cybergate | 8321d3df1ed66163ec6c1a0cf396bc99c55dd6d1aca0f0b7d7bb7ada496e54d3

General

Target

8321d3df1ed66163ec6c1a0cf396bc99c55dd6d1aca0f0b7d7bb7ada496e54d3.exe
Size

465KB
MD5

19a054a7038d9b9d600bf4397d8e5b24
SHA1

b4180459f90e7ca1b31ec14ca04465dddd3705f0
SHA256

8321d3df1ed66163ec6c1a0cf396bc99c55dd6d1aca0f0b7d7bb7ada496e54d3
SHA512

707ecfc452aec931c532c27930edc2ab3414ca2c1438a562a191a3d4c3fb0f656815c2ac6524f7f3605d3a40ffa8d0e0fa4a99f4fb27de073d7daba98c1f198e
SSDEEP

12288:Ye3vle69xA1t4j3wq3Lab2OKy3gKXCJ0O:fI69Ut+fjOKj/B

Score

10^/10

cybergate victime persistence stealer trojan upx

Malware Config

Extracted

Family

cybergate

Version

2.6

Botnet

VicTime

C2

spy-klagord.sytes.net:288

klagord.no-ip.org:288

kabooos.sytes.net:288

Mutex

***MUTEX***

Attributes

enable_keylogger
true
enable_message_box
false
ftp_directory
./logs/
ftp_interval
30
injected_process
explorer.exe
install_dir
install
install_file
Now sex video clip.real.exe
install_flag
true
keylogger_enable_ftp
false
message_box_caption
texto da mensagem
message_box_title
título da mensagem
password
abcd1234
regkey_hkcu
HKCU
regkey_hklm
HKLM

Signatures

CyberGate, Rebhip
CyberGate is a lightweight remote administration tool with a wide array of functionalities.
trojan stealer cybergate
Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

Processes:

WerFault.exe

description pid process target process

PID 4952 created 3796 4952 WerFault.exe Now sex video clip.real.exe

description	pid	process	target process
PID 4952 created 3796	4952	WerFault.exe	Now sex video clip.real.exe

Molebox Virtualization software 2 IoCs

Detects file using Molebox Virtualization software.

Processes:

resource	yara_rule
C:\Program Files (x86)\install\Now sex video clip.real.exe	molebox
C:\Program Files (x86)\install\Now sex video clip.real.exe	molebox

Adds policy Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

8321d3df1ed66163ec6c1a0cf396bc99c55dd6d1aca0f0b7d7bb7ada496e54d3.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Program Files (x86)\\install\\Now sex video clip.real.exe"	8321d3df1ed66163ec6c1a0cf396bc99c55dd6d1aca0f0b7d7bb7ada496e54d3.exe
Key created	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	8321d3df1ed66163ec6c1a0cf396bc99c55dd6d1aca0f0b7d7bb7ada496e54d3.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Program Files (x86)\\install\\Now sex video clip.real.exe"	8321d3df1ed66163ec6c1a0cf396bc99c55dd6d1aca0f0b7d7bb7ada496e54d3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	8321d3df1ed66163ec6c1a0cf396bc99c55dd6d1aca0f0b7d7bb7ada496e54d3.exe

Executes dropped EXE 1 IoCs

Processes:

Now sex video clip.real.exe

pid process

3796 Now sex video clip.real.exe

pid	process
3796	Now sex video clip.real.exe

UPX packed file 20 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/1368-136-0x0000000024010000-0x0000000024072000-memory.dmp	upx
behavioral2/memory/1368-141-0x0000000024080000-0x00000000240E2000-memory.dmp	upx
behavioral2/memory/1440-144-0x0000000024080000-0x00000000240E2000-memory.dmp	upx
behavioral2/memory/1440-147-0x0000000024080000-0x00000000240E2000-memory.dmp	upx
behavioral2/memory/1368-149-0x00000000240F0000-0x0000000024152000-memory.dmp	upx
behavioral2/memory/1368-154-0x0000000024160000-0x00000000241C2000-memory.dmp	upx
behavioral2/memory/4980-157-0x0000000024160000-0x00000000241C2000-memory.dmp	upx
behavioral2/memory/4980-160-0x0000000024160000-0x00000000241C2000-memory.dmp	upx
behavioral2/memory/1440-161-0x0000000031BC0000-0x0000000031BCD000-memory.dmp	upx
behavioral2/memory/3796-164-0x0000000031BE0000-0x0000000031BED000-memory.dmp	upx
behavioral2/memory/4952-166-0x0000000031BF0000-0x0000000031BFD000-memory.dmp	upx
behavioral2/memory/4952-167-0x0000000031BF0000-0x0000000031BFD000-memory.dmp	upx
behavioral2/memory/5084-168-0x0000000031C10000-0x0000000031C1D000-memory.dmp	upx
behavioral2/memory/3796-170-0x0000000031BE0000-0x0000000031BED000-memory.dmp	upx
behavioral2/memory/5084-172-0x0000000031C10000-0x0000000031C1D000-memory.dmp	upx
behavioral2/memory/4980-173-0x0000000024160000-0x00000000241C2000-memory.dmp	upx
behavioral2/memory/1440-174-0x0000000031BC0000-0x0000000031BCD000-memory.dmp	upx
behavioral2/memory/5084-175-0x0000000031C10000-0x0000000031C1D000-memory.dmp	upx
behavioral2/memory/5084-176-0x0000000031C10000-0x0000000031C1D000-memory.dmp	upx
behavioral2/memory/3796-177-0x0000000031BE0000-0x0000000031BED000-memory.dmp	upx

