Analysis
-
max time kernel
152s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
25-11-2022 21:17
Static task
static1
Behavioral task
behavioral1
Sample
87d837993cf1c55bb6d7c46f7e6c426388e249b477e141f96e539fa7e848955d.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
87d837993cf1c55bb6d7c46f7e6c426388e249b477e141f96e539fa7e848955d.exe
Resource
win10v2004-20220812-en
General
-
Target
87d837993cf1c55bb6d7c46f7e6c426388e249b477e141f96e539fa7e848955d.exe
-
Size
549KB
-
MD5
6b50e5b32b3937cbb107825a144f7bc8
-
SHA1
492171452790445697106f1e8463cf74f8fc8b62
-
SHA256
87d837993cf1c55bb6d7c46f7e6c426388e249b477e141f96e539fa7e848955d
-
SHA512
8fe177ec002f63fce2ebb24c1292a3b810207b022f9fb42f310a625b2d7fc6bfb5360ad9dd1e06eb881a025e8f929682b3942fab2c80cd1c347abc808f8aba04
-
SSDEEP
12288:8ooGf9Y1Jop3A3IoCoj7+vjQxfibQQwwo:B+wp31Xoj79Kbbwj
Malware Config
Extracted
pony
http://www.indianmoneybag.in/wordpress/wp-content/themes/twentyfourteen/css/php/gate.php
Signatures
-
Executes dropped EXE 4 IoCs
Processes:
OGOAN.exeahike.exeOGOAN.exeahike.exepid process 4712 OGOAN.exe 4492 ahike.exe 1376 OGOAN.exe 3420 ahike.exe -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\OGOAN.exe upx C:\Users\Admin\AppData\Local\Temp\OGOAN.exe upx behavioral2/memory/4712-138-0x0000000000400000-0x000000000041D000-memory.dmp upx C:\Users\Admin\AppData\Local\Temp\OGOAN.exe upx behavioral2/memory/1376-145-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral2/memory/1376-156-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral2/memory/4712-163-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral2/memory/1376-164-0x0000000000400000-0x000000000041D000-memory.dmp upx -
Checks computer location settings 2 TTPs 4 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
87d837993cf1c55bb6d7c46f7e6c426388e249b477e141f96e539fa7e848955d.exeahike.exeOGOAN.exeOGOAN.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation 87d837993cf1c55bb6d7c46f7e6c426388e249b477e141f96e539fa7e848955d.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation ahike.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation OGOAN.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation OGOAN.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook accounts 1 TTPs 2 IoCs
Processes:
OGOAN.exeOGOAN.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts OGOAN.exe Key opened \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts OGOAN.exe -
Accesses Microsoft Outlook profiles 1 TTPs 2 IoCs
Processes:
OGOAN.exeOGOAN.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook OGOAN.exe Key opened \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook OGOAN.exe -
Adds Run key to start application 2 TTPs 3 IoCs
Processes:
ahike.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\Currentversion\Run ahike.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\Currentversion\Run ahike.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Unakigibys = "C:\\Users\\Admin\\AppData\\Roaming\\Didazo\\ahike.exe" ahike.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 4 IoCs
Processes:
