Analysis
-
max time kernel
174s -
max time network
129s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
14/10/2022, 10:08
Static task
static1
Behavioral task
behavioral1
Sample
1e6dd6998fb06d1a6f8afc5bb7e7b41518179285f28553cccdb6e45adc303df7.exe
Resource
win7-20220812-en
windows7-x64
17 signatures
150 seconds
Behavioral task
behavioral2
Sample
1e6dd6998fb06d1a6f8afc5bb7e7b41518179285f28553cccdb6e45adc303df7.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
12 signatures
150 seconds
General
-
Target
1e6dd6998fb06d1a6f8afc5bb7e7b41518179285f28553cccdb6e45adc303df7.exe
-
Size
452KB
-
MD5
638e0e23a8e006dce8dfded1cbff5e9e
-
SHA1
6d846680bdf596b4df98b814a591aaa86030f12f
-
SHA256
1e6dd6998fb06d1a6f8afc5bb7e7b41518179285f28553cccdb6e45adc303df7
-
SHA512
8ce8d57702951f5416aaa95a163f379e2d60bab9e672d1b6463318347f50430f7fe1156b25019ec6922957c70c7fc498498d72a56884fd1c962db40ef10a90b2
-
SSDEEP
12288:KYU476vtic2xSNc8DtoQRWIvf5qZ4KAlPfEOX:1utj22c8RVWFZ3ARsOX
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" xiufeo.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" jm9su7UE.exe -
Executes dropped EXE 6 IoCs
pid Process 4428 jm9su7UE.exe 2336 auhost.exe 4132 auhost.exe 4588 xiufeo.exe 4664 bqhost.exe 612 elhost.exe -
resource yara_rule behavioral2/memory/4132-145-0x0000000000400000-0x000000000040E000-memory.dmp upx behavioral2/memory/4132-148-0x0000000000400000-0x000000000040E000-memory.dmp upx behavioral2/memory/4132-149-0x0000000000400000-0x000000000040E000-memory.dmp upx behavioral2/memory/4132-156-0x0000000000400000-0x000000000040E000-memory.dmp upx -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation jm9su7UE.exe Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation 1e6dd6998fb06d1a6f8afc5bb7e7b41518179285f28553cccdb6e45adc303df7.exe -
Adds Run key to start application 2 TTPs 54 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xiufeo = "C:\\Users\\Admin\\xiufeo.exe /g" xiufeo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xiufeo = "C:\\Users\\Admin\\xiufeo.exe /m" xiufeo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xiufeo = "C:\\Users\\Admin\\xiufeo.exe /Q" xiufeo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xiufeo = "C:\\Users\\Admin\\xiufeo.exe /k" xiufeo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xiufeo = "C:\\Users\\Admin\\xiufeo.exe /z" xiufeo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xiufeo = "C:\\Users\\Admin\\xiufeo.exe /j" xiufeo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xiufeo = "C:\\Users\\Admin\\xiufeo.exe /p" xiufeo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xiufeo = "C:\\Users\\Admin\\xiufeo.exe /Y" xiufeo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xiufeo = "C:\\Users\\Admin\\xiufeo.exe /O" xiufeo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xiufeo = "C:\\Users\\Admin\\xiufeo.exe /V" xiufeo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xiufeo = "C:\\Users\\Admin\\xiufeo.exe /I" xiufeo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xiufeo = "C:\\Users\\Admin\\xiufeo.exe /b" xiufeo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xiufeo = "C:\\Users\\Admin\\xiufeo.exe /F" xiufeo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xiufeo = "C:\\Users\\Admin\\xiufeo.exe /H" xiufeo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xiufeo = "C:\\Users\\Admin\\xiufeo.exe /P" xiufeo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xiufeo = "C:\\Users\\Admin\\xiufeo.exe /s" xiufeo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xiufeo = "C:\\Users\\Admin\\xiufeo.exe /B" xiufeo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xiufeo = "C:\\Users\\Admin\\xiufeo.exe /P" jm9su7UE.