Analysis
-
max time kernel
151s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
04-10-2022 03:58
Static task
static1
Behavioral task
behavioral1
Sample
0c0a0bc81a10e2fdfba7260bfe8f3475ea96984ec9c0d3f93a0591e192b7ab15.exe
Resource
win7-20220812-en
windows7-x64
17 signatures
150 seconds
Behavioral task
behavioral2
Sample
0c0a0bc81a10e2fdfba7260bfe8f3475ea96984ec9c0d3f93a0591e192b7ab15.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
12 signatures
150 seconds
General
-
Target
0c0a0bc81a10e2fdfba7260bfe8f3475ea96984ec9c0d3f93a0591e192b7ab15.exe
-
Size
460KB
-
MD5
04e6b154f1d3fa9b12ecc955765e6bce
-
SHA1
6bf3bfa52e54df3208c2643baeecfcc82d01ef4c
-
SHA256
0c0a0bc81a10e2fdfba7260bfe8f3475ea96984ec9c0d3f93a0591e192b7ab15
-
SHA512
6a0c9f9bcea518d89c943c41fdf604eb7cda10522fa903a5f782fca5c9420de2264e3cf8be3733f293103ab1067c6ed2a9fd632827fb7c92cce46aeb7c668c62
-
SSDEEP
12288:llSt6oIHNOhU5O5TYo4XqTig5GSR9CClDDL:llSt69HNx6T/5xT
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" iBdqphzke5.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" qoeri.exe -
Executes dropped EXE 6 IoCs
pid Process 2648 iBdqphzke5.exe 2304 qoeri.exe 1448 astat.exe 3416 astat.exe 2064 dstat.exe 3628 fstat.exe -
resource yara_rule behavioral2/memory/3416-151-0x0000000000400000-0x000000000040E000-memory.dmp upx behavioral2/memory/3416-154-0x0000000000400000-0x000000000040E000-memory.dmp upx behavioral2/memory/3416-156-0x0000000000400000-0x000000000040E000-memory.dmp upx behavioral2/memory/3416-157-0x0000000000400000-0x000000000040E000-memory.dmp upx -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation iBdqphzke5.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation 0c0a0bc81a10e2fdfba7260bfe8f3475ea96984ec9c0d3f93a0591e192b7ab15.exe -
Adds Run key to start application 2 TTPs 55 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qoeri = "C:\\Users\\Admin\\qoeri.exe /l" qoeri.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qoeri = "C:\\Users\\Admin\\qoeri.exe /r" qoeri.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qoeri = "C:\\Users\\Admin\\qoeri.exe /N" qoeri.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qoeri = "C:\\Users\\Admin\\qoeri.exe /j" qoeri.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qoeri = "C:\\Users\\Admin\\qoeri.exe /e" qoeri.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qoeri = "C:\\Users\\Admin\\qoeri.exe /B" qoeri.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qoeri = "C:\\Users\\Admin\\qoeri.exe /d" qoeri.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qoeri = "C:\\Users\\Admin\\qoeri.exe /b" qoeri.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qoeri = "C:\\Users\\Admin\\qoeri.exe /v" qoeri.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qoeri = "C:\\Users\\Admin\\qoeri.exe /x" qoeri.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qoeri = "C:\\Users\\Admin\\qoeri.exe /o" qoeri.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qoeri = "C:\\Users\\Admin\\qoeri.exe /c" qoeri.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qoeri = "C:\\Users\\Admin\\qoeri.exe /O" qoeri.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qoeri = "C:\\Users\\Admin\\qoeri.exe /S" qoeri.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Run\ iBdqphzke5.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qoeri = "C:\\Users\\Admin\\qoeri.exe /n" qoeri.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qoeri = "C:\\Users\\Admin\\qoeri.exe /s" qoeri.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qoeri = "C:\\Users\\Admin\\qoeri.exe /T" qoeri.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qoeri = "C:\\Users\\Admin\\qoeri.exe /m" qoeri.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qoeri = "C:\\Users\\Admin\\qoeri.exe /u" qoeri.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Run\ qoeri.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qoeri = "C:\\Users\\Admin\\qoeri.exe /h" qoeri.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qoeri = "C:\\Users\\Admin\\qoeri.exe /E" qoeri.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qoeri = "C:\\Users\\Admin\\qoeri.exe /R" qoeri.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qoeri = "C:\\Users\\Admin\\qoeri.exe /M" qoeri.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qoeri = "C:\\Users\\Admin\\qoeri.exe /Z" qoeri.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qoeri = "C:\\Users\\Admin\\qoeri.exe /k" qoeri.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qoeri = "C:\\Users\\Admin\\qoeri.exe /f" qoeri.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qoeri = "C:\\Users\\Admin\\qoeri.exe /p" qoeri.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qoeri = "C:\\Users\\Admin\\qoeri.exe /H" qoeri.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qoeri = "C:\\Users\\Admin\\qoeri.exe /z" qoeri.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qoeri = "C:\\Users\\Admin\\qoeri.exe /A" qoeri.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qoeri = "C:\\Users\\Admin\\qoeri.exe /G" qoeri.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qoeri = "C:\\Users\\Admin\\qoeri.exe /F" qoeri.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qoeri = "C:\\Users\\Admin\\qoeri.exe /J" qoeri.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qoeri = "C:\\Users\\Admin\\qoeri.exe /a" qoeri.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qoeri = "C:\\Users\\Admin\\qoeri.exe /Y" qoeri.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qoeri = "C:\\Users\\Admin\\qoeri.exe /w" qoeri.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qoeri = "C:\\Users\\Admin\\qoeri.exe /q" qoeri.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qoeri = "C:\\Users\\Admin\\qoeri.exe /P" qoeri.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qoeri = "C:\\Users\\Admin\\qoeri.exe /D" qoeri.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qoeri = "C:\\Users\\Admin\\qoeri.exe /Q" qoeri.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qoeri = "C:\\Users\\Admin\\qoeri.exe /U" iBdqphzke5.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qoeri = "C:\\Users\\Admin\\qoeri.exe /I" qoeri.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qoeri = "C:\\Users\\Admin\\qoeri.exe /U" qoeri.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qoeri = "C:\\Users\\Admin\\qoeri.exe /y" qoeri.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qoeri = "C:\\Users\\Admin\\qoeri.exe /V" qoeri.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qoeri = "C:\\Users\\Admin\\qoeri.exe /C" qoeri.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qoeri = "C:\\Users\\Admin\\qoeri.exe /i" qoeri.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qoeri = "C:\\Users\\Admin\\qoeri.exe /X" qoeri.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qoeri = "C:\\Users\\Admin\\qoeri.exe /L" qoeri.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qoeri = "C:\\Users\\Admin\\qoeri.exe /W" qoeri.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qoeri = "C:\\Users\\Admin\\qoeri.exe /K" qoeri.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qoeri = "C:\\Users\\Admin\\qoeri.exe /g" qoeri.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qoeri = "C:\\Users\\Admin\\qoeri.exe /t" qoeri.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 1448 set thread context of 3416 1448 astat.exe 89 PID 3628 set thread context of 4656 3628 fstat.exe 94 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Enumerates processes with tasklist 1 TTPs 2 IoCs
pid Process 2224 tasklist.exe 4448 tasklist.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2648 iBdqphzke5.exe 2648 iBdqphzke5.exe 2648 iBdqphzke5.exe 2648 iBdqphzke5.exe 3416 astat.exe 3416 astat.exe 3416 astat.exe 3416 astat.exe 2304 qoeri.exe 2304 qoeri.exe 2304 qoeri.exe 2304 qoeri.exe 3416 astat.exe 3416 astat.exe 3416 astat.exe 3416 astat.exe 3416 astat.exe 3416 astat.exe 2304 qoeri.exe 2304 qoeri.exe 2304 qoeri.exe 2304 qoeri.exe 2304 qoeri.exe 2304 qoeri.exe 3416 astat.exe 3416 astat.exe 2304 qoeri.exe 2304 qoeri.exe 3416 astat.exe 3416 astat.exe 2304 qoeri.exe 2304 qoeri.exe 3416 astat.exe 3416 astat.exe 2304 qoeri.exe 2304 qoeri.exe 2304 qoeri.exe 2304 qoeri.exe 3416 astat.exe 3416 astat.exe 2304 qoeri.exe 2304 qoeri.exe 3416 astat.exe 3416 astat.exe 2304 qoeri.exe 2304 qoeri.exe 3416 astat.exe 3416 astat.exe 3416 astat.exe 3416 astat.exe 3416 astat.exe 3416 astat.exe 2304 qoeri.exe 2304 qoeri.exe 2304 qoeri.exe 2304 qoeri.exe 3416 astat.exe 3416 astat.exe 2304 qoeri.exe 2304 qoeri.exe 3416 astat.exe 3416 astat.exe 3416 astat.exe 3416 astat.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 2224 tasklist.exe Token: SeDebugPrivilege 3628 fstat.exe Token: SeDebugPrivilege 4448 tasklist.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 1240 0c0a0bc81a10e2fdfba7260bfe8f3475ea96984ec9c0d3f93a0591e192b7ab15.exe 2648 iBdqphzke5.exe 2304 qoeri.exe 1448 astat.exe 2064 dstat.exe -
Suspicious use of WriteProcessMemory 39 IoCs
description pid Process procid_target PID 1240 wrote to memory of 2648 1240 0c0a0bc81a10e2fdfba7260bfe8f3475ea96984ec9c0d3f93a0591e192b7ab15.exe 84 PID 1240 wrote to memory of 2648 1240 0c0a0bc81a10e2fdfba7260bfe8f3475ea96984ec9c0d3f93a0591e192b7ab15.exe 84 PID 1240 wrote to memory of 2648 1240 0c0a0bc81a10e2fdfba7260bfe8f3475ea96984ec9c0d3f93a0591e192b7ab15.exe 84 PID 2648 wrote to memory of 2304 2648 iBdqphzke5.exe 85 PID 2648 wrote to memory of 2304 2648 iBdqphzke5.exe 85 PID 2648 wrote to memory of 2304 2648 iBdqphzke5.exe 85 PID 1240 wrote to memory of 1448 1240 0c0a0bc81a10e2fdfba7260bfe8f3475ea96984ec9c0d3f93a0591e192b7ab15.exe 86 PID 1240 wrote to memory of 1448 1240 0c0a0bc81a10e2fdfba7260bfe8f3475ea96984ec9c0d3f93a0591e192b7ab15.exe 86 PID 1240 wrote to memory of 1448 1240 0c0a0bc81a10e2fdfba7260bfe8f3475ea96984ec9c0d3f93a0591e192b7ab15.exe 86 PID 2648 wrote to memory of 1632 2648 iBdqphzke5.exe 87 PID 2648 wrote to memory of 1632 2648 iBdqphzke5.exe 87 PID 2648 wrote to memory of 1632 2648 iBdqphzke5.exe 87 PID 1448 wrote to memory of 3416 1448 astat.exe 89 PID 1448 wrote to memory of 3416 1448 astat.exe 89 PID 1448 wrote to memory of 3416 1448 astat.exe 89 PID 1448 wrote to memory of 3416 1448 astat.exe 89 PID 1448 wrote to memory of 3416 1448 astat.exe 89 PID 1448 wrote to memory of 3416 1448 astat.exe 89 PID 1448 wrote to memory of 3416 1448 astat.exe 89 PID 1448 wrote to memory of 3416 1448 astat.exe 89 PID 1632 wrote to memory of 2224 1632 cmd.exe 90 PID 1632 wrote to memory of 2224 1632 cmd.exe 90 PID 1632 wrote to memory of 2224 1632 cmd.exe 90 PID 1240 wrote to memory of 2064 1240 0c0a0bc81a10e2fdfba7260bfe8f3475ea96984ec9c0d3f93a0591e192b7ab15.exe 91 PID 1240 wrote to memory of 2064 1240 0c0a0bc81a10e2fdfba7260bfe8f3475ea96984ec9c0d3f93a0591e192b7ab15.exe 91 PID 1240 wrote to memory of 2064 1240 0c0a0bc81a10e2fdfba7260bfe8f3475ea96984ec9c0d3f93a0591e192b7ab15.exe 91 PID 1240 wrote to memory of 3628 1240 0c0a0bc81a10e2fdfba7260bfe8f3475ea96984ec9c0d3f93a0591e192b7ab15.exe 93 PID 1240 wrote to memory of 3628 1240 0c0a0bc81a10e2fdfba7260bfe8f3475ea96984ec9c0d3f93a0591e192b7ab15.exe 93 PID 1240 wrote to memory of 3628 1240 0c0a0bc81a10e2fdfba7260bfe8f3475ea96984ec9c0d3f93a0591e192b7ab15.exe 93 PID 3628 wrote to memory of 4656 3628 fstat.exe 94 PID 3628 wrote to memory of 4656 3628 fstat.exe 94 PID 3628 wrote to memory of 4656 3628 fstat.exe 94 PID 3628 wrote to memory of 4656 3628 fstat.exe 94 PID 1240 wrote to memory of 4988 1240 0c0a0bc81a10e2fdfba7260bfe8f3475ea96984ec9c0d3f93a0591e192b7ab15.exe 96 PID 1240 wrote to memory of 4988 1240 0c0a0bc81a10e2fdfba7260bfe8f3475ea96984ec9c0d3f93a0591e192b7ab15.exe 96 PID 1240 wrote to memory of 4988 1240 0c0a0bc81a10e2fdfba7260bfe8f3475ea96984ec9c0d3f93a0591e192b7ab15.exe 96 PID 4988 wrote to memory of 4448 4988 cmd.exe 98 PID 4988 wrote to memory of 4448 4988 cmd.exe 98 PID 4988 wrote to memory of 4448 4988 cmd.exe 98
Processes
-
C:\Users\Admin\AppData\Local\Temp\0c0a0bc81a10e2fdfba7260bfe8f3475ea96984ec9c0d3f93a0591e192b7ab15.exe"C:\Users\Admin\AppData\Local\Temp\0c0a0bc81a10e2fdfba7260bfe8f3475ea96984ec9c0d3f93a0591e192b7ab15.exe"1⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1240 -
C:\Users\Admin\iBdqphzke5.exeC:\Users\Admin\iBdqphzke5.exe2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\Users\Admin\qoeri.exe"C:\Users\Admin\qoeri.exe"3⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2304
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c tasklist&&del iBdqphzke5.exe3⤵
- Suspicious use of WriteProcessMemory
PID:1632 -
C:\Windows\SysWOW64\tasklist.exetasklist4⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:2224
-
-
-
-
C:\Users\Admin\astat.exeC:\Users\Admin\astat.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1448 -
C:\Users\Admin\astat.exe"C:\Users\Admin\astat.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3416
-
-
-
C:\Users\Admin\dstat.exeC:\Users\Admin\dstat.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2064
-
-
C:\Users\Admin\fstat.exeC:\Users\Admin\fstat.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3628 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"3⤵PID:4656
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c tasklist&&del 0c0a0bc81a10e2fdfba7260bfe8f3475ea96984ec9c0d3f93a0591e192b7ab15.exe2⤵
- Suspicious use of WriteProcessMemory
PID:4988 -
C:\Windows\SysWOW64\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:4448
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60KB
MD587c6498966e3f85fac743c89050aa312
SHA105c165c34cbfa14e4925c33ace81992b0f50a2b5
SHA25630c8328585e41968aff773da16cedbe590dcefd293c7fa74a69c557ecbf2c3c5
SHA512740f7159ee78f73e57c92e583b8c4f97c5dd49b68b9c321da976d7e318819daa28e8dfc76e95e1e3ccee643dc464324c40b481d1849863e287d826adb577b420
-
Filesize
60KB
MD587c6498966e3f85fac743c89050aa312
SHA105c165c34cbfa14e4925c33ace81992b0f50a2b5
SHA25630c8328585e41968aff773da16cedbe590dcefd293c7fa74a69c557ecbf2c3c5
SHA512740f7159ee78f73e57c92e583b8c4f97c5dd49b68b9c321da976d7e318819daa28e8dfc76e95e1e3ccee643dc464324c40b481d1849863e287d826adb577b420
-
Filesize
60KB
MD587c6498966e3f85fac743c89050aa312
SHA105c165c34cbfa14e4925c33ace81992b0f50a2b5
SHA25630c8328585e41968aff773da16cedbe590dcefd293c7fa74a69c557ecbf2c3c5
SHA512740f7159ee78f73e57c92e583b8c4f97c5dd49b68b9c321da976d7e318819daa28e8dfc76e95e1e3ccee643dc464324c40b481d1849863e287d826adb577b420
-
Filesize
36KB
MD5b6da847084e39e0cecf175c32c91b4bb
SHA1fbfd9494fabed5220cdf01866ff088fe7adc535b
SHA256065781e8a55cf59cb926d5950e0039e19b50b1e081023404fbff4d7a32fc9cbe
SHA51259d372ea36904cd48c99f2f34740c22004b35c5e5dada2417813b0463292af19e4aa5ba4552cc443da373e40ba03a1f7906019a567806806f5972c202a31d9d2
-
Filesize
36KB
MD5b6da847084e39e0cecf175c32c91b4bb
SHA1fbfd9494fabed5220cdf01866ff088fe7adc535b
SHA256065781e8a55cf59cb926d5950e0039e19b50b1e081023404fbff4d7a32fc9cbe
SHA51259d372ea36904cd48c99f2f34740c22004b35c5e5dada2417813b0463292af19e4aa5ba4552cc443da373e40ba03a1f7906019a567806806f5972c202a31d9d2
-
Filesize
271KB
MD534353cf7e1d1b10bcbbcae0745110535
SHA12fb471681daac6f6d66477b7772025da4f58c508
SHA256b2d7a66e2d10d8943e48d6f3ad75237ff379e82ab0101a620406c4569be1d959
SHA5127404f82abfabd21d6f2a88b55f6f0ff886bb0a1f16a9d45c6883d74daa26451f862a10a78646c549c3a3264ba4bd9fb44949d470493af895973dd05a0ec311e6
-
Filesize
271KB
MD534353cf7e1d1b10bcbbcae0745110535
SHA12fb471681daac6f6d66477b7772025da4f58c508
SHA256b2d7a66e2d10d8943e48d6f3ad75237ff379e82ab0101a620406c4569be1d959
SHA5127404f82abfabd21d6f2a88b55f6f0ff886bb0a1f16a9d45c6883d74daa26451f862a10a78646c549c3a3264ba4bd9fb44949d470493af895973dd05a0ec311e6
-
Filesize
244KB
MD5a4cdb62cf4866a17e742e7e9cc73d237
SHA130d94f8e872455ac569949ac4c768d0a0cdfbba7
SHA256c741d649bf5b72fbe97470820ce994ce29b153baae14af10c3a2a9adc3098b32
SHA512c4447f95565d3e5dc0ef7712382325280bedf127ac682f85f4043b586afb4188633f2c73277595eb31fe45d992107492f42c82a71f448286a9cb8fac4bfb3671
-
Filesize
244KB
MD5a4cdb62cf4866a17e742e7e9cc73d237
SHA130d94f8e872455ac569949ac4c768d0a0cdfbba7
SHA256c741d649bf5b72fbe97470820ce994ce29b153baae14af10c3a2a9adc3098b32
SHA512c4447f95565d3e5dc0ef7712382325280bedf127ac682f85f4043b586afb4188633f2c73277595eb31fe45d992107492f42c82a71f448286a9cb8fac4bfb3671
-
Filesize
244KB
MD5933b677046d031794b496d2b08297134
SHA1b17553138db9567f1b35d8299f3974798af667a5
SHA2566d4566b73108f8db10f2e0d330d79cbfc484e9088a72a51d8d5561f22407f616
SHA512b19e908a399ca33925fcf7b2d591e12f14265b213ab7f78ecf8d4880c80dcafc92718763b5467a814839c7d96f9b36c7304f2b5f92382ea60931aac50e95ec1d
-
Filesize
244KB
MD5933b677046d031794b496d2b08297134
SHA1b17553138db9567f1b35d8299f3974798af667a5
SHA2566d4566b73108f8db10f2e0d330d79cbfc484e9088a72a51d8d5561f22407f616
SHA512b19e908a399ca33925fcf7b2d591e12f14265b213ab7f78ecf8d4880c80dcafc92718763b5467a814839c7d96f9b36c7304f2b5f92382ea60931aac50e95ec1d