0ab40251273af3a0e2c76935d1176ca71e898c5a935d9aed1a8f4b21a0e0d8c9

Analysis

max time kernel
154s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
03-10-2022 03:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0ab40251273af3a0e2c76935d1176ca71e898c5a935d9aed1a8f4b21a0e0d8c9.exe
Size

535KB
MD5

6acd1647078d560a5ec3d53f85b5c709
SHA1

5d55d16df9e337800c7410a819ee7b56f7b4b31e
SHA256

0ab40251273af3a0e2c76935d1176ca71e898c5a935d9aed1a8f4b21a0e0d8c9
SHA512

08dc141a957f1e5bcd1c92f51093abd1b8dfcfccfccc2f5572a0304282ad93f05ce47900a799b1e8b1705f22e74ad84a6203db89a637333f347974df64fe47a9
SSDEEP

12288:vSo6xg5kN530xuooqMVwsgTo6xg5kN530xuooqT:b6u5030x+gE6u5030xD

Score

8^/10

evasion persistence

Malware Config

Signatures

Adds policy Run key to start application 2 TTPs 40 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

KHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exe0ab40251273af3a0e2c76935d1176ca71e898c5a935d9aed1a8f4b21a0e0d8c9.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	KHATRA.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	KHATRA.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	KHATRA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\G_Host = "\"C:\\Windows\\System\\gHost.exe\" /Reproduce"	KHATRA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\G_Host = "\"C:\\Windows\\System\\gHost.exe\" /Reproduce"	KHATRA.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	KHATRA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\G_Host = "\"C:\\Windows\\System\\gHost.exe\" /Reproduce"	KHATRA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\G_Host = "\"C:\\Windows\\System\\gHost.exe\" /Reproduce"	KHATRA.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	KHATRA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\G_Host = "\"C:\\Windows\\System\\gHost.exe\" /Reproduce"	KHATRA.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	KHATRA.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	KHATRA.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	KHATRA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\G_Host = "\"C:\\Windows\\System\\gHost.exe\" /Reproduce"	KHATRA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\G_Host = "\"C:\\Windows\\System\\gHost.exe\" /Reproduce"	KHATRA.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	KHATRA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\G_Host = "\"C:\\Windows\\System\\gHost.exe\" /Reproduce"	KHATRA.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	KHATRA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\G_Host = "\"C:\\Windows\\System\\gHost.exe\" /Reproduce"	KHATRA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\G_Host = "\"C:\\Windows\\System\\gHost.exe\" /Reproduce"	KHATRA.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	KHATRA.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	KHATRA.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	KHATRA.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	KHATRA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\G_Host = "\"C:\\Windows\\System\\gHost.exe\" /Reproduce"	KHATRA.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	KHATRA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\G_Host = "\"C:\\Windows\\System\\gHost.exe\" /Reproduce"	KHATRA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\G_Host = "\"C:\\Windows\\System\\gHost.exe\" /Reproduce"	KHATRA.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	KHATRA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\G_Host = "\"C:\\Windows\\System\\gHost.exe\" /Reproduce"	0ab40251273af3a0e2c76935d1176ca71e898c5a935d9aed1a8f4b21a0e0d8c9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\G_Host = "\"C:\\Windows\\System\\gHost.exe\" /Reproduce"	KHATRA.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	KHATRA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\G_Host = "\"C:\\Windows\\System\\gHost.exe\" /Reproduce"	KHATRA.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	KHATRA.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	KHATRA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\G_Host = "\"C:\\Windows\\System\\gHost.exe\" /Reproduce"	KHATRA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\G_Host = "\"C:\\Windows\\System\\gHost.exe\" /Reproduce"	KHATRA.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	0ab40251273af3a0e2c76935d1176ca71e898c5a935d9aed1a8f4b21a0e0d8c9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\G_Host = "\"C:\\Windows\\System\\gHost.exe\" /Reproduce"	KHATRA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\G_Host = "\"C:\\Windows\\System\\gHost.exe\" /Reproduce"	KHATRA.exe

Disables RegEdit via registry modification 20 IoCs

evasion

Processes:

KHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exe0ab40251273af3a0e2c76935d1176ca71e898c5a935d9aed1a8f4b21a0e0d8c9.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	KHATRA.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	KHATRA.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	KHATRA.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	KHATRA.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	KHATRA.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	KHATRA.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	KHATRA.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	0ab40251273af3a0e2c76935d1176ca71e898c5a935d9aed1a8f4b21a0e0d8c9.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	KHATRA.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	KHATRA.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	KHATRA.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	KHATRA.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	KHATRA.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	KHATRA.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	KHATRA.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	KHATRA.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	KHATRA.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	KHATRA.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	KHATRA.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	KHATRA.exe

Executes dropped EXE 25 IoCs

Processes:

KHATRA.exeXplorer.exegHost.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exe

pid	process
2824	KHATRA.exe
4748	Xplorer.exe
3700	gHost.exe
3640	KHATRA.exe
3296	KHATRA.exe
4364	KHATRA.exe
2888	KHATRA.exe
3424	KHATRA.exe
2788	KHATRA.exe
4920	KHATRA.exe
2156	KHATRA.exe
3772	KHATRA.exe
2320	KHATRA.exe
3972	KHATRA.exe
4824	KHATRA.exe
4596	KHATRA.exe
1588	KHATRA.exe
1620	KHATRA.exe
4296	KHATRA.exe
3896	KHATRA.exe
3572	KHATRA.exe
3108	KHATRA.exe
4760	KHATRA.exe
1108	KHATRA.exe
3088	KHATRA.exe

Modifies Windows Firewall 1 TTPs 20 IoCs

evasion

Modify Existing Service

T1031

Processes:

netsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exe

pid	process
2964	netsh.exe
3200	netsh.exe
2324	netsh.exe
3564	netsh.exe
4316	netsh.exe
3512	netsh.exe
3044	netsh.exe
1204	netsh.exe
3096	netsh.exe
3356	netsh.exe
3864	netsh.exe
1288	netsh.exe
4228	netsh.exe
4356	netsh.exe
4932	netsh.exe
2488	netsh.exe
3420	netsh.exe
4536	netsh.exe
4332	netsh.exe
2828	netsh.exe

Adds Run key to start application 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

KHATRA.exe0ab40251273af3a0e2c76935d1176ca71e898c5a935d9aed1a8f4b21a0e0d8c9.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	KHATRA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Xplorer = "\"C:\\Windows\\Xplorer.exe\" /Windows"	0ab40251273af3a0e2c76935d1176ca71e898c5a935d9aed1a8f4b21a0e0d8c9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\1 = "C:\\Windows\\Xplorer.exe"	KHATRA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\1 = "C:\\Windows\\Xplorer.exe"	KHATRA.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	KHATRA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Xplorer = "C:\\Windows\\Xplorer.exe"	KHATRA.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	KHATRA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\1 = "C:\\Windows\\system32\\KHATRA.exe"	KHATRA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Xplorer = "\"C:\\Windows\\Xplorer.exe\" /Windows"	KHATRA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\1 = "C:\\Windows\\Xplorer.exe"	KHATRA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\1 = "C:\\Windows\\system32\\KHATRA.exe"	0ab40251273af3a0e2c76935d1176ca71e898c5a935d9aed1a8f4b21a0e0d8c9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Xplorer = "\"C:\\Windows\\Xplorer.exe\" /Windows"	KHATRA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Xplorer = "\"C:\\Windows\\Xplorer.exe\" /Windows"	KHATRA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\1 = "C:\\Windows\\system32\\KHATRA.exe"	KHATRA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Xplorer = "\"C:\\Windows\\Xplorer.exe\" /Windows"	KHATRA.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	KHATRA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Xplorer = "C:\\Windows\\system32\\KHATRA.exe"	KHATRA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Xplorer = "\"C:\\Windows\\Xplorer.exe\" /Windows"	KHATRA.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	KHATRA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Xplorer = "\"C:\\Windows\\Xplorer.exe\" /Windows"	KHATRA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Xplorer = "C:\\Windows\\Xplorer.exe"	KHATRA.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	KHATRA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\1 = "C:\\Windows\\system32\\KHATRA.exe"	KHATRA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\1 = "C:\\Windows\\Xplorer.exe"	KHATRA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Xplorer = "C:\\Windows\\Xplorer.exe"	KHATRA.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	KHATRA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\1 = "C:\\Windows\\system32\\KHATRA.exe"	KHATRA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\1 = "C:\\Windows\\system32\\KHATRA.exe"	KHATRA.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	KHATRA.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	KHATRA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\1 = "C:\\Windows\\Xplorer.exe"	KHATRA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Xplorer = "\"C:\\Windows\\Xplorer.exe\" /Windows"	KHATRA.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	KHATRA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\1 = "C:\\Windows\\Xplorer.exe"	KHATRA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Xplorer = "C:\\Windows\\Xplorer.exe"	KHATRA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Xplorer = "\"C:\\Windows\\Xplorer.exe\" /Windows"	KHATRA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Xplorer = "\"C:\\Windows\\Xplorer.exe\" /Windows"	KHATRA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\1 = "C:\\Windows\\system32\\KHATRA.exe"	KHATRA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\1 = "C:\\Windows\\system32\\KHATRA.exe"	KHATRA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Xplorer = "\"C:\\Windows\\Xplorer.exe\" /Windows"	KHATRA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\1 = "C:\\Windows\\Xplorer.exe"	KHATRA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Xplorer = "\"C:\\Windows\\Xplorer.exe\" /Windows"	KHATRA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Xplorer = "C:\\Windows\\Xplorer.exe"	KHATRA.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	KHATRA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\1 = "C:\\Windows\\system32\\KHATRA.exe"	KHATRA.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	KHATRA.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	0ab40251273af3a0e2c76935d1176ca71e898c5a935d9aed1a8f4b21a0e0d8c9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\1 = "C:\\Windows\\Xplorer.exe"	0ab40251273af3a0e2c76935d1176ca71e898c5a935d9aed1a8f4b21a0e0d8c9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Xplorer = "C:\\Windows\\system32\\KHATRA.exe"	KHATRA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\1 = "C:\\Windows\\Xplorer.exe"	KHATRA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Xplorer = "\"C:\\Windows\\Xplorer.exe\" /Windows"	KHATRA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Xplorer = "\"C:\\Windows\\Xplorer.exe\" /Windows"	KHATRA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Xplorer = "\"C:\\Windows\\Xplorer.exe\" /Windows"	KHATRA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\1 = "C:\\Windows\\system32\\KHATRA.exe"	KHATRA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Xplorer = "C:\\Windows\\Xplorer.exe"	KHATRA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Xplorer = "C:\\Windows\\Xplorer.exe"	KHATRA.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	KHATRA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Xplorer = "\"C:\\Windows\\Xplorer.exe\" /Windows"	KHATRA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Xplorer = "\"C:\\Windows\\Xplorer.exe\" /Windows"	KHATRA.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	KHATRA.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	KHATRA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Xplorer = "\"C:\\Windows\\Xplorer.exe\" /Windows"	KHATRA.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	KHATRA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Xplorer = "C:\\Windows\\Xplorer.exe"	KHATRA.exe

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

gHost.exe

description	ioc	process
File opened (read-only)	\??\o:	gHost.exe
File opened (read-only)	\??\q:	gHost.exe
File opened (read-only)	\??\t:	gHost.exe
File opened (read-only)	\??\z:	gHost.exe
File opened (read-only)	\??\a:	gHost.exe
File opened (read-only)	\??\b:	gHost.exe
File opened (read-only)	\??\g:	gHost.exe
File opened (read-only)	\??\h:	gHost.exe
File opened (read-only)	\??\e:	gHost.exe
File opened (read-only)	\??\p:	gHost.exe
File opened (read-only)	\??\v:	gHost.exe
File opened (read-only)	\??\w:	gHost.exe
File opened (read-only)	\??\u:	gHost.exe
File opened (read-only)	\??\y:	gHost.exe
File opened (read-only)	\??\f:	gHost.exe
File opened (read-only)	\??\k:	gHost.exe
File opened (read-only)	\??\l:	gHost.exe
File opened (read-only)	\??\s:	gHost.exe
File opened (read-only)	\??\r:	gHost.exe
File opened (read-only)	\??\x:	gHost.exe
File opened (read-only)	\??\i:	gHost.exe
File opened (read-only)	\??\j:	gHost.exe
File opened (read-only)	\??\m:	gHost.exe
File opened (read-only)	\??\n:	gHost.exe

Modifies WinLogon 2 TTPs 20 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

KHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exe0ab40251273af3a0e2c76935d1176ca71e898c5a935d9aed1a8f4b21a0e0d8c9.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Taskman = "C:\\Windows\\system32\\KHATRA.exe"	KHATRA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Taskman = "C:\\Windows\\system32\\KHATRA.exe"	KHATRA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Taskman = "C:\\Windows\\system32\\KHATRA.exe"	KHATRA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Taskman = "C:\\Windows\\system32\\KHATRA.exe"	KHATRA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Taskman = "C:\\Windows\\system32\\KHATRA.exe"	0ab40251273af3a0e2c76935d1176ca71e898c5a935d9aed1a8f4b21a0e0d8c9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Taskman = "C:\\Windows\\system32\\KHATRA.exe"	KHATRA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Taskman = "C:\\Windows\\system32\\KHATRA.exe"	KHATRA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Taskman = "C:\\Windows\\system32\\KHATRA.exe"	KHATRA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Taskman = "C:\\Windows\\system32\\KHATRA.exe"	KHATRA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Taskman = "C:\\Windows\\system32\\KHATRA.exe"	KHATRA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Taskman = "C:\\Windows\\system32\\KHATRA.exe"	KHATRA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Taskman = "C:\\Windows\\system32\\KHATRA.exe"	KHATRA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Taskman = "C:\\Windows\\system32\\KHATRA.exe"	KHATRA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Taskman = "C:\\Windows\\system32\\KHATRA.exe"	KHATRA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Taskman = "C:\\Windows\\system32\\KHATRA.exe"	KHATRA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Taskman = "C:\\Windows\\system32\\KHATRA.exe"	KHATRA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Taskman = "C:\\Windows\\system32\\KHATRA.exe"	KHATRA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Taskman = "C:\\Windows\\system32\\KHATRA.exe"	KHATRA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Taskman = "C:\\Windows\\system32\\KHATRA.exe"	KHATRA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Taskman = "C:\\Windows\\system32\\KHATRA.exe"	KHATRA.exe

AutoIT Executable 48 IoCs

AutoIT scripts compiled to PE executables.

Processes:

resource	yara_rule
behavioral2/memory/2716-132-0x0000000000400000-0x00000000004CC000-memory.dmp	autoit_exe
behavioral2/memory/2824-137-0x0000000000400000-0x00000000004CC000-memory.dmp	autoit_exe
behavioral2/memory/4748-147-0x0000000000400000-0x00000000004CC000-memory.dmp	autoit_exe
behavioral2/memory/3700-148-0x0000000000400000-0x00000000004CC000-memory.dmp	autoit_exe
behavioral2/memory/2716-170-0x0000000000400000-0x00000000004CC000-memory.dmp	autoit_exe
behavioral2/memory/2824-169-0x0000000000400000-0x00000000004CC000-memory.dmp	autoit_exe
behavioral2/memory/3640-175-0x0000000000400000-0x00000000004CC000-memory.dmp	autoit_exe
behavioral2/memory/3296-176-0x0000000000400000-0x00000000004CC000-memory.dmp	autoit_exe
behavioral2/memory/3296-177-0x0000000000400000-0x00000000004CC000-memory.dmp	autoit_exe
behavioral2/memory/3640-178-0x0000000000400000-0x00000000004CC000-memory.dmp	autoit_exe
behavioral2/memory/4364-181-0x0000000000400000-0x00000000004CC000-memory.dmp	autoit_exe
behavioral2/memory/4364-193-0x0000000000400000-0x00000000004CC000-memory.dmp	autoit_exe
behavioral2/memory/2888-197-0x0000000000400000-0x00000000004CC000-memory.dmp	autoit_exe
behavioral2/memory/2888-208-0x0000000000400000-0x00000000004CC000-memory.dmp	autoit_exe
behavioral2/memory/3424-215-0x0000000000400000-0x00000000004CC000-memory.dmp	autoit_exe
behavioral2/memory/3424-223-0x0000000000400000-0x00000000004CC000-memory.dmp	autoit_exe
behavioral2/memory/2788-227-0x0000000000400000-0x00000000004CC000-memory.dmp	autoit_exe
behavioral2/memory/2788-238-0x0000000000400000-0x00000000004CC000-memory.dmp	autoit_exe
behavioral2/memory/4920-242-0x0000000000400000-0x00000000004CC000-memory.dmp	autoit_exe
behavioral2/memory/4920-251-0x0000000000400000-0x00000000004CC000-memory.dmp	autoit_exe
behavioral2/memory/2156-256-0x0000000000400000-0x00000000004CC000-memory.dmp	autoit_exe
behavioral2/memory/2156-258-0x0000000000400000-0x00000000004CC000-memory.dmp	autoit_exe
behavioral2/memory/3772-264-0x0000000000400000-0x00000000004CC000-memory.dmp	autoit_exe
behavioral2/memory/2320-267-0x0000000000400000-0x00000000004CC000-memory.dmp	autoit_exe
behavioral2/memory/3972-268-0x0000000000400000-0x00000000004CC000-memory.dmp	autoit_exe
behavioral2/memory/3972-269-0x0000000000400000-0x00000000004CC000-memory.dmp	autoit_exe
behavioral2/memory/4748-270-0x0000000000400000-0x00000000004CC000-memory.dmp	autoit_exe
behavioral2/memory/3700-271-0x0000000000400000-0x00000000004CC000-memory.dmp	autoit_exe
behavioral2/memory/4824-272-0x0000000000400000-0x00000000004CC000-memory.dmp	autoit_exe
behavioral2/memory/4596-273-0x0000000000400000-0x00000000004CC000-memory.dmp	autoit_exe
behavioral2/memory/4596-274-0x0000000000400000-0x00000000004CC000-memory.dmp	autoit_exe
behavioral2/memory/1588-275-0x0000000000400000-0x00000000004CC000-memory.dmp	autoit_exe
behavioral2/memory/1588-276-0x0000000000400000-0x00000000004CC000-memory.dmp	autoit_exe
behavioral2/memory/1620-277-0x0000000000400000-0x00000000004CC000-memory.dmp	autoit_exe
behavioral2/memory/1620-278-0x0000000000400000-0x00000000004CC000-memory.dmp	autoit_exe
behavioral2/memory/4296-279-0x0000000000400000-0x00000000004CC000-memory.dmp	autoit_exe
behavioral2/memory/4296-280-0x0000000000400000-0x00000000004CC000-memory.dmp	autoit_exe
behavioral2/memory/3896-281-0x0000000000400000-0x00000000004CC000-memory.dmp	autoit_exe
behavioral2/memory/3572-282-0x0000000000400000-0x00000000004CC000-memory.dmp	autoit_exe
behavioral2/memory/3572-284-0x0000000000400000-0x00000000004CC000-memory.dmp	autoit_exe
behavioral2/memory/3896-283-0x0000000000400000-0x00000000004CC000-memory.dmp	autoit_exe
behavioral2/memory/3108-285-0x0000000000400000-0x00000000004CC000-memory.dmp	autoit_exe
behavioral2/memory/3108-286-0x0000000000400000-0x00000000004CC000-memory.dmp	autoit_exe
behavioral2/memory/4760-287-0x0000000000400000-0x00000000004CC000-memory.dmp	autoit_exe
behavioral2/memory/4760-288-0x0000000000400000-0x00000000004CC000-memory.dmp	autoit_exe
behavioral2/memory/1108-289-0x0000000000400000-0x00000000004CC000-memory.dmp	autoit_exe
behavioral2/memory/1108-290-0x0000000000400000-0x00000000004CC000-memory.dmp	autoit_exe
behavioral2/memory/3088-291-0x0000000000400000-0x00000000004CC000-memory.dmp	autoit_exe

Drops autorun.inf file 1 TTPs 20 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

Processes:

KHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exe0ab40251273af3a0e2c76935d1176ca71e898c5a935d9aed1a8f4b21a0e0d8c9.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exe

description	ioc	process
File created	C:\Users\Admin\Local Settings\Application Data\Microsoft\CD Burning\AUTORUN.inF	KHATRA.exe
File created	C:\Users\Admin\Local Settings\Application Data\Microsoft\CD Burning\AUTORUN.inF	KHATRA.exe
File created	C:\Users\Admin\Local Settings\Application Data\Microsoft\CD Burning\AUTORUN.inF	KHATRA.exe
File created	C:\Users\Admin\Local Settings\Application Data\Microsoft\CD Burning\AUTORUN.inF	KHATRA.exe
File created	C:\Users\Admin\Local Settings\Application Data\Microsoft\CD Burning\AUTORUN.inF	KHATRA.exe
File created	C:\Users\Admin\Local Settings\Application Data\Microsoft\CD Burning\AUTORUN.inF	KHATRA.exe
File created	C:\Users\Admin\Local Settings\Application Data\Microsoft\CD Burning\AUTORUN.inF	KHATRA.exe
File created	C:\Users\Admin\Local Settings\Application Data\Microsoft\CD Burning\AUTORUN.inF	KHATRA.exe
File created	C:\Users\Admin\Local Settings\Application Data\Microsoft\CD Burning\AUTORUN.inF	KHATRA.exe
File created	C:\Users\Admin\Local Settings\Application Data\Microsoft\CD Burning\AUTORUN.inF	KHATRA.exe
File created	C:\Users\Admin\Local Settings\Application Data\Microsoft\CD Burning\AUTORUN.inF	KHATRA.exe
File created	C:\Users\Admin\Local Settings\Application Data\Microsoft\CD Burning\AUTORUN.inF	KHATRA.exe
File created	C:\Users\Admin\Local Settings\Application Data\Microsoft\CD Burning\AUTORUN.inF	KHATRA.exe
File created	C:\Users\Admin\Local Settings\Application Data\Microsoft\CD Burning\AUTORUN.inF	KHATRA.exe
File created	C:\Users\Admin\Local Settings\Application Data\Microsoft\CD Burning\AUTORUN.inF	0ab40251273af3a0e2c76935d1176ca71e898c5a935d9aed1a8f4b21a0e0d8c9.exe
File created	C:\Users\Admin\Local Settings\Application Data\Microsoft\CD Burning\AUTORUN.inF	KHATRA.exe
File created	C:\Users\Admin\Local Settings\Application Data\Microsoft\CD Burning\AUTORUN.inF	KHATRA.exe
File created	C:\Users\Admin\Local Settings\Application Data\Microsoft\CD Burning\AUTORUN.inF	KHATRA.exe
File created	C:\Users\Admin\Local Settings\Application Data\Microsoft\CD Burning\AUTORUN.inF	KHATRA.exe
File created	C:\Users\Admin\Local Settings\Application Data\Microsoft\CD Burning\AUTORUN.inF	KHATRA.exe

Drops file in System32 directory 39 IoCs

Processes:

KHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exe0ab40251273af3a0e2c76935d1176ca71e898c5a935d9aed1a8f4b21a0e0d8c9.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\KHATRA.exe	KHATRA.exe
File opened for modification	C:\Windows\SysWOW64\KHATRA.exe	KHATRA.exe
File opened for modification	C:\Windows\SysWOW64\KHATRA.exe	KHATRA.exe
File created	C:\Windows\SysWOW64\KHATRA.exe	KHATRA.exe
File opened for modification	C:\Windows\SysWOW64\KHATRA.exe	KHATRA.exe
File created	C:\Windows\SysWOW64\KHATRA.exe	KHATRA.exe
File opened for modification	C:\Windows\SysWOW64\KHATRA.exe	KHATRA.exe
File created	C:\Windows\SysWOW64\KHATRA.exe	KHATRA.exe
File opened for modification	C:\Windows\SysWOW64\KHATRA.exe	KHATRA.exe
File created	C:\Windows\SysWOW64\KHATRA.exe	KHATRA.exe
File created	C:\Windows\SysWOW64\KHATRA.exe	KHATRA.exe
File opened for modification	C:\Windows\SysWOW64\KHATRA.exe	KHATRA.exe
File opened for modification	C:\Windows\SysWOW64\KHATRA.exe	KHATRA.exe
File opened for modification	C:\Windows\SysWOW64\KHATRA.exe	KHATRA.exe
File opened for modification	C:\Windows\SysWOW64\KHATRA.exe	KHATRA.exe
File created	C:\Windows\SysWOW64\KHATRA.exe	KHATRA.exe
File opened for modification	C:\Windows\SysWOW64\KHATRA.exe	KHATRA.exe
File opened for modification	C:\Windows\SysWOW64\KHATRA.exe	0ab40251273af3a0e2c76935d1176ca71e898c5a935d9aed1a8f4b21a0e0d8c9.exe
File created	C:\Windows\SysWOW64\KHATRA.exe	KHATRA.exe
File opened for modification	C:\Windows\SysWOW64\KHATRA.exe	KHATRA.exe
File created	C:\Windows\SysWOW64\KHATRA.exe	KHATRA.exe
File created	C:\Windows\SysWOW64\KHATRA.exe	KHATRA.exe
File created	C:\Windows\SysWOW64\KHATRA.exe	KHATRA.exe
File created	C:\Windows\SysWOW64\KHATRA.exe	KHATRA.exe
File created	C:\Windows\SysWOW64\KHATRA.exe	0ab40251273af3a0e2c76935d1176ca71e898c5a935d9aed1a8f4b21a0e0d8c9.exe
File opened for modification	C:\Windows\SysWOW64\KHATRA.exe	KHATRA.exe
File created	C:\Windows\SysWOW64\KHATRA.exe	KHATRA.exe
File created	C:\Windows\SysWOW64\KHATRA.exe	KHATRA.exe
File created	C:\Windows\SysWOW64\KHATRA.exe	KHATRA.exe
File opened for modification	C:\Windows\SysWOW64\KHATRA.exe	KHATRA.exe
File opened for modification	C:\Windows\SysWOW64\KHATRA.exe	KHATRA.exe
File created	C:\Windows\SysWOW64\KHATRA.exe	KHATRA.exe
File opened for modification	C:\Windows\SysWOW64\KHATRA.exe	KHATRA.exe
File opened for modification	C:\Windows\SysWOW64\KHATRA.exe	KHATRA.exe
File opened for modification	C:\Windows\SysWOW64\KHATRA.exe	KHATRA.exe
File created	C:\Windows\SysWOW64\KHATRA.exe	KHATRA.exe
File opened for modification	C:\Windows\SysWOW64\KHATRA.exe	KHATRA.exe
File created	C:\Windows\SysWOW64\KHATRA.exe	KHATRA.exe
File created	C:\Windows\SysWOW64\KHATRA.exe	KHATRA.exe

