Analysis
-
max time kernel
155s -
max time network
163s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
03-10-2022 03:43
Static task
static1
Behavioral task
behavioral1
Sample
4294637edeceeff8e5db5b9355fd260ad6015a53e0835290140507bbac969415.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
4294637edeceeff8e5db5b9355fd260ad6015a53e0835290140507bbac969415.exe
Resource
win10v2004-20220812-en
General
-
Target
4294637edeceeff8e5db5b9355fd260ad6015a53e0835290140507bbac969415.exe
-
Size
457KB
-
MD5
4303740f657093a0dbcc65ffb1896700
-
SHA1
41f6fc777321df9088b468b7a233dfc27276b343
-
SHA256
4294637edeceeff8e5db5b9355fd260ad6015a53e0835290140507bbac969415
-
SHA512
eb46a6f36ea29eb987b115c83ba6f4211f03978454a33edb0bea01c8d5845791b7821e7ed23a73c2683eb2447f28cf039c2ae103c550d20122254f6767da7cda
-
SSDEEP
12288:QSo6xg5kN530xuooqMVwsgS0Tyv9H7ef/:Y6u5030x+gS0TyvN+
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 9 IoCs
Detects file using ACProtect software.
Processes:
resource yara_rule C:\Windows\SysWOW64\avphost.dll acprotect C:\Windows\SysWOW64\avphost.dll acprotect C:\Windows\SysWOW64\avphost.dll acprotect C:\Windows\SysWOW64\avphost.dll acprotect C:\Windows\SysWOW64\avphost.dll acprotect C:\Windows\SysWOW64\avphost.dll acprotect C:\Windows\SysWOW64\avphost.dll acprotect C:\Windows\SysWOW64\avphost.dll acprotect C:\Windows\SysWOW64\avphost.dll acprotect -
Adds policy Run key to start application 2 TTPs 36 IoCs
Processes:
KHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exe4294637edeceeff8e5db5b9355fd260ad6015a53e0835290140507bbac969415.exeKHATRA.exeKHATRA.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run KHATRA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\G_Host = "\"C:\\Windows\\System\\gHost.exe\" /Reproduce" KHATRA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run KHATRA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\G_Host = "\"C:\\Windows\\System\\gHost.exe\" /Reproduce" KHATRA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\G_Host = "\"C:\\Windows\\System\\gHost.exe\" /Reproduce" KHATRA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run KHATRA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run KHATRA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\G_Host = "\"C:\\Windows\\System\\gHost.exe\" /Reproduce" KHATRA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run KHATRA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\G_Host = "\"C:\\Windows\\System\\gHost.exe\" /Reproduce" KHATRA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run KHATRA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run KHATRA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run KHATRA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\G_Host = "\"C:\\Windows\\System\\gHost.exe\" /Reproduce" KHATRA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\G_Host = "\"C:\\Windows\\System\\gHost.exe\" /Reproduce" KHATRA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run KHATRA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run KHATRA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\G_Host = "\"C:\\Windows\\System\\gHost.exe\" /Reproduce" KHATRA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\G_Host = "\"C:\\Windows\\System\\gHost.exe\" /Reproduce" KHATRA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\G_Host = "\"C:\\Windows\\System\\gHost.exe\" /Reproduce" KHATRA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run KHATRA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\G_Host = "\"C:\\Windows\\System\\gHost.exe\" /Reproduce" 4294637edeceeff8e5db5b9355fd260ad6015a53e0835290140507bbac969415.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run KHATRA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\G_Host = "\"C:\\Windows\\System\\gHost.exe\" /Reproduce" KHATRA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\G_Host = "\"C:\\Windows\\System\\gHost.exe\" /Reproduce" KHATRA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\G_Host = "\"C:\\Windows\\System\\gHost.exe\" /Reproduce" KHATRA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run KHATRA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run KHATRA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run 4294637edeceeff8e5db5b9355fd260ad6015a53e0835290140507bbac969415.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\G_Host = "\"C:\\Windows\\System\\gHost.exe\" /Reproduce" KHATRA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\G_Host = "\"C:\\Windows\\System\\gHost.exe\" /Reproduce" KHATRA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\G_Host = "\"C:\\Windows\\System\\gHost.exe\" /Reproduce" KHATRA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run KHATRA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run KHATRA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run KHATRA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\G_Host = "\"C:\\Windows\\System\\gHost.exe\" /Reproduce" KHATRA.exe -
Disables RegEdit via registry modification 18 IoCs
Processes:
KHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exe4294637edeceeff8e5db5b9355fd260ad6015a53e0835290140507bbac969415.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" KHATRA.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" KHATRA.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" KHATRA.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" KHATRA.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" KHATRA.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" KHATRA.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" KHATRA.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" 4294637edeceeff8e5db5b9355fd260ad6015a53e0835290140507bbac969415.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" KHATRA.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" KHATRA.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" KHATRA.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" KHATRA.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" KHATRA.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" KHATRA.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" KHATRA.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" KHATRA.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" KHATRA.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" KHATRA.exe -
Executes dropped EXE 19 IoCs
Processes:
KHATRA.exeXplorer.exegHost.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exepid process 1520 KHATRA.exe 2372 Xplorer.exe 4128 gHost.exe 4132 KHATRA.exe 4884 KHATRA.exe 1264 KHATRA.exe 3208 KHATRA.exe 3132 KHATRA.exe 2252 KHATRA.exe 836 KHATRA.exe 4652 KHATRA.exe 2544 KHATRA.exe 492 KHATRA.exe 2392 KHATRA.exe 1512 KHATRA.exe 1784 KHATRA.exe 4344 KHATRA.exe 1120 KHATRA.exe 3828 KHATRA.exe -
Modifies Windows Firewall 1 TTPs 17 IoCs
Processes:
netsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exepid process 3820 netsh.exe 3512 netsh.exe 212 netsh.exe 4844 netsh.exe 5104 netsh.exe 3812 netsh.exe 4664 netsh.exe 4416 netsh.exe 2044 netsh.exe 1996 netsh.exe 916 netsh.exe 1812 netsh.exe 4504 netsh.exe 3016 netsh.exe 1812 netsh.exe 5068 netsh.exe 2544 netsh.exe -
Processes:
resource yara_rule C:\Windows\SysWOW64\avphost.dll upx C:\Windows\SysWOW64\avphost.dll upx C:\Windows\SysWOW64\avphost.dll upx C:\Windows\SysWOW64\avphost.dll upx behavioral2/memory/1956-168-0x0000000010000000-0x000000001005C000-memory.dmp upx C:\Windows\SysWOW64\avphost.dll upx C:\Windows\SysWOW64\avphost.dll upx C:\Windows\SysWOW64\avphost.dll upx C:\Windows\SysWOW64\avphost.dll upx C:\Windows\SysWOW64\avphost.dll upx -
Loads dropped DLL 17 IoCs
Processes:
regsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exepid process 1956 regsvr32.exe 1836 regsvr32.exe 4084 regsvr32.exe 1860 regsvr32.exe 1748 regsvr32.exe 4696 regsvr32.exe 2084 regsvr32.exe 4640 regsvr32.exe 3304 regsvr32.exe 4476 regsvr32.exe 2296 regsvr32.exe 3508 regsvr32.exe 5040 regsvr32.exe 3220 regsvr32.exe 3256 regsvr32.exe 4668 regsvr32.exe 60 regsvr32.exe -
Adds Run key to start application 2 TTPs 58 IoCs
Processes:
KHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exe4294637edeceeff8e5db5b9355fd260ad6015a53e0835290140507bbac969415.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run KHATRA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\1 = "C:\\Windows\\Xplorer.exe" KHATRA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Xplorer = "\"C:\\Windows\\Xplorer.exe\" /Windows" KHATRA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\1 = "C:\\Windows\\Xplorer.exe" KHATRA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Xplorer = "C:\\Windows\\system32\\KHATRA.exe" KHATRA.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run KHATRA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\1 = "C:\\Windows\\system32\\KHATRA.exe" KHATRA.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run KHATRA.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run KHATRA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\1 = "C:\\Windows\\Xplorer.exe" KHATRA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Xplorer = "\"C:\\Windows\\Xplorer.exe\" /Windows" KHATRA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Xplorer = "\"C:\\Windows\\Xplorer.exe\" /Windows" KHATRA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\1 = "C:\\Windows\\system32\\KHATRA.exe" KHATRA.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run KHATRA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\1 = "C:\\Windows\\Xplorer.exe" KHATRA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Xplorer = "\"C:\\Windows\\Xplorer.exe\" /Windows" KHATRA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Xplorer = "\"C:\\Windows\\Xplorer.exe\" /Windows" KHATRA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Xplorer = "\"C:\\Windows\\Xplorer.exe\" /Windows" KHATRA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Xplorer = "\"C:\\Windows\\Xplorer.exe\" /Windows" KHATRA.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run KHATRA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\1 = "C:\\Windows\\system32\\KHATRA.exe" KHATRA.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run KHATRA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Xplorer = "C:\\Windows\\system32\\KHATRA.exe" KHATRA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Xplorer = "\"C:\\Windows\\Xplorer.exe\" /Windows" KHATRA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Xplorer = "\"C:\\Windows\\Xplorer.exe\" /Windows" KHATRA.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run KHATRA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Xplorer = "C:\\Windows\\Xplorer.exe" KHATRA.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run KHATRA.