87d837993cf1c55bb6d7c46f7e6c426388e249b477e141f96e539fa7e848955d.exeahike.exeOGOAN.exeOGOAN.exedescription pid process target process PID 4808 set thread context of 4756 4808 87d837993cf1c55bb6d7c46f7e6c426388e249b477e141f96e539fa7e848955d.exe 87d837993cf1c55bb6d7c46f7e6c426388e249b477e141f96e539fa7e848955d.exe PID 4492 set thread context of 3420 4492 ahike.exe ahike.exe PID 4712 set thread context of 1480 4712 OGOAN.exe cmd.exe PID 1376 set thread context of 5088 1376 OGOAN.exe cmd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Processes:
OGOAN.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Privacy OGOAN.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Privacy\CleanCookies = "0" OGOAN.exe -
Suspicious behavior: EnumeratesProcesses 50 IoCs
Processes:
ahike.exepid process 3420 ahike.exe 3420 ahike.exe 3420 ahike.exe 3420 ahike.exe 3420 ahike.exe 3420 ahike.exe 3420 ahike.exe 3420 ahike.exe 3420 ahike.exe 3420 ahike.exe 3420 ahike.exe 3420 ahike.exe 3420 ahike.exe 3420 ahike.exe 3420 ahike.exe 3420 ahike.exe 3420 ahike.exe 3420 ahike.exe 3420 ahike.exe 3420 ahike.exe 3420 ahike.exe 3420 ahike.exe 3420 ahike.exe 3420 ahike.exe 3420 ahike.exe 3420 ahike.exe 3420 ahike.exe 3420 ahike.exe 3420 ahike.exe 3420 ahike.exe 3420 ahike.exe 3420 ahike.exe 3420 ahike.exe 3420 ahike.exe 3420 ahike.exe 3420 ahike.exe 3420 ahike.exe 3420 ahike.exe 3420 ahike.exe 3420 ahike.exe 3420 ahike.exe 3420 ahike.exe 3420 ahike.exe 3420 ahike.exe 3420 ahike.exe 3420 ahike.exe 3420 ahike.exe 3420 ahike.exe 3420 ahike.exe 3420 ahike.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
OGOAN.exe87d837993cf1c55bb6d7c46f7e6c426388e249b477e141f96e539fa7e848955d.exeOGOAN.exedescription pid process Token: SeImpersonatePrivilege 4712 OGOAN.exe Token: SeTcbPrivilege 4712 OGOAN.exe Token: SeChangeNotifyPrivilege 4712 OGOAN.exe Token: SeCreateTokenPrivilege 4712 OGOAN.exe Token: SeBackupPrivilege 4712 OGOAN.exe Token: SeRestorePrivilege 4712 OGOAN.exe Token: SeIncreaseQuotaPrivilege 4712 OGOAN.exe Token: SeAssignPrimaryTokenPrivilege 4712 OGOAN.exe Token: SeSecurityPrivilege 4756 87d837993cf1c55bb6d7c46f7e6c426388e249b477e141f96e539fa7e848955d.exe Token: SeSecurityPrivilege 4756 87d837993cf1c55bb6d7c46f7e6c426388e249b477e141f96e539fa7e848955d.exe Token: SeImpersonatePrivilege 1376 OGOAN.exe Token: SeTcbPrivilege 1376 OGOAN.exe Token: SeChangeNotifyPrivilege 1376 OGOAN.exe Token: SeCreateTokenPrivilege 1376 OGOAN.exe Token: SeBackupPrivilege 1376 OGOAN.exe Token: SeRestorePrivilege 1376 OGOAN.exe Token: SeIncreaseQuotaPrivilege 1376 OGOAN.exe Token: SeAssignPrimaryTokenPrivilege 1376 OGOAN.exe Token: SeSecurityPrivilege 4712 OGOAN.exe Token: SeSecurityPrivilege 4712 OGOAN.exe Token: SeSecurityPrivilege 4712 OGOAN.exe Token: SeSecurityPrivilege 4712 OGOAN.exe Token: SeSecurityPrivilege 4712 OGOAN.exe Token: SeImpersonatePrivilege 1376 OGOAN.exe Token: SeTcbPrivilege 1376 OGOAN.exe Token: SeChangeNotifyPrivilege 1376 OGOAN.exe Token: SeCreateTokenPrivilege 1376 OGOAN.exe Token: SeBackupPrivilege 1376 OGOAN.exe Token: SeRestorePrivilege 1376 OGOAN.exe Token: SeIncreaseQuotaPrivilege 1376 OGOAN.exe Token: SeAssignPrimaryTokenPrivilege 1376 OGOAN.exe Token: SeImpersonatePrivilege 4712 OGOAN.exe Token: SeTcbPrivilege 4712 OGOAN.exe Token: SeChangeNotifyPrivilege 4712 OGOAN.exe Token: SeCreateTokenPrivilege 4712 OGOAN.exe Token: SeBackupPrivilege 4712 OGOAN.exe Token: SeRestorePrivilege 4712 OGOAN.exe Token: SeIncreaseQuotaPrivilege 4712 OGOAN.exe Token: SeAssignPrimaryTokenPrivilege 4712 OGOAN.exe Token: SeSecurityPrivilege 4712 OGOAN.exe Token: SeSecurityPrivilege 4712 OGOAN.exe Token: SeImpersonatePrivilege 4712 OGOAN.exe Token: SeTcbPrivilege 4712 OGOAN.exe Token: SeChangeNotifyPrivilege 4712 OGOAN.exe Token: SeCreateTokenPrivilege 4712 OGOAN.exe Token: SeBackupPrivilege 4712 OGOAN.exe Token: SeRestorePrivilege 4712 OGOAN.exe Token: SeIncreaseQuotaPrivilege 4712 OGOAN.exe Token: SeAssignPrimaryTokenPrivilege 4712 OGOAN.exe Token: SeImpersonatePrivilege 1376 OGOAN.exe Token: SeTcbPrivilege 1376 OGOAN.exe Token: SeChangeNotifyPrivilege 1376 OGOAN.exe Token: SeCreateTokenPrivilege 1376 OGOAN.exe Token: SeBackupPrivilege 1376 OGOAN.exe Token: SeRestorePrivilege 1376 OGOAN.exe Token: SeIncreaseQuotaPrivilege 1376 OGOAN.exe Token: SeAssignPrimaryTokenPrivilege 1376 OGOAN.exe Token: SeImpersonatePrivilege 4712 OGOAN.exe Token: SeTcbPrivilege 4712 OGOAN.exe Token: SeChangeNotifyPrivilege 4712 OGOAN.exe Token: SeCreateTokenPrivilege 4712 OGOAN.exe Token: SeBackupPrivilege 4712 OGOAN.exe Token: SeRestorePrivilege 4712 OGOAN.exe Token: SeIncreaseQuotaPrivilege 4712 OGOAN.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
87d837993cf1c55bb6d7c46f7e6c426388e249b477e141f96e539fa7e848955d.exe87d837993cf1c55bb6d7c46f7e6c426388e249b477e141f96e539fa7e848955d.exeahike.exeahike.exedescription pid process target process PID 4808 wrote to memory of 4712 4808 87d837993cf1c55bb6d7c46f7e6c426388e249b477e141f96e539fa7e848955d.exe OGOAN.exe PID 4808 wrote to memory of 4712 4808 87d837993cf1c55bb6d7c46f7e6c426388e249b477e141f96e539fa7e848955d.exe OGOAN.exe PID 4808 wrote to memory of 4712 4808 87d837993cf1c55bb6d7c46f7e6c426388e249b477e141f96e539fa7e848955d.exe OGOAN.exe PID 4808 wrote to memory of 4756 4808 87d837993cf1c55bb6d7c46f7e6c426388e249b477e141f96e539fa7e848955d.exe 87d837993cf1c55bb6d7c46f7e6c426388e249b477e141f96e539fa7e848955d.exe PID 4808 wrote to memory of 4756 4808 87d837993cf1c55bb6d7c46f7e6c426388e249b477e141f96e539fa7e848955d.exe 87d837993cf1c55bb6d7c46f7e6c426388e249b477e141f96e539fa7e848955d.exe PID 4808 wrote to memory of 4756 4808 87d837993cf1c55bb6d7c46f7e6c426388e249b477e141f96e539fa7e848955d.exe 87d837993cf1c55bb6d7c46f7e6c426388e249b477e141f96e539fa7e848955d.exe PID 4808 wrote to memory of 4756 4808 87d837993cf1c55bb6d7c46f7e6c426388e249b477e141f96e539fa7e848955d.exe 87d837993cf1c55bb6d7c46f7e6c426388e249b477e141f96e539fa7e848955d.exe PID 4808 wrote to memory of 4756 4808 87d837993cf1c55bb6d7c46f7e6c426388e249b477e141f96e539fa7e848955d.exe 87d837993cf1c55bb6d7c46f7e6c426388e249b477e141f96e539fa7e848955d.exe PID 4756 wrote to memory of 4492 4756 87d837993cf1c55bb6d7c46f7e6c426388e249b477e141f96e539fa7e848955d.exe ahike.exe PID 4756 wrote to memory of 4492 4756 87d837993cf1c55bb6d7c46f7e6c426388e249b477e141f96e539fa7e848955d.exe ahike.exe PID 4756 wrote to memory of 4492 4756 87d837993cf1c55bb6d7c46f7e6c426388e249b477e141f96e539fa7e848955d.exe ahike.exe PID 4492 wrote to memory of 1376 4492 ahike.exe OGOAN.exe PID 4492 wrote to memory of 1376 4492 ahike.exe OGOAN.exe PID 4492 wrote to memory of 1376 4492 ahike.exe OGOAN.exe PID 4492 wrote to memory of 3420 4492 ahike.exe ahike.exe PID 4492 wrote to memory of 3420 4492 ahike.exe ahike.exe PID 4492 wrote to memory of 3420 4492 ahike.exe ahike.exe PID 4492 wrote to memory of 3420 4492 ahike.exe ahike.exe PID 4492 wrote to memory of 3420 4492 ahike.exe ahike.exe PID 3420 wrote to memory of 2484 3420 ahike.exe sihost.exe PID 3420 wrote to memory of 2484 3420 ahike.exe sihost.exe PID 3420 wrote to memory of 2484 3420 ahike.exe sihost.exe PID 3420 wrote to memory of 2484 3420 ahike.exe sihost.exe PID 3420 wrote to memory of 2484 3420 ahike.exe sihost.exe PID 4756 wrote to memory of 5012 4756 87d837993cf1c55bb6d7c46f7e6c426388e249b477e141f96e539fa7e848955d.exe cmd.exe PID 4756 wrote to memory of 5012 4756 87d837993cf1c55bb6d7c46f7e6c426388e249b477e141f96e539fa7e848955d.exe cmd.exe PID 4756 wrote to memory of 5012 4756 87d837993cf1c55bb6d7c46f7e6c426388e249b477e141f96e539fa7e848955d.exe cmd.exe PID 3420 wrote to memory of 2504 3420 ahike.exe svchost.exe PID 3420 wrote to memory of 2504 3420 ahike.exe svchost.exe PID 3420 wrote to memory of 2504 3420 ahike.exe svchost.exe PID 3420 wrote to memory of 2504 3420 ahike.exe svchost.exe PID 3420 wrote to memory of 2504 3420 ahike.exe svchost.exe PID 3420 wrote to memory of 2708 3420 ahike.exe taskhostw.exe PID 3420 wrote to memory of 2708 3420 ahike.exe taskhostw.exe PID 3420 wrote to memory of 2708 3420 ahike.exe taskhostw.exe PID 3420 wrote to memory of 2708 3420 ahike.exe taskhostw.exe PID 3420 wrote to memory of 2708 3420 ahike.exe taskhostw.exe PID 3420 wrote to memory of 2592 3420 ahike.exe Explorer.EXE PID 3420 wrote to memory of 2592 3420 ahike.exe Explorer.EXE PID 3420 wrote to memory of 2592 3420 ahike.exe Explorer.EXE PID 3420 wrote to memory of 2592 3420 ahike.exe Explorer.EXE PID 3420 wrote to memory of 2592 3420 ahike.exe Explorer.EXE PID 3420 wrote to memory of 3148 3420 ahike.exe svchost.exe PID 3420 wrote to memory of 3148 3420 ahike.exe svchost.exe PID 3420 wrote to memory of 3148 3420 ahike.exe svchost.exe PID 3420 wrote to memory of 3148 3420 ahike.exe svchost.exe PID 3420 wrote to memory of 3148 3420 ahike.exe svchost.exe PID 3420 wrote to memory of 3344 3420 ahike.exe DllHost.exe PID 3420 wrote to memory of 3344 3420 ahike.exe DllHost.exe PID 3420 wrote to memory of 3344 3420 ahike.exe DllHost.exe PID 3420 wrote to memory of 3344 3420 ahike.exe DllHost.exe PID 3420 wrote to memory of 3344 3420 ahike.exe DllHost.exe PID 3420 wrote to memory of 3448 3420 ahike.exe StartMenuExperienceHost.exe PID 3420 wrote to memory of 3448 3420 ahike.exe StartMenuExperienceHost.exe PID 3420 wrote to memory of 3448 3420 ahike.exe StartMenuExperienceHost.exe PID 3420 wrote to memory of 3448 3420 ahike.exe StartMenuExperienceHost.exe PID 3420 wrote to memory of 3448 3420 ahike.exe StartMenuExperienceHost.exe PID 3420 wrote to memory of 3516 3420 ahike.exe RuntimeBroker.exe PID 3420 wrote to memory of 3516 3420 ahike.exe RuntimeBroker.exe PID 3420 wrote to memory of 3516 3420 ahike.exe RuntimeBroker.exe PID 3420 wrote to memory of 3516 3420 ahike.exe RuntimeBroker.exe PID 3420 wrote to memory of 3516 3420 ahike.exe RuntimeBroker.exe PID 3420 wrote to memory of 3600 3420 ahike.exe SearchApp.exe PID 3420 wrote to memory of 3600 3420 ahike.exe SearchApp.exe -
outlook_win_path 1 IoCs
Processes:
OGOAN.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook OGOAN.exe
Processes
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\87d837993cf1c55bb6d7c46f7e6c426388e249b477e141f96e539fa7e848955d.exe"C:\Users\Admin\AppData\Local\Temp\87d837993cf1c55bb6d7c46f7e6c426388e249b477e141f96e539fa7e848955d.exe"2⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\OGOAN.exe"C:\Users\Admin\AppData\Local\Temp\OGOAN.exe"3⤵
- Executes dropped EXE
- Checks computer location settings
- Accesses Microsoft Outlook accounts
- Accesses Microsoft Outlook profiles
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious use of AdjustPrivilegeToken
- outlook_win_path
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\240593406.bat" "C:\Users\Admin\AppData\Local\Temp\OGOAN.exe" "4⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
C:\Users\Admin\AppData\Local\Temp\87d837993cf1c55bb6d7c46f7e6c426388e249b477e141f96e539fa7e848955d.exe"C:\Users\Admin\AppData\Local\Temp\87d837993cf1c55bb6d7c46f7e6c426388e249b477e141f96e539fa7e848955d.exe"3⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Didazo\ahike.exe"C:\Users\Admin\AppData\Roaming\Didazo\ahike.exe"4⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\OGOAN.exe"C:\Users\Admin\AppData\Local\Temp\OGOAN.exe"5⤵
- Executes dropped EXE
- Checks computer location settings
- Accesses Microsoft Outlook accounts
- Accesses Microsoft Outlook profiles
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\240593421.bat" "C:\Users\Admin\AppData\Local\Temp\OGOAN.exe" "6⤵
-
C:\Users\Admin\AppData\Roaming\Didazo\ahike.exe"C:\Users\Admin\AppData\Roaming\Didazo\ahike.exe"5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp4a86afa2.bat"4⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\OGOAN.exeFilesize
34KB
MD5a61e366717c34d2625ab397896811314
SHA1357ce1cbcbf5be365b1feca1c1ef748bd433f253
SHA2564702ca95176a3052a1dbfc5a4f4690c4fc80303c555603e7664766ee0c9588a5
SHA512ead51f5ca804e7e616dc418a3d1e5b4fba1192934df0595f7bd121a973aba117f256ab40582ced2987dceaf5fd84df30d02e78d2e1b9591a39d4a89a522db882
-
C:\Users\Admin\AppData\Local\Temp\OGOAN.exeFilesize
34KB
MD5a61e366717c34d2625ab397896811314
SHA1357ce1cbcbf5be365b1feca1c1ef748bd433f253
SHA2564702ca95176a3052a1dbfc5a4f4690c4fc80303c555603e7664766ee0c9588a5
SHA512ead51f5ca804e7e616dc418a3d1e5b4fba1192934df0595f7bd121a973aba117f256ab40582ced2987dceaf5fd84df30d02e78d2e1b9591a39d4a89a522db882
-
C:\Users\Admin\AppData\Local\Temp\OGOAN.exeFilesize
34KB
MD5a61e366717c34d2625ab397896811314
SHA1357ce1cbcbf5be365b1feca1c1ef748bd433f253
SHA2564702ca95176a3052a1dbfc5a4f4690c4fc80303c555603e7664766ee0c9588a5
SHA512ead51f5ca804e7e616dc418a3d1e5b4fba1192934df0595f7bd121a973aba117f256ab40582ced2987dceaf5fd84df30d02e78d2e1b9591a39d4a89a522db882
-
C:\Users\Admin\AppData\Local\Temp\tmp4a86afa2.batFilesize
307B
MD576ca18297f3114de10ccb57f5b8fb6ac
SHA1ee48db063e31d9f81d82e6b31999f00b638763cd
SHA2566d955cf6c2f80ee4a7da71990f05f30f5e7117c46961a9d4860006f0274f95a9
SHA51281653ba3d3e9126fd8c20700a6b0a2b0d351b63354a40de80b168b035bc846d20fea36c76f2acfae82b0f5ead100c870942d71d1f849cc769e4e85ed5df1f79d
-
C:\Users\Admin\AppData\Roaming\Amvi\fiyvo.vuqFilesize
2KB
MD57a133a9871826c46887ec8afe0946099