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xiufeo = "C:\\Users\\Admin\\xiufeo.exe /Z" xiufeo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xiufeo = "C:\\Users\\Admin\\xiufeo.exe /t" xiufeo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xiufeo = "C:\\Users\\Admin\\xiufeo.exe /w" xiufeo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xiufeo = "C:\\Users\\Admin\\xiufeo.exe /e" xiufeo.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows\CurrentVersion\Run\ jm9su7UE.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xiufeo = "C:\\Users\\Admin\\xiufeo.exe /r" xiufeo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xiufeo = "C:\\Users\\Admin\\xiufeo.exe /C" xiufeo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xiufeo = "C:\\Users\\Admin\\xiufeo.exe /G" xiufeo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xiufeo = "C:\\Users\\Admin\\xiufeo.exe /R" xiufeo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xiufeo = "C:\\Users\\Admin\\xiufeo.exe /N" xiufeo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xiufeo = "C:\\Users\\Admin\\xiufeo.exe /x" xiufeo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xiufeo = "C:\\Users\\Admin\\xiufeo.exe /a" xiufeo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xiufeo = "C:\\Users\\Admin\\xiufeo.exe /L" xiufeo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xiufeo = "C:\\Users\\Admin\\xiufeo.exe /X" xiufeo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xiufeo = "C:\\Users\\Admin\\xiufeo.exe /S" xiufeo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xiufeo = "C:\\Users\\Admin\\xiufeo.exe /M" xiufeo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xiufeo = "C:\\Users\\Admin\\xiufeo.exe /U" xiufeo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xiufeo = "C:\\Users\\Admin\\xiufeo.exe /K" xiufeo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xiufeo = "C:\\Users\\Admin\\xiufeo.exe /d" xiufeo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xiufeo = "C:\\Users\\Admin\\xiufeo.exe /f" xiufeo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xiufeo = "C:\\Users\\Admin\\xiufeo.exe /i" xiufeo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xiufeo = "C:\\Users\\Admin\\xiufeo.exe /T" xiufeo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xiufeo = "C:\\Users\\Admin\\xiufeo.exe /y" xiufeo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xiufeo = "C:\\Users\\Admin\\xiufeo.exe /E" xiufeo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xiufeo = "C:\\Users\\Admin\\xiufeo.exe /c" xiufeo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xiufeo = "C:\\Users\\Admin\\xiufeo.exe /q" xiufeo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xiufeo = "C:\\Users\\Admin\\xiufeo.exe /l" xiufeo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xiufeo = "C:\\Users\\Admin\\xiufeo.exe /o" xiufeo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xiufeo = "C:\\Users\\Admin\\xiufeo.exe /v" xiufeo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xiufeo = "C:\\Users\\Admin\\xiufeo.exe /J" xiufeo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xiufeo = "C:\\Users\\Admin\\xiufeo.exe /A" xiufeo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xiufeo = "C:\\Users\\Admin\\xiufeo.exe /n" xiufeo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xiufeo = "C:\\Users\\Admin\\xiufeo.exe /W" xiufeo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xiufeo = "C:\\Users\\Admin\\xiufeo.exe /D" xiufeo.