87d742e118752759069d49307aca2d83d3e4f5da05f891e15bc1882814ec8a6a

General

Target

87d742e118752759069d49307aca2d83d3e4f5da05f891e15bc1882814ec8a6a.exe
Size

88KB
MD5

a33a0aedfa094aadd074015b2207db86
SHA1

dcb5102ef86fa89b31adedcdee1991616b4ce389
SHA256

87d742e118752759069d49307aca2d83d3e4f5da05f891e15bc1882814ec8a6a
SHA512

6d30a62b77a502971b09457eb2ff48441364b6c6c851b249d7d3ff9f7107a76b976720e0594745fb7c1af8163a62c0fe7ce7a53dbf2ea5dfd2a3be5ea73e55ff
SSDEEP

768:fDFIzMsddaqnObOasGEwU8Z1Rbe2kjEQJQ1H7a8zFkzqcwuHW:JIYZiCU8Z1QjEQJecwuHW

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Processes:

baoge.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	baoge.exe

Executes dropped EXE 1 IoCs

Processes:

baoge.exe

pid process

1316 baoge.exe

Loads dropped DLL 2 IoCs

Processes:

87d742e118752759069d49307aca2d83d3e4f5da05f891e15bc1882814ec8a6a.exe

pid	process
1676	87d742e118752759069d49307aca2d83d3e4f5da05f891e15bc1882814ec8a6a.exe
1676	87d742e118752759069d49307aca2d83d3e4f5da05f891e15bc1882814ec8a6a.exe

Adds Run key to start application 2 TTPs 48 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

baoge.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\baoge = "C:\\Users\\Admin\\baoge.exe /r"	baoge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\baoge = "C:\\Users\\Admin\\baoge.exe /D"	baoge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\baoge = "C:\\Users\\Admin\\baoge.exe /q"	baoge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\baoge = "C:\\Users\\Admin\\baoge.exe /p"	baoge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\baoge = "C:\\Users\\Admin\\baoge.exe /o"	baoge.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\	baoge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\baoge = "C:\\Users\\Admin\\baoge.exe /G"	baoge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\baoge = "C:\\Users\\Admin\\baoge.exe /P"	baoge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\baoge = "C:\\Users\\Admin\\baoge.exe /S"	baoge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\baoge = "C:\\Users\\Admin\\baoge.exe /R"	baoge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\baoge = "C:\\Users\\Admin\\baoge.exe /i"	baoge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\baoge = "C:\\Users\\Admin\\baoge.exe /C"	baoge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\baoge = "C:\\Users\\Admin\\baoge.exe /m"	baoge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\baoge = "C:\\Users\\Admin\\baoge.exe /Q"	baoge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\baoge = "C:\\Users\\Admin\\baoge.exe /M"	baoge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\baoge = "C:\\Users\\Admin\\baoge.exe /F"	baoge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\baoge = "C:\\Users\\Admin\\baoge.exe /J"	baoge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\baoge = "C:\\Users\\Admin\\baoge.exe /v"	baoge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\baoge = "C:\\Users\\Admin\\baoge.exe /b"	baoge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\baoge = "C:\\Users\\Admin\\baoge.exe /O"	baoge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\baoge = "C:\\Users\\Admin\\baoge.exe /c"	baoge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\baoge = "C:\\Users\\Admin\\baoge.exe /X"	baoge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\baoge = "C:\\Users\\Admin\\baoge.exe /H"	baoge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\baoge = "C:\\Users\\Admin\\baoge.exe /Y"	baoge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\baoge = "C:\\Users\\Admin\\baoge.exe /L"	baoge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\baoge = "C:\\Users\\Admin\\baoge.exe /h"	baoge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\baoge = "C:\\Users\\Admin\\baoge.exe /w"	baoge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\baoge = "C:\\Users\\Admin\\baoge.exe /f"	baoge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\baoge = "C:\\Users\\Admin\\baoge.exe /Z"	baoge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\baoge = "C:\\Users\\Admin\\baoge.exe /W"	baoge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\baoge = "C:\\Users\\Admin\\baoge.exe /a"	baoge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\baoge = "C:\\Users\\Admin\\baoge.exe /E"	baoge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\baoge = "C:\\Users\\Admin\\baoge.exe /k"	baoge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\baoge = "C:\\Users\\Admin\\baoge.exe /x"	baoge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\baoge = "C:\\Users\\Admin\\baoge.exe /j"	baoge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\baoge = "C:\\Users\\Admin\\baoge.exe /t"	baoge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\baoge = "C:\\Users\\Admin\\baoge.exe /l"	baoge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\baoge = "C:\\Users\\Admin\\baoge.exe /y"	baoge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\baoge = "C:\\Users\\Admin\\baoge.exe /z"	baoge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\baoge = "C:\\Users\\Admin\\baoge.exe /e"	baoge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\baoge = "C:\\Users\\Admin\\baoge.exe /N"	baoge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\baoge = "C:\\Users\\Admin\\baoge.exe /U"	baoge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\baoge = "C:\\Users\\Admin\\baoge.exe /u"	baoge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\baoge = "C:\\Users\\Admin\\baoge.exe /A"	baoge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\baoge = "C:\\Users\\Admin\\baoge.exe /g"	baoge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\baoge = "C:\\Users\\Admin\\baoge.exe /B"	baoge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\baoge = "C:\\Users\\Admin\\baoge.exe /d"	baoge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\baoge = "C:\\Users\\Admin\\baoge.exe /n"	baoge.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