SHA1effd6c376c417b0bd0b9186b438fe59540beff7d
SHA2568f0ea697a29e28ab068314ef32376b9dfdf8e6c724a744890aec4f2c2ec7683c
SHA512e57734097c57737ad2da617276709573951bbf461d6e5f9e2f8a5215dc0efebd74becaa9b9b71241595440948facb39203d92273f7ec36c8c53312c0f00438f5
-
C:\Users\Admin\AppData\Roaming\Didazo\ahike.exeFilesize
549KB
MD5758ac5ecba64d9b1133848515b9dc83d
SHA16d8a4b8e2a4ff7fc625700163e5aef1cc4dc3e14
SHA256ad7c0b54bd1c6738a30e131db32492f14a28d6a45c7983a435eaeafd48f94bd4
SHA5129810404a884489dee1ddc276d40880a9b0500bdabf5a0a8feb56f3c69cce52c9da433bfba9dcd8c68fc5dca04ee8ad71e1c307310cf45a7253e8874ced07eb2a
-
C:\Users\Admin\AppData\Roaming\Didazo\ahike.exeFilesize
549KB
MD5758ac5ecba64d9b1133848515b9dc83d
SHA16d8a4b8e2a4ff7fc625700163e5aef1cc4dc3e14
SHA256ad7c0b54bd1c6738a30e131db32492f14a28d6a45c7983a435eaeafd48f94bd4
SHA5129810404a884489dee1ddc276d40880a9b0500bdabf5a0a8feb56f3c69cce52c9da433bfba9dcd8c68fc5dca04ee8ad71e1c307310cf45a7253e8874ced07eb2a
-
C:\Users\Admin\AppData\Roaming\Didazo\ahike.exeFilesize
549KB
MD5758ac5ecba64d9b1133848515b9dc83d
SHA16d8a4b8e2a4ff7fc625700163e5aef1cc4dc3e14
SHA256ad7c0b54bd1c6738a30e131db32492f14a28d6a45c7983a435eaeafd48f94bd4
SHA5129810404a884489dee1ddc276d40880a9b0500bdabf5a0a8feb56f3c69cce52c9da433bfba9dcd8c68fc5dca04ee8ad71e1c307310cf45a7253e8874ced07eb2a
-
memory/1376-164-0x0000000000400000-0x000000000041D000-memory.dmpFilesize
116KB
-
memory/1376-166-0x0000000002AF0000-0x0000000002B2B000-memory.dmpFilesize
236KB
-
memory/1376-143-0x0000000000000000-mapping.dmp
-
memory/1376-145-0x0000000000400000-0x000000000041D000-memory.dmpFilesize
116KB
-
memory/1376-157-0x0000000002AF0000-0x0000000002B2B000-memory.dmpFilesize
236KB
-
memory/1376-156-0x0000000000400000-0x000000000041D000-memory.dmpFilesize
116KB
-
memory/1480-161-0x0000000001140000-0x000000000117B000-memory.dmpFilesize
236KB
-
memory/1480-160-0x0000000000000000-mapping.dmp
-
memory/1480-168-0x0000000001140000-0x000000000117B000-memory.dmpFilesize
236KB
-
memory/3420-150-0x0000000000400000-0x000000000043B000-memory.dmpFilesize
236KB
-
memory/3420-146-0x0000000000000000-mapping.dmp
-
memory/4492-140-0x0000000000000000-mapping.dmp
-
memory/4712-138-0x0000000000400000-0x000000000041D000-memory.dmpFilesize
116KB
-
memory/4712-165-0x0000000000AA0000-0x0000000000ADB000-memory.dmpFilesize
236KB
-
memory/4712-163-0x0000000000400000-0x000000000041D000-memory.dmpFilesize
116KB
-
memory/4712-155-0x0000000000AA0000-0x0000000000ADB000-memory.dmpFilesize
236KB
-
memory/4712-132-0x0000000000000000-mapping.dmp
-
memory/4756-136-0x0000000000400000-0x000000000043B000-memory.dmpFilesize
236KB
-
memory/4756-139-0x0000000000400000-0x000000000043B000-memory.dmpFilesize
236KB
-
memory/4756-151-0x0000000000400000-0x000000000043B000-memory.dmpFilesize
236KB
-
memory/4756-137-0x0000000000400000-0x000000000043B000-memory.dmpFilesize
236KB
-
memory/4756-153-0x0000000000400000-0x000000000043B000-memory.dmpFilesize
236KB
-
memory/4756-135-0x0000000000000000-mapping.dmp
-
memory/5012-152-0x0000000000000000-mapping.dmp
-
memory/5088-162-0x0000000001100000-0x000000000113B000-memory.dmpFilesize
236KB
-
memory/5088-159-0x0000000000000000-mapping.dmp
-
memory/5088-167-0x0000000001100000-0x000000000113B000-memory.dmpFilesize
236KB