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run KHATRA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\1 = "C:\\Windows\\system32\\KHATRA.exe" KHATRA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Xplorer = "\"C:\\Windows\\Xplorer.exe\" /Windows" KHATRA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Xplorer = "\"C:\\Windows\\Xplorer.exe\" /Windows" KHATRA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Xplorer = "\"C:\\Windows\\Xplorer.exe\" /Windows" KHATRA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Xplorer = "C:\\Windows\\Xplorer.exe" KHATRA.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run KHATRA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Xplorer = "C:\\Windows\\system32\\KHATRA.exe" KHATRA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Xplorer = "\"C:\\Windows\\Xplorer.exe\" /Windows" 4294637edeceeff8e5db5b9355fd260ad6015a53e0835290140507bbac969415.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Xplorer = "C:\\Windows\\Xplorer.exe" KHATRA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Xplorer = "C:\\Windows\\Xplorer.exe" KHATRA.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run KHATRA.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run KHATRA.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run 4294637edeceeff8e5db5b9355fd260ad6015a53e0835290140507bbac969415.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run KHATRA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Xplorer = "C:\\Windows\\system32\\KHATRA.exe" KHATRA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\1 = "C:\\Windows\\Xplorer.exe" KHATRA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Xplorer = "\"C:\\Windows\\Xplorer.exe\" /Windows" KHATRA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Xplorer = "\"C:\\Windows\\Xplorer.exe\" /Windows" KHATRA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\1 = "C:\\Windows\\system32\\KHATRA.exe" KHATRA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\1 = "C:\\Windows\\system32\\KHATRA.exe" KHATRA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\1 = "C:\\Windows\\Xplorer.exe" KHATRA.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run KHATRA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Xplorer = "C:\\Windows\\system32\\KHATRA.exe" KHATRA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Xplorer = "\"C:\\Windows\\Xplorer.exe\" /Windows" KHATRA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Xplorer = "\"C:\\Windows\\Xplorer.exe\" /Windows" KHATRA.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run KHATRA.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run KHATRA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Xplorer = "\"C:\\Windows\\Xplorer.exe\" /Windows" KHATRA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Xplorer = "C:\\Windows\\Xplorer.exe" KHATRA.exe -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
gHost.exedescription ioc process File opened (read-only) \??\g: gHost.exe File opened (read-only) \??\h: gHost.exe File opened (read-only) \??\s: gHost.exe File opened (read-only) \??\z: gHost.exe File opened (read-only) \??\f: gHost.exe File opened (read-only) \??\j: gHost.exe File opened (read-only) \??\k: gHost.exe File opened (read-only) \??\p: gHost.exe File opened (read-only) \??\q: gHost.exe File opened (read-only) \??\w: gHost.exe File opened (read-only) \??\x: gHost.exe File opened (read-only) \??\a: gHost.exe File opened (read-only) \??\l: gHost.exe File opened (read-only) \??\m: gHost.exe File opened (read-only) \??\y: gHost.exe File opened (read-only) \??\u: gHost.exe File opened (read-only) \??\b: gHost.exe File opened (read-only) \??\e: gHost.exe File opened (read-only) \??\i: gHost.exe File opened (read-only) \??\n: gHost.exe File opened (read-only) \??\o: gHost.exe File opened (read-only) \??\r: gHost.exe File opened (read-only) \??\t: gHost.exe File opened (read-only) \??\v: gHost.exe -
Modifies WinLogon 2 TTPs 18 IoCs
Processes:
KHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exe4294637edeceeff8e5db5b9355fd260ad6015a53e0835290140507bbac969415.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Taskman = "C:\\Windows\\system32\\KHATRA.exe" KHATRA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Taskman = "C:\\Windows\\system32\\KHATRA.exe" KHATRA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Taskman = "C:\\Windows\\system32\\KHATRA.exe" KHATRA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Taskman = "C:\\Windows\\system32\\KHATRA.exe" KHATRA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Taskman = "C:\\Windows\\system32\\KHATRA.exe" KHATRA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Taskman = "C:\\Windows\\system32\\KHATRA.exe" KHATRA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Taskman = "C:\\Windows\\system32\\KHATRA.exe" KHATRA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Taskman = "C:\\Windows\\system32\\KHATRA.exe" 4294637edeceeff8e5db5b9355fd260ad6015a53e0835290140507bbac969415.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Taskman = "C:\\Windows\\system32\\KHATRA.exe" KHATRA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Taskman = "C:\\Windows\\system32\\KHATRA.exe" KHATRA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Taskman = "C:\\Windows\\system32\\KHATRA.exe" KHATRA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Taskman = "C:\\Windows\\system32\\KHATRA.exe" KHATRA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Taskman = "C:\\Windows\\system32\\KHATRA.exe" KHATRA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Taskman = "C:\\Windows\\system32\\KHATRA.exe" KHATRA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Taskman = "C:\\Windows\\system32\\KHATRA.exe" KHATRA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Taskman = "C:\\Windows\\system32\\KHATRA.exe" KHATRA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Taskman = "C:\\Windows\\system32\\KHATRA.exe" KHATRA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Taskman = "C:\\Windows\\system32\\KHATRA.exe" KHATRA.exe -
AutoIT Executable 36 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule behavioral2/memory/1520-136-0x0000000000400000-0x0000000000498000-memory.dmp autoit_exe behavioral2/memory/2372-147-0x0000000000400000-0x0000000000498000-memory.dmp autoit_exe behavioral2/memory/4128-148-0x0000000000400000-0x0000000000498000-memory.dmp autoit_exe behavioral2/memory/4596-178-0x0000000000400000-0x0000000000498000-memory.dmp autoit_exe behavioral2/memory/1520-177-0x0000000000400000-0x0000000000498000-memory.dmp autoit_exe behavioral2/memory/4132-182-0x0000000000400000-0x0000000000498000-memory.dmp autoit_exe behavioral2/memory/4132-194-0x0000000000400000-0x0000000000498000-memory.dmp autoit_exe behavioral2/memory/4884-203-0x0000000000400000-0x0000000000498000-memory.dmp autoit_exe behavioral2/memory/4884-210-0x0000000000400000-0x0000000000498000-memory.dmp autoit_exe behavioral2/memory/1264-213-0x0000000000400000-0x0000000000498000-memory.dmp autoit_exe behavioral2/memory/1264-226-0x0000000000400000-0x0000000000498000-memory.dmp autoit_exe behavioral2/memory/3208-230-0x0000000000400000-0x0000000000498000-memory.dmp autoit_exe behavioral2/memory/3208-242-0x0000000000400000-0x0000000000498000-memory.dmp autoit_exe behavioral2/memory/3132-250-0x0000000000400000-0x0000000000498000-memory.dmp autoit_exe behavioral2/memory/3132-258-0x0000000000400000-0x0000000000498000-memory.dmp autoit_exe behavioral2/memory/2252-263-0x0000000000400000-0x0000000000498000-memory.dmp autoit_exe behavioral2/memory/836-264-0x0000000000400000-0x0000000000498000-memory.dmp autoit_exe behavioral2/memory/836-265-0x0000000000400000-0x0000000000498000-memory.dmp autoit_exe behavioral2/memory/4652-266-0x0000000000400000-0x0000000000498000-memory.dmp autoit_exe behavioral2/memory/4652-267-0x0000000000400000-0x0000000000498000-memory.dmp autoit_exe behavioral2/memory/2544-268-0x0000000000400000-0x0000000000498000-memory.dmp autoit_exe behavioral2/memory/2544-269-0x0000000000400000-0x0000000000498000-memory.dmp autoit_exe behavioral2/memory/2372-270-0x0000000000400000-0x0000000000498000-memory.dmp autoit_exe behavioral2/memory/492-272-0x0000000000400000-0x0000000000498000-memory.dmp autoit_exe behavioral2/memory/4128-271-0x0000000000400000-0x0000000000498000-memory.dmp autoit_exe behavioral2/memory/492-273-0x0000000000400000-0x0000000000498000-memory.dmp autoit_exe behavioral2/memory/2392-274-0x0000000000400000-0x0000000000498000-memory.dmp autoit_exe behavioral2/memory/2392-275-0x0000000000400000-0x0000000000498000-memory.dmp autoit_exe behavioral2/memory/1512-276-0x0000000000400000-0x0000000000498000-memory.dmp autoit_exe behavioral2/memory/1512-277-0x0000000000400000-0x0000000000498000-memory.dmp autoit_exe behavioral2/memory/1784-278-0x0000000000400000-0x0000000000498000-memory.dmp autoit_exe behavioral2/memory/1784-279-0x0000000000400000-0x0000000000498000-memory.dmp autoit_exe behavioral2/memory/4344-280-0x0000000000400000-0x0000000000498000-memory.dmp autoit_exe behavioral2/memory/4344-281-0x0000000000400000-0x0000000000498000-memory.dmp autoit_exe behavioral2/memory/1120-282-0x0000000000400000-0x0000000000498000-memory.dmp autoit_exe behavioral2/memory/1120-283-0x0000000000400000-0x0000000000498000-memory.dmp autoit_exe -
Drops autorun.inf file 1 TTPs 17 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
Processes:
KHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exe4294637edeceeff8e5db5b9355fd260ad6015a53e0835290140507bbac969415.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exedescription ioc process File created C:\Users\Admin\Local Settings\Application Data\Microsoft\CD Burning\AUTORUN.inF KHATRA.exe File created C:\Users\Admin\Local Settings\Application Data\Microsoft\CD Burning\AUTORUN.inF KHATRA.exe File created C:\Users\Admin\Local Settings\Application Data\Microsoft\CD Burning\AUTORUN.inF KHATRA.exe File created C:\Users\Admin\Local Settings\Application Data\Microsoft\CD Burning\AUTORUN.inF KHATRA.exe File created C:\Users\Admin\Local Settings\Application Data\Microsoft\CD Burning\AUTORUN.inF 4294637edeceeff8e5db5b9355fd260ad6015a53e0835290140507bbac969415.exe File created C:\Users\Admin\Local Settings\Application Data\Microsoft\CD Burning\AUTORUN.inF KHATRA.exe File created C:\Users\Admin\Local Settings\Application Data\Microsoft\CD Burning\AUTORUN.inF KHATRA.exe File created C:\Users\Admin\Local Settings\Application Data\Microsoft\CD Burning\AUTORUN.inF KHATRA.exe File created C:\Users\Admin\Local Settings\Application Data\Microsoft\CD Burning\AUTORUN.inF KHATRA.exe File created C:\Users\Admin\Local Settings\Application Data\Microsoft\CD Burning\AUTORUN.inF KHATRA.exe File created C:\Users\Admin\Local Settings\Application Data\Microsoft\CD Burning\AUTORUN.inF KHATRA.exe File created C:\Users\Admin\Local Settings\Application Data\Microsoft\CD Burning\AUTORUN.inF KHATRA.exe File created C:\Users\Admin\Local Settings\Application Data\Microsoft\CD Burning\AUTORUN.inF KHATRA.exe File created C:\Users\Admin\Local Settings\Application Data\Microsoft\CD Burning\AUTORUN.inF KHATRA.exe File created C:\Users\Admin\Local Settings\Application Data\Microsoft\CD Burning\AUTORUN.inF KHATRA.exe File created C:\Users\Admin\Local Settings\Application Data\Microsoft\CD Burning\AUTORUN.inF KHATRA.exe File created C:\Users\Admin\Local Settings\Application Data\Microsoft\CD Burning\AUTORUN.inF KHATRA.exe -
