Analysis
-
max time kernel
151s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
28-11-2022 15:06
Behavioral task
behavioral1
Sample
32a34056fbf49f709109cece880570a3d84c6de34f1f15da4cdc41387a4868f9.exe
Resource
win7-20221111-en
General
-
Target
32a34056fbf49f709109cece880570a3d84c6de34f1f15da4cdc41387a4868f9.exe
-
Size
2.2MB
-
MD5
bb176d591abf10ad736903f0c44dd3d2
-
SHA1
0cc9b99a34533f48c0a0758e99d675ffadf58b4a
-
SHA256
32a34056fbf49f709109cece880570a3d84c6de34f1f15da4cdc41387a4868f9
-
SHA512
5c53c4fd2396a797d87178e6a2cb20ddfae2c19211780483b56ab0c7d8dbc9b85a3cbb4c92e8fed53cf3de48677ea3560407be342755dc056de7e2980a8a0d12
-
SSDEEP
24576:3tQ1zabaojiW8iWcZZ6+ZeHEK67xPyHSBEMq4L6X7Qdiy46J0FXxKqFmpTFJuVXc:3t+3hGluEKqEMpriVA2gqomgqoPeXA
Malware Config
Extracted
cybergate
2.7 J/M SE
=P
00doom00.myftp.biz:83
00doom00.myftp.biz:81
JoKeR/M@SK
-
enable_keylogger
true
-
enable_message_box
false
-
ftp_directory
./logs/
-
ftp_interval
30
-
injected_process
explorer.exe
-
install_dir
install
-
install_file
server.exe
-
install_flag
true
-
keylogger_enable_ftp
false
-
message_box_caption
texto da mensagem
-
message_box_title
tÃtulo da mensagem
-
password
abcd1234
-
regkey_hkcu
HKCU
-
regkey_hklm
HKLM
Signatures
-
Adds policy Run key to start application 2 TTPs 4 IoCs
Processes:
32a34056fbf49f709109cece880570a3d84c6de34f1f15da4cdc41387a4868f9.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\install\\server.exe" 32a34056fbf49f709109cece880570a3d84c6de34f1f15da4cdc41387a4868f9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run 32a34056fbf49f709109cece880570a3d84c6de34f1f15da4cdc41387a4868f9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\install\\server.exe" 32a34056fbf49f709109cece880570a3d84c6de34f1f15da4cdc41387a4868f9.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run 32a34056fbf49f709109cece880570a3d84c6de34f1f15da4cdc41387a4868f9.exe -
Executes dropped EXE 3 IoCs
Processes:
server.exeserver.exeserver.exepid process 1344 server.exe 1476 server.exe 1980 server.exe -
Modifies Installed Components in the registry 2 TTPs 2 IoCs
Processes:
32a34056fbf49f709109cece880570a3d84c6de34f1f15da4cdc41387a4868f9.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{V84676P1-DS24-6RJB-770V-6G8EQ4BM65W1} 32a34056fbf49f709109cece880570a3d84c6de34f1f15da4cdc41387a4868f9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{V84676P1-DS24-6RJB-770V-6G8EQ4BM65W1}\StubPath = "C:\\Windows\\system32\\install\\server.exe Restart" 32a34056fbf49f709109cece880570a3d84c6de34f1f15da4cdc41387a4868f9.exe -
Processes:
