Analysis
-
max time kernel
156s -
max time network
180s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
30/10/2022, 20:22
Behavioral task
behavioral1
Sample
fdfdae75585d82bbbbcf987a718f39f073e97eb93174f24b6944fa429ebacb20.exe
Resource
win7-20220812-en
General
-
Target
fdfdae75585d82bbbbcf987a718f39f073e97eb93174f24b6944fa429ebacb20.exe
-
Size
335KB
-
MD5
90bd2d5f5c1236396bd700aa7722a791
-
SHA1
16e5ac0209b9bf3ccca6ac1a025efde0c99912c7
-
SHA256
fdfdae75585d82bbbbcf987a718f39f073e97eb93174f24b6944fa429ebacb20
-
SHA512
3d7d15dc27b68c5d1c311ece6cf00dc91a5748d7b71a058132bc8d49c7592f084500aa4e8e41a8db1f644cebf2b99779ab7dc369beb4bc92d20f500e7ec3f043
-
SSDEEP
6144:IqIlZJowmXZxRnANwrN8eje8gKa5oEzFQl2xR0Sj5gvC07HnFZfj44:IXlrrmXZx7rN84Xa5oEzas30Sj5gvCKZ
Malware Config
Extracted
cybergate
2.6
ÖÍíÉ
alabady.no-ip.biz :81
***MUTEX***
-
enable_keylogger
true
-
enable_message_box
true
-
ftp_directory
./logs/
-
ftp_interval
30
-
injected_process
svchost.exe
-
install_file
windows.exe
-
install_flag
true
-
keylogger_enable_ftp
false
-
message_box_caption
Error
-
message_box_title
Error
-
password
5838999
Signatures
-
Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
description pid Process procid_target PID 1548 created 1864 1548 WerFault.exe 90 -
Adds policy Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run fdfdae75585d82bbbbcf987a718f39f073e97eb93174f24b6944fa429ebacb20.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\windows.exe" fdfdae75585d82bbbbcf987a718f39f073e97eb93174f24b6944fa429ebacb20.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run fdfdae75585d82bbbbcf987a718f39f073e97eb93174f24b6944fa429ebacb20.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\windows.exe" fdfdae75585d82bbbbcf987a718f39f073e97eb93174f24b6944fa429ebacb20.exe -
Executes dropped EXE 3 IoCs
pid Process 4632 windows.exe 2184 windows.exe 1864 windows.exe -
Modifies Installed Components in the registry 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{GF4X7745-WQW6-GR05-83C3-J2A4J26U82BY} fdfdae75585d82bbbbcf987a718f39f073e97eb93174f24b6944fa429ebacb20.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{GF4X7745-WQW6-GR05-83C3-J2A4J26U82BY}\StubPath = "C:\\Windows\\system32\\windows.exe Restart" fdfdae75585d82bbbbcf987a718f39f073e97eb93174f24b6944fa429ebacb20.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{GF4X7745-WQW6-GR05-83C3-J2A4J26U82BY} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{GF4X7745-WQW6-GR05-83C3-J2A4J26U82BY}\StubPath = "C:\\Windows\\system32\\windows.exe" explorer.exe -
resource yara_rule behavioral2/memory/4304-139-0x0000000000400000-0x0000000000449000-memory.dmp upx behavioral2/memory/4304-141-0x0000000000400000-0x0000000000449000-memory.dmp upx behavioral2/memory/3820-143-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral2/memory/3820-146-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral2/memory/3820-147-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral2/memory/3820-148-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral2/memory/3820-149-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral2/memory/3820-151-0x0000000024010000-0x0000000024072000-memory.dmp upx behavioral2/memory/3820-156-0x0000000024080000-0x00000000240E2000-memory.dmp upx behavioral2/memory/532-159-0x0000000024080000-0x00000000240E2000-memory.dmp upx behavioral2/memory/532-160-0x0000000024080000-0x00000000240E2000-memory.dmp upx behavioral2/memory/3820-162-0x00000000023C0000-0x0000000002422000-memory.dmp upx behavioral2/memory/4284-167-0x0000000000400000-0x0000000000449000-memory.dmp upx behavioral2/memory/3820-168-0x00000000240F0000-0x0000000024152000-memory.dmp upx behavioral2/memory/4284-171-0x00000000240F0000-0x0000000024152000-memory.dmp upx behavioral2/memory/3820-172-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral2/files/0x0006000000022e31-174.dat upx behavioral2/memory/4284-176-0x0000000031770000-0x000000003177D000-memory.dmp upx behavioral2/memory/4284-179-0x00000000240F0000-0x0000000024152000-memory.dmp upx behavioral2/memory/532-180-0x0000000031B90000-0x0000000031B9D000-memory.dmp upx behavioral2/memory/532-181-0x0000000024080000-0x00000000240E2000-memory.dmp upx behavioral2/files/0x0006000000022e31-183.dat upx behavioral2/memory/4632-189-0x0000000031BA0000-0x0000000031BAD000-memory.dmp upx behavioral2/files/0x0006000000022e31-188.dat upx behavioral2/memory/4632-191-0x0000000000400000-0x0000000000449000-memory.dmp upx behavioral2/files/0x0006000000022e31-197.dat upx behavioral2/memory/1864-200-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral2/memory/1864-201-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral2/memory/1864-202-0x0000000031BC0000-0x0000000031BCD000-memory.dmp upx behavioral2/memory/1864-203-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral2/memory/1864-204-0x0000000031BC0000-0x0000000031BCD000-memory.dmp upx behavioral2/memory/4284-205-0x00000000240F0000-0x0000000024152000-memory.dmp upx behavioral2/memory/532-206-0x0000000031B90000-0x0000000031B9D000-memory.dmp upx behavioral2/memory/1548-207-0x0000000031BD0000-0x0000000031BDD000-memory.dmp upx behavioral2/memory/1548-208-0x0000000031BD0000-0x0000000031BDD000-memory.dmp upx behavioral2/memory/696-209-0x0000000031BF0000-0x0000000031BFD000-memory.dmp upx behavioral2/memory/696-210-0x0000000031BF0000-0x0000000031BFD000-memory.dmp upx behavioral2/memory/2692-211-0x0000000031C30000-0x0000000031C3D000-memory.dmp upx behavioral2/memory/2692-212-0x0000000031C30000-0x0000000031C3D000-memory.dmp upx behavioral2/memory/1864-213-0x0000000031BC0000-0x0000000031BCD000-memory.dmp upx behavioral2/memory/2692-214-0x0000000031C30000-0x0000000031C3D000-memory.dmp upx behavioral2/memory/696-215-0x0000000031BF0000-0x0000000031BFD000-memory.dmp upx -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation fdfdae75585d82bbbbcf987a718f39f073e97eb93174f24b6944fa429ebacb20.exe -
Drops file in System32 directory 4 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\windows.exe fdfdae75585d82bbbbcf987a718f39f073e97eb93174f24b6944fa429ebacb20.exe File opened for modification C:\Windows\SysWOW64\windows.exe fdfdae75585d82bbbbcf987a718f39f073e97eb93174f24b6944fa429ebacb20.exe File opened for modification C:\Windows\SysWOW64\ fdfdae75585d82bbbbcf987a718f39f073e97eb93174f24b6944fa429ebacb20.exe File created C:\Windows\SysWOW64\windows.exe fdfdae75585d82bbbbcf987a718f39f073e97eb93174f24b6944fa429ebacb20.exe -
Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 4304 set thread context of 5084 4304 fdfdae75585d82bbbbcf987a718f39f073e97eb93174f24b6944fa429ebacb20.exe 82 PID 5084 set thread context of 3820 5084 fdfdae75585d82bbbbcf987a718f39f073e97eb93174f24b6944fa429ebacb20.exe 84 PID 4632 set thread context of 2184 4632 windows.exe 89 PID 2184 set thread context of 1864 2184 windows.exe 90 -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\AppCompat\Programs\Amcache.hve.tmp WerFault.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 2 IoCs
pid pid_target Process procid_target 696 1864 WerFault.exe 90 2692 696 WerFault.exe 92 -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe -
Enumerates system info in registry 2 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ fdfdae75585d82bbbbcf987a718f39f073e97eb93174f24b6944fa429ebacb20.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3820 fdfdae75585d82bbbbcf987a718f39f073e97eb93174f24b6944fa429ebacb20.exe 3820 fdfdae75585d82bbbbcf987a718f39f073e97eb93174f24b6944fa429ebacb20.exe 3820 fdfdae75585d82bbbbcf987a718f39f073e97eb93174f24b6944fa429ebacb20.exe 3820 fdfdae75585d82bbbbcf987a718f39f073e97eb93174f24b6944fa429ebacb20.exe 4284 fdfdae75585d82bbbbcf987a718f39f073e97eb93174f24b6944fa429ebacb20.exe 4284 fdfdae75585d82bbbbcf987a718f39f073e97eb93174f24b6944fa429ebacb20.exe 4284 fdfdae75585d82bbbbcf987a718f39f073e97eb93174f24b6944fa429ebacb20.exe 4284 fdfdae75585d82bbbbcf987a718f39f073e97eb93174f24b6944fa429ebacb20.exe 4284 fdfdae75585d82bbbbcf987a718f39f073e97eb93174f24b6944fa429ebacb20.exe 4284 fdfdae75585d82bbbbcf987a718f39f073e97eb93174f24b6944fa429ebacb20.exe 4284 fdfdae75585d82bbbbcf987a718f39f073e97eb93174f24b6944fa429ebacb20.exe 4284 fdfdae75585d82bbbbcf987a718f39f073e97eb93174f24b6944fa429ebacb20.exe 4284 fdfdae75585d82bbbbcf987a718f39f073e97eb93174f24b6944fa429ebacb20.exe 4284 fdfdae75585d82bbbbcf987a718f39f073e97eb93174f24b6944fa429ebacb20.exe 4284 fdfdae75585d82bbbbcf987a718f39f073e97eb93174f24b6944fa429ebacb20.exe 4284 fdfdae75585d82bbbbcf987a718f39f073e97eb93174f24b6944fa429ebacb20.exe 4284 fdfdae75585d82bbbbcf987a718f39f073e97eb93174f24b6944fa429ebacb20.exe 4284 fdfdae75585d82bbbbcf987a718f39f073e97eb93174f24b6944fa429ebacb20.exe 4284 fdfdae75585d82bbbbcf987a718f39f073e97eb93174f24b6944fa429ebacb20.exe 4284 fdfdae75585d82bbbbcf987a718f39f073e97eb93174f24b6944fa429ebacb20.exe 4284 fdfdae75585d82bbbbcf987a718f39f073e97eb93174f24b6944fa429ebacb20.exe 4284 fdfdae75585d82bbbbcf987a718f39f073e97eb93174f24b6944fa429ebacb20.exe 4284 fdfdae75585d82bbbbcf987a718f39f073e97eb93174f24b6944fa429ebacb20.exe 4284 fdfdae75585d82bbbbcf987a718f39f073e97eb93174f24b6944fa429ebacb20.exe 4284 fdfdae75585d82bbbbcf987a718f39f073e97eb93174f24b6944fa429ebacb20.exe 4284 fdfdae75585d82bbbbcf987a718f39f073e97eb93174f24b6944fa429ebacb20.exe 4284 fdfdae75585d82bbbbcf987a718f39f073e97eb93174f24b6944fa429ebacb20.exe 4284 fdfdae75585d82bbbbcf987a718f39f073e97eb93174f24b6944fa429ebacb20.exe 4284 fdfdae75585d82bbbbcf987a718f39f073e97eb93174f24b6944fa429ebacb20.exe 4284 fdfdae75585d82bbbbcf987a718f39f073e97eb93174f24b6944fa429ebacb20.exe 4284 fdfdae75585d82bbbbcf987a718f39f073e97eb93174f24b6944fa429ebacb20.exe 4284 fdfdae75585d82bbbbcf987a718f39f073e97eb93174f24b6944fa429ebacb20.exe 4284 fdfdae75585d82bbbbcf987a718f39f073e97eb93174f24b6944fa429ebacb20.exe 4284 fdfdae75585d82bbbbcf987a718f39f073e97eb93174f24b6944fa429ebacb20.exe 4284 fdfdae75585d82bbbbcf987a718f39f073e97eb93174f24b6944fa429ebacb20.exe 4284 fdfdae75585d82bbbbcf987a718f39f073e97eb93174f24b6944fa429ebacb20.exe 4284 fdfdae75585d82bbbbcf987a718f39f073e97eb93174f24b6944fa429ebacb20.exe 4284 fdfdae75585d82bbbbcf987a718f39f073e97eb93174f24b6944fa429ebacb20.exe 4284 fdfdae75585d82bbbbcf987a718f39f073e97eb93174f24b6944fa429ebacb20.exe 4284 fdfdae75585d82bbbbcf987a718f39f073e97eb93174f24b6944fa429ebacb20.exe 4284 fdfdae75585d82bbbbcf987a718f39f073e97eb93174f24b6944fa429ebacb20.exe 4284 fdfdae75585d82bbbbcf987a718f39f073e97eb93174f24b6944fa429ebacb20.exe 4284 fdfdae75585d82bbbbcf987a718f39f073e97eb93174f24b6944fa429ebacb20.exe 4284 fdfdae75585d82bbbbcf987a718f39f073e97eb93174f24b6944fa429ebacb20.exe 4284 fdfdae75585d82bbbbcf987a718f39f073e97eb93174f24b6944fa429ebacb20.exe 4284 fdfdae75585d82bbbbcf987a718f39f073e97eb93174f24b6944fa429ebacb20.exe 4284 fdfdae75585d82bbbbcf987a718f39f073e97eb93174f24b6944fa429ebacb20.exe 4284 fdfdae75585d82bbbbcf987a718f39f073e97eb93174f24b6944fa429ebacb20.exe 4284 fdfdae75585d82bbbbcf987a718f39f073e97eb93174f24b6944fa429ebacb20.exe 4284 fdfdae75585d82bbbbcf987a718f39f073e97eb93174f24b6944fa429ebacb20.exe 4284 fdfdae75585d82bbbbcf987a718f39f073e97eb93174f24b6944fa429ebacb20.exe 4284 fdfdae75585d82bbbbcf987a718f39f073e97eb93174f24b6944fa429ebacb20.exe 4284 fdfdae75585d82bbbbcf987a718f39f073e97eb93174f24b6944fa429ebacb20.exe 4284 fdfdae75585d82bbbbcf987a718f39f073e97eb93174f24b6944fa429ebacb20.exe 4284 fdfdae75585d82bbbbcf987a718f39f073e97eb93174f24b6944fa429ebacb20.exe 4284 fdfdae75585d82bbbbcf987a718f39f073e97eb93174f24b6944fa429ebacb20.exe 4284 fdfdae75585d82bbbbcf987a718f39f073e97eb93174f24b6944fa429ebacb20.exe 4284 fdfdae75585d82bbbbcf987a718f39f073e97eb93174f24b6944fa429ebacb20.exe 4284 fdfdae75585d82bbbbcf987a718f39f073e97eb93174f24b6944fa429ebacb20.exe 4284 fdfdae75585d82bbbbcf987a718f39f073e97eb93174f24b6944fa429ebacb20.exe 4284 fdfdae75585d82bbbbcf987a718f39f073e97eb93174f24b6944fa429ebacb20.exe 4284 fdfdae75585d82bbbbcf987a718f39f073e97eb93174f24b6944fa429ebacb20.exe 4284 fdfdae75585d82bbbbcf987a718f39f073e97eb93174f24b6944fa429ebacb20.exe 4284 fdfdae75585d82bbbbcf987a718f39f073e97eb93174f24b6944fa429ebacb20.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4284 fdfdae75585d82bbbbcf987a718f39f073e97eb93174f24b6944fa429ebacb20.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 4284 fdfdae75585d82bbbbcf987a718f39f073e97eb93174f24b6944fa429ebacb20.exe Token: SeDebugPrivilege 4284 fdfdae75585d82bbbbcf987a718f39f073e97eb93174f24b6944fa429ebacb20.exe Token: SeRestorePrivilege 696 WerFault.exe Token: SeBackupPrivilege 696 WerFault.exe Token: SeBackupPrivilege 696 WerFault.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3820 fdfdae75585d82bbbbcf987a718f39f073e97eb93174f24b6944fa429ebacb20.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 4304 fdfdae75585d82bbbbcf987a718f39f073e97eb93174f24b6944fa429ebacb20.exe 5084 fdfdae75585d82bbbbcf987a718f39f073e97eb93174f24b6944fa429ebacb20.exe 4632 windows.exe 2184 windows.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4304 wrote to memory of 5084 4304 fdfdae75585d82bbbbcf987a718f39f073e97eb93174f24b6944fa429ebacb20.exe 82 PID 4304 wrote to memory of 5084 4304 fdfdae75585d82bbbbcf987a718f39f073e97eb93174f24b6944fa429ebacb20.exe 82 PID 4304 wrote to memory of 5084 4304 fdfdae75585d82bbbbcf987a718f39f073e97eb93174f24b6944fa429ebacb20.exe 82 PID 4304 wrote to memory of 5084 4304 fdfdae75585d82bbbbcf987a718f39f073e97eb93174f24b6944fa429ebacb20.exe 82 PID 4304 wrote to memory of 5084 4304 fdfdae75585d82bbbbcf987a718f39f073e97eb93174f24b6944fa429ebacb20.exe 82 PID 4304 wrote to memory of 5084 4304 fdfdae75585d82bbbbcf987a718f39f073e97eb93174f24b6944fa429ebacb20.exe 82 PID 4304 wrote to memory of 5084 4304 fdfdae75585d82bbbbcf987a718f39f073e97eb93174f24b6944fa429ebacb20.exe 82 PID 4304 wrote to memory of 5084 4304 fdfdae75585d82bbbbcf987a718f39f073e97eb93174f24b6944fa429ebacb20.exe 82 PID 5084 wrote to memory of 3820 5084 fdfdae75585d82bbbbcf987a718f39f073e97eb93174f24b6944fa429ebacb20.exe 84 PID 5084 wrote to memory of 3820 5084 fdfdae75585d82bbbbcf987a718f39f073e97eb93174f24b6944fa429ebacb20.exe 84 PID 5084 wrote to memory of 3820 5084 fdfdae75585d82bbbbcf987a718f39f073e97eb93174f24b6944fa429ebacb20.exe 84 PID 5084 wrote to memory of 3820 5084 fdfdae75585d82bbbbcf987a718f39f073e97eb93174f24b6944fa429ebacb20.exe 84 PID 5084 wrote to memory of 3820 5084 fdfdae75585d82bbbbcf987a718f39f073e97eb93174f24b6944fa429ebacb20.exe 84 PID 5084 wrote to memory of 3820 5084 fdfdae75585d82bbbbcf987a718f39f073e97eb93174f24b6944fa429ebacb20.exe 84 PID 5084 wrote to memory of 3820 5084 