75501dffe10e62d8fde7033c2ed428105e39335e0f5ad52b06ffec66c40c8a9d

Analysis

max time kernel
152s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
01-12-2022 03:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

75501dffe10e62d8fde7033c2ed428105e39335e0f5ad52b06ffec66c40c8a9d.exe
Size

332KB
MD5

774986b4933fada2a7d86fd8812f38ee
SHA1

009cbea9d50212250003a7c48c9598ad3e456b3d
SHA256

75501dffe10e62d8fde7033c2ed428105e39335e0f5ad52b06ffec66c40c8a9d
SHA512

43c9b736d04fcdc68a7dd6bd7173fafeb87b1ae72fe07e1beb259da238266549d0cb1e307fc60dac93655345c333b3ce4b4f3e918cc5052c81dc4b3c75cbd961
SSDEEP

6144:KkQU0/L5/fx9h/P3vgQf0R+738XSiJxlTbExPcxkn2PhDoHji3sl5p2+FMLZoe:5x0/jz5f0RO3+JTXIcyn2hcH+3sZTe

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1332	75501dffe10e62d8fde7033c2ed428105e39335e0f5ad52b06ffec66c40c8a9d.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4656 set thread context of 1332	4656	75501dffe10e62d8fde7033c2ed428105e39335e0f5ad52b06ffec66c40c8a9d.exe	79

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\win.ini	75501dffe10e62d8fde7033c2ed428105e39335e0f5ad52b06ffec66c40c8a9d.exe

Modifies registry class 47 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14161267-D9D9-1C52-7A34-B1925E64B192}\DefaultExtension	75501dffe10e62d8fde7033c2ed428105e39335e0f5ad52b06ffec66c40c8a9d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14161267-D9D9-1C52-7A34-B1925E64B192}\InprocHandler32	75501dffe10e62d8fde7033c2ed428105e39335e0f5ad52b06ffec66c40c8a9d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14161267-D9D9-1C52-7A34-B1925E64B192}\InprocHandler32\ = "ole32.dll"	75501dffe10e62d8fde7033c2ed428105e39335e0f5ad52b06ffec66c40c8a9d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14161267-D9D9-1C52-7A34-B1925E64B192}\LocalServer32	75501dffe10e62d8fde7033c2ed428105e39335e0f5ad52b06ffec66c40c8a9d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14161267-D9D9-1C52-7A34-B1925E64B192}\AuxUserType\3	75501dffe10e62d8fde7033c2ed428105e39335e0f5ad52b06ffec66c40c8a9d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14161267-D9D9-1C52-7A34-B1925E64B192}\DataFormats\GetSet	75501dffe10e62d8fde7033c2ed428105e39335e0f5ad52b06ffec66c40c8a9d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14161267-D9D9-1C52-7A34-B1925E64B192}\DataFormats\GetSet\1\ = "3,1,32,1"	75501dffe10e62d8fde7033c2ed428105e39335e0f5ad52b06ffec66c40c8a9d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14161267-D9D9-1C52-7A34-B1925E64B192}\DataFormats\GetSet\2\ = "1,1,1,1"	75501dffe10e62d8fde7033c2ed428105e39335e0f5ad52b06ffec66c40c8a9d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14161267-D9D9-1C52-7A34-B1925E64B192}\ProgID\ = "PowerPoint.Slide.12"	75501dffe10e62d8fde7033c2ed428105e39335e0f5ad52b06ffec66c40c8a9d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14161267-D9D9-1C52-7A34-B1925E64B192}\Verb	75501dffe10e62d8fde7033c2ed428105e39335e0f5ad52b06ffec66c40c8a9d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14161267-D9D9-1C52-7A34-B1925E64B192}\Verb\1	75501dffe10e62d8fde7033c2ed428105e39335e0f5ad52b06ffec66c40c8a9d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14161267-D9D9-1C52-7A34-B1925E64B192}\Element = "{6AEA156B-F8C7-05A2-151F-E41ACABCE41A}"	75501dffe10e62d8fde7033c2ed428105e39335e0f5ad52b06ffec66c40c8a9d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14161267-D9D9-1C52-7A34-B1925E64B192}\MiscStatus	75501dffe10e62d8fde7033c2ed428105e39335e0f5ad52b06ffec66c40c8a9d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14161267-D9D9-1C52-7A34-B1925E64B192}\Verb\0	75501dffe10e62d8fde7033c2ed428105e39335e0f5ad52b06ffec66c40c8a9d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14161267-D9D9-1C52-7A34-B1925E64B192}\Verb\1\ = "&Open,0,2"	75501dffe10e62d8fde7033c2ed428105e39335e0f5ad52b06ffec66c40c8a9d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14161267-D9D9-1C52-7A34-B1925E64B192}\Conversion	75501dffe10e62d8fde7033c2ed428105e39335e0f5ad52b06ffec66c40c8a9d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14161267-D9D9-1C52-7A34-B1925E64B192}\DataFormats\GetSet\3	75501dffe10e62d8fde7033c2ed428105e39335e0f5ad52b06ffec66c40c8a9d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14161267-D9D9-1C52-7A34-B1925E64B192}\Insertable	75501dffe10e62d8fde7033c2ed428105e39335e0f5ad52b06ffec66c40c8a9d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14161267-D9D9-1C52-7A34-B1925E64B192}\Insertable\	75501dffe10e62d8fde7033c2ed428105e39335e0f5ad52b06ffec66c40c8a9d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14161267-D9D9-1C52-7A34-B1925E64B192}\AuxUserType\2\ = "Slide"	