2065ac4d426063a6d9c0ec955751a1a14867e3a1b73a91ad25208dec3671a56e

Analysis

max time kernel
148s
max time network
164s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
01/12/2022, 10:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2065ac4d426063a6d9c0ec955751a1a14867e3a1b73a91ad25208dec3671a56e.exe
Size

792KB
MD5

50e78782b35bfcf7d32d6545657b4089
SHA1

cfc24ec1025d094da83628151fecf781dfd69fd1
SHA256

2065ac4d426063a6d9c0ec955751a1a14867e3a1b73a91ad25208dec3671a56e
SHA512

56f9ede374babc6c4af9d82a040e7e78ee2f6ad77f72c323e8d1385ceb45693b3bcc5740bcd1a24e739713333a6be525bff010ef0d9c97a8bda16582cb283839
SSDEEP

12288:dbG/winQbx9f7Oy8aidn58gWOINqiwoEyMj:dbQwinUpQd58VOIsiXEn

Score

8^/10

persistence upx

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
1516	svchost.exe
1900	DNF01Á¬·¢¹¤¾ß.exe
576	Tencenthw.exe
340	vKINSTALLERS_43_25100.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000b0000000122f0-55.dat	upx
behavioral1/files/0x000b0000000122f0-56.dat	upx
behavioral1/files/0x000b0000000122f0-58.dat	upx
behavioral1/memory/1516-73-0x0000000000400000-0x000000000042D000-memory.dmp	upx

Loads dropped DLL 13 IoCs

pid	Process
1504	2065ac4d426063a6d9c0ec955751a1a14867e3a1b73a91ad25208dec3671a56e.exe
1504	2065ac4d426063a6d9c0ec955751a1a14867e3a1b73a91ad25208dec3671a56e.exe
1504	2065ac4d426063a6d9c0ec955751a1a14867e3a1b73a91ad25208dec3671a56e.exe
1504	2065ac4d426063a6d9c0ec955751a1a14867e3a1b73a91ad25208dec3671a56e.exe
1516	svchost.exe
1516	svchost.exe
1504	2065ac4d426063a6d9c0ec955751a1a14867e3a1b73a91ad25208dec3671a56e.exe
1476	WerFault.exe
1476	WerFault.exe
340	vKINSTALLERS_43_25100.exe
340	vKINSTALLERS_43_25100.exe
340	vKINSTALLERS_43_25100.exe
1476	WerFault.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\54rk = "C:\\Windows\\SysWOW64\\Tencenthw.exe"	Tencenthw.exe

Drops file in System32 directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\cfghw.tmp	svchost.exe
File created	C:\Windows\SysWOW64\Tencenthw.exe	svchost.exe
File created	C:\Windows\SysWOW64\e0x2.dll	svchost.exe
File created	C:\Windows\SysWOW64\gametohw.exe	svchost.exe
File opened for modification	C:\Windows\SysWOW64\cfghw.tmp	Tencenthw.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1476	576	WerFault.exe	30

Modifies Internet Explorer settings 1 TTPs 64 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "31"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	2065ac4d426063a6d9c0ec955751a1a14867e3a1b73a91ad25208dec3671a56e.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "6"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "0"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000fbec07815684004d899a318f710de6af0000000002000000000010660000000100002000000015d40572aaa3b7fc265048549b76a51841778a932c7f9329addeae9b8e457798000000000e80000000020000200000005c339b8220202d2bb434954c2f3dd1e4a9250a58bfdd7026e1047e81b5afb08290000000a06605417b360a8ab6f4926866e18ee1bbee6ee9c45a2143c043c0c5472cee817f52656f23b32db6113d9669771ffed331c1b06f011e54c43179902df94dc23b840d862a26e2851af8d6e7ea119c72d0da1db04c783c0acea890e01169f920311f65921a8d5e0119bff7d6aa07e6c14665a5815e72dbf82619b6dd0c5a2790d93c62c0267ad7e2295dce76f7fdb5bec5400000007f43e91681f78f6d23d76141f20cbd5a498a7910d163069bcc8cd36979f691a26073ceea923140f6f38329a4795fe17b69b95a0f4a33c7f0b1cde361a29c4be1	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "146"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "121"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main	2065ac4d426063a6d9c0ec955751a1a14867e3a1b73a91ad25208dec3671a56e.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DOMStorage\hugedomains.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "25"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "115"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "6"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.google.com\ = "25"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 504fd7574007d901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.google.com	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "121"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000fbec07815684004d899a318f710de6af0000000002000000000010660000000100002000000047ce89fde9c9218a819dbd4dc138289ae13eb0f6d3a2f73638f14a839a3500cf000000000e80000000020000200000005fea55b4f3ad66f47f04e27010119bcea86cb024627bc30e57efe657f22659ac20000000bce8e5f492d9d849ca8fc67b4e3c0d53a4a149d18247b5fdd49fc81daabb56ba40000000f14e712db21f4588a187550cc1553034c067b7019e37dce672ff7f4b7641b03455d772cc7fc0fac14ffabfe41d711c50f40d37be7a63d633dc45d5cfcab54ea5	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{49B3E4B1-7333-11ED-87F1-C6AD45B766F5} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "376854948"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "0"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com\Total = "25"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "140"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DOMStorage\hugedomains.com	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "115"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "6"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious behavior: EnumeratesProcesses 28 IoCs

pid	Process
576	Tencenthw.exe
576	Tencenthw.exe
576	Tencenthw.exe
576	Tencenthw.exe
576	Tencenthw.exe
576	Tencenthw.exe
576	Tencenthw.exe
576	Tencenthw.exe
576	Tencenthw.exe
576	Tencenthw.exe
576	Tencenthw.exe
576	Tencenthw.exe
576	Tencenthw.exe
576	Tencenthw.exe
576	Tencenthw.exe
576	Tencenthw.exe
576	Tencenthw.exe
576	Tencenthw.exe
576	Tencenthw.exe
576	Tencenthw.exe
576	Tencenthw.exe
576	Tencenthw.exe
576	Tencenthw.exe
576	Tencenthw.exe
576	Tencenthw.exe
576	Tencenthw.exe
576	Tencenthw.exe
576	Tencenthw.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: 33	2188	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2188	AUDIODG.EXE
Token: 33	2188	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2188	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
876	iexplore.exe

Suspicious use of SetWindowsHookEx 11 IoCs

pid	Process
1504	2065ac4d426063a6d9c0ec955751a1a14867e3a1b73a91ad25208dec3671a56e.exe
1504	2065ac4d426063a6d9c0ec955751a1a14867e3a1b73a91ad25208dec3671a56e.exe
1504	2065ac4d426063a6d9c0ec955751a1a14867e3a1b73a91ad25208dec3671a56e.exe
1504	2065ac4d426063a6d9c0ec955751a1a14867e3a1b73a91ad25208dec3671a56e.exe
1900	DNF01Á¬·¢¹¤¾ß.exe
1900	DNF01Á¬·¢¹¤¾ß.exe
1900	DNF01Á¬·¢¹¤¾ß.exe
876	iexplore.exe
876	iexplore.exe
428	IEXPLORE.EXE
428	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 1504 wrote to memory of 1516	1504	2065ac4d426063a6d9c0ec955751a1a14867e3a1b73a91ad25208dec3671a56e.exe	28
PID 1504 wrote to memory of 1516	1504	2065ac4d426063a6d9c0ec955751a1a14867e3a1b73a91ad25208dec3671a56e.exe	28
PID 1504 wrote to memory of 1516	1504	2065ac4d426063a6d9c0ec955751a1a14867e3a1b73a91ad25208dec3671a56e.exe	28
PID 1504 wrote to memory of 1516	1504	2065ac4d426063a6d9c0ec955751a1a14867e3a1b73a91ad25208dec3671a56e.exe	28
PID 1504 wrote to memory of 1900	1504	2065ac4d426063a6d9c0ec955751a1a14867e3a1b73a91ad25208dec3671a56e.exe	29
PID 1504 wrote to memory of 1900	1504	2065ac4d426063a6d9c0ec955751a1a14867e3a1b73a91ad25208dec3671a56e.exe	29
PID 1504 wrote to memory of 1900	1504	2065ac4d426063a6d9c0ec955751a1a14867e3a1b73a91ad25208dec3671a56e.exe	29
PID 1504 wrote to memory of 1900	1504	2065ac4d426063a6d9c0ec955751a1a14867e3a1b73a91ad25208dec3671a56e.exe	29
PID 1516 wrote to memory of 576	1516	svchost.exe	30
PID 1516 wrote to memory of 576	1516	svchost.exe	30
PID 1516 wrote to memory of 576	1516	svchost.exe	30
PID 1516 wrote to memory of 576	1516	svchost.exe	30
PID 1900 wrote to memory of 876	1900	DNF01Á¬·¢¹¤¾ß.exe	31
PID 1900 wrote to memory of 876	1900	DNF01Á¬·¢¹¤¾ß.exe	31
PID 1900 wrote to memory of 876	1900	DNF01Á¬·¢¹¤¾ß.exe	31
PID 1900 wrote to memory of 876	1900	DNF01Á¬·¢¹¤¾ß.exe	31
PID 876 wrote to memory of 428	876	iexplore.exe	33
PID 876 wrote to memory of 428	876	iexplore.exe	33
PID 876 wrote to memory of 428	876	iexplore.exe	33
PID 876 wrote to memory of 428	876	iexplore.exe	33
PID 576 wrote to memory of 1476	576	Tencenthw.exe	36
PID 576 wrote to memory of 1476	576	Tencenthw.exe	36
PID 576 wrote to memory of 1476	576	Tencenthw.exe	36
PID 576 wrote to memory of 1476	576	Tencenthw.exe	36
PID 1504 wrote to memory of 340	1504	2065ac4d426063a6d9c0ec955751a1a14867e3a1b73a91ad25208dec3671a56e.exe	37
PID 1504 wrote to memory of 340	1504	2065ac4d426063a6d9c0ec955751a1a14867e3a1b73a91ad25208dec3671a56e.exe	37
PID 1504 wrote to memory of 340	1504	2065ac4d426063a6d9c0ec955751a1a14867e3a1b73a91ad25208dec3671a56e.exe	37
PID 1504 wrote to memory of 340	1504	2065ac4d426063a6d9c0ec955751a1a14867e3a1b73a91ad25208dec3671a56e.exe	37
PID 1504 wrote to memory of 340	1504	2065ac4d426063a6d9c0ec955751a1a14867e3a1b73a91ad25208dec3671a56e.exe	37
PID 1504 wrote to memory of 340	1504	2065ac4d426063a6d9c0ec955751a1a14867e3a1b73a91ad25208dec3671a56e.exe	37
PID 1504 wrote to memory of 340	1504	2065ac4d426063a6d9c0ec955751a1a14867e3a1b73a91ad25208dec3671a56e.exe	37

C:\Users\Admin\AppData\Local\Temp\2065ac4d426063a6d9c0ec955751a1a14867e3a1b73a91ad25208dec3671a56e.exe
"C:\Users\Admin\AppData\Local\Temp\2065ac4d426063a6d9c0ec955751a1a14867e3a1b73a91ad25208dec3671a56e.exe"
1⤵
- Loads dropped DLL
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1504
- C:\Users\Admin\AppData\Local\Temp\svchost.exe
  "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:1516
- - C:\Windows\SysWOW64\Tencenthw.exe
    C:\Windows\system32\Tencenthw.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in System32 directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:576
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 576 -s 924
      4⤵
      Loads dropped DLL
      Program crash
      PID:1476
- C:\Users\Admin\AppData\Local\Temp\DNF01Á¬·¢¹¤¾ß.exe
  "C:\Users\Admin\AppData\Local\Temp\DNF01Á¬·¢¹¤¾ß.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1900
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" www.nanawg.com
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:876
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:876 CREDAT:275457 /prefetch:2
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:428
- C:\Users\Admin\AppData\Local\Temp\vKINSTALLERS_43_25100.exe
  "C:\Users\Admin\AppData\Local\Temp\vKINSTALLERS_43_25100.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:340

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0xc8
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2188

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
61KB

MD5
fc4666cbca561e864e7fdf883a9e6661

SHA1
2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5

SHA256
10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b

SHA512
c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f5fe2776e916338fd0b7d7f100270a5f

SHA1
5fa1b0dad086be790ebac968077709c1549f05ba

SHA256
670b948fb1ab5a5c5dfcdd89cd8d508ed347b19ed9d6a3979ef2160d6c748947

SHA512
d67a11c612f8c56ba6b791276ce84efabcb686fe870d957124b0d4278b2ec56b5a512023616b5bc7973f11e5c31e28a8a3b1d0e9ca2c30172793cc2560111a09

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4bcb9b4e8700e3d68becdc5cf2dde0fd

SHA1
7c79890b74daac3b7787154fe1270b0a28c127a9

SHA256
e359e1b117c30e9c8657d87731d80c657691f41aaa941890afc5d00094dcf515

SHA512
982e58b89541be45153c223971bd62d26c125de370a35b0bdb726546a0972d4655d091d31a29a0320c7e46836798755eec2cdc2710f05a3e6bc476fe946cb89e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7b94149e5824d30c6a520addec32ed04

SHA1
eea9d9cfcd7a9d3bd0976279ed525e9b880d83bd

SHA256
86544bff54f5e3b87c688776030e9aaf103d047b740f264c2c8b5687fdc12c3d

SHA512
cefaa2b55c1992ce396e1d2bb3e14577c0528667cab50de9cc53f0ae0f83bd9eb1a6187dfe5136900f6456dfda67738d973ee2bff16e581fffbbf7580d4458af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\try74lz\imagestore.dat

Filesize
1KB

MD5
9581a87d44ead6eca55fbd4c58c95201

SHA1
265a0d13323dc8adf4b71be9dae06c0e255cc8f5

SHA256
29e767c5ff558d55195ffe5d873d0aa50d142efca6a131c4d54e111b7d738b96

SHA512
f138130a7b84acd3f83135392208581be9243f7673156688497483c8f6baee43e3bbcfb75b8c1abb65ef7e749f68573d675ca1f887f8ed04e36bea14ac54f237

Download Submit
C:\Users\Admin\AppData\Local\Temp\DNF01Á¬·¢¹¤¾ß.exe

Filesize
620KB

MD5
818218a13de47277ae018f384f5c25d4

SHA1
34284575d27710b39252e66b73c1dcc8852f8b6f

SHA256
fe6d4d79d68976973b4c26e861dbe7f3d97e37062781ff28c5b9e0fc7e4f0075

SHA512
9312df1f6eb61ace14fada64ea1ded3647ec8be2bd85b610ba4805671e6616e64f07b2d3359d5e8b19b68771c10e1317d1914d3e72f7a1b2a90ef42d145700d5

Download Submit
C:\Users\Admin\AppData\Local\Temp\svchost.exe

Filesize
80KB

MD5
177f093147c38555ca830c266f967a26

SHA1
560d9206482e898f73d092fcfdf1777db598cf13

SHA256
6c1d97af8a64a20fd7f04c99db4420b55babfb81229704109d46a0d14c40e9d6

SHA512
54ed6d51364ae2836e091c7cd51eaf59bf133df2789434f92407ffd70ebcfe25633212a73e0c24e275020185baf9dbb01bca231df225113abc24a2d6adbc258f

Download Submit
C:\Users\Admin\AppData\Local\Temp\vKINSTALLERS_43_25100.exe

Filesize
58KB

MD5
59aa2880527d8baf9d025c3dc2925503

SHA1
de75a277fae0886fba8adc778e11b8fb788f1319

SHA256
d7c6cd9f7f7e9254d5bb4dcd640dd1d7a437bfcd5a31dab80dace8b51f5274c0

SHA512
c8a35125d25df522cf376059fe26051878163ce7af46cbc236955b9ca80df56127b5a72231c5e601db9a38c49027028dcea8aca57eea22d2d0a3cab903e012e4

Download Submit
C:\Users\Admin\AppData\Local\Temp\vKINSTALLERS_43_25100.exe

Filesize
58KB

MD5
59aa2880527d8baf9d025c3dc2925503

SHA1
de75a277fae0886fba8adc778e11b8fb788f1319

SHA256
d7c6cd9f7f7e9254d5bb4dcd640dd1d7a437bfcd5a31dab80dace8b51f5274c0

SHA512
c8a35125d25df522cf376059fe26051878163ce7af46cbc236955b9ca80df56127b5a72231c5e601db9a38c49027028dcea8aca57eea22d2d0a3cab903e012e4

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\AF5DXFFG.txt

Filesize
533B

MD5
a744b68e72aa96b4494f76d54516a8f3

SHA1
2e4f3ab3680844f22ac38f21d2c4424945a50667

SHA256
172c63b5d63ef73251073dcdaefe790e805ace20e668d37197f2ca358e07ca29

SHA512
04dfde798c1789395ffdae6fddb9a098f5976c0436f4665ff471c4630cca92c311ee644928aa115761088e24be8de48b5f73935c73aaaad151846bbf20151adf

Download Submit
C:\Windows\SysWOW64\Tencenthw.exe

Filesize
35KB

MD5
107e71382f8c42169041743dd0e8e72e

SHA1
656c44dc0b546f0814c80e3334f5ee10d3f8b8fc

SHA256
2065e9ee4ebcf2d87c30c0c43676b85a5863579a9da1080f8a7eb0f9348ddc47

SHA512
e81559dc92527c62b603c02bbefd71b495e91105b09c64d6c3c5fddde40615204c0007e9d3382490a44158da305d3f22b84ae0d6f2d7ece840107ffcdcceb116

Download Submit
C:\Windows\SysWOW64\cfghw.tmp

Filesize
185B

MD5
0010d08f56fa12ce6d57f7844c7faaa9

SHA1
dcac35f8f8709be3fd8552107fca0d250d5efa24

SHA256
65ccbdf80715a018723c359dd934c1a57ae108c00de959d35a62bd77fb6c363a

SHA512
0f094b1d1b559d8f351e93180a8419eb3f28eae33118a3c3829cfc20cf3cf0d637c53ff14b5d7ced4e66b090f773a3262fb75a01babfd8659709cd352c2b10ef

Download Submit
\Users\Admin\AppData\Local\Temp\DNF01Á¬·¢¹¤¾ß.exe

Filesize
620KB

MD5
818218a13de47277ae018f384f5c25d4

SHA1
34284575d27710b39252e66b73c1dcc8852f8b6f

SHA256
fe6d4d79d68976973b4c26e861dbe7f3d97e37062781ff28c5b9e0fc7e4f0075

SHA512
9312df1f6eb61ace14fada64ea1ded3647ec8be2bd85b610ba4805671e6616e64f07b2d3359d5e8b19b68771c10e1317d1914d3e72f7a1b2a90ef42d145700d5

Download Submit
\Users\Admin\AppData\Local\Temp\DNF01Á¬·¢¹¤¾ß.exe

Filesize
620KB

MD5
818218a13de47277ae018f384f5c25d4

SHA1
34284575d27710b39252e66b73c1dcc8852f8b6f

SHA256
fe6d4d79d68976973b4c26e861dbe7f3d97e37062781ff28c5b9e0fc7e4f0075

SHA512
9312df1f6eb61ace14fada64ea1ded3647ec8be2bd85b610ba4805671e6616e64f07b2d3359d5e8b19b68771c10e1317d1914d3e72f7a1b2a90ef42d145700d5

Download Submit
\Users\Admin\AppData\Local\Temp\svchost.exe

Filesize
80KB

MD5
177f093147c38555ca830c266f967a26

SHA1
560d9206482e898f73d092fcfdf1777db598cf13

SHA256
6c1d97af8a64a20fd7f04c99db4420b55babfb81229704109d46a0d14c40e9d6

SHA512
54ed6d51364ae2836e091c7cd51eaf59bf133df2789434f92407ffd70ebcfe25633212a73e0c24e275020185baf9dbb01bca231df225113abc24a2d6adbc258f

Download Submit
\Users\Admin\AppData\Local\Temp\svchost.exe

Filesize
80KB

MD5
177f093147c38555ca830c266f967a26

SHA1
560d9206482e898f73d092fcfdf1777db598cf13

SHA256
6c1d97af8a64a20fd7f04c99db4420b55babfb81229704109d46a0d14c40e9d6

SHA512
54ed6d51364ae2836e091c7cd51eaf59bf133df2789434f92407ffd70ebcfe25633212a73e0c24e275020185baf9dbb01bca231df225113abc24a2d6adbc258f

Download Submit
\Users\Admin\AppData\Local\Temp\vKINSTALLERS_43_25100.exe

Filesize
58KB

MD5
59aa2880527d8baf9d025c3dc2925503

SHA1
de75a277fae0886fba8adc778e11b8fb788f1319

SHA256
d7c6cd9f7f7e9254d5bb4dcd640dd1d7a437bfcd5a31dab80dace8b51f5274c0

SHA512
c8a35125d25df522cf376059fe26051878163ce7af46cbc236955b9ca80df56127b5a72231c5e601db9a38c49027028dcea8aca57eea22d2d0a3cab903e012e4

Download Submit
\Users\Admin\AppData\Local\Temp\vKINSTALLERS_43_25100.exe

Filesize
58KB

MD5
59aa2880527d8baf9d025c3dc2925503

SHA1
de75a277fae0886fba8adc778e11b8fb788f1319

SHA256
d7c6cd9f7f7e9254d5bb4dcd640dd1d7a437bfcd5a31dab80dace8b51f5274c0

SHA512
c8a35125d25df522cf376059fe26051878163ce7af46cbc236955b9ca80df56127b5a72231c5e601db9a38c49027028dcea8aca57eea22d2d0a3cab903e012e4

Download Submit
\Users\Admin\AppData\Local\Temp\vKINSTALLERS_43_25100.exe

Filesize
58KB

MD5
59aa2880527d8baf9d025c3dc2925503

SHA1
de75a277fae0886fba8adc778e11b8fb788f1319

SHA256
d7c6cd9f7f7e9254d5bb4dcd640dd1d7a437bfcd5a31dab80dace8b51f5274c0

SHA512
c8a35125d25df522cf376059fe26051878163ce7af46cbc236955b9ca80df56127b5a72231c5e601db9a38c49027028dcea8aca57eea22d2d0a3cab903e012e4

Download Submit
\Users\Admin\AppData\Local\Temp\vKINSTALLERS_43_25100.exe

Filesize
58KB

MD5
59aa2880527d8baf9d025c3dc2925503

SHA1
de75a277fae0886fba8adc778e11b8fb788f1319

SHA256
d7c6cd9f7f7e9254d5bb4dcd640dd1d7a437bfcd5a31dab80dace8b51f5274c0

SHA512
c8a35125d25df522cf376059fe26051878163ce7af46cbc236955b9ca80df56127b5a72231c5e601db9a38c49027028dcea8aca57eea22d2d0a3cab903e012e4

Download Submit
\Windows\SysWOW64\Tencenthw.exe

Filesize
35KB

MD5
107e71382f8c42169041743dd0e8e72e

SHA1
656c44dc0b546f0814c80e3334f5ee10d3f8b8fc

SHA256
2065e9ee4ebcf2d87c30c0c43676b85a5863579a9da1080f8a7eb0f9348ddc47

SHA512
e81559dc92527c62b603c02bbefd71b495e91105b09c64d6c3c5fddde40615204c0007e9d3382490a44158da305d3f22b84ae0d6f2d7ece840107ffcdcceb116

Download Submit
\Windows\SysWOW64\Tencenthw.exe

Filesize
35KB

MD5
107e71382f8c42169041743dd0e8e72e

SHA1
656c44dc0b546f0814c80e3334f5ee10d3f8b8fc

SHA256
2065e9ee4ebcf2d87c30c0c43676b85a5863579a9da1080f8a7eb0f9348ddc47

SHA512
e81559dc92527c62b603c02bbefd71b495e91105b09c64d6c3c5fddde40615204c0007e9d3382490a44158da305d3f22b84ae0d6f2d7ece840107ffcdcceb116

Download Submit
\Windows\SysWOW64\Tencenthw.exe

Filesize
35KB

MD5
107e71382f8c42169041743dd0e8e72e

SHA1
656c44dc0b546f0814c80e3334f5ee10d3f8b8fc

SHA256
2065e9ee4ebcf2d87c30c0c43676b85a5863579a9da1080f8a7eb0f9348ddc47

SHA512
e81559dc92527c62b603c02bbefd71b495e91105b09c64d6c3c5fddde40615204c0007e9d3382490a44158da305d3f22b84ae0d6f2d7ece840107ffcdcceb116

Download Submit
\Windows\SysWOW64\Tencenthw.exe

Filesize
35KB

MD5
107e71382f8c42169041743dd0e8e72e

SHA1
656c44dc0b546f0814c80e3334f5ee10d3f8b8fc

SHA256
2065e9ee4ebcf2d87c30c0c43676b85a5863579a9da1080f8a7eb0f9348ddc47

SHA512
e81559dc92527c62b603c02bbefd71b495e91105b09c64d6c3c5fddde40615204c0007e9d3382490a44158da305d3f22b84ae0d6f2d7ece840107ffcdcceb116

Download Submit
\Windows\SysWOW64\Tencenthw.exe

Filesize
35KB

MD5
107e71382f8c42169041743dd0e8e72e

SHA1
656c44dc0b546f0814c80e3334f5ee10d3f8b8fc

SHA256
2065e9ee4ebcf2d87c30c0c43676b85a5863579a9da1080f8a7eb0f9348ddc47

SHA512
e81559dc92527c62b603c02bbefd71b495e91105b09c64d6c3c5fddde40615204c0007e9d3382490a44158da305d3f22b84ae0d6f2d7ece840107ffcdcceb116

Download Submit
memory/576-75-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/576-77-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/1504-54-0x0000000075C81000-0x0000000075C83000-memory.dmp

Filesize
8KB

Download
memory/1504-72-0x0000000002100000-0x000000000212D000-memory.dmp

Filesize
180KB

Download
memory/1504-71-0x0000000002100000-0x000000000212D000-memory.dmp

Filesize
180KB

Download
memory/1516-76-0x0000000000300000-0x000000000030E000-memory.dmp

Filesize
56KB

Download
memory/1516-74-0x0000000000300000-0x000000000030E000-memory.dmp

Filesize
56KB

Download
memory/1516-73-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download