fdfdae75585d82bbbbcf987a718f39f073e97eb93174f24b6944fa429ebacb20.exe 84 PID 5084 wrote to memory of 3820 5084 fdfdae75585d82bbbbcf987a718f39f073e97eb93174f24b6944fa429ebacb20.exe 84 PID 3820 wrote to memory of 744 3820 fdfdae75585d82bbbbcf987a718f39f073e97eb93174f24b6944fa429ebacb20.exe 53 PID 3820 wrote to memory of 744 3820 fdfdae75585d82bbbbcf987a718f39f073e97eb93174f24b6944fa429ebacb20.exe 53 PID 3820 wrote to memory of 744 3820 fdfdae75585d82bbbbcf987a718f39f073e97eb93174f24b6944fa429ebacb20.exe 53 PID 3820 wrote to memory of 744 3820 fdfdae75585d82bbbbcf987a718f39f073e97eb93174f24b6944fa429ebacb20.exe 53 PID 3820 wrote to memory of 744 3820 fdfdae75585d82bbbbcf987a718f39f073e97eb93174f24b6944fa429ebacb20.exe 53 PID 3820 wrote to memory of 744 3820 fdfdae75585d82bbbbcf987a718f39f073e97eb93174f24b6944fa429ebacb20.exe 53 PID 3820 wrote to memory of 744 3820 fdfdae75585d82bbbbcf987a718f39f073e97eb93174f24b6944fa429ebacb20.exe 53 PID 3820 wrote to memory of 744 3820 fdfdae75585d82bbbbcf987a718f39f073e97eb93174f24b6944fa429ebacb20.exe 53 PID 3820 wrote to memory of 744 3820 fdfdae75585d82bbbbcf987a718f39f073e97eb93174f24b6944fa429ebacb20.exe 53 PID 3820 wrote to memory of 744 3820 fdfdae75585d82bbbbcf987a718f39f073e97eb93174f24b6944fa429ebacb20.exe 53 PID 3820 wrote to memory of 744 3820 fdfdae75585d82bbbbcf987a718f39f073e97eb93174f24b6944fa429ebacb20.exe 53 PID 3820 wrote to memory of 744 3820 fdfdae75585d82bbbbcf987a718f39f073e97eb93174f24b6944fa429ebacb20.exe 53 PID 3820 wrote to memory of 744 3820 fdfdae75585d82bbbbcf987a718f39f073e97eb93174f24b6944fa429ebacb20.exe 53 PID 3820 wrote to memory of 744 3820 fdfdae75585d82bbbbcf987a718f39f073e97eb93174f24b6944fa429ebacb20.exe 53 PID 3820 wrote to memory of 744 3820 fdfdae75585d82bbbbcf987a718f39f073e97eb93174f24b6944fa429ebacb20.exe 53 PID 3820 wrote to memory of 744 3820 fdfdae75585d82bbbbcf987a718f39f073e97eb93174f24b6944fa429ebacb20.exe 53 PID 3820 wrote to memory of 744 3820 fdfdae75585d82bbbbcf987a718f39f073e97eb93174f24b6944fa429ebacb20.exe 53 PID 3820 wrote to memory of 744 3820 fdfdae75585d82bbbbcf987a718f39f073e97eb93174f24b6944fa429ebacb20.exe 53 PID 3820 wrote to memory of 744 3820 fdfdae75585d82bbbbcf987a718f39f073e97eb93174f24b6944fa429ebacb20.exe 53 PID 3820 wrote to memory of 744 3820 fdfdae75585d82bbbbcf987a718f39f073e97eb93174f24b6944fa429ebacb20.exe 53 PID 3820 wrote to memory of 744 3820 fdfdae75585d82bbbbcf987a718f39f073e97eb93174f24b6944fa429ebacb20.exe 53 PID 3820 wrote to memory of 744 3820 fdfdae75585d82bbbbcf987a718f39f073e97eb93174f24b6944fa429ebacb20.exe 53 PID 3820 wrote to memory of 744 3820 fdfdae75585d82bbbbcf987a718f39f073e97eb93174f24b6944fa429ebacb20.exe 53 PID 3820 wrote to memory of 744 3820 fdfdae75585d82bbbbcf987a718f39f073e97eb93174f24b6944fa429ebacb20.exe 53 PID 3820 wrote to memory of 744 3820 fdfdae75585d82bbbbcf987a718f39f073e97eb93174f24b6944fa429ebacb20.exe 53 PID 3820 wrote to memory of 744 3820 fdfdae75585d82bbbbcf987a718f39f073e97eb93174f24b6944fa429ebacb20.exe 53 PID 3820 wrote to memory of 744 3820 fdfdae75585d82bbbbcf987a718f39f073e97eb93174f24b6944fa429ebacb20.exe 53 PID 3820 wrote to memory of 744 3820 fdfdae75585d82bbbbcf987a718f39f073e97eb93174f24b6944fa429ebacb20.exe 53 PID 3820 wrote to memory of 744 3820 fdfdae75585d82bbbbcf987a718f39f073e97eb93174f24b6944fa429ebacb20.exe 53 PID 3820 wrote to memory of 744 3820 fdfdae75585d82bbbbcf987a718f39f073e97eb93174f24b6944fa429ebacb20.exe 53 PID 3820 wrote to memory of 744 3820 fdfdae75585d82bbbbcf987a718f39f073e97eb93174f24b6944fa429ebacb20.exe 53 PID 3820 wrote to memory of 744 3820 fdfdae75585d82bbbbcf987a718f39f073e97eb93174f24b6944fa429ebacb20.exe 53 PID 3820 wrote to memory of 744 3820 fdfdae75585d82bbbbcf987a718f39f073e97eb93174f24b6944fa429ebacb20.exe 53 PID 3820 wrote to memory of 744 3820 fdfdae75585d82bbbbcf987a718f39f073e97eb93174f24b6944fa429ebacb20.exe 53 PID 3820 wrote to memory of 744 3820 fdfdae75585d82bbbbcf987a718f39f073e97eb93174f24b6944fa429ebacb20.exe 53 PID 3820 wrote to memory of 744 3820 fdfdae75585d82bbbbcf987a718f39f073e97eb93174f24b6944fa429ebacb20.exe 53 PID 3820 wrote to memory of 744 3820 fdfdae75585d82bbbbcf987a718f39f073e97eb93174f24b6944fa429ebacb20.exe 53 PID 3820 wrote to memory of 744 3820 fdfdae75585d82bbbbcf987a718f39f073e97eb93174f24b6944fa429ebacb20.exe 53 PID 3820 wrote to memory of 744 3820 fdfdae75585d82bbbbcf987a718f39f073e97eb93174f24b6944fa429ebacb20.exe 53 PID 3820 wrote to memory of 744 3820 fdfdae75585d82bbbbcf987a718f39f073e97eb93174f24b6944fa429ebacb20.exe 53 PID 3820 wrote to memory of 744 3820 fdfdae75585d82bbbbcf987a718f39f073e97eb93174f24b6944fa429ebacb20.exe 53 PID 3820 wrote to memory of 744 3820 fdfdae75585d82bbbbcf987a718f39f073e97eb93174f24b6944fa429ebacb20.exe 53 PID 3820 wrote to memory of 744 3820 fdfdae75585d82bbbbcf987a718f39f073e97eb93174f24b6944fa429ebacb20.exe 53 PID 3820 wrote to memory of 744 3820 fdfdae75585d82bbbbcf987a718f39f073e97eb93174f24b6944fa429ebacb20.exe 53 PID 3820 wrote to memory of 744 3820 fdfdae75585d82bbbbcf987a718f39f073e97eb93174f24b6944fa429ebacb20.exe 53 PID 3820 wrote to memory of 744 3820 fdfdae75585d82bbbbcf987a718f39f073e97eb93174f24b6944fa429ebacb20.exe 53 PID 3820 wrote to memory of 744 3820 fdfdae75585d82bbbbcf987a718f39f073e97eb93174f24b6944fa429ebacb20.exe 53 PID 3820 wrote to memory of 744 3820 fdfdae75585d82bbbbcf987a718f39f073e97eb93174f24b6944fa429ebacb20.exe 53
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:608
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"2⤵PID:776
-
-
C:\Windows\system32\dwm.exe"dwm.exe"2⤵PID:60
-
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe1⤵PID:668
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:768
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p1⤵PID:784
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}2⤵PID:3292
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca2⤵PID:3396
-
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca2⤵PID:3548
-
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding2⤵PID:3460
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}2⤵PID:4040
-
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding2⤵PID:3768
-
-
C:\Windows\system32\SppExtComObj.exeC:\Windows\system32\SppExtComObj.exe -Embedding2⤵PID:2864
-
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding2⤵PID:4764
-
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding2⤵PID:4968
-
-
C:\Windows\System32\mousocoreworker.exeC:\Windows\System32\mousocoreworker.exe -Embedding2⤵PID:1588
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RPCSS -p1⤵PID:884
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM1⤵PID:940
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc1⤵PID:424
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts1⤵PID:684
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService1⤵PID:904
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc1⤵PID:1008
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p1⤵PID:1072
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule1⤵PID:1096
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}2⤵PID:2972
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc1⤵PID:1176
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog1⤵PID:1224
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager1⤵PID:1316
-
C:\Windows\system32\sihost.exesihost.exe2⤵PID:2848
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc1⤵PID:1324
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s Themes1⤵PID:1344
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem1⤵PID:1352
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s nsi1⤵PID:1388
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s SENS1⤵PID:1532
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp1⤵PID:1540
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder1⤵PID:1604
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s FontCache1⤵PID:1612
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵PID:1720
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc1⤵PID:1736
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s netprofm1⤵PID:1800
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache1⤵PID:1912
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵PID:1920
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection1⤵PID:1952
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository1⤵PID:1968
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p1⤵PID:2080
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe1⤵PID:1744
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation1⤵PID:2100
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent1⤵PID:2312
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc1⤵PID:2372
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT1⤵PID:2320
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc1⤵PID:2220
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService1⤵PID:2404
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks1⤵PID:2416
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service1⤵PID:2504
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt1⤵PID:2424
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer1⤵PID:2536
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:744
-
C:\Users\Admin\AppData\Local\Temp\fdfdae75585d82bbbbcf987a718f39f073e97eb93174f24b6944fa429ebacb20.exe"C:\Users\Admin\AppData\Local\Temp\fdfdae75585d82bbbbcf987a718f39f073e97eb93174f24b6944fa429ebacb20.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4304 -
C:\Users\Admin\AppData\Local\Temp\fdfdae75585d82bbbbcf987a718f39f073e97eb93174f24b6944fa429ebacb20.exeC:\Users\Admin\AppData\Local\Temp\fdfdae75585d82bbbbcf987a718f39f073e97eb93174f24b6944fa429ebacb20.exe3⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5084 -
C:\Users\Admin\AppData\Local\Temp\fdfdae75585d82bbbbcf987a718f39f073e97eb93174f24b6944fa429ebacb20.exe"C:\Users\Admin\AppData\Local\Temp\fdfdae75585d82bbbbcf987a718f39f073e97eb93174f24b6944fa429ebacb20.exe"4⤵
- Adds policy Run key to start application
- Modifies Installed Components in the registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3820 -
C:\Windows\SysWOW64\explorer.exeexplorer.exe5⤵
- Modifies Installed Components in the registry
PID:532
-
-
C:\Users\Admin\AppData\Local\Temp\fdfdae75585d82bbbbcf987a718f39f073e97eb93174f24b6944fa429ebacb20.exe"C:\Users\Admin\AppData\Local\Temp\fdfdae75585d82bbbbcf987a718f39f073e97eb93174f24b6944fa429ebacb20.exe"5⤵
- Checks computer location settings
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:4284 -
C:\Windows\SysWOW64\windows.exe"C:\Windows\system32\windows.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:4632 -
C:\Windows\SysWOW64\windows.exeC:\Windows\SysWOW64\windows.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:2184 -
C:\Windows\SysWOW64\windows.exe"C:\Windows\SysWOW64\windows.exe"8⤵
- Executes dropped EXE
PID:1864 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1864 -s 5329⤵
- Drops file in Windows directory
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:696 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 696 -s 73610⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:2692
-
-
-
-
-
-
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3088
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2868
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc1⤵PID:4528
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc1⤵PID:2564
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager1⤵PID:2360
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc1⤵PID:1932
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k WerSvcGroup1⤵PID:4908
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1864 -ip 18642⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:1548
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 696 -ip 6962⤵PID:4600
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p1⤵PID:1144
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -s W32Time1⤵PID:1376
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc1⤵PID:3204
-
C:\Windows\System32\WaaSMedicAgent.exeC:\Windows\System32\WaaSMedicAgent.exe f19d62b5a36231241c1c4e3b22bb86ee +ZFk8aUBaEmvvxBGdDcldg.0.1.0.0.01⤵PID:3084
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV12⤵PID:4216
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵PID:4088
-
C:\Windows\servicing\TrustedInstaller.exeC:\Windows\servicing\TrustedInstaller.exe1⤵PID:4340
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc1⤵PID:4536
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
240KB
MD5e15681871d6bad44e9d8f4843aabbaa3
SHA131f1053ad543a6b9aee211cb7b4df3f5a92e1eed
SHA2568e7ad464f483cb1af3746c3f1208c04fb9d0e0c15f576225de9fda995bd03c21
SHA512c4fb8452a8aaff8ecbf8f7d7f5a07231f95744f2d102257ce8374a550a62e841906d0fd278407bb6e6fcea0b1c62e3ce135df1d0194be68e0a18cf34d88429fc
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2629973501-4017243118-3254762364-1000\699c4b9cdebca7aaea5193cae8a50098_e32e1c79-b88e-4709-94fb-81034ca3398e
Filesize50B
MD55b63d4dd8c04c88c0e30e494ec6a609a
SHA1884d5a8bdc25fe794dc22ef9518009dcf0069d09
SHA2564d93c22555b3169e5c13716ca59b8b22892c69b3025aea841afe5259698102fd
SHA51215ff8551ac6b9de978050569bcdc26f44dfc06a0eaf445ac70fd45453a21bdafa3e4c8b4857d6a1c3226f4102a639682bdfb71d7b255062fb81a51c9126896cb
-
Filesize
335KB
MD590bd2d5f5c1236396bd700aa7722a791
SHA116e5ac0209b9bf3ccca6ac1a025efde0c99912c7
SHA256fdfdae75585d82bbbbcf987a718f39f073e97eb93174f24b6944fa429ebacb20
SHA5123d7d15dc27b68c5d1c311ece6cf00dc91a5748d7b71a058132bc8d49c7592f084500aa4e8e41a8db1f644cebf2b99779ab7dc369beb4bc92d20f500e7ec3f043
-
Filesize
335KB
MD590bd2d5f5c1236396bd700aa7722a791
SHA116e5ac0209b9bf3ccca6ac1a025efde0c99912c7
SHA256fdfdae75585d82bbbbcf987a718f39f073e97eb93174f24b6944fa429ebacb20
SHA5123d7d15dc27b68c5d1c311ece6cf00dc91a5748d7b71a058132bc8d49c7592f084500aa4e8e41a8db1f644cebf2b99779ab7dc369beb4bc92d20f500e7ec3f043
-
Filesize
335KB
MD590bd2d5f5c1236396bd700aa7722a791
SHA116e5ac0209b9bf3ccca6ac1a025efde0c99912c7
SHA256fdfdae75585d82bbbbcf987a718f39f073e97eb93174f24b6944fa429ebacb20
SHA5123d7d15dc27b68c5d1c311ece6cf00dc91a5748d7b71a058132bc8d49c7592f084500aa4e8e41a8db1f644cebf2b99779ab7dc369beb4bc92d20f500e7ec3f043
-
Filesize
335KB
MD590bd2d5f5c1236396bd700aa7722a791
SHA116e5ac0209b9bf3ccca6ac1a025efde0c99912c7
SHA256fdfdae75585d82bbbbcf987a718f39f073e97eb93174f24b6944fa429ebacb20
SHA5123d7d15dc27b68c5d1c311ece6cf00dc91a5748d7b71a058132bc8d49c7592f084500aa4e8e41a8db1f644cebf2b99779ab7dc369beb4bc92d20f500e7ec3f043