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

8321d3df1ed66163ec6c1a0cf396bc99c55dd6d1aca0f0b7d7bb7ada496e54d3.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\Control Panel\International\Geo\Nation	8321d3df1ed66163ec6c1a0cf396bc99c55dd6d1aca0f0b7d7bb7ada496e54d3.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

8321d3df1ed66163ec6c1a0cf396bc99c55dd6d1aca0f0b7d7bb7ada496e54d3.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\Software\Microsoft\Windows\CurrentVersion\Run	8321d3df1ed66163ec6c1a0cf396bc99c55dd6d1aca0f0b7d7bb7ada496e54d3.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Program Files (x86)\\install\\Now sex video clip.real.exe"	8321d3df1ed66163ec6c1a0cf396bc99c55dd6d1aca0f0b7d7bb7ada496e54d3.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	8321d3df1ed66163ec6c1a0cf396bc99c55dd6d1aca0f0b7d7bb7ada496e54d3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Program Files (x86)\\install\\Now sex video clip.real.exe"	8321d3df1ed66163ec6c1a0cf396bc99c55dd6d1aca0f0b7d7bb7ada496e54d3.exe

Drops file in Program Files directory 4 IoCs

Processes:

8321d3df1ed66163ec6c1a0cf396bc99c55dd6d1aca0f0b7d7bb7ada496e54d3.exe8321d3df1ed66163ec6c1a0cf396bc99c55dd6d1aca0f0b7d7bb7ada496e54d3.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\install\Now sex video clip.real.exe	8321d3df1ed66163ec6c1a0cf396bc99c55dd6d1aca0f0b7d7bb7ada496e54d3.exe
File opened for modification	C:\Program Files (x86)\install\	8321d3df1ed66163ec6c1a0cf396bc99c55dd6d1aca0f0b7d7bb7ada496e54d3.exe
File created	C:\Program Files (x86)\install\Now sex video clip.real.exe	8321d3df1ed66163ec6c1a0cf396bc99c55dd6d1aca0f0b7d7bb7ada496e54d3.exe
File opened for modification	C:\Program Files (x86)\install\Now sex video clip.real.exe	8321d3df1ed66163ec6c1a0cf396bc99c55dd6d1aca0f0b7d7bb7ada496e54d3.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

5084 3796 WerFault.exe Now sex video clip.real.exe

pid	pid_target	process	target process
5084	3796	WerFault.exe	Now sex video clip.real.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

WerFault.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

WerFault.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe

Modifies registry class 1 IoCs

Processes:

8321d3df1ed66163ec6c1a0cf396bc99c55dd6d1aca0f0b7d7bb7ada496e54d3.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	8321d3df1ed66163ec6c1a0cf396bc99c55dd6d1aca0f0b7d7bb7ada496e54d3.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

8321d3df1ed66163ec6c1a0cf396bc99c55dd6d1aca0f0b7d7bb7ada496e54d3.exe8321d3df1ed66163ec6c1a0cf396bc99c55dd6d1aca0f0b7d7bb7ada496e54d3.exe

