Analysis
-
max time kernel
203s -
max time network
213s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
28/11/2022, 02:04
Static task
static1
Behavioral task
behavioral1
Sample
433526c997c9586097e1ac7ed3045f3debed6dcd72ad98fddef7e45f486402ab.exe
Resource
win7-20221111-en
windows7-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
433526c997c9586097e1ac7ed3045f3debed6dcd72ad98fddef7e45f486402ab.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
13 signatures
150 seconds
General
-
Target
433526c997c9586097e1ac7ed3045f3debed6dcd72ad98fddef7e45f486402ab.exe
-
Size
504KB
-
MD5
06423b915fdde4d9a7051480a337123b
-
SHA1
5ed71ff1c8432aab2e17887fd6eb9455b924dada
-
SHA256
433526c997c9586097e1ac7ed3045f3debed6dcd72ad98fddef7e45f486402ab
-
SHA512
c3da80348d6a36a3255ff7ad24d0b840db8f34821558f4c983f5a924dd6ec2aa1ba4e54fc83659eba4698ba17f35e703a798d56eb21a88cb6a1d0b5e6b0fc447
-
SSDEEP
12288:6OwQmZiqb/i5t+V9iTCSvEMseLPcRnKb:6OdeIe9ih8Ms+PU
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" y26f0s.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" frcouy.exe -
Executes dropped EXE 6 IoCs
pid Process 4364 y26f0s.exe 4272 apod.exe 4136 apod.exe 1976 frcouy.exe 4060 dpod.exe 984 epod.exe -
resource yara_rule behavioral2/memory/4136-145-0x0000000000400000-0x000000000040E000-memory.dmp upx behavioral2/memory/4136-148-0x0000000000400000-0x000000000040E000-memory.dmp upx behavioral2/memory/4136-149-0x0000000000400000-0x000000000040E000-memory.dmp upx behavioral2/memory/4136-158-0x0000000000400000-0x000000000040E000-memory.dmp upx -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation y26f0s.exe Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation 433526c997c9586097e1ac7ed3045f3debed6dcd72ad98fddef7e45f486402ab.exe -
Adds Run key to start application 2 TTPs 52 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\frcouy = "C:\\Users\\Admin\\frcouy.exe /C" frcouy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\frcouy = "C:\\Users\\Admin\\frcouy.exe /p" frcouy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\frcouy = "C:\\Users\\Admin\\frcouy.exe /E" frcouy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\frcouy = "C:\\Users\\Admin\\frcouy.exe /P" frcouy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\frcouy = "C:\\Users\\Admin\\frcouy.exe /g" frcouy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\frcouy = "C:\\Users\\Admin\\frcouy.exe /Z" frcouy.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows\CurrentVersion\Run\ y26f0s.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\frcouy = "C:\\Users\\Admin\\frcouy.exe /B" frcouy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\frcouy = "C:\\Users\\Admin\\frcouy.exe /U" frcouy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\frcouy = "C:\\Users\\Admin\\frcouy.exe /q" frcouy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\frcouy = "C:\\Users\\Admin\\frcouy.exe /s" frcouy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\frcouy = "C:\\Users\\Admin\\frcouy.exe /X" frcouy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\frcouy = "C:\\Users\\Admin\\frcouy.exe /R" frcouy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\frcouy = "C:\\Users\\Admin\\frcouy.exe /f" frcouy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\frcouy = "C:\\Users\\Admin\\frcouy.exe /c" frcouy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\frcouy = "C:\\Users\\Admin\\frcouy.exe /a" frcouy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\frcouy = "C:\\Users\\Admin\\frcouy.exe /d" frcouy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\frcouy = "C:\\Users\\Admin\\frcouy.exe /L" frcouy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\frcouy = "C:\\Users\\Admin\\frcouy.exe /k" frcouy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\frcouy = "C:\\Users\\Admin\\frcouy.exe /K" frcouy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\frcouy = "C:\\Users\\Admin\\frcouy.exe /Y" frcouy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\frcouy = "C:\\Users\\Admin\\frcouy.exe /H" frcouy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\frcouy = "C:\\Users\\Admin\\frcouy.exe /j" frcouy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\frcouy = "C:\\Users\\Admin\\frcouy.exe /Q" frcouy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\frcouy = "C:\\Users\\Admin\\frcouy.exe /A" frcouy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\frcouy = "C:\\Users\\Admin\\frcouy.exe /T" frcouy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\frcouy = "C:\\Users\\Admin\\frcouy.exe /M" frcouy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\frcouy = "C:\\Users\\Admin\\frcouy.exe /t" frcouy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\frcouy = "C:\\Users\\Admin\\frcouy.exe /V" frcouy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\frcouy = "C:\\Users\\Admin\\frcouy.exe /w" frcouy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\frcouy = "C:\\Users\\Admin\\frcouy.exe /J" frcouy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\frcouy = "C:\\Users\\Admin\\frcouy.exe /n" frcouy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\frcouy = "C:\\Users\\Admin\\frcouy.exe /z" frcouy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\frcouy = "C:\\Users\\Admin\\frcouy.exe /l" frcouy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\frcouy = "C:\\Users\\Admin\\frcouy.exe /e" frcouy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\frcouy = "C:\\Users\\Admin\\frcouy.exe /x" frcouy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\frcouy = "C:\\Users\\Admin\\frcouy.exe /v" frcouy.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows\CurrentVersion\Run\ frcouy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\frcouy = "C:\\Users\\Admin\\frcouy.exe /b" frcouy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\frcouy = "C:\\Users\\Admin\\frcouy.exe /r" frcouy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\frcouy = "C:\\Users\\Admin\\frcouy.exe /F" frcouy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\frcouy = "C:\\Users\\Admin\\frcouy.exe /D" frcouy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\frcouy = "C:\\Users\\Admin\\frcouy.exe /o" frcouy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\frcouy = "C:\\Users\\Admin\\frcouy.exe /u" frcouy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\frcouy = "C:\\Users\\Admin\\frcouy.exe /i" frcouy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\frcouy = "C:\\Users\\Admin\\frcouy.exe /U" y26f0s.