Analysis
-
max time kernel
174s -
max time network
193s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
04-10-2022 01:48
Static task
static1
Behavioral task
behavioral1
Sample
7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exe
Resource
win7-20220812-en
General
-
Target
7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exe
-
Size
470KB
-
MD5
15a861b54403084db2cfabc2f7e0dd40
-
SHA1
6498b6fc584cc8af7265874b8bd9af77218760fb
-
SHA256
7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02
-
SHA512
6532568dd8fb03ac5573ece2019cac67eafbb4f51b50a56cd87976a92a06f3350c31043c7e08ab5049487e37bd7ee45a84e158867ddd0f271b73ba662010e80c
-
SSDEEP
6144:+8SRDa8qLzrqUeQfHR2sle1tgk25MBqpp6joQ68SRDa8qLzrqUeQfHR2sle1tgkm:EPKrnsrkOBqdPKrnsrkOBqp
Malware Config
Extracted
nanocore
1.2.2.2
new555.ddns.net:9033
8c75819e-ba86-4f76-b760-0b353e60a683
-
activate_away_mode
true
-
backup_connection_host
new555.ddns.net
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2015-05-09T09:12:09.414523536Z
-
bypass_user_account_control
true
- bypass_user_account_control_data
-
clear_access_control
true
-
clear_zone_identifier
true
-
connect_delay
4000
-
connection_port
9033
-
default_group
FIREMANSS
-
enable_debug_mode
true
-
gc_threshold
1.0448576e+08
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.0448576e+08
-
mutex
8c75819e-ba86-4f76-b760-0b353e60a683
-
mutex_timeout
5000
-
prevent_system_sleep
true
-
primary_connection_host
new555.ddns.net
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
false
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.2
-
wan_timeout
8000
Signatures
-
Sets file to hidden 1 TTPs 1 IoCs
Modifies file attributes to stop it showing in Explorer etc.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation 7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exe -
Adds Run key to start application 2 TTPs 47 IoCs
Processes:
REG.exeREG.exeREG.exeREG.exeREG.exeREG.exeREG.exeREG.exeREG.exeREG.exeREG.exeREG.exeREG.exeREG.exeREG.exeREG.exeREG.exeREG.exeREG.exeREG.exeREG.exeREG.exeREG.exeRegAsm.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\chrome . exe = "C:\\Users\\Admin\\AppData\\Roaming\\sub folder\\google chrome.exe" REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\chrome . exe = "C:\\Users\\Admin\\AppData\\Roaming\\sub folder\\google chrome.exe" REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\chrome . exe = "C:\\Users\\Admin\\AppData\\Roaming\\sub folder\\google chrome.exe" REG.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\chrome . exe = "C:\\Users\\Admin\\AppData\\Roaming\\sub folder\\google chrome.exe" REG.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\chrome . exe = "C:\\Users\\Admin\\AppData\\Roaming\\sub folder\\google chrome.exe" REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\chrome . exe = "C:\\Users\\Admin\\AppData\\Roaming\\sub folder\\google chrome.exe" REG.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run REG.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\chrome . exe = "C:\\Users\\Admin\\AppData\\Roaming\\sub folder\\google chrome.exe" REG.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\chrome . exe = "C:\\Users\\Admin\\AppData\\Roaming\\sub folder\\google chrome.exe" REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\chrome . exe = "C:\\Users\\Admin\\AppData\\Roaming\\sub folder\\google chrome.exe" REG.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run REG.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run REG.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run REG.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\chrome . exe = "C:\\Users\\Admin\\AppData\\Roaming\\sub folder\\google chrome.exe" REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\chrome . exe = "C:\\Users\\Admin\\AppData\\Roaming\\sub folder\\google chrome.exe" REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\chrome . exe = "C:\\Users\\Admin\\AppData\\Roaming\\sub folder\\google chrome.exe" REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\chrome . exe = "C:\\Users\\Admin\\AppData\\Roaming\\sub folder\\google chrome.exe" REG.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\chrome . exe = "C:\\Users\\Admin\\AppData\\Roaming\\sub folder\\google chrome.exe" REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\chrome . exe = "C:\\Users\\Admin\\AppData\\Roaming\\sub folder\\google chrome.exe" REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\chrome . exe = "C:\\Users\\Admin\\AppData\\Roaming\\sub folder\\google chrome.exe" REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\chrome . exe = "C:\\Users\\Admin\\AppData\\Roaming\\sub folder\\google chrome.exe" REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\chrome . exe = "C:\\Users\\Admin\\AppData\\Roaming\\sub folder\\google chrome.exe" REG.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run REG.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\chrome . exe = "C:\\Users\\Admin\\AppData\\Roaming\\sub folder\\google chrome.exe" REG.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\chrome . exe = "C:\\Users\\Admin\\AppData\\Roaming\\sub folder\\google chrome.exe" REG.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run REG.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run REG.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run REG.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\chrome . exe = "C:\\Users\\Admin\\AppData\\Roaming\\sub folder\\google chrome.exe" REG.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run REG.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run REG.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\chrome . exe = "C:\\Users\\Admin\\AppData\\Roaming\\sub folder\\google chrome.exe" REG.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\chrome . exe = "C:\\Users\\Admin\\AppData\\Roaming\\sub folder\\google chrome.exe" REG.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run REG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DDP Host = "C:\\Program Files (x86)\\DDP Host\\ddphost.exe" RegAsm.exe -
Processes:
RegAsm.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA RegAsm.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exedescription pid process target process PID 736 set thread context of 1144 736 7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exe RegAsm.exe -
Drops file in Program Files directory 2 IoCs
Processes:
RegAsm.exedescription ioc process File opened for modification C:\Program Files (x86)\DDP Host\ddphost.exe RegAsm.exe File created C:\Program Files (x86)\DDP Host\ddphost.exe RegAsm.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Runs ping.exe 1 TTPs 10 IoCs
Processes:
ping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exepid process 4468 ping.exe 3044 ping.exe 820 ping.exe 3500 ping.exe 3220 ping.exe 1856 ping.exe 924 ping.exe 2016 ping.exe 3532 ping.exe 2688 ping.exe -
Suspicious behavior: EnumeratesProcesses 48 IoCs
Processes:
7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exeRegAsm.exepid process 736 7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exe 1144 RegAsm.exe 1144 RegAsm.exe 1144 RegAsm.exe 736 7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exe 736 7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exe 736 7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exe 736 7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exe 736 7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exe 736 7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exe 736 7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exe 736 7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exe 736 7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exe 736 7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exe 736 7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exe 736 7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exe 736 7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exe 736 7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exe 736 7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exe 736 7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exe 736 7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exe 736 7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exe 736 7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exe 736 7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exe 736 7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exe 736 7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exe 736 7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exe 736 7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exe 736 7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exe 736 7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exe 736 7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exe 736 7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exe 736 7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exe 736 7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exe 736 7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exe 736 7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exe 736 7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exe 736 7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exe 736 7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exe 736 7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exe 736 7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exe 736 7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exe 736 7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exe 736 7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exe 736 7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exe 736 7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exe 736 7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exe 736 7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
RegAsm.exepid process 1144 RegAsm.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exeRegAsm.exedescription pid process Token: SeDebugPrivilege 736 7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exe Token: SeDebugPrivilege 1144 RegAsm.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exedescription pid process target process PID 736 wrote to memory of 1144 736 7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exe RegAsm.exe PID 736 wrote to memory of 1144 736 7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exe RegAsm.exe PID 736 wrote to memory of 1144 736 7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exe RegAsm.exe PID 736 wrote to memory of 1144 736 7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exe RegAsm.exe PID 736 wrote to memory of 1144 736 7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exe RegAsm.exe PID 736 wrote to memory of 1144 736 7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exe RegAsm.exe PID 736 wrote to memory of 1144 736 7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exe RegAsm.exe PID 736 wrote to memory of 1144 736 7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exe RegAsm.exe PID 736 wrote to memory of 1092 736 7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exe attrib.exe PID 736 wrote to memory of 1092 736 7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exe attrib.exe PID 736 wrote to memory of 1092 736 7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exe attrib.exe PID 736 wrote to memory of 820 736 7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exe ping.exe PID 736 wrote to memory of 820 736 7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exe ping.exe PID 736 wrote to memory of 820 736 7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exe ping.exe PID 736 wrote to memory of 2016 736 7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exe ping.exe PID 736 wrote to memory of 2016 736 7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exe ping.exe PID 736 wrote to memory of 2016 736 7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exe ping.exe PID 736 wrote to memory of 3500 736 7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exe ping.exe PID 736 wrote to memory of 3500 736 7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exe ping.exe PID 736 wrote to memory of 3500 736 7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exe ping.exe PID 736 wrote to memory of 3532 736 7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exe ping.exe PID 736 wrote to memory of 3532 736 7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exe ping.exe PID 736 wrote to memory of 3532 736 7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exe ping.exe PID 736 wrote to memory of 3220 736 7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exe ping.exe PID 736 wrote to memory of 3220 736 7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exe ping.exe PID 736 wrote to memory of 3220 736 7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exe ping.exe PID 736 wrote to memory of 2688 736 7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exe ping.exe PID 736 wrote to memory of 2688 736 7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exe ping.exe PID 736 wrote to memory of 2688 736 7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exe ping.exe PID 736 wrote to memory of 1856 736 7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exe ping.exe PID 736 wrote to memory of 1856 736 7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exe ping.exe PID 736 wrote to memory of 1856 736 7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exe ping.exe PID 736 wrote to memory of 4468 736 7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exe ping.exe PID 736 wrote to memory of 4468 736 7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exe ping.exe PID 736 wrote to memory of 4468 736 7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exe ping.exe PID 736 wrote to memory of 3044 736 7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exe ping.exe PID 736 wrote to memory of 3044 736 7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exe ping.exe PID 736 wrote to memory of 3044 736 7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exe ping.exe PID 736 wrote to memory of 924 736 7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exe ping.exe PID 736 wrote to memory of 924 736 7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exe ping.exe PID 736 wrote to memory of 924 736 7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exe ping.exe PID 736 wrote to memory of 3436 736 7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exe REG.exe PID 736 wrote to memory of 3436 736 7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exe REG.exe PID 736 wrote to memory of 3436 736 7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exe REG.exe PID 736 wrote to memory of 4044 736 7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exe REG.exe PID 736 wrote to memory of 4044 736 7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exe REG.exe PID 736 wrote to memory of 4044 736 7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exe REG.exe PID 736 wrote to memory of 3120 736 7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exe REG.exe PID 736 wrote to memory of 3120 736 7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exe REG.exe PID 736 wrote to memory of 3120 736 7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exe REG.exe PID 736 wrote to memory of 1044 736 7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exe REG.exe PID 736 wrote to memory of 1044 736 7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exe REG.exe PID 736 wrote to memory of 1044 736 7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exe REG.exe PID 736 wrote to memory of 4852 736 7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exe REG.exe PID 736 wrote to memory of 4852 736 7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exe REG.exe PID 736 wrote to memory of 4852 736 7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exe REG.exe PID 736 wrote to memory of 972 736 7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exe REG.exe PID 736 wrote to memory of 972 736 7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exe REG.exe PID 736 wrote to memory of 972 736 7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exe REG.exe PID 736 wrote to memory of 2712 736 7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exe REG.exe PID 736 wrote to memory of 2712 736 7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exe REG.exe PID 736 wrote to memory of 2712 736 7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exe REG.exe PID 736 wrote to memory of 2268 736 7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exe REG.exe PID 736 wrote to memory of 2268 736 7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exe REG.exe -
Views/modifies file attributes 1 TTPs 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exe"C:\Users\Admin\AppData\Local\Temp\7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"2⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\attrib.exe"C:\Windows\System32\attrib.exe" +s +h C:\Users\Admin\AppData\Local\Temp\7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exe2⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Windows\SysWOW64\ping.exeC:\Windows\System32\ping.exe google.com2⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\ping.exeC:\Windows\System32\ping.exe google.com2⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\ping.exeC:\Windows\System32\ping.exe google.com2⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\ping.exeC:\Windows\System32\ping.exe google.com2⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\ping.exeC:\Windows\System32\ping.exe google.com2⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\ping.exeC:\Windows\System32\ping.exe google.com2⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\ping.exeC:\Windows\System32\ping.exe google.com2⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\ping.exeC:\Windows\System32\ping.exe google.com2⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\ping.exeC:\Windows\System32\ping.exe google.com2⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\ping.exeC:\Windows\System32\ping.exe google.com2⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "chrome . exe" /t REG_SZ /F /D "C:\Users\Admin\AppData\Roaming\sub folder\google chrome.exe2⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "chrome . exe" /t REG_SZ /F /D "C:\Users\Admin\AppData\Roaming\sub folder\google chrome.exe2⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "chrome . exe" /t REG_SZ /F /D "C:\Users\Admin\AppData\Roaming\sub folder\google chrome.exe2⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "chrome . exe" /t REG_SZ /F /D "C:\Users\Admin\AppData\Roaming\sub folder\google chrome.exe2⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "chrome . exe" /t REG_SZ /F /D "C:\Users\Admin\AppData\Roaming\sub folder\google chrome.exe2⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "chrome . exe" /t REG_SZ /F /D "C:\Users\Admin\AppData\Roaming\sub folder\google chrome.exe2⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "chrome . exe" /t REG_SZ /F /D "C:\Users\Admin\AppData\Roaming\sub folder\google chrome.exe2⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "chrome . exe" /t REG_SZ /F /D "C:\Users\Admin\AppData\Roaming\sub folder\google chrome.exe2⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "chrome . exe" /t REG_SZ /F /D "C:\Users\Admin\AppData\Roaming\sub folder\google chrome.exe2⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "chrome . exe" /t REG_SZ /F /D "C:\Users\Admin\AppData\Roaming\sub folder\google chrome.exe2⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "chrome . exe" /t REG_SZ /F /D "C:\Users\Admin\AppData\Roaming\sub folder\google chrome.exe2⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "chrome . exe" /t REG_SZ /F /D "C:\Users\Admin\AppData\Roaming\sub folder\google chrome.exe2⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "chrome . exe" /t REG_SZ /F /D "C:\Users\Admin\AppData\Roaming\sub folder\google chrome.exe2⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "chrome . exe" /t REG_SZ /F /D "C:\Users\Admin\AppData\Roaming\sub folder\google chrome.exe2⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "chrome . exe" /t REG_SZ /F /D "C:\Users\Admin\AppData\Roaming\sub folder\google chrome.exe2⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "chrome . exe" /t REG_SZ /F /D "C:\Users\Admin\AppData\Roaming\sub folder\google chrome.exe2⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "chrome . exe" /t REG_SZ /F /D "C:\Users\Admin\AppData\Roaming\sub folder\google chrome.exe2⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "chrome . exe" /t REG_SZ /F /D "C:\Users\Admin\AppData\Roaming\sub folder\google chrome.exe2⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "chrome . exe" /t REG_SZ /F /D "C:\Users\Admin\AppData\Roaming\sub folder\google chrome.exe2⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "chrome . exe" /t REG_SZ /F /D "C:\Users\Admin\AppData\Roaming\sub folder\google chrome.exe2⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "chrome . exe" /t REG_SZ /F /D "C:\Users\Admin\AppData\Roaming\sub folder\google chrome.exe2⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "chrome . exe" /t REG_SZ /F /D "C:\Users\Admin\AppData\Roaming\sub folder\google chrome.exe2⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "chrome . exe" /t REG_SZ /F /D "C:\Users\Admin\AppData\Roaming\sub folder\google chrome.exe2⤵
- Adds Run key to start application
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/344-160-0x0000000000000000-mapping.dmp
-
memory/736-132-0x0000000074A30000-0x0000000074FE1000-memory.dmpFilesize
5.7MB
-
memory/736-140-0x0000000074A30000-0x0000000074FE1000-memory.dmpFilesize
5.7MB
-
memory/820-137-0x0000000000000000-mapping.dmp
-
memory/880-165-0x0000000000000000-mapping.dmp
-
memory/924-148-0x0000000000000000-mapping.dmp
-
memory/972-154-0x0000000000000000-mapping.dmp
-
memory/1044-152-0x0000000000000000-mapping.dmp
-
memory/1060-159-0x0000000000000000-mapping.dmp
-
memory/1092-136-0x0000000000000000-mapping.dmp
-
memory/1144-142-0x0000000074A30000-0x0000000074FE1000-memory.dmpFilesize
5.7MB
-
memory/1144-133-0x0000000000000000-mapping.dmp
-
memory/1144-134-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1144-135-0x0000000074A30000-0x0000000074FE1000-memory.dmpFilesize
5.7MB
-
memory/1324-157-0x0000000000000000-mapping.dmp
-
memory/1584-170-0x0000000000000000-mapping.dmp
-
memory/1856-145-0x0000000000000000-mapping.dmp
-
memory/1980-166-0x0000000000000000-mapping.dmp
-
memory/2016-138-0x0000000000000000-mapping.dmp
-
memory/2212-168-0x0000000000000000-mapping.dmp
-
memory/2268-156-0x0000000000000000-mapping.dmp
-
memory/2384-164-0x0000000000000000-mapping.dmp
-
memory/2540-171-0x0000000000000000-mapping.dmp
-
memory/2688-144-0x0000000000000000-mapping.dmp
-
memory/2712-155-0x0000000000000000-mapping.dmp
-
memory/2936-163-0x0000000000000000-mapping.dmp
-
memory/3044-147-0x0000000000000000-mapping.dmp
-
memory/3120-151-0x0000000000000000-mapping.dmp
-
memory/3220-143-0x0000000000000000-mapping.dmp
-
memory/3436-149-0x0000000000000000-mapping.dmp
-
memory/3500-139-0x0000000000000000-mapping.dmp
-
memory/3528-162-0x0000000000000000-mapping.dmp
-
memory/3532-141-0x0000000000000000-mapping.dmp
-
memory/3764-169-0x0000000000000000-mapping.dmp
-
memory/3888-161-0x0000000000000000-mapping.dmp
-
memory/4044-150-0x0000000000000000-mapping.dmp
-
memory/4468-146-0x0000000000000000-mapping.dmp
-
memory/4628-158-0x0000000000000000-mapping.dmp
-
memory/4852-153-0x0000000000000000-mapping.dmp
-
memory/4944-167-0x0000000000000000-mapping.dmp