description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe C:\\Windows\\system32\\fservice.exe"	c46805d51bfee760e479a708d5b3a0d1e089396103d01f0693c3fc5edbd9760b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe C:\\Windows\\system32\\fservice.exe"	services.exe

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\DirectX For Microsoft® Windows = "C:\\Windows\\system32\\fservice.exe"	services.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	c46805d51bfee760e479a708d5b3a0d1e089396103d01f0693c3fc5edbd9760b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\DirectX For Microsoft® Windows = "C:\\Windows\\system32\\fservice.exe"	c46805d51bfee760e479a708d5b3a0d1e089396103d01f0693c3fc5edbd9760b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	services.exe

resource	yara_rule
behavioral2/memory/2800-132-0x0000000000400000-0x00000000005FC000-memory.dmp	upx
behavioral2/memory/2800-133-0x0000000000400000-0x00000000005FC000-memory.dmp	upx
behavioral2/files/0x000300000001e64d-135.dat	upx
behavioral2/files/0x000300000001e64d-136.dat	upx
behavioral2/files/0x000b00000002171d-137.dat	upx
behavioral2/files/0x0002000000021b42-139.dat	upx
behavioral2/files/0x0002000000021b42-140.dat	upx
behavioral2/memory/3376-142-0x0000000000400000-0x00000000005FC000-memory.dmp	upx
behavioral2/memory/3620-143-0x0000000000400000-0x00000000005FC000-memory.dmp	upx
behavioral2/memory/3376-155-0x0000000000400000-0x00000000005FC000-memory.dmp	upx
behavioral2/memory/2800-157-0x0000000000400000-0x00000000005FC000-memory.dmp	upx
behavioral2/memory/3620-159-0x0000000000400000-0x00000000005FC000-memory.dmp	upx

pid	Process
3620	services.exe
3620	services.exe
3620	services.exe
3376	fservice.exe
2800	c46805d51bfee760e479a708d5b3a0d1e089396103d01f0693c3fc5edbd9760b.exe

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\fservice.exe	c46805d51bfee760e479a708d5b3a0d1e089396103d01f0693c3fc5edbd9760b.exe
File created	C:\Windows\SysWOW64\fservice.exe	fservice.exe
File opened for modification	C:\Windows\SysWOW64\fservice.exe	fservice.exe
File created	C:\Windows\SysWOW64\winkey.dll	services.exe
File created	C:\Windows\SysWOW64\reginv.dll	services.exe
File created	C:\Windows\SysWOW64\fservice.exe	services.exe
File created	C:\Windows\SysWOW64\fservice.exe	c46805d51bfee760e479a708d5b3a0d1e089396103d01f0693c3fc5edbd9760b.exe

description	ioc	Process
File created	C:\Windows\system\sservice.exe	c46805d51bfee760e479a708d5b3a0d1e089396103d01f0693c3fc5edbd9760b.exe
File opened for modification	C:\Windows\system\sservice.exe	c46805d51bfee760e479a708d5b3a0d1e089396103d01f0693c3fc5edbd9760b.exe
File created	C:\Windows\services.exe	fservice.exe
File opened for modification	C:\Windows\services.exe	fservice.exe
File created	C:\Windows\system\sservice.exe	fservice.exe
File opened for modification	C:\Windows\system\sservice.exe	fservice.exe
File created	C:\Windows\system\sservice.exe	services.exe

description	pid	Process	procid_target
PID 2800 wrote to memory of 3376	2800	c46805d51bfee760e479a708d5b3a0d1e089396103d01f0693c3fc5edbd9760b.exe	84
PID 2800 wrote to memory of 3376	2800	c46805d51bfee760e479a708d5b3a0d1e089396103d01f0693c3fc5edbd9760b.exe	84
PID 2800 wrote to memory of 3376	2800	c46805d51bfee760e479a708d5b3a0d1e089396103d01f0693c3fc5edbd9760b.exe	84
PID 3376 wrote to memory of 3620	3376	fservice.exe	85
PID 3376 wrote to memory of 3620	3376	fservice.exe	85
PID 3376 wrote to memory of 3620	3376	fservice.exe	85
PID 3620 wrote to memory of 4356	3620	services.exe	86
PID 3620 wrote to memory of 4356	3620	services.exe	86
PID 3620 wrote to memory of 4356	3620	services.exe	86
PID 3620 wrote to memory of 3776	3620	services.exe	87
PID 3620 wrote to memory of 3776	3620	services.exe	87
PID 3620 wrote to memory of 3776	3620	services.exe	87
PID 3776 wrote to memory of 4040	3776	NET.exe	91
PID 3776 wrote to memory of 4040	3776	NET.exe	91
PID 3776 wrote to memory of 4040	3776	NET.exe	91
PID 4356 wrote to memory of 4504	4356	NET.exe	90
PID 4356 wrote to memory of 4504	4356	NET.exe	90
PID 4356 wrote to memory of 4504	4356	NET.exe	90
PID 2800 wrote to memory of 4328	2800	c46805d51bfee760e479a708d5b3a0d1e089396103d01f0693c3fc5edbd9760b.exe	92
PID 2800 wrote to memory of 4328	2800	c46805d51bfee760e479a708d5b3a0d1e089396103d01f0693c3fc5edbd9760b.exe	92
PID 2800 wrote to memory of 4328	2800	c46805d51bfee760e479a708d5b3a0d1e089396103d01f0693c3fc5edbd9760b.exe	92

Analysis

Sharing