pid	process
1368	8321d3df1ed66163ec6c1a0cf396bc99c55dd6d1aca0f0b7d7bb7ada496e54d3.exe
1368	8321d3df1ed66163ec6c1a0cf396bc99c55dd6d1aca0f0b7d7bb7ada496e54d3.exe
4980	8321d3df1ed66163ec6c1a0cf396bc99c55dd6d1aca0f0b7d7bb7ada496e54d3.exe
4980	8321d3df1ed66163ec6c1a0cf396bc99c55dd6d1aca0f0b7d7bb7ada496e54d3.exe
4980	8321d3df1ed66163ec6c1a0cf396bc99c55dd6d1aca0f0b7d7bb7ada496e54d3.exe
4980	8321d3df1ed66163ec6c1a0cf396bc99c55dd6d1aca0f0b7d7bb7ada496e54d3.exe
4980	8321d3df1ed66163ec6c1a0cf396bc99c55dd6d1aca0f0b7d7bb7ada496e54d3.exe
4980	8321d3df1ed66163ec6c1a0cf396bc99c55dd6d1aca0f0b7d7bb7ada496e54d3.exe
4980	8321d3df1ed66163ec6c1a0cf396bc99c55dd6d1aca0f0b7d7bb7ada496e54d3.exe
4980	8321d3df1ed66163ec6c1a0cf396bc99c55dd6d1aca0f0b7d7bb7ada496e54d3.exe
4980	8321d3df1ed66163ec6c1a0cf396bc99c55dd6d1aca0f0b7d7bb7ada496e54d3.exe
4980	8321d3df1ed66163ec6c1a0cf396bc99c55dd6d1aca0f0b7d7bb7ada496e54d3.exe
4980	8321d3df1ed66163ec6c1a0cf396bc99c55dd6d1aca0f0b7d7bb7ada496e54d3.exe
4980	8321d3df1ed66163ec6c1a0cf396bc99c55dd6d1aca0f0b7d7bb7ada496e54d3.exe
4980	8321d3df1ed66163ec6c1a0cf396bc99c55dd6d1aca0f0b7d7bb7ada496e54d3.exe
4980	8321d3df1ed66163ec6c1a0cf396bc99c55dd6d1aca0f0b7d7bb7ada496e54d3.exe
4980	8321d3df1ed66163ec6c1a0cf396bc99c55dd6d1aca0f0b7d7bb7ada496e54d3.exe
4980	8321d3df1ed66163ec6c1a0cf396bc99c55dd6d1aca0f0b7d7bb7ada496e54d3.exe
4980	8321d3df1ed66163ec6c1a0cf396bc99c55dd6d1aca0f0b7d7bb7ada496e54d3.exe
4980	8321d3df1ed66163ec6c1a0cf396bc99c55dd6d1aca0f0b7d7bb7ada496e54d3.exe
4980	8321d3df1ed66163ec6c1a0cf396bc99c55dd6d1aca0f0b7d7bb7ada496e54d3.exe
4980	8321d3df1ed66163ec6c1a0cf396bc99c55dd6d1aca0f0b7d7bb7ada496e54d3.exe
4980	8321d3df1ed66163ec6c1a0cf396bc99c55dd6d1aca0f0b7d7bb7ada496e54d3.exe
4980	8321d3df1ed66163ec6c1a0cf396bc99c55dd6d1aca0f0b7d7bb7ada496e54d3.exe
4980	8321d3df1ed66163ec6c1a0cf396bc99c55dd6d1aca0f0b7d7bb7ada496e54d3.exe
4980	8321d3df1ed66163ec6c1a0cf396bc99c55dd6d1aca0f0b7d7bb7ada496e54d3.exe
4980	8321d3df1ed66163ec6c1a0cf396bc99c55dd6d1aca0f0b7d7bb7ada496e54d3.exe
4980	8321d3df1ed66163ec6c1a0cf396bc99c55dd6d1aca0f0b7d7bb7ada496e54d3.exe
4980	8321d3df1ed66163ec6c1a0cf396bc99c55dd6d1aca0f0b7d7bb7ada496e54d3.exe
4980	8321d3df1ed66163ec6c1a0cf396bc99c55dd6d1aca0f0b7d7bb7ada496e54d3.exe
4980	8321d3df1ed66163ec6c1a0cf396bc99c55dd6d1aca0f0b7d7bb7ada496e54d3.exe
4980	8321d3df1ed66163ec6c1a0cf396bc99c55dd6d1aca0f0b7d7bb7ada496e54d3.exe
4980	8321d3df1ed66163ec6c1a0cf396bc99c55dd6d1aca0f0b7d7bb7ada496e54d3.exe
4980	8321d3df1ed66163ec6c1a0cf396bc99c55dd6d1aca0f0b7d7bb7ada496e54d3.exe
4980	8321d3df1ed66163ec6c1a0cf396bc99c55dd6d1aca0f0b7d7bb7ada496e54d3.exe
4980	8321d3df1ed66163ec6c1a0cf396bc99c55dd6d1aca0f0b7d7bb7ada496e54d3.exe
4980	8321d3df1ed66163ec6c1a0cf396bc99c55dd6d1aca0f0b7d7bb7ada496e54d3.exe
4980	8321d3df1ed66163ec6c1a0cf396bc99c55dd6d1aca0f0b7d7bb7ada496e54d3.exe
4980	8321d3df1ed66163ec6c1a0cf396bc99c55dd6d1aca0f0b7d7bb7ada496e54d3.exe
4980	8321d3df1ed66163ec6c1a0cf396bc99c55dd6d1aca0f0b7d7bb7ada496e54d3.exe
4980	8321d3df1ed66163ec6c1a0cf396bc99c55dd6d1aca0f0b7d7bb7ada496e54d3.exe
4980	8321d3df1ed66163ec6c1a0cf396bc99c55dd6d1aca0f0b7d7bb7ada496e54d3.exe
4980	8321d3df1ed66163ec6c1a0cf396bc99c55dd6d1aca0f0b7d7bb7ada496e54d3.exe
4980	8321d3df1ed66163ec6c1a0cf396bc99c55dd6d1aca0f0b7d7bb7ada496e54d3.exe
4980	8321d3df1ed66163ec6c1a0cf396bc99c55dd6d1aca0f0b7d7bb7ada496e54d3.exe
4980	8321d3df1ed66163ec6c1a0cf396bc99c55dd6d1aca0f0b7d7bb7ada496e54d3.exe
4980	8321d3df1ed66163ec6c1a0cf396bc99c55dd6d1aca0f0b7d7bb7ada496e54d3.exe
4980	8321d3df1ed66163ec6c1a0cf396bc99c55dd6d1aca0f0b7d7bb7ada496e54d3.exe
4980	8321d3df1ed66163ec6c1a0cf396bc99c55dd6d1aca0f0b7d7bb7ada496e54d3.exe
4980	8321d3df1ed66163ec6c1a0cf396bc99c55dd6d1aca0f0b7d7bb7ada496e54d3.exe
4980	8321d3df1ed66163ec6c1a0cf396bc99c55dd6d1aca0f0b7d7bb7ada496e54d3.exe
4980	8321d3df1ed66163ec6c1a0cf396bc99c55dd6d1aca0f0b7d7bb7ada496e54d3.exe
4980	8321d3df1ed66163ec6c1a0cf396bc99c55dd6d1aca0f0b7d7bb7ada496e54d3.exe
4980	8321d3df1ed66163ec6c1a0cf396bc99c55dd6d1aca0f0b7d7bb7ada496e54d3.exe
4980	8321d3df1ed66163ec6c1a0cf396bc99c55dd6d1aca0f0b7d7bb7ada496e54d3.exe
4980	8321d3df1ed66163ec6c1a0cf396bc99c55dd6d1aca0f0b7d7bb7ada496e54d3.exe
4980	8321d3df1ed66163ec6c1a0cf396bc99c55dd6d1aca0f0b7d7bb7ada496e54d3.exe
4980	8321d3df1ed66163ec6c1a0cf396bc99c55dd6d1aca0f0b7d7bb7ada496e54d3.exe
4980	8321d3df1ed66163ec6c1a0cf396bc99c55dd6d1aca0f0b7d7bb7ada496e54d3.exe
4980	8321d3df1ed66163ec6c1a0cf396bc99c55dd6d1aca0f0b7d7bb7ada496e54d3.exe
4980	8321d3df1ed66163ec6c1a0cf396bc99c55dd6d1aca0f0b7d7bb7ada496e54d3.exe
4980	8321d3df1ed66163ec6c1a0cf396bc99c55dd6d1aca0f0b7d7bb7ada496e54d3.exe
4980	8321d3df1ed66163ec6c1a0cf396bc99c55dd6d1aca0f0b7d7bb7ada496e54d3.exe
4980	8321d3df1ed66163ec6c1a0cf396bc99c55dd6d1aca0f0b7d7bb7ada496e54d3.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

8321d3df1ed66163ec6c1a0cf396bc99c55dd6d1aca0f0b7d7bb7ada496e54d3.exe

pid process

4980 8321d3df1ed66163ec6c1a0cf396bc99c55dd6d1aca0f0b7d7bb7ada496e54d3.exe

pid	process
4980	8321d3df1ed66163ec6c1a0cf396bc99c55dd6d1aca0f0b7d7bb7ada496e54d3.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

8321d3df1ed66163ec6c1a0cf396bc99c55dd6d1aca0f0b7d7bb7ada496e54d3.exe

description	pid	process
Token: SeDebugPrivilege	4980	8321d3df1ed66163ec6c1a0cf396bc99c55dd6d1aca0f0b7d7bb7ada496e54d3.exe
Token: SeDebugPrivilege	4980	8321d3df1ed66163ec6c1a0cf396bc99c55dd6d1aca0f0b7d7bb7ada496e54d3.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

8321d3df1ed66163ec6c1a0cf396bc99c55dd6d1aca0f0b7d7bb7ada496e54d3.exe

pid process

1368 8321d3df1ed66163ec6c1a0cf396bc99c55dd6d1aca0f0b7d7bb7ada496e54d3.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

8321d3df1ed66163ec6c1a0cf396bc99c55dd6d1aca0f0b7d7bb7ada496e54d3.exe

description	pid	process	target process
PID 1368 wrote to memory of 2380	1368	8321d3df1ed66163ec6c1a0cf396bc99c55dd6d1aca0f0b7d7bb7ada496e54d3.exe	Explorer.EXE
PID 1368 wrote to memory of 2380	1368	8321d3df1ed66163ec6c1a0cf396bc99c55dd6d1aca0f0b7d7bb7ada496e54d3.exe	Explorer.EXE
PID 1368 wrote to memory of 2380	1368	8321d3df1ed66163ec6c1a0cf396bc99c55dd6d1aca0f0b7d7bb7ada496e54d3.exe	Explorer.EXE
PID 1368 wrote to memory of 2380	1368	8321d3df1ed66163ec6c1a0cf396bc99c55dd6d1aca0f0b7d7bb7ada496e54d3.exe	Explorer.EXE
PID 1368 wrote to memory of 2380	1368	8321d3df1ed66163ec6c1a0cf396bc99c55dd6d1aca0f0b7d7bb7ada496e54d3.exe	Explorer.EXE
PID 1368 wrote to memory of 2380	1368	8321d3df1ed66163ec6c1a0cf396bc99c55dd6d1aca0f0b7d7bb7ada496e54d3.exe	Explorer.EXE
PID 1368 wrote to memory of 2380	1368	8321d3df1ed66163ec6c1a0cf396bc99c55dd6d1aca0f0b7d7bb7ada496e54d3.exe	Explorer.EXE
PID 1368 wrote to memory of 2380	1368	8321d3df1ed66163ec6c1a0cf396bc99c55dd6d1aca0f0b7d7bb7ada496e54d3.exe	Explorer.EXE
PID 1368 wrote to memory of 2380	1368	8321d3df1ed66163ec6c1a0cf396bc99c55dd6d1aca0f0b7d7bb7ada496e54d3.exe	Explorer.EXE
PID 1368 wrote to memory of 2380	1368	8321d3df1ed66163ec6c1a0cf396bc99c55dd6d1aca0f0b7d7bb7ada496e54d3.exe	Explorer.EXE
PID 1368 wrote to memory of 2380	1368	8321d3df1ed66163ec6c1a0cf396bc99c55dd6d1aca0f0b7d7bb7ada496e54d3.exe	Explorer.EXE
PID 1368 wrote to memory of 2380	1368	8321d3df1ed66163ec6c1a0cf396bc99c55dd6d1aca0f0b7d7bb7ada496e54d3.exe	Explorer.EXE
PID 1368 wrote to memory of 2380	1368	8321d3df1ed66163ec6c1a0cf396bc99c55dd6d1aca0f0b7d7bb7ada496e54d3.exe	Explorer.EXE
PID 1368 wrote to memory of 2380	1368	8321d3df1ed66163ec6c1a0cf396bc99c55dd6d1aca0f0b7d7bb7ada496e54d3.exe	Explorer.EXE
PID 1368 wrote to memory of 2380	1368	8321d3df1ed66163ec6c1a0cf396bc99c55dd6d1aca0f0b7d7bb7ada496e54d3.exe	Explorer.EXE
PID 1368 wrote to memory of 2380	1368	8321d3df1ed66163ec6c1a0cf396bc99c55dd6d1aca0f0b7d7bb7ada496e54d3.exe	Explorer.EXE