75501dffe10e62d8fde7033c2ed428105e39335e0f5ad52b06ffec66c40c8a9d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14161267-D9D9-1C52-7A34-B1925E64B192}\AuxUserType\3\ = "Microsoft PowerPoint Slide"	75501dffe10e62d8fde7033c2ed428105e39335e0f5ad52b06ffec66c40c8a9d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14161267-D9D9-1C52-7A34-B1925E64B192}\MiscStatus\ = "0"	75501dffe10e62d8fde7033c2ed428105e39335e0f5ad52b06ffec66c40c8a9d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14161267-D9D9-1C52-7A34-B1925E64B192}\ = "Microsoft PowerPoint Slide"	75501dffe10e62d8fde7033c2ed428105e39335e0f5ad52b06ffec66c40c8a9d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14161267-D9D9-1C52-7A34-B1925E64B192}\AuxUserType	75501dffe10e62d8fde7033c2ed428105e39335e0f5ad52b06ffec66c40c8a9d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14161267-D9D9-1C52-7A34-B1925E64B192}\DataFormats	75501dffe10e62d8fde7033c2ed428105e39335e0f5ad52b06ffec66c40c8a9d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14161267-D9D9-1C52-7A34-B1925E64B192}\DataFormats\DefaultFile\ = "MSPresentation"	75501dffe10e62d8fde7033c2ed428105e39335e0f5ad52b06ffec66c40c8a9d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14161267-D9D9-1C52-7A34-B1925E64B192}\DefaultIcon	75501dffe10e62d8fde7033c2ed428105e39335e0f5ad52b06ffec66c40c8a9d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14161267-D9D9-1C52-7A34-B1925E64B192}	75501dffe10e62d8fde7033c2ed428105e39335e0f5ad52b06ffec66c40c8a9d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14161267-D9D9-1C52-7A34-B1925E64B192}\DataFormats\DefaultFile	75501dffe10e62d8fde7033c2ed428105e39335e0f5ad52b06ffec66c40c8a9d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14161267-D9D9-1C52-7A34-B1925E64B192}\DataFormats\GetSet\0	75501dffe10e62d8fde7033c2ed428105e39335e0f5ad52b06ffec66c40c8a9d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14161267-D9D9-1C52-7A34-B1925E64B192}\ProgID	75501dffe10e62d8fde7033c2ed428105e39335e0f5ad52b06ffec66c40c8a9d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14161267-D9D9-1C52-7A34-B1925E64B192}\Conversion\Readable	75501dffe10e62d8fde7033c2ed428105e39335e0f5ad52b06ffec66c40c8a9d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14161267-D9D9-1C52-7A34-B1925E64B192}\DataFormats\GetSet\4\ = "Rich Text Format,1,1,1"	75501dffe10e62d8fde7033c2ed428105e39335e0f5ad52b06ffec66c40c8a9d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14161267-D9D9-1C52-7A34-B1925E64B192}\DefaultIcon\ = "C:\\Program Files\\Microsoft Office\\Root\\Office16\\PPTICO.EXE,10"	75501dffe10e62d8fde7033c2ed428105e39335e0f5ad52b06ffec66c40c8a9d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14161267-D9D9-1C52-7A34-B1925E64B192}\LocalServer32\ = "\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\POWERPNT.EXE\""	75501dffe10e62d8fde7033c2ed428105e39335e0f5ad52b06ffec66c40c8a9d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14161267-D9D9-1C52-7A34-B1925E64B192}\DataFormats\GetSet\0\ = "3,1,32,1"	75501dffe10e62d8fde7033c2ed428105e39335e0f5ad52b06ffec66c40c8a9d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14161267-D9D9-1C52-7A34-B1925E64B192}\DataFormats\GetSet\2	75501dffe10e62d8fde7033c2ed428105e39335e0f5ad52b06ffec66c40c8a9d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14161267-D9D9-1C52-7A34-B1925E64B192}\Verb\0\ = "&Edit,0,2"	75501dffe10e62d8fde7033c2ed428105e39335e0f5ad52b06ffec66c40c8a9d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14161267-D9D9-1C52-7A34-B1925E64B192}\VersionIndependentProgID\ = "PowerPoint.Slide"	75501dffe10e62d8fde7033c2ed428105e39335e0f5ad52b06ffec66c40c8a9d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14161267-D9D9-1C52-7A34-B1925E64B192}\DataFormats\GetSet\3\ = "NoteshNote,-1,1,1"	75501dffe10e62d8fde7033c2ed428105e39335e0f5ad52b06ffec66c40c8a9d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14161267-D9D9-1C52-7A34-B1925E64B192}\DataFormats\GetSet\4	75501dffe10e62d8fde7033c2ed428105e39335e0f5ad52b06ffec66c40c8a9d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14161267-D9D9-1C52-7A34-B1925E64B192}\DefaultExtension\ = ".sldx, Microsoft PowerPoint Slide (.sldx)"	75501dffe10e62d8fde7033c2ed428105e39335e0f5ad52b06ffec66c40c8a9d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14161267-D9D9-1C52-7A34-B1925E64B192}\VersionIndependentProgID	75501dffe10e62d8fde7033c2ed428105e39335e0f5ad52b06ffec66c40c8a9d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14161267-D9D9-1C52-7A34-B1925E64B192}\AuxUserType\2	75501dffe10e62d8fde7033c2ed428105e39335e0f5ad52b06ffec66c40c8a9d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14161267-D9D9-1C52-7A34-B1925E64B192}\Conversion\Readable\Main	75501dffe10e62d8fde7033c2ed428105e39335e0f5ad52b06ffec66c40c8a9d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14161267-D9D9-1C52-7A34-B1925E64B192}\Conversion\Readable\Main\ = "MSPowerPointSho,MSPresentation,PowerPoint.Show.4,PowerPoint.Slide.4,PowerPoint.Show.7,PowerPoint.Slide.7,PowerPoint.Show.8,PowerPoint.Slide.8"	75501dffe10e62d8fde7033c2ed428105e39335e0f5ad52b06ffec66c40c8a9d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{14161267-D9D9-1C52-7A34-B1925E64B192}\DataFormats\GetSet\1	75501dffe10e62d8fde7033c2ed428105e39335e0f5ad52b06ffec66c40c8a9d.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\75501dffe10e62d8fde7033c2ed428105e39335e0f5ad52b06ffec66c40c8a9d.exe:{03534742-799AC91E-504AE02D-F032B5B7}	75501dffe10e62d8fde7033c2ed428105e39335e0f5ad52b06ffec66c40c8a9d.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4656	75501dffe10e62d8fde7033c2ed428105e39335e0f5ad52b06ffec66c40c8a9d.exe
4656	75501dffe10e62d8fde7033c2ed428105e39335e0f5ad52b06ffec66c40c8a9d.exe
1332	75501dffe10e62d8fde7033c2ed428105e39335e0f5ad52b06ffec66c40c8a9d.exe
1332	75501dffe10e62d8fde7033c2ed428105e39335e0f5ad52b06ffec66c40c8a9d.exe
1332	75501dffe10e62d8fde7033c2ed428105e39335e0f5ad52b06ffec66c40c8a9d.exe
1332	75501dffe10e62d8fde7033c2ed428105e39335e0f5ad52b06ffec66c40c8a9d.exe
1332	75501dffe10e62d8fde7033c2ed428105e39335e0f5ad52b06ffec66c40c8a9d.exe
1332	75501dffe10e62d8fde7033c2ed428105e39335e0f5ad52b06ffec66c40c8a9d.exe
1332	75501dffe10e62d8fde7033c2ed428105e39335e0f5ad52b06ffec66c40c8a9d.exe
1332	75501dffe10e62d8fde7033c2ed428105e39335e0f5ad52b06ffec66c40c8a9d.exe
1332	75501dffe10e62d8fde7033c2ed428105e39335e0f5ad52b06ffec66c40c8a9d.exe
1332	75501dffe10e62d8fde7033c2ed428105e39335e0f5ad52b06ffec66c40c8a9d.exe
1332	75501dffe10e62d8fde7033c2ed428105e39335e0f5ad52b06ffec66c40c8a9d.exe
1332	75501dffe10e62d8fde7033c2ed428105e39335e0f5ad52b06ffec66c40c8a9d.exe
1332	75501dffe10e62d8fde7033c2ed428105e39335e0f5ad52b06ffec66c40c8a9d.exe
1332	75501dffe10e62d8fde7033c2ed428105e39335e0f5ad52b06ffec66c40c8a9d.exe
1332	75501dffe10e62d8fde7033c2ed428105e39335e0f5ad52b06ffec66c40c8a9d.exe
1332	75501dffe10e62d8fde7033c2ed428105e39335e0f5ad52b06ffec66c40c8a9d.exe
1332	75501dffe10e62d8fde7033c2ed428105e39335e0f5ad52b06ffec66c40c8a9d.exe
1332	75501dffe10e62d8fde7033c2ed428105e39335e0f5ad52b06ffec66c40c8a9d.exe
1332	75501dffe10e62d8fde7033c2ed428105e39335e0f5ad52b06ffec66c40c8a9d.exe
1332	75501dffe10e62d8fde7033c2ed428105e39335e0f5ad52b06ffec66c40c8a9d.exe
1332	75501dffe10e62d8fde7033c2ed428105e39335e0f5ad52b06ffec66c40c8a9d.exe
1332	75501dffe10e62d8fde7033c2ed428105e39335e0f5ad52b06ffec66c40c8a9d.exe
1332	75501dffe10e62d8fde7033c2ed428105e39335e0f5ad52b06ffec66c40c8a9d.exe
1332	75501dffe10e62d8fde7033c2ed428105e39335e0f5ad52b06ffec66c40c8a9d.exe
1332	75501dffe10e62d8fde7033c2ed428105e39335e0f5ad52b06ffec66c40c8a9d.exe
1332	75501dffe10e62d8fde7033c2ed428105e39335e0f5ad52b06ffec66c40c8a9d.exe
1332	75501dffe10e62d8fde7033c2ed428105e39335e0f5ad52b06ffec66c40c8a9d.exe
1332	75501dffe10e62d8fde7033c2ed428105e39335e0f5ad52b06ffec66c40c8a9d.exe
1332	75501dffe10e62d8fde7033c2ed428105e39335e0f5ad52b06ffec66c40c8a9d.exe
1332	75501dffe10e62d8fde7033c2ed428105e39335e0f5ad52b06ffec66c40c8a9d.exe
1332	75501dffe10e62d8fde7033c2ed428105e39335e0f5ad52b06ffec66c40c8a9d.exe
1332	75501dffe10e62d8fde7033c2ed428105e39335e0f5ad52b06ffec66c40c8a9d.exe
1332	75501dffe10e62d8fde7033c2ed428105e39335e0f5ad52b06ffec66c40c8a9d.exe
1332	75501dffe10e62d8fde7033c2ed428105e39335e0f5ad52b06ffec66c40c8a9d.exe
1332	75501dffe10e62d8fde7033c2ed428105e39335e0f5ad52b06ffec66c40c8a9d.exe
1332	75501dffe10e62d8fde7033c2ed428105e39335e0f5ad52b06ffec66c40c8a9d.exe
1332	75501dffe10e62d8fde7033c2ed428105e39335e0f5ad52b06ffec66c40c8a9d.exe
1332	75501dffe10e62d8fde7033c2ed428105e39335e0f5ad52b06ffec66c40c8a9d.exe
1332	75501dffe10e62d8fde7033c2ed428105e39335e0f5ad52b06ffec66c40c8a9d.exe
1332	75501dffe10e62d8fde7033c2ed428105e39335e0f5ad52b06ffec66c40c8a9d.exe
1332	75501dffe10e62d8fde7033c2ed428105e39335e0f5ad52b06ffec66c40c8a9d.exe
1332	75501dffe10e62d8fde7033c2ed428105e39335e0f5ad52b06ffec66c40c8a9d.exe
1332	75501dffe10e62d8fde7033c2ed428105e39335e0f5ad52b06ffec66c40c8a9d.exe
1332	75501dffe10e62d8fde7033c2ed428105e39335e0f5ad52b06ffec66c40c8a9d.exe
1332	75501dffe10e62d8fde7033c2ed428105e39335e0f5ad52b06ffec66c40c8a9d.exe
1332	75501dffe10e62d8fde7033c2ed428105e39335e0f5ad52b06ffec66c40c8a9d.exe
1332	75501dffe10e62d8fde7033c2ed428105e39335e0f5ad52b06ffec66c40c8a9d.exe
1332	75501dffe10e62d8fde7033c2ed428105e39335e0f5ad52b06ffec66c40c8a9d.exe
1332	75501dffe10e62d8fde7033c2ed428105e39335e0f5ad52b06ffec66c40c8a9d.exe
1332	75501dffe10e62d8fde7033c2ed428105e39335e0f5ad52b06ffec66c40c8a9d.exe
1332	75501dffe10e62d8fde7033c2ed428105e39335e0f5ad52b06ffec66c40c8a9d.exe
1332	75501dffe10e62d8fde7033c2ed428105e39335e0f5ad52b06ffec66c40c8a9d.exe
1332	75501dffe10e62d8fde7033c2ed428105e39335e0f5ad52b06ffec66c40c8a9d.exe
1332	75501dffe10e62d8fde7033c2ed428105e39335e0f5ad52b06ffec66c40c8a9d.exe
1332	75501dffe10e62d8fde7033c2ed428105e39335e0f5ad52b06ffec66c40c8a9d.exe
1332	75501dffe10e62d8fde7033c2ed428105e39335e0f5ad52b06ffec66c40c8a9d.exe
1332	75501dffe10e62d8fde7033c2ed428105e39335e0f5ad52b06ffec66c40c8a9d.exe
1332	75501dffe10e62d8fde7033c2ed428105e39335e0f5ad52b06ffec66c40c8a9d.exe
1332	75501dffe10e62d8fde7033c2ed428105e39335e0f5ad52b06ffec66c40c8a9d.exe
1332	75501dffe10e62d8fde7033c2ed428105e39335e0f5ad52b06ffec66c40c8a9d.exe
1332	75501dffe10e62d8fde7033c2ed428105e39335e0f5ad52b06ffec66c40c8a9d.exe
1332	75501dffe10e62d8fde7033c2ed428105e39335e0f5ad52b06ffec66c40c8a9d.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4656	75501dffe10e62d8fde7033c2ed428105e39335e0f5ad52b06ffec66c40c8a9d.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4656 wrote to memory of 1332	4656	75501dffe10e62d8fde7033c2ed428105e39335e0f5ad52b06ffec66c40c8a9d.exe	79
PID 4656 wrote to memory of 1332	4656	75501dffe10e62d8fde7033c2ed428105e39335e0f5ad52b06ffec66c40c8a9d.exe	79
PID 4656 wrote to memory of 1332	4656	75501dffe10e62d8fde7033c2ed428105e39335e0f5ad52b06ffec66c40c8a9d.exe	79
PID 4656 wrote to memory of 1332	4656	75501dffe10e62d8fde7033c2ed428105e39335e0f5ad52b06ffec66c40c8a9d.exe	79
PID 4656 wrote to memory of 1332	4656	75501dffe10e62d8fde7033c2ed428105e39335e0f5ad52b06ffec66c40c8a9d.exe	79
PID 4656 wrote to memory of 1332	4656	75501dffe10e62d8fde7033c2ed428105e39335e0f5ad52b06ffec66c40c8a9d.exe	79
PID 4656 wrote to memory of 1332	4656	75501dffe10e62d8fde7033c2ed428105e39335e0f5ad52b06ffec66c40c8a9d.exe	79
PID 1332 wrote to memory of 3044	1332	75501dffe10e62d8fde7033c2ed428105e39335e0f5ad52b06ffec66c40c8a9d.exe	43
PID 1332 wrote to memory of 3044	1332	75501dffe10e62d8fde7033c2ed428105e39335e0f5ad52b06ffec66c40c8a9d.exe	43
PID 1332 wrote to memory of 3044	1332	75501dffe10e62d8fde7033c2ed428105e39335e0f5ad52b06ffec66c40c8a9d.exe	43
PID 1332 wrote to memory of 3044	1332	75501dffe10e62d8fde7033c2ed428105e39335e0f5ad52b06ffec66c40c8a9d.exe	43
PID 1332 wrote to memory of 3044	1332	75501dffe10e62d8fde7033c2ed428105e39335e0f5ad52b06ffec66c40c8a9d.exe	43
PID 1332 wrote to memory of 3044	1332	75501dffe10e62d8fde7033c2ed428105e39335e0f5ad52b06ffec66c40c8a9d.exe	43
PID 1332 wrote to memory of 3044	1332	75501dffe10e62d8fde7033c2ed428105e39335e0f5ad52b06ffec66c40c8a9d.exe	43
PID 1332 wrote to memory of 3044	1332	75501dffe10e62d8fde7033c2ed428105e39335e0f5ad52b06ffec66c40c8a9d.exe	43
PID 1332 wrote to memory of 3044	1332	75501dffe10e62d8fde7033c2ed428105e39335e0f5ad52b06ffec66c40c8a9d.exe	43
PID 1332 wrote to memory of 3044	1332	75501dffe10e62d8fde7033c2ed428105e39335e0f5ad52b06ffec66c40c8a9d.exe	43
PID 1332 wrote to memory of 3044	1332	75501dffe10e62d8fde7033c2ed428105e39335e0f5ad52b06ffec66c40c8a9d.exe	43
PID 1332 wrote to memory of 3044	1332	75501dffe10e62d8fde7033c2ed428105e39335e0f5ad52b06ffec66c40c8a9d.exe	43
PID 1332 wrote to memory of 3044	1332	75501dffe10e62d8fde7033c2ed428105e39335e0f5ad52b06ffec66c40c8a9d.exe	43
PID 1332 wrote to memory of 3044	1332	75501dffe10e62d8fde7033c2ed428105e39335e0f5ad52b06ffec66c40c8a9d.exe	43
PID 1332 wrote to memory of 3044	1332	75501dffe10e62d8fde7033c2ed428105e39335e0f5ad52b06ffec66c40c8a9d.exe	43
PID 1332 wrote to memory of 3044	1332	75501dffe10e62d8fde7033c2ed428105e39335e0f5ad52b06ffec66c40c8a9d.exe	43
PID 1332 wrote to memory of 3044	1332	75501dffe10e62d8fde7033c2ed428105e39335e0f5ad52b06ffec66c40c8a9d.exe	43
PID 1332 wrote to memory of 3044	1332	75501dffe10e62d8fde7033c2ed428105e39335e0f5ad52b06ffec66c40c8a9d.exe	43
PID 1332 wrote to memory of 3044	1332	75501dffe10e62d8fde7033c2ed428105e39335e0f5ad52b06ffec66c40c8a9d.exe	43
PID 1332 wrote to memory of 3044	1332	75501dffe10e62d8fde7033c2ed428105e39335e0f5ad52b06ffec66c40c8a9d.exe	43
PID 1332 wrote to memory of 3044	1332	75501dffe10e62d8fde7033c2ed428105e39335e0f5ad52b06ffec66c40c8a9d.exe	43
PID 1332 wrote to memory of 3044	1332	75501dffe10e62d8fde7033c2ed428105e39335e0f5ad52b06ffec66c40c8a9d.exe	43
PID 1332 wrote to memory of 3044	1332	75501dffe10e62d8fde7033c2ed428105e39335e0f5ad52b06ffec66c40c8a9d.exe	43
PID 1332 wrote to memory of 3044	1332	75501dffe10e62d8fde7033c2ed428105e39335e0f5ad52b06ffec66c40c8a9d.exe	43
PID 1332 wrote to memory of 3044	1332	75501dffe10e62d8fde7033c2ed428105e39335e0f5ad52b06ffec66c40c8a9d.exe	43
PID 1332 wrote to memory of 3044	1332	75501dffe10e62d8fde7033c2ed428105e39335e0f5ad52b06ffec66c40c8a9d.exe	43
PID 1332 wrote to memory of 3044	1332	75501dffe10e62d8fde7033c2ed428105e39335e0f5ad52b06ffec66c40c8a9d.exe	43
PID 1332 wrote to memory of 3044	1332	75501dffe10e62d8fde7033c2ed428105e39335e0f5ad52b06ffec66c40c8a9d.exe	43
PID 1332 wrote to memory of 3044	1332	75501dffe10e62d8fde7033c2ed428105e39335e0f5ad52b06ffec66c40c8a9d.exe	43
PID 1332 wrote to memory of 3044	1332	75501dffe10e62d8fde7033c2ed428105e39335e0f5ad52b06ffec66c40c8a9d.exe	43
PID 1332 wrote to memory of 3044	1332	75501dffe10e62d8fde7033c2ed428105e39335e0f5ad52b06ffec66c40c8a9d.exe	43
PID 1332 wrote to memory of 3044	1332	75501dffe10e62d8fde7033c2ed428105e39335e0f5ad52b06ffec66c40c8a9d.exe	43
PID 1332 wrote to memory of 3044	1332	75501dffe10e62d8fde7033c2ed428105e39335e0f5ad52b06ffec66c40c8a9d.exe	43
PID 1332 wrote to memory of 3044	1332	75501dffe10e62d8fde7033c2ed428105e39335e0f5ad52b06ffec66c40c8a9d.exe	43
PID 1332 wrote to memory of 3044	1332	75501dffe10e62d8fde7033c2ed428105e39335e0f5ad52b06ffec66c40c8a9d.exe	43
PID 1332 wrote to memory of 3044	1332	75501dffe10e62d8fde7033c2ed428105e39335e0f5ad52b06ffec66c40c8a9d.exe	43
PID 1332 wrote to memory of 3044	1332	75501dffe10e62d8fde7033c2ed428105e39335e0f5ad52b06ffec66c40c8a9d.exe	43
PID 1332 wrote to memory of 3044	1332	75501dffe10e62d8fde7033c2ed428105e39335e0f5ad52b06ffec66c40c8a9d.exe	43
PID 1332 wrote to memory of 3044	1332	75501dffe10e62d8fde7033c2ed428105e39335e0f5ad52b06ffec66c40c8a9d.exe	43
PID 1332 wrote to memory of 3044	1332	75501dffe10e62d8fde7033c2ed428105e39335e0f5ad52b06ffec66c40c8a9d.exe	43
PID 1332 wrote to memory of 3044	1332	75501dffe10e62d8fde7033c2ed428105e39335e0f5ad52b06ffec66c40c8a9d.exe	43
PID 1332 wrote to memory of 3044	1332	75501dffe10e62d8fde7033c2ed428105e39335e0f5ad52b06ffec66c40c8a9d.exe	43
PID 1332 wrote to memory of 3044	1332	75501dffe10e62d8fde7033c2ed428105e39335e0f5ad52b06ffec66c40c8a9d.exe	43
PID 1332 wrote to memory of 3044	1332	75501dffe10e62d8fde7033c2ed428105e39335e0f5ad52b06ffec66c40c8a9d.exe	43
PID 1332 wrote to memory of 3044	1332	75501dffe10e62d8fde7033c2ed428105e39335e0f5ad52b06ffec66c40c8a9d.exe	43
PID 1332 wrote to memory of 3044	1332	75501dffe10e62d8fde7033c2ed428105e39335e0f5ad52b06ffec66c40c8a9d.exe	43
PID 1332 wrote to memory of 3044	1332	75501dffe10e62d8fde7033c2ed428105e39335e0f5ad52b06ffec66c40c8a9d.exe	43
PID 1332 wrote to memory of 3044	1332	75501dffe10e62d8fde7033c2ed428105e39335e0f5ad52b06ffec66c40c8a9d.exe	43
PID 1332 wrote to memory of 3044	1332	75501dffe10e62d8fde7033c2ed428105e39335e0f5ad52b06ffec66c40c8a9d.exe	43
PID 1332 wrote to memory of 3044	1332	75501dffe10e62d8fde7033c2ed428105e39335e0f5ad52b06ffec66c40c8a9d.exe	43
PID 1332 wrote to memory of 3044	1332	75501dffe10e62d8fde7033c2ed428105e39335e0f5ad52b06ffec66c40c8a9d.exe	43
PID 1332 wrote to memory of 3044	1332	75501dffe10e62d8fde7033c2ed428105e39335e0f5ad52b06ffec66c40c8a9d.exe	43
PID 1332 wrote to memory of 3044	1332	75501dffe10e62d8fde7033c2ed428105e39335e0f5ad52b06ffec66c40c8a9d.exe	43
PID 1332 wrote to memory of 3044	1332	75501dffe10e62d8fde7033c2ed428105e39335e0f5ad52b06ffec66c40c8a9d.exe	43
PID 1332 wrote to memory of 3044	1332	75501dffe10e62d8fde7033c2ed428105e39335e0f5ad52b06ffec66c40c8a9d.exe	43
PID 1332 wrote to memory of 3044	1332	75501dffe10e62d8fde7033c2ed428105e39335e0f5ad52b06ffec66c40c8a9d.exe	43
PID 1332 wrote to memory of 3044	1332	75501dffe10e62d8fde7033c2ed428105e39335e0f5ad52b06ffec66c40c8a9d.exe	43

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3044
- C:\Users\Admin\AppData\Local\Temp\75501dffe10e62d8fde7033c2ed428105e39335e0f5ad52b06ffec66c40c8a9d.exe
  "C:\Users\Admin\AppData\Local\Temp\75501dffe10e62d8fde7033c2ed428105e39335e0f5ad52b06ffec66c40c8a9d.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Drops file in Windows directory
  - Modifies registry class
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4656
- - C:\Users\Admin\AppData\Local\Temp\75501dffe10e62d8fde7033c2ed428105e39335e0f5ad52b06ffec66c40c8a9d.exe
    "C:\Users\Admin\AppData\Local\Temp\75501dffe10e62d8fde7033c2ed428105e39335e0f5ad52b06ffec66c40c8a9d.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:1332

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\75501dffe10e62d8fde7033c2ed428105e39335e0f5ad52b06ffec66c40c8a9d.exe

Filesize
332KB

MD5
774986b4933fada2a7d86fd8812f38ee

SHA1
009cbea9d50212250003a7c48c9598ad3e456b3d

SHA256
75501dffe10e62d8fde7033c2ed428105e39335e0f5ad52b06ffec66c40c8a9d

SHA512
43c9b736d04fcdc68a7dd6bd7173fafeb87b1ae72fe07e1beb259da238266549d0cb1e307fc60dac93655345c333b3ce4b4f3e918cc5052c81dc4b3c75cbd961

Download Submit
memory/1332-138-0x0000000000000000-mapping.dmp

Download
memory/1332-139-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download
memory/1332-145-0x0000000000400000-0x0000000000402400-memory.dmp

Filesize
9KB

Download
memory/4656-132-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/4656-133-0x0000000000730000-0x0000000000762000-memory.dmp

Filesize
200KB

Download
memory/4656-134-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/4656-136-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/4656-142-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/4656-143-0x0000000000730000-0x0000000000762000-memory.dmp

Filesize
200KB

Download
memory/4656-144-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download