Overview

overview

10

Static

static

a1c17a517a...58.exe

windows7-x64

8

a1c17a517a...58.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21/11/2022, 14:37

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    a1c17a517ab0d55b393bed9b9f6c4302cca2472945287ed7fd4c89fe06bdfa58.exe
  • Size 361KB
  • Sample221121-ry7dcshd4y
  • SHA256 a1c17a517ab0d55b393bed9b9f6c4302cca2472945287ed7fd4c89fe06bdfa58
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10

Malware Config

Signatures

  • Suspicious use of NtCreateUserProcessOtherParentProcess 57 IoCs
  • Executes dropped EXE 64 IoCs
  • Gathers network information 2 TTPs 19 IoCs

    Uses commandline utility to view network configuration.

  • Modifies Internet Explorer settings 1 TTPs 35 IoCs
    adwarespyware
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: LoadsDriver 19 IoCs
  • Suspicious use of AdjustPrivilegeToken 21 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a1c17a517ab0d55b393bed9b9f6c4302cca2472945287ed7fd4c89fe06bdfa58.exe
    "C:\Users\Admin\AppData\Local\Temp\a1c17a517ab0d55b393bed9b9f6c4302cca2472945287ed7fd4c89fe06bdfa58.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4208
    • C:\Temp\wtomgeywrojgbztr.exe
      C:\Temp\wtomgeywrojgbztr.exe run
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2732
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\wqojgbztrl.exe ups_run
        3⤵
        • Executes dropped EXE
        PID:3256
        • C:\Temp\wqojgbztrl.exe
          C:\Temp\wqojgbztrl.exe ups_run
          4⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:3360
          • C:\temp\CreateProcess.exe
            C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
            5⤵
            • Executes dropped EXE
            PID:868
            • C:\windows\system32\ipconfig.exe
              C:\windows\system32\ipconfig.exe /release
              6⤵
              • Gathers network information
              PID:3156
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\i_wqojgbztrl.exe ups_ins
        3⤵
        • Executes dropped EXE
        PID:1676
        • C:\Temp\i_wqojgbztrl.exe
          C:\Temp\i_wqojgbztrl.exe ups_ins
          4⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:176
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\yvqoigaytq.exe ups_run
        3⤵
        • Executes dropped EXE
        PID:4856
        • C:\Temp\yvqoigaytq.exe
          C:\Temp\yvqoigaytq.exe ups_run
          4⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:3600
          • C:\temp\CreateProcess.exe
            C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
            5⤵
            • Executes dropped EXE
            PID:4480
            • C:\windows\system32\ipconfig.exe
              C:\windows\system32\ipconfig.exe /release
              6⤵
              • Gathers network information
              PID:3552
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\i_yvqoigaytq.exe ups_ins
        3⤵
        • Executes dropped EXE
        PID:3448
        • C:\Temp\i_yvqoigaytq.exe
          C:\Temp\i_yvqoigaytq.exe ups_ins
          4⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:4228
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\gaysqlidbv.exe ups_run
        3⤵
        • Executes dropped EXE
        PID:4224
        • C:\Temp\gaysqlidbv.exe
          C:\Temp\gaysqlidbv.exe ups_run
          4⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:3940
          • C:\temp\CreateProcess.exe
            C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
            5⤵
            • Executes dropped EXE
            PID:2160
            • C:\windows\system32\ipconfig.exe
              C:\windows\system32\ipconfig.exe /release
              6⤵
              • Gathers network information
              PID:1128
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\i_gaysqlidbv.exe ups_ins
        3⤵
        • Executes dropped EXE
        PID:628
        • C:\Temp\i_gaysqlidbv.exe
          C:\Temp\i_gaysqlidbv.exe ups_ins
          4⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:5108
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\lfdxvqniga.exe ups_run
        3⤵
        • Executes dropped EXE
        PID:2300
        • C:\Temp\lfdxvqniga.exe
          C:\Temp\lfdxvqniga.exe ups_run
          4⤵
          • Executes dropped EXE
          PID:1260
          • C:\temp\CreateProcess.exe
            C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
            5⤵
            • Executes dropped EXE
            PID:2108
            • C:\windows\system32\ipconfig.exe
              C:\windows\system32\ipconfig.exe /release
              6⤵
              • Gathers network information
              PID:3592
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\i_lfdxvqniga.exe ups_ins
        3⤵
        • Executes dropped EXE
        PID:4668
        • C:\Temp\i_lfdxvqniga.exe
          C:\Temp\i_lfdxvqniga.exe ups_ins
          4⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:1688
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\kicausnkfc.exe ups_run
        3⤵
        • Executes dropped EXE
        PID:3028
        • C:\Temp\kicausnkfc.exe
          C:\Temp\kicausnkfc.exe ups_run
          4⤵
          • Executes dropped EXE
          PID:3528
          • C:\temp\CreateProcess.exe
            C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
            5⤵
            • Executes dropped EXE
            PID:1832
            • C:\windows\system32\ipconfig.exe
              C:\windows\system32\ipconfig.exe /release
              6⤵
              • Gathers network information
              PID:2540
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\i_kicausnkfc.exe ups_ins
        3⤵
        • Executes dropped EXE
        PID:3176
        • C:\Temp\i_kicausnkfc.exe
          C:\Temp\i_kicausnkfc.exe ups_ins
          4⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:3320
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\khcausmkec.exe ups_run
        3⤵
        • Executes dropped EXE
        PID:4256
        • C:\Temp\khcausmkec.exe
          C:\Temp\khcausmkec.exe ups_run
          4⤵
          • Executes dropped EXE
          PID:616
          • C:\temp\CreateProcess.exe
            C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
            5⤵
            • Executes dropped EXE
            PID:1948
            • C:\windows\system32\ipconfig.exe
              C:\windows\system32\ipconfig.exe /release
              6⤵
              • Gathers network information
              PID:1788
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\i_khcausmkec.exe ups_ins
        3⤵
        • Executes dropped EXE
        PID:5036
        • C:\Temp\i_khcausmkec.exe
          C:\Temp\i_khcausmkec.exe ups_ins
          4⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:4612
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\zxrpjhbzur.exe ups_run
        3⤵
        • Executes dropped EXE
        PID:4224
        • C:\Temp\zxrpjhbzur.exe
          C:\Temp\zxrpjhbzur.exe ups_run
          4⤵
          • Executes dropped EXE
          PID:1668
          • C:\temp\CreateProcess.exe
            C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
            5⤵
            • Executes dropped EXE
            PID:3492
            • C:\windows\system32\ipconfig.exe
              C:\windows\system32\ipconfig.exe /release
              6⤵
              • Gathers network information
              PID:2844
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\i_zxrpjhbzur.exe ups_ins
        3⤵
        • Executes dropped EXE
        PID:380
        • C:\Temp\i_zxrpjhbzur.exe
          C:\Temp\i_zxrpjhbzur.exe ups_ins
          4⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:4920
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\gezwrojhbz.exe ups_run
        3⤵
        • Executes dropped EXE
        PID:452
        • C:\Temp\gezwrojhbz.exe
          C:\Temp\gezwrojhbz.exe ups_run
          4⤵
          • Executes dropped EXE
          PID:2560
          • C:\temp\CreateProcess.exe
            C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
            5⤵
            • Executes dropped EXE
            PID:1452
            • C:\windows\system32\ipconfig.exe
              C:\windows\system32\ipconfig.exe /release
              6⤵
              • Gathers network information
              PID:2324
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\i_gezwrojhbz.exe ups_ins
        3⤵
        • Executes dropped EXE
        PID:1684
        • C:\Temp\i_gezwrojhbz.exe
          C:\Temp\i_gezwrojhbz.exe ups_ins
          4⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:1144
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\ljebwtomge.exe ups_run
        3⤵
        • Executes dropped EXE
        PID:3124
        • C:\Temp\ljebwtomge.exe
          C:\Temp\ljebwtomge.exe ups_run
          4⤵
          • Executes dropped EXE
          PID:2388
          • C:\temp\CreateProcess.exe
            C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
            5⤵
            • Executes dropped EXE
            PID:3412
            • C:\windows\system32\ipconfig.exe
              C:\windows\system32\ipconfig.exe /release
              6⤵
              • Gathers network information
              PID:3956
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\i_ljebwtomge.exe ups_ins
        3⤵
        • Executes dropped EXE
        PID:4404
        • C:\Temp\i_ljebwtomge.exe
          C:\Temp\i_ljebwtomge.exe ups_ins
          4⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:528
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\trljdbvtol.exe ups_run
        3⤵
        • Executes dropped EXE
        PID:5104
        • C:\Temp\trljdbvtol.exe
          C:\Temp\trljdbvtol.exe ups_run
          4⤵
          • Executes dropped EXE
          PID:3008
          • C:\temp\CreateProcess.exe
            C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
            5⤵
            • Executes dropped EXE
            PID:4724
            • C:\windows\system32\ipconfig.exe
              C:\windows\system32\ipconfig.exe /release
              6⤵
              • Gathers network information
              PID:4860
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\i_trljdbvtol.exe ups_ins
        3⤵
        • Executes dropped EXE
        PID:1732
        • C:\Temp\i_trljdbvtol.exe
          C:\Temp\i_trljdbvtol.exe ups_ins
          4⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:1840
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\avtnlfdxvq.exe ups_run
        3⤵
        • Executes dropped EXE
        PID:3320
        • C:\Temp\avtnlfdxvq.exe
          C:\Temp\avtnlfdxvq.exe ups_run
          4⤵
          • Executes dropped EXE
          PID:4308
          • C:\temp\CreateProcess.exe
            C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
            5⤵
            • Executes dropped EXE
            PID:1012
            • C:\windows\system32\ipconfig.exe
              C:\windows\system32\ipconfig.exe /release
              6⤵
              • Gathers network information
              PID:2380
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\i_avtnlfdxvq.exe ups_ins
        3⤵
        • Executes dropped EXE
        PID:1200
        • C:\Temp\i_avtnlfdxvq.exe
          C:\Temp\i_avtnlfdxvq.exe ups_ins
          4⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:4872
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\nlfdxvpnif.exe ups_run
        3⤵
        • Executes dropped EXE
        PID:4372
        • C:\Temp\nlfdxvpnif.exe
          C:\Temp\nlfdxvpnif.exe ups_run
          4⤵
          • Executes dropped EXE
          PID:4700
          • C:\temp\CreateProcess.exe
            C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
            5⤵
            • Executes dropped EXE
            PID:3840
            • C:\windows\system32\ipconfig.exe
              C:\windows\system32\ipconfig.exe /release
              6⤵
              • Gathers network information
              PID:4952
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\i_nlfdxvpnif.exe ups_ins
        3⤵
        • Executes dropped EXE
        PID:4856
        • C:\Temp\i_nlfdxvpnif.exe
          C:\Temp\i_nlfdxvpnif.exe ups_ins
          4⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:3952
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\xsnkfdxvpn.exe ups_run
        3⤵
        • Executes dropped EXE
        PID:2772
        • C:\Temp\xsnkfdxvpn.exe
          C:\Temp\xsnkfdxvpn.exe ups_run
          4⤵
          • Executes dropped EXE
          PID:1376
          • C:\temp\CreateProcess.exe
            C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
            5⤵
            • Executes dropped EXE
            PID:5020
            • C:\windows\system32\ipconfig.exe
              C:\windows\system32\ipconfig.exe /release
              6⤵
              • Gathers network information
              PID:1908
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\i_xsnkfdxvpn.exe ups_ins
        3⤵
          PID:3316
          • C:\Temp\i_xsnkfdxvpn.exe
            C:\Temp\i_xsnkfdxvpn.exe ups_ins
            4⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:2728
        • C:\temp\CreateProcess.exe
          C:\temp\CreateProcess.exe C:\Temp\zxrpkhczus.exe ups_run
          3⤵
            PID:908
            • C:\Temp\zxrpkhczus.exe
              C:\Temp\zxrpkhczus.exe ups_run
              4⤵
                PID:3940
                • C:\temp\CreateProcess.exe
                  C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
                  5⤵
                    PID:2996
                    • C:\windows\system32\ipconfig.exe
                      C:\windows\system32\ipconfig.exe /release
                      6⤵
                      • Gathers network information
                      PID:3096
              • C:\temp\CreateProcess.exe
                C:\temp\CreateProcess.exe C:\Temp\i_zxrpkhczus.exe ups_ins
                3⤵
                  PID:1980
                  • C:\Temp\i_zxrpkhczus.exe
                    C:\Temp\i_zxrpkhczus.exe ups_ins
                    4⤵
                    • Suspicious use of AdjustPrivilegeToken
                    PID:3820
                • C:\temp\CreateProcess.exe
                  C:\temp\CreateProcess.exe C:\Temp\wrpjhczurm.exe ups_run
                  3⤵
                    PID:3512
                    • C:\Temp\wrpjhczurm.exe
                      C:\Temp\wrpjhczurm.exe ups_run
                      4⤵
                        PID:628
                        • C:\temp\CreateProcess.exe
                          C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
                          5⤵
                            PID:3108
                            • C:\windows\system32\ipconfig.exe
                              C:\windows\system32\ipconfig.exe /release
                              6⤵
                              • Gathers network information
                              PID:2844
                      • C:\temp\CreateProcess.exe
                        C:\temp\CreateProcess.exe C:\Temp\i_wrpjhczurm.exe ups_ins
                        3⤵
                          PID:428
                          • C:\Temp\i_wrpjhczurm.exe
                            C:\Temp\i_wrpjhczurm.exe ups_ins
                            4⤵
                            • Suspicious use of AdjustPrivilegeToken
                            PID:2156
                        • C:\temp\CreateProcess.exe
                          C:\temp\CreateProcess.exe C:\Temp\omgezwrojh.exe ups_run
                          3⤵
                            PID:3564
                            • C:\Temp\omgezwrojh.exe
                              C:\Temp\omgezwrojh.exe ups_run
                              4⤵
                                PID:1472
                                • C:\temp\CreateProcess.exe
                                  C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
                                  5⤵
                                    PID:2128
                                    • C:\windows\system32\ipconfig.exe
                                      C:\windows\system32\ipconfig.exe /release
                                      6⤵
                                      • Gathers network information
                                      PID:3872
                              • C:\temp\CreateProcess.exe
                                C:\temp\CreateProcess.exe C:\Temp\i_omgezwrojh.exe ups_ins
                                3⤵
                                  PID:4088
                                  • C:\Temp\i_omgezwrojh.exe
                                    C:\Temp\i_omgezwrojh.exe ups_ins
                                    4⤵
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:4196
                                • C:\temp\CreateProcess.exe
                                  C:\temp\CreateProcess.exe C:\Temp\bwuomgeywr.exe ups_run
                                  3⤵
                                    PID:4668
                                    • C:\Temp\bwuomgeywr.exe
                                      C:\Temp\bwuomgeywr.exe ups_run
                                      4⤵
                                        PID:4980
                                        • C:\temp\CreateProcess.exe
                                          C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
                                          5⤵
                                            PID:1304
                                            • C:\windows\system32\ipconfig.exe
                                              C:\windows\system32\ipconfig.exe /release
                                              6⤵
                                              • Gathers network information
                                              PID:3416
                                      • C:\temp\CreateProcess.exe
                                        C:\temp\CreateProcess.exe C:\Temp\i_bwuomgeywr.exe ups_ins
                                        3⤵
                                          PID:1076
                                          • C:\Temp\i_bwuomgeywr.exe
                                            C:\Temp\i_bwuomgeywr.exe ups_ins
                                            4⤵
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:2612
                                        • C:\temp\CreateProcess.exe
                                          C:\temp\CreateProcess.exe C:\Temp\lgdywqoiga.exe ups_run
                                          3⤵
                                            PID:4360
                                            • C:\Temp\lgdywqoiga.exe
                                              C:\Temp\lgdywqoiga.exe ups_run
                                              4⤵
                                                PID:5116
                                                • C:\temp\CreateProcess.exe
                                                  C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
                                                  5⤵
                                                    PID:3908
                                                    • C:\windows\system32\ipconfig.exe
                                                      C:\windows\system32\ipconfig.exe /release
                                                      6⤵
                                                      • Gathers network information
                                                      PID:4080
                                              • C:\temp\CreateProcess.exe
                                                C:\temp\CreateProcess.exe C:\Temp\i_lgdywqoiga.exe ups_ins
                                                3⤵
                                                  PID:2596
                                                  • C:\Temp\i_lgdywqoiga.exe
                                                    C:\Temp\i_lgdywqoiga.exe ups_ins
                                                    4⤵
                                                    • Suspicious use of AdjustPrivilegeToken
                                                    PID:4716
                                                • C:\temp\CreateProcess.exe
                                                  C:\temp\CreateProcess.exe C:\Temp\wqoigaytql.exe ups_run
                                                  3⤵
                                                    PID:1836
                                                    • C:\Temp\wqoigaytql.exe
                                                      C:\Temp\wqoigaytql.exe ups_run
                                                      4⤵
                                                        PID:1852
                                                        • C:\temp\CreateProcess.exe
                                                          C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
                                                          5⤵
                                                            PID:828
                                                            • C:\windows\system32\ipconfig.exe
                                                              C:\windows\system32\ipconfig.exe /release
                                                              6⤵
                                                              • Gathers network information
                                                              PID:2200
                                                      • C:\temp\CreateProcess.exe
                                                        C:\temp\CreateProcess.exe C:\Temp\i_wqoigaytql.exe ups_ins
                                                        3⤵
                                                          PID:3044
                                                          • C:\Temp\i_wqoigaytql.exe
                                                            C:\Temp\i_wqoigaytql.exe ups_ins
                                                            4⤵
                                                            • Suspicious use of AdjustPrivilegeToken
                                                            PID:3360
                                                      • C:\Program Files\Internet Explorer\iexplore.exe
                                                        "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
                                                        2⤵
                                                        • Modifies Internet Explorer settings
                                                        • Suspicious behavior: GetForegroundWindowSpam
                                                        • Suspicious use of FindShellTrayWindow
                                                        • Suspicious use of SetWindowsHookEx
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:2180
                                                        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                                                          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2180 CREDAT:17410 /prefetch:2
                                                          3⤵
                                                          • Modifies Internet Explorer settings
                                                          • Suspicious use of SetWindowsHookEx
                                                          PID:4444
                                                    • C:\Windows\system32\svchost.exe
                                                      C:\Windows\system32\svchost.exe -k netsvcs -p -s seclogon
                                                      1⤵
                                                      • Suspicious use of NtCreateUserProcessOtherParentProcess
                                                      • Suspicious use of AdjustPrivilegeToken
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:1960

                                                    Network

                                                          MITRE ATT&CK Enterprise v6

                                                          Replay Monitor

                                                          Loading Replay Monitor...

                                                          Downloads

                                                          CreateProcess.exe
                                                          • Path C:\Temp\CreateProcess.exe
                                                          • Size 3KB
                                                          • SHA256 9812481ebbe126eb517158a1c507fef81500f0b3b8f574d056be0b2f29805631
                                                          • MD5 SHA1 SHA512
                                                          Submit Download

                                                          CreateProcess.exe
                                                          • Path C:\Temp\CreateProcess.exe
                                                          • Size 3KB
                                                          • SHA256 9812481ebbe126eb517158a1c507fef81500f0b3b8f574d056be0b2f29805631
                                                          • MD5 SHA1 SHA512
                                                          Submit Download

                                                          CreateProcess.exe
                                                          • Path C:\Temp\CreateProcess.exe
                                                          • Size 3KB
                                                          • SHA256 9812481ebbe126eb517158a1c507fef81500f0b3b8f574d056be0b2f29805631
                                                          • MD5 SHA1 SHA512
                                                          Submit Download

                                                          CreateProcess.exe
                                                          • Path C:\Temp\CreateProcess.exe
                                                          • Size 3KB
                                                          • SHA256 9812481ebbe126eb517158a1c507fef81500f0b3b8f574d056be0b2f29805631
                                                          • MD5 SHA1 SHA512
                                                          Submit Download

                                                          CreateProcess.exe
                                                          • Path C:\Temp\CreateProcess.exe
                                                          • Size 3KB
                                                          • SHA256 9812481ebbe126eb517158a1c507fef81500f0b3b8f574d056be0b2f29805631
                                                          • MD5 SHA1 SHA512
                                                          Submit Download

                                                          CreateProcess.exe
                                                          • Path C:\Temp\CreateProcess.exe
                                                          • Size 3KB
                                                          • SHA256 9812481ebbe126eb517158a1c507fef81500f0b3b8f574d056be0b2f29805631
                                                          • MD5 SHA1 SHA512
                                                          Submit Download

                                                          CreateProcess.exe
                                                          • Path C:\Temp\CreateProcess.exe
                                                          • Size 3KB
                                                          • SHA256 9812481ebbe126eb517158a1c507fef81500f0b3b8f574d056be0b2f29805631
                                                          • MD5 SHA1 SHA512
                                                          Submit Download

                                                          CreateProcess.exe
                                                          • Path C:\Temp\CreateProcess.exe
                                                          • Size 3KB
                                                          • SHA256 9812481ebbe126eb517158a1c507fef81500f0b3b8f574d056be0b2f29805631
                                                          • MD5 SHA1 SHA512
                                                          Submit Download

                                                          CreateProcess.exe
                                                          • Path C:\Temp\CreateProcess.exe
                                                          • Size 3KB
                                                          • SHA256 9812481ebbe126eb517158a1c507fef81500f0b3b8f574d056be0b2f29805631
                                                          • MD5 SHA1 SHA512
                                                          Submit Download

                                                          CreateProcess.exe
                                                          • Path C:\Temp\CreateProcess.exe
                                                          • Size 3KB
                                                          • SHA256 9812481ebbe126eb517158a1c507fef81500f0b3b8f574d056be0b2f29805631
                                                          • MD5 SHA1 SHA512
                                                          Submit Download

                                                          CreateProcess.exe
                                                          • Path C:\Temp\CreateProcess.exe
                                                          • Size 3KB
                                                          • SHA256 9812481ebbe126eb517158a1c507fef81500f0b3b8f574d056be0b2f29805631
                                                          • MD5 SHA1 SHA512
                                                          Submit Download

                                                          CreateProcess.exe
                                                          • Path C:\Temp\CreateProcess.exe
                                                          • Size 3KB
                                                          • SHA256 9812481ebbe126eb517158a1c507fef81500f0b3b8f574d056be0b2f29805631
                                                          • MD5 SHA1 SHA512
                                                          Submit Download

                                                          CreateProcess.exe
                                                          • Path C:\Temp\CreateProcess.exe
                                                          • Size 3KB
                                                          • SHA256 9812481ebbe126eb517158a1c507fef81500f0b3b8f574d056be0b2f29805631
                                                          • MD5 SHA1 SHA512
                                                          Submit Download

                                                          CreateProcess.exe
                                                          • Path C:\Temp\CreateProcess.exe
                                                          • Size 3KB
                                                          • SHA256 9812481ebbe126eb517158a1c507fef81500f0b3b8f574d056be0b2f29805631
                                                          • MD5 SHA1 SHA512
                                                          Submit Download

                                                          CreateProcess.exe
                                                          • Path C:\Temp\CreateProcess.exe
                                                          • Size 3KB
                                                          • SHA256 9812481ebbe126eb517158a1c507fef81500f0b3b8f574d056be0b2f29805631
                                                          • MD5 SHA1 SHA512
                                                          Submit Download

                                                          CreateProcess.exe
                                                          • Path C:\Temp\CreateProcess.exe
                                                          • Size 3KB
                                                          • SHA256 9812481ebbe126eb517158a1c507fef81500f0b3b8f574d056be0b2f29805631
                                                          • MD5 SHA1 SHA512
                                                          Submit Download

                                                          CreateProcess.exe
                                                          • Path C:\Temp\CreateProcess.exe
                                                          • Size 3KB
                                                          • SHA256 9812481ebbe126eb517158a1c507fef81500f0b3b8f574d056be0b2f29805631
                                                          • MD5 SHA1 SHA512
                                                          Submit Download

                                                          CreateProcess.exe
                                                          • Path C:\Temp\CreateProcess.exe
                                                          • Size 3KB
                                                          • SHA256 9812481ebbe126eb517158a1c507fef81500f0b3b8f574d056be0b2f29805631
                                                          • MD5 SHA1 SHA512
                                                          Submit Download

                                                          CreateProcess.exe
                                                          • Path C:\Temp\CreateProcess.exe
                                                          • Size 3KB
                                                          • SHA256 9812481ebbe126eb517158a1c507fef81500f0b3b8f574d056be0b2f29805631
                                                          • MD5 SHA1 SHA512
                                                          Submit Download

                                                          CreateProcess.exe
                                                          • Path C:\Temp\CreateProcess.exe
                                                          • Size 3KB
                                                          • SHA256 9812481ebbe126eb517158a1c507fef81500f0b3b8f574d056be0b2f29805631
                                                          • MD5 SHA1 SHA512
                                                          Submit Download

                                                          CreateProcess.exe
                                                          • Path C:\Temp\CreateProcess.exe
                                                          • Size 3KB
                                                          • SHA256 9812481ebbe126eb517158a1c507fef81500f0b3b8f574d056be0b2f29805631
                                                          • MD5 SHA1 SHA512
                                                          Submit Download

                                                          CreateProcess.exe
                                                          • Path C:\Temp\CreateProcess.exe
                                                          • Size 3KB
                                                          • SHA256 9812481ebbe126eb517158a1c507fef81500f0b3b8f574d056be0b2f29805631
                                                          • MD5 SHA1 SHA512
                                                          Submit Download

                                                          CreateProcess.exe
                                                          • Path C:\Temp\CreateProcess.exe
                                                          • Size 3KB
                                                          • SHA256 9812481ebbe126eb517158a1c507fef81500f0b3b8f574d056be0b2f29805631
                                                          • MD5 SHA1 SHA512
                                                          Submit Download

                                                          CreateProcess.exe
                                                          • Path C:\Temp\CreateProcess.exe
                                                          • Size 3KB
                                                          • SHA256 9812481ebbe126eb517158a1c507fef81500f0b3b8f574d056be0b2f29805631
                                                          • MD5 SHA1 SHA512
                                                          Submit Download

                                                          CreateProcess.exe
                                                          • Path C:\Temp\CreateProcess.exe
                                                          • Size 3KB
                                                          • SHA256 9812481ebbe126eb517158a1c507fef81500f0b3b8f574d056be0b2f29805631
                                                          • MD5 SHA1 SHA512
                                                          Submit Download

                                                          CreateProcess.exe
                                                          • Path C:\Temp\CreateProcess.exe
                                                          • Size 3KB
                                                          • SHA256 9812481ebbe126eb517158a1c507fef81500f0b3b8f574d056be0b2f29805631
                                                          • MD5 SHA1 SHA512
                                                          Submit Download

                                                          gaysqlidbv.exe
                                                          • Path C:\Temp\gaysqlidbv.exe
                                                          • Size 361KB
                                                          • SHA256 d1805fd691be2591b113b9667329131852fc3387047c4a03dfcadfe1f775b7ce
                                                          • MD5 SHA1 SHA512 SSDEEP
                                                          Submit Download

                                                          gaysqlidbv.exe
                                                          • Path C:\Temp\gaysqlidbv.exe
                                                          • Size 361KB
                                                          • SHA256 d1805fd691be2591b113b9667329131852fc3387047c4a03dfcadfe1f775b7ce
                                                          • MD5 SHA1 SHA512 SSDEEP
                                                          Submit Download

                                                          gezwrojhbz.exe
                                                          • Path C:\Temp\gezwrojhbz.exe
                                                          • Size 361KB
                                                          • SHA256 c46242607a7118c5fde60e2a62267359136f24ef950bb1d2875628c401256278
                                                          • MD5 SHA1 SHA512 SSDEEP
                                                          Submit Download

                                                          gezwrojhbz.exe
                                                          • Path C:\Temp\gezwrojhbz.exe
                                                          • Size 361KB
                                                          • SHA256 c46242607a7118c5fde60e2a62267359136f24ef950bb1d2875628c401256278
                                                          • MD5 SHA1 SHA512 SSDEEP
                                                          Submit Download

                                                          i_gaysqlidbv.exe
                                                          • Path C:\Temp\i_gaysqlidbv.exe
                                                          • Size 361KB
                                                          • SHA256 6ae386995ed828cbeee5ef2a9d6c0e1851b55243d12d3f3f51109e20f38c8250
                                                          • MD5 SHA1 SHA512 SSDEEP
                                                          Submit Download

                                                          i_gaysqlidbv.exe
                                                          • Path C:\Temp\i_gaysqlidbv.exe
                                                          • Size 361KB
                                                          • SHA256 6ae386995ed828cbeee5ef2a9d6c0e1851b55243d12d3f3f51109e20f38c8250
                                                          • MD5 SHA1 SHA512 SSDEEP
                                                          Submit Download

                                                          i_gezwrojhbz.exe
                                                          • Path C:\Temp\i_gezwrojhbz.exe
                                                          • Size 361KB
                                                          • SHA256 61c439d6a69ed40a0e1fdf9605ab894dab09cd5ecf070e75c6d74a65de2e1baf
                                                          • MD5 SHA1 SHA512 SSDEEP
                                                          Submit Download

                                                          i_gezwrojhbz.exe
                                                          • Path C:\Temp\i_gezwrojhbz.exe
                                                          • Size 361KB
                                                          • SHA256 61c439d6a69ed40a0e1fdf9605ab894dab09cd5ecf070e75c6d74a65de2e1baf
                                                          • MD5 SHA1 SHA512 SSDEEP
                                                          Submit Download

                                                          i_khcausmkec.exe
                                                          • Path C:\Temp\i_khcausmkec.exe
                                                          • Size 361KB
                                                          • SHA256 59377815ed6fbf86dd9260a0249c6b5d55d8eda983e17f0eda18ae991b994c5e
                                                          • MD5 SHA1 SHA512 SSDEEP
                                                          Submit Download

                                                          i_khcausmkec.exe
                                                          • Path C:\Temp\i_khcausmkec.exe
                                                          • Size 361KB
                                                          • SHA256 59377815ed6fbf86dd9260a0249c6b5d55d8eda983e17f0eda18ae991b994c5e
                                                          • MD5 SHA1 SHA512 SSDEEP
                                                          Submit Download

                                                          i_kicausnkfc.exe
                                                          • Path C:\Temp\i_kicausnkfc.exe
                                                          • Size 361KB
                                                          • SHA256 146d94f8ead19a4e82410dafed29404eef7f9c5b022806e398b30e68ad38bc4e
                                                          • MD5 SHA1 SHA512 SSDEEP
                                                          Submit Download

                                                          i_kicausnkfc.exe
                                                          • Path C:\Temp\i_kicausnkfc.exe
                                                          • Size 361KB
                                                          • SHA256 146d94f8ead19a4e82410dafed29404eef7f9c5b022806e398b30e68ad38bc4e
                                                          • MD5 SHA1 SHA512 SSDEEP
                                                          Submit Download

                                                          i_lfdxvqniga.exe
                                                          • Path C:\Temp\i_lfdxvqniga.exe
                                                          • Size 361KB
                                                          • SHA256 2c48b19edc76de7aba86b9b5df4cc901ff74b1423562a147a59d576d2d93fd81
                                                          • MD5 SHA1 SHA512 SSDEEP
                                                          Submit Download

                                                          i_lfdxvqniga.exe
                                                          • Path C:\Temp\i_lfdxvqniga.exe
                                                          • Size 361KB
                                                          • SHA256 2c48b19edc76de7aba86b9b5df4cc901ff74b1423562a147a59d576d2d93fd81
                                                          • MD5 SHA1 SHA512 SSDEEP
                                                          Submit Download

                                                          i_wqojgbztrl.exe
                                                          • Path C:\Temp\i_wqojgbztrl.exe
                                                          • Size 361KB
                                                          • SHA256 d44b5ae44ea9c55281a57305929748cf1f4d0a3c4deac001f0fb4cde9167cc36
                                                          • MD5 SHA1 SHA512 SSDEEP
                                                          Submit Download

                                                          i_wqojgbztrl.exe
                                                          • Path C:\Temp\i_wqojgbztrl.exe
                                                          • Size 361KB
                                                          • SHA256 d44b5ae44ea9c55281a57305929748cf1f4d0a3c4deac001f0fb4cde9167cc36
                                                          • MD5 SHA1 SHA512 SSDEEP
                                                          Submit Download

                                                          i_yvqoigaytq.exe
                                                          • Path C:\Temp\i_yvqoigaytq.exe
                                                          • Size 361KB
                                                          • SHA256 a4950db5e6583b134a15526a64d91888d32378a47a26296784dd157e4c971609
                                                          • MD5 SHA1 SHA512 SSDEEP
                                                          Submit Download

                                                          i_yvqoigaytq.exe
                                                          • Path C:\Temp\i_yvqoigaytq.exe
                                                          • Size 361KB
                                                          • SHA256 a4950db5e6583b134a15526a64d91888d32378a47a26296784dd157e4c971609
                                                          • MD5 SHA1 SHA512 SSDEEP
                                                          Submit Download

                                                          i_zxrpjhbzur.exe
                                                          • Path C:\Temp\i_zxrpjhbzur.exe
                                                          • Size 361KB
                                                          • SHA256 3073b672ae5f3a3650be6798e95ef25eb4de8e907a94833dcdf8e31b2453d10b
                                                          • MD5 SHA1 SHA512 SSDEEP
                                                          Submit Download

                                                          i_zxrpjhbzur.exe
                                                          • Path C:\Temp\i_zxrpjhbzur.exe
                                                          • Size 361KB
                                                          • SHA256 3073b672ae5f3a3650be6798e95ef25eb4de8e907a94833dcdf8e31b2453d10b
                                                          • MD5 SHA1 SHA512 SSDEEP
                                                          Submit Download

                                                          khcausmkec.exe
                                                          • Path C:\Temp\khcausmkec.exe
                                                          • Size 361KB
                                                          • SHA256 fe0cb5ac57455763b5b5baf45413a0a54ebcc2e7a64feb6e3f38bedc8aa92521
                                                          • MD5 SHA1 SHA512 SSDEEP
                                                          Submit Download

                                                          khcausmkec.exe
                                                          • Path C:\Temp\khcausmkec.exe
                                                          • Size 361KB
                                                          • SHA256 fe0cb5ac57455763b5b5baf45413a0a54ebcc2e7a64feb6e3f38bedc8aa92521
                                                          • MD5 SHA1 SHA512 SSDEEP
                                                          Submit Download

                                                          kicausnkfc.exe
                                                          • Path C:\Temp\kicausnkfc.exe
                                                          • Size 361KB
                                                          • SHA256 e731159da8c20157ee8c7f4fd7bc6e40a7b09f52db6377c818bb05169f5ae400
                                                          • MD5 SHA1 SHA512 SSDEEP
                                                          Submit Download

                                                          kicausnkfc.exe
                                                          • Path C:\Temp\kicausnkfc.exe
                                                          • Size 361KB
                                                          • SHA256 e731159da8c20157ee8c7f4fd7bc6e40a7b09f52db6377c818bb05169f5ae400
                                                          • MD5 SHA1 SHA512 SSDEEP
                                                          Submit Download

                                                          lfdxvqniga.exe
                                                          • Path C:\Temp\lfdxvqniga.exe
                                                          • Size 361KB
                                                          • SHA256 60f1b2a82da5e57ea2d7840ba3e1c858f551ab6f56217d55ad5aa1cca1285fe9
                                                          • MD5 SHA1 SHA512 SSDEEP
                                                          Submit Download

                                                          lfdxvqniga.exe
                                                          • Path C:\Temp\lfdxvqniga.exe
                                                          • Size 361KB
                                                          • SHA256 60f1b2a82da5e57ea2d7840ba3e1c858f551ab6f56217d55ad5aa1cca1285fe9
                                                          • MD5 SHA1 SHA512 SSDEEP
                                                          Submit Download

                                                          ljebwtomge.exe
                                                          • Path C:\Temp\ljebwtomge.exe
                                                          • Size 361KB
                                                          • SHA256 53a50c012c60b1e40ab6b319c29571bbc313bdf258fa54ee89cc15aef94c7398
                                                          • MD5 SHA1 SHA512 SSDEEP
                                                          Submit Download

                                                          wqojgbztrl.exe
                                                          • Path C:\Temp\wqojgbztrl.exe
                                                          • Size 361KB
                                                          • SHA256 4e1cd902da31a8f63e41b0f1e9741980393bf89e4c6505a404f074d5e638485c
                                                          • MD5 SHA1 SHA512 SSDEEP
                                                          Submit Download

                                                          wqojgbztrl.exe
                                                          • Path C:\Temp\wqojgbztrl.exe
                                                          • Size 361KB
                                                          • SHA256 4e1cd902da31a8f63e41b0f1e9741980393bf89e4c6505a404f074d5e638485c
                                                          • MD5 SHA1 SHA512 SSDEEP
                                                          Submit Download

                                                          wtomgeywrojgbztr.exe
                                                          • Path C:\Temp\wtomgeywrojgbztr.exe
                                                          • Size 361KB
                                                          • SHA256 f97b8780a767039120eb801b788516b18aae52c052f299960286e185fbbb6be2
                                                          • MD5 SHA1 SHA512 SSDEEP
                                                          Submit Download

                                                          wtomgeywrojgbztr.exe
                                                          • Path C:\Temp\wtomgeywrojgbztr.exe
                                                          • Size 361KB
                                                          • SHA256 f97b8780a767039120eb801b788516b18aae52c052f299960286e185fbbb6be2
                                                          • MD5 SHA1 SHA512 SSDEEP
                                                          Submit Download

                                                          yvqoigaytq.exe
                                                          • Path C:\Temp\yvqoigaytq.exe
                                                          • Size 361KB
                                                          • SHA256 19cfd6a8c496e0fcf9a9af1a9d05c89540c4713a558f51453209918b67608d9c
                                                          • MD5 SHA1 SHA512 SSDEEP
                                                          Submit Download

                                                          yvqoigaytq.exe
                                                          • Path C:\Temp\yvqoigaytq.exe
                                                          • Size 361KB
                                                          • SHA256 19cfd6a8c496e0fcf9a9af1a9d05c89540c4713a558f51453209918b67608d9c
                                                          • MD5 SHA1 SHA512 SSDEEP
                                                          Submit Download

                                                          zxrpjhbzur.exe
                                                          • Path C:\Temp\zxrpjhbzur.exe
                                                          • Size 361KB
                                                          • SHA256 e47259df1f303d592e973ecc4008aa391a063d128639cc8bf7ee4a1c5d15e543
                                                          • MD5 SHA1 SHA512 SSDEEP
                                                          Submit Download

                                                          zxrpjhbzur.exe
                                                          • Path C:\Temp\zxrpjhbzur.exe
                                                          • Size 361KB
                                                          • SHA256 e47259df1f303d592e973ecc4008aa391a063d128639cc8bf7ee4a1c5d15e543
                                                          • MD5 SHA1 SHA512 SSDEEP
                                                          Submit Download

                                                          7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
                                                          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
                                                          • Size 471B
                                                          • SHA256 980abeaa872503211925db8acf8bdcdff0bc3c6deb2182fd698f6a444d2625be
                                                          • MD5 SHA1 SHA512
                                                          Submit Download

                                                          7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
                                                          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
                                                          • Size 434B
                                                          • SHA256 328b58bb15d09c7f88ddc4c3d2b29ba64e14ca7049053b4e00d7ebd24cceadfd
                                                          • MD5 SHA1 SHA512
                                                          Submit Download

                                                          CreateProcess.exe
                                                          • Path C:\temp\CreateProcess.exe
                                                          • Size 3KB
                                                          • SHA256 9812481ebbe126eb517158a1c507fef81500f0b3b8f574d056be0b2f29805631
                                                          • MD5 SHA1 SHA512
                                                          Submit Download