PID 1368 wrote to memory of 2380	1368	8321d3df1ed66163ec6c1a0cf396bc99c55dd6d1aca0f0b7d7bb7ada496e54d3.exe	Explorer.EXE
PID 1368 wrote to memory of 2380	1368	8321d3df1ed66163ec6c1a0cf396bc99c55dd6d1aca0f0b7d7bb7ada496e54d3.exe	Explorer.EXE
PID 1368 wrote to memory of 2380	1368	8321d3df1ed66163ec6c1a0cf396bc99c55dd6d1aca0f0b7d7bb7ada496e54d3.exe	Explorer.EXE
PID 1368 wrote to memory of 2380	1368	8321d3df1ed66163ec6c1a0cf396bc99c55dd6d1aca0f0b7d7bb7ada496e54d3.exe	Explorer.EXE
PID 1368 wrote to memory of 2380	1368	8321d3df1ed66163ec6c1a0cf396bc99c55dd6d1aca0f0b7d7bb7ada496e54d3.exe	Explorer.EXE
PID 1368 wrote to memory of 2380	1368	8321d3df1ed66163ec6c1a0cf396bc99c55dd6d1aca0f0b7d7bb7ada496e54d3.exe	Explorer.EXE
PID 1368 wrote to memory of 2380	1368	8321d3df1ed66163ec6c1a0cf396bc99c55dd6d1aca0f0b7d7bb7ada496e54d3.exe	Explorer.EXE
PID 1368 wrote to memory of 2380	1368	8321d3df1ed66163ec6c1a0cf396bc99c55dd6d1aca0f0b7d7bb7ada496e54d3.exe	Explorer.EXE
PID 1368 wrote to memory of 2380	1368	8321d3df1ed66163ec6c1a0cf396bc99c55dd6d1aca0f0b7d7bb7ada496e54d3.exe	Explorer.EXE
PID 1368 wrote to memory of 2380	1368	8321d3df1ed66163ec6c1a0cf396bc99c55dd6d1aca0f0b7d7bb7ada496e54d3.exe	Explorer.EXE
PID 1368 wrote to memory of 2380	1368	8321d3df1ed66163ec6c1a0cf396bc99c55dd6d1aca0f0b7d7bb7ada496e54d3.exe	Explorer.EXE
PID 1368 wrote to memory of 2380	1368	8321d3df1ed66163ec6c1a0cf396bc99c55dd6d1aca0f0b7d7bb7ada496e54d3.exe	Explorer.EXE
PID 1368 wrote to memory of 2380	1368	8321d3df1ed66163ec6c1a0cf396bc99c55dd6d1aca0f0b7d7bb7ada496e54d3.exe	Explorer.EXE
PID 1368 wrote to memory of 2380	1368	8321d3df1ed66163ec6c1a0cf396bc99c55dd6d1aca0f0b7d7bb7ada496e54d3.exe	Explorer.EXE
PID 1368 wrote to memory of 2380	1368	8321d3df1ed66163ec6c1a0cf396bc99c55dd6d1aca0f0b7d7bb7ada496e54d3.exe	Explorer.EXE
PID 1368 wrote to memory of 2380	1368	8321d3df1ed66163ec6c1a0cf396bc99c55dd6d1aca0f0b7d7bb7ada496e54d3.exe	Explorer.EXE
PID 1368 wrote to memory of 2380	1368	8321d3df1ed66163ec6c1a0cf396bc99c55dd6d1aca0f0b7d7bb7ada496e54d3.exe	Explorer.EXE
PID 1368 wrote to memory of 2380	1368	8321d3df1ed66163ec6c1a0cf396bc99c55dd6d1aca0f0b7d7bb7ada496e54d3.exe	Explorer.EXE
PID 1368 wrote to memory of 2380	1368	8321d3df1ed66163ec6c1a0cf396bc99c55dd6d1aca0f0b7d7bb7ada496e54d3.exe	Explorer.EXE
PID 1368 wrote to memory of 2380	1368	8321d3df1ed66163ec6c1a0cf396bc99c55dd6d1aca0f0b7d7bb7ada496e54d3.exe	Explorer.EXE
PID 1368 wrote to memory of 2380	1368	8321d3df1ed66163ec6c1a0cf396bc99c55dd6d1aca0f0b7d7bb7ada496e54d3.exe	Explorer.EXE
PID 1368 wrote to memory of 2380	1368	8321d3df1ed66163ec6c1a0cf396bc99c55dd6d1aca0f0b7d7bb7ada496e54d3.exe	Explorer.EXE
PID 1368 wrote to memory of 2380	1368	8321d3df1ed66163ec6c1a0cf396bc99c55dd6d1aca0f0b7d7bb7ada496e54d3.exe	Explorer.EXE
PID 1368 wrote to memory of 2380	1368	8321d3df1ed66163ec6c1a0cf396bc99c55dd6d1aca0f0b7d7bb7ada496e54d3.exe	Explorer.EXE
