Analysis
-
max time kernel
152s -
max time network
105s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
06/11/2022, 10:09
Static task
static1
Behavioral task
behavioral1
Sample
64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe
Resource
win7-20220812-en
General
-
Target
64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe
-
Size
628KB
-
MD5
2cfca1fa8763be6eed11e47401fabd49
-
SHA1
bfe916c8dadfcf4c7025c03648ea6ef63e6952c1
-
SHA256
64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593
-
SHA512
bd871365213d210d01eaa149be300539cc338a0dc3ef7cd4dd877e9186f6377e945bfe2b03191a99fa41d94c5688220e9db8e04ae8f129428d592eb3b7d8e595
-
SSDEEP
12288:iXeVQkTrvj4xdoJ/Up9zCU2LnOjvTcUsEXxoMo1Exan+KMrrRwOm6:iaQkTf4zoGaCrcU5Xlo7ERJm6
Malware Config
Extracted
cybergate
2.6
victim
noorhackers.no-ip.org:1604
***MUTEX***
-
enable_keylogger
true
-
enable_message_box
false
-
ftp_directory
./logs/
-
ftp_interval
30
-
injected_process
svchost.exe
-
install_dir
yahoo
-
install_file
windows.exe
-
install_flag
true
-
keylogger_enable_ftp
false
-
message_box_caption
texto da mensagem
-
message_box_title
t?tulo da mensagem
-
password
123321
-
regkey_hkcu
HKCU
-
regkey_hklm
HKLM
Signatures
-
Adds policy Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run 64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\yahoo\\windows.exe" 64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run 64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\yahoo\\windows.exe" 64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe -
Executes dropped EXE 2 IoCs
pid Process 840 windows.exe 1500 windows.exe -
Modifies Installed Components in the registry 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{K1C68Y58-S3Y6-6SHU-334U-SEIULY86LMJD} 64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{K1C68Y58-S3Y6-6SHU-334U-SEIULY86LMJD}\StubPath = "C:\\Windows\\yahoo\\windows.exe Restart" 64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{K1C68Y58-S3Y6-6SHU-334U-SEIULY86LMJD} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{K1C68Y58-S3Y6-6SHU-334U-SEIULY86LMJD}\StubPath = "C:\\Windows\\yahoo\\windows.exe" explorer.exe -
resource yara_rule behavioral1/memory/1356-63-0x0000000000400000-0x0000000000459000-memory.dmp upx behavioral1/memory/1356-62-0x0000000000400000-0x0000000000459000-memory.dmp upx behavioral1/memory/1356-60-0x0000000000400000-0x0000000000459000-memory.dmp upx behavioral1/memory/1356-68-0x0000000000400000-0x0000000000459000-memory.dmp upx behavioral1/memory/1356-69-0x0000000000400000-0x0000000000459000-memory.dmp upx behavioral1/memory/1356-70-0x0000000000400000-0x0000000000459000-memory.dmp upx behavioral1/memory/1356-72-0x0000000024010000-0x0000000024072000-memory.dmp upx behavioral1/memory/1356-80-0x0000000000400000-0x0000000000459000-memory.dmp upx behavioral1/memory/1356-82-0x0000000024080000-0x00000000240E2000-memory.dmp upx behavioral1/memory/1760-87-0x0000000024080000-0x00000000240E2000-memory.dmp upx behavioral1/memory/1760-90-0x0000000024080000-0x00000000240E2000-memory.dmp upx behavioral1/memory/1356-92-0x00000000240F0000-0x0000000024152000-memory.dmp upx behavioral1/memory/1356-98-0x0000000024160000-0x00000000241C2000-memory.dmp upx behavioral1/memory/1324-103-0x0000000024160000-0x00000000241C2000-memory.dmp upx behavioral1/memory/1356-104-0x0000000000400000-0x0000000000459000-memory.dmp upx behavioral1/memory/1324-110-0x0000000024160000-0x00000000241C2000-memory.dmp upx behavioral1/memory/1500-170-0x0000000000400000-0x0000000000459000-memory.dmp upx behavioral1/memory/1500-174-0x0000000000400000-0x0000000000459000-memory.dmp upx behavioral1/memory/1760-175-0x00000000318E0000-0x00000000318ED000-memory.dmp upx behavioral1/memory/1500-176-0x0000000031900000-0x000000003190D000-memory.dmp upx behavioral1/memory/1500-177-0x0000000000400000-0x0000000000459000-memory.dmp upx behavioral1/memory/1500-178-0x0000000031900000-0x000000003190D000-memory.dmp upx behavioral1/memory/1324-179-0x0000000024160000-0x00000000241C2000-memory.dmp upx behavioral1/memory/1760-180-0x00000000318E0000-0x00000000318ED000-memory.dmp upx -
Loads dropped DLL 2 IoCs
pid Process 1324 64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe 1324 64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\yahoo\\windows.exe" 64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run 64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\yahoo\\windows.exe" 64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run 64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 1124 set thread context of 1356 1124 64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe 27 PID 840 set thread context of 1500 840 windows.exe 32 -
Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\yahoo\windows.exe 64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe File opened for modification C:\Windows\yahoo\windows.exe 64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe File opened for modification C:\Windows\yahoo\ 64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe File created C:\Windows\yahoo\windows.exe 64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1356 64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe 1324 64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe 1324 64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe 1500 windows.exe 1324 64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe 1324 64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe 1324 64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe 1324 64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe 1324 64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe 1324 64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe 1324 64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe 1324 64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe 1324 64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe 1324 64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe 1324 64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe 1324 64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe 1324 64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe 1324 64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe 1324 64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe 1324 64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe 1324 64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe 1324 64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe 1324 64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe 1324 64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe 1324 64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe 1324 64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe 1324 64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe 1324 64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe 1324 64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe 1324 64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe 1324 64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe 1324 64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe 1324 64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe 1324 64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe 1324 64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe 1324 64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe 1324 64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe 1324 64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe 1324 64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe 1324 64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe 1324 64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe 1324 64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe 1324 64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe 1324 64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe 1324 64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe 1324 64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe 1324 64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe 1324 64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe 1324 64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe 1324 64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe 1324 64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe 1324 64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe 1324 64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe 1324 64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe 1324 64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe 1324 64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe 1324 64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe 1324 64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe 1324 64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe 1324 64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe 1324 64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe 1324 64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe 1324 64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe 1324 64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1324 64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 1124 64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe Token: SeDebugPrivilege 1324 64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe Token: SeDebugPrivilege 1324 64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe Token: SeDebugPrivilege 840 windows.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1356 64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1124 wrote to memory of 1356 1124 64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe 27 PID 1124 wrote to memory of 1356 1124 64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe 27 PID 1124 wrote to memory of 1356 1124 64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe 27 PID 1124 wrote to memory of 1356 1124 64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe 27 PID 1124 wrote to memory of 1356 1124 64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe 27 PID 1124 wrote to memory of 1356 1124 64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe 27 PID 1124 wrote to memory of 1356 1124 64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe 27 PID 1124 wrote to memory of 1356 1124 64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe 27 PID 1356 wrote to memory of 1384 1356 64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe 14 PID 1356 wrote to memory of 1384 1356 64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe 14 PID 1356 wrote to memory of 1384 1356 64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe 14 PID 1356 wrote to memory of 1384 1356 64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe 14 PID 1356 wrote to memory of 1384 1356 64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe 14 PID 1356 wrote to memory of 1384 1356 64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe 14 PID 1356 wrote to memory of 1384 1356 64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe 14 PID 1356 wrote to memory of 1384 1356 64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe 14 PID 1356 wrote to memory of 1384 1356 64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe 14 PID 1356 wrote to memory of 1384 1356 64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe 14 PID 1356 wrote to memory of 1384 1356 64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe 14 PID 1356 wrote to memory of 1384 1356 64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe 14 PID 1356 wrote to memory of 1384 1356 64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe 14 PID 1356 wrote to memory of 1384 1356 64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe 14 PID 1356 wrote to memory of 1384 1356 64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe 14 PID 1356 wrote to memory of 1384 1356 64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe 14 PID 1356 wrote to memory of 1384 1356 64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe 14 PID 1356 wrote to memory of 1384 1356 64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe 14 PID 1356 wrote to memory of 1384 1356 64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe 14 PID 1356 wrote to memory of 1384 1356 64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe 14 PID 1356 wrote to memory of 1384 1356 64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe 14 PID 1356 wrote to memory of 1384 1356 64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe 14 PID 1356 wrote to memory of 1384 1356 64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe 14 PID 1356 wrote to memory of 1384 1356 64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe 14 PID 1356 wrote to memory of 1384 1356 64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe 14 PID 1356 wrote to memory of 1384 1356 64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe 14 PID 1356 wrote to memory of 1384 1356 64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe 14 PID 1356 wrote to memory of 1384 1356 64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe 14 PID 1356 wrote to memory of 1384 1356 64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe 14 PID 1356 wrote to memory of 1384 1356 64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe 14 PID 1356 wrote to memory of 1384 1356 64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe 14 PID 1356 wrote to memory of 1384 1356 64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe 14 PID 1356 wrote to memory of 