resource yara_rule behavioral1/memory/2036-75-0x0000000000400000-0x00000000006F3000-memory.dmp upx behavioral1/memory/2032-99-0x0000000024010000-0x0000000024072000-memory.dmp upx behavioral1/memory/980-106-0x0000000000400000-0x00000000006F3000-memory.dmp upx behavioral1/memory/2032-107-0x0000000024080000-0x00000000240E2000-memory.dmp upx behavioral1/memory/980-112-0x0000000024080000-0x00000000240E2000-memory.dmp upx behavioral1/memory/980-114-0x0000000024080000-0x00000000240E2000-memory.dmp upx C:\Windows\SysWOW64\install\server.exe upx \Windows\SysWOW64\install\server.exe upx C:\Windows\SysWOW64\install\server.exe upx \Windows\SysWOW64\install\server.exe upx C:\Windows\SysWOW64\install\server.exe upx \Windows\SysWOW64\install\server.exe upx \Windows\SysWOW64\install\server.exe upx behavioral1/memory/1344-144-0x0000000000400000-0x00000000006F3000-memory.dmp upx C:\Windows\SysWOW64\install\server.exe upx behavioral1/memory/980-147-0x0000000024080000-0x00000000240E2000-memory.dmp upx -
Loads dropped DLL 4 IoCs
Processes:
32a34056fbf49f709109cece880570a3d84c6de34f1f15da4cdc41387a4868f9.exeWerFault.exepid process 980 32a34056fbf49f709109cece880570a3d84c6de34f1f15da4cdc41387a4868f9.exe 1228 WerFault.exe 1228 WerFault.exe 1228 WerFault.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
32a34056fbf49f709109cece880570a3d84c6de34f1f15da4cdc41387a4868f9.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run 32a34056fbf49f709109cece880570a3d84c6de34f1f15da4cdc41387a4868f9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\system32\\install\\server.exe" 32a34056fbf49f709109cece880570a3d84c6de34f1f15da4cdc41387a4868f9.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run 32a34056fbf49f709109cece880570a3d84c6de34f1f15da4cdc41387a4868f9.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\system32\\install\\server.exe" 32a34056fbf49f709109cece880570a3d84c6de34f1f15da4cdc41387a4868f9.exe -
Drops file in System32 directory 2 IoCs
Processes:
32a34056fbf49f709109cece880570a3d84c6de34f1f15da4cdc41387a4868f9.exedescription ioc process File created C:\Windows\SysWOW64\install\server.exe 32a34056fbf49f709109cece880570a3d84c6de34f1f15da4cdc41387a4868f9.exe File opened for modification C:\Windows\SysWOW64\install\server.exe 32a34056fbf49f709109cece880570a3d84c6de34f1f15da4cdc41387a4868f9.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
32a34056fbf49f709109cece880570a3d84c6de34f1f15da4cdc41387a4868f9.exe32a34056fbf49f709109cece880570a3d84c6de34f1f15da4cdc41387a4868f9.exeserver.exedescription pid process target process PID 2036 set thread context of 1892 2036 32a34056fbf49f709109cece880570a3d84c6de34f1f15da4cdc41387a4868f9.exe 32a34056fbf49f709109cece880570a3d84c6de34f1f15da4cdc41387a4868f9.exe PID 1892 set thread context of 2032 1892 32a34056fbf49f709109cece880570a3d84c6de34f1f15da4cdc41387a4868f9.exe 32a34056fbf49f709109cece880570a3d84c6de34f1f15da4cdc41387a4868f9.exe PID 1344 set thread context of 1476 1344 server.exe server.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 596 2036 WerFault.exe 32a34056fbf49f709109cece880570a3d84c6de34f1f15da4cdc41387a4868f9.exe 1228 1344 WerFault.exe server.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
32a34056fbf49f709109cece880570a3d84c6de34f1f15da4cdc41387a4868f9.exeserver.exepid process 2032 32a34056fbf49f709109cece880570a3d84c6de34f1f15da4cdc41387a4868f9.exe 1980 server.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
32a34056fbf49f709109cece880570a3d84c6de34f1f15da4cdc41387a4868f9.exepid process 980 32a34056fbf49f709109cece880570a3d84c6de34f1f15da4cdc41387a4868f9.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
32a34056fbf49f709109cece880570a3d84c6de34f1f15da4cdc41387a4868f9.exedescription pid process Token: SeDebugPrivilege 980 32a34056fbf49f709109cece880570a3d84c6de34f1f15da4cdc41387a4868f9.exe Token: SeDebugPrivilege 980 32a34056fbf49f709109cece880570a3d84c6de34f1f15da4cdc41387a4868f9.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
32a34056fbf49f709109cece880570a3d84c6de34f1f15da4cdc41387a4868f9.exe32a34056fbf49f709109cece880570a3d84c6de34f1f15da4cdc41387a4868f9.exe32a34056fbf49f709109cece880570a3d84c6de34f1f15da4cdc41387a4868f9.exedescription pid process target process PID 2036 wrote to memory of 1892 2036 32a34056fbf49f709109cece880570a3d84c6de34f1f15da4cdc41387a4868f9.exe 32a34056fbf49f709109cece880570a3d84c6de34f1f15da4cdc41387a4868f9.exe PID 2036 wrote to memory of 1892 2036 32a34056fbf49f709109cece880570a3d84c6de34f1f15da4cdc41387a4868f9.exe 32a34056fbf49f709109cece880570a3d84c6de34f1f15da4cdc41387a4868f9.exe PID 2036 wrote to memory of 1892 2036 32a34056fbf49f709109cece880570a3d84c6de34f1f15da4cdc41387a4868f9.exe 32a34056fbf49f709109cece880570a3d84c6de34f1f15da4cdc41387a4868f9.exe PID 2036 wrote to memory of 1892 2036 32a34056fbf49f709109cece880570a3d84c6de34f1f15da4cdc41387a4868f9.exe 32a34056fbf49f709109cece880570a3d84c6de34f1f15da4cdc41387a4868f9.exe PID 2036 wrote to memory of 1892 2036 32a34056fbf49f709109cece880570a3d84c6de34f1f15da4cdc41387a4868f9.exe 32a34056fbf49f709109cece880570a3d84c6de34f1f15da4cdc41387a4868f9.exe PID 2036 wrote to memory of 1892 2036 32a34056fbf49f709109cece880570a3d84c6de34f1f15da4cdc41387a4868f9.exe 32a34056fbf49f709109cece880570a3d84c6de34f1f15da4cdc41387a4868f9.exe PID 2036 wrote to memory of 1892 2036 32a34056fbf49f709109cece880570a3d84c6de34f1f15da4cdc41387a4868f9.exe 32a34056fbf49f709109cece880570a3d84c6de34f1f15da4cdc41387a4868f9.exe PID 2036 wrote to memory of 1892 2036 32a34056fbf49f709109cece880570a3d84c6de34f1f15da4cdc41387a4868f9.exe 32a34056fbf49f709109cece880570a3d84c6de34f1f15da4cdc41387a4868f9.exe PID 2036 wrote to memory of 1892 2036 32a34056fbf49f709109cece880570a3d84c6de34f1f15da4cdc41387a4868f9.exe 32a34056fbf49f709109cece880570a3d84c6de34f1f15da4cdc41387a4868f9.exe PID 2036 wrote to memory of 1892 2036 32a34056fbf49f709109cece880570a3d84c6de34f1f15da4cdc41387a4868f9.exe 32a34056fbf49f709109cece880570a3d84c6de34f1f15da4cdc41387a4868f9.exe PID 2036 wrote to memory of 1892 2036 32a34056fbf49f709109cece880570a3d84c6de34f1f15da4cdc41387a4868f9.exe 32a34056fbf49f709109cece880570a3d84c6de34f1f15da4cdc41387a4868f9.exe PID 2036 wrote to memory of 1892 2036 32a34056fbf49f709109cece880570a3d84c6de34f1f15da4cdc41387a4868f9.exe 32a34056fbf49f709109cece880570a3d84c6de34f1f15da4cdc41387a4868f9.exe PID 2036 wrote to memory of 596 2036 32a34056fbf49f709109cece880570a3d84c6de34f1f15da4cdc41387a4868f9.exe WerFault.exe PID 2036 wrote to memory of 596 2036 32a34056fbf49f709109cece880570a3d84c6de34f1f15da4cdc41387a4868f9.exe WerFault.exe PID 2036 wrote to memory of 596 2036 32a34056fbf49f709109cece880570a3d84c6de34f1f15da4cdc41387a4868f9.exe WerFault.exe PID 2036 wrote to memory of 596 2036 32a34056fbf49f709109cece880570a3d84c6de34f1f15da4cdc41387a4868f9.exe WerFault.exe PID 1892 wrote to memory of 2032 1892 32a34056fbf49f709109cece880570a3d84c6de34f1f15da4cdc41387a4868f9.exe 32a34056fbf49f709109cece880570a3d84c6de34f1f15da4cdc41387a4868f9.exe PID 1892 wrote to memory of 2032 1892 32a34056fbf49f709109cece880570a3d84c6de34f1f15da4cdc41387a4868f9.exe 32a34056fbf49f709109cece880570a3d84c6de34f1f15da4cdc41387a4868f9.exe PID 1892 wrote to memory of 2032 1892 32a34056fbf49f709109cece880570a3d84c6de34f1f15da4cdc41387a4868f9.exe 32a34056fbf49f709109cece880570a3d84c6de34f1f15da4cdc41387a4868f9.exe PID 1892 wrote to memory of 2032 1892 32a34056fbf49f709109cece880570a3d84c6de34f1f15da4cdc41387a4868f9.exe 32a34056fbf49f709109cece880570a3d84c6de34f1f15da4cdc41387a4868f9.exe PID 1892 wrote to memory of 2032 1892 32a34056fbf49f709109cece880570a3d84c6de34f1f15da4cdc41387a4868f9.exe 32a34056fbf49f709109cece880570a3d84c6de34f1f15da4cdc41387a4868f9.exe PID 1892 wrote to memory of 2032 1892 32a34056fbf49f709109cece880570a3d84c6de34f1f15da4cdc41387a4868f9.exe 32a34056fbf49f709109cece880570a3d84c6de34f1f15da4cdc41387a4868f9.exe PID 1892 wrote to memory of 2032 1892 32a34056fbf49f709109cece880570a3d84c6de34f1f15da4cdc41387a4868f9.exe 32a34056fbf49f709109cece880570a3d84c6de34f1f15da4cdc41387a4868f9.exe PID 1892 wrote to memory of 2032 1892 32a34056fbf49f709109cece880570a3d84c6de34f1f15da4cdc41387a4868f9.exe 32a34056fbf49f709109cece880570a3d84c6de34f1f15da4cdc41387a4868f9.exe PID 1892 wrote to memory of 2032 1892 32a34056fbf49f709109cece880570a3d84c6de34f1f15da4cdc41387a4868f9.exe 32a34056fbf49f709109cece880570a3d84c6de34f1f15da4cdc41387a4868f9.exe PID 1892 wrote to memory of 2032 1892 32a34056fbf49f709109cece880570a3d84c6de34f1f15da4cdc41387a4868f9.exe 32a34056fbf49f709109cece880570a3d84c6de34f1f15da4cdc41387a4868f9.exe PID 1892 wrote to memory of 2032 1892 32a34056fbf49f709109cece880570a3d84c6de34f1f15da4cdc41387a4868f9.exe 32a34056fbf49f709109cece880570a3d84c6de34f1f15da4cdc41387a4868f9.exe PID 1892 wrote to memory of 2032 1892 32a34056fbf49f709109cece880570a3d84c6de34f1f15da4cdc41387a4868f9.exe 32a34056fbf49f709109cece880570a3d84c6de34f1f15da4cdc41387a4868f9.exe PID 2032 wrote to memory of 112 2032 32a34056fbf49f709109cece880570a3d84c6de34f1f15da4cdc41387a4868f9.exe iexplore.exe PID 2032 wrote to memory of 