PID 1368 wrote to memory of 2380	1368	8321d3df1ed66163ec6c1a0cf396bc99c55dd6d1aca0f0b7d7bb7ada496e54d3.exe	Explorer.EXE
PID 1368 wrote to memory of 2380	1368	8321d3df1ed66163ec6c1a0cf396bc99c55dd6d1aca0f0b7d7bb7ada496e54d3.exe	Explorer.EXE
PID 1368 wrote to memory of 2380	1368	8321d3df1ed66163ec6c1a0cf396bc99c55dd6d1aca0f0b7d7bb7ada496e54d3.exe	Explorer.EXE
PID 1368 wrote to memory of 2380	1368	8321d3df1ed66163ec6c1a0cf396bc99c55dd6d1aca0f0b7d7bb7ada496e54d3.exe	Explorer.EXE
PID 1368 wrote to memory of 2380	1368	8321d3df1ed66163ec6c1a0cf396bc99c55dd6d1aca0f0b7d7bb7ada496e54d3.exe	Explorer.EXE
PID 1368 wrote to memory of 2380	1368	8321d3df1ed66163ec6c1a0cf396bc99c55dd6d1aca0f0b7d7bb7ada496e54d3.exe	Explorer.EXE
PID 1368 wrote to memory of 2380	1368	8321d3df1ed66163ec6c1a0cf396bc99c55dd6d1aca0f0b7d7bb7ada496e54d3.exe	Explorer.EXE
PID 1368 wrote to memory of 2380	1368	8321d3df1ed66163ec6c1a0cf396bc99c55dd6d1aca0f0b7d7bb7ada496e54d3.exe	Explorer.EXE
PID 1368 wrote to memory of 2380	1368	8321d3df1ed66163ec6c1a0cf396bc99c55dd6d1aca0f0b7d7bb7ada496e54d3.exe	Explorer.EXE
PID 1368 wrote to memory of 2380	1368	8321d3df1ed66163ec6c1a0cf396bc99c55dd6d1aca0f0b7d7bb7ada496e54d3.exe	Explorer.EXE
PID 1368 wrote to memory of 2380	1368	8321d3df1ed66163ec6c1a0cf396bc99c55dd6d1aca0f0b7d7bb7ada496e54d3.exe	Explorer.EXE
PID 1368 wrote to memory of 2380	1368	8321d3df1ed66163ec6c1a0cf396bc99c55dd6d1aca0f0b7d7bb7ada496e54d3.exe	Explorer.EXE
PID 1368 wrote to memory of 2380	1368	8321d3df1ed66163ec6c1a0cf396bc99c55dd6d1aca0f0b7d7bb7ada496e54d3.exe	Explorer.EXE
PID 1368 wrote to memory of 2380	1368	8321d3df1ed66163ec6c1a0cf396bc99c55dd6d1aca0f0b7d7bb7ada496e54d3.exe	Explorer.EXE
PID 1368 wrote to memory of 2380	1368	8321d3df1ed66163ec6c1a0cf396bc99c55dd6d1aca0f0b7d7bb7ada496e54d3.exe	Explorer.EXE
PID 1368 wrote to memory of 2380	1368	8321d3df1ed66163ec6c1a0cf396bc99c55dd6d1aca0f0b7d7bb7ada496e54d3.exe	Explorer.EXE
PID 1368 wrote to memory of 2380	1368	8321d3df1ed66163ec6c1a0cf396bc99c55dd6d1aca0f0b7d7bb7ada496e54d3.exe	Explorer.EXE
PID 1368 wrote to memory of 2380	1368	8321d3df1ed66163ec6c1a0cf396bc99c55dd6d1aca0f0b7d7bb7ada496e54d3.exe	Explorer.EXE
PID 1368 wrote to memory of 2380	1368	8321d3df1ed66163ec6c1a0cf396bc99c55dd6d1aca0f0b7d7bb7ada496e54d3.exe	Explorer.EXE
PID 1368 wrote to memory of 2380	1368	8321d3df1ed66163ec6c1a0cf396bc99c55dd6d1aca0f0b7d7bb7ada496e54d3.exe	Explorer.EXE
PID 1368 wrote to memory of 2380	1368	8321d3df1ed66163ec6c1a0cf396bc99c55dd6d1aca0f0b7d7bb7ada496e54d3.exe	Explorer.EXE
PID 1368 wrote to memory of 2380	1368	8321d3df1ed66163ec6c1a0cf396bc99c55dd6d1aca0f0b7d7bb7ada496e54d3.exe	Explorer.EXE
PID 1368 wrote to memory of 2380	1368	8321d3df1ed66163ec6c1a0cf396bc99c55dd6d1aca0f0b7d7bb7ada496e54d3.exe	Explorer.EXE
PID 1368 wrote to memory of 2380	1368	8321d3df1ed66163ec6c1a0cf396bc99c55dd6d1aca0f0b7d7bb7ada496e54d3.exe	Explorer.EXE