baoge.exe

pid	process
1316	baoge.exe
1316	baoge.exe
1316	baoge.exe
1316	baoge.exe
1316	baoge.exe
1316	baoge.exe
1316	baoge.exe
1316	baoge.exe
1316	baoge.exe
1316	baoge.exe
1316	baoge.exe
1316	baoge.exe
1316	baoge.exe
1316	baoge.exe
1316	baoge.exe
1316	baoge.exe
1316	baoge.exe
1316	baoge.exe
1316	baoge.exe
1316	baoge.exe
1316	baoge.exe
1316	baoge.exe
1316	baoge.exe
1316	baoge.exe
1316	baoge.exe
1316	baoge.exe
1316	baoge.exe
1316	baoge.exe
1316	baoge.exe
1316	baoge.exe
1316	baoge.exe
1316	baoge.exe
1316	baoge.exe
1316	baoge.exe
1316	baoge.exe
1316	baoge.exe
1316	baoge.exe
1316	baoge.exe
1316	baoge.exe
1316	baoge.exe
1316	baoge.exe
1316	baoge.exe
1316	baoge.exe
1316	baoge.exe
1316	baoge.exe
1316	baoge.exe
1316	baoge.exe
1316	baoge.exe
1316	baoge.exe
1316	baoge.exe
1316	baoge.exe
1316	baoge.exe
1316	baoge.exe
1316	baoge.exe
1316	baoge.exe
1316	baoge.exe
1316	baoge.exe
1316	baoge.exe
1316	baoge.exe
1316	baoge.exe
1316	baoge.exe
1316	baoge.exe
1316	baoge.exe
1316	baoge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

87d742e118752759069d49307aca2d83d3e4f5da05f891e15bc1882814ec8a6a.exebaoge.exe

pid process

1676 87d742e118752759069d49307aca2d83d3e4f5da05f891e15bc1882814ec8a6a.exe
1316 baoge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

87d742e118752759069d49307aca2d83d3e4f5da05f891e15bc1882814ec8a6a.exebaoge.exe

description	pid	process	target process
PID 1676 wrote to memory of 1316	1676	87d742e118752759069d49307aca2d83d3e4f5da05f891e15bc1882814ec8a6a.exe	baoge.exe
PID 1676 wrote to memory of 1316	1676	87d742e118752759069d49307aca2d83d3e4f5da05f891e15bc1882814ec8a6a.exe	baoge.exe
PID 1676 wrote to memory of 1316	1676	87d742e118752759069d49307aca2d83d3e4f5da05f891e15bc1882814ec8a6a.exe	baoge.exe
PID 1676 wrote to memory of 1316	1676	87d742e118752759069d49307aca2d83d3e4f5da05f891e15bc1882814ec8a6a.exe	baoge.exe
PID 1316 wrote to memory of 1676	1316	baoge.exe	87d742e118752759069d49307aca2d83d3e4f5da05f891e15bc1882814ec8a6a.exe
PID 1316 wrote to memory of 1676	1316	baoge.exe	87d742e118752759069d49307aca2d83d3e4f5da05f891e15bc1882814ec8a6a.exe
PID 1316 wrote to memory of 1676	1316	baoge.exe	87d742e118752759069d49307aca2d83d3e4f5da05f891e15bc1882814ec8a6a.exe
PID 1316 wrote to memory of 1676	1316	baoge.exe	87d742e118752759069d49307aca2d83d3e4f5da05f891e15bc1882814ec8a6a.exe
PID 1316 wrote to memory of 1676	1316	baoge.exe	87d742e118752759069d49307aca2d83d3e4f5da05f891e15bc1882814ec8a6a.exe
PID 1316 wrote to memory of 1676	1316	baoge.exe	87d742e118752759069d49307aca2d83d3e4f5da05f891e15bc1882814ec8a6a.exe
PID 1316 wrote to memory of 1676	1316	baoge.exe	87d742e118752759069d49307aca2d83d3e4f5da05f891e15bc1882814ec8a6a.exe
PID 1316 wrote to memory of 1676	1316	baoge.exe	87d742e118752759069d49307aca2d83d3e4f5da05f891e15bc1882814ec8a6a.exe
PID 1316 wrote to memory of 1676	1316	baoge.exe	87d742e118752759069d49307aca2d83d3e4f5da05f891e15bc1882814ec8a6a.exe
PID 1316 wrote to memory of 1676	1316	baoge.exe	87d742e118752759069d49307aca2d83d3e4f5da05f891e15bc1882814ec8a6a.exe
PID 1316 wrote to memory of 1676	1316	baoge.exe	87d742e118752759069d49307aca2d83d3e4f5da05f891e15bc1882814ec8a6a.exe
PID 1316 wrote to memory of 1676	1316	baoge.exe	87d742e118752759069d49307aca2d83d3e4f5da05f891e15bc1882814ec8a6a.exe
PID 1316 wrote to memory of 1676	1316	baoge.exe	87d742e118752759069d49307aca2d83d3e4f5da05f891e15bc1882814ec8a6a.exe
PID 1316 wrote to memory of 1676	1316	baoge.exe	87d742e118752759069d49307aca2d83d3e4f5da05f891e15bc1882814ec8a6a.exe
PID 1316 wrote to memory of 1676	1316	baoge.exe	87d742e118752759069d49307aca2d83d3e4f5da05f891e15bc1882814ec8a6a.exe
PID 1316 wrote to memory of 1676	1316	baoge.exe	87d742e118752759069d49307aca2d83d3e4f5da05f891e15bc1882814ec8a6a.exe
PID 1316 wrote to memory of 1676	1316	baoge.exe	87d742e118752759069d49307aca2d83d3e4f5da05f891e15bc1882814ec8a6a.exe
PID 1316 wrote to memory of 1676	1316	baoge.exe	87d742e118752759069d49307aca2d83d3e4f5da05f891e15bc1882814ec8a6a.exe
PID 1316 wrote to memory of 1676	1316	baoge.exe	87d742e118752759069d49307aca2d83d3e4f5da05f891e15bc1882814ec8a6a.exe
PID 1316 wrote to memory of 1676	1316	baoge.exe	87d742e118752759069d49307aca2d83d3e4f5da05f891e15bc1882814ec8a6a.exe
PID 1316 wrote to memory of 1676	1316	baoge.exe	87d742e118752759069d49307aca2d83d3e4f5da05f891e15bc1882814ec8a6a.exe
PID 1316 wrote to memory of 1676	1316	baoge.exe	87d742e118752759069d49307aca2d83d3e4f5da05f891e15bc1882814ec8a6a.exe
PID 1316 wrote to memory of 1676	1316	baoge.exe	87d742e118752759069d49307aca2d83d3e4f5da05f891e15bc1882814ec8a6a.exe
PID 1316 wrote to memory of 1676	1316	baoge.exe	87d742e118752759069d49307aca2d83d3e4f5da05f891e15bc1882814ec8a6a.exe
PID 1316 wrote to memory of 1676	1316	baoge.exe	87d742e118752759069d49307aca2d83d3e4f5da05f891e15bc1882814ec8a6a.exe
PID 1316 wrote to memory of 1676	1316	baoge.exe	87d742e118752759069d49307aca2d83d3e4f5da05f891e15bc1882814ec8a6a.exe
PID 1316 wrote to memory of 1676	1316	baoge.exe	87d742e118752759069d49307aca2d83d3e4f5da05f891e15bc1882814ec8a6a.exe
PID 1316 wrote to memory of 1676	1316	baoge.exe	87d742e118752759069d49307aca2d83d3e4f5da05f891e15bc1882814ec8a6a.exe
PID 1316 wrote to memory of 1676	1316	baoge.exe	87d742e118752759069d49307aca2d83d3e4f5da05f891e15bc1882814ec8a6a.exe
PID 1316 wrote to memory of 1676	1316	baoge.exe	87d742e118752759069d49307aca2d83d3e4f5da05f891e15bc1882814ec8a6a.exe
PID 1316 wrote to memory of 1676	1316	baoge.exe	87d742e118752759069d49307aca2d83d3e4f5da05f891e15bc1882814ec8a6a.exe
PID 1316 wrote to memory of 1676	1316	baoge.exe	87d742e118752759069d49307aca2d83d3e4f5da05f891e15bc1882814ec8a6a.exe
PID 1316 wrote to memory of 1676	1316	baoge.exe	87d742e118752759069d49307aca2d83d3e4f5da05f891e15bc1882814ec8a6a.exe
PID 1316 wrote to memory of 1676	1316	baoge.exe	87d742e118752759069d49307aca2d83d3e4f5da05f891e15bc1882814ec8a6a.exe
PID 1316 wrote to memory of 1676	1316	baoge.exe	87d742e118752759069d49307aca2d83d3e4f5da05f891e15bc1882814ec8a6a.exe
PID 1316 wrote to memory of 1676	1316	baoge.exe	87d742e118752759069d49307aca2d83d3e4f5da05f891e15bc1882814ec8a6a.exe
PID 1316 wrote to memory of 1676	1316	baoge.exe	87d742e118752759069d49307aca2d83d3e4f5da05f891e15bc1882814ec8a6a.exe
PID 1316 wrote to memory of 1676	1316	baoge.exe	87d742e118752759069d49307aca2d83d3e4f5da05f891e15bc1882814ec8a6a.exe
PID 1316 wrote to memory of 1676	1316	baoge.exe	87d742e118752759069d49307aca2d83d3e4f5da05f891e15bc1882814ec8a6a.exe
PID 1316 wrote to memory of 1676	1316	baoge.exe	87d742e118752759069d49307aca2d83d3e4f5da05f891e15bc1882814ec8a6a.exe
PID 1316 wrote to memory of 1676	1316	baoge.exe	87d742e118752759069d49307aca2d83d3e4f5da05f891e15bc1882814ec8a6a.exe
PID 1316 wrote to memory of 1676	1316	baoge.exe	87d742e118752759069d49307aca2d83d3e4f5da05f891e15bc1882814ec8a6a.exe
PID 1316 wrote to memory of 1676	1316	baoge.exe	87d742e118752759069d49307aca2d83d3e4f5da05f891e15bc1882814ec8a6a.exe
PID 1316 wrote to memory of 1676	1316	baoge.exe	87d742e118752759069d49307aca2d83d3e4f5da05f891e15bc1882814ec8a6a.exe
PID 1316 wrote to memory of 1676	1316	baoge.exe	87d742e118752759069d49307aca2d83d3e4f5da05f891e15bc1882814ec8a6a.exe
PID 1316 wrote to memory of 1676	1316	baoge.exe	87d742e118752759069d49307aca2d83d3e4f5da05f891e15bc1882814ec8a6a.exe
PID 1316 wrote to memory of 1676	1316	baoge.exe	87d742e118752759069d49307aca2d83d3e4f5da05f891e15bc1882814ec8a6a.exe
PID 1316 wrote to memory of 1676	1316	baoge.exe	87d742e118752759069d49307aca2d83d3e4f5da05f891e15bc1882814ec8a6a.exe
PID 1316 wrote to memory of 1676	1316	baoge.exe	87d742e118752759069d49307aca2d83d3e4f5da05f891e15bc1882814ec8a6a.exe
PID 1316 wrote to memory of 1676	1316	baoge.exe	87d742e118752759069d49307aca2d83d3e4f5da05f891e15bc1882814ec8a6a.exe
PID 1316 wrote to memory of 1676	1316	baoge.exe	87d742e118752759069d49307aca2d83d3e4f5da05f891e15bc1882814ec8a6a.exe
PID 1316 wrote to memory of 1676	1316	baoge.exe	87d742e118752759069d49307aca2d83d3e4f5da05f891e15bc1882814ec8a6a.exe
PID 1316 wrote to memory of 1676	1316	baoge.exe	87d742e118752759069d49307aca2d83d3e4f5da05f891e15bc1882814ec8a6a.exe
PID 1316 wrote to memory of 1676	1316	baoge.exe	87d742e118752759069d49307aca2d83d3e4f5da05f891e15bc1882814ec8a6a.exe
PID 1316 wrote to memory of 1676	1316	baoge.exe	87d742e118752759069d49307aca2d83d3e4f5da05f891e15bc1882814ec8a6a.exe
PID 1316 wrote to memory of 1676	1316	baoge.exe	87d742e118752759069d49307aca2d83d3e4f5da05f891e15bc1882814ec8a6a.exe
PID 1316 wrote to memory of 1676	1316	baoge.exe	87d742e118752759069d49307aca2d83d3e4f5da05f891e15bc1882814ec8a6a.exe
PID 1316 wrote to memory of 1676	1316	baoge.exe	87d742e118752759069d49307aca2d83d3e4f5da05f891e15bc1882814ec8a6a.exe
PID 1316 wrote to memory of 1676	1316	baoge.exe	87d742e118752759069d49307aca2d83d3e4f5da05f891e15bc1882814ec8a6a.exe
PID 1316 wrote to memory of 1676	1316	baoge.exe	87d742e118752759069d49307aca2d83d3e4f5da05f891e15bc1882814ec8a6a.exe

C:\Users\Admin\AppData\Local\Temp\87d742e118752759069d49307aca2d83d3e4f5da05f891e15bc1882814ec8a6a.exe
"C:\Users\Admin\AppData\Local\Temp\87d742e118752759069d49307aca2d83d3e4f5da05f891e15bc1882814ec8a6a.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1676

C:\Users\Admin\baoge.exe
"C:\Users\Admin\baoge.exe"
2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1316

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

1

T1158

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\baoge.exe

Filesize
88KB

MD5
66114c7434eb290373fb55be813bf848

SHA1
af385fde7d3aee8e6b50465f6497b6ad75331bb2

SHA256
bb242ae16385b3297e6ea1badaed35bde596ade19324678fc3bd09002f92235e

SHA512
a1ebe0686fd2a989021fa28a9060f462d12e2d266b738b80ca0a01d8bb093ce8ceab11eab0a7b3800904fc1d0f685e2215bacfec556ac02d982f4fc8f2748ac9

Download Submit
C:\Users\Admin\baoge.exe

Filesize
88KB

MD5
66114c7434eb290373fb55be813bf848

SHA1
af385fde7d3aee8e6b50465f6497b6ad75331bb2

SHA256
bb242ae16385b3297e6ea1badaed35bde596ade19324678fc3bd09002f92235e

SHA512
a1ebe0686fd2a989021fa28a9060f462d12e2d266b738b80ca0a01d8bb093ce8ceab11eab0a7b3800904fc1d0f685e2215bacfec556ac02d982f4fc8f2748ac9

Download Submit
\Users\Admin\baoge.exe

Filesize
88KB

MD5
66114c7434eb290373fb55be813bf848

SHA1
af385fde7d3aee8e6b50465f6497b6ad75331bb2

SHA256
bb242ae16385b3297e6ea1badaed35bde596ade19324678fc3bd09002f92235e

SHA512
a1ebe0686fd2a989021fa28a9060f462d12e2d266b738b80ca0a01d8bb093ce8ceab11eab0a7b3800904fc1d0f685e2215bacfec556ac02d982f4fc8f2748ac9

Download Submit
\Users\Admin\baoge.exe

Filesize
88KB

MD5
66114c7434eb290373fb55be813bf848

SHA1
af385fde7d3aee8e6b50465f6497b6ad75331bb2

SHA256
bb242ae16385b3297e6ea1badaed35bde596ade19324678fc3bd09002f92235e

SHA512
a1ebe0686fd2a989021fa28a9060f462d12e2d266b738b80ca0a01d8bb093ce8ceab11eab0a7b3800904fc1d0f685e2215bacfec556ac02d982f4fc8f2748ac9

Download Submit
memory/1316-59-0x0000000000000000-mapping.dmp

Download
memory/1676-56-0x0000000075C81000-0x0000000075C83000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads