358cde8d93948908b90963691a673e91e870ba68fbf52d461b97c36b1816be07

Analysis

max time kernel
151s
max time network
151s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
03-10-2022 02:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

358cde8d93948908b90963691a673e91e870ba68fbf52d461b97c36b1816be07.exe
Size

384KB
MD5

6aa10c7a5d6aecb4dfd09647f553dc62
SHA1

798215e3f05eb7dda8dd0ec813681c176a0a9265
SHA256

358cde8d93948908b90963691a673e91e870ba68fbf52d461b97c36b1816be07
SHA512

e212180568baeceda2181f506705a65f255736956cc26e1d80c224e7788b9cc1540943adbb2608ccfd99d7432e7d1d6a53c8dd81d26e949177caeb9b6c7641b9
SSDEEP

6144:4JGK2pYLlY4c6ue7lfhTuJZrM4l8KONb6/SPcGHciKjyISzTOILNhWOmzTTKWiYy:EGK2pYLlY4c6ue7lfhTuJZrM4l8KONbq

Score

10^/10

evasion persistence upx

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	yY6uXQd3.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	waooja.exe

Executes dropped EXE 7 IoCs

pid	Process
1216	yY6uXQd3.exe
1504	waooja.exe
544	2cmd.exe
760	2cmd.exe
864	3cmd.exe
340	csrss.exe
764	4cmd.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/760-82-0x0000000000400000-0x000000000040E000-memory.dmp	upx
behavioral1/memory/760-85-0x0000000000400000-0x000000000040E000-memory.dmp	upx
behavioral1/memory/760-84-0x0000000000400000-0x000000000040E000-memory.dmp	upx
behavioral1/memory/760-89-0x0000000000400000-0x000000000040E000-memory.dmp	upx
behavioral1/memory/760-90-0x0000000000400000-0x000000000040E000-memory.dmp	upx
behavioral1/memory/760-92-0x0000000000400000-0x000000000040E000-memory.dmp	upx

Deletes itself 1 IoCs

pid	Process
1588	cmd.exe

Loads dropped DLL 10 IoCs

pid	Process
852	358cde8d93948908b90963691a673e91e870ba68fbf52d461b97c36b1816be07.exe
852	358cde8d93948908b90963691a673e91e870ba68fbf52d461b97c36b1816be07.exe
1216	yY6uXQd3.exe
1216	yY6uXQd3.exe
852	358cde8d93948908b90963691a673e91e870ba68fbf52d461b97c36b1816be07.exe
852	358cde8d93948908b90963691a673e91e870ba68fbf52d461b97c36b1816be07.exe
852	358cde8d93948908b90963691a673e91e870ba68fbf52d461b97c36b1816be07.exe
852	358cde8d93948908b90963691a673e91e870ba68fbf52d461b97c36b1816be07.exe
852	358cde8d93948908b90963691a673e91e870ba68fbf52d461b97c36b1816be07.exe
852	358cde8d93948908b90963691a673e91e870ba68fbf52d461b97c36b1816be07.exe

Adds Run key to start application 2 TTPs 53 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\waooja = "C:\\Users\\Admin\\waooja.exe /a"	waooja.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\waooja = "C:\\Users\\Admin\\waooja.exe /c"	waooja.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\waooja = "C:\\Users\\Admin\\waooja.exe /K"	waooja.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\waooja = "C:\\Users\\Admin\\waooja.exe /M"	waooja.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\waooja = "C:\\Users\\Admin\\waooja.exe /X"	waooja.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\waooja = "C:\\Users\\Admin\\waooja.exe /d"	waooja.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\waooja = "C:\\Users\\Admin\\waooja.exe /i"	waooja.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\waooja = "C:\\Users\\Admin\\waooja.exe /A"	waooja.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\waooja = "C:\\Users\\Admin\\waooja.exe /W"	waooja.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\waooja = "C:\\Users\\Admin\\waooja.exe /t"	waooja.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\waooja = "C:\\Users\\Admin\\waooja.exe /q"	waooja.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\waooja = "C:\\Users\\Admin\\waooja.exe /U"	waooja.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\waooja = "C:\\Users\\Admin\\waooja.exe /L"	waooja.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\waooja = "C:\\Users\\Admin\\waooja.exe /k"	waooja.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\waooja = "C:\\Users\\Admin\\waooja.exe /S"	waooja.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\waooja = "C:\\Users\\Admin\\waooja.exe /h"	waooja.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\waooja = "C:\\Users\\Admin\\waooja.exe /w"	waooja.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\waooja = "C:\\Users\\Admin\\waooja.exe /N"	waooja.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\	yY6uXQd3.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\waooja = "C:\\Users\\Admin\\waooja.exe /H"	waooja.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\waooja = "C:\\Users\\Admin\\waooja.exe /y"	waooja.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\waooja = "C:\\Users\\Admin\\waooja.exe /g"	waooja.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\waooja = "C:\\Users\\Admin\\waooja.exe /F"	waooja.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\	waooja.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\waooja = "C:\\Users\\Admin\\waooja.exe /p"	waooja.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\waooja = "C:\\Users\\Admin\\waooja.exe /m"	waooja.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\waooja = "C:\\Users\\Admin\\waooja.exe /Z"	waooja.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\waooja = "C:\\Users\\Admin\\waooja.exe /P"	waooja.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\waooja = "C:\\Users\\Admin\\waooja.exe /z"	waooja.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\waooja = "C:\\Users\\Admin\\waooja.exe /v"	waooja.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\waooja = "C:\\Users\\Admin\\waooja.exe /G"	waooja.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\waooja = "C:\\Users\\Admin\\waooja.exe /C"	yY6uXQd3.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\waooja = "C:\\Users\\Admin\\waooja.exe /l"	waooja.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\waooja = "C:\\Users\\Admin\\waooja.exe /s"	waooja.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\waooja = "C:\\Users\\Admin\\waooja.exe /C"	waooja.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\waooja = "C:\\Users\\Admin\\waooja.exe /J"	waooja.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\waooja = "C:\\Users\\Admin\\waooja.exe /B"	waooja.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\waooja = "C:\\Users\\Admin\\waooja.exe /T"	waooja.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\waooja = "C:\\Users\\Admin\\waooja.exe /j"	waooja.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\waooja = "C:\\Users\\Admin\\waooja.exe /f"	waooja.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\waooja = "C:\\Users\\Admin\\waooja.exe /O"	waooja.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\waooja = "C:\\Users\\Admin\\waooja.exe /n"	waooja.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\waooja = "C:\\Users\\Admin\\waooja.exe /r"	waooja.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\waooja = "C:\\Users\\Admin\\waooja.exe /x"	waooja.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\waooja = "C:\\Users\\Admin\\waooja.exe /I"	waooja.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\waooja = "C:\\Users\\Admin\\waooja.exe /Y"	waooja.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\waooja = "C:\\Users\\Admin\\waooja.exe /o"	waooja.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\waooja = "C:\\Users\\Admin\\waooja.exe /E"	waooja.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\waooja = "C:\\Users\\Admin\\waooja.exe /b"	waooja.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\waooja = "C:\\Users\\Admin\\waooja.exe /V"	waooja.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\waooja = "C:\\Users\\Admin\\waooja.exe /u"	waooja.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\waooja = "C:\\Users\\Admin\\waooja.exe /e"	waooja.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\waooja = "C:\\Users\\Admin\\waooja.exe /D"	waooja.exe

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File created	\systemroot\assembly\GAC_64\Desktop.ini	csrss.exe
File created	\systemroot\assembly\GAC_32\Desktop.ini	csrss.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 544 set thread context of 760	544	2cmd.exe	34
PID 864 set thread context of 1888	864	3cmd.exe	36

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Enumerates processes with tasklist 1 TTPs 2 IoCs

Process Discovery

T1057

pid	Process
1496	tasklist.exe
892	tasklist.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1216	yY6uXQd3.exe
1216	yY6uXQd3.exe
760	2cmd.exe
864	3cmd.exe
864	3cmd.exe
864	3cmd.exe
864	3cmd.exe
760	2cmd.exe
1504	waooja.exe
1504	waooja.exe
1504	waooja.exe
1504	waooja.exe
760	2cmd.exe
760	2cmd.exe
1504	waooja.exe
760	2cmd.exe
1504	waooja.exe
1504	waooja.exe
1504	waooja.exe
760	2cmd.exe
760	2cmd.exe
1504	waooja.exe
760	2cmd.exe
1504	waooja.exe
1504	waooja.exe
760	2cmd.exe
760	2cmd.exe
1504	waooja.exe
760	2cmd.exe
1504	waooja.exe
760	2cmd.exe
760	2cmd.exe
1504	waooja.exe
1504	waooja.exe
760	2cmd.exe
1504	waooja.exe
760	2cmd.exe
1504	waooja.exe
760	2cmd.exe
1504	waooja.exe
760	2cmd.exe
760	2cmd.exe
1504	waooja.exe
760	2cmd.exe
1504	waooja.exe
760	2cmd.exe
760	2cmd.exe
1504	waooja.exe
760	2cmd.exe
1504	waooja.exe
760	2cmd.exe
1504	waooja.exe
760	2cmd.exe
760	2cmd.exe
1504	waooja.exe
760	2cmd.exe
760	2cmd.exe
1504	waooja.exe
1504	waooja.exe
1504	waooja.exe
760	2cmd.exe
760	2cmd.exe
760	2cmd.exe
1504	waooja.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1280	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1496	tasklist.exe
Token: SeDebugPrivilege	864	3cmd.exe
Token: SeDebugPrivilege	864	3cmd.exe
Token: SeDebugPrivilege	892	tasklist.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1280	Explorer.EXE
1280	Explorer.EXE

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
1280	Explorer.EXE
1280	Explorer.EXE

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
852	358cde8d93948908b90963691a673e91e870ba68fbf52d461b97c36b1816be07.exe
1216	yY6uXQd3.exe
1504	waooja.exe
544	2cmd.exe
764	4cmd.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
340	csrss.exe
1280	Explorer.EXE

Suspicious use of WriteProcessMemory 52 IoCs

description	pid	Process	procid_target
PID 852 wrote to memory of 1216	852	358cde8d93948908b90963691a673e91e870ba68fbf52d461b97c36b1816be07.exe	27
PID 852 wrote to memory of 1216	852	358cde8d93948908b90963691a673e91e870ba68fbf52d461b97c36b1816be07.exe	27
PID 852 wrote to memory of 1216	852	358cde8d93948908b90963691a673e91e870ba68fbf52d461b97c36b1816be07.exe	27
PID 852 wrote to memory of 1216	852	358cde8d93948908b90963691a673e91e870ba68fbf52d461b97c36b1816be07.exe	27
PID 1216 wrote to memory of 1504	1216	yY6uXQd3.exe	28
PID 1216 wrote to memory of 1504	1216	yY6uXQd3.exe	28
PID 1216 wrote to memory of 1504	1216	yY6uXQd3.exe	28
PID 1216 wrote to memory of 1504	1216	yY6uXQd3.exe	28
PID 1216 wrote to memory of 336	1216	yY6uXQd3.exe	29
PID 1216 wrote to memory of 336	1216	yY6uXQd3.exe	29
PID 1216 wrote to memory of 336	1216	yY6uXQd3.exe	29
PID 1216 wrote to memory of 336	1216	yY6uXQd3.exe	29
PID 336 wrote to memory of 1496	336	cmd.exe	31
PID 336 wrote to memory of 1496	336	cmd.exe	31
PID 336 wrote to memory of 1496	336	cmd.exe	31
PID 336 wrote to memory of 1496	336	cmd.exe	31
PID 852 wrote to memory of 544	852	358cde8d93948908b90963691a673e91e870ba68fbf52d461b97c36b1816be07.exe	33
PID 852 wrote to memory of 544	852	358cde8d93948908b90963691a673e91e870ba68fbf52d461b97c36b1816be07.exe	33
PID 852 wrote to memory of 544	852	358cde8d93948908b90963691a673e91e870ba68fbf52d461b97c36b1816be07.exe	33
PID 852 wrote to memory of 544	852	358cde8d93948908b90963691a673e91e870ba68fbf52d461b97c36b1816be07.exe	33
PID 544 wrote to memory of 760	544	2cmd.exe	34
PID 544 wrote to memory of 760	544	2cmd.exe	34
PID 544 wrote to memory of 760	544	2cmd.exe	34
PID 544 wrote to memory of 760	544	2cmd.exe	34
PID 544 wrote to memory of 760	544	2cmd.exe	34
PID 544 wrote to memory of 760	544	2cmd.exe	34
PID 544 wrote to memory of 760	544	2cmd.exe	34
PID 544 wrote to memory of 760	544	2cmd.exe	34
PID 852 wrote to memory of 864	852	358cde8d93948908b90963691a673e91e870ba68fbf52d461b97c36b1816be07.exe	35
PID 852 wrote to memory of 864	852	358cde8d93948908b90963691a673e91e870ba68fbf52d461b97c36b1816be07.exe	35
PID 852 wrote to memory of 864	852	358cde8d93948908b90963691a673e91e870ba68fbf52d461b97c36b1816be07.exe	35
PID 852 wrote to memory of 864	852	358cde8d93948908b90963691a673e91e870ba68fbf52d461b97c36b1816be07.exe	35
PID 864 wrote to memory of 1280	864	3cmd.exe	6
PID 864 wrote to memory of 340	864	3cmd.exe	24
PID 864 wrote to memory of 1888	864	3cmd.exe	36
PID 864 wrote to memory of 1888	864	3cmd.exe	36
PID 864 wrote to memory of 1888	864	3cmd.exe	36
PID 864 wrote to memory of 1888	864	3cmd.exe	36
PID 864 wrote to memory of 1888	864	3cmd.exe	36
PID 852 wrote to memory of 764	852	358cde8d93948908b90963691a673e91e870ba68fbf52d461b97c36b1816be07.exe	38
PID 852 wrote to memory of 764	852	358cde8d93948908b90963691a673e91e870ba68fbf52d461b97c36b1816be07.exe	38
PID 852 wrote to memory of 764	852	358cde8d93948908b90963691a673e91e870ba68fbf52d461b97c36b1816be07.exe	38
PID 852 wrote to memory of 764	852	358cde8d93948908b90963691a673e91e870ba68fbf52d461b97c36b1816be07.exe	38
PID 852 wrote to memory of 1588	852	358cde8d93948908b90963691a673e91e870ba68fbf52d461b97c36b1816be07.exe	39
PID 852 wrote to memory of 1588	852	358cde8d93948908b90963691a673e91e870ba68fbf52d461b97c36b1816be07.exe	39
PID 852 wrote to memory of 1588	852	358cde8d93948908b90963691a673e91e870ba68fbf52d461b97c36b1816be07.exe	39
PID 852 wrote to memory of 1588	852	358cde8d93948908b90963691a673e91e870ba68fbf52d461b97c36b1816be07.exe	39
PID 1588 wrote to memory of 892	1588	cmd.exe	41
PID 1588 wrote to memory of 892	1588	cmd.exe	41
PID 1588 wrote to memory of 892	1588	cmd.exe	41
PID 1588 wrote to memory of 892	1588	cmd.exe	41
PID 340 wrote to memory of 872	340	csrss.exe	16

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of UnmapMainImage
PID:1280
- C:\Users\Admin\AppData\Local\Temp\358cde8d93948908b90963691a673e91e870ba68fbf52d461b97c36b1816be07.exe
  "C:\Users\Admin\AppData\Local\Temp\358cde8d93948908b90963691a673e91e870ba68fbf52d461b97c36b1816be07.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:852
- - C:\Users\Admin\yY6uXQd3.exe
    C:\Users\Admin\yY6uXQd3.exe
    3⤵
    - Modifies visiblity of hidden/system files in Explorer
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1216
  - - C:\Users\Admin\waooja.exe
      "C:\Users\Admin\waooja.exe"
      4⤵
      Modifies visiblity of hidden/system files in Explorer
      Executes dropped EXE
      Adds Run key to start application
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      PID:1504
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c tasklist&&del yY6uXQd3.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:336
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:1496
- - C:\Users\Admin\2cmd.exe
    C:\Users\Admin\2cmd.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:544
  - - C:\Users\Admin\2cmd.exe
      "C:\Users\Admin\2cmd.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:760
- - C:\Users\Admin\3cmd.exe
    C:\Users\Admin\3cmd.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:864
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe"
      4⤵
      PID:1888
- - C:\Users\Admin\4cmd.exe
    C:\Users\Admin\4cmd.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:764
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c tasklist&&del 358cde8d93948908b90963691a673e91e870ba68fbf52d461b97c36b1816be07.exe
    3⤵
    - Deletes itself
    - Suspicious use of WriteProcessMemory
    PID:1588
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:892

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs
1⤵
PID:872

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:340

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Discovery

Process Discovery

T1057

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\2cmd.exe

Filesize
68KB

MD5
3a0c1cfad2607489a7b81afeadb1c8de

SHA1
505930aa4aacad8743768c73c9d56b7896277cd8

SHA256
d0115953a9086756f4c8fc090765ffc6eb842d2addb5faac7eb4b10f5422d701

SHA512
277c586dc9d11c3e6f899dd26cc18947051f9f3589bbfcb80e9f0d35296849fc610feb5ad2d43a0d0ad17e9aa0c1a147903c355b9e1cfc6514def04bf0f8672b

Download Submit
C:\Users\Admin\2cmd.exe

Filesize
68KB

MD5
3a0c1cfad2607489a7b81afeadb1c8de

SHA1
505930aa4aacad8743768c73c9d56b7896277cd8

SHA256
d0115953a9086756f4c8fc090765ffc6eb842d2addb5faac7eb4b10f5422d701

SHA512
277c586dc9d11c3e6f899dd26cc18947051f9f3589bbfcb80e9f0d35296849fc610feb5ad2d43a0d0ad17e9aa0c1a147903c355b9e1cfc6514def04bf0f8672b

Download Submit
C:\Users\Admin\2cmd.exe

Filesize
68KB

MD5
3a0c1cfad2607489a7b81afeadb1c8de

SHA1
505930aa4aacad8743768c73c9d56b7896277cd8

SHA256
d0115953a9086756f4c8fc090765ffc6eb842d2addb5faac7eb4b10f5422d701

SHA512
277c586dc9d11c3e6f899dd26cc18947051f9f3589bbfcb80e9f0d35296849fc610feb5ad2d43a0d0ad17e9aa0c1a147903c355b9e1cfc6514def04bf0f8672b

Download Submit
C:\Users\Admin\3cmd.exe

Filesize
204KB

MD5
22d9cb396127839a597009a5c0d2092c

SHA1
c854e7c3954516ccb0f5aa8f96efb61fa0ca47c0

SHA256
81c1c53b6f97ff69a0762b45c123160b43c301c6b8ff5a996db20c22deb66660

SHA512
f0020266bd408ad8617e2a56ac21379907ec48384d9ddcd95d5602f58eac2e304d55eb5844e0062747ea8cb8b3f58d7fc44120d9e358a7b1bffa63e31362531a

Download Submit
C:\Users\Admin\3cmd.exe

Filesize
204KB

MD5
22d9cb396127839a597009a5c0d2092c

SHA1
c854e7c3954516ccb0f5aa8f96efb61fa0ca47c0

SHA256
81c1c53b6f97ff69a0762b45c123160b43c301c6b8ff5a996db20c22deb66660

SHA512
f0020266bd408ad8617e2a56ac21379907ec48384d9ddcd95d5602f58eac2e304d55eb5844e0062747ea8cb8b3f58d7fc44120d9e358a7b1bffa63e31362531a

Download Submit
C:\Users\Admin\4cmd.exe

Filesize
36KB

MD5
06267a936e89e44812691c5ee418e214

SHA1
7a7f7fde8da51c6f8e077650f4718cfc84bb0eca

SHA256
c8818d1fae7fa653031cbd2dde9355085c1ece748508c6b294ad7567759d7ab2

SHA512
e85fa457dbb6b2fddc43d597697f9c88e20569201e383b6a1fb70c9fd2a69266be56b90a2766bcfb13d0a06adf2cf3353daa81f865442173d55d690b904ba506

Download Submit
C:\Users\Admin\waooja.exe

Filesize
264KB

MD5
67e53cd074be5cd2eb3b6cdc8b2d913c

SHA1
406453e2948f91a8fba8beb3cd868791592f0d02

SHA256
0e2d9dc6a0f754f754e4c88af91b419c8e48688c6685118fe125809823877279

SHA512
1bc920ed5515261740cf09a1e3cd33fd4e215ac3ce40849c9d9d955880a0de7494b81090b42c1e9bd999101592164f7ee364b4842fd303fa770a8c887671a2ee

Download Submit
C:\Users\Admin\waooja.exe

Filesize
264KB

MD5
67e53cd074be5cd2eb3b6cdc8b2d913c

SHA1
406453e2948f91a8fba8beb3cd868791592f0d02

SHA256
0e2d9dc6a0f754f754e4c88af91b419c8e48688c6685118fe125809823877279

SHA512
1bc920ed5515261740cf09a1e3cd33fd4e215ac3ce40849c9d9d955880a0de7494b81090b42c1e9bd999101592164f7ee364b4842fd303fa770a8c887671a2ee

Download Submit
C:\Users\Admin\yY6uXQd3.exe

Filesize
264KB

MD5
490d9698c1890b9b4e1c62dd277c2ddb

SHA1
635866f95d176fa2567eb47f078d9a618a9ceb6a

SHA256
9ca36f2be3faf01aa4ebe57f90106ab517c757b505de69b3b5d8016ae11dc116

SHA512
3fd9745bee17f284e1cf693e538c81b71478432d0a3980dcdec5b15502f63eed072002c7ad10598778ccb1287549b5b3ae18a9070f1d3b7c077bf87bc616ff45

Download Submit
C:\Users\Admin\yY6uXQd3.exe

Filesize
264KB

MD5
490d9698c1890b9b4e1c62dd277c2ddb

SHA1
635866f95d176fa2567eb47f078d9a618a9ceb6a

SHA256
9ca36f2be3faf01aa4ebe57f90106ab517c757b505de69b3b5d8016ae11dc116

SHA512
3fd9745bee17f284e1cf693e538c81b71478432d0a3980dcdec5b15502f63eed072002c7ad10598778ccb1287549b5b3ae18a9070f1d3b7c077bf87bc616ff45

Download Submit
C:\Windows\system32\consrv.dll

Filesize
53KB

MD5
d1c9e07123216e8836e7988794cd3c75

SHA1
a1061c34544c9377449e186074404e0dd1009994

SHA256
334bd46d5f3ba098c11827982715c0ff98e2aa1c2361b9702b222949e7e5730c

SHA512
06014da3030fa66fbf64f9dd0c9c229390c93dedcb2c6f53aff810a7d0054c05c514804ea9dbae3d6ec1f13b45b4dd844a7e1ec1706e5a7ae16be8e8a760898b

Download Submit
\??\globalroot\systemroot\assembly\temp\@

Filesize
2KB

MD5
c0b9f15f2e1426b24a9c2b09b03aabd5

SHA1
2acf7b1b9b235b9117266ae47acdc6869dd158c5

SHA256
708463d6e6ff6275e3f073374cf3f0cde2ea6fc7f22685976a8e65e594603654

SHA512
bab5b7a0bfff280dcaf31c49854e61a17a90e03c38507b49764e674ca5cba9fcf5fa1335a4e7b8bbb4b5233003d509852b0c042acd385af289da435fd608fc4c

Download Submit
\Users\Admin\2cmd.exe

Filesize
68KB

MD5
3a0c1cfad2607489a7b81afeadb1c8de

SHA1
505930aa4aacad8743768c73c9d56b7896277cd8

SHA256
d0115953a9086756f4c8fc090765ffc6eb842d2addb5faac7eb4b10f5422d701

SHA512
277c586dc9d11c3e6f899dd26cc18947051f9f3589bbfcb80e9f0d35296849fc610feb5ad2d43a0d0ad17e9aa0c1a147903c355b9e1cfc6514def04bf0f8672b

Download Submit
\Users\Admin\2cmd.exe

Filesize
68KB

MD5
3a0c1cfad2607489a7b81afeadb1c8de

SHA1
505930aa4aacad8743768c73c9d56b7896277cd8

SHA256
d0115953a9086756f4c8fc090765ffc6eb842d2addb5faac7eb4b10f5422d701

SHA512
277c586dc9d11c3e6f899dd26cc18947051f9f3589bbfcb80e9f0d35296849fc610feb5ad2d43a0d0ad17e9aa0c1a147903c355b9e1cfc6514def04bf0f8672b

Download Submit
\Users\Admin\3cmd.exe

Filesize
204KB

MD5
22d9cb396127839a597009a5c0d2092c

SHA1
c854e7c3954516ccb0f5aa8f96efb61fa0ca47c0

SHA256
81c1c53b6f97ff69a0762b45c123160b43c301c6b8ff5a996db20c22deb66660

SHA512
f0020266bd408ad8617e2a56ac21379907ec48384d9ddcd95d5602f58eac2e304d55eb5844e0062747ea8cb8b3f58d7fc44120d9e358a7b1bffa63e31362531a

Download Submit
\Users\Admin\3cmd.exe

Filesize
204KB

MD5
22d9cb396127839a597009a5c0d2092c

SHA1
c854e7c3954516ccb0f5aa8f96efb61fa0ca47c0

SHA256
81c1c53b6f97ff69a0762b45c123160b43c301c6b8ff5a996db20c22deb66660

SHA512
f0020266bd408ad8617e2a56ac21379907ec48384d9ddcd95d5602f58eac2e304d55eb5844e0062747ea8cb8b3f58d7fc44120d9e358a7b1bffa63e31362531a

Download Submit
\Users\Admin\4cmd.exe

Filesize
36KB

MD5
06267a936e89e44812691c5ee418e214

SHA1
7a7f7fde8da51c6f8e077650f4718cfc84bb0eca

SHA256
c8818d1fae7fa653031cbd2dde9355085c1ece748508c6b294ad7567759d7ab2

SHA512
e85fa457dbb6b2fddc43d597697f9c88e20569201e383b6a1fb70c9fd2a69266be56b90a2766bcfb13d0a06adf2cf3353daa81f865442173d55d690b904ba506

Download Submit
\Users\Admin\4cmd.exe

Filesize
36KB

MD5
06267a936e89e44812691c5ee418e214

SHA1
7a7f7fde8da51c6f8e077650f4718cfc84bb0eca

SHA256
c8818d1fae7fa653031cbd2dde9355085c1ece748508c6b294ad7567759d7ab2

SHA512
e85fa457dbb6b2fddc43d597697f9c88e20569201e383b6a1fb70c9fd2a69266be56b90a2766bcfb13d0a06adf2cf3353daa81f865442173d55d690b904ba506

Download Submit
\Users\Admin\waooja.exe

Filesize
264KB

MD5
67e53cd074be5cd2eb3b6cdc8b2d913c

SHA1
406453e2948f91a8fba8beb3cd868791592f0d02

SHA256
0e2d9dc6a0f754f754e4c88af91b419c8e48688c6685118fe125809823877279

SHA512
1bc920ed5515261740cf09a1e3cd33fd4e215ac3ce40849c9d9d955880a0de7494b81090b42c1e9bd999101592164f7ee364b4842fd303fa770a8c887671a2ee

Download Submit
\Users\Admin\waooja.exe

Filesize
264KB

MD5
67e53cd074be5cd2eb3b6cdc8b2d913c

SHA1
406453e2948f91a8fba8beb3cd868791592f0d02

SHA256
0e2d9dc6a0f754f754e4c88af91b419c8e48688c6685118fe125809823877279

SHA512
1bc920ed5515261740cf09a1e3cd33fd4e215ac3ce40849c9d9d955880a0de7494b81090b42c1e9bd999101592164f7ee364b4842fd303fa770a8c887671a2ee

Download Submit
\Users\Admin\yY6uXQd3.exe

Filesize
264KB

MD5
490d9698c1890b9b4e1c62dd277c2ddb

SHA1
635866f95d176fa2567eb47f078d9a618a9ceb6a

SHA256
9ca36f2be3faf01aa4ebe57f90106ab517c757b505de69b3b5d8016ae11dc116

SHA512
3fd9745bee17f284e1cf693e538c81b71478432d0a3980dcdec5b15502f63eed072002c7ad10598778ccb1287549b5b3ae18a9070f1d3b7c077bf87bc616ff45

Download Submit
\Users\Admin\yY6uXQd3.exe

Filesize
264KB

MD5
490d9698c1890b9b4e1c62dd277c2ddb

SHA1
635866f95d176fa2567eb47f078d9a618a9ceb6a

SHA256
9ca36f2be3faf01aa4ebe57f90106ab517c757b505de69b3b5d8016ae11dc116

SHA512
3fd9745bee17f284e1cf693e538c81b71478432d0a3980dcdec5b15502f63eed072002c7ad10598778ccb1287549b5b3ae18a9070f1d3b7c077bf87bc616ff45

Download Submit
\Windows\System32\consrv.dll

Filesize
53KB

MD5
d1c9e07123216e8836e7988794cd3c75

SHA1
a1061c34544c9377449e186074404e0dd1009994

SHA256
334bd46d5f3ba098c11827982715c0ff98e2aa1c2361b9702b222949e7e5730c

SHA512
06014da3030fa66fbf64f9dd0c9c229390c93dedcb2c6f53aff810a7d0054c05c514804ea9dbae3d6ec1f13b45b4dd844a7e1ec1706e5a7ae16be8e8a760898b

Download Submit
memory/340-120-0x0000000001FC0000-0x0000000001FD2000-memory.dmp

Filesize
72KB

Download
memory/760-90-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/760-85-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/760-89-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/760-84-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/760-92-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/760-82-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/760-81-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/852-56-0x0000000074E41000-0x0000000074E43000-memory.dmp

Filesize
8KB

Download
memory/864-108-0x0000000000220000-0x000000000024A000-memory.dmp

Filesize
168KB

Download
memory/864-97-0x0000000030670000-0x00000000306A3000-memory.dmp

Filesize
204KB

Download
memory/864-111-0x0000000030670000-0x00000000306A3000-memory.dmp

Filesize
204KB

Download
memory/872-123-0x0000000000940000-0x000000000094B000-memory.dmp

Filesize
44KB

Download
memory/872-127-0x0000000000940000-0x000000000094B000-memory.dmp

Filesize
44KB

Download
memory/872-136-0x0000000000950000-0x000000000095B000-memory.dmp

Filesize
44KB

Download
memory/872-135-0x0000000000930000-0x0000000000938000-memory.dmp

Filesize
32KB

Download
memory/872-134-0x0000000000950000-0x000000000095B000-memory.dmp

Filesize
44KB

Download
memory/872-133-0x0000000000930000-0x0000000000938000-memory.dmp

Filesize
32KB

Download
memory/872-131-0x0000000000940000-0x000000000094B000-memory.dmp

Filesize
44KB

Download
memory/1280-98-0x0000000002AE0000-0x0000000002AE6000-memory.dmp

Filesize
24KB

Download
memory/1280-102-0x0000000002AE0000-0x0000000002AE6000-memory.dmp

Filesize
24KB

Download
memory/1280-106-0x0000000002AE0000-0x0000000002AE6000-memory.dmp

Filesize
24KB

Download