Drops file in Windows directory 64 IoCs

Processes:

KHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exe0ab40251273af3a0e2c76935d1176ca71e898c5a935d9aed1a8f4b21a0e0d8c9.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exe

description	ioc	process
File opened for modification	C:\Windows\INF\Autoplay.inF	KHATRA.exe
File opened for modification	C:\Windows\INF\Autoplay.inF	KHATRA.exe
File opened for modification	C:\Windows\inf\Autoplay.inF	KHATRA.exe
File opened for modification	C:\Windows\KHATARNAKH.exe	KHATRA.exe
File created	C:\Windows\KHATARNAKH.exe	KHATRA.exe
File opened for modification	C:\Windows\Xplorer.exe	KHATRA.exe
File opened for modification	C:\Windows\System\gHost.exe	KHATRA.exe
File created	C:\Windows\System\gHost.exe	KHATRA.exe
File opened for modification	C:\Windows\Xplorer.exe	KHATRA.exe
File created	C:\Windows\System\gHost.exe	KHATRA.exe
File opened for modification	C:\Windows\inf\Autoplay.inF	KHATRA.exe
File created	C:\Windows\KHATARNAKH.exe	KHATRA.exe
File created	C:\Windows\KHATARNAKH.exe	KHATRA.exe
File opened for modification	C:\Windows\Xplorer.exe	KHATRA.exe
File opened for modification	C:\Windows\Xplorer.exe	KHATRA.exe
File created	C:\Windows\Xplorer.exe	KHATRA.exe
File created	C:\Windows\KHATARNAKH.exe	KHATRA.exe
File created	C:\Windows\KHATARNAKH.exe	KHATRA.exe
File opened for modification	C:\Windows\INF\Autoplay.inF	KHATRA.exe
File opened for modification	C:\Windows\INF\Autoplay.inF	KHATRA.exe
File opened for modification	C:\Windows\System\gHost.exe	KHATRA.exe
File opened for modification	C:\Windows\INF\Autoplay.inF	KHATRA.exe
File opened for modification	C:\Windows\inf\Autoplay.inF	KHATRA.exe
File opened for modification	C:\Windows\System\gHost.exe	KHATRA.exe
File opened for modification	C:\Windows\inf\Autoplay.inF	KHATRA.exe
File opened for modification	C:\Windows\Xplorer.exe	KHATRA.exe
File opened for modification	C:\Windows\INF\Autoplay.inF	KHATRA.exe
File created	C:\Windows\Xplorer.exe	KHATRA.exe
File opened for modification	C:\Windows\System\gHost.exe	KHATRA.exe
File opened for modification	C:\Windows\INF\Autoplay.inF	0ab40251273af3a0e2c76935d1176ca71e898c5a935d9aed1a8f4b21a0e0d8c9.exe
File created	C:\Windows\KHATARNAKH.exe	KHATRA.exe
File opened for modification	C:\Windows\KHATARNAKH.exe	KHATRA.exe
File created	C:\Windows\KHATARNAKH.exe	KHATRA.exe
File opened for modification	C:\Windows\Xplorer.exe	KHATRA.exe
File opened for modification	C:\Windows\KHATARNAKH.exe	KHATRA.exe
File opened for modification	C:\Windows\System\gHost.exe	KHATRA.exe
File opened for modification	C:\Windows\System\gHost.exe	KHATRA.exe
File opened for modification	C:\Windows\Xplorer.exe	KHATRA.exe
File opened for modification	C:\Windows\inf\Autoplay.inF	KHATRA.exe
File opened for modification	C:\Windows\inf\Autoplay.inF	KHATRA.exe
File created	C:\Windows\System\gHost.exe	KHATRA.exe
File opened for modification	C:\Windows\System\gHost.exe	KHATRA.exe
File opened for modification	C:\Windows\inf\Autoplay.inF	KHATRA.exe
File created	C:\Windows\Xplorer.exe	KHATRA.exe
File opened for modification	C:\Windows\inf\Autoplay.inF	KHATRA.exe
File created	C:\Windows\System\gHost.exe	KHATRA.exe
File opened for modification	C:\Windows\System\gHost.exe	KHATRA.exe
File created	C:\Windows\Xplorer.exe	KHATRA.exe
File created	C:\Windows\Xplorer.exe	KHATRA.exe
File created	C:\Windows\KHATARNAKH.exe	KHATRA.exe
File created	C:\Windows\System\gHost.exe	KHATRA.exe
File opened for modification	C:\Windows\System\gHost.exe	KHATRA.exe
File created	C:\Windows\Xplorer.exe	KHATRA.exe
File opened for modification	C:\Windows\System\gHost.exe	KHATRA.exe
File opened for modification	C:\Windows\Xplorer.exe	KHATRA.exe
File created	C:\Windows\KHATARNAKH.exe	0ab40251273af3a0e2c76935d1176ca71e898c5a935d9aed1a8f4b21a0e0d8c9.exe
File created	C:\Windows\KHATARNAKH.exe	KHATRA.exe
File opened for modification	C:\Windows\KHATARNAKH.exe	KHATRA.exe
File opened for modification	C:\Windows\KHATARNAKH.exe	KHATRA.exe
File created	C:\Windows\Xplorer.exe	0ab40251273af3a0e2c76935d1176ca71e898c5a935d9aed1a8f4b21a0e0d8c9.exe
File opened for modification	C:\Windows\KHATARNAKH.exe	KHATRA.exe
File opened for modification	C:\Windows\inf\Autoplay.inF	KHATRA.exe
File opened for modification	C:\Windows\KHATARNAKH.exe	KHATRA.exe
File opened for modification	C:\Windows\inf\Autoplay.inF	KHATRA.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 40 IoCs

adware spyware

Modify Registry

T1112

Processes:

KHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exe0ab40251273af3a0e2c76935d1176ca71e898c5a935d9aed1a8f4b21a0e0d8c9.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window Title = "Internet Exploiter"	KHATRA.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main	KHATRA.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main	KHATRA.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main	KHATRA.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main	KHATRA.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main	KHATRA.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main	KHATRA.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window Title = "Internet Exploiter"	KHATRA.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window Title = "Internet Exploiter"	KHATRA.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main	KHATRA.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main	KHATRA.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window Title = "Internet Exploiter"	KHATRA.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main	KHATRA.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main	0ab40251273af3a0e2c76935d1176ca71e898c5a935d9aed1a8f4b21a0e0d8c9.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window Title = "Internet Exploiter"	0ab40251273af3a0e2c76935d1176ca71e898c5a935d9aed1a8f4b21a0e0d8c9.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main	KHATRA.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window Title = "Internet Exploiter"	KHATRA.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window Title = "Internet Exploiter"	KHATRA.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main	KHATRA.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window Title = "Internet Exploiter"	KHATRA.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main	KHATRA.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window Title = "Internet Exploiter"	KHATRA.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main	KHATRA.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window Title = "Internet Exploiter"	KHATRA.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main	KHATRA.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window Title = "Internet Exploiter"	KHATRA.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window Title = "Internet Exploiter"	KHATRA.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window Title = "Internet Exploiter"	KHATRA.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window Title = "Internet Exploiter"	KHATRA.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main	KHATRA.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window Title = "Internet Exploiter"	KHATRA.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window Title = "Internet Exploiter"	KHATRA.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main	KHATRA.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window Title = "Internet Exploiter"	KHATRA.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main	KHATRA.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main	KHATRA.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window Title = "Internet Exploiter"	KHATRA.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window Title = "Internet Exploiter"	KHATRA.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window Title = "Internet Exploiter"	KHATRA.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main	KHATRA.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

0ab40251273af3a0e2c76935d1176ca71e898c5a935d9aed1a8f4b21a0e0d8c9.exe

pid	process
2716	0ab40251273af3a0e2c76935d1176ca71e898c5a935d9aed1a8f4b21a0e0d8c9.exe
2716	0ab40251273af3a0e2c76935d1176ca71e898c5a935d9aed1a8f4b21a0e0d8c9.exe
2716	0ab40251273af3a0e2c76935d1176ca71e898c5a935d9aed1a8f4b21a0e0d8c9.exe
2716	0ab40251273af3a0e2c76935d1176ca71e898c5a935d9aed1a8f4b21a0e0d8c9.exe
2716	0ab40251273af3a0e2c76935d1176ca71e898c5a935d9aed1a8f4b21a0e0d8c9.exe
2716	0ab40251273af3a0e2c76935d1176ca71e898c5a935d9aed1a8f4b21a0e0d8c9.exe
2716	0ab40251273af3a0e2c76935d1176ca71e898c5a935d9aed1a8f4b21a0e0d8c9.exe
2716	0ab40251273af3a0e2c76935d1176ca71e898c5a935d9aed1a8f4b21a0e0d8c9.exe
2716	0ab40251273af3a0e2c76935d1176ca71e898c5a935d9aed1a8f4b21a0e0d8c9.exe
2716	0ab40251273af3a0e2c76935d1176ca71e898c5a935d9aed1a8f4b21a0e0d8c9.exe
2716	0ab40251273af3a0e2c76935d1176ca71e898c5a935d9aed1a8f4b21a0e0d8c9.exe
2716	0ab40251273af3a0e2c76935d1176ca71e898c5a935d9aed1a8f4b21a0e0d8c9.exe
2716	0ab40251273af3a0e2c76935d1176ca71e898c5a935d9aed1a8f4b21a0e0d8c9.exe
2716	0ab40251273af3a0e2c76935d1176ca71e898c5a935d9aed1a8f4b21a0e0d8c9.exe
2716	0ab40251273af3a0e2c76935d1176ca71e898c5a935d9aed1a8f4b21a0e0d8c9.exe
2716	0ab40251273af3a0e2c76935d1176ca71e898c5a935d9aed1a8f4b21a0e0d8c9.exe
2716	0ab40251273af3a0e2c76935d1176ca71e898c5a935d9aed1a8f4b21a0e0d8c9.exe
2716	0ab40251273af3a0e2c76935d1176ca71e898c5a935d9aed1a8f4b21a0e0d8c9.exe
2716	0ab40251273af3a0e2c76935d1176ca71e898c5a935d9aed1a8f4b21a0e0d8c9.exe
2716	0ab40251273af3a0e2c76935d1176ca71e898c5a935d9aed1a8f4b21a0e0d8c9.exe
2716	0ab40251273af3a0e2c76935d1176ca71e898c5a935d9aed1a8f4b21a0e0d8c9.exe
2716	0ab40251273af3a0e2c76935d1176ca71e898c5a935d9aed1a8f4b21a0e0d8c9.exe
2716	0ab40251273af3a0e2c76935d1176ca71e898c5a935d9aed1a8f4b21a0e0d8c9.exe
2716	0ab40251273af3a0e2c76935d1176ca71e898c5a935d9aed1a8f4b21a0e0d8c9.exe
2716	0ab40251273af3a0e2c76935d1176ca71e898c5a935d9aed1a8f4b21a0e0d8c9.exe
2716	0ab40251273af3a0e2c76935d1176ca71e898c5a935d9aed1a8f4b21a0e0d8c9.exe
2716	0ab40251273af3a0e2c76935d1176ca71e898c5a935d9aed1a8f4b21a0e0d8c9.exe
2716	0ab40251273af3a0e2c76935d1176ca71e898c5a935d9aed1a8f4b21a0e0d8c9.exe
2716	0ab40251273af3a0e2c76935d1176ca71e898c5a935d9aed1a8f4b21a0e0d8c9.exe
2716	0ab40251273af3a0e2c76935d1176ca71e898c5a935d9aed1a8f4b21a0e0d8c9.exe
2716	0ab40251273af3a0e2c76935d1176ca71e898c5a935d9aed1a8f4b21a0e0d8c9.exe
2716	0ab40251273af3a0e2c76935d1176ca71e898c5a935d9aed1a8f4b21a0e0d8c9.exe
2716	0ab40251273af3a0e2c76935d1176ca71e898c5a935d9aed1a8f4b21a0e0d8c9.exe
2716	0ab40251273af3a0e2c76935d1176ca71e898c5a935d9aed1a8f4b21a0e0d8c9.exe
2716	0ab40251273af3a0e2c76935d1176ca71e898c5a935d9aed1a8f4b21a0e0d8c9.exe
2716	0ab40251273af3a0e2c76935d1176ca71e898c5a935d9aed1a8f4b21a0e0d8c9.exe
2716	0ab40251273af3a0e2c76935d1176ca71e898c5a935d9aed1a8f4b21a0e0d8c9.exe
2716	0ab40251273af3a0e2c76935d1176ca71e898c5a935d9aed1a8f4b21a0e0d8c9.exe
2716	0ab40251273af3a0e2c76935d1176ca71e898c5a935d9aed1a8f4b21a0e0d8c9.exe
2716	0ab40251273af3a0e2c76935d1176ca71e898c5a935d9aed1a8f4b21a0e0d8c9.exe
2716	0ab40251273af3a0e2c76935d1176ca71e898c5a935d9aed1a8f4b21a0e0d8c9.exe
2716	0ab40251273af3a0e2c76935d1176ca71e898c5a935d9aed1a8f4b21a0e0d8c9.exe
2716	0ab40251273af3a0e2c76935d1176ca71e898c5a935d9aed1a8f4b21a0e0d8c9.exe
2716	0ab40251273af3a0e2c76935d1176ca71e898c5a935d9aed1a8f4b21a0e0d8c9.exe
2716	0ab40251273af3a0e2c76935d1176ca71e898c5a935d9aed1a8f4b21a0e0d8c9.exe
2716	0ab40251273af3a0e2c76935d1176ca71e898c5a935d9aed1a8f4b21a0e0d8c9.exe
2716	0ab40251273af3a0e2c76935d1176ca71e898c5a935d9aed1a8f4b21a0e0d8c9.exe
2716	0ab40251273af3a0e2c76935d1176ca71e898c5a935d9aed1a8f4b21a0e0d8c9.exe
2716	0ab40251273af3a0e2c76935d1176ca71e898c5a935d9aed1a8f4b21a0e0d8c9.exe
2716	0ab40251273af3a0e2c76935d1176ca71e898c5a935d9aed1a8f4b21a0e0d8c9.exe
2716	0ab40251273af3a0e2c76935d1176ca71e898c5a935d9aed1a8f4b21a0e0d8c9.exe
2716	0ab40251273af3a0e2c76935d1176ca71e898c5a935d9aed1a8f4b21a0e0d8c9.exe
2716	0ab40251273af3a0e2c76935d1176ca71e898c5a935d9aed1a8f4b21a0e0d8c9.exe
2716	0ab40251273af3a0e2c76935d1176ca71e898c5a935d9aed1a8f4b21a0e0d8c9.exe
2716	0ab40251273af3a0e2c76935d1176ca71e898c5a935d9aed1a8f4b21a0e0d8c9.exe
2716	0ab40251273af3a0e2c76935d1176ca71e898c5a935d9aed1a8f4b21a0e0d8c9.exe
2716	0ab40251273af3a0e2c76935d1176ca71e898c5a935d9aed1a8f4b21a0e0d8c9.exe
2716	0ab40251273af3a0e2c76935d1176ca71e898c5a935d9aed1a8f4b21a0e0d8c9.exe
2716	0ab40251273af3a0e2c76935d1176ca71e898c5a935d9aed1a8f4b21a0e0d8c9.exe
2716	0ab40251273af3a0e2c76935d1176ca71e898c5a935d9aed1a8f4b21a0e0d8c9.exe
2716	0ab40251273af3a0e2c76935d1176ca71e898c5a935d9aed1a8f4b21a0e0d8c9.exe
2716	0ab40251273af3a0e2c76935d1176ca71e898c5a935d9aed1a8f4b21a0e0d8c9.exe
2716	0ab40251273af3a0e2c76935d1176ca71e898c5a935d9aed1a8f4b21a0e0d8c9.exe
2716	0ab40251273af3a0e2c76935d1176ca71e898c5a935d9aed1a8f4b21a0e0d8c9.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

Processes:

Xplorer.exegHost.exe

pid process

4748 Xplorer.exe
3700 gHost.exe

pid	process
4748	Xplorer.exe
3700	gHost.exe

Suspicious use of FindShellTrayWindow 39 IoCs

Processes:

0ab40251273af3a0e2c76935d1176ca71e898c5a935d9aed1a8f4b21a0e0d8c9.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exeKHATRA.exe

pid	process
2716	0ab40251273af3a0e2c76935d1176ca71e898c5a935d9aed1a8f4b21a0e0d8c9.exe
2824	KHATRA.exe
2824	KHATRA.exe
2716	0ab40251273af3a0e2c76935d1176ca71e898c5a935d9aed1a8f4b21a0e0d8c9.exe
4364	KHATRA.exe
4364	KHATRA.exe
2888	KHATRA.exe
2888	KHATRA.exe
3424	KHATRA.exe
3424	KHATRA.exe
2788	KHATRA.exe
2788	KHATRA.exe
4920	KHATRA.exe
4920	KHATRA.exe
2156	KHATRA.exe
2156	KHATRA.exe
3772	KHATRA.exe
3772	KHATRA.exe
2320	KHATRA.exe
2320	KHATRA.exe
3972	KHATRA.exe
3972	KHATRA.exe
4824	KHATRA.exe
4824	KHATRA.exe
4596	KHATRA.exe
4596	KHATRA.exe
1588	KHATRA.exe
1588	KHATRA.exe
1620	KHATRA.exe
1620	KHATRA.exe
4296	KHATRA.exe
4296	KHATRA.exe
3108	KHATRA.exe
3108	KHATRA.exe
4760	KHATRA.exe
4760	KHATRA.exe
1108	KHATRA.exe
1108	KHATRA.exe
3088	KHATRA.exe

Suspicious use of SendNotifyMessage 39 IoCs

Processes:

pid	process
2716	0ab40251273af3a0e2c76935d1176ca71e898c5a935d9aed1a8f4b21a0e0d8c9.exe
2824	KHATRA.exe
2824	KHATRA.exe
2716	0ab40251273af3a0e2c76935d1176ca71e898c5a935d9aed1a8f4b21a0e0d8c9.exe
4364	KHATRA.exe
4364	KHATRA.exe
2888	KHATRA.exe
2888	KHATRA.exe
3424	KHATRA.exe
3424	KHATRA.exe
2788	KHATRA.exe
2788	KHATRA.exe
4920	KHATRA.exe
4920	KHATRA.exe
2156	KHATRA.exe
2156	KHATRA.exe
3772	KHATRA.exe
3772	KHATRA.exe
2320	KHATRA.exe
2320	KHATRA.exe
3972	KHATRA.exe
3972	KHATRA.exe
4824	KHATRA.exe
4824	KHATRA.exe
4596	KHATRA.exe
4596	KHATRA.exe
1588	KHATRA.exe
1588	KHATRA.exe
1620	KHATRA.exe
1620	KHATRA.exe
4296	KHATRA.exe
4296	KHATRA.exe
3108	KHATRA.exe
3108	KHATRA.exe
4760	KHATRA.exe
4760	KHATRA.exe
1108	KHATRA.exe
1108	KHATRA.exe
3088	KHATRA.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

0ab40251273af3a0e2c76935d1176ca71e898c5a935d9aed1a8f4b21a0e0d8c9.exeKHATRA.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.exeXplorer.exegHost.exe

description	pid	process	target process
PID 2716 wrote to memory of 2824	2716	0ab40251273af3a0e2c76935d1176ca71e898c5a935d9aed1a8f4b21a0e0d8c9.exe	KHATRA.exe
PID 2716 wrote to memory of 2824	2716	0ab40251273af3a0e2c76935d1176ca71e898c5a935d9aed1a8f4b21a0e0d8c9.exe	KHATRA.exe
PID 2716 wrote to memory of 2824	2716	0ab40251273af3a0e2c76935d1176ca71e898c5a935d9aed1a8f4b21a0e0d8c9.exe	KHATRA.exe
PID 2824 wrote to memory of 4748	2824	KHATRA.exe	Xplorer.exe
PID 2824 wrote to memory of 4748	2824	KHATRA.exe	Xplorer.exe
PID 2824 wrote to memory of 4748	2824	KHATRA.exe	Xplorer.exe
PID 2716 wrote to memory of 3700	2716	0ab40251273af3a0e2c76935d1176ca71e898c5a935d9aed1a8f4b21a0e0d8c9.exe	gHost.exe
PID 2716 wrote to memory of 3700	2716	0ab40251273af3a0e2c76935d1176ca71e898c5a935d9aed1a8f4b21a0e0d8c9.exe	gHost.exe
PID 2716 wrote to memory of 3700	2716	0ab40251273af3a0e2c76935d1176ca71e898c5a935d9aed1a8f4b21a0e0d8c9.exe	gHost.exe
PID 2716 wrote to memory of 2044	2716	0ab40251273af3a0e2c76935d1176ca71e898c5a935d9aed1a8f4b21a0e0d8c9.exe	cmd.exe
PID 2716 wrote to memory of 2044	2716	0ab40251273af3a0e2c76935d1176ca71e898c5a935d9aed1a8f4b21a0e0d8c9.exe	cmd.exe
PID 2716 wrote to memory of 2044	2716	0ab40251273af3a0e2c76935d1176ca71e898c5a935d9aed1a8f4b21a0e0d8c9.exe	cmd.exe
PID 2824 wrote to memory of 940	2824	KHATRA.exe	cmd.exe
PID 2824 wrote to memory of 940	2824	KHATRA.exe	cmd.exe
PID 2824 wrote to memory of 940	2824	KHATRA.exe	cmd.exe
PID 940 wrote to memory of 3628	940	cmd.exe	at.exe
PID 940 wrote to memory of 3628	940	cmd.exe	at.exe
PID 940 wrote to memory of 3628	940	cmd.exe	at.exe
PID 2044 wrote to memory of 2440	2044	cmd.exe	at.exe
PID 2044 wrote to memory of 2440	2044	cmd.exe	at.exe
PID 2044 wrote to memory of 2440	2044	cmd.exe	at.exe
PID 2716 wrote to memory of 2280	2716	0ab40251273af3a0e2c76935d1176ca71e898c5a935d9aed1a8f4b21a0e0d8c9.exe	cmd.exe
PID 2716 wrote to memory of 2280	2716	0ab40251273af3a0e2c76935d1176ca71e898c5a935d9aed1a8f4b21a0e0d8c9.exe	cmd.exe
PID 2716 wrote to memory of 2280	2716	0ab40251273af3a0e2c76935d1176ca71e898c5a935d9aed1a8f4b21a0e0d8c9.exe	cmd.exe
PID 2824 wrote to memory of 1788	2824	KHATRA.exe	cmd.exe
PID 2824 wrote to memory of 1788	2824	KHATRA.exe	cmd.exe
PID 2824 wrote to memory of 1788	2824	KHATRA.exe	cmd.exe
PID 1788 wrote to memory of 5088	1788	cmd.exe	at.exe
PID 1788 wrote to memory of 5088	1788	cmd.exe	at.exe
PID 1788 wrote to memory of 5088	1788	cmd.exe	at.exe
PID 2280 wrote to memory of 1332	2280	cmd.exe	at.exe
PID 2280 wrote to memory of 1332	2280	cmd.exe	at.exe
PID 2280 wrote to memory of 1332	2280	cmd.exe	at.exe
PID 2824 wrote to memory of 4952	2824	KHATRA.exe	cmd.exe
PID 2824 wrote to memory of 4952	2824	KHATRA.exe	cmd.exe
PID 2824 wrote to memory of 4952	2824	KHATRA.exe	cmd.exe
PID 2716 wrote to memory of 4072	2716	0ab40251273af3a0e2c76935d1176ca71e898c5a935d9aed1a8f4b21a0e0d8c9.exe	cmd.exe
PID 2716 wrote to memory of 4072	2716	0ab40251273af3a0e2c76935d1176ca71e898c5a935d9aed1a8f4b21a0e0d8c9.exe	cmd.exe
PID 2716 wrote to memory of 4072	2716	0ab40251273af3a0e2c76935d1176ca71e898c5a935d9aed1a8f4b21a0e0d8c9.exe	cmd.exe
PID 4952 wrote to memory of 1680	4952	cmd.exe	regsvr32.exe
PID 4952 wrote to memory of 1680	4952	cmd.exe	regsvr32.exe
PID 4952 wrote to memory of 1680	4952	cmd.exe	regsvr32.exe
PID 4072 wrote to memory of 2332	4072	cmd.exe	regsvr32.exe
PID 4072 wrote to memory of 2332	4072	cmd.exe	regsvr32.exe
PID 4072 wrote to memory of 2332	4072	cmd.exe	regsvr32.exe
PID 2824 wrote to memory of 4452	2824	KHATRA.exe	cmd.exe
PID 2824 wrote to memory of 4452	2824	KHATRA.exe	cmd.exe
PID 2824 wrote to memory of 4452	2824	KHATRA.exe	cmd.exe
PID 2716 wrote to memory of 1984	2716	0ab40251273af3a0e2c76935d1176ca71e898c5a935d9aed1a8f4b21a0e0d8c9.exe	cmd.exe
PID 2716 wrote to memory of 1984	2716	0ab40251273af3a0e2c76935d1176ca71e898c5a935d9aed1a8f4b21a0e0d8c9.exe	cmd.exe
PID 2716 wrote to memory of 1984	2716	0ab40251273af3a0e2c76935d1176ca71e898c5a935d9aed1a8f4b21a0e0d8c9.exe	cmd.exe
PID 4452 wrote to memory of 3356	4452	cmd.exe	netsh.exe
PID 4452 wrote to memory of 3356	4452	cmd.exe	netsh.exe
PID 4452 wrote to memory of 3356	4452	cmd.exe	netsh.exe
PID 1984 wrote to memory of 3200	1984	cmd.exe	netsh.exe
PID 1984 wrote to memory of 3200	1984	cmd.exe	netsh.exe
PID 1984 wrote to memory of 3200	1984	cmd.exe	netsh.exe
PID 4748 wrote to memory of 3296	4748	Xplorer.exe	KHATRA.exe
PID 4748 wrote to memory of 3296	4748	Xplorer.exe	KHATRA.exe
PID 4748 wrote to memory of 3296	4748	Xplorer.exe	KHATRA.exe
PID 3700 wrote to memory of 3640	3700	gHost.exe	KHATRA.exe
PID 3700 wrote to memory of 3640	3700	gHost.exe	KHATRA.exe
PID 3700 wrote to memory of 3640	3700	gHost.exe	KHATRA.exe
PID 4748 wrote to memory of 4364	4748	Xplorer.exe	KHATRA.exe

C:\Users\Admin\AppData\Local\Temp\0ab40251273af3a0e2c76935d1176ca71e898c5a935d9aed1a8f4b21a0e0d8c9.exe
"C:\Users\Admin\AppData\Local\Temp\0ab40251273af3a0e2c76935d1176ca71e898c5a935d9aed1a8f4b21a0e0d8c9.exe"
1⤵
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Adds Run key to start application
- Modifies WinLogon
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2716

C:\Windows\SysWOW64\KHATRA.exe
C:\Windows\system32\KHATRA.exe
2⤵
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Executes dropped EXE
- Adds Run key to start application
- Modifies WinLogon
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2824

C:\Windows\Xplorer.exe
"C:\Windows\Xplorer.exe" /Windows
3⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:4748

C:\Windows\SysWOW64\KHATRA.exe
C:\Windows\system32\KHATRA.exe
4⤵
- Executes dropped EXE
PID:3296

C:\Windows\SysWOW64\KHATRA.exe
C:\Windows\system32\KHATRA.exe
4⤵
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Executes dropped EXE
- Adds Run key to start application
- Modifies WinLogon
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4364

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /C AT /delete /yes
5⤵
PID:800

C:\Windows\SysWOW64\at.exe
AT /delete /yes
6⤵
PID:3352

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /C AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe
5⤵
PID:768

C:\Windows\SysWOW64\at.exe
AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe
6⤵
PID:4824

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /C RegSvr32 /S C:\Windows\system32\avphost.dll
5⤵
PID:2964

C:\Windows\SysWOW64\regsvr32.exe
RegSvr32 /S C:\Windows\system32\avphost.dll
6⤵
PID:5108

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /C netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System
5⤵
PID:3748

C:\Windows\SysWOW64\netsh.exe
netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System
6⤵
- Modifies Windows Firewall
PID:4228

C:\Windows\SysWOW64\KHATRA.exe
C:\Windows\system32\KHATRA.exe
4⤵
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Executes dropped EXE
- Adds Run key to start application
- Modifies WinLogon
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2888

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /C AT /delete /yes
5⤵
PID:3492

C:\Windows\SysWOW64\at.exe
AT /delete /yes
6⤵
PID:1596

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /C AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe
5⤵
PID:3528

C:\Windows\SysWOW64\at.exe
AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe
6⤵
PID:3344

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /C RegSvr32 /S C:\Windows\system32\avphost.dll
5⤵
PID:2716

C:\Windows\SysWOW64\regsvr32.exe
RegSvr32 /S C:\Windows\system32\avphost.dll
6⤵
PID:4604

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /C netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System
5⤵
PID:5088

C:\Windows\SysWOW64\netsh.exe
netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System
6⤵
- Modifies Windows Firewall
PID:4332

C:\Windows\SysWOW64\KHATRA.exe
C:\Windows\system32\KHATRA.exe
4⤵
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Executes dropped EXE
- Adds Run key to start application
- Modifies WinLogon
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3424

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /C AT /delete /yes
5⤵
PID:3256

C:\Windows\SysWOW64\at.exe
AT /delete /yes
6⤵
PID:3472

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /C AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe
5⤵
PID:4276

C:\Windows\SysWOW64\at.exe
AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe
6⤵
PID:3144

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /C RegSvr32 /S C:\Windows\system32\avphost.dll
5⤵
PID:3352

C:\Windows\SysWOW64\regsvr32.exe
RegSvr32 /S C:\Windows\system32\avphost.dll
6⤵
PID:1776

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /C netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System
5⤵
PID:3712

C:\Windows\SysWOW64\netsh.exe
netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System
6⤵
- Modifies Windows Firewall
PID:3864

C:\Windows\SysWOW64\KHATRA.exe
C:\Windows\system32\KHATRA.exe
4⤵
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Executes dropped EXE
- Adds Run key to start application
- Modifies WinLogon
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2788

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /C AT /delete /yes
5⤵
PID:5088

C:\Windows\SysWOW64\at.exe
AT /delete /yes
6⤵
PID:3148

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /C AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe
5⤵
PID:3444

C:\Windows\SysWOW64\at.exe
AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe
6⤵
PID:1108

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /C RegSvr32 /S C:\Windows\system32\avphost.dll
5⤵
PID:5040

C:\Windows\SysWOW64\regsvr32.exe
RegSvr32 /S C:\Windows\system32\avphost.dll
6⤵
PID:576

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /C netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System
5⤵
PID:3864

C:\Windows\SysWOW64\netsh.exe
netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System
6⤵
- Modifies Windows Firewall
PID:3564

C:\Windows\SysWOW64\KHATRA.exe
C:\Windows\system32\KHATRA.exe
4⤵
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Executes dropped EXE
- Adds Run key to start application
- Modifies WinLogon
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4920

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /C AT /delete /yes
5⤵
PID:4260

C:\Windows\SysWOW64\at.exe
AT /delete /yes
6⤵
PID:2040

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /C AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe
5⤵
PID:2412

C:\Windows\SysWOW64\at.exe
AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe
6⤵
PID:3240

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /C RegSvr32 /S C:\Windows\system32\avphost.dll
5⤵
PID:1824

C:\Windows\SysWOW64\regsvr32.exe
RegSvr32 /S C:\Windows\system32\avphost.dll
6⤵
PID:1680

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /C netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System
5⤵
PID:4952

C:\Windows\SysWOW64\netsh.exe
netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System
6⤵
- Modifies Windows Firewall
PID:4316

C:\Windows\SysWOW64\KHATRA.exe
C:\Windows\system32\KHATRA.exe
4⤵
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Executes dropped EXE
- Adds Run key to start application
- Modifies WinLogon
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2156

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /C AT /delete /yes
5⤵
PID:3088

C:\Windows\SysWOW64\at.exe
AT /delete /yes
6⤵
PID:4276

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /C AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe
5⤵
PID:1004

C:\Windows\SysWOW64\at.exe
AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe
6⤵
PID:4452

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /C RegSvr32 /S C:\Windows\system32\avphost.dll
5⤵
PID:4584

C:\Windows\SysWOW64\regsvr32.exe
RegSvr32 /S C:\Windows\system32\avphost.dll
6⤵
PID:4180

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /C netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System
5⤵
PID:3572

C:\Windows\SysWOW64\netsh.exe
netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System
6⤵
- Modifies Windows Firewall
PID:3512

C:\Windows\SysWOW64\KHATRA.exe
C:\Windows\system32\KHATRA.exe
4⤵
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Executes dropped EXE
- Adds Run key to start application
- Modifies WinLogon
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3772

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /C AT /delete /yes
5⤵
PID:4764

C:\Windows\SysWOW64\at.exe
AT /delete /yes
6⤵
PID:2044

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /C AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe
5⤵
PID:3896

C:\Windows\SysWOW64\at.exe
AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe
6⤵
PID:3092

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /C RegSvr32 /S C:\Windows\system32\avphost.dll
5⤵
PID:2140

C:\Windows\SysWOW64\regsvr32.exe
RegSvr32 /S C:\Windows\system32\avphost.dll
6⤵
PID:4756

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /C netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System
5⤵
PID:2636

C:\Windows\SysWOW64\netsh.exe
netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System
6⤵
- Modifies Windows Firewall
PID:2828

C:\Windows\SysWOW64\KHATRA.exe
C:\Windows\system32\KHATRA.exe
4⤵
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Executes dropped EXE
- Adds Run key to start application
- Modifies WinLogon
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2320

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /C AT /delete /yes
5⤵
PID:4240

C:\Windows\SysWOW64\at.exe
AT /delete /yes
6⤵
PID:3636

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /C AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe
5⤵
PID:1728

C:\Windows\SysWOW64\at.exe
AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe
6⤵
PID:2552

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /C RegSvr32 /S C:\Windows\system32\avphost.dll
5⤵
PID:1192

C:\Windows\SysWOW64\regsvr32.exe
RegSvr32 /S C:\Windows\system32\avphost.dll
6⤵
PID:3624

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /C netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System
5⤵
PID:3536

C:\Windows\SysWOW64\netsh.exe
netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System
6⤵
- Modifies Windows Firewall
PID:3044

C:\Windows\SysWOW64\KHATRA.exe
C:\Windows\system32\KHATRA.exe
4⤵
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Executes dropped EXE
- Adds Run key to start application
- Modifies WinLogon
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3972

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /C AT /delete /yes
5⤵
PID:1600

C:\Windows\SysWOW64\at.exe
AT /delete /yes
6⤵
PID:4316

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /C AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe
5⤵
PID:3516

C:\Windows\SysWOW64\at.exe
AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe
6⤵
PID:3184

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /C RegSvr32 /S C:\Windows\system32\avphost.dll
5⤵
PID:4688

C:\Windows\SysWOW64\regsvr32.exe
RegSvr32 /S C:\Windows\system32\avphost.dll
6⤵
PID:3508

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /C netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System
5⤵
PID:4168

C:\Windows\SysWOW64\netsh.exe
netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System
6⤵
- Modifies Windows Firewall
PID:4932

C:\Windows\SysWOW64\KHATRA.exe
C:\Windows\system32\KHATRA.exe
4⤵
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Executes dropped EXE
- Adds Run key to start application
- Modifies WinLogon
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4824

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /C AT /delete /yes
5⤵
PID:2008

C:\Windows\SysWOW64\at.exe
AT /delete /yes
6⤵
PID:3552

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /C AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe
5⤵
PID:3148

C:\Windows\SysWOW64\at.exe
AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe
6⤵
PID:4532

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /C RegSvr32 /S C:\Windows\system32\avphost.dll
5⤵
PID:3856

C:\Windows\SysWOW64\regsvr32.exe
RegSvr32 /S C:\Windows\system32\avphost.dll
6⤵
PID:768

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /C netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System
5⤵
PID:3924

C:\Windows\SysWOW64\netsh.exe
netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System
6⤵
- Modifies Windows Firewall
PID:4356

C:\Windows\SysWOW64\KHATRA.exe
C:\Windows\system32\KHATRA.exe
4⤵
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Executes dropped EXE
- Adds Run key to start application
- Modifies WinLogon
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4596

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /C AT /delete /yes
5⤵
PID:4700

C:\Windows\SysWOW64\at.exe
AT /delete /yes
6⤵
PID:4228

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /C AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe
5⤵
PID:1232

C:\Windows\SysWOW64\at.exe
AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe
6⤵
PID:4612

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /C RegSvr32 /S C:\Windows\system32\avphost.dll
5⤵
PID:4272

C:\Windows\SysWOW64\regsvr32.exe
RegSvr32 /S C:\Windows\system32\avphost.dll
6⤵
PID:4324

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /C netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System
5⤵
PID:3268

C:\Windows\SysWOW64\netsh.exe
netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System
6⤵
- Modifies Windows Firewall
PID:2324

C:\Windows\SysWOW64\KHATRA.exe
C:\Windows\system32\KHATRA.exe
4⤵
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Executes dropped EXE
- Adds Run key to start application
- Modifies WinLogon
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1588

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /C AT /delete /yes
5⤵
PID:2408

C:\Windows\SysWOW64\at.exe
AT /delete /yes
6⤵
PID:1192

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /C AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe
5⤵
PID:4364

C:\Windows\SysWOW64\at.exe
AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe
6⤵
PID:2968

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /C RegSvr32 /S C:\Windows\system32\avphost.dll
5⤵
PID:1172

C:\Windows\SysWOW64\regsvr32.exe
RegSvr32 /S C:\Windows\system32\avphost.dll
6⤵
PID:3212

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /C netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System
5⤵
PID:3992

C:\Windows\SysWOW64\netsh.exe
netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System
6⤵
- Modifies Windows Firewall
PID:1204

C:\Windows\SysWOW64\KHATRA.exe
C:\Windows\system32\KHATRA.exe
4⤵
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Executes dropped EXE
- Adds Run key to start application
- Modifies WinLogon
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1620

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /C AT /delete /yes
5⤵
PID:3184

C:\Windows\SysWOW64\at.exe
AT /delete /yes
6⤵
PID:2072

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /C AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe
5⤵
PID:4276

C:\Windows\SysWOW64\at.exe
AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe
6⤵
PID:1576

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /C RegSvr32 /S C:\Windows\system32\avphost.dll
5⤵
PID:220

C:\Windows\SysWOW64\regsvr32.exe
RegSvr32 /S C:\Windows\system32\avphost.dll
6⤵
PID:4344

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /C netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System
5⤵
PID:800

C:\Windows\SysWOW64\netsh.exe
netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System
6⤵
- Modifies Windows Firewall
PID:2488

C:\Windows\SysWOW64\KHATRA.exe
C:\Windows\system32\KHATRA.exe
4⤵
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Executes dropped EXE
- Adds Run key to start application
- Modifies WinLogon
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4296

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /C AT /delete /yes
5⤵
PID:3504

C:\Windows\SysWOW64\at.exe
AT /delete /yes
6⤵
PID:4816

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /C AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe
5⤵
PID:4416

C:\Windows\SysWOW64\at.exe
AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe
6⤵
PID:4372

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /C RegSvr32 /S C:\Windows\system32\avphost.dll
5⤵
PID:4764

C:\Windows\SysWOW64\regsvr32.exe
RegSvr32 /S C:\Windows\system32\avphost.dll
6⤵
PID:2044

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /C netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System
5⤵
PID:3864

C:\Windows\SysWOW64\netsh.exe
netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System
6⤵
- Modifies Windows Firewall
PID:2964

C:\Windows\SysWOW64\KHATRA.exe
C:\Windows\system32\KHATRA.exe
4⤵
- Executes dropped EXE
PID:3572

C:\Windows\SysWOW64\KHATRA.exe
C:\Windows\system32\KHATRA.exe
4⤵
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Executes dropped EXE
- Adds Run key to start application
- Modifies WinLogon
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3108

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /C AT /delete /yes
5⤵
PID:3988

C:\Windows\SysWOW64\at.exe
AT /delete /yes
6⤵
PID:2176

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /C AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe
5⤵
PID:4672

C:\Windows\SysWOW64\at.exe
AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe
6⤵
PID:4052

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /C RegSvr32 /S C:\Windows\system32\avphost.dll
5⤵
PID:5068

C:\Windows\SysWOW64\regsvr32.exe
RegSvr32 /S C:\Windows\system32\avphost.dll
6⤵
PID:2716

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /C netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System
5⤵
PID:3268

C:\Windows\SysWOW64\netsh.exe
netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System
6⤵
- Modifies Windows Firewall
PID:3420

C:\Windows\SysWOW64\KHATRA.exe
C:\Windows\system32\KHATRA.exe
4⤵
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Executes dropped EXE
- Adds Run key to start application
- Modifies WinLogon
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4760

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /C AT /delete /yes
5⤵
PID:3344

C:\Windows\SysWOW64\at.exe
AT /delete /yes
6⤵
PID:4788

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /C AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe
5⤵
PID:740

C:\Windows\SysWOW64\at.exe
AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe
6⤵
PID:2368

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /C RegSvr32 /S C:\Windows\system32\avphost.dll
5⤵
PID:4988

C:\Windows\SysWOW64\regsvr32.exe
RegSvr32 /S C:\Windows\system32\avphost.dll
6⤵
PID:4768

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /C netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System
5⤵
PID:4620

C:\Windows\SysWOW64\netsh.exe
netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System
6⤵
- Modifies Windows Firewall
PID:4536

C:\Windows\SysWOW64\KHATRA.exe
C:\Windows\system32\KHATRA.exe
4⤵
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Executes dropped EXE
- Adds Run key to start application
- Modifies WinLogon
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1108

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /C AT /delete /yes
5⤵
PID:3184

C:\Windows\SysWOW64\at.exe
AT /delete /yes
6⤵
PID:1824

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /C AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe
5⤵
PID:2376

C:\Windows\SysWOW64\at.exe
AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe
6⤵
PID:4932

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /C RegSvr32 /S C:\Windows\system32\avphost.dll
5⤵
PID:4420

C:\Windows\SysWOW64\regsvr32.exe
RegSvr32 /S C:\Windows\system32\avphost.dll
6⤵
PID:5004

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /C netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System
5⤵
PID:2488

C:\Windows\SysWOW64\netsh.exe
netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System
6⤵
- Modifies Windows Firewall
PID:3096

C:\Windows\SysWOW64\KHATRA.exe
C:\Windows\system32\KHATRA.exe
4⤵
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Executes dropped EXE
- Adds Run key to start application
- Modifies WinLogon
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3088

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /C AT /delete /yes
5⤵
PID:2080

C:\Windows\SysWOW64\at.exe
AT /delete /yes
6⤵
PID:3516

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /C AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe
5⤵
PID:4368

C:\Windows\SysWOW64\at.exe
AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe
6⤵
PID:796

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /C RegSvr32 /S C:\Windows\system32\avphost.dll
5⤵
PID:4264

C:\Windows\SysWOW64\regsvr32.exe
RegSvr32 /S C:\Windows\system32\avphost.dll
6⤵
PID:4928

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /C netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System
5⤵
PID:4412

C:\Windows\SysWOW64\netsh.exe
netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System
6⤵
- Modifies Windows Firewall
PID:1288

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /C AT /delete /yes
3⤵
- Suspicious use of WriteProcessMemory
PID:940

C:\Windows\SysWOW64\at.exe
AT /delete /yes
4⤵
PID:3628

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /C AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:1788

C:\Windows\SysWOW64\at.exe
AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe
4⤵
PID:5088

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /C RegSvr32 /S C:\Windows\system32\avphost.dll
3⤵
- Suspicious use of WriteProcessMemory
PID:4952

C:\Windows\SysWOW64\regsvr32.exe
RegSvr32 /S C:\Windows\system32\avphost.dll
4⤵
PID:1680

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /C netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System
3⤵
- Suspicious use of WriteProcessMemory
PID:4452

C:\Windows\SysWOW64\netsh.exe
netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System
4⤵
- Modifies Windows Firewall
PID:3356

C:\Windows\System\gHost.exe
"C:\Windows\System\gHost.exe" /Reproduce
2⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:3700

C:\Windows\SysWOW64\KHATRA.exe
C:\Windows\system32\KHATRA.exe
3⤵
- Executes dropped EXE
PID:3640

C:\Windows\SysWOW64\KHATRA.exe
C:\Windows\system32\KHATRA.exe
3⤵
- Executes dropped EXE
PID:3896

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /C AT /delete /yes
2⤵
- Suspicious use of WriteProcessMemory
PID:2044

C:\Windows\SysWOW64\at.exe
AT /delete /yes
3⤵
PID:2440

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /C AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe
2⤵
- Suspicious use of WriteProcessMemory
PID:2280

C:\Windows\SysWOW64\at.exe
AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\KHATRA.exe
3⤵
PID:1332

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /C RegSvr32 /S C:\Windows\system32\avphost.dll
2⤵
- Suspicious use of WriteProcessMemory
PID:4072

C:\Windows\SysWOW64\regsvr32.exe
RegSvr32 /S C:\Windows\system32\avphost.dll
3⤵
PID:2332

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /C netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System
2⤵
- Suspicious use of WriteProcessMemory
PID:1984

C:\Windows\SysWOW64\netsh.exe
netsh firewall add allowedprogram program=C:\Windows\system32\KHATRA.exe name=System
3⤵
- Modifies Windows Firewall
PID:3200

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Modify Existing Service

T1031

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Lateral Movement

Replication Through Removable Media

T1091

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\(Empty).LNK
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\(Empty).LNK
Filesize
1KB

MD5
5b9cb340f13ec70567c333b3ab6c37aa

SHA1
6229271e28e7dc4b4f35d2c0f12d66199f426a17

SHA256
6ccdec87e83b0347b3cea3a7525e9ac59d96210c88bd09b0b5ce4a7bf5fae3d8

SHA512
67f04ebefef1b3b4d57d27e192ad491eeaa56de9a8fa50eb2e6ef6704b9158e04c06886d3da8ffc026d0e9fcff6764fc569457f95ee47a7715e85616b359e358

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\(Empty).LNK
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\(Empty).LNK
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\(Empty).LNK
Filesize
1KB

MD5
5e73ed7962a0f6993cfb417336157d4c

SHA1
6249badb0d2ef7be473e46b21bd55c033ef91fdb

SHA256
42b3fd63ec7278a6bdeca9cd393626a7b20ca33b3f887d628e37be2ce3438873

SHA512
b1352d1cacbf1ae3234a1a77985e74e14b0e5c558caa613f007f54534b646c2ad4cb6f69d7abb1be7e51df30fff0c4df06cf5e1318b222f2ec56e8787f1a27a0

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\(Empty).LNK
Filesize
1KB

MD5
2945d16a3f0ab67b33a14610815edb4d

SHA1
b6763f03c1d40e8d617b451754f9b580310a2141

SHA256
c1649405628fe553e86d96703bf8de3f34f3cf8baa8c68fb1f7a8ee685ac64fd

SHA512
b6fd01b17ca643a17257592a704c8ace2d47eda4943fd5b81cdf1c38de1a9044d3cfbe2adad880d79a1ec83f9f10a3037390bb183d1bc2c5c7decb104cce82fd

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\(Empty).LNK
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\(Empty).LNK
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\(Empty).LNK
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\Windows\KHATARNAKH.exe
Filesize
535KB

MD5
6acd1647078d560a5ec3d53f85b5c709

SHA1
5d55d16df9e337800c7410a819ee7b56f7b4b31e

SHA256
0ab40251273af3a0e2c76935d1176ca71e898c5a935d9aed1a8f4b21a0e0d8c9

SHA512
08dc141a957f1e5bcd1c92f51093abd1b8dfcfccfccc2f5572a0304282ad93f05ce47900a799b1e8b1705f22e74ad84a6203db89a637333f347974df64fe47a9

Download Submit
C:\Windows\KHATARNAKH.exe
Filesize
535KB

MD5
6acd1647078d560a5ec3d53f85b5c709

SHA1
5d55d16df9e337800c7410a819ee7b56f7b4b31e

SHA256
0ab40251273af3a0e2c76935d1176ca71e898c5a935d9aed1a8f4b21a0e0d8c9

SHA512
08dc141a957f1e5bcd1c92f51093abd1b8dfcfccfccc2f5572a0304282ad93f05ce47900a799b1e8b1705f22e74ad84a6203db89a637333f347974df64fe47a9

Download Submit
C:\Windows\KHATARNAKH.exe
Filesize
535KB

MD5
6acd1647078d560a5ec3d53f85b5c709

SHA1
5d55d16df9e337800c7410a819ee7b56f7b4b31e

SHA256
0ab40251273af3a0e2c76935d1176ca71e898c5a935d9aed1a8f4b21a0e0d8c9

SHA512
08dc141a957f1e5bcd1c92f51093abd1b8dfcfccfccc2f5572a0304282ad93f05ce47900a799b1e8b1705f22e74ad84a6203db89a637333f347974df64fe47a9

Download Submit
C:\Windows\KHATARNAKH.exe
Filesize
535KB

MD5
6acd1647078d560a5ec3d53f85b5c709

SHA1
5d55d16df9e337800c7410a819ee7b56f7b4b31e

SHA256
0ab40251273af3a0e2c76935d1176ca71e898c5a935d9aed1a8f4b21a0e0d8c9

SHA512
08dc141a957f1e5bcd1c92f51093abd1b8dfcfccfccc2f5572a0304282ad93f05ce47900a799b1e8b1705f22e74ad84a6203db89a637333f347974df64fe47a9

Download Submit
C:\Windows\KHATARNAKH.exe
Filesize
535KB

MD5
6acd1647078d560a5ec3d53f85b5c709

SHA1
5d55d16df9e337800c7410a819ee7b56f7b4b31e

SHA256
0ab40251273af3a0e2c76935d1176ca71e898c5a935d9aed1a8f4b21a0e0d8c9

SHA512
08dc141a957f1e5bcd1c92f51093abd1b8dfcfccfccc2f5572a0304282ad93f05ce47900a799b1e8b1705f22e74ad84a6203db89a637333f347974df64fe47a9

Download Submit
C:\Windows\KHATARNAKH.exe
Filesize
535KB

MD5
6acd1647078d560a5ec3d53f85b5c709

SHA1
5d55d16df9e337800c7410a819ee7b56f7b4b31e

SHA256
0ab40251273af3a0e2c76935d1176ca71e898c5a935d9aed1a8f4b21a0e0d8c9

SHA512
08dc141a957f1e5bcd1c92f51093abd1b8dfcfccfccc2f5572a0304282ad93f05ce47900a799b1e8b1705f22e74ad84a6203db89a637333f347974df64fe47a9

Download Submit
C:\Windows\KHATARNAKH.exe
Filesize
535KB

MD5
6acd1647078d560a5ec3d53f85b5c709

SHA1
5d55d16df9e337800c7410a819ee7b56f7b4b31e

SHA256
0ab40251273af3a0e2c76935d1176ca71e898c5a935d9aed1a8f4b21a0e0d8c9

SHA512
08dc141a957f1e5bcd1c92f51093abd1b8dfcfccfccc2f5572a0304282ad93f05ce47900a799b1e8b1705f22e74ad84a6203db89a637333f347974df64fe47a9

Download Submit
C:\Windows\KHATARNAKH.exe
Filesize
535KB

MD5
6acd1647078d560a5ec3d53f85b5c709

SHA1
5d55d16df9e337800c7410a819ee7b56f7b4b31e

SHA256
0ab40251273af3a0e2c76935d1176ca71e898c5a935d9aed1a8f4b21a0e0d8c9

SHA512
08dc141a957f1e5bcd1c92f51093abd1b8dfcfccfccc2f5572a0304282ad93f05ce47900a799b1e8b1705f22e74ad84a6203db89a637333f347974df64fe47a9

Download Submit
C:\Windows\KHATARNAKH.exe
Filesize
535KB

MD5
6acd1647078d560a5ec3d53f85b5c709

SHA1
5d55d16df9e337800c7410a819ee7b56f7b4b31e

SHA256
0ab40251273af3a0e2c76935d1176ca71e898c5a935d9aed1a8f4b21a0e0d8c9

SHA512
08dc141a957f1e5bcd1c92f51093abd1b8dfcfccfccc2f5572a0304282ad93f05ce47900a799b1e8b1705f22e74ad84a6203db89a637333f347974df64fe47a9

Download Submit
C:\Windows\SysWOW64\KHATRA.exe
Filesize
535KB

MD5
6acd1647078d560a5ec3d53f85b5c709

SHA1
5d55d16df9e337800c7410a819ee7b56f7b4b31e

SHA256
0ab40251273af3a0e2c76935d1176ca71e898c5a935d9aed1a8f4b21a0e0d8c9

SHA512
08dc141a957f1e5bcd1c92f51093abd1b8dfcfccfccc2f5572a0304282ad93f05ce47900a799b1e8b1705f22e74ad84a6203db89a637333f347974df64fe47a9

Download Submit
C:\Windows\SysWOW64\KHATRA.exe
Filesize
535KB

MD5
6acd1647078d560a5ec3d53f85b5c709

SHA1
5d55d16df9e337800c7410a819ee7b56f7b4b31e

SHA256
0ab40251273af3a0e2c76935d1176ca71e898c5a935d9aed1a8f4b21a0e0d8c9

SHA512
08dc141a957f1e5bcd1c92f51093abd1b8dfcfccfccc2f5572a0304282ad93f05ce47900a799b1e8b1705f22e74ad84a6203db89a637333f347974df64fe47a9

Download Submit
C:\Windows\SysWOW64\KHATRA.exe
Filesize
535KB

MD5
6acd1647078d560a5ec3d53f85b5c709

SHA1
5d55d16df9e337800c7410a819ee7b56f7b4b31e

SHA256
0ab40251273af3a0e2c76935d1176ca71e898c5a935d9aed1a8f4b21a0e0d8c9

SHA512
08dc141a957f1e5bcd1c92f51093abd1b8dfcfccfccc2f5572a0304282ad93f05ce47900a799b1e8b1705f22e74ad84a6203db89a637333f347974df64fe47a9

Download Submit
C:\Windows\SysWOW64\KHATRA.exe
Filesize
535KB

MD5
6acd1647078d560a5ec3d53f85b5c709

SHA1
5d55d16df9e337800c7410a819ee7b56f7b4b31e

SHA256
0ab40251273af3a0e2c76935d1176ca71e898c5a935d9aed1a8f4b21a0e0d8c9

SHA512
08dc141a957f1e5bcd1c92f51093abd1b8dfcfccfccc2f5572a0304282ad93f05ce47900a799b1e8b1705f22e74ad84a6203db89a637333f347974df64fe47a9

Download Submit
C:\Windows\SysWOW64\KHATRA.exe
Filesize
535KB

MD5
6acd1647078d560a5ec3d53f85b5c709

SHA1
5d55d16df9e337800c7410a819ee7b56f7b4b31e

SHA256
0ab40251273af3a0e2c76935d1176ca71e898c5a935d9aed1a8f4b21a0e0d8c9

SHA512
08dc141a957f1e5bcd1c92f51093abd1b8dfcfccfccc2f5572a0304282ad93f05ce47900a799b1e8b1705f22e74ad84a6203db89a637333f347974df64fe47a9

Download Submit
C:\Windows\SysWOW64\KHATRA.exe
Filesize
535KB

MD5
6acd1647078d560a5ec3d53f85b5c709

SHA1
5d55d16df9e337800c7410a819ee7b56f7b4b31e

SHA256
0ab40251273af3a0e2c76935d1176ca71e898c5a935d9aed1a8f4b21a0e0d8c9

SHA512
08dc141a957f1e5bcd1c92f51093abd1b8dfcfccfccc2f5572a0304282ad93f05ce47900a799b1e8b1705f22e74ad84a6203db89a637333f347974df64fe47a9

Download Submit
C:\Windows\SysWOW64\KHATRA.exe
Filesize
535KB

MD5
6acd1647078d560a5ec3d53f85b5c709

SHA1
5d55d16df9e337800c7410a819ee7b56f7b4b31e

SHA256
0ab40251273af3a0e2c76935d1176ca71e898c5a935d9aed1a8f4b21a0e0d8c9

SHA512
08dc141a957f1e5bcd1c92f51093abd1b8dfcfccfccc2f5572a0304282ad93f05ce47900a799b1e8b1705f22e74ad84a6203db89a637333f347974df64fe47a9

Download Submit
C:\Windows\SysWOW64\KHATRA.exe
Filesize
535KB

MD5
6acd1647078d560a5ec3d53f85b5c709

SHA1
5d55d16df9e337800c7410a819ee7b56f7b4b31e

SHA256
0ab40251273af3a0e2c76935d1176ca71e898c5a935d9aed1a8f4b21a0e0d8c9

SHA512
08dc141a957f1e5bcd1c92f51093abd1b8dfcfccfccc2f5572a0304282ad93f05ce47900a799b1e8b1705f22e74ad84a6203db89a637333f347974df64fe47a9

Download Submit
C:\Windows\SysWOW64\KHATRA.exe
Filesize
535KB

MD5
6acd1647078d560a5ec3d53f85b5c709

SHA1
5d55d16df9e337800c7410a819ee7b56f7b4b31e

SHA256
0ab40251273af3a0e2c76935d1176ca71e898c5a935d9aed1a8f4b21a0e0d8c9

SHA512
08dc141a957f1e5bcd1c92f51093abd1b8dfcfccfccc2f5572a0304282ad93f05ce47900a799b1e8b1705f22e74ad84a6203db89a637333f347974df64fe47a9

Download Submit
C:\Windows\SysWOW64\KHATRA.exe
Filesize
535KB

MD5
6acd1647078d560a5ec3d53f85b5c709

SHA1
5d55d16df9e337800c7410a819ee7b56f7b4b31e

SHA256
0ab40251273af3a0e2c76935d1176ca71e898c5a935d9aed1a8f4b21a0e0d8c9

SHA512
08dc141a957f1e5bcd1c92f51093abd1b8dfcfccfccc2f5572a0304282ad93f05ce47900a799b1e8b1705f22e74ad84a6203db89a637333f347974df64fe47a9

Download Submit
C:\Windows\SysWOW64\KHATRA.exe
Filesize
535KB

MD5
6acd1647078d560a5ec3d53f85b5c709

SHA1
5d55d16df9e337800c7410a819ee7b56f7b4b31e

SHA256
0ab40251273af3a0e2c76935d1176ca71e898c5a935d9aed1a8f4b21a0e0d8c9

SHA512
08dc141a957f1e5bcd1c92f51093abd1b8dfcfccfccc2f5572a0304282ad93f05ce47900a799b1e8b1705f22e74ad84a6203db89a637333f347974df64fe47a9

Download Submit
C:\Windows\SysWOW64\KHATRA.exe
Filesize
535KB

MD5
6acd1647078d560a5ec3d53f85b5c709

SHA1
5d55d16df9e337800c7410a819ee7b56f7b4b31e

SHA256
0ab40251273af3a0e2c76935d1176ca71e898c5a935d9aed1a8f4b21a0e0d8c9

SHA512
08dc141a957f1e5bcd1c92f51093abd1b8dfcfccfccc2f5572a0304282ad93f05ce47900a799b1e8b1705f22e74ad84a6203db89a637333f347974df64fe47a9

Download Submit
C:\Windows\System\gHost.exe
Filesize
535KB

MD5
6acd1647078d560a5ec3d53f85b5c709

SHA1
5d55d16df9e337800c7410a819ee7b56f7b4b31e

SHA256
0ab40251273af3a0e2c76935d1176ca71e898c5a935d9aed1a8f4b21a0e0d8c9

SHA512
08dc141a957f1e5bcd1c92f51093abd1b8dfcfccfccc2f5572a0304282ad93f05ce47900a799b1e8b1705f22e74ad84a6203db89a637333f347974df64fe47a9

Download Submit
C:\Windows\System\gHost.exe
Filesize
535KB

MD5
6acd1647078d560a5ec3d53f85b5c709

SHA1
5d55d16df9e337800c7410a819ee7b56f7b4b31e

SHA256
0ab40251273af3a0e2c76935d1176ca71e898c5a935d9aed1a8f4b21a0e0d8c9

SHA512
08dc141a957f1e5bcd1c92f51093abd1b8dfcfccfccc2f5572a0304282ad93f05ce47900a799b1e8b1705f22e74ad84a6203db89a637333f347974df64fe47a9