Drops file in System32 directory 38 IoCs
Processes:
KHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exe4294637edeceeff8e5db5b9355fd260ad6015a53e0835290140507bbac969415.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exedescription ioc process File opened for modification C:\Windows\SysWOW64\KHATRA.exe KHATRA.exe File created C:\Windows\SysWOW64\KHATRA.exe KHATRA.exe File opened for modification C:\Windows\SysWOW64\KHATRA.exe KHATRA.exe File created C:\Windows\SysWOW64\KHATRA.exe KHATRA.exe File created C:\Windows\SysWOW64\KHATRA.exe KHATRA.exe File opened for modification C:\Windows\SysWOW64\KHATRA.exe KHATRA.exe File created C:\Windows\SysWOW64\KHATRA.exe KHATRA.exe File created C:\Windows\SysWOW64\KHATRA.exe KHATRA.exe File created C:\Windows\SysWOW64\KHATRA.exe KHATRA.exe File opened for modification C:\Windows\SysWOW64\KHATRA.exe KHATRA.exe File created C:\Windows\SysWOW64\KHATRA.exe KHATRA.exe File created C:\Windows\SysWOW64\KHATRA.exe KHATRA.exe File opened for modification C:\Windows\SysWOW64\KHATRA.exe KHATRA.exe File opened for modification C:\Windows\SysWOW64\KHATRA.exe KHATRA.exe File opened for modification C:\Windows\SysWOW64\KHATRA.exe KHATRA.exe File opened for modification C:\Windows\SysWOW64\KHATRA.exe KHATRA.exe File opened for modification C:\Windows\SysWOW64\KHATRA.exe KHATRA.exe File created C:\Windows\SysWOW64\KHATRA.exe 4294637edeceeff8e5db5b9355fd260ad6015a53e0835290140507bbac969415.exe File created C:\Windows\SysWOW64\KHATRA.exe KHATRA.exe File created C:\Windows\SysWOW64\KHATRA.exe KHATRA.exe File opened for modification C:\Windows\SysWOW64\KHATRA.exe KHATRA.exe File created C:\Windows\SysWOW64\KHATRA.exe KHATRA.exe File opened for modification C:\Windows\SysWOW64\KHATRA.exe 4294637edeceeff8e5db5b9355fd260ad6015a53e0835290140507bbac969415.exe File created C:\Windows\SysWOW64\avphost.dll 4294637edeceeff8e5db5b9355fd260ad6015a53e0835290140507bbac969415.exe File opened for modification C:\Windows\SysWOW64\avphost.dll 4294637edeceeff8e5db5b9355fd260ad6015a53e0835290140507bbac969415.exe File opened for modification C:\Windows\SysWOW64\KHATRA.exe KHATRA.exe File created C:\Windows\SysWOW64\KHATRA.exe KHATRA.exe File opened for modification C:\Windows\SysWOW64\KHATRA.exe KHATRA.exe File opened for modification C:\Windows\SysWOW64\KHATRA.exe KHATRA.exe File opened for modification C:\Windows\SysWOW64\KHATRA.exe KHATRA.exe File opened for modification C:\Windows\SysWOW64\KHATRA.exe KHATRA.exe File created C:\Windows\SysWOW64\KHATRA.exe KHATRA.exe File created C:\Windows\SysWOW64\KHATRA.exe KHATRA.exe File opened for modification C:\Windows\SysWOW64\KHATRA.exe KHATRA.exe File opened for modification C:\Windows\SysWOW64\avphost.dll KHATRA.exe File created C:\Windows\SysWOW64\KHATRA.exe KHATRA.exe File opened for modification C:\Windows\SysWOW64\KHATRA.exe KHATRA.exe File created C:\Windows\SysWOW64\KHATRA.exe KHATRA.exe -
Drops file in Windows directory 64 IoCs
Processes:
KHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exe4294637edeceeff8e5db5b9355fd260ad6015a53e0835290140507bbac969415.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exedescription ioc process File opened for modification C:\Windows\Xplorer.exe KHATRA.exe File opened for modification C:\Windows\Xplorer.exe KHATRA.exe File opened for modification C:\Windows\inf\Autoplay.inF KHATRA.exe File opened for modification C:\Windows\KHATARNAKH.exe KHATRA.exe File created C:\Windows\KHATARNAKH.exe KHATRA.exe File opened for modification C:\Windows\INF\Autoplay.inF KHATRA.exe File created C:\Windows\KHATARNAKH.exe KHATRA.exe File created C:\Windows\System\gHost.exe KHATRA.exe File opened for modification C:\Windows\KHATARNAKH.exe KHATRA.exe File opened for modification C:\Windows\inf\Autoplay.inF KHATRA.exe File opened for modification C:\Windows\INF\Autoplay.inF KHATRA.exe File opened for modification C:\Windows\KHATARNAKH.exe KHATRA.exe File opened for modification C:\Windows\inf\Autoplay.inF KHATRA.exe File opened for modification C:\Windows\Xplorer.exe KHATRA.exe File opened for modification C:\Windows\System\gHost.exe KHATRA.exe File opened for modification C:\Windows\INF\Autoplay.inF 4294637edeceeff8e5db5b9355fd260ad6015a53e0835290140507bbac969415.exe File created C:\Windows\System\gHost.exe KHATRA.exe File opened for modification C:\Windows\KHATARNAKH.exe KHATRA.exe File opened for modification C:\Windows\KHATARNAKH.exe KHATRA.exe File opened for modification C:\Windows\INF\Autoplay.inF KHATRA.exe File opened for modification C:\Windows\KHATARNAKH.exe KHATRA.exe File opened for modification C:\Windows\INF\Autoplay.inF KHATRA.exe File created C:\Windows\KHATARNAKH.exe 4294637edeceeff8e5db5b9355fd260ad6015a53e0835290140507bbac969415.exe File created C:\Windows\System\gHost.exe KHATRA.exe File opened for modification C:\Windows\KHATARNAKH.exe KHATRA.exe File created C:\Windows\System\gHost.exe KHATRA.exe File created C:\Windows\Xplorer.exe KHATRA.exe File opened for modification C:\Windows\INF\Autoplay.inF KHATRA.exe File opened for modification C:\Windows\inf\Autoplay.inF KHATRA.exe File opened for modification C:\Windows\Xplorer.exe 4294637edeceeff8e5db5b9355fd260ad6015a53e0835290140507bbac969415.exe File opened for modification C:\Windows\System\gHost.exe KHATRA.exe File created C:\Windows\KHATARNAKH.exe KHATRA.exe File created C:\Windows\System\gHost.exe KHATRA.exe File created C:\Windows\Xplorer.exe KHATRA.exe File created C:\Windows\Xplorer.exe KHATRA.exe File opened for modification C:\Windows\Xplorer.exe KHATRA.exe File created C:\Windows\Xplorer.exe KHATRA.exe File opened for modification C:\Windows\inf\Autoplay.inF KHATRA.exe File opened for modification C:\Windows\KHATARNAKH.exe KHATRA.exe File created C:\Windows\Xplorer.exe KHATRA.exe File opened for modification C:\Windows\Xplorer.exe KHATRA.exe File created C:\Windows\Xplorer.exe KHATRA.exe File created C:\Windows\Xplorer.exe KHATRA.exe File opened for modification C:\Windows\Xplorer.exe KHATRA.exe File created C:\Windows\System\gHost.exe KHATRA.exe File opened for modification C:\Windows\Xplorer.exe KHATRA.exe File created C:\Windows\KHATARNAKH.exe KHATRA.exe File created C:\Windows\KHATARNAKH.exe KHATRA.exe File opened for modification C:\Windows\inf\Autoplay.inF KHATRA.exe File created C:\Windows\Xplorer.exe KHATRA.exe File created C:\Windows\KHATARNAKH.exe KHATRA.exe File opened for modification C:\Windows\KHATARNAKH.exe KHATRA.exe File created C:\Windows\System\gHost.exe KHATRA.exe File opened for modification C:\Windows\System\gHost.exe KHATRA.exe File opened for modification C:\Windows\KHATARNAKH.exe KHATRA.exe File opened for modification C:\Windows\inf\Autoplay.inF KHATRA.exe File created C:\Windows\Xplorer.exe 4294637edeceeff8e5db5b9355fd260ad6015a53e0835290140507bbac969415.exe File opened for modification C:\Windows\KHATARNAKH.exe KHATRA.exe File created C:\Windows\System\gHost.exe KHATRA.exe File opened for modification C:\Windows\INF\Autoplay.inF KHATRA.exe File created C:\Windows\Xplorer.exe KHATRA.exe File created C:\Windows\KHATARNAKH.exe KHATRA.exe File created C:\Windows\Xplorer.exe KHATRA.exe File opened for modification C:\Windows\Xplorer.exe KHATRA.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Processes:
KHATRA.exeKHATRA.exeKHATRA.exe4294637edeceeff8e5db5b9355fd260ad6015a53e0835290140507bbac969415.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window Title = "Internet Exploiter" KHATRA.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Main KHATRA.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Main KHATRA.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Main 4294637edeceeff8e5db5b9355fd260ad6015a53e0835290140507bbac969415.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Main KHATRA.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window Title = "Internet Exploiter" KHATRA.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window Title = "Internet Exploiter" 4294637edeceeff8e5db5b9355fd260ad6015a53e0835290140507bbac969415.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window Title = "Internet Exploiter" KHATRA.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Main KHATRA.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window Title = "Internet Exploiter" KHATRA.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window Title = "Internet Exploiter" KHATRA.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Main KHATRA.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Main KHATRA.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window Title = "Internet Exploiter" KHATRA.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Main KHATRA.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Main KHATRA.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window Title = "Internet Exploiter" KHATRA.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window Title = "Internet Exploiter" KHATRA.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window Title = "Internet Exploiter" KHATRA.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Main KHATRA.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Main KHATRA.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Main KHATRA.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Main KHATRA.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window Title = "Internet Exploiter" KHATRA.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window Title = "Internet Exploiter" KHATRA.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Main KHATRA.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Main KHATRA.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Main KHATRA.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Main KHATRA.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window Title = "Internet Exploiter" KHATRA.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window Title = "Internet Exploiter" KHATRA.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window Title = "Internet Exploiter" KHATRA.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window Title = "Internet Exploiter" KHATRA.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window Title = "Internet Exploiter" KHATRA.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window Title = "Internet Exploiter" KHATRA.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Main KHATRA.exe -
Modifies registry class 64 IoCs
Processes:
regsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F8D07B72-B4B4-46A0-ACC0-C771D4614B82}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AOSMTP.FastSender\ = "FastSender Class" regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F8D07B72-B4B4-46A0-ACC0-C771D4614B82} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AOSMTP.FastSender.1\CLSID\ = "{69620165-77DD-44EE-995C-3632E525A22B}" regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F8D07B72-B4B4-46A0-ACC0-C771D4614B82}\VersionIndependentProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{69620165-77DD-44EE-995C-3632E525A22B} regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F8D07B72-B4B4-46A0-ACC0-C771D4614B82}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AOSMTP.FastSender\CurVer\ = "AOSMTP.FastSender.1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AOSMTP.Mail\CLSID\ = "{F8D07B72-B4B4-46A0-ACC0-C771D4614B82}" regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F8D07B72-B4B4-46A0-ACC0-C771D4614B82}\TypeLib regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F8D07B72-B4B4-46A0-ACC0-C771D4614B82}\ProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{69620165-77DD-44EE-995C-3632E525A22B}\ = "FastSender Class" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{69620165-77DD-44EE-995C-3632E525A22B}\InprocServer32\ = "C:\\Windows\\SysWow64\\avphost.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{69620165-77DD-44EE-995C-3632E525A22B}\VersionIndependentProgID\ = "AOSMTP.FastSender" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{69620165-77DD-44EE-995C-3632E525A22B}\InprocServer32\ = "C:\\Windows\\SysWow64\\avphost.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FF14B02B-6EE4-400F-A729-B0EA35F921C2}\1.0\HELPDIR\ = "C:\\Windows\\SysWow64\\" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F8D07B72-B4B4-46A0-ACC0-C771D4614B82}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AOSMTP.Mail.1\CLSID\ = "{F8D07B72-B4B4-46A0-ACC0-C771D4614B82}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F8D07B72-B4B4-46A0-ACC0-C771D4614B82}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F8D07B72-B4B4-46A0-ACC0-C771D4614B82}\TypeLib\ = "{FF14B02B-6EE4-400F-A729-B0EA35F921C2}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{69620165-77DD-44EE-995C-3632E525A22B}\ProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AOSMTP.Mail\ = "Mail Class" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FF14B02B-6EE4-400F-A729-B0EA35F921C2}\1.0\0 regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{69620165-77DD-44EE-995C-3632E525A22B}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F8D07B72-B4B4-46A0-ACC0-C771D4614B82}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F8D07B72-B4B4-46A0-ACC0-C771D4614B82}\Programmable regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F8D07B72-B4B4-46A0-ACC0-C771D4614B82}\Programmable regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{69620165-77DD-44EE-995C-3632E525A22B}\TypeLib regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{69620165-77DD-44EE-995C-3632E525A22B}\VersionIndependentProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F8D07B72-B4B4-46A0-ACC0-C771D4614B82}\VersionIndependentProgID regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{69620165-77DD-44EE-995C-3632E525A22B}\Programmable regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{69620165-77DD-44EE-995C-3632E525A22B}\ProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F8D07B72-B4B4-46A0-ACC0-C771D4614B82}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F8D07B72-B4B4-46A0-ACC0-C771D4614B82}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FF14B02B-6EE4-400F-A729-B0EA35F921C2}\1.0\0\win32\ = "C:\\Windows\\SysWow64\\avphost.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F8D07B72-B4B4-46A0-ACC0-C771D4614B82}\ProgID\ = "AOSMTP.Mail.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{69620165-77DD-44EE-995C-3632E525A22B}\Programmable regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F8D07B72-B4B4-46A0-ACC0-C771D4614B82}\ = "Mail Class" regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F8D07B72-B4B4-46A0-ACC0-C771D4614B82}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F8D07B72-B4B4-46A0-ACC0-C771D4614B82}\VersionIndependentProgID\ = "AOSMTP.Mail" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AOSMTP.FastSender\ = "FastSender Class" regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F8D07B72-B4B4-46A0-ACC0-C771D4614B82} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{69620165-77DD-44EE-995C-3632E525A22B}\ProgID\ = "AOSMTP.FastSender.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F8D07B72-B4B4-46A0-ACC0-C771D4614B82}\InprocServer32 regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F8D07B72-B4B4-46A0-ACC0-C771D4614B82}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F8D07B72-B4B4-46A0-ACC0-C771D4614B82}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F8D07B72-B4B4-46A0-ACC0-C771D4614B82}\InprocServer32\ = "C:\\Windows\\SysWow64\\avphost.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AOSMTP.Mail regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D622E87A-35F9-4FB2-AFEE-4F5BF8407C7A}\ = "_IFastSenderEvents" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{69620165-77DD-44EE-995C-3632E525A22B}\VersionIndependentProgID\ = "AOSMTP.FastSender" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F8D07B72-B4B4-46A0-ACC0-C771D4614B82}\InprocServer32\ = "C:\\Windows\\SysWow64\\avphost.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F8D07B72-B4B4-46A0-ACC0-C771D4614B82}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FF14B02B-6EE4-400F-A729-B0EA35F921C2}\1.0\HELPDIR\ = "C:\\Windows\\SysWow64\\" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{69620165-77DD-44EE-995C-3632E525A22B} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{63BD4EE4-660B-434D-A54B-7C1F53E2FEDD}\TypeLib\ = "{FF14B02B-6EE4-400F-A729-B0EA35F921C2}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AOSMTP.Mail\ = "Mail Class" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F8D07B72-B4B4-46A0-ACC0-C771D4614B82}\ProgID\ = "AOSMTP.Mail.1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1ECC44FB-970D-4BC8-90E3-002DA4DD21B8}\TypeLib\Version = "1.0" regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{69620165-77DD-44EE-995C-3632E525A22B}\TypeLib regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{69620165-77DD-44EE-995C-3632E525A22B}\Programmable regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F8D07B72-B4B4-46A0-ACC0-C771D4614B82} regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{69620165-77DD-44EE-995C-3632E525A22B}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{69620165-77DD-44EE-995C-3632E525A22B}\TypeLib regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{69620165-77DD-44EE-995C-3632E525A22B}\Programmable regsvr32.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
4294637edeceeff8e5db5b9355fd260ad6015a53e0835290140507bbac969415.exepid process 4596 4294637edeceeff8e5db5b9355fd260ad6015a53e0835290140507bbac969415.exe 4596 4294637edeceeff8e5db5b9355fd260ad6015a53e0835290140507bbac969415.exe 4596 4294637edeceeff8e5db5b9355fd260ad6015a53e0835290140507bbac969415.exe 4596 4294637edeceeff8e5db5b9355fd260ad6015a53e0835290140507bbac969415.exe 4596 4294637edeceeff8e5db5b9355fd260ad6015a53e0835290140507bbac969415.exe 4596 4294637edeceeff8e5db5b9355fd260ad6015a53e0835290140507bbac969415.exe 4596 4294637edeceeff8e5db5b9355fd260ad6015a53e0835290140507bbac969415.exe 4596 4294637edeceeff8e5db5b9355fd260ad6015a53e0835290140507bbac969415.exe 4596 4294637edeceeff8e5db5b9355fd260ad6015a53e0835290140507bbac969415.exe 4596 4294637edeceeff8e5db5b9355fd260ad6015a53e0835290140507bbac969415.exe 4596 4294637edeceeff8e5db5b9355fd260ad6015a53e0835290140507bbac969415.exe 4596 4294637edeceeff8e5db5b9355fd260ad6015a53e0835290140507bbac969415.exe 4596 4294637edeceeff8e5db5b9355fd260ad6015a53e0835290140507bbac969415.exe 4596 4294637edeceeff8e5db5b9355fd260ad6015a53e0835290140507bbac969415.exe 4596 4294637edeceeff8e5db5b9355fd260ad6015a53e0835290140507bbac969415.exe 4596 4294637edeceeff8e5db5b9355fd260ad6015a53e0835290140507bbac969415.exe 4596 4294637edeceeff8e5db5b9355fd260ad6015a53e0835290140507bbac969415.exe 4596 4294637edeceeff8e5db5b9355fd260ad6015a53e0835290140507bbac969415.exe 4596 4294637edeceeff8e5db5b9355fd260ad6015a53e0835290140507bbac969415.exe 4596 4294637edeceeff8e5db5b9355fd260ad6015a53e0835290140507bbac969415.exe 4596 4294637edeceeff8e5db5b9355fd260ad6015a53e0835290140507bbac969415.exe 4596 4294637edeceeff8e5db5b9355fd260ad6015a53e0835290140507bbac969415.exe 4596 4294637edeceeff8e5db5b9355fd260ad6015a53e0835290140507bbac969415.exe 4596 4294637edeceeff8e5db5b9355fd260ad6015a53e0835290140507bbac969415.exe 4596 4294637edeceeff8e5db5b9355fd260ad6015a53e0835290140507bbac969415.exe 4596 4294637edeceeff8e5db5b9355fd260ad6015a53e0835290140507bbac969415.exe 4596 4294637edeceeff8e5db5b9355fd260ad6015a53e0835290140507bbac969415.exe 4596 4294637edeceeff8e5db5b9355fd260ad6015a53e0835290140507bbac969415.exe 4596 4294637edeceeff8e5db5b9355fd260ad6015a53e0835290140507bbac969415.exe 4596 4294637edeceeff8e5db5b9355fd260ad6015a53e0835290140507bbac969415.exe 4596 4294637edeceeff8e5db5b9355fd260ad6015a53e0835290140507bbac969415.exe 4596 4294637edeceeff8e5db5b9355fd260ad6015a53e0835290140507bbac969415.exe 4596 4294637edeceeff8e5db5b9355fd260ad6015a53e0835290140507bbac969415.exe 4596 4294637edeceeff8e5db5b9355fd260ad6015a53e0835290140507bbac969415.exe 4596 4294637edeceeff8e5db5b9355fd260ad6015a53e0835290140507bbac969415.exe 4596 4294637edeceeff8e5db5b9355fd260ad6015a53e0835290140507bbac969415.exe 4596 4294637edeceeff8e5db5b9355fd260ad6015a53e0835290140507bbac969415.exe 4596 4294637edeceeff8e5db5b9355fd260ad6015a53e0835290140507bbac969415.exe 4596 4294637edeceeff8e5db5b9355fd260ad6015a53e0835290140507bbac969415.exe 4596 4294637edeceeff8e5db5b9355fd260ad6015a53e0835290140507bbac969415.exe 4596 4294637edeceeff8e5db5b9355fd260ad6015a53e0835290140507bbac969415.exe 4596 4294637edeceeff8e5db5b9355fd260ad6015a53e0835290140507bbac969415.exe 4596 4294637edeceeff8e5db5b9355fd260ad6015a53e0835290140507bbac969415.exe 4596 4294637edeceeff8e5db5b9355fd260ad6015a53e0835290140507bbac969415.exe 4596 4294637edeceeff8e5db5b9355fd260ad6015a53e0835290140507bbac969415.exe 4596 4294637edeceeff8e5db5b9355fd260ad6015a53e0835290140507bbac969415.exe 4596 4294637edeceeff8e5db5b9355fd260ad6015a53e0835290140507bbac969415.exe 4596 4294637edeceeff8e5db5b9355fd260ad6015a53e0835290140507bbac969415.exe 4596 4294637edeceeff8e5db5b9355fd260ad6015a53e0835290140507bbac969415.exe 4596 4294637edeceeff8e5db5b9355fd260ad6015a53e0835290140507bbac969415.exe 4596 4294637edeceeff8e5db5b9355fd260ad6015a53e0835290140507bbac969415.exe 4596 4294637edeceeff8e5db5b9355fd260ad6015a53e0835290140507bbac969415.exe 4596 4294637edeceeff8e5db5b9355fd260ad6015a53e0835290140507bbac969415.exe 4596 4294637edeceeff8e5db5b9355fd260ad6015a53e0835290140507bbac969415.exe 4596 4294637edeceeff8e5db5b9355fd260ad6015a53e0835290140507bbac969415.exe 4596 4294637edeceeff8e5db5b9355fd260ad6015a53e0835290140507bbac969415.exe 4596 4294637edeceeff8e5db5b9355fd260ad6015a53e0835290140507bbac969415.exe 4596 4294637edeceeff8e5db5b9355fd260ad6015a53e0835290140507bbac969415.exe 4596 4294637edeceeff8e5db5b9355fd260ad6015a53e0835290140507bbac969415.exe 4596 4294637edeceeff8e5db5b9355fd260ad6015a53e0835290140507bbac969415.exe 4596 4294637edeceeff8e5db5b9355fd260ad6015a53e0835290140507bbac969415.exe 4596 4294637edeceeff8e5db5b9355fd260ad6015a53e0835290140507bbac969415.exe 4596 4294637edeceeff8e5db5b9355fd260ad6015a53e0835290140507bbac969415.exe 4596 4294637edeceeff8e5db5b9355fd260ad6015a53e0835290140507bbac969415.