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows\CurrentVersion\Run\ xiufeo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xiufeo = "C:\\Users\\Admin\\xiufeo.exe /u" xiufeo.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 2336 set thread context of 4132 2336 auhost.exe 82 PID 4664 set thread context of 5048 4664 bqhost.exe 91 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Enumerates processes with tasklist 1 TTPs 2 IoCs
pid Process 2812 tasklist.exe 4736 tasklist.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4428 jm9su7UE.exe 4428 jm9su7UE.exe 4132 auhost.exe 4132 auhost.exe 4428 jm9su7UE.exe 4428 jm9su7UE.exe 4588 xiufeo.exe 4588 xiufeo.exe 4588 xiufeo.exe 4588 xiufeo.exe 4132 auhost.exe 4132 auhost.exe 4588 xiufeo.exe 4588 xiufeo.exe 4588 xiufeo.exe 4588 xiufeo.exe 4588 xiufeo.exe 4588 xiufeo.exe 4132 auhost.exe 4132 auhost.exe 4588 xiufeo.exe 4588 xiufeo.exe 4132 auhost.exe 4132 auhost.exe 4132 auhost.exe 4132 auhost.exe 4588 xiufeo.exe 4588 xiufeo.exe 4588 xiufeo.exe 4588 xiufeo.exe 4588 xiufeo.exe 4588 xiufeo.exe 4132 auhost.exe 4132 auhost.exe 4588 xiufeo.exe 4588 xiufeo.exe 4132 auhost.exe 4132 auhost.exe 4588 xiufeo.exe 4588 xiufeo.exe 4132 auhost.exe 4132 auhost.exe 4588 xiufeo.exe 4588 xiufeo.exe 4588 xiufeo.exe 4588 xiufeo.exe 4588 xiufeo.exe 4588 xiufeo.exe 4132 auhost.exe 4132 auhost.exe 4588 xiufeo.exe 4588 xiufeo.exe 4132 auhost.exe 4132 auhost.exe 4132 auhost.exe 4132 auhost.exe 4588 xiufeo.exe 4588 xiufeo.exe 4132 auhost.exe 4132 auhost.exe 4132 auhost.exe 4132 auhost.exe 4588 xiufeo.exe 4588 xiufeo.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 4736 tasklist.exe Token: SeDebugPrivilege 4664 bqhost.exe Token: SeDebugPrivilege 2812 tasklist.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 408 1e6dd6998fb06d1a6f8afc5bb7e7b41518179285f28553cccdb6e45adc303df7.exe 4428 jm9su7UE.exe 2336 auhost.exe 4588 xiufeo.exe 612 elhost.exe -
Suspicious use of WriteProcessMemory 39 IoCs
description pid Process procid_target PID 408 wrote to memory of 4428 408 1e6dd6998fb06d1a6f8afc5bb7e7b41518179285f28553cccdb6e45adc303df7.exe 78 PID 408 wrote to memory of 4428 408 1e6dd6998fb06d1a6f8afc5bb7e7b41518179285f28553cccdb6e45adc303df7.exe 78 PID 408 wrote to memory of 4428 408 1e6dd6998fb06d1a6f8afc5bb7e7b41518179285f28553cccdb6e45adc303df7.exe 78 PID 408 wrote to memory of 2336 408 1e6dd6998fb06d1a6f8afc5bb7e7b41518179285f28553cccdb6e45adc303df7.exe 81 PID 408 wrote to memory of 2336 408 1e6dd6998fb06d1a6f8afc5bb7e7b41518179285f28553cccdb6e45adc303df7.exe 81 PID 408 wrote to memory of 2336 408 1e6dd6998fb06d1a6f8afc5bb7e7b41518179285f28553cccdb6e45adc303df7.exe 81 PID 2336 wrote to memory of 4132 2336 auhost.exe 82 PID 2336 wrote to memory of 4132 2336 auhost.exe 82 PID 2336 wrote to memory of 4132 2336 auhost.exe 82 PID 2336 wrote to memory of 4132 2336 auhost.exe 82 PID 2336 wrote to memory of 4132 2336 auhost.exe 82 PID 2336 wrote to memory of 4132 2336 auhost.exe 82 PID 2336 wrote to memory of 4132 2336 auhost.exe 82 PID 2336 wrote to memory of 4132 2336 auhost.exe 82 PID 4428 wrote to memory of 4588 4428 jm9su7UE.exe 83 PID 4428 wrote to memory of 4588 4428 jm9su7UE.exe 83 PID 4428 wrote to memory of 4588 4428 jm9su7UE.exe 83 PID 4428 wrote to memory of 912 4428 jm9su7UE.exe 84 PID 4428 wrote to memory of 912 4428 jm9su7UE.exe 84 PID 4428 wrote to memory of 912 4428 jm9su7UE.exe 84 PID 408 wrote to memory of 4664 408 1e6dd6998fb06d1a6f8afc5bb7e7b41518179285f28553cccdb6e45adc303df7.exe 86 PID 408 wrote to memory of 4664 408 1e6dd6998fb06d1a6f8afc5bb7e7b41518179285f28553cccdb6e45adc303df7.exe 86 PID 408 wrote to memory of 4664 408 1e6dd6998fb06d1a6f8afc5bb7e7b41518179285f28553cccdb6e45adc303df7.exe 86 PID 912 wrote to memory of 4736 912 cmd.exe 87 PID 912 wrote to memory of 4736 912 cmd.exe 87 PID 912 wrote to memory of 4736 912 cmd.exe 87 PID 4664 wrote to memory of 5048 4664 bqhost.exe 91 PID 4664 wrote to memory of 5048 4664 bqhost.exe 91 PID 4664 wrote to memory of 5048 4664 bqhost.exe 91 PID 4664 wrote to memory of 5048 4664 bqhost.exe 91 PID 408 wrote to memory of 612 408 1e6dd6998fb06d1a6f8afc5bb7e7b41518179285f28553cccdb6e45adc303df7.exe 93 PID 408 wrote to memory of 612 408 1e6dd6998fb06d1a6f8afc5bb7e7b41518179285f28553cccdb6e45adc303df7.exe 93 PID 408 wrote to memory of 612 408 1e6dd6998fb06d1a6f8afc5bb7e7b41518179285f28553cccdb6e45adc303df7.exe 93 PID 408 wrote to memory of 2848 408 1e6dd6998fb06d1a6f8afc5bb7e7b41518179285f28553cccdb6e45adc303df7.exe 99 PID 408 wrote to memory of 2848 408 1e6dd6998fb06d1a6f8afc5bb7e7b41518179285f28553cccdb6e45adc303df7.exe 99 PID 408 wrote to memory of 2848 408 1e6dd6998fb06d1a6f8afc5bb7e7b41518179285f28553cccdb6e45adc303df7.exe 99 PID 2848 wrote to memory of 2812 2848 cmd.exe 100 PID 2848 wrote to memory of 2812 2848 cmd.exe 100 PID 2848 wrote to memory of 2812 2848 cmd.exe 100
Processes
-
C:\Users\Admin\AppData\Local\Temp\1e6dd6998fb06d1a6f8afc5bb7e7b41518179285f28553cccdb6e45adc303df7.exe"C:\Users\Admin\AppData\Local\Temp\1e6dd6998fb06d1a6f8afc5bb7e7b41518179285f28553cccdb6e45adc303df7.exe"1⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:408 -
C:\Users\Admin\jm9su7UE.exeC:\Users\Admin\jm9su7UE.exe2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4428 -
C:\Users\Admin\xiufeo.exe"C:\Users\Admin\xiufeo.exe"3⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4588
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c tasklist&&del jm9su7UE.exe3⤵
- Suspicious use of WriteProcessMemory
PID:912 -
C:\Windows\SysWOW64\tasklist.exetasklist4⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:4736
-
-
-
-
C:\Users\Admin\auhost.exeC:\Users\Admin\auhost.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2336 -
C:\Users\Admin\auhost.exe"C:\Users\Admin\auhost.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4132
-
-
-
C:\Users\Admin\bqhost.exeC:\Users\Admin\bqhost.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4664 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"3⤵PID:5048
-
-
-
C:\Users\Admin\elhost.exeC:\Users\Admin\elhost.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:612
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c tasklist&&del 1e6dd6998fb06d1a6f8afc5bb7e7b41518179285f28553cccdb6e45adc303df7.exe2⤵
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\Windows\SysWOW64\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:2812
