a49c956e

Download Submit
\Windows\System32\consrv.dll

Filesize
52KB

MD5
6bf2039986af96d98e08824ac6c383fd

SHA1
0bb6384656a96943cb427baa92446f987219a02e

SHA256
a3e03454ff636f4cdd0a95b856ea9e7857cd3ce0fd2bc6d528ab45781349103f

SHA512
fae378badcd6b45d69705d11fe5feb2d9f93fa444249c13aff9b150359ffdbcfe2b160731e193d3e19b6eef18d2ef01de41549a1c2bbdf59501f901511f9068e

Download Submit
memory/336-115-0x0000000001F80000-0x0000000001F91000-memory.dmp

Filesize
68KB

Download
memory/868-138-0x0000000000840000-0x000000000084B000-memory.dmp

Filesize
44KB

Download
memory/868-137-0x0000000000820000-0x0000000000828000-memory.dmp

Filesize
32KB

Download
memory/868-136-0x0000000000840000-0x000000000084B000-memory.dmp

Filesize
44KB

Download
memory/868-135-0x0000000000820000-0x0000000000828000-memory.dmp

Filesize
32KB

Download
memory/868-133-0x0000000000830000-0x000000000083B000-memory.dmp

Filesize
44KB

Download
memory/868-129-0x0000000000830000-0x000000000083B000-memory.dmp

Filesize
44KB

Download
memory/868-125-0x0000000000830000-0x000000000083B000-memory.dmp

Filesize
44KB

Download
memory/1260-100-0x00000000029F0000-0x00000000029F6000-memory.dmp

Filesize
24KB

Download
memory/1260-104-0x00000000029F0000-0x00000000029F6000-memory.dmp

Filesize
24KB

Download
memory/1260-108-0x00000000029F0000-0x00000000029F6000-memory.dmp

Filesize
24KB

Download
memory/1672-56-0x0000000075BD1000-0x0000000075BD3000-memory.dmp

Filesize
8KB

Download
memory/1724-114-0x0000000030670000-0x00000000306A3000-memory.dmp

Filesize
204KB

Download
memory/1724-99-0x0000000030670000-0x00000000306A3000-memory.dmp

Filesize
204KB

Download
memory/1724-98-0x0000000000220000-0x000000000024A000-memory.dmp

Filesize
168KB

Download
memory/1724-113-0x0000000000220000-0x000000000024A000-memory.dmp

Filesize
168KB

Download
memory/1912-85-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/1912-83-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/1912-86-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/1912-91-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/1912-82-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/1912-90-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/1912-93-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download