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
Processes:
Xplorer.exegHost.exepid process 2372 Xplorer.exe 4128 gHost.exe -
Suspicious use of FindShellTrayWindow 35 IoCs
Processes:
4294637edeceeff8e5db5b9355fd260ad6015a53e0835290140507bbac969415.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exepid process 4596 4294637edeceeff8e5db5b9355fd260ad6015a53e0835290140507bbac969415.exe 1520 KHATRA.exe 4596 4294637edeceeff8e5db5b9355fd260ad6015a53e0835290140507bbac969415.exe 1520 KHATRA.exe 4132 KHATRA.exe 4132 KHATRA.exe 4884 KHATRA.exe 4884 KHATRA.exe 1264 KHATRA.exe 1264 KHATRA.exe 3208 KHATRA.exe 3208 KHATRA.exe 3132 KHATRA.exe 3132 KHATRA.exe 2252 KHATRA.exe 2252 KHATRA.exe 836 KHATRA.exe 836 KHATRA.exe 4652 KHATRA.exe 4652 KHATRA.exe 2544 KHATRA.exe 2544 KHATRA.exe 492 KHATRA.exe 492 KHATRA.exe 2392 KHATRA.exe 2392 KHATRA.exe 1512 KHATRA.exe 1512 KHATRA.exe 1784 KHATRA.exe 1784 KHATRA.exe 4344 KHATRA.exe 4344 KHATRA.exe 1120 KHATRA.exe 1120 KHATRA.exe 3828 KHATRA.exe -
Suspicious use of SendNotifyMessage 35 IoCs
Processes:
4294637edeceeff8e5db5b9355fd260ad6015a53e0835290140507bbac969415.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exepid process 4596 4294637edeceeff8e5db5b9355fd260ad6015a53e0835290140507bbac969415.exe 1520 KHATRA.exe 4596 4294637edeceeff8e5db5b9355fd260ad6015a53e0835290140507bbac969415.exe 1520 KHATRA.exe 4132 KHATRA.exe 4132 KHATRA.exe 4884 KHATRA.exe 4884 KHATRA.exe 1264 KHATRA.exe 1264 KHATRA.exe 3208 KHATRA.exe 3208 KHATRA.exe 3132 KHATRA.exe 3132 KHATRA.exe 2252 KHATRA.exe 2252 KHATRA.exe 836 KHATRA.exe 836 KHATRA.exe 4652 KHATRA.exe 4652 KHATRA.exe 2544 KHATRA.exe 2544 KHATRA.exe 492 KHATRA.exe 492 KHATRA.exe 2392 KHATRA.exe 2392 KHATRA.exe 1512 KHATRA.exe 1512 KHATRA.exe 1784 KHATRA.exe 1784 KHATRA.exe 4344 KHATRA.exe 4344 KHATRA.exe 1120 KHATRA.exe 1120 KHATRA.exe 3828 KHATRA.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
4294637edeceeff8e5db5b9355fd260ad6015a53e0835290140507bbac969415.exeKHATRA.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.exeXplorer.exeKHATRA.execmd.exedescription pid process target process PID 4596 wrote to memory of 1520 4596 4294637edeceeff8e5db5b9355fd260ad6015a53e0835290140507bbac969415.exe KHATRA.exe PID 4596 wrote to memory of 1520 4596 4294637edeceeff8e5db5b9355fd260ad6015a53e0835290140507bbac969415.exe KHATRA.exe PID 4596 wrote to memory of 1520 4596 4294637edeceeff8e5db5b9355fd260ad6015a53e0835290140507bbac969415.exe KHATRA.exe PID 1520 wrote to memory of 2372 1520 KHATRA.exe Xplorer.exe PID 1520 wrote to memory of 2372 1520 KHATRA.exe Xplorer.exe PID 1520 wrote to memory of 2372 1520 KHATRA.exe Xplorer.exe PID 4596 wrote to memory of 4128 4596 4294637edeceeff8e5db5b9355fd260ad6015a53e0835290140507bbac969415.exe gHost.exe PID 4596 wrote to memory of 4128 4596 4294637edeceeff8e5db5b9355fd260ad6015a53e0835290140507bbac969415.exe gHost.exe PID 4596 wrote to memory of 4128 4596 4294637edeceeff8e5db5b9355fd260ad6015a53e0835290140507bbac969415.exe gHost.exe PID 1520 wrote to memory of 176 1520 KHATRA.exe cmd.exe PID 1520 wrote to memory of 176 1520 KHATRA.exe cmd.exe PID 1520 wrote to memory of 176 1520 KHATRA.exe cmd.exe PID 4596 wrote to memory of 316 4596 4294637edeceeff8e5db5b9355fd260ad6015a53e0835290140507bbac969415.exe cmd.exe PID 4596 wrote to memory of 316 4596 4294637edeceeff8e5db5b9355fd260ad6015a53e0835290140507bbac969415.exe cmd.exe PID 4596 wrote to memory of 316 4596 4294637edeceeff8e5db5b9355fd260ad6015a53e0835290140507bbac969415.exe cmd.exe PID 316 wrote to memory of 3076 316 cmd.exe at.exe PID 316 wrote to memory of 3076 316 cmd.exe at.exe PID 316 wrote to memory of 3076 316 cmd.exe at.exe PID 176 wrote to memory of 480 176 cmd.exe at.exe PID 176 wrote to memory of 480 176 cmd.exe at.exe PID 176 wrote to memory of 480 176 cmd.exe at.exe PID 4596 wrote to memory of 3472 4596 4294637edeceeff8e5db5b9355fd260ad6015a53e0835290140507bbac969415.exe cmd.exe PID 4596 wrote to memory of 3472 4596 4294637edeceeff8e5db5b9355fd260ad6015a53e0835290140507bbac969415.exe cmd.exe PID 4596 wrote to memory of 3472 4596 4294637edeceeff8e5db5b9355fd260ad6015a53e0835290140507bbac969415.exe cmd.exe PID 1520 wrote to memory of 1076 1520 KHATRA.exe cmd.exe PID 1520 wrote to memory of 1076 1520 KHATRA.exe cmd.exe PID 1520 wrote to memory of 1076 1520 KHATRA.exe cmd.exe PID 3472 wrote to memory of 3196 3472 cmd.exe at.exe PID 3472 wrote to memory of 3196 3472 cmd.exe at.exe PID 3472 wrote to memory of 3196 3472 cmd.exe at.exe PID 1076 wrote to memory of 1844 1076 cmd.exe at.exe PID 1076 wrote to memory of 1844 1076 cmd.exe at.exe PID 1076 wrote to memory of 1844 1076 cmd.exe at.exe PID 4596 wrote to memory of 2584 4596 4294637edeceeff8e5db5b9355fd260ad6015a53e0835290140507bbac969415.exe cmd.exe PID 4596 wrote to memory of 2584 4596 4294637edeceeff8e5db5b9355fd260ad6015a53e0835290140507bbac969415.exe cmd.exe PID 4596 wrote to memory of 2584 4596 4294637edeceeff8e5db5b9355fd260ad6015a53e0835290140507bbac969415.exe cmd.exe PID 1520 wrote to memory of 2128 1520 KHATRA.exe cmd.exe PID 1520 wrote to memory of 2128 1520 KHATRA.exe cmd.exe PID 1520 wrote to memory of 2128 1520 KHATRA.exe cmd.exe PID 2584 wrote to memory of 1836 2584 cmd.exe regsvr32.exe PID 2584 wrote to memory of 1836 2584 cmd.exe regsvr32.exe PID 2584 wrote to memory of 1836 2584 cmd.exe regsvr32.exe PID 2128 wrote to memory of 1956 2128 cmd.exe regsvr32.exe PID 2128 wrote to memory of 1956 2128 cmd.exe regsvr32.exe PID 2128 wrote to memory of 1956 2128 cmd.exe regsvr32.exe PID 1520 wrote to memory of 2544 1520 KHATRA.exe cmd.exe PID 1520 wrote to memory of 2544 1520 KHATRA.exe cmd.exe PID 1520 wrote to memory of 2544 1520 KHATRA.exe cmd.exe PID 4596 wrote to memory of 2428 4596 4294637edeceeff8e5db5b9355fd260ad6015a53e0835290140507bbac969415.exe cmd.exe PID 4596 wrote to memory of 2428 4596 4294637edeceeff8e5db5b9355fd260ad6015a53e0835290140507bbac969415.exe cmd.exe PID 4596 wrote to memory of 2428 4596 4294637edeceeff8e5db5b9355fd260ad6015a53e0835290140507bbac969415.exe cmd.exe PID 2428 wrote to memory of 4504 2428 cmd.exe netsh.exe PID 2428 wrote to memory of 4504 2428 cmd.exe netsh.exe PID 2428 wrote to memory of 4504 2428 cmd.exe netsh.exe PID 2544 wrote to memory of 3820 2544 cmd.exe netsh.exe PID 2544 wrote to memory of 3820 2544 cmd.exe netsh.exe PID 2544 wrote to memory of 3820 2544 cmd.exe netsh.exe PID 2372 wrote to memory of 4132 2372 Xplorer.exe KHATRA.exe PID 2372 wrote to memory of 4132 2372 Xplorer.exe KHATRA.exe PID 2372 wrote to memory of 4132 2372 Xplorer.exe KHATRA.exe PID 4132 wrote to memory of 3168 4132 KHATRA.exe cmd.exe PID 4132 wrote to memory of 3168 4132 KHATRA.exe cmd.exe PID 4132 wrote to memory of 3168 4132 KHATRA.exe cmd.exe PID 3168 wrote to memory of 4792 3168 cmd.exe at.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4294637edeceeff8e5db5b9355fd260ad6015a53e0835290140507bbac969415.exe"C:\Users\Admin\AppData\Local\Temp\4294637edeceeff8e5db5b9355fd260ad6015a53e0835290140507bbac969415.exe"1⤵
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Adds Run key to start application
- Modifies WinLogon
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\KHATRA.exeC:\Windows\system32\KHATRA.exe2⤵
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Executes dropped EXE
- Adds Run key to start application
- Modifies WinLogon
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\Xplorer.exe"C:\Windows\Xplorer.exe" /Windows3⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\KHATRA.exeC:\Windows\system32\KHATRA.exe4⤵
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Executes dropped EXE
- Adds Run key to start application
- Modifies WinLogon
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C AT /delete /yes5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\at.exeAT /delete /yes6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe5⤵
-
C:\Windows\SysWOW64\at.exeAT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C RegSvr32 /S C:\Windows\system32\avphost.dll5⤵
-
C:\Windows\SysWOW64\regsvr32.exeRegSvr32 /S C:\Windows\system32\avphost.dll6⤵
- Loads dropped DLL
- Modifies registry class
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System5⤵
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System6⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\KHATRA.exeC:\Windows\system32\KHATRA.exe4⤵
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Executes dropped EXE
- Adds Run key to start application
- Modifies WinLogon
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C AT /delete /yes5⤵
-
C:\Windows\SysWOW64\at.exeAT /delete /yes6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe5⤵
-
C:\Windows\SysWOW64\at.exeAT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C RegSvr32 /S C:\Windows\system32\avphost.dll5⤵
-
C:\Windows\SysWOW64\regsvr32.exeRegSvr32 /S C:\Windows\system32\avphost.dll6⤵
- Loads dropped DLL
- Modifies registry class
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System5⤵
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System6⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\KHATRA.exeC:\Windows\system32\KHATRA.exe4⤵