1384 1356 64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe 14 PID 1356 wrote to memory of 1384 1356 64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe 14 PID 1356 wrote to memory of 1384 1356 64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe 14 PID 1356 wrote to memory of 1384 1356 64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe 14 PID 1356 wrote to memory of 1384 1356 64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe 14 PID 1356 wrote to memory of 1384 1356 64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe 14 PID 1356 wrote to memory of 1384 1356 64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe 14 PID 1356 wrote to memory of 1384 1356 64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe 14 PID 1356 wrote to memory of 1384 1356 64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe 14 PID 1356 wrote to memory of 1384 1356 64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe 14 PID 1356 wrote to memory of 1384 1356 64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe 14 PID 1356 wrote to memory of 1384 1356 64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe 14 PID 1356 wrote to memory of 1384 1356 64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe 14 PID 1356 wrote to memory of 1384 1356 64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe 14 PID 1356 wrote to memory of 1384 1356 64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe 14 PID 1356 wrote to memory of 1384 1356 64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe 14 PID 1356 wrote to memory of 1384 1356 64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe 14 PID 1356 wrote to memory of 1384 1356 64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe 14 PID 1356 wrote to memory of 1384 1356 64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe 14 PID 1356 wrote to memory of 1384 1356 64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe 14 PID 1356 wrote to memory of 1384 1356 64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe 14 PID 1356 wrote to memory of 1384 1356 64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe 14 PID 1356 wrote to memory of 1384 1356 64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe 14 PID 1356 wrote to memory of 1384 1356 64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe 14
Processes
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe1⤵PID:476
-
C:\Windows\system32\services.exeC:\Windows\system32\services.exe1⤵PID:468
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService2⤵PID:328
-
-
C:\Windows\system32\sppsvc.exeC:\Windows\system32\sppsvc.exe2⤵PID:960
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation2⤵PID:800
-
-
C:\Windows\system32\taskhost.exe"taskhost.exe"2⤵PID:1256
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork2⤵PID:1040
-
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe2⤵PID:308
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs2⤵PID:876
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService2⤵PID:852
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted2⤵PID:804
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted2⤵PID:740
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RPCSS2⤵PID:676
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch2⤵PID:592
-
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:420
-
C:\Windows\system32\wininit.exewininit.exe1⤵PID:380
-
C:\Windows\system32\lsm.exeC:\Windows\system32\lsm.exe2⤵PID:484
-
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵PID:372
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵PID:336
-
C:\Windows\System32\smss.exe\SystemRoot\System32\smss.exe1⤵PID:260
-
\\?\C:\Windows\system32\wbem\WMIADAP.EXEwmiadap.exe /F /T /R1⤵PID:1928
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1384
-
C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe"C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1124 -
C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exeC:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe3⤵
- Adds policy Run key to start application
- Modifies Installed Components in the registry
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1356 -
C:\Windows\SysWOW64\explorer.exeexplorer.exe4⤵
- Modifies Installed Components in the registry
PID:1760
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"4⤵PID:1172
-
-
C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe"C:\Users\Admin\AppData\Local\Temp\64864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593.exe"4⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:1324 -
C:\Windows\yahoo\windows.exe"C:\Windows\yahoo\windows.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:840 -
C:\Windows\yahoo\windows.exeC:\Windows\yahoo\windows.exe6⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1500
-
-
-
-
-
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1340
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
240KB
MD5b9809d5a8cbd073f66859efd9a588518
SHA156105be88fdbf616c53b4e4a9fd9771f98757b11
SHA256dba9023e3d048216d62ef108a0fd0c70fa09ff24c2cf2095f46be26aab29ea51
SHA512ade3989acc305cf22668d13bdd68c3d711bafd700269f980a9d8be81485c5875c880a7cf9630bd0b4a8c20cedb43ce87731beb97061b0e3b1ac4bfed0a074f1c
-
Filesize
628KB
MD52cfca1fa8763be6eed11e47401fabd49
SHA1bfe916c8dadfcf4c7025c03648ea6ef63e6952c1
SHA25664864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593
SHA512bd871365213d210d01eaa149be300539cc338a0dc3ef7cd4dd877e9186f6377e945bfe2b03191a99fa41d94c5688220e9db8e04ae8f129428d592eb3b7d8e595
-
Filesize
628KB
MD52cfca1fa8763be6eed11e47401fabd49
SHA1bfe916c8dadfcf4c7025c03648ea6ef63e6952c1
SHA25664864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593
SHA512bd871365213d210d01eaa149be300539cc338a0dc3ef7cd4dd877e9186f6377e945bfe2b03191a99fa41d94c5688220e9db8e04ae8f129428d592eb3b7d8e595
-
Filesize
628KB
MD52cfca1fa8763be6eed11e47401fabd49
SHA1bfe916c8dadfcf4c7025c03648ea6ef63e6952c1
SHA25664864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593
SHA512bd871365213d210d01eaa149be300539cc338a0dc3ef7cd4dd877e9186f6377e945bfe2b03191a99fa41d94c5688220e9db8e04ae8f129428d592eb3b7d8e595
-
Filesize
628KB
MD52cfca1fa8763be6eed11e47401fabd49
SHA1bfe916c8dadfcf4c7025c03648ea6ef63e6952c1
SHA25664864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593
SHA512bd871365213d210d01eaa149be300539cc338a0dc3ef7cd4dd877e9186f6377e945bfe2b03191a99fa41d94c5688220e9db8e04ae8f129428d592eb3b7d8e595
-
Filesize
628KB
MD52cfca1fa8763be6eed11e47401fabd49
SHA1bfe916c8dadfcf4c7025c03648ea6ef63e6952c1
SHA25664864c7007f2626994398cd1edd78912e43c554459b094fa25e4c2a7c6ef9593
SHA512bd871365213d210d01eaa149be300539cc338a0dc3ef7cd4dd877e9186f6377e945bfe2b03191a99fa41d94c5688220e9db8e04ae8f129428d592eb3b7d8e595