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\frcouy = "C:\\Users\\Admin\\frcouy.exe /m" frcouy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\frcouy = "C:\\Users\\Admin\\frcouy.exe /I" frcouy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\frcouy = "C:\\Users\\Admin\\frcouy.exe /S" frcouy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\frcouy = "C:\\Users\\Admin\\frcouy.exe /W" frcouy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\frcouy = "C:\\Users\\Admin\\frcouy.exe /G" frcouy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\frcouy = "C:\\Users\\Admin\\frcouy.exe /N" frcouy.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4272 set thread context of 4136 4272 apod.exe 82 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 2 IoCs
pid pid_target Process procid_target 4568 984 WerFault.exe 92 68 984 WerFault.exe 92 -
Enumerates processes with tasklist 1 TTPs 2 IoCs
pid Process 1544 tasklist.exe 540 tasklist.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4364 y26f0s.exe 4364 y26f0s.exe 4136 apod.exe 4136 apod.exe 4364 y26f0s.exe 4364 y26f0s.exe 1976 frcouy.exe 1976 frcouy.exe 4136 apod.exe 4136 apod.exe 1976 frcouy.exe 1976 frcouy.exe 1976 frcouy.exe 1976 frcouy.exe 1976 frcouy.exe 1976 frcouy.exe 1976 frcouy.exe 1976 frcouy.exe 4136 apod.exe 4136 apod.exe 1976 frcouy.exe 1976 frcouy.exe 4136 apod.exe 4136 apod.exe 4136 apod.exe 4136 apod.exe 1976 frcouy.exe 1976 frcouy.exe 1976 frcouy.exe 1976 frcouy.exe 1976 frcouy.exe 1976 frcouy.exe 4136 apod.exe 4136 apod.exe 1976 frcouy.exe 1976 frcouy.exe 4136 apod.exe 4136 apod.exe 4136 apod.exe 4136 apod.exe 1976 frcouy.exe 1976 frcouy.exe 1976 frcouy.exe 1976 frcouy.exe 1976 frcouy.exe 1976 frcouy.exe 4136 apod.exe 4136 apod.exe 4136 apod.exe 4136 apod.exe 1976 frcouy.exe 1976 frcouy.exe 4136 apod.exe 4136 apod.exe 1976 frcouy.exe 1976 frcouy.exe 4136 apod.exe 4136 apod.exe 4136 apod.exe 4136 apod.exe 1976 frcouy.exe 1976 frcouy.exe 4136 apod.exe 4136 apod.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1544 tasklist.exe Token: SeDebugPrivilege 540 tasklist.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 1672 433526c997c9586097e1ac7ed3045f3debed6dcd72ad98fddef7e45f486402ab.exe 4364 y26f0s.exe 4272 apod.exe 1976 frcouy.exe 4060 dpod.exe -
Suspicious use of WriteProcessMemory 37 IoCs
description pid Process procid_target PID 1672 wrote to memory of 4364 1672 433526c997c9586097e1ac7ed3045f3debed6dcd72ad98fddef7e45f486402ab.exe 79 PID 1672 wrote to memory of 4364 1672 433526c997c9586097e1ac7ed3045f3debed6dcd72ad98fddef7e45f486402ab.exe 79 PID 1672 wrote to memory of 4364 1672 433526c997c9586097e1ac7ed3045f3debed6dcd72ad98fddef7e45f486402ab.exe 79 PID 1672 wrote to memory of 4272 1672 433526c997c9586097e1ac7ed3045f3debed6dcd72ad98fddef7e45f486402ab.exe 81 PID 1672 wrote to memory of 4272 1672 433526c997c9586097e1ac7ed3045f3debed6dcd72ad98fddef7e45f486402ab.exe 81 PID 1672 wrote to memory of 4272 1672 433526c997c9586097e1ac7ed3045f3debed6dcd72ad98fddef7e45f486402ab.exe 81 PID 4272 wrote to memory of 4136 4272 apod.exe 82 PID 4272 wrote to memory of 4136 4272 apod.exe 82 PID 4272 wrote to memory of 4136 4272 apod.exe 82 PID 4272 wrote to memory of 4136 4272 apod.exe 82 PID 4272 wrote to memory of 4136 4272 apod.exe 82 PID 4272 wrote to memory of 4136 4272 apod.exe 82 PID 4272 wrote to memory of 4136 4272 apod.exe 82 PID 4272 wrote to memory of 4136 4272 apod.exe 82 PID 4364 wrote to memory of 1976 4364 y26f0s.exe 83 PID 4364 wrote to memory of 1976 4364 y26f0s.exe 83 PID 4364 wrote to memory of 1976 4364 y26f0s.exe 83 PID 4364 wrote to memory of 3196 4364 y26f0s.exe 84 PID 4364 wrote to memory of 3196 4364 y26f0s.exe 84 PID 4364 wrote to memory of 3196 4364 y26f0s.exe 84 PID 3196 wrote to memory of 1544 3196 cmd.exe 86 PID 3196 wrote to memory of 1544 3196 cmd.exe 86 PID 3196 wrote to memory of 1544 3196 cmd.exe 86 PID 1672 wrote to memory of 4060 1672 433526c997c9586097e1ac7ed3045f3debed6dcd72ad98fddef7e45f486402ab.exe 87 PID 1672 wrote to memory of 4060 1672 433526c997c9586097e1ac7ed3045f3debed6dcd72ad98fddef7e45f486402ab.exe 87 PID 1672 wrote to memory of 4060 1672 433526c997c9586097e1ac7ed3045f3debed6dcd72ad98fddef7e45f486402ab.exe 87 PID 1672 wrote to memory of 984 1672 433526c997c9586097e1ac7ed3045f3debed6dcd72ad98fddef7e45f486402ab.exe 92 PID 1672 wrote to memory of 984 1672 433526c997c9586097e1ac7ed3045f3debed6dcd72ad98fddef7e45f486402ab.exe 92 PID 1672 wrote to memory of 984 1672 433526c997c9586097e1ac7ed3045f3debed6dcd72ad98fddef7e45f486402ab.exe 92 PID 1672 wrote to memory of 4448 1672 433526c997c9586097e1ac7ed3045f3debed6dcd72ad98fddef7e45f486402ab.exe 100 PID 1672 wrote to memory of 4448 1672 433526c997c9586097e1ac7ed3045f3debed6dcd72ad98fddef7e45f486402ab.exe 100 PID 1672 wrote to memory of 4448 1672 433526c997c9586097e1ac7ed3045f3debed6dcd72ad98fddef7e45f486402ab.exe 100 PID 4448 wrote to memory of 540 4448 cmd.exe 102 PID 4448 wrote to memory of 540 4448 cmd.exe 102 PID 4448 wrote to memory of 540 4448 cmd.exe 102 PID 1976 wrote to memory of 540 1976 frcouy.exe 102 PID 1976 wrote to memory of 540 1976 frcouy.exe 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\433526c997c9586097e1ac7ed3045f3debed6dcd72ad98fddef7e45f486402ab.exe"C:\Users\Admin\AppData\Local\Temp\433526c997c9586097e1ac7ed3045f3debed6dcd72ad98fddef7e45f486402ab.exe"1⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1672 -
C:\Users\Admin\y26f0s.exeC:\Users\Admin\y26f0s.exe2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4364 -
C:\Users\Admin\frcouy.exe"C:\Users\Admin\frcouy.exe"3⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1976
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c tasklist&&del y26f0s.exe3⤵
- Suspicious use of WriteProcessMemory
PID:3196 -
C:\Windows\SysWOW64\tasklist.exetasklist4⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:1544
-
-
-
-
C:\Users\Admin\apod.exeC:\Users\Admin\apod.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4272 -
C:\Users\Admin\apod.exe"C:\Users\Admin\apod.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4136
-
-
-
C:\Users\Admin\dpod.exeC:\Users\Admin\dpod.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4060
-
-
C:\Users\Admin\epod.exeC:\Users\Admin\epod.exe2⤵
- Executes dropped EXE
PID:984 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 984 -s 2203⤵
- Program crash
PID:4568
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 984 -s 2243⤵
- Program crash
PID:68
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c tasklist&&del 433526c997c9586097e1ac7ed3045f3debed6dcd72ad98fddef7e45f486402ab.exe2⤵
- Suspicious use of WriteProcessMemory
PID:4448 -
C:\Windows\SysWOW64\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:540
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 984 -ip 9841⤵PID:4596
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 984 -ip 9841⤵PID:1844
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
76KB
MD5423c4a08989b956f40a58ac76d4b06ef
SHA1e5f926bda675c1682a12df0033eacbcea1ed8b8c
SHA256b2c621f8ca9704489c90a2fe87c7e5eb9ef247cef06a9b18708c8cd7a1b4e6c7
SHA512b089470923a03f773749047688c9c315401da8590485f76d41589fcb3fbf045732e5f54e1297bdd6545575bb72c4cc4ba2d2ac2d7e64c4baab6a064f30a92b43
-
Filesize
76KB
MD5423c4a08989b956f40a58ac76d4b06ef
SHA1e5f926bda675c1682a12df0033eacbcea1ed8b8c
SHA256b2c621f8ca9704489c90a2fe87c7e5eb9ef247cef06a9b18708c8cd7a1b4e6c7
SHA512b089470923a03f773749047688c9c315401da8590485f76d41589fcb3fbf045732e5f54e1297bdd6545575bb72c4cc4ba2d2ac2d7e64c4baab6a064f30a92b43
-
Filesize
76KB
MD5423c4a08989b956f40a58ac76d4b06ef
SHA1e5f926bda675c1682a12df0033eacbcea1ed8b8c
SHA256b2c621f8ca9704489c90a2fe87c7e5eb9ef247cef06a9b18708c8cd7a1b4e6c7
SHA512b089470923a03f773749047688c9c315401da8590485f76d41589fcb3fbf045732e5f54e1297bdd6545575bb72c4cc4ba2d2ac2d7e64c4baab6a064f30a92b43
-
Filesize
36KB
MD53f33e061a2ed4b19f8b837cc9798ba4b
SHA15e3a078de37dc896a657cb0a09f13394f5bd2715
SHA25682b7ebb533cebb3bb671625ba65e41755ecad1c8e7b6ec7f9a8f4a549aac1a79
SHA5122ef0c88aa69b8015db4773eaf5332a16464d6c502376c3edb88fa2c3b81aa135e42581f5384ecadd5964cf12abbc263af5841ba2322f8cb9d5f10e92fd0f52e5
-
Filesize
36KB
MD53f33e061a2ed4b19f8b837cc9798ba4b
SHA15e3a078de37dc896a657cb0a09f13394f5bd2715
SHA25682b7ebb533cebb3bb671625ba65e41755ecad1c8e7b6ec7f9a8f4a549aac1a79
SHA5122ef0c88aa69b8015db4773eaf5332a16464d6c502376c3edb88fa2c3b81aa135e42581f5384ecadd5964cf12abbc263af5841ba2322f8cb9d5f10e92fd0f52e5
-
Filesize
7.2MB
MD5319622bd15bf89dafbfa59e4de0cc5e7
SHA1ff6540889833fffaca5c2b423a4b4f55f5a136c4
SHA2569b571d3d69123d97e85c878e0b8ecf47acace18947e11eca707ae083ff4ffda8
SHA5129685a1bce02371a1fe32e98b3c7c4b37ba61009e2bd3746de419ee219ea96c646ad8f47128bdd32aece3dd30bb3984d0bb895a852dbc6e9e8f0d44bd7757b239
-
Filesize
7.2MB
MD5319622bd15bf89dafbfa59e4de0cc5e7
SHA1ff6540889833fffaca5c2b423a4b4f55f5a136c4
SHA2569b571d3d69123d97e85c878e0b8ecf47acace18947e11eca707ae083ff4ffda8
SHA5129685a1bce02371a1fe32e98b3c7c4b37ba61009e2bd3746de419ee219ea96c646ad8f47128bdd32aece3dd30bb3984d0bb895a852dbc6e9e8f0d44bd7757b239
-
Filesize
340KB
MD53772bc8ed051186a427012c520bb6e1d
SHA1370cd8ebcdfdf81055d6d8c32c6a961cc10a73d0
SHA2562673860acb2426f1398bc01c2bb4aba13a7bf3f7b67a0cc4b9d0b087409d72d6
SHA5125961801829eb296948dd7602977e4ded03f951b081836713155a70a01e4e491f3ab27d076b46fafbdfd164df5289c666a3e466ea8e77b3d96a0902892aa9f6ca
-
Filesize
340KB
MD53772bc8ed051186a427012c520bb6e1d
SHA1370cd8ebcdfdf81055d6d8c32c6a961cc10a73d0
SHA2562673860acb2426f1398bc01c2bb4aba13a7bf3f7b67a0cc4b9d0b087409d72d6
SHA5125961801829eb296948dd7602977e4ded03f951b081836713155a70a01e4e491f3ab27d076b46fafbdfd164df5289c666a3e466ea8e77b3d96a0902892aa9f6ca
-
Filesize
340KB
MD5cd821a611d07ae0237546cd00fa6752f
SHA19cf66009462749c884320a43261af67e44688380
SHA256977facc689d0653837ba70a93147f6fb512031d25c4e8991b93672d57289c01a
SHA512f0a2328b2bd3f61593cbfc76cea146bcf7fa9eb69e192dd5cfbaaa40bab2632c3222af0ebf410567020c4a05748192a766d78f460ec90db96d04ac4a43bae719
-
Filesize
340KB
MD5cd821a611d07ae0237546cd00fa6752f
SHA19cf66009462749c884320a43261af67e44688380
SHA256977facc689d0653837ba70a93147f6fb512031d25c4e8991b93672d57289c01a
SHA512f0a2328b2bd3f61593cbfc76cea146bcf7fa9eb69e192dd5cfbaaa40bab2632c3222af0ebf410567020c4a05748192a766d78f460ec90db96d04ac4a43bae719