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:576

C:\Windows\system32\dwm.exe
"dwm.exe"
2⤵
PID:64

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
2⤵
PID:796

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:664

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p
1⤵
PID:776

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
2⤵
PID:3420

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
2⤵
PID:4524

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca
2⤵
PID:4252

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe
2⤵
PID:4672

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
2⤵
PID:3932

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppX53ypgrj20bgndg05hj3tc7z654myszwp.mca
2⤵
PID:4896

C:\Windows\system32\SppExtComObj.exe
C:\Windows\system32\SppExtComObj.exe -Embedding
2⤵
PID:3752

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
2⤵
PID:3964

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
2⤵
PID:3660

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
2⤵
PID:3500

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
2⤵
PID:3356

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
2⤵
PID:3252

C:\Windows\System32\mousocoreworker.exe
C:\Windows\System32\mousocoreworker.exe -Embedding
2⤵
PID:4652

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
2⤵
PID:2536

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
2⤵
PID:3840

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:788

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:956

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k RPCSS -p
1⤵
PID:900

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:500

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1032

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1196

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1376

C:\Windows\system32\sihost.exe
sihost.exe
2⤵
PID:2432

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1404

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1396

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1504

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1332

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1684

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
1⤵
PID:1748

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1800

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
1⤵
PID:1916

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s FontCache
1⤵
PID:1696

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1⤵
PID:1628

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:1972

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1924

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:2012

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1560

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2052

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p
1⤵
PID:2084

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2148

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1292

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2160

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:1168

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2344

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1128

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
2⤵
PID:2756

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2352

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1040

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p
1⤵
PID:520

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:2520

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2588

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
PID:2528

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2488

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2604

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:2620

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:688

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:2020

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:3588

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -s W32Time
1⤵
PID:2652

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:3264

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
1⤵
PID:4800

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 3796 -ip 3796
2⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:4952

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p
1⤵
PID:680

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
PID:3428

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:760

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:5076

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:2380

C:\Users\Admin\AppData\Local\Temp\8321d3df1ed66163ec6c1a0cf396bc99c55dd6d1aca0f0b7d7bb7ada496e54d3.exe
"C:\Users\Admin\AppData\Local\Temp\8321d3df1ed66163ec6c1a0cf396bc99c55dd6d1aca0f0b7d7bb7ada496e54d3.exe"
2⤵
- Adds policy Run key to start application
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1368

C:\Windows\SysWOW64\explorer.exe
explorer.exe
3⤵
PID:1440

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
3⤵
PID:4356

C:\Users\Admin\AppData\Local\Temp\8321d3df1ed66163ec6c1a0cf396bc99c55dd6d1aca0f0b7d7bb7ada496e54d3.exe
"C:\Users\Admin\AppData\Local\Temp\8321d3df1ed66163ec6c1a0cf396bc99c55dd6d1aca0f0b7d7bb7ada496e54d3.exe"
3⤵
- Checks computer location settings
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:4980

C:\Program Files (x86)\install\Now sex video clip.real.exe
"C:\Program Files (x86)\install\Now sex video clip.real.exe"
4⤵
- Executes dropped EXE
PID:3796

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3796 -s 600
5⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:5084

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2628

C:\Windows\System32\WaaSMedicAgent.exe
C:\Windows\System32\WaaSMedicAgent.exe 300eaf14abee522d221304e00bf11718 qTLxWsGTqkyp+p7r7ckyYA.0.1.0.0.0
1⤵
PID:2444