Download Submit
C:\Windows\Xplorer.exe
Filesize
535KB

MD5
6acd1647078d560a5ec3d53f85b5c709

SHA1
5d55d16df9e337800c7410a819ee7b56f7b4b31e

SHA256
0ab40251273af3a0e2c76935d1176ca71e898c5a935d9aed1a8f4b21a0e0d8c9

SHA512
08dc141a957f1e5bcd1c92f51093abd1b8dfcfccfccc2f5572a0304282ad93f05ce47900a799b1e8b1705f22e74ad84a6203db89a637333f347974df64fe47a9

Download Submit
C:\Windows\Xplorer.exe
Filesize
535KB

MD5
6acd1647078d560a5ec3d53f85b5c709

SHA1
5d55d16df9e337800c7410a819ee7b56f7b4b31e

SHA256
0ab40251273af3a0e2c76935d1176ca71e898c5a935d9aed1a8f4b21a0e0d8c9

SHA512
08dc141a957f1e5bcd1c92f51093abd1b8dfcfccfccc2f5572a0304282ad93f05ce47900a799b1e8b1705f22e74ad84a6203db89a637333f347974df64fe47a9

Download Submit
C:\Windows\inf\Autoplay.inF
Filesize
234B

MD5
7ae2f1a7ce729d91acfef43516e5a84c

SHA1
ebbc99c7e5ac5679de2881813257576ec980fb44

SHA256
43b2fee4fbe5b4a83ae32589d11c3f45ad1988dd5357f790ec708fdfd6709a98

SHA512
915b67d31a7034659360355cb00f9620bf9c64cc06660ea55e5fcba0096f1ac782ac7550f778c4874f63082820c03fbbf4dd05169b0de61a661a202f10a4eff9

Download Submit
C:\Windows\inf\Autoplay.inF
Filesize
234B

MD5
7ae2f1a7ce729d91acfef43516e5a84c

SHA1
ebbc99c7e5ac5679de2881813257576ec980fb44

SHA256
43b2fee4fbe5b4a83ae32589d11c3f45ad1988dd5357f790ec708fdfd6709a98

SHA512
915b67d31a7034659360355cb00f9620bf9c64cc06660ea55e5fcba0096f1ac782ac7550f778c4874f63082820c03fbbf4dd05169b0de61a661a202f10a4eff9

Download Submit
C:\Windows\inf\Autoplay.inF
Filesize
234B

MD5
7ae2f1a7ce729d91acfef43516e5a84c

SHA1
ebbc99c7e5ac5679de2881813257576ec980fb44

SHA256
43b2fee4fbe5b4a83ae32589d11c3f45ad1988dd5357f790ec708fdfd6709a98

SHA512
915b67d31a7034659360355cb00f9620bf9c64cc06660ea55e5fcba0096f1ac782ac7550f778c4874f63082820c03fbbf4dd05169b0de61a661a202f10a4eff9

Download Submit
C:\Windows\inf\Autoplay.inF
Filesize
234B

MD5
7ae2f1a7ce729d91acfef43516e5a84c

SHA1
ebbc99c7e5ac5679de2881813257576ec980fb44

SHA256
43b2fee4fbe5b4a83ae32589d11c3f45ad1988dd5357f790ec708fdfd6709a98

SHA512
915b67d31a7034659360355cb00f9620bf9c64cc06660ea55e5fcba0096f1ac782ac7550f778c4874f63082820c03fbbf4dd05169b0de61a661a202f10a4eff9

Download Submit
C:\Windows\inf\Autoplay.inF
Filesize
234B

MD5
7ae2f1a7ce729d91acfef43516e5a84c

SHA1
ebbc99c7e5ac5679de2881813257576ec980fb44

SHA256
43b2fee4fbe5b4a83ae32589d11c3f45ad1988dd5357f790ec708fdfd6709a98

SHA512
915b67d31a7034659360355cb00f9620bf9c64cc06660ea55e5fcba0096f1ac782ac7550f778c4874f63082820c03fbbf4dd05169b0de61a661a202f10a4eff9

Download Submit
C:\Windows\inf\Autoplay.inF
Filesize
234B

MD5
7ae2f1a7ce729d91acfef43516e5a84c

SHA1
ebbc99c7e5ac5679de2881813257576ec980fb44

SHA256
43b2fee4fbe5b4a83ae32589d11c3f45ad1988dd5357f790ec708fdfd6709a98

SHA512
915b67d31a7034659360355cb00f9620bf9c64cc06660ea55e5fcba0096f1ac782ac7550f778c4874f63082820c03fbbf4dd05169b0de61a661a202f10a4eff9

Download Submit
C:\Windows\inf\Autoplay.inF
Filesize
234B

MD5
7ae2f1a7ce729d91acfef43516e5a84c

SHA1
ebbc99c7e5ac5679de2881813257576ec980fb44

SHA256
43b2fee4fbe5b4a83ae32589d11c3f45ad1988dd5357f790ec708fdfd6709a98

SHA512
915b67d31a7034659360355cb00f9620bf9c64cc06660ea55e5fcba0096f1ac782ac7550f778c4874f63082820c03fbbf4dd05169b0de61a661a202f10a4eff9

Download Submit
C:\Windows\inf\Autoplay.inF
Filesize
234B

MD5
7ae2f1a7ce729d91acfef43516e5a84c

SHA1
ebbc99c7e5ac5679de2881813257576ec980fb44

SHA256
43b2fee4fbe5b4a83ae32589d11c3f45ad1988dd5357f790ec708fdfd6709a98

SHA512
915b67d31a7034659360355cb00f9620bf9c64cc06660ea55e5fcba0096f1ac782ac7550f778c4874f63082820c03fbbf4dd05169b0de61a661a202f10a4eff9

Download Submit
C:\Windows\inf\Autoplay.inF
Filesize
234B

MD5
7ae2f1a7ce729d91acfef43516e5a84c

SHA1
ebbc99c7e5ac5679de2881813257576ec980fb44

SHA256
43b2fee4fbe5b4a83ae32589d11c3f45ad1988dd5357f790ec708fdfd6709a98

SHA512
915b67d31a7034659360355cb00f9620bf9c64cc06660ea55e5fcba0096f1ac782ac7550f778c4874f63082820c03fbbf4dd05169b0de61a661a202f10a4eff9

Download Submit
C:\Windows\inf\Autoplay.inF
Filesize
234B

MD5
7ae2f1a7ce729d91acfef43516e5a84c

SHA1
ebbc99c7e5ac5679de2881813257576ec980fb44

SHA256
43b2fee4fbe5b4a83ae32589d11c3f45ad1988dd5357f790ec708fdfd6709a98

SHA512
915b67d31a7034659360355cb00f9620bf9c64cc06660ea55e5fcba0096f1ac782ac7550f778c4874f63082820c03fbbf4dd05169b0de61a661a202f10a4eff9

Download Submit
C:\\KHATRA.exe
Filesize
535KB

MD5
6acd1647078d560a5ec3d53f85b5c709

SHA1
5d55d16df9e337800c7410a819ee7b56f7b4b31e

SHA256
0ab40251273af3a0e2c76935d1176ca71e898c5a935d9aed1a8f4b21a0e0d8c9

SHA512
08dc141a957f1e5bcd1c92f51093abd1b8dfcfccfccc2f5572a0304282ad93f05ce47900a799b1e8b1705f22e74ad84a6203db89a637333f347974df64fe47a9

Download Submit
\??\PIPE\atsvc
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/576-235-0x0000000000000000-mapping.dmp

Download
memory/768-187-0x0000000000000000-mapping.dmp

Download
memory/800-185-0x0000000000000000-mapping.dmp

Download
memory/940-150-0x0000000000000000-mapping.dmp

Download
memory/1108-233-0x0000000000000000-mapping.dmp

Download
memory/1108-290-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/1108-289-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/1332-156-0x0000000000000000-mapping.dmp

Download
memory/1588-276-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/1588-275-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/1596-201-0x0000000000000000-mapping.dmp

Download
memory/1620-277-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/1620-278-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/1680-160-0x0000000000000000-mapping.dmp

Download
memory/1680-250-0x0000000000000000-mapping.dmp

Download
memory/1776-220-0x0000000000000000-mapping.dmp

Download
memory/1788-154-0x0000000000000000-mapping.dmp

Download
memory/1824-249-0x0000000000000000-mapping.dmp

Download
memory/1984-163-0x0000000000000000-mapping.dmp

Download
memory/2040-246-0x0000000000000000-mapping.dmp

Download
memory/2044-149-0x0000000000000000-mapping.dmp

Download
memory/2156-258-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/2156-256-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/2280-153-0x0000000000000000-mapping.dmp

Download
memory/2320-266-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/2320-267-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/2332-161-0x0000000000000000-mapping.dmp

Download
memory/2412-247-0x0000000000000000-mapping.dmp

Download
memory/2440-152-0x0000000000000000-mapping.dmp

Download
memory/2716-204-0x0000000000000000-mapping.dmp

Download
memory/2716-132-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/2716-170-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/2788-238-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/2788-224-0x0000000000000000-mapping.dmp

Download
memory/2788-227-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/2824-133-0x0000000000000000-mapping.dmp

Download
memory/2824-169-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/2824-137-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/2888-194-0x0000000000000000-mapping.dmp

Download
memory/2888-208-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/2888-197-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/2964-189-0x0000000000000000-mapping.dmp

Download
memory/3088-291-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/3108-286-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/3108-285-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/3144-218-0x0000000000000000-mapping.dmp

Download
memory/3148-231-0x0000000000000000-mapping.dmp

Download
memory/3200-165-0x0000000000000000-mapping.dmp

Download
memory/3240-248-0x0000000000000000-mapping.dmp

Download
memory/3256-214-0x0000000000000000-mapping.dmp

Download
memory/3296-171-0x0000000000000000-mapping.dmp

Download
memory/3296-176-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/3296-177-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/3344-203-0x0000000000000000-mapping.dmp

Download
memory/3352-219-0x0000000000000000-mapping.dmp

Download
memory/3352-186-0x0000000000000000-mapping.dmp

Download
memory/3356-164-0x0000000000000000-mapping.dmp

Download
memory/3424-209-0x0000000000000000-mapping.dmp

Download
memory/3424-215-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/3424-223-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/3444-232-0x0000000000000000-mapping.dmp

Download
memory/3472-216-0x0000000000000000-mapping.dmp

Download
memory/3492-200-0x0000000000000000-mapping.dmp

Download
memory/3528-202-0x0000000000000000-mapping.dmp

Download
memory/3564-237-0x0000000000000000-mapping.dmp

Download
memory/3572-284-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/3572-282-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/3628-151-0x0000000000000000-mapping.dmp

Download
memory/3640-172-0x0000000000000000-mapping.dmp

Download
memory/3640-175-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/3640-178-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/3700-271-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/3700-148-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/3700-145-0x0000000000000000-mapping.dmp

Download
memory/3712-221-0x0000000000000000-mapping.dmp

Download
memory/3748-191-0x0000000000000000-mapping.dmp

Download
memory/3772-264-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/3772-260-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/3864-236-0x0000000000000000-mapping.dmp

Download
memory/3864-222-0x0000000000000000-mapping.dmp

Download
memory/3896-283-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/3896-281-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/3972-269-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/3972-268-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/4072-159-0x0000000000000000-mapping.dmp

Download
memory/4228-192-0x0000000000000000-mapping.dmp

Download
memory/4260-245-0x0000000000000000-mapping.dmp

Download
memory/4276-217-0x0000000000000000-mapping.dmp

Download
memory/4296-279-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/4296-280-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/4332-207-0x0000000000000000-mapping.dmp

Download
memory/4364-193-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/4364-179-0x0000000000000000-mapping.dmp

Download
memory/4364-181-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/4452-162-0x0000000000000000-mapping.dmp

Download
memory/4596-273-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/4596-274-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/4604-205-0x0000000000000000-mapping.dmp

Download
memory/4748-147-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/4748-270-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/4748-143-0x0000000000000000-mapping.dmp

Download
memory/4760-288-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/4760-287-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/4824-272-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/4824-188-0x0000000000000000-mapping.dmp

Download
memory/4920-239-0x0000000000000000-mapping.dmp

Download
memory/4920-251-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/4920-242-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/4952-158-0x0000000000000000-mapping.dmp

Download
memory/5040-234-0x0000000000000000-mapping.dmp

Download
memory/5088-230-0x0000000000000000-mapping.dmp

Download
memory/5088-155-0x0000000000000000-mapping.dmp

Download
memory/5088-206-0x0000000000000000-mapping.dmp

Download
memory/5108-190-0x0000000000000000-mapping.dmp

Download