112 2032 32a34056fbf49f709109cece880570a3d84c6de34f1f15da4cdc41387a4868f9.exe iexplore.exe PID 2032 wrote to memory of 112 2032 32a34056fbf49f709109cece880570a3d84c6de34f1f15da4cdc41387a4868f9.exe iexplore.exe PID 2032 wrote to memory of 112 2032 32a34056fbf49f709109cece880570a3d84c6de34f1f15da4cdc41387a4868f9.exe iexplore.exe PID 2032 wrote to memory of 112 2032 32a34056fbf49f709109cece880570a3d84c6de34f1f15da4cdc41387a4868f9.exe iexplore.exe PID 2032 wrote to memory of 112 2032 32a34056fbf49f709109cece880570a3d84c6de34f1f15da4cdc41387a4868f9.exe iexplore.exe PID 2032 wrote to memory of 112 2032 32a34056fbf49f709109cece880570a3d84c6de34f1f15da4cdc41387a4868f9.exe iexplore.exe PID 2032 wrote to memory of 112 2032 32a34056fbf49f709109cece880570a3d84c6de34f1f15da4cdc41387a4868f9.exe iexplore.exe PID 2032 wrote to memory of 112 2032 32a34056fbf49f709109cece880570a3d84c6de34f1f15da4cdc41387a4868f9.exe iexplore.exe PID 2032 wrote to memory of 112 2032 32a34056fbf49f709109cece880570a3d84c6de34f1f15da4cdc41387a4868f9.exe iexplore.exe PID 2032 wrote to memory of 112 2032 32a34056fbf49f709109cece880570a3d84c6de34f1f15da4cdc41387a4868f9.exe iexplore.exe PID 2032 wrote to memory of 112 2032 32a34056fbf49f709109cece880570a3d84c6de34f1f15da4cdc41387a4868f9.exe iexplore.exe PID 2032 wrote to memory of 112 2032 32a34056fbf49f709109cece880570a3d84c6de34f1f15da4cdc41387a4868f9.exe iexplore.exe PID 2032 wrote to memory of 112 2032 32a34056fbf49f709109cece880570a3d84c6de34f1f15da4cdc41387a4868f9.exe iexplore.exe PID 2032 wrote to memory of 112 2032 32a34056fbf49f709109cece880570a3d84c6de34f1f15da4cdc41387a4868f9.exe iexplore.exe PID 2032 wrote to memory of 112 2032 32a34056fbf49f709109cece880570a3d84c6de34f1f15da4cdc41387a4868f9.exe iexplore.exe PID 2032 wrote to memory of 112 2032 32a34056fbf49f709109cece880570a3d84c6de34f1f15da4cdc41387a4868f9.exe iexplore.exe PID 2032 wrote to memory of 112 2032 32a34056fbf49f709109cece880570a3d84c6de34f1f15da4cdc41387a4868f9.exe iexplore.exe PID 2032 wrote to memory of 112 2032 32a34056fbf49f709109cece880570a3d84c6de34f1f15da4cdc41387a4868f9.exe iexplore.exe PID 2032 wrote to memory of 112 2032 32a34056fbf49f709109cece880570a3d84c6de34f1f15da4cdc41387a4868f9.exe iexplore.exe PID 2032 wrote to memory of 112 2032 32a34056fbf49f709109cece880570a3d84c6de34f1f15da4cdc41387a4868f9.exe iexplore.exe PID 2032 wrote to memory of 112 2032 32a34056fbf49f709109cece880570a3d84c6de34f1f15da4cdc41387a4868f9.exe iexplore.exe PID 2032 wrote to memory of 112 2032 32a34056fbf49f709109cece880570a3d84c6de34f1f15da4cdc41387a4868f9.exe iexplore.exe PID 2032 wrote to memory of 112 2032 32a34056fbf49f709109cece880570a3d84c6de34f1f15da4cdc41387a4868f9.exe iexplore.exe PID 2032 wrote to memory of 112 2032 32a34056fbf49f709109cece880570a3d84c6de34f1f15da4cdc41387a4868f9.exe iexplore.exe PID 2032 wrote to memory of 112 2032 32a34056fbf49f709109cece880570a3d84c6de34f1f15da4cdc41387a4868f9.exe iexplore.exe PID 2032 wrote to memory of 112 2032 32a34056fbf49f709109cece880570a3d84c6de34f1f15da4cdc41387a4868f9.exe iexplore.exe PID 2032 wrote to memory of 112 2032 32a34056fbf49f709109cece880570a3d84c6de34f1f15da4cdc41387a4868f9.exe iexplore.exe PID 2032 wrote to memory of 112 2032 32a34056fbf49f709109cece880570a3d84c6de34f1f15da4cdc41387a4868f9.exe iexplore.exe PID 2032 wrote to memory of 112 2032 32a34056fbf49f709109cece880570a3d84c6de34f1f15da4cdc41387a4868f9.exe iexplore.exe PID 2032 wrote to memory of 112 2032 32a34056fbf49f709109cece880570a3d84c6de34f1f15da4cdc41387a4868f9.exe iexplore.exe PID 2032 wrote to memory of 112 2032 32a34056fbf49f709109cece880570a3d84c6de34f1f15da4cdc41387a4868f9.exe iexplore.exe PID 2032 wrote to memory of 112 2032 32a34056fbf49f709109cece880570a3d84c6de34f1f15da4cdc41387a4868f9.exe iexplore.exe PID 2032 wrote to memory of 112 2032 32a34056fbf49f709109cece880570a3d84c6de34f1f15da4cdc41387a4868f9.exe iexplore.exe PID 2032 wrote to memory of 112 2032 32a34056fbf49f709109cece880570a3d84c6de34f1f15da4cdc41387a4868f9.exe iexplore.exe PID 2032 wrote to memory of 112 2032 32a34056fbf49f709109cece880570a3d84c6de34f1f15da4cdc41387a4868f9.exe iexplore.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\32a34056fbf49f709109cece880570a3d84c6de34f1f15da4cdc41387a4868f9.exe"C:\Users\Admin\AppData\Local\Temp\32a34056fbf49f709109cece880570a3d84c6de34f1f15da4cdc41387a4868f9.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\32a34056fbf49f709109cece880570a3d84c6de34f1f15da4cdc41387a4868f9.exeC:\Users\Admin\AppData\Local\Temp\32a34056fbf49f709109cece880570a3d84c6de34f1f15da4cdc41387a4868f9.exe2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\32a34056fbf49f709109cece880570a3d84c6de34f1f15da4cdc41387a4868f9.exe"C:\Users\Admin\AppData\Local\Temp\32a34056fbf49f709109cece880570a3d84c6de34f1f15da4cdc41387a4868f9.exe"3⤵
- Adds policy Run key to start application
- Modifies Installed Components in the registry
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\32a34056fbf49f709109cece880570a3d84c6de34f1f15da4cdc41387a4868f9.exe"C:\Users\Admin\AppData\Local\Temp\32a34056fbf49f709109cece880570a3d84c6de34f1f15da4cdc41387a4868f9.exe"4⤵
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\install\server.exe"C:\Windows\system32\install\server.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\install\server.exeC:\Windows\SysWOW64\install\server.exe6⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\install\server.exe"C:\Windows\SysWOW64\install\server.exe"7⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1344 -s 3406⤵
- Loads dropped DLL
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2036 -s 3282⤵
- Program crash
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txtFilesize
232KB
MD50653ef16e1af7bd648bccdb0a5142e56
SHA145bad6714389f77d78d7283295bfb8655d3ce45d
SHA256e24d3be4e8223cbce4b61613579dc9873e61c58fa8a2aabefdf46b9a7c30af61
SHA512cec8570098707c1d4e417a15bf3a72f7829cbe594801e6d2d73783209d494fadaef840793b51e9f712baa5964b8d590c0213a08e130e3bd013cef0e330e8ae9d
-
C:\Windows\SysWOW64\install\server.exeFilesize
2.2MB
MD5bb176d591abf10ad736903f0c44dd3d2
SHA10cc9b99a34533f48c0a0758e99d675ffadf58b4a
SHA25632a34056fbf49f709109cece880570a3d84c6de34f1f15da4cdc41387a4868f9
SHA5125c53c4fd2396a797d87178e6a2cb20ddfae2c19211780483b56ab0c7d8dbc9b85a3cbb4c92e8fed53cf3de48677ea3560407be342755dc056de7e2980a8a0d12
-
C:\Windows\SysWOW64\install\server.exeFilesize
2.2MB
MD5bb176d591abf10ad736903f0c44dd3d2
SHA10cc9b99a34533f48c0a0758e99d675ffadf58b4a
SHA25632a34056fbf49f709109cece880570a3d84c6de34f1f15da4cdc41387a4868f9
SHA5125c53c4fd2396a797d87178e6a2cb20ddfae2c19211780483b56ab0c7d8dbc9b85a3cbb4c92e8fed53cf3de48677ea3560407be342755dc056de7e2980a8a0d12
-
C:\Windows\SysWOW64\install\server.exeFilesize
2.2MB
MD5bb176d591abf10ad736903f0c44dd3d2
SHA10cc9b99a34533f48c0a0758e99d675ffadf58b4a
SHA25632a34056fbf49f709109cece880570a3d84c6de34f1f15da4cdc41387a4868f9
SHA5125c53c4fd2396a797d87178e6a2cb20ddfae2c19211780483b56ab0c7d8dbc9b85a3cbb4c92e8fed53cf3de48677ea3560407be342755dc056de7e2980a8a0d12
-
C:\Windows\SysWOW64\install\server.exeFilesize
2.2MB
MD5bb176d591abf10ad736903f0c44dd3d2
SHA10cc9b99a34533f48c0a0758e99d675ffadf58b4a
SHA25632a34056fbf49f709109cece880570a3d84c6de34f1f15da4cdc41387a4868f9
SHA5125c53c4fd2396a797d87178e6a2cb20ddfae2c19211780483b56ab0c7d8dbc9b85a3cbb4c92e8fed53cf3de48677ea3560407be342755dc056de7e2980a8a0d12
-
\Windows\SysWOW64\install\server.exeFilesize
2.2MB
MD5bb176d591abf10ad736903f0c44dd3d2
SHA10cc9b99a34533f48c0a0758e99d675ffadf58b4a
SHA25632a34056fbf49f709109cece880570a3d84c6de34f1f15da4cdc41387a4868f9
SHA5125c53c4fd2396a797d87178e6a2cb20ddfae2c19211780483b56ab0c7d8dbc9b85a3cbb4c92e8fed53cf3de48677ea3560407be342755dc056de7e2980a8a0d12
-
\Windows\SysWOW64\install\server.exeFilesize
2.2MB
MD5bb176d591abf10ad736903f0c44dd3d2
SHA10cc9b99a34533f48c0a0758e99d675ffadf58b4a
SHA25632a34056fbf49f709109cece880570a3d84c6de34f1f15da4cdc41387a4868f9
SHA5125c53c4fd2396a797d87178e6a2cb20ddfae2c19211780483b56ab0c7d8dbc9b85a3cbb4c92e8fed53cf3de48677ea3560407be342755dc056de7e2980a8a0d12
-
\Windows\SysWOW64\install\server.exeFilesize
2.2MB
MD5bb176d591abf10ad736903f0c44dd3d2
SHA10cc9b99a34533f48c0a0758e99d675ffadf58b4a
SHA25632a34056fbf49f709109cece880570a3d84c6de34f1f15da4cdc41387a4868f9
SHA5125c53c4fd2396a797d87178e6a2cb20ddfae2c19211780483b56ab0c7d8dbc9b85a3cbb4c92e8fed53cf3de48677ea3560407be342755dc056de7e2980a8a0d12
-
\Windows\SysWOW64\install\server.exeFilesize
2.2MB
MD5bb176d591abf10ad736903f0c44dd3d2
SHA10cc9b99a34533f48c0a0758e99d675ffadf58b4a
SHA25632a34056fbf49f709109cece880570a3d84c6de34f1f15da4cdc41387a4868f9
SHA5125c53c4fd2396a797d87178e6a2cb20ddfae2c19211780483b56ab0c7d8dbc9b85a3cbb4c92e8fed53cf3de48677ea3560407be342755dc056de7e2980a8a0d12
-
memory/596-77-0x0000000000000000-mapping.dmp
-
memory/980-106-0x0000000000400000-0x00000000006F3000-memory.dmpFilesize
2.9MB
-
memory/980-148-0x0000000004EA0000-0x0000000005193000-memory.dmpFilesize
2.9MB
-
memory/980-147-0x0000000024080000-0x00000000240E2000-memory.dmpFilesize
392KB
-
memory/980-103-0x0000000000000000-mapping.dmp
-
memory/980-114-0x0000000024080000-0x00000000240E2000-memory.dmpFilesize
392KB
-
memory/980-110-0x0000000024080000-0x00000000240E2000-memory.dmpFilesize
392KB
-
memory/980-143-0x0000000004EA0000-0x0000000005193000-memory.dmpFilesize
2.9MB
-
memory/980-112-0x0000000024080000-0x00000000240E2000-memory.dmpFilesize
392KB
-
memory/1228-139-0x0000000000000000-mapping.dmp
-
memory/1344-144-0x0000000000400000-0x00000000006F3000-memory.dmpFilesize
2.9MB
-
memory/1344-117-0x0000000000000000-mapping.dmp
-
memory/1476-137-0x0000000000404A38-mapping.dmp
-
memory/1892-68-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/1892-72-0x0000000000404A38-mapping.dmp
-
memory/1892-70-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/1892-73-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/1892-74-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/1892-66-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/1892-63-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/1892-60-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/1892-58-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/1892-56-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/1892-55-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/2032-95-0x0000000000400000-0x0000000000543000-memory.dmpFilesize
1.3MB
-
memory/2032-79-0x0000000000400000-0x0000000000543000-memory.dmpFilesize
1.3MB
-
memory/2032-105-0x0000000001EE0000-0x00000000021D3000-memory.dmpFilesize
2.9MB
-
memory/2032-99-0x0000000024010000-0x0000000024072000-memory.dmpFilesize
392KB
-
memory/2032-97-0x0000000000400000-0x0000000000543000-memory.dmpFilesize
1.3MB
-
memory/2032-78-0x0000000000400000-0x0000000000543000-memory.dmpFilesize
1.3MB
-
memory/2032-94-0x000000000040BDE8-mapping.dmp
-
memory/2032-92-0x0000000000400000-0x0000000000543000-memory.dmpFilesize
1.3MB
-
memory/2032-89-0x0000000000400000-0x0000000000543000-memory.dmpFilesize
1.3MB
-
memory/2032-87-0x0000000000400000-0x0000000000543000-memory.dmpFilesize
1.3MB
-
memory/2032-85-0x0000000000400000-0x0000000000543000-memory.dmpFilesize
1.3MB
-
memory/2032-83-0x0000000000400000-0x0000000000543000-memory.dmpFilesize
1.3MB
-
memory/2032-81-0x0000000000400000-0x0000000000543000-memory.dmpFilesize
1.3MB
-
memory/2032-107-0x0000000024080000-0x00000000240E2000-memory.dmpFilesize
392KB
-
memory/2036-54-0x00000000760B1000-0x00000000760B3000-memory.dmpFilesize
8KB
-
memory/2036-76-0x0000000002F60000-0x0000000003253000-memory.dmpFilesize
2.9MB
-
memory/2036-75-0x0000000000400000-0x00000000006F3000-memory.dmpFilesize
2.9MB