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60KB
MD50ce1e9a2bc7b4a2b10a847acace8f337
SHA17698c4d822146dd757c6b39bdcec8d443860c099
SHA2561fa5dca1771d75940cd5364edb358d914baaefdc56f2d21d573bbce22d41b205
SHA5126b0be69db960889d5be8e89e92c7e3c82fa07430ebf16ad1d2fb77ad1a23d0358c0f7e44f75d16da2722abc4998cba88f6b08090b3a4b7f8b1400ae6001a1bb7
-
Filesize
60KB
MD50ce1e9a2bc7b4a2b10a847acace8f337
SHA17698c4d822146dd757c6b39bdcec8d443860c099
SHA2561fa5dca1771d75940cd5364edb358d914baaefdc56f2d21d573bbce22d41b205
SHA5126b0be69db960889d5be8e89e92c7e3c82fa07430ebf16ad1d2fb77ad1a23d0358c0f7e44f75d16da2722abc4998cba88f6b08090b3a4b7f8b1400ae6001a1bb7
-
Filesize
60KB
MD50ce1e9a2bc7b4a2b10a847acace8f337
SHA17698c4d822146dd757c6b39bdcec8d443860c099
SHA2561fa5dca1771d75940cd5364edb358d914baaefdc56f2d21d573bbce22d41b205
SHA5126b0be69db960889d5be8e89e92c7e3c82fa07430ebf16ad1d2fb77ad1a23d0358c0f7e44f75d16da2722abc4998cba88f6b08090b3a4b7f8b1400ae6001a1bb7
-
Filesize
260KB
MD5880ec3876f5d5687be0f9099c1d629ee
SHA16b6e56229204e16285f44684a4fa904ded59beef
SHA256d65d3acf805651b38ec3c6eee1fb4efa83824fdd7e407495cdb9f6ad9b8e0c7d
SHA5122fa67fd0e315ea45ea2e54afcf42ff3795b5a64326470f7bb285adb8e840ba68de02fb1d518bc34d94067b8ef7d5e2865718fff9a805193c2b6f128d546f6434
-
Filesize
260KB
MD5880ec3876f5d5687be0f9099c1d629ee
SHA16b6e56229204e16285f44684a4fa904ded59beef
SHA256d65d3acf805651b38ec3c6eee1fb4efa83824fdd7e407495cdb9f6ad9b8e0c7d
SHA5122fa67fd0e315ea45ea2e54afcf42ff3795b5a64326470f7bb285adb8e840ba68de02fb1d518bc34d94067b8ef7d5e2865718fff9a805193c2b6f128d546f6434
-
Filesize
48KB
MD582cd7f18c0c82c6c4228033a8dcaef8b
SHA166f78542b3ee762e4b189f658f37d01dbf0aff43
SHA25618ec72076fb151ad97aeaa5e18d357aeb77c405dd867703e6709b9ede40cb237
SHA512f9306ced3be80943b19c4fab575f1070bee46f9c049de988e9ec737ce6b320c66c82eec9a2cbed8f598514da2a21459bb7c25d514173afd566cd76d97a070142
-
Filesize
48KB
MD582cd7f18c0c82c6c4228033a8dcaef8b
SHA166f78542b3ee762e4b189f658f37d01dbf0aff43
SHA25618ec72076fb151ad97aeaa5e18d357aeb77c405dd867703e6709b9ede40cb237
SHA512f9306ced3be80943b19c4fab575f1070bee46f9c049de988e9ec737ce6b320c66c82eec9a2cbed8f598514da2a21459bb7c25d514173afd566cd76d97a070142
-
Filesize
212KB
MD5e533f129e341c16a690960697fbb5c27
SHA1c1c945168f49e1e312b77f518e1fcb5ab0a1c824
SHA2562d0bcc8dce0a65ec302bfe3a49c143ba852d50286893657674c6c7fe73b70bff
SHA512c5ce81ed27a8a4618b14560d97c1022b7a0156f8acdf883e9a8cdfc94c1edbbc76fed52fb5eba67af57dc3e5d269bfa480878da5d78108e9dc0392928d490ad6
-
Filesize
212KB
MD5e533f129e341c16a690960697fbb5c27
SHA1c1c945168f49e1e312b77f518e1fcb5ab0a1c824
SHA2562d0bcc8dce0a65ec302bfe3a49c143ba852d50286893657674c6c7fe73b70bff
SHA512c5ce81ed27a8a4618b14560d97c1022b7a0156f8acdf883e9a8cdfc94c1edbbc76fed52fb5eba67af57dc3e5d269bfa480878da5d78108e9dc0392928d490ad6
-
Filesize
212KB
MD566028644724a023cd0f1765507538e03
SHA1df1fe712fc9ccff2e631273be53390a07b592ad1
SHA256759867f1c1bc3bcc95ae27350e96ecca0154be75ae182d27ad569f0901759812
SHA5129128ef1339c9e3a2880090417cb403b16f71c50f3fba10b9335189584a19a308cb7a0a19e4768d79e7a2bccb026eec913e4f88fd2a6f37e4197f1e7fcaf95826
-
Filesize
212KB
MD566028644724a023cd0f1765507538e03
SHA1df1fe712fc9ccff2e631273be53390a07b592ad1
SHA256759867f1c1bc3bcc95ae27350e96ecca0154be75ae182d27ad569f0901759812
SHA5129128ef1339c9e3a2880090417cb403b16f71c50f3fba10b9335189584a19a308cb7a0a19e4768d79e7a2bccb026eec913e4f88fd2a6f37e4197f1e7fcaf95826