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Executes dropped EXE
- Adds Run key to start application
- Modifies WinLogon
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C AT /delete /yes5⤵
-
C:\Windows\SysWOW64\at.exeAT /delete /yes6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe5⤵
-
C:\Windows\SysWOW64\at.exeAT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C RegSvr32 /S C:\Windows\system32\avphost.dll5⤵
-
C:\Windows\SysWOW64\regsvr32.exeRegSvr32 /S C:\Windows\system32\avphost.dll6⤵
- Loads dropped DLL
- Modifies registry class
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System5⤵
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System6⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\KHATRA.exeC:\Windows\system32\KHATRA.exe4⤵
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Executes dropped EXE
- Adds Run key to start application
- Modifies WinLogon
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C AT /delete /yes5⤵
-
C:\Windows\SysWOW64\at.exeAT /delete /yes6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe5⤵
-
C:\Windows\SysWOW64\at.exeAT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C RegSvr32 /S C:\Windows\system32\avphost.dll5⤵
-
C:\Windows\SysWOW64\regsvr32.exeRegSvr32 /S C:\Windows\system32\avphost.dll6⤵
- Loads dropped DLL
- Modifies registry class
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System5⤵
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System6⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\KHATRA.exeC:\Windows\system32\KHATRA.exe4⤵
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Executes dropped EXE
- Adds Run key to start application
- Modifies WinLogon
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C AT /delete /yes5⤵
-
C:\Windows\SysWOW64\at.exeAT /delete /yes6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe5⤵
-
C:\Windows\SysWOW64\at.exeAT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C RegSvr32 /S C:\Windows\system32\avphost.dll5⤵
-
C:\Windows\SysWOW64\regsvr32.exeRegSvr32 /S C:\Windows\system32\avphost.dll6⤵
- Loads dropped DLL
- Modifies registry class
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System5⤵
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System6⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\KHATRA.exeC:\Windows\system32\KHATRA.exe4⤵
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Executes dropped EXE
- Adds Run key to start application
- Modifies WinLogon
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C AT /delete /yes5⤵
-
C:\Windows\SysWOW64\at.exeAT /delete /yes6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe5⤵
-
C:\Windows\SysWOW64\at.exeAT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C RegSvr32 /S C:\Windows\system32\avphost.dll5⤵
-
C:\Windows\SysWOW64\regsvr32.exeRegSvr32 /S C:\Windows\system32\avphost.dll6⤵
- Loads dropped DLL
- Modifies registry class
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System5⤵
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System6⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\KHATRA.exeC:\Windows\system32\KHATRA.exe4⤵
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Executes dropped EXE
- Adds Run key to start application
- Modifies WinLogon
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C AT /delete /yes5⤵
-
C:\Windows\SysWOW64\at.exeAT /delete /yes6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe5⤵
-
C:\Windows\SysWOW64\at.exeAT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C RegSvr32 /S C:\Windows\system32\avphost.dll5⤵
-
C:\Windows\SysWOW64\regsvr32.exeRegSvr32 /S C:\Windows\system32\avphost.dll6⤵
- Loads dropped DLL
- Modifies registry class
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System5⤵
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System6⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\KHATRA.exeC:\Windows\system32\KHATRA.exe4⤵
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Executes dropped EXE
- Adds Run key to start application
- Modifies WinLogon
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C AT /delete /yes5⤵
-
C:\Windows\SysWOW64\at.exeAT /delete /yes6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe5⤵
-
C:\Windows\SysWOW64\at.exeAT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C RegSvr32 /S C:\Windows\system32\avphost.dll5⤵
-
C:\Windows\SysWOW64\regsvr32.exeRegSvr32 /S C:\Windows\system32\avphost.dll6⤵
- Loads dropped DLL
- Modifies registry class
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System5⤵
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System6⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\KHATRA.exeC:\Windows\system32\KHATRA.exe4⤵
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Executes dropped EXE
- Adds Run key to start application
- Modifies WinLogon
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C AT /delete /yes5⤵
-
C:\Windows\SysWOW64\at.exeAT /delete /yes6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe5⤵
-
C:\Windows\SysWOW64\at.exeAT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C RegSvr32 /S C:\Windows\system32\avphost.dll5⤵
-
C:\Windows\SysWOW64\regsvr32.exeRegSvr32 /S C:\Windows\system32\avphost.dll6⤵
- Loads dropped DLL
- Modifies registry class
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System5⤵
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System6⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\KHATRA.exeC:\Windows\system32\KHATRA.exe4⤵
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Executes dropped EXE
- Adds Run key to start application
- Modifies WinLogon
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C AT /delete /yes5⤵
-
C:\Windows\SysWOW64\at.exeAT /delete /yes6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe5⤵
-
C:\Windows\SysWOW64\at.exeAT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C RegSvr32 /S C:\Windows\system32\avphost.dll5⤵
-
C:\Windows\SysWOW64\regsvr32.exeRegSvr32 /S C:\Windows\system32\avphost.dll6⤵
- Loads dropped DLL
- Modifies registry class
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System5⤵
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System6⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\KHATRA.exeC:\Windows\system32\KHATRA.exe4⤵
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Executes dropped EXE
- Adds Run key to start application
- Modifies WinLogon
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C AT /delete /yes5⤵
-
C:\Windows\SysWOW64\at.exeAT /delete /yes6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe5⤵
-
C:\Windows\SysWOW64\at.exeAT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C RegSvr32 /S C:\Windows\system32\avphost.dll5⤵
-
C:\Windows\SysWOW64\regsvr32.exeRegSvr32 /S C:\Windows\system32\avphost.dll6⤵
- Loads dropped DLL
- Modifies registry class
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System5⤵
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System6⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\KHATRA.exeC:\Windows\system32\KHATRA.exe4⤵
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Executes dropped EXE
- Adds Run key to start application
- Modifies WinLogon
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C AT /delete /yes5⤵
-
C:\Windows\SysWOW64\at.exeAT /delete /yes6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe5⤵
-
C:\Windows\SysWOW64\at.exeAT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C RegSvr32 /S C:\Windows\system32\avphost.dll5⤵
-
C:\Windows\SysWOW64\regsvr32.exeRegSvr32 /S C:\Windows\system32\avphost.dll6⤵
- Loads dropped DLL
- Modifies registry class
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System5⤵
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System6⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\KHATRA.exeC:\Windows\system32\KHATRA.exe4⤵
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Executes dropped EXE
- Adds Run key to start application
- Modifies WinLogon
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C AT /delete /yes5⤵
-
C:\Windows\SysWOW64\at.exeAT /delete /yes6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe5⤵
-
C:\Windows\SysWOW64\at.exeAT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C RegSvr32 /S C:\Windows\system32\avphost.dll5⤵
-
C:\Windows\SysWOW64\regsvr32.exeRegSvr32 /S C:\Windows\system32\avphost.dll6⤵
- Loads dropped DLL
- Modifies registry class
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System5⤵
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System6⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\KHATRA.exeC:\Windows\system32\KHATRA.exe4⤵
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Executes dropped EXE
- Adds Run key to start application
- Modifies WinLogon
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C AT /delete /yes5⤵
-
C:\Windows\SysWOW64\at.exeAT /delete /yes6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe5⤵
-
C:\Windows\SysWOW64\at.exeAT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C RegSvr32 /S C:\Windows\system32\avphost.dll5⤵
-
C:\Windows\SysWOW64\regsvr32.exeRegSvr32 /S C:\Windows\system32\avphost.dll6⤵
- Loads dropped DLL
- Modifies registry class
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System5⤵
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System6⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\KHATRA.exeC:\Windows\system32\KHATRA.exe4⤵
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Executes dropped EXE
- Adds Run key to start application
- Modifies WinLogon
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C AT /delete /yes5⤵
-
C:\Windows\SysWOW64\at.exeAT /delete /yes6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C AT /delete /yes3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\at.exeAT /delete /yes4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\at.exeAT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C RegSvr32 /S C:\Windows\system32\avphost.dll3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exeRegSvr32 /S C:\Windows\system32\avphost.dll4⤵
- Loads dropped DLL
- Modifies registry class
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System4⤵
- Modifies Windows Firewall
-
C:\Windows\System\gHost.exe"C:\Windows\System\gHost.exe" /Reproduce2⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious behavior: GetForegroundWindowSpam
-
C:\Windows\SysWOW64\KHATRA.exeC:\Windows\system32\KHATRA.exe3⤵
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Executes dropped EXE
- Adds Run key to start application
- Modifies WinLogon
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C AT /delete /yes4⤵
-
C:\Windows\SysWOW64\at.exeAT /delete /yes5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe4⤵