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
2⤵
PID:1540

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
1⤵
PID:1444

C:\Windows\servicing\TrustedInstaller.exe
C:\Windows\servicing\TrustedInstaller.exe
1⤵
PID:1308

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc
1⤵
PID:2820

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

2

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Query Registry

3

T1012

System Information Discovery

4

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\install\Now sex video clip.real.exe
Filesize
465KB

MD5
19a054a7038d9b9d600bf4397d8e5b24

SHA1
b4180459f90e7ca1b31ec14ca04465dddd3705f0

SHA256
8321d3df1ed66163ec6c1a0cf396bc99c55dd6d1aca0f0b7d7bb7ada496e54d3

SHA512
707ecfc452aec931c532c27930edc2ab3414ca2c1438a562a191a3d4c3fb0f656815c2ac6524f7f3605d3a40ffa8d0e0fa4a99f4fb27de073d7daba98c1f198e

Download Submit
C:\Program Files (x86)\install\Now sex video clip.real.exe
Filesize
465KB

MD5
19a054a7038d9b9d600bf4397d8e5b24

SHA1
b4180459f90e7ca1b31ec14ca04465dddd3705f0

SHA256
8321d3df1ed66163ec6c1a0cf396bc99c55dd6d1aca0f0b7d7bb7ada496e54d3

SHA512
707ecfc452aec931c532c27930edc2ab3414ca2c1438a562a191a3d4c3fb0f656815c2ac6524f7f3605d3a40ffa8d0e0fa4a99f4fb27de073d7daba98c1f198e

Download Submit
C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
Filesize
240KB

MD5
e7b75c9797acafcf16c4a5dd1be9db97

SHA1
7ff90557be0cf09d38a74d3fee273c93a326f1ab

SHA256
f3a7655351486b27c8fe59942477425abf5b26eece73d1306e3e26cd18036d1c

SHA512
69ab5499bb9658d5981d20b0ac68474b577bdf7f652e80d443f6116968a027ccbf656da22e14dc83fdc0d9affac582c650aa1da38dc5558883bb202ef3cb4fd3

Download Submit
memory/1368-154-0x0000000024160000-0x00000000241C2000-memory.dmp

Filesize
392KB

Download
memory/1368-133-0x00000000008F0000-0x000000000093E000-memory.dmp

Filesize
312KB

Download
memory/1368-134-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/1368-136-0x0000000024010000-0x0000000024072000-memory.dmp

Filesize
392KB

Download
memory/1368-141-0x0000000024080000-0x00000000240E2000-memory.dmp

Filesize
392KB

Download
memory/1368-132-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/1368-159-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/1368-149-0x00000000240F0000-0x0000000024152000-memory.dmp

Filesize
392KB

Download
memory/1368-158-0x00000000008F0000-0x000000000093E000-memory.dmp

Filesize
312KB

Download
memory/1440-144-0x0000000024080000-0x00000000240E2000-memory.dmp

Filesize
392KB

Download
memory/1440-161-0x0000000031BC0000-0x0000000031BCD000-memory.dmp

Filesize
52KB

Download
memory/1440-140-0x0000000000000000-mapping.dmp

Download
memory/1440-147-0x0000000024080000-0x00000000240E2000-memory.dmp

Filesize
392KB

Download
memory/1440-174-0x0000000031BC0000-0x0000000031BCD000-memory.dmp

Filesize
52KB

Download
memory/3796-170-0x0000000031BE0000-0x0000000031BED000-memory.dmp

Filesize
52KB

Download
memory/3796-162-0x0000000000000000-mapping.dmp

Download
memory/3796-177-0x0000000031BE0000-0x0000000031BED000-memory.dmp

Filesize
52KB

Download
memory/3796-165-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/3796-164-0x0000000031BE0000-0x0000000031BED000-memory.dmp

Filesize
52KB

Download
memory/3796-171-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/3796-169-0x00000000029A0000-0x00000000029EE000-memory.dmp

Filesize
312KB

Download
memory/4952-166-0x0000000031BF0000-0x0000000031BFD000-memory.dmp

Filesize
52KB

Download
memory/4952-167-0x0000000031BF0000-0x0000000031BFD000-memory.dmp

Filesize
52KB

Download
memory/4980-160-0x0000000024160000-0x00000000241C2000-memory.dmp

Filesize
392KB

Download
memory/4980-173-0x0000000024160000-0x00000000241C2000-memory.dmp

Filesize
392KB

Download
memory/4980-157-0x0000000024160000-0x00000000241C2000-memory.dmp

Filesize
392KB

Download
memory/4980-153-0x0000000000000000-mapping.dmp

Download
memory/5084-168-0x0000000031C10000-0x0000000031C1D000-memory.dmp

Filesize
52KB

Download
memory/5084-172-0x0000000031C10000-0x0000000031C1D000-memory.dmp

Filesize
52KB

Download
memory/5084-175-0x0000000031C10000-0x0000000031C1D000-memory.dmp

Filesize
52KB

Download
memory/5084-176-0x0000000031C10000-0x0000000031C1D000-memory.dmp

Filesize
52KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads