Analysis
-
max time kernel
151s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
20/11/2022, 05:53
Static task
static1
Behavioral task
behavioral1
Sample
96ef3f01a6f2853e3ea2e57ac5a9b4350e4128d4600a2977a8e0ef6917d63fb4.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
96ef3f01a6f2853e3ea2e57ac5a9b4350e4128d4600a2977a8e0ef6917d63fb4.exe
Resource
win10v2004-20220812-en
General
-
Target
96ef3f01a6f2853e3ea2e57ac5a9b4350e4128d4600a2977a8e0ef6917d63fb4.exe
-
Size
608KB
-
MD5
19a06eefb2d48107725ffe46843057af
-
SHA1
1a06f82c59fd546864c16e7c4b0e568ed8dbc594
-
SHA256
96ef3f01a6f2853e3ea2e57ac5a9b4350e4128d4600a2977a8e0ef6917d63fb4
-
SHA512
04d0d2cbd36bdab719fca67dd1796889b5e0e454d9599804bc7a7f30ada8a675d3dd00e7eddafd4cb31316edd22e21266b8fb310785084e8126da5d101ade282
-
SSDEEP
12288:YBYDZJr1E+3JcdrXxE3Vq4Vcim38bJ6vKDn5gcPUbjC:YqF6+ydroLrJ6vKVgkUb
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" aUY5E15SY8.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" jonog.exe -
Executes dropped EXE 9 IoCs
pid Process 1256 aUY5E15SY8.exe 4844 2nua.exe 2444 jonog.exe 1392 2nua.exe 1056 2nua.exe 5068 2nua.exe 4980 2nua.exe 2076 2nua.exe 1776 3nua.exe -
resource yara_rule behavioral2/memory/1056-153-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1056-156-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1056-160-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4980-165-0x0000000000400000-0x0000000000407000-memory.dmp upx behavioral2/memory/1056-158-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4980-168-0x0000000000400000-0x0000000000407000-memory.dmp upx behavioral2/memory/2076-170-0x0000000000400000-0x000000000040A000-memory.dmp upx behavioral2/memory/4980-171-0x0000000000400000-0x0000000000407000-memory.dmp upx behavioral2/memory/2076-176-0x0000000000400000-0x000000000040A000-memory.dmp upx behavioral2/memory/2076-174-0x0000000000400000-0x000000000040A000-memory.dmp upx behavioral2/memory/4980-181-0x0000000000400000-0x0000000000407000-memory.dmp upx behavioral2/memory/2076-182-0x0000000000400000-0x000000000040A000-memory.dmp upx behavioral2/memory/2076-187-0x0000000000400000-0x000000000040A000-memory.dmp upx behavioral2/memory/1056-189-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation aUY5E15SY8.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation 96ef3f01a6f2853e3ea2e57ac5a9b4350e4128d4600a2977a8e0ef6917d63fb4.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 53 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jonog = "C:\\Users\\Admin\\jonog.exe /j" jonog.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jonog = "C:\\Users\\Admin\\jonog.exe /L" jonog.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jonog = "C:\\Users\\Admin\\jonog.exe /A" jonog.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jonog = "C:\\Users\\Admin\\jonog.exe /r" jonog.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jonog = "C:\\Users\\Admin\\jonog.exe /c" jonog.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jonog = "C:\\Users\\Admin\\jonog.exe /Y" jonog.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jonog = "C:\\Users\\Admin\\jonog.exe /D" jonog.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jonog = "C:\\Users\\Admin\\jonog.exe /l" jonog.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jonog = "C:\\Users\\Admin\\jonog.exe /p" jonog.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jonog = "C:\\Users\\Admin\\jonog.exe /W" jonog.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jonog = "C:\\Users\\Admin\\jonog.exe /G" jonog.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jonog = "C:\\Users\\Admin\\jonog.exe /n" jonog.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jonog = "C:\\Users\\Admin\\jonog.exe /s" jonog.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jonog = "C:\\Users\\Admin\\jonog.exe /I" jonog.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jonog = "C:\\Users\\Admin\\jonog.exe /B" jonog.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jonog = "C:\\Users\\Admin\\jonog.exe /m" jonog.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jonog = "C:\\Users\\Admin\\jonog.exe /k" jonog.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jonog = "C:\\Users\\Admin\\jonog.exe /M" jonog.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Run\ jonog.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jonog = "C:\\Users\\Admin\\jonog.exe /V" jonog.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jonog = "C:\\Users\\Admin\\jonog.exe /w" jonog.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Run\ aUY5E15SY8.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jonog = "C:\\Users\\Admin\\jonog.exe /N" jonog.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jonog = "C:\\Users\\Admin\\jonog.exe /d" jonog.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jonog = "C:\\Users\\Admin\\jonog.exe /Q" jonog.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jonog = "C:\\Users\\Admin\\jonog.exe /q" jonog.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jonog = "C:\\Users\\Admin\\jonog.exe /y" jonog.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jonog = "C:\\Users\\Admin\\jonog.exe /P" jonog.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jonog = "C:\\Users\\Admin\\jonog.exe /R" jonog.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jonog = "C:\\Users\\Admin\\jonog.exe /x" jonog.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jonog = "C:\\Users\\Admin\\jonog.exe /b" jonog.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jonog = "C:\\Users\\Admin\\jonog.exe /Z" jonog.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jonog = "C:\\Users\\Admin\\jonog.exe /O" jonog.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jonog = "C:\\Users\\Admin\\jonog.exe /f" jonog.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jonog = "C:\\Users\\Admin\\jonog.exe /S" jonog.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jonog = "C:\\Users\\Admin\\jonog.exe /U" jonog.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jonog = "C:\\Users\\Admin\\jonog.exe /K" jonog.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jonog = "C:\\Users\\Admin\\jonog.exe /E" jonog.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jonog = "C:\\Users\\Admin\\jonog.exe /h" jonog.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jonog = "C:\\Users\\Admin\\jonog.exe /z" jonog.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jonog = "C:\\Users\\Admin\\jonog.exe /g" jonog.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jonog = "C:\\Users\\Admin\\jonog.exe /i" jonog.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jonog = "C:\\Users\\Admin\\jonog.exe /T" jonog.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jonog = "C:\\Users\\Admin\\jonog.exe /X" jonog.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jonog = "C:\\Users\\Admin\\jonog.exe /C" jonog.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jonog = "C:\\Users\\Admin\\jonog.exe /e" jonog.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jonog = "C:\\Users\\Admin\\jonog.exe /t" jonog.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jonog = "C:\\Users\\Admin\\jonog.exe /Z" aUY5E15SY8.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jonog = "C:\\Users\\Admin\\jonog.exe /a" jonog.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jonog = "C:\\Users\\Admin\\jonog.exe /F" jonog.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jonog = "C:\\Users\\Admin\\jonog.exe /u" jonog.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jonog = "C:\\Users\\Admin\\jonog.exe /J" jonog.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jonog = "C:\\Users\\Admin\\jonog.exe /o" jonog.exe -
Maps connected drives based on registry 3 TTPs 4 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 2nua.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum 2nua.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 2nua.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum 2nua.exe -
Suspicious use of SetThreadContext 5 IoCs
description pid Process procid_target PID 4844 set thread context of 1392 4844 2nua.exe 84 PID 4844 set thread context of 1056 4844 2nua.exe 87 PID 4844 set thread context of 5068 4844 2nua.exe 89 PID 4844 set thread context of 4980 4844 2nua.exe 91 PID 4844 set thread context of 2076 4844 2nua.exe 92 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 2 IoCs
pid pid_target Process procid_target 1756 1392 WerFault.exe 84 3792 1776 WerFault.exe 94 -
Enumerates processes with tasklist 1 TTPs 2 IoCs
pid Process 1368 tasklist.exe 3364 tasklist.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1256 aUY5E15SY8.exe 1256 aUY5E15SY8.exe 1256 aUY5E15SY8.exe 1256 aUY5E15SY8.exe 1056 2nua.exe 1056 2nua.exe 5068 2nua.exe 5068 2nua.exe 2444 jonog.exe 2444 jonog.exe 2444 jonog.exe 2444 jonog.exe 1056 2nua.exe 1056 2nua.exe 2444 jonog.exe 2444 jonog.exe 2444 jonog.exe 2444 jonog.exe 2444 jonog.exe 2444 jonog.exe 2444 jonog.exe 2444 jonog.exe 2444 jonog.exe 2444 jonog.exe 2444 jonog.exe 2444 jonog.exe 2444 jonog.exe 2444 jonog.exe 2444 jonog.exe 2444 jonog.exe 2444 jonog.exe 2444 jonog.exe 2444 jonog.exe 2444 jonog.exe 2444 jonog.exe 2444 jonog.exe 2444 jonog.exe 2444 jonog.exe 2444 jonog.exe 2444 jonog.exe 2444 jonog.exe 2444 jonog.exe 2444 jonog.exe 2444 jonog.exe 2444 jonog.exe 2444 jonog.exe 2444 jonog.exe 2444 jonog.exe 2444 jonog.exe 2444 jonog.exe 2444 jonog.exe 2444 jonog.exe 2444 jonog.exe 2444 jonog.exe 2444 jonog.exe 2444 jonog.exe 2444 jonog.exe 2444 jonog.exe 2444 jonog.exe 2444 jonog.exe 2444 jonog.exe 2444 jonog.exe 2444 jonog.exe 2444 jonog.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1368 tasklist.exe Token: SeDebugPrivilege 3364 tasklist.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 764 96ef3f01a6f2853e3ea2e57ac5a9b4350e4128d4600a2977a8e0ef6917d63fb4.exe 1256 aUY5E15SY8.exe 4844 2nua.exe 2444 jonog.exe 4980 2nua.exe 2076 2nua.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 764 wrote to memory of 1256 764 96ef3f01a6f2853e3ea2e57ac5a9b4350e4128d4600a2977a8e0ef6917d63fb4.exe 81 PID 764 wrote to memory of 1256 764 96ef3f01a6f2853e3ea2e57ac5a9b4350e4128d4600a2977a8e0ef6917d63fb4.exe 81 PID 764 wrote to memory of 1256 764 96ef3f01a6f2853e3ea2e57ac5a9b4350e4128d4600a2977a8e0ef6917d63fb4.exe 81 PID 764 wrote to memory of 4844 764 96ef3f01a6f2853e3ea2e57ac5a9b4350e4128d4600a2977a8e0ef6917d63fb4.exe 82 PID 764 wrote to memory of 4844 764 96ef3f01a6f2853e3ea2e57ac5a9b4350e4128d4600a2977a8e0ef6917d63fb4.exe 82 PID 764 wrote to memory of 4844 764 96ef3f01a6f2853e3ea2e57ac5a9b4350e4128d4600a2977a8e0ef6917d63fb4.exe 82 PID 1256 wrote to memory of 2444 1256 aUY5E15SY8.exe 83 PID 1256 wrote to memory of 2444 1256 aUY5E15SY8.exe 83 PID 1256 wrote to memory of 2444 1256 aUY5E15SY8.exe 83 PID 1256 wrote to memory of 4872 1256 aUY5E15SY8.exe 85 PID 1256 wrote to memory of 4872 1256 aUY5E15SY8.exe 85 PID 1256 wrote to memory of 4872 1256 aUY5E15SY8.exe 85 PID 4844 wrote to memory of 1392 4844 2nua.exe 84 PID 4844 wrote to memory of 1392 4844 2nua.exe 84 PID 4844 wrote to memory of 1392 4844 2nua.exe 84 PID 4844 wrote to memory of 1392 4844 2nua.exe 84 PID 4844 wrote to memory of 1056 4844 2nua.exe 87 PID 4844 wrote to memory of 1056 4844 2nua.exe 87 PID 4844 wrote to memory of 1056 4844 2nua.exe 87 PID 4844 wrote to memory of 1056 4844 2nua.exe 87 PID 4844 wrote to memory of 1056 4844 2nua.exe 87 PID 4844 wrote to memory of 1056 4844 2nua.exe 87 PID 4844 wrote to memory of 1056 4844 2nua.exe 87 PID 4844 wrote to memory of 1056 4844 2nua.exe 87 PID 4844 wrote to memory of 5068 4844 2nua.exe 89 PID 4844 wrote to memory of 5068 4844 2nua.exe 89 PID 4844 wrote to memory of 5068 4844 2nua.exe 89 PID 4844 wrote to memory of 5068 4844 2nua.exe 89 PID 4844 wrote to memory of 5068 4844 2nua.exe 89 PID 4844 wrote to memory of 5068 4844 2nua.exe 89 PID 4844 wrote to memory of 5068 4844 2nua.exe 89 PID 4844 wrote to memory of 5068 4844 2nua.exe 89 PID 4844 wrote to memory of 5068 4844 2nua.exe 89 PID 4844 wrote to memory of 4980 4844 2nua.exe 91 PID 4844 wrote to memory of 4980 4844 2nua.exe 91 PID 4844 wrote to memory of 4980 4844 2nua.exe 91 PID 4844 wrote to memory of 4980 4844 2nua.exe 91 PID 4844 wrote to memory of 4980 4844 2nua.exe 91 PID 4844 wrote to memory of 4980 4844 2nua.exe 91 PID 4844 wrote to memory of 4980 4844 2nua.exe 91 PID 4844 wrote to memory of 4980 4844 2nua.exe 91 PID 4844 wrote to memory of 2076 4844 2nua.exe 92 PID 4844 wrote to memory of 2076 4844 2nua.exe 92 PID 4844 wrote to memory of 2076 4844 2nua.exe 92 PID 4844 wrote to memory of 2076 4844 2nua.exe 92 PID 4844 wrote to memory of 2076 4844 2nua.exe 92 PID 4844 wrote to memory of 2076 4844 2nua.exe 92 PID 4844 wrote to memory of 2076 4844 2nua.exe 92 PID 4844 wrote to memory of 2076 4844 2nua.exe 92 PID 764 wrote to memory of 1776 764 96ef3f01a6f2853e3ea2e57ac5a9b4350e4128d4600a2977a8e0ef6917d63fb4.exe 94 PID 764 wrote to memory of 1776 764 96ef3f01a6f2853e3ea2e57ac5a9b4350e4128d4600a2977a8e0ef6917d63fb4.exe 94 PID 764 wrote to memory of 1776 764 96ef3f01a6f2853e3ea2e57ac5a9b4350e4128d4600a2977a8e0ef6917d63fb4.exe 94 PID 4872 wrote to memory of 1368 4872 cmd.exe 95 PID 4872 wrote to memory of 1368 4872 cmd.exe 95 PID 4872 wrote to memory of 1368 4872 cmd.exe 95 PID 2444 wrote to memory of 1368 2444 jonog.exe 95 PID 2444 wrote to memory of 1368 2444 jonog.exe 95 PID 2444 wrote to memory of 1368 2444 jonog.exe 95 PID 2444 wrote to memory of 1368 2444 jonog.exe 95 PID 2444 wrote to memory of 1368 2444 jonog.exe 95 PID 2444 wrote to memory of 1368 2444 jonog.exe 95 PID 2444 wrote to memory of 1368 2444 jonog.exe 95 PID 2444 wrote to memory of 1368 2444 jonog.exe 95 PID 2444 wrote to memory of 1368 2444 jonog.exe 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\96ef3f01a6f2853e3ea2e57ac5a9b4350e4128d4600a2977a8e0ef6917d63fb4.exe"C:\Users\Admin\AppData\Local\Temp\96ef3f01a6f2853e3ea2e57ac5a9b4350e4128d4600a2977a8e0ef6917d63fb4.exe"1⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:764 -
C:\Users\Admin\aUY5E15SY8.exeC:\Users\Admin\aUY5E15SY8.exe2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1256 -
C:\Users\Admin\jonog.exe"C:\Users\Admin\jonog.exe"3⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2444
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c tasklist&&del aUY5E15SY8.exe3⤵
- Suspicious use of WriteProcessMemory
PID:4872 -
C:\Windows\SysWOW64\tasklist.exetasklist4⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:1368
-
-
-
-
C:\Users\Admin\2nua.exeC:\Users\Admin\2nua.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4844 -
C:\Users\Admin\2nua.exe"C:\Users\Admin\2nua.exe"3⤵
- Executes dropped EXE
PID:1392 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1392 -s 804⤵
- Program crash
PID:1756
-
-
-
C:\Users\Admin\2nua.exe"C:\Users\Admin\2nua.exe"3⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
PID:1056
-
-
C:\Users\Admin\2nua.exe"C:\Users\Admin\2nua.exe"3⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
PID:5068
-
-
C:\Users\Admin\2nua.exe"C:\Users\Admin\2nua.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4980
-
-
C:\Users\Admin\2nua.exe"C:\Users\Admin\2nua.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2076
-
-
-
C:\Users\Admin\3nua.exeC:\Users\Admin\3nua.exe2⤵
- Executes dropped EXE
PID:1776 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1776 -s 6323⤵
- Program crash
PID:3792
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c tasklist&&del 96ef3f01a6f2853e3ea2e57ac5a9b4350e4128d4600a2977a8e0ef6917d63fb4.exe2⤵PID:1828
-
C:\Windows\SysWOW64\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:3364
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1392 -ip 13921⤵PID:4156
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1776 -ip 17761⤵PID:3368
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
224KB
MD5b64185be04a7c3882871c07358450544
SHA16dd00c5f29490e210639ac155e732f7c33e746af
SHA256c7968bba96e5bc1c47dd24c4b61763eb9d227e89bb259add8ac010711a875f0d
SHA512604aa723229eddd5225c13d64993966d9a79f0e34aa6b31bb8cfc00e1765319886eaefff276222831e6c5a82cf50634f04a9d59c141329b07a632fc586e4ed21
-
Filesize
224KB
MD5b64185be04a7c3882871c07358450544
SHA16dd00c5f29490e210639ac155e732f7c33e746af
SHA256c7968bba96e5bc1c47dd24c4b61763eb9d227e89bb259add8ac010711a875f0d
SHA512604aa723229eddd5225c13d64993966d9a79f0e34aa6b31bb8cfc00e1765319886eaefff276222831e6c5a82cf50634f04a9d59c141329b07a632fc586e4ed21
-
Filesize
224KB
MD5b64185be04a7c3882871c07358450544
SHA16dd00c5f29490e210639ac155e732f7c33e746af
SHA256c7968bba96e5bc1c47dd24c4b61763eb9d227e89bb259add8ac010711a875f0d
SHA512604aa723229eddd5225c13d64993966d9a79f0e34aa6b31bb8cfc00e1765319886eaefff276222831e6c5a82cf50634f04a9d59c141329b07a632fc586e4ed21
-
Filesize
224KB
MD5b64185be04a7c3882871c07358450544
SHA16dd00c5f29490e210639ac155e732f7c33e746af
SHA256c7968bba96e5bc1c47dd24c4b61763eb9d227e89bb259add8ac010711a875f0d
SHA512604aa723229eddd5225c13d64993966d9a79f0e34aa6b31bb8cfc00e1765319886eaefff276222831e6c5a82cf50634f04a9d59c141329b07a632fc586e4ed21
-
Filesize
224KB
MD5b64185be04a7c3882871c07358450544
SHA16dd00c5f29490e210639ac155e732f7c33e746af
SHA256c7968bba96e5bc1c47dd24c4b61763eb9d227e89bb259add8ac010711a875f0d
SHA512604aa723229eddd5225c13d64993966d9a79f0e34aa6b31bb8cfc00e1765319886eaefff276222831e6c5a82cf50634f04a9d59c141329b07a632fc586e4ed21
-
Filesize
224KB
MD5b64185be04a7c3882871c07358450544
SHA16dd00c5f29490e210639ac155e732f7c33e746af
SHA256c7968bba96e5bc1c47dd24c4b61763eb9d227e89bb259add8ac010711a875f0d
SHA512604aa723229eddd5225c13d64993966d9a79f0e34aa6b31bb8cfc00e1765319886eaefff276222831e6c5a82cf50634f04a9d59c141329b07a632fc586e4ed21
-
Filesize
224KB
MD5b64185be04a7c3882871c07358450544
SHA16dd00c5f29490e210639ac155e732f7c33e746af
SHA256c7968bba96e5bc1c47dd24c4b61763eb9d227e89bb259add8ac010711a875f0d
SHA512604aa723229eddd5225c13d64993966d9a79f0e34aa6b31bb8cfc00e1765319886eaefff276222831e6c5a82cf50634f04a9d59c141329b07a632fc586e4ed21
-
Filesize
273KB
MD50fcecac14065f03c4f83bf5ae6ac415b
SHA1f71aa4708e16a2a3bf15e2a99cc0ce609b08769b
SHA25679f4527215b4a213f69cf618440202131afa6eb61d2bc6046b718dd4b4ddb787
SHA51249195c9f00c434228dd76151042dc03f7f87b77438734861face0f4ec40391649ed784aaf82b756113a55d55126c9b18c27e44d0c47ca75564ea079eed161003
-
Filesize
273KB
MD50fcecac14065f03c4f83bf5ae6ac415b
SHA1f71aa4708e16a2a3bf15e2a99cc0ce609b08769b
SHA25679f4527215b4a213f69cf618440202131afa6eb61d2bc6046b718dd4b4ddb787
SHA51249195c9f00c434228dd76151042dc03f7f87b77438734861face0f4ec40391649ed784aaf82b756113a55d55126c9b18c27e44d0c47ca75564ea079eed161003
-
Filesize
208KB
MD5380575fdf47f22e24cc214c89f098f9d
SHA15d5584fab3dc5267ffacfd4c331555f4f7703fb6
SHA25604fc572ba5e2e941d3510ed1504cc04490c7f5ff3ec651e6c8ffd6645ef2e0c9
SHA51270ce73ac9a14224c608e1ab60e21dd8bbd5ebcc8c75bb670c0861c8fc4a478965d39a450d32907ff90baa3a8a2fc9e50a9cc8d7385a330b373d3c9854cc8e7e2
-
Filesize
208KB
MD5380575fdf47f22e24cc214c89f098f9d
SHA15d5584fab3dc5267ffacfd4c331555f4f7703fb6
SHA25604fc572ba5e2e941d3510ed1504cc04490c7f5ff3ec651e6c8ffd6645ef2e0c9
SHA51270ce73ac9a14224c608e1ab60e21dd8bbd5ebcc8c75bb670c0861c8fc4a478965d39a450d32907ff90baa3a8a2fc9e50a9cc8d7385a330b373d3c9854cc8e7e2
-
Filesize
208KB
MD5d6099020829a02dc26fe7df6283b330b
SHA1ae0445340db92124e88afeb72987738626e4bf22
SHA256a5180b8cdfd32bc7b154b0c4c64d9fbd3f26896e02f05768231518cde7e16bca
SHA51200d3a4df1b1fb33d9ecc140f574b7e416bdf932a005806c044ebc2b73f28afb11f976919514f818c68d422d5479f0d7834dff32e5201380bcb767381f0180229
-
Filesize
208KB
MD5d6099020829a02dc26fe7df6283b330b
SHA1ae0445340db92124e88afeb72987738626e4bf22
SHA256a5180b8cdfd32bc7b154b0c4c64d9fbd3f26896e02f05768231518cde7e16bca
SHA51200d3a4df1b1fb33d9ecc140f574b7e416bdf932a005806c044ebc2b73f28afb11f976919514f818c68d422d5479f0d7834dff32e5201380bcb767381f0180229