5135d1b17a6cd39214038cb098e9bab090ece866f75ce7c2839fdcf00f2e74cb

Analysis

max time kernel
151s
max time network
50s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
11-10-2022 07:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5135d1b17a6cd39214038cb098e9bab090ece866f75ce7c2839fdcf00f2e74cb.exe
Size

504KB
MD5

6afe941c6ac3443fc98b33d786ba0548
SHA1

4c6d722a95f001a237880d54790616884ebf326a
SHA256

5135d1b17a6cd39214038cb098e9bab090ece866f75ce7c2839fdcf00f2e74cb
SHA512

00637db5804e1d28c8e262277bead5970b2e73ff6fce5ac55287f64c54974734de7df7e3530b59ead6eface557de5020395d13028f8ac676dd87a650f0304d29
SSDEEP

6144:syvhitdjyuhy/uqIVwMpIndxyD0w5GziWmdS1CeoiC2DZnlDRXpm1deeC+wDm8:syod25uBWibpkCeBNNuRC+gm8

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	Y4u5h60580.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	dutug.exe

Executes dropped EXE 4 IoCs

pid	Process
988	Y4u5h60580.exe
644	zog.exe
332	csrss.exe
1452	dutug.exe

Deletes itself 1 IoCs

pid	Process
584	cmd.exe

Loads dropped DLL 6 IoCs

pid	Process
1696	5135d1b17a6cd39214038cb098e9bab090ece866f75ce7c2839fdcf00f2e74cb.exe
1696	5135d1b17a6cd39214038cb098e9bab090ece866f75ce7c2839fdcf00f2e74cb.exe
1696	5135d1b17a6cd39214038cb098e9bab090ece866f75ce7c2839fdcf00f2e74cb.exe
1696	5135d1b17a6cd39214038cb098e9bab090ece866f75ce7c2839fdcf00f2e74cb.exe
988	Y4u5h60580.exe
988	Y4u5h60580.exe

Adds Run key to start application 2 TTPs 53 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\dutug = "C:\\Users\\Admin\\dutug.exe /e"	dutug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\dutug = "C:\\Users\\Admin\\dutug.exe /W"	dutug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\dutug = "C:\\Users\\Admin\\dutug.exe /A"	dutug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\dutug = "C:\\Users\\Admin\\dutug.exe /q"	dutug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\dutug = "C:\\Users\\Admin\\dutug.exe /S"	dutug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\dutug = "C:\\Users\\Admin\\dutug.exe /d"	dutug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\dutug = "C:\\Users\\Admin\\dutug.exe /a"	dutug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\dutug = "C:\\Users\\Admin\\dutug.exe /F"	dutug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\dutug = "C:\\Users\\Admin\\dutug.exe /m"	dutug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\dutug = "C:\\Users\\Admin\\dutug.exe /z"	dutug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\dutug = "C:\\Users\\Admin\\dutug.exe /T"	dutug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\dutug = "C:\\Users\\Admin\\dutug.exe /o"	Y4u5h60580.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\dutug = "C:\\Users\\Admin\\dutug.exe /k"	dutug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\dutug = "C:\\Users\\Admin\\dutug.exe /o"	dutug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\dutug = "C:\\Users\\Admin\\dutug.exe /G"	dutug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\dutug = "C:\\Users\\Admin\\dutug.exe /L"	dutug.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\	Y4u5h60580.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\dutug = "C:\\Users\\Admin\\dutug.exe /X"	dutug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\dutug = "C:\\Users\\Admin\\dutug.exe /i"	dutug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\dutug = "C:\\Users\\Admin\\dutug.exe /E"	dutug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\dutug = "C:\\Users\\Admin\\dutug.exe /Y"	dutug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\dutug = "C:\\Users\\Admin\\dutug.exe /B"	dutug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\dutug = "C:\\Users\\Admin\\dutug.exe /R"	dutug.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\	dutug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\dutug = "C:\\Users\\Admin\\dutug.exe /g"	dutug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\dutug = "C:\\Users\\Admin\\dutug.exe /Z"	dutug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\dutug = "C:\\Users\\Admin\\dutug.exe /n"	dutug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\dutug = "C:\\Users\\Admin\\dutug.exe /y"	dutug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\dutug = "C:\\Users\\Admin\\dutug.exe /Q"	dutug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\dutug = "C:\\Users\\Admin\\dutug.exe /h"	dutug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\dutug = "C:\\Users\\Admin\\dutug.exe /l"	dutug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\dutug = "C:\\Users\\Admin\\dutug.exe /I"	dutug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\dutug = "C:\\Users\\Admin\\dutug.exe /C"	dutug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\dutug = "C:\\Users\\Admin\\dutug.exe /b"	dutug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\dutug = "C:\\Users\\Admin\\dutug.exe /M"	dutug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\dutug = "C:\\Users\\Admin\\dutug.exe /r"	dutug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\dutug = "C:\\Users\\Admin\\dutug.exe /u"	dutug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\dutug = "C:\\Users\\Admin\\dutug.exe /v"	dutug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\dutug = "C:\\Users\\Admin\\dutug.exe /w"	dutug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\dutug = "C:\\Users\\Admin\\dutug.exe /K"	dutug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\dutug = "C:\\Users\\Admin\\dutug.exe /p"	dutug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\dutug = "C:\\Users\\Admin\\dutug.exe /j"	dutug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\dutug = "C:\\Users\\Admin\\dutug.exe /P"	dutug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\dutug = "C:\\Users\\Admin\\dutug.exe /t"	dutug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\dutug = "C:\\Users\\Admin\\dutug.exe /D"	dutug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\dutug = "C:\\Users\\Admin\\dutug.exe /O"	dutug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\dutug = "C:\\Users\\Admin\\dutug.exe /s"	dutug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\dutug = "C:\\Users\\Admin\\dutug.exe /V"	dutug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\dutug = "C:\\Users\\Admin\\dutug.exe /H"	dutug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\dutug = "C:\\Users\\Admin\\dutug.exe /x"	dutug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\dutug = "C:\\Users\\Admin\\dutug.exe /f"	dutug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\dutug = "C:\\Users\\Admin\\dutug.exe /U"	dutug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\dutug = "C:\\Users\\Admin\\dutug.exe /J"	dutug.exe

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File created	\systemroot\assembly\GAC_32\Desktop.ini	csrss.exe
File created	\systemroot\assembly\GAC_64\Desktop.ini	csrss.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 644 set thread context of 520	644	zog.exe	31

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery

T1057

pid	Process
596	tasklist.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\registry\machine\Software\Classes\Interface\{3097c7e0-1ac2-2f18-0d68-79804155316e}	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3097c7e0-1ac2-2f18-0d68-79804155316e}\u = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3097c7e0-1ac2-2f18-0d68-79804155316e}\cid = "4716568763360290577"	explorer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
988	Y4u5h60580.exe
520	explorer.exe
520	explorer.exe
520	explorer.exe
988	Y4u5h60580.exe
1452	dutug.exe
1452	dutug.exe
1452	dutug.exe
1452	dutug.exe
1452	dutug.exe
1452	dutug.exe
1452	dutug.exe
1452	dutug.exe
1452	dutug.exe
1452	dutug.exe
1452	dutug.exe
1452	dutug.exe
1452	dutug.exe
1452	dutug.exe
1452	dutug.exe
1452	dutug.exe
1452	dutug.exe
1452	dutug.exe
1452	dutug.exe
1452	dutug.exe
1452	dutug.exe
1452	dutug.exe
1452	dutug.exe
1452	dutug.exe
1452	dutug.exe
1452	dutug.exe
1452	dutug.exe
1452	dutug.exe
1452	dutug.exe
1452	dutug.exe
1452	dutug.exe
1452	dutug.exe
1452	dutug.exe
1452	dutug.exe
1452	dutug.exe
1452	dutug.exe
1452	dutug.exe
1452	dutug.exe
1452	dutug.exe
1452	dutug.exe
1452	dutug.exe
1452	dutug.exe
1452	dutug.exe
1452	dutug.exe
1452	dutug.exe
1452	dutug.exe
1452	dutug.exe
1452	dutug.exe
1452	dutug.exe
1452	dutug.exe
1452	dutug.exe
1452	dutug.exe
1452	dutug.exe
1452	dutug.exe
1452	dutug.exe
1452	dutug.exe
1452	dutug.exe
1452	dutug.exe
1452	dutug.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	520	explorer.exe
Token: SeDebugPrivilege	596	tasklist.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
988	Y4u5h60580.exe
1452	dutug.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
332	csrss.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 1696 wrote to memory of 988	1696	5135d1b17a6cd39214038cb098e9bab090ece866f75ce7c2839fdcf00f2e74cb.exe	27
PID 1696 wrote to memory of 988	1696	5135d1b17a6cd39214038cb098e9bab090ece866f75ce7c2839fdcf00f2e74cb.exe	27
PID 1696 wrote to memory of 988	1696	5135d1b17a6cd39214038cb098e9bab090ece866f75ce7c2839fdcf00f2e74cb.exe	27
PID 1696 wrote to memory of 988	1696	5135d1b17a6cd39214038cb098e9bab090ece866f75ce7c2839fdcf00f2e74cb.exe	27
PID 1696 wrote to memory of 644	1696	5135d1b17a6cd39214038cb098e9bab090ece866f75ce7c2839fdcf00f2e74cb.exe	28
PID 1696 wrote to memory of 644	1696	5135d1b17a6cd39214038cb098e9bab090ece866f75ce7c2839fdcf00f2e74cb.exe	28
PID 1696 wrote to memory of 644	1696	5135d1b17a6cd39214038cb098e9bab090ece866f75ce7c2839fdcf00f2e74cb.exe	28
PID 1696 wrote to memory of 644	1696	5135d1b17a6cd39214038cb098e9bab090ece866f75ce7c2839fdcf00f2e74cb.exe	28
PID 1696 wrote to memory of 584	1696	5135d1b17a6cd39214038cb098e9bab090ece866f75ce7c2839fdcf00f2e74cb.exe	29
PID 1696 wrote to memory of 584	1696	5135d1b17a6cd39214038cb098e9bab090ece866f75ce7c2839fdcf00f2e74cb.exe	29
PID 1696 wrote to memory of 584	1696	5135d1b17a6cd39214038cb098e9bab090ece866f75ce7c2839fdcf00f2e74cb.exe	29
PID 1696 wrote to memory of 584	1696	5135d1b17a6cd39214038cb098e9bab090ece866f75ce7c2839fdcf00f2e74cb.exe	29
PID 644 wrote to memory of 520	644	zog.exe	31
PID 644 wrote to memory of 520	644	zog.exe	31
PID 644 wrote to memory of 520	644	zog.exe	31
PID 644 wrote to memory of 520	644	zog.exe	31
PID 644 wrote to memory of 520	644	zog.exe	31
PID 520 wrote to memory of 332	520	explorer.exe	6
PID 988 wrote to memory of 1452	988	Y4u5h60580.exe	32
PID 988 wrote to memory of 1452	988	Y4u5h60580.exe	32
PID 988 wrote to memory of 1452	988	Y4u5h60580.exe	32
PID 988 wrote to memory of 1452	988	Y4u5h60580.exe	32
PID 988 wrote to memory of 1620	988	Y4u5h60580.exe	33
PID 988 wrote to memory of 1620	988	Y4u5h60580.exe	33
PID 988 wrote to memory of 1620	988	Y4u5h60580.exe	33
PID 988 wrote to memory of 1620	988	Y4u5h60580.exe	33
PID 1620 wrote to memory of 596	1620	cmd.exe	35
PID 1620 wrote to memory of 596	1620	cmd.exe	35
PID 1620 wrote to memory of 596	1620	cmd.exe	35
PID 1620 wrote to memory of 596	1620	cmd.exe	35
PID 332 wrote to memory of 1016	332	csrss.exe	36
PID 332 wrote to memory of 1016	332	csrss.exe	36

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:332

C:\Users\Admin\AppData\Local\Temp\5135d1b17a6cd39214038cb098e9bab090ece866f75ce7c2839fdcf00f2e74cb.exe
"C:\Users\Admin\AppData\Local\Temp\5135d1b17a6cd39214038cb098e9bab090ece866f75ce7c2839fdcf00f2e74cb.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1696
- C:\Users\Admin\Y4u5h60580.exe
  Y4u5h60580.exe
  2⤵
  - Modifies visiblity of hidden/system files in Explorer
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:988
- - C:\Users\Admin\dutug.exe
    "C:\Users\Admin\dutug.exe"
    3⤵
    - Modifies visiblity of hidden/system files in Explorer
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:1452
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c tasklist&&del Y4u5h60580.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1620
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:596
- C:\Users\Admin\zog.exe
  zog.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:644
- - C:\Windows\explorer.exe
    00000084*
    3⤵
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:520
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del 5135d1b17a6cd39214038cb098e9bab090ece866f75ce7c2839fdcf00f2e74cb.exe
  2⤵
  - Deletes itself
  PID:584

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
1⤵
PID:1016

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Discovery

Process Discovery

T1057

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\Y4u5h60580.exe

Filesize
156KB

MD5
9f8c7135656944d1f44898bcccd861c2

SHA1
bad42bc8dad10a21bfdacc596a3815db0b69a175

SHA256
a4dfaa76c783983bffea99b8c8a108b32dd469ae51f4277f9381b79d2dcd9bfd

SHA512
2f2ed402480fa06ba520e3192b31354dd5bbf2557f85aa69370c54b22fb6a0888ef08240190ec975cc73a4266a45af9ba564b3be7b70dc167d3cd95e523b16d5

Download Submit
C:\Users\Admin\Y4u5h60580.exe

Filesize
156KB

MD5
9f8c7135656944d1f44898bcccd861c2

SHA1
bad42bc8dad10a21bfdacc596a3815db0b69a175

SHA256
a4dfaa76c783983bffea99b8c8a108b32dd469ae51f4277f9381b79d2dcd9bfd

SHA512
2f2ed402480fa06ba520e3192b31354dd5bbf2557f85aa69370c54b22fb6a0888ef08240190ec975cc73a4266a45af9ba564b3be7b70dc167d3cd95e523b16d5

Download Submit
C:\Users\Admin\dutug.exe

Filesize
156KB

MD5
39d3f55b68a0e566552f201868661289

SHA1
6829ebad5317937ed78182a058d036d10c195436

SHA256
00881e33f5e6cae90e702b4f1cc764036f9d916bc14e4c3c93c86b146f11b8b1

SHA512
2f036ee1067a39c4eaf2feaaa666607cb8667c9e33aa243a528c7cba2b55029123f36327ef5d322a58864204b826980aa0b4f465c91c9bf9608a347c9ac6c775

Download Submit
C:\Users\Admin\dutug.exe

Filesize
156KB

MD5
39d3f55b68a0e566552f201868661289

SHA1
6829ebad5317937ed78182a058d036d10c195436

SHA256
00881e33f5e6cae90e702b4f1cc764036f9d916bc14e4c3c93c86b146f11b8b1

SHA512
2f036ee1067a39c4eaf2feaaa666607cb8667c9e33aa243a528c7cba2b55029123f36327ef5d322a58864204b826980aa0b4f465c91c9bf9608a347c9ac6c775

Download Submit
C:\Users\Admin\zog.exe

Filesize
181KB

MD5
139c3fc0dbda75248805ed1a0d41d44a

SHA1
2d789ae79753aae0afd544c419029fd6129a1d29

SHA256
28da5c2be3b507a8d6c0edc0bbf345c7521d4834c351bd6ab6d2d0778fb24bac

SHA512
8d1f286913ee93212104f9032d3ed501d20f85c94e191ff5a0bc6c168d114aad9a8e5d2ee8fd36042a6d3b00c4236c8abe75db5761e2a632f7600969e5f81520

Download Submit
C:\Users\Admin\zog.exe

Filesize
181KB

MD5
139c3fc0dbda75248805ed1a0d41d44a

SHA1
2d789ae79753aae0afd544c419029fd6129a1d29

SHA256
28da5c2be3b507a8d6c0edc0bbf345c7521d4834c351bd6ab6d2d0778fb24bac

SHA512
8d1f286913ee93212104f9032d3ed501d20f85c94e191ff5a0bc6c168d114aad9a8e5d2ee8fd36042a6d3b00c4236c8abe75db5761e2a632f7600969e5f81520

Download Submit
C:\Windows\system32\consrv.DLL

Filesize
52KB

MD5
1812577ddfa736694a8dbad896d329d7

SHA1
a6831421aa2c04b93078df35d4bd2eed62985060

SHA256
c9173337e91ef6a59658dd60f713517eddd8cb43196dcc970266cbc12c33d5df

SHA512
d470c44c8e969b182dae8b2451075b525a9f1fc349737db19966581cb76289b1cac00cf6b7920c53959aaaedabd47385acc6b74dce2cc8f6a54a5ed882901d34

Download Submit
\Users\Admin\Y4u5h60580.exe

Filesize
156KB

MD5
9f8c7135656944d1f44898bcccd861c2

SHA1
bad42bc8dad10a21bfdacc596a3815db0b69a175

SHA256
a4dfaa76c783983bffea99b8c8a108b32dd469ae51f4277f9381b79d2dcd9bfd

SHA512
2f2ed402480fa06ba520e3192b31354dd5bbf2557f85aa69370c54b22fb6a0888ef08240190ec975cc73a4266a45af9ba564b3be7b70dc167d3cd95e523b16d5

Download Submit
\Users\Admin\Y4u5h60580.exe

Filesize
156KB

MD5
9f8c7135656944d1f44898bcccd861c2

SHA1
bad42bc8dad10a21bfdacc596a3815db0b69a175

SHA256
a4dfaa76c783983bffea99b8c8a108b32dd469ae51f4277f9381b79d2dcd9bfd

SHA512
2f2ed402480fa06ba520e3192b31354dd5bbf2557f85aa69370c54b22fb6a0888ef08240190ec975cc73a4266a45af9ba564b3be7b70dc167d3cd95e523b16d5

Download Submit
\Users\Admin\dutug.exe

Filesize
156KB

MD5
39d3f55b68a0e566552f201868661289

SHA1
6829ebad5317937ed78182a058d036d10c195436

SHA256
00881e33f5e6cae90e702b4f1cc764036f9d916bc14e4c3c93c86b146f11b8b1

SHA512
2f036ee1067a39c4eaf2feaaa666607cb8667c9e33aa243a528c7cba2b55029123f36327ef5d322a58864204b826980aa0b4f465c91c9bf9608a347c9ac6c775

Download Submit
\Users\Admin\dutug.exe

Filesize
156KB

MD5
39d3f55b68a0e566552f201868661289

SHA1
6829ebad5317937ed78182a058d036d10c195436

SHA256
00881e33f5e6cae90e702b4f1cc764036f9d916bc14e4c3c93c86b146f11b8b1

SHA512
2f036ee1067a39c4eaf2feaaa666607cb8667c9e33aa243a528c7cba2b55029123f36327ef5d322a58864204b826980aa0b4f465c91c9bf9608a347c9ac6c775

Download Submit
\Users\Admin\zog.exe

Filesize
181KB

MD5
139c3fc0dbda75248805ed1a0d41d44a

SHA1
2d789ae79753aae0afd544c419029fd6129a1d29

SHA256
28da5c2be3b507a8d6c0edc0bbf345c7521d4834c351bd6ab6d2d0778fb24bac

SHA512
8d1f286913ee93212104f9032d3ed501d20f85c94e191ff5a0bc6c168d114aad9a8e5d2ee8fd36042a6d3b00c4236c8abe75db5761e2a632f7600969e5f81520

Download Submit
\Users\Admin\zog.exe

Filesize
181KB

MD5
139c3fc0dbda75248805ed1a0d41d44a

SHA1
2d789ae79753aae0afd544c419029fd6129a1d29

SHA256
28da5c2be3b507a8d6c0edc0bbf345c7521d4834c351bd6ab6d2d0778fb24bac

SHA512
8d1f286913ee93212104f9032d3ed501d20f85c94e191ff5a0bc6c168d114aad9a8e5d2ee8fd36042a6d3b00c4236c8abe75db5761e2a632f7600969e5f81520

Download Submit
\Windows\System32\consrv.dll

Filesize
52KB

MD5
1812577ddfa736694a8dbad896d329d7

SHA1
a6831421aa2c04b93078df35d4bd2eed62985060

SHA256
c9173337e91ef6a59658dd60f713517eddd8cb43196dcc970266cbc12c33d5df

SHA512
d470c44c8e969b182dae8b2451075b525a9f1fc349737db19966581cb76289b1cac00cf6b7920c53959aaaedabd47385acc6b74dce2cc8f6a54a5ed882901d34

Download Submit
memory/332-88-0x0000000000820000-0x0000000000832000-memory.dmp

Filesize
72KB

Download
memory/520-70-0x0000000000000000-mapping.dmp

Download
memory/520-72-0x00000000003F0000-0x0000000000409000-memory.dmp

Filesize
100KB

Download
memory/520-78-0x00000000003F0000-0x0000000000409000-memory.dmp

Filesize
100KB

Download
memory/520-83-0x00000000003F0000-0x0000000000409000-memory.dmp

Filesize
100KB

Download
memory/520-84-0x0000000000060000-0x0000000000075000-memory.dmp

Filesize
84KB

Download
memory/584-67-0x0000000000000000-mapping.dmp

Download
memory/596-97-0x0000000000000000-mapping.dmp

Download
memory/644-62-0x0000000000000000-mapping.dmp

Download
memory/644-73-0x0000000000350000-0x00000000003AE000-memory.dmp

Filesize
376KB

Download
memory/644-71-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/644-68-0x0000000000350000-0x00000000003AE000-memory.dmp

Filesize
376KB

Download
memory/988-57-0x0000000000000000-mapping.dmp

Download
memory/1452-91-0x0000000000000000-mapping.dmp

Download
memory/1620-96-0x0000000000000000-mapping.dmp

Download
memory/1696-54-0x00000000766D1000-0x00000000766D3000-memory.dmp

Filesize
8KB

Download