-
C:\Windows\SysWOW64\at.exeAT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C RegSvr32 /S C:\Windows\system32\avphost.dll4⤵
-
C:\Windows\SysWOW64\regsvr32.exeRegSvr32 /S C:\Windows\system32\avphost.dll5⤵
- Loads dropped DLL
- Modifies registry class
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System4⤵
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System5⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C AT /delete /yes2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\at.exeAT /delete /yes3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\at.exeAT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C RegSvr32 /S C:\Windows\system32\avphost.dll2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exeRegSvr32 /S C:\Windows\system32\avphost.dll3⤵
- Loads dropped DLL
- Modifies registry class
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System3⤵
- Modifies Windows Firewall
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\(Empty).LNKMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\(Empty).LNKFilesize
1KB
MD5c12acab3a85f3c1e09b642410a58d718
SHA1df0d4ac1b255ab81e49fd260c43c3810a3ea8512
SHA25694511b2fe81868ff3973d5c22d02661dee7fb97daf001c0db7eb32425cb0d93c
SHA512dbccbaee6bb7de14681d708d69de548050a5ee4cac4d7476cf3a212216ca9c000e885a26269742e9fc5ce39077cee2203097b0037f19ea3f9c8cca8d2667a75b
-
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\(Empty).LNKFilesize
1KB
MD50f22fffb7310acf9850da90a5b4cf6e1
SHA1c05cadc4422d7ea92fb10885c69da5f8a564ea3d
SHA25678ceca811979bcd1c60e996d9dad596a8f7b08f8d89b3f1e26f11d23beffeb04
SHA512f7bf931a5e33a6e6f61ce9ade12d17270f5bc8d0165d55929f48c7be178e24ef067d91900f51a6f92bfcaaaab27d5177cd370d8304aa8f2163dbe14a530c3176
-
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\(Empty).LNKMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\(Empty).LNKMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\(Empty).LNKMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\(Empty).LNKFilesize
1KB
MD5d4789419f0fa4d5e059c154540eb59a2
SHA1b1fb7dd086634e3b1f9596e70fdba82d05095f54
SHA25677762a586f4c6aa6e9fda279afdc8315fbb2f060160a59587ce21bb5c4ad9158
SHA512d8790941ec10638137ec40671327669206e0b8123941418abab16cf9d0613c95d212d20fc8257cf24bd81d0763865667a8ecb72854509da9d3e8871916262c9e
-
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\(Empty).LNKMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\(Empty).LNKMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
C:\Users\Admin\Documents\My Music.exeFilesize
457KB
MD54303740f657093a0dbcc65ffb1896700
SHA141f6fc777321df9088b468b7a233dfc27276b343
SHA2564294637edeceeff8e5db5b9355fd260ad6015a53e0835290140507bbac969415
SHA512eb46a6f36ea29eb987b115c83ba6f4211f03978454a33edb0bea01c8d5845791b7821e7ed23a73c2683eb2447f28cf039c2ae103c550d20122254f6767da7cda
-
C:\Users\Admin\Documents\My Videos\My Videos.exeFilesize
457KB
MD54303740f657093a0dbcc65ffb1896700
SHA141f6fc777321df9088b468b7a233dfc27276b343
SHA2564294637edeceeff8e5db5b9355fd260ad6015a53e0835290140507bbac969415
SHA512eb46a6f36ea29eb987b115c83ba6f4211f03978454a33edb0bea01c8d5845791b7821e7ed23a73c2683eb2447f28cf039c2ae103c550d20122254f6767da7cda
-
C:\Windows\KHATARNAKH.exeFilesize
457KB
MD54303740f657093a0dbcc65ffb1896700
SHA141f6fc777321df9088b468b7a233dfc27276b343
SHA2564294637edeceeff8e5db5b9355fd260ad6015a53e0835290140507bbac969415
SHA512eb46a6f36ea29eb987b115c83ba6f4211f03978454a33edb0bea01c8d5845791b7821e7ed23a73c2683eb2447f28cf039c2ae103c550d20122254f6767da7cda
-
C:\Windows\KHATARNAKH.exeFilesize
457KB
MD54303740f657093a0dbcc65ffb1896700
SHA141f6fc777321df9088b468b7a233dfc27276b343
SHA2564294637edeceeff8e5db5b9355fd260ad6015a53e0835290140507bbac969415
SHA512eb46a6f36ea29eb987b115c83ba6f4211f03978454a33edb0bea01c8d5845791b7821e7ed23a73c2683eb2447f28cf039c2ae103c550d20122254f6767da7cda
-
C:\Windows\KHATARNAKH.exeFilesize
457KB
MD54303740f657093a0dbcc65ffb1896700
SHA141f6fc777321df9088b468b7a233dfc27276b343
SHA2564294637edeceeff8e5db5b9355fd260ad6015a53e0835290140507bbac969415
SHA512eb46a6f36ea29eb987b115c83ba6f4211f03978454a33edb0bea01c8d5845791b7821e7ed23a73c2683eb2447f28cf039c2ae103c550d20122254f6767da7cda
-
C:\Windows\KHATARNAKH.exeFilesize
457KB
MD54303740f657093a0dbcc65ffb1896700
SHA141f6fc777321df9088b468b7a233dfc27276b343
SHA2564294637edeceeff8e5db5b9355fd260ad6015a53e0835290140507bbac969415
SHA512eb46a6f36ea29eb987b115c83ba6f4211f03978454a33edb0bea01c8d5845791b7821e7ed23a73c2683eb2447f28cf039c2ae103c550d20122254f6767da7cda
-
C:\Windows\KHATARNAKH.exeFilesize
457KB
MD54303740f657093a0dbcc65ffb1896700
SHA141f6fc777321df9088b468b7a233dfc27276b343
SHA2564294637edeceeff8e5db5b9355fd260ad6015a53e0835290140507bbac969415
SHA512eb46a6f36ea29eb987b115c83ba6f4211f03978454a33edb0bea01c8d5845791b7821e7ed23a73c2683eb2447f28cf039c2ae103c550d20122254f6767da7cda
-
C:\Windows\KHATARNAKH.exeFilesize
457KB
MD54303740f657093a0dbcc65ffb1896700
SHA141f6fc777321df9088b468b7a233dfc27276b343
SHA2564294637edeceeff8e5db5b9355fd260ad6015a53e0835290140507bbac969415
SHA512eb46a6f36ea29eb987b115c83ba6f4211f03978454a33edb0bea01c8d5845791b7821e7ed23a73c2683eb2447f28cf039c2ae103c550d20122254f6767da7cda
-
C:\Windows\KHATARNAKH.exeFilesize
457KB
MD54303740f657093a0dbcc65ffb1896700
SHA141f6fc777321df9088b468b7a233dfc27276b343
SHA2564294637edeceeff8e5db5b9355fd260ad6015a53e0835290140507bbac969415
SHA512eb46a6f36ea29eb987b115c83ba6f4211f03978454a33edb0bea01c8d5845791b7821e7ed23a73c2683eb2447f28cf039c2ae103c550d20122254f6767da7cda
-
C:\Windows\KHATARNAKH.exeFilesize
457KB
MD54303740f657093a0dbcc65ffb1896700
SHA141f6fc777321df9088b468b7a233dfc27276b343
SHA2564294637edeceeff8e5db5b9355fd260ad6015a53e0835290140507bbac969415
SHA512eb46a6f36ea29eb987b115c83ba6f4211f03978454a33edb0bea01c8d5845791b7821e7ed23a73c2683eb2447f28cf039c2ae103c550d20122254f6767da7cda
-
C:\Windows\SysWOW64\KHATRA.exeFilesize
457KB
MD54303740f657093a0dbcc65ffb1896700
SHA141f6fc777321df9088b468b7a233dfc27276b343
SHA2564294637edeceeff8e5db5b9355fd260ad6015a53e0835290140507bbac969415
SHA512eb46a6f36ea29eb987b115c83ba6f4211f03978454a33edb0bea01c8d5845791b7821e7ed23a73c2683eb2447f28cf039c2ae103c550d20122254f6767da7cda
-
C:\Windows\SysWOW64\KHATRA.exeFilesize
457KB
MD54303740f657093a0dbcc65ffb1896700
SHA141f6fc777321df9088b468b7a233dfc27276b343
SHA2564294637edeceeff8e5db5b9355fd260ad6015a53e0835290140507bbac969415
SHA512eb46a6f36ea29eb987b115c83ba6f4211f03978454a33edb0bea01c8d5845791b7821e7ed23a73c2683eb2447f28cf039c2ae103c550d20122254f6767da7cda
-
C:\Windows\SysWOW64\KHATRA.exeFilesize
457KB
MD54303740f657093a0dbcc65ffb1896700
SHA141f6fc777321df9088b468b7a233dfc27276b343
SHA2564294637edeceeff8e5db5b9355fd260ad6015a53e0835290140507bbac969415
SHA512eb46a6f36ea29eb987b115c83ba6f4211f03978454a33edb0bea01c8d5845791b7821e7ed23a73c2683eb2447f28cf039c2ae103c550d20122254f6767da7cda
-
C:\Windows\SysWOW64\KHATRA.exeFilesize
457KB
MD54303740f657093a0dbcc65ffb1896700
SHA141f6fc777321df9088b468b7a233dfc27276b343
SHA2564294637edeceeff8e5db5b9355fd260ad6015a53e0835290140507bbac969415
SHA512eb46a6f36ea29eb987b115c83ba6f4211f03978454a33edb0bea01c8d5845791b7821e7ed23a73c2683eb2447f28cf039c2ae103c550d20122254f6767da7cda
-
C:\Windows\SysWOW64\KHATRA.exeFilesize
457KB
MD54303740f657093a0dbcc65ffb1896700
SHA141f6fc777321df9088b468b7a233dfc27276b343
SHA2564294637edeceeff8e5db5b9355fd260ad6015a53e0835290140507bbac969415
SHA512eb46a6f36ea29eb987b115c83ba6f4211f03978454a33edb0bea01c8d5845791b7821e7ed23a73c2683eb2447f28cf039c2ae103c550d20122254f6767da7cda
-
C:\Windows\SysWOW64\KHATRA.exeFilesize
457KB
MD54303740f657093a0dbcc65ffb1896700
SHA141f6fc777321df9088b468b7a233dfc27276b343
SHA2564294637edeceeff8e5db5b9355fd260ad6015a53e0835290140507bbac969415
SHA512eb46a6f36ea29eb987b115c83ba6f4211f03978454a33edb0bea01c8d5845791b7821e7ed23a73c2683eb2447f28cf039c2ae103c550d20122254f6767da7cda
-
C:\Windows\SysWOW64\KHATRA.exeFilesize
457KB
MD54303740f657093a0dbcc65ffb1896700
SHA141f6fc777321df9088b468b7a233dfc27276b343
SHA2564294637edeceeff8e5db5b9355fd260ad6015a53e0835290140507bbac969415
SHA512eb46a6f36ea29eb987b115c83ba6f4211f03978454a33edb0bea01c8d5845791b7821e7ed23a73c2683eb2447f28cf039c2ae103c550d20122254f6767da7cda
-
C:\Windows\SysWOW64\KHATRA.exeFilesize
457KB
MD54303740f657093a0dbcc65ffb1896700
SHA141f6fc777321df9088b468b7a233dfc27276b343
SHA2564294637edeceeff8e5db5b9355fd260ad6015a53e0835290140507bbac969415
SHA512eb46a6f36ea29eb987b115c83ba6f4211f03978454a33edb0bea01c8d5845791b7821e7ed23a73c2683eb2447f28cf039c2ae103c550d20122254f6767da7cda
-
C:\Windows\SysWOW64\avphost.dllFilesize
127KB
MD5d47ebd342b6906a2fda10d70560bcd5a
SHA1c1b54deb14d47e539bc6aea1464edb38fad4b87f
SHA25600a035dd63d4b26ab23ab122899767da8452bf262f61a06f9136513d841feaf2
SHA512626b00fb28e2b13b6f8fa393051e07da2eb937a164d87affdaac8f9be8aaa02cd3230c5c27648526ecdd1cad8b198f4d7c12f30dd362bf15011d04cadb17e8d1
-
C:\Windows\SysWOW64\avphost.dllFilesize
127KB
MD5d47ebd342b6906a2fda10d70560bcd5a
SHA1c1b54deb14d47e539bc6aea1464edb38fad4b87f
SHA25600a035dd63d4b26ab23ab122899767da8452bf262f61a06f9136513d841feaf2
SHA512626b00fb28e2b13b6f8fa393051e07da2eb937a164d87affdaac8f9be8aaa02cd3230c5c27648526ecdd1cad8b198f4d7c12f30dd362bf15011d04cadb17e8d1
-
C:\Windows\SysWOW64\avphost.dllFilesize
127KB
MD5d47ebd342b6906a2fda10d70560bcd5a
SHA1c1b54deb14d47e539bc6aea1464edb38fad4b87f
SHA25600a035dd63d4b26ab23ab122899767da8452bf262f61a06f9136513d841feaf2
SHA512626b00fb28e2b13b6f8fa393051e07da2eb937a164d87affdaac8f9be8aaa02cd3230c5c27648526ecdd1cad8b198f4d7c12f30dd362bf15011d04cadb17e8d1
-
C:\Windows\SysWOW64\avphost.dllFilesize
127KB
MD5d47ebd342b6906a2fda10d70560bcd5a
SHA1c1b54deb14d47e539bc6aea1464edb38fad4b87f
SHA25600a035dd63d4b26ab23ab122899767da8452bf262f61a06f9136513d841feaf2
SHA512626b00fb28e2b13b6f8fa393051e07da2eb937a164d87affdaac8f9be8aaa02cd3230c5c27648526ecdd1cad8b198f4d7c12f30dd362bf15011d04cadb17e8d1
-
C:\Windows\SysWOW64\avphost.dllFilesize
127KB
MD5d47ebd342b6906a2fda10d70560bcd5a
SHA1c1b54deb14d47e539bc6aea1464edb38fad4b87f
SHA25600a035dd63d4b26ab23ab122899767da8452bf262f61a06f9136513d841feaf2
SHA512626b00fb28e2b13b6f8fa393051e07da2eb937a164d87affdaac8f9be8aaa02cd3230c5c27648526ecdd1cad8b198f4d7c12f30dd362bf15011d04cadb17e8d1
-
C:\Windows\SysWOW64\avphost.dllFilesize
127KB
MD5d47ebd342b6906a2fda10d70560bcd5a
SHA1c1b54deb14d47e539bc6aea1464edb38fad4b87f
SHA25600a035dd63d4b26ab23ab122899767da8452bf262f61a06f9136513d841feaf2
SHA512626b00fb28e2b13b6f8fa393051e07da2eb937a164d87affdaac8f9be8aaa02cd3230c5c27648526ecdd1cad8b198f4d7c12f30dd362bf15011d04cadb17e8d1
-
C:\Windows\SysWOW64\avphost.dllFilesize
127KB
MD5d47ebd342b6906a2fda10d70560bcd5a
SHA1c1b54deb14d47e539bc6aea1464edb38fad4b87f
SHA25600a035dd63d4b26ab23ab122899767da8452bf262f61a06f9136513d841feaf2
SHA512626b00fb28e2b13b6f8fa393051e07da2eb937a164d87affdaac8f9be8aaa02cd3230c5c27648526ecdd1cad8b198f4d7c12f30dd362bf15011d04cadb17e8d1
-
C:\Windows\SysWOW64\avphost.dllFilesize
127KB
MD5d47ebd342b6906a2fda10d70560bcd5a
SHA1c1b54deb14d47e539bc6aea1464edb38fad4b87f
SHA25600a035dd63d4b26ab23ab122899767da8452bf262f61a06f9136513d841feaf2
SHA512626b00fb28e2b13b6f8fa393051e07da2eb937a164d87affdaac8f9be8aaa02cd3230c5c27648526ecdd1cad8b198f4d7c12f30dd362bf15011d04cadb17e8d1
-
C:\Windows\SysWOW64\avphost.dllFilesize
127KB
MD5d47ebd342b6906a2fda10d70560bcd5a
SHA1c1b54deb14d47e539bc6aea1464edb38fad4b87f
SHA25600a035dd63d4b26ab23ab122899767da8452bf262f61a06f9136513d841feaf2
SHA512626b00fb28e2b13b6f8fa393051e07da2eb937a164d87affdaac8f9be8aaa02cd3230c5c27648526ecdd1cad8b198f4d7c12f30dd362bf15011d04cadb17e8d1
-
C:\Windows\System\gHost.exeFilesize
457KB
MD54303740f657093a0dbcc65ffb1896700
SHA141f6fc777321df9088b468b7a233dfc27276b343
SHA2564294637edeceeff8e5db5b9355fd260ad6015a53e0835290140507bbac969415
SHA512eb46a6f36ea29eb987b115c83ba6f4211f03978454a33edb0bea01c8d5845791b7821e7ed23a73c2683eb2447f28cf039c2ae103c550d20122254f6767da7cda
-
C:\Windows\System\gHost.exeFilesize
457KB
MD54303740f657093a0dbcc65ffb1896700
SHA141f6fc777321df9088b468b7a233dfc27276b343
SHA2564294637edeceeff8e5db5b9355fd260ad6015a53e0835290140507bbac969415
SHA512eb46a6f36ea29eb987b115c83ba6f4211f03978454a33edb0bea01c8d5845791b7821e7ed23a73c2683eb2447f28cf039c2ae103c550d20122254f6767da7cda
-
C:\Windows\Xplorer.exeFilesize
457KB
MD54303740f657093a0dbcc65ffb1896700
SHA141f6fc777321df9088b468b7a233dfc27276b343
SHA2564294637edeceeff8e5db5b9355fd260ad6015a53e0835290140507bbac969415
SHA512eb46a6f36ea29eb987b115c83ba6f4211f03978454a33edb0bea01c8d5845791b7821e7ed23a73c2683eb2447f28cf039c2ae103c550d20122254f6767da7cda
-
C:\Windows\Xplorer.exeFilesize
457KB
MD54303740f657093a0dbcc65ffb1896700
SHA141f6fc777321df9088b468b7a233dfc27276b343
SHA2564294637edeceeff8e5db5b9355fd260ad6015a53e0835290140507bbac969415
SHA512eb46a6f36ea29eb987b115c83ba6f4211f03978454a33edb0bea01c8d5845791b7821e7ed23a73c2683eb2447f28cf039c2ae103c550d20122254f6767da7cda
-
C:\Windows\inf\Autoplay.inFFilesize
234B
MD57ae2f1a7ce729d91acfef43516e5a84c
SHA1ebbc99c7e5ac5679de2881813257576ec980fb44
SHA25643b2fee4fbe5b4a83ae32589d11c3f45ad1988dd5357f790ec708fdfd6709a98
SHA512915b67d31a7034659360355cb00f9620bf9c64cc06660ea55e5fcba0096f1ac782ac7550f778c4874f63082820c03fbbf4dd05169b0de61a661a202f10a4eff9
-
C:\Windows\inf\Autoplay.inFFilesize
234B
MD57ae2f1a7ce729d91acfef43516e5a84c
SHA1ebbc99c7e5ac5679de2881813257576ec980fb44
SHA25643b2fee4fbe5b4a83ae32589d11c3f45ad1988dd5357f790ec708fdfd6709a98
SHA512915b67d31a7034659360355cb00f9620bf9c64cc06660ea55e5fcba0096f1ac782ac7550f778c4874f63082820c03fbbf4dd05169b0de61a661a202f10a4eff9
-
C:\Windows\inf\Autoplay.inFFilesize
234B
MD57ae2f1a7ce729d91acfef43516e5a84c
SHA1ebbc99c7e5ac5679de2881813257576ec980fb44
SHA25643b2fee4fbe5b4a83ae32589d11c3f45ad1988dd5357f790ec708fdfd6709a98
SHA512915b67d31a7034659360355cb00f9620bf9c64cc06660ea55e5fcba0096f1ac782ac7550f778c4874f63082820c03fbbf4dd05169b0de61a661a202f10a4eff9
-
C:\Windows\inf\Autoplay.inFFilesize
234B
MD57ae2f1a7ce729d91acfef43516e5a84c
SHA1ebbc99c7e5ac5679de2881813257576ec980fb44
SHA25643b2fee4fbe5b4a83ae32589d11c3f45ad1988dd5357f790ec708fdfd6709a98
SHA512915b67d31a7034659360355cb00f9620bf9c64cc06660ea55e5fcba0096f1ac782ac7550f778c4874f63082820c03fbbf4dd05169b0de61a661a202f10a4eff9
-
C:\Windows\inf\Autoplay.inFMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
C:\Windows\inf\Autoplay.inFMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
C:\Windows\inf\Autoplay.inFFilesize
234B
MD57ae2f1a7ce729d91acfef43516e5a84c
SHA1ebbc99c7e5ac5679de2881813257576ec980fb44
SHA25643b2fee4fbe5b4a83ae32589d11c3f45ad1988dd5357f790ec708fdfd6709a98
SHA512915b67d31a7034659360355cb00f9620bf9c64cc06660ea55e5fcba0096f1ac782ac7550f778c4874f63082820c03fbbf4dd05169b0de61a661a202f10a4eff9
-
C:\Windows\inf\Autoplay.inFMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
C:\\KHATRA.exeFilesize
457KB
MD54303740f657093a0dbcc65ffb1896700
SHA141f6fc777321df9088b468b7a233dfc27276b343
SHA2564294637edeceeff8e5db5b9355fd260ad6015a53e0835290140507bbac969415
SHA512eb46a6f36ea29eb987b115c83ba6f4211f03978454a33edb0bea01c8d5845791b7821e7ed23a73c2683eb2447f28cf039c2ae103c550d20122254f6767da7cda
-
memory/176-149-0x0000000000000000-mapping.dmp
-
memory/212-205-0x0000000000000000-mapping.dmp
-
memory/316-150-0x0000000000000000-mapping.dmp
-
memory/480-152-0x0000000000000000-mapping.dmp
-
memory/492-273-0x0000000000400000-0x0000000000498000-memory.dmpFilesize
608KB
-
memory/492-272-0x0000000000400000-0x0000000000498000-memory.dmpFilesize
608KB
-
memory/836-265-0x0000000000400000-0x0000000000498000-memory.dmpFilesize
608KB
-
memory/836-264-0x0000000000400000-0x0000000000498000-memory.dmpFilesize
608KB
-
memory/1076-154-0x0000000000000000-mapping.dmp
-
memory/1120-282-0x0000000000400000-0x0000000000498000-memory.dmpFilesize
608KB
-
memory/1120-283-0x0000000000400000-0x0000000000498000-memory.dmpFilesize
608KB
-
memory/1264-213-0x0000000000400000-0x0000000000498000-memory.dmpFilesize
608KB
-
memory/1264-211-0x0000000000000000-mapping.dmp
-
memory/1264-226-0x0000000000400000-0x0000000000498000-memory.dmpFilesize
608KB
-
memory/1512-277-0x0000000000400000-0x0000000000498000-memory.dmpFilesize
608KB
-
memory/1512-276-0x0000000000400000-0x0000000000498000-memory.dmpFilesize
608KB
-
memory/1520-133-0x0000000000000000-mapping.dmp
-
memory/1520-136-0x0000000000400000-0x0000000000498000-memory.dmpFilesize
608KB
-
memory/1520-177-0x0000000000400000-0x0000000000498000-memory.dmpFilesize
608KB
-
memory/1748-222-0x0000000000000000-mapping.dmp
-
memory/1784-279-0x0000000000400000-0x0000000000498000-memory.dmpFilesize
608KB
-
memory/1784-278-0x0000000000400000-0x0000000000498000-memory.dmpFilesize
608KB
-
memory/1812-225-0x0000000000000000-mapping.dmp
-
memory/1836-221-0x0000000000000000-mapping.dmp
-
memory/1836-163-0x0000000000000000-mapping.dmp
-
memory/1840-234-0x0000000000000000-mapping.dmp
-
memory/1844-156-0x0000000000000000-mapping.dmp
-
memory/1856-233-0x0000000000000000-mapping.dmp
-
memory/1860-206-0x0000000000000000-mapping.dmp
-
memory/1936-218-0x0000000000000000-mapping.dmp
-
memory/1956-168-0x0000000010000000-0x000000001005C000-memory.dmpFilesize
368KB
-
memory/1956-164-0x0000000000000000-mapping.dmp
-
memory/2044-193-0x0000000000000000-mapping.dmp
-
memory/2084-254-0x0000000000000000-mapping.dmp
-
memory/2128-162-0x0000000000000000-mapping.dmp
-
memory/2252-263-0x0000000000400000-0x0000000000498000-memory.dmpFilesize
608KB
-
memory/2252-260-0x0000000000400000-0x0000000000498000-memory.dmpFilesize
608KB
-
memory/2252-192-0x0000000000000000-mapping.dmp
-
memory/2340-219-0x0000000000000000-mapping.dmp
-
memory/2372-147-0x0000000000400000-0x0000000000498000-memory.dmpFilesize
608KB
-
memory/2372-270-0x0000000000400000-0x0000000000498000-memory.dmpFilesize
608KB
-
memory/2372-143-0x0000000000000000-mapping.dmp
-
memory/2392-274-0x0000000000400000-0x0000000000498000-memory.dmpFilesize
608KB
-
memory/2392-275-0x0000000000400000-0x0000000000498000-memory.dmpFilesize
608KB
-
memory/2428-170-0x0000000000000000-mapping.dmp
-
memory/2428-236-0x0000000000000000-mapping.dmp
-
memory/2544-169-0x0000000000000000-mapping.dmp
-
memory/2544-269-0x0000000000400000-0x0000000000498000-memory.dmpFilesize
608KB
-
memory/2544-268-0x0000000000400000-0x0000000000498000-memory.dmpFilesize
608KB
-
memory/2584-161-0x0000000000000000-mapping.dmp
-
memory/2840-256-0x0000000000000000-mapping.dmp
-
memory/2900-200-0x0000000000000000-mapping.dmp
-
memory/3016-209-0x0000000000000000-mapping.dmp
-
memory/3076-151-0x0000000000000000-mapping.dmp
-
memory/3080-217-0x0000000000000000-mapping.dmp
-
memory/3120-249-0x0000000000000000-mapping.dmp
-
memory/3132-243-0x0000000000000000-mapping.dmp
-
memory/3132-250-0x0000000000400000-0x0000000000498000-memory.dmpFilesize
608KB
-
memory/3132-258-0x0000000000400000-0x0000000000498000-memory.dmpFilesize
608KB
-
memory/3168-185-0x0000000000000000-mapping.dmp
-
memory/3196-155-0x0000000000000000-mapping.dmp
-
memory/3208-227-0x0000000000000000-mapping.dmp
-
memory/3208-230-0x0000000000400000-0x0000000000498000-memory.dmpFilesize
608KB
-
memory/3208-242-0x0000000000400000-0x0000000000498000-memory.dmpFilesize
608KB
-
memory/3428-189-0x0000000000000000-mapping.dmp
-
memory/3464-252-0x0000000000000000-mapping.dmp
-
memory/3472-153-0x0000000000000000-mapping.dmp
-
memory/3512-241-0x0000000000000000-mapping.dmp
-
memory/3556-201-0x0000000000000000-mapping.dmp
-
memory/3576-253-0x0000000000000000-mapping.dmp
-
memory/3748-251-0x0000000000000000-mapping.dmp
-
memory/3820-172-0x0000000000000000-mapping.dmp
-
memory/3936-248-0x0000000000000000-mapping.dmp
-
memory/3992-224-0x0000000000000000-mapping.dmp
-
memory/4084-190-0x0000000000000000-mapping.dmp
-
memory/4120-204-0x0000000000000000-mapping.dmp
-
memory/4128-271-0x0000000000400000-0x0000000000498000-memory.dmpFilesize
608KB
-
memory/4128-148-0x0000000000400000-0x0000000000498000-memory.dmpFilesize
608KB
-
memory/4128-145-0x0000000000000000-mapping.dmp
-
memory/4132-194-0x0000000000400000-0x0000000000498000-memory.dmpFilesize
608KB
-
memory/4132-182-0x0000000000400000-0x0000000000498000-memory.dmpFilesize
608KB
-
memory/4132-179-0x0000000000000000-mapping.dmp
-
memory/4344-281-0x0000000000400000-0x0000000000498000-memory.dmpFilesize
608KB
-
memory/4344-280-0x0000000000400000-0x0000000000498000-memory.dmpFilesize
608KB
-
memory/4424-208-0x0000000000000000-mapping.dmp
-
memory/4440-237-0x0000000000000000-mapping.dmp
-
memory/4504-171-0x0000000000000000-mapping.dmp
-
memory/4552-188-0x0000000000000000-mapping.dmp
-
memory/4596-178-0x0000000000400000-0x0000000000498000-memory.dmpFilesize
608KB
-
memory/4596-132-0x0000000000400000-0x0000000000498000-memory.dmpFilesize
608KB
-
memory/4652-266-0x0000000000400000-0x0000000000498000-memory.dmpFilesize
608KB
-
memory/4652-267-0x0000000000400000-0x0000000000498000-memory.dmpFilesize
608KB
-
memory/4668-235-0x0000000000000000-mapping.dmp
-
memory/4696-238-0x0000000000000000-mapping.dmp
-
memory/4792-186-0x0000000000000000-mapping.dmp
-
memory/4844-220-0x0000000000000000-mapping.dmp
-
memory/4884-203-0x0000000000400000-0x0000000000498000-memory.dmpFilesize
608KB
-
memory/4884-195-0x0000000000000000-mapping.dmp
-
memory/4884-210-0x0000000000400000-0x0000000000498000-memory.dmpFilesize
608KB
-
memory/4948-240-0x0000000000000000-mapping.dmp
-
memory/5040-202-0x0000000000000000-mapping.dmp
-
memory/5060-187-0x0000000000000000-mapping.dmp
-
memory/5068-257-0x0000000000000000-mapping.dmp