Analysis
-
max time kernel
150s -
max time network
132s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
04-12-2022 02:31
Static task
static1
Behavioral task
behavioral1
Sample
b97f16b75b2522ea30f217e7fc7831c37a38d7ebfc30ca46359abd3f3624aff3.exe
Resource
win7-20220901-en
General
-
Target
b97f16b75b2522ea30f217e7fc7831c37a38d7ebfc30ca46359abd3f3624aff3.exe
-
Size
461KB
-
MD5
45534195afd36071c6127a31a50415a8
-
SHA1
2782267ca60fcc138adcd2b3b3bda0c2f7b584f3
-
SHA256
b97f16b75b2522ea30f217e7fc7831c37a38d7ebfc30ca46359abd3f3624aff3
-
SHA512
0d441dfad134bec110ce08fb40eca753bf109582606c1a221f0c9a6cdca2479b3f4ebc091a268725a53b73e45af672d762656d7df3fda993cbbdb334b8c6a915
-
SSDEEP
12288:WP1FVkA1lkLe6TxR2EkAKZj1f5VCurFmGM:+DVtlkL10DZxf581n
Malware Config
Extracted
cybergate
v1.01.18
01
homepepe.dyndns.org:4321
mandanga.blogdns.com:4321
los2
-
enable_keylogger
false
-
enable_message_box
false
-
ftp_directory
./logs/
-
ftp_interval
30
-
injected_process
explorer.exe
-
install_dir
avgPro
-
install_file
avgPro.exe
-
install_flag
true
-
keylogger_enable_ftp
false
-
message_box_caption
Remote Administration anywhere in the world.
-
message_box_title
CyberGate
-
password
1qaz
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
avgPro.exeavgPro.exepid process 1820 avgPro.exe 1724 avgPro.exe -
Sets file to hidden 1 TTPs 2 IoCs
Modifies file attributes to stop it showing in Explorer etc.
Processes:
attrib.exeattrib.exepid process 1260 attrib.exe 1036 attrib.exe -
Processes:
resource yara_rule behavioral1/memory/1288-65-0x0000000024010000-0x000000002406F000-memory.dmp upx behavioral1/memory/936-70-0x0000000024010000-0x000000002406F000-memory.dmp upx behavioral1/memory/936-91-0x0000000024010000-0x000000002406F000-memory.dmp upx behavioral1/memory/936-94-0x0000000024010000-0x000000002406F000-memory.dmp upx -
Loads dropped DLL 2 IoCs
Processes:
b97f16b75b2522ea30f217e7fc7831c37a38d7ebfc30ca46359abd3f3624aff3.exepid process 936 b97f16b75b2522ea30f217e7fc7831c37a38d7ebfc30ca46359abd3f3624aff3.exe 936 b97f16b75b2522ea30f217e7fc7831c37a38d7ebfc30ca46359abd3f3624aff3.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
WScript.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run WScript.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\avgPro = "%APPDATA%\\avgPro\\avgPro.exe" WScript.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
b97f16b75b2522ea30f217e7fc7831c37a38d7ebfc30ca46359abd3f3624aff3.exeavgPro.exedescription pid process target process PID 1380 set thread context of 1288 1380 b97f16b75b2522ea30f217e7fc7831c37a38d7ebfc30ca46359abd3f3624aff3.exe b97f16b75b2522ea30f217e7fc7831c37a38d7ebfc30ca46359abd3f3624aff3.exe PID 1820 set thread context of 1724 1820 avgPro.exe avgPro.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
b97f16b75b2522ea30f217e7fc7831c37a38d7ebfc30ca46359abd3f3624aff3.exedescription pid process Token: SeDebugPrivilege 936 b97f16b75b2522ea30f217e7fc7831c37a38d7ebfc30ca46359abd3f3624aff3.exe Token: SeDebugPrivilege 936 b97f16b75b2522ea30f217e7fc7831c37a38d7ebfc30ca46359abd3f3624aff3.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
b97f16b75b2522ea30f217e7fc7831c37a38d7ebfc30ca46359abd3f3624aff3.exeavgPro.exepid process 1380 b97f16b75b2522ea30f217e7fc7831c37a38d7ebfc30ca46359abd3f3624aff3.exe 1820 avgPro.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
b97f16b75b2522ea30f217e7fc7831c37a38d7ebfc30ca46359abd3f3624aff3.exeb97f16b75b2522ea30f217e7fc7831c37a38d7ebfc30ca46359abd3f3624aff3.exedescription pid process target process PID 1380 wrote to memory of 1288 1380 b97f16b75b2522ea30f217e7fc7831c37a38d7ebfc30ca46359abd3f3624aff3.exe b97f16b75b2522ea30f217e7fc7831c37a38d7ebfc30ca46359abd3f3624aff3.exe PID 1380 wrote to memory of 1288 1380 b97f16b75b2522ea30f217e7fc7831c37a38d7ebfc30ca46359abd3f3624aff3.exe b97f16b75b2522ea30f217e7fc7831c37a38d7ebfc30ca46359abd3f3624aff3.exe PID 1380 wrote to memory of 1288 1380 b97f16b75b2522ea30f217e7fc7831c37a38d7ebfc30ca46359abd3f3624aff3.exe b97f16b75b2522ea30f217e7fc7831c37a38d7ebfc30ca46359abd3f3624aff3.exe PID 1380 wrote to memory of 1288 1380 b97f16b75b2522ea30f217e7fc7831c37a38d7ebfc30ca46359abd3f3624aff3.exe b97f16b75b2522ea30f217e7fc7831c37a38d7ebfc30ca46359abd3f3624aff3.exe PID 1380 wrote to memory of 1288 1380 b97f16b75b2522ea30f217e7fc7831c37a38d7ebfc30ca46359abd3f3624aff3.exe b97f16b75b2522ea30f217e7fc7831c37a38d7ebfc30ca46359abd3f3624aff3.exe PID 1380 wrote to memory of 1288 1380 b97f16b75b2522ea30f217e7fc7831c37a38d7ebfc30ca46359abd3f3624aff3.exe b97f16b75b2522ea30f217e7fc7831c37a38d7ebfc30ca46359abd3f3624aff3.exe PID 1380 wrote to memory of 1288 1380 b97f16b75b2522ea30f217e7fc7831c37a38d7ebfc30ca46359abd3f3624aff3.exe b97f16b75b2522ea30f217e7fc7831c37a38d7ebfc30ca46359abd3f3624aff3.exe PID 1380 wrote to memory of 1288 1380 b97f16b75b2522ea30f217e7fc7831c37a38d7ebfc30ca46359abd3f3624aff3.exe b97f16b75b2522ea30f217e7fc7831c37a38d7ebfc30ca46359abd3f3624aff3.exe PID 1380 wrote to memory of 1288 1380 b97f16b75b2522ea30f217e7fc7831c37a38d7ebfc30ca46359abd3f3624aff3.exe b97f16b75b2522ea30f217e7fc7831c37a38d7ebfc30ca46359abd3f3624aff3.exe PID 1380 wrote to memory of 1288 1380 b97f16b75b2522ea30f217e7fc7831c37a38d7ebfc30ca46359abd3f3624aff3.exe b97f16b75b2522ea30f217e7fc7831c37a38d7ebfc30ca46359abd3f3624aff3.exe PID 1380 wrote to memory of 1288 1380 b97f16b75b2522ea30f217e7fc7831c37a38d7ebfc30ca46359abd3f3624aff3.exe b97f16b75b2522ea30f217e7fc7831c37a38d7ebfc30ca46359abd3f3624aff3.exe PID 1380 wrote to memory of 1288 1380 b97f16b75b2522ea30f217e7fc7831c37a38d7ebfc30ca46359abd3f3624aff3.exe b97f16b75b2522ea30f217e7fc7831c37a38d7ebfc30ca46359abd3f3624aff3.exe PID 1380 wrote to memory of 1288 1380 b97f16b75b2522ea30f217e7fc7831c37a38d7ebfc30ca46359abd3f3624aff3.exe b97f16b75b2522ea30f217e7fc7831c37a38d7ebfc30ca46359abd3f3624aff3.exe PID 1380 wrote to memory of 1288 1380 b97f16b75b2522ea30f217e7fc7831c37a38d7ebfc30ca46359abd3f3624aff3.exe b97f16b75b2522ea30f217e7fc7831c37a38d7ebfc30ca46359abd3f3624aff3.exe PID 1288 wrote to memory of 936 1288 b97f16b75b2522ea30f217e7fc7831c37a38d7ebfc30ca46359abd3f3624aff3.exe b97f16b75b2522ea30f217e7fc7831c37a38d7ebfc30ca46359abd3f3624aff3.exe PID 1288 wrote to memory of 936 1288 b97f16b75b2522ea30f217e7fc7831c37a38d7ebfc30ca46359abd3f3624aff3.exe b97f16b75b2522ea30f217e7fc7831c37a38d7ebfc30ca46359abd3f3624aff3.exe PID 1288 wrote to memory of 936 1288 b97f16b75b2522ea30f217e7fc7831c37a38d7ebfc30ca46359abd3f3624aff3.exe b97f16b75b2522ea30f217e7fc7831c37a38d7ebfc30ca46359abd3f3624aff3.exe PID 1288 wrote to memory of 936 1288 b97f16b75b2522ea30f217e7fc7831c37a38d7ebfc30ca46359abd3f3624aff3.exe b97f16b75b2522ea30f217e7fc7831c37a38d7ebfc30ca46359abd3f3624aff3.exe PID 1288 wrote to memory of 936 1288 b97f16b75b2522ea30f217e7fc7831c37a38d7ebfc30ca46359abd3f3624aff3.exe b97f16b75b2522ea30f217e7fc7831c37a38d7ebfc30ca46359abd3f3624aff3.exe PID 1288 wrote to memory of 936 1288 b97f16b75b2522ea30f217e7fc7831c37a38d7ebfc30ca46359abd3f3624aff3.exe b97f16b75b2522ea30f217e7fc7831c37a38d7ebfc30ca46359abd3f3624aff3.exe PID 1288 wrote to memory of 936 1288 b97f16b75b2522ea30f217e7fc7831c37a38d7ebfc30ca46359abd3f3624aff3.exe b97f16b75b2522ea30f217e7fc7831c37a38d7ebfc30ca46359abd3f3624aff3.exe PID 1288 wrote to memory of 936 1288 b97f16b75b2522ea30f217e7fc7831c37a38d7ebfc30ca46359abd3f3624aff3.exe b97f16b75b2522ea30f217e7fc7831c37a38d7ebfc30ca46359abd3f3624aff3.exe PID 1288 wrote to memory of 936 1288 b97f16b75b2522ea30f217e7fc7831c37a38d7ebfc30ca46359abd3f3624aff3.exe b97f16b75b2522ea30f217e7fc7831c37a38d7ebfc30ca46359abd3f3624aff3.exe PID 1288 wrote to memory of 936 1288 b97f16b75b2522ea30f217e7fc7831c37a38d7ebfc30ca46359abd3f3624aff3.exe b97f16b75b2522ea30f217e7fc7831c37a38d7ebfc30ca46359abd3f3624aff3.exe PID 1288 wrote to memory of 936 1288 b97f16b75b2522ea30f217e7fc7831c37a38d7ebfc30ca46359abd3f3624aff3.exe b97f16b75b2522ea30f217e7fc7831c37a38d7ebfc30ca46359abd3f3624aff3.exe PID 1288 wrote to memory of 936 1288 b97f16b75b2522ea30f217e7fc7831c37a38d7ebfc30ca46359abd3f3624aff3.exe b97f16b75b2522ea30f217e7fc7831c37a38d7ebfc30ca46359abd3f3624aff3.exe PID 1288 wrote to memory of 936 1288 b97f16b75b2522ea30f217e7fc7831c37a38d7ebfc30ca46359abd3f3624aff3.exe b97f16b75b2522ea30f217e7fc7831c37a38d7ebfc30ca46359abd3f3624aff3.exe PID 1288 wrote to memory of 936 1288 b97f16b75b2522ea30f217e7fc7831c37a38d7ebfc30ca46359abd3f3624aff3.exe b97f16b75b2522ea30f217e7fc7831c37a38d7ebfc30ca46359abd3f3624aff3.exe PID 1288 wrote to memory of 936 1288 b97f16b75b2522ea30f217e7fc7831c37a38d7ebfc30ca46359abd3f3624aff3.exe b97f16b75b2522ea30f217e7fc7831c37a38d7ebfc30ca46359abd3f3624aff3.exe PID 1288 wrote to memory of 936 1288 b97f16b75b2522ea30f217e7fc7831c37a38d7ebfc30ca46359abd3f3624aff3.exe b97f16b75b2522ea30f217e7fc7831c37a38d7ebfc30ca46359abd3f3624aff3.exe PID 1288 wrote to memory of 936 1288 b97f16b75b2522ea30f217e7fc7831c37a38d7ebfc30ca46359abd3f3624aff3.exe b97f16b75b2522ea30f217e7fc7831c37a38d7ebfc30ca46359abd3f3624aff3.exe PID 1288 wrote to memory of 936 1288 b97f16b75b2522ea30f217e7fc7831c37a38d7ebfc30ca46359abd3f3624aff3.exe b97f16b75b2522ea30f217e7fc7831c37a38d7ebfc30ca46359abd3f3624aff3.exe PID 1288 wrote to memory of 936 1288 b97f16b75b2522ea30f217e7fc7831c37a38d7ebfc30ca46359abd3f3624aff3.exe b97f16b75b2522ea30f217e7fc7831c37a38d7ebfc30ca46359abd3f3624aff3.exe PID 1288 wrote to memory of 936 1288 b97f16b75b2522ea30f217e7fc7831c37a38d7ebfc30ca46359abd3f3624aff3.exe b97f16b75b2522ea30f217e7fc7831c37a38d7ebfc30ca46359abd3f3624aff3.exe PID 1288 wrote to memory of 936 1288 b97f16b75b2522ea30f217e7fc7831c37a38d7ebfc30ca46359abd3f3624aff3.exe b97f16b75b2522ea30f217e7fc7831c37a38d7ebfc30ca46359abd3f3624aff3.exe PID 1288 wrote to memory of 936 1288 b97f16b75b2522ea30f217e7fc7831c37a38d7ebfc30ca46359abd3f3624aff3.exe b97f16b75b2522ea30f217e7fc7831c37a38d7ebfc30ca46359abd3f3624aff3.exe PID 1288 wrote to memory of 936 1288 b97f16b75b2522ea30f217e7fc7831c37a38d7ebfc30ca46359abd3f3624aff3.exe b97f16b75b2522ea30f217e7fc7831c37a38d7ebfc30ca46359abd3f3624aff3.exe PID 1288 wrote to memory of 936 1288 b97f16b75b2522ea30f217e7fc7831c37a38d7ebfc30ca46359abd3f3624aff3.exe b97f16b75b2522ea30f217e7fc7831c37a38d7ebfc30ca46359abd3f3624aff3.exe PID 1288 wrote to memory of 936 1288 b97f16b75b2522ea30f217e7fc7831c37a38d7ebfc30ca46359abd3f3624aff3.exe b97f16b75b2522ea30f217e7fc7831c37a38d7ebfc30ca46359abd3f3624aff3.exe PID 1288 wrote to memory of 936 1288 b97f16b75b2522ea30f217e7fc7831c37a38d7ebfc30ca46359abd3f3624aff3.exe b97f16b75b2522ea30f217e7fc7831c37a38d7ebfc30ca46359abd3f3624aff3.exe PID 1288 wrote to memory of 936 1288 b97f16b75b2522ea30f217e7fc7831c37a38d7ebfc30ca46359abd3f3624aff3.exe b97f16b75b2522ea30f217e7fc7831c37a38d7ebfc30ca46359abd3f3624aff3.exe PID 1288 wrote to memory of 936 1288 b97f16b75b2522ea30f217e7fc7831c37a38d7ebfc30ca46359abd3f3624aff3.exe b97f16b75b2522ea30f217e7fc7831c37a38d7ebfc30ca46359abd3f3624aff3.exe PID 1288 wrote to memory of 936 1288 b97f16b75b2522ea30f217e7fc7831c37a38d7ebfc30ca46359abd3f3624aff3.exe b97f16b75b2522ea30f217e7fc7831c37a38d7ebfc30ca46359abd3f3624aff3.exe PID 1288 wrote to memory of 936 1288 b97f16b75b2522ea30f217e7fc7831c37a38d7ebfc30ca46359abd3f3624aff3.exe b97f16b75b2522ea30f217e7fc7831c37a38d7ebfc30ca46359abd3f3624aff3.exe PID 1288 wrote to memory of 936 1288 b97f16b75b2522ea30f217e7fc7831c37a38d7ebfc30ca46359abd3f3624aff3.exe b97f16b75b2522ea30f217e7fc7831c37a38d7ebfc30ca46359abd3f3624aff3.exe PID 1288 wrote to memory of 936 1288 b97f16b75b2522ea30f217e7fc7831c37a38d7ebfc30ca46359abd3f3624aff3.exe b97f16b75b2522ea30f217e7fc7831c37a38d7ebfc30ca46359abd3f3624aff3.exe PID 1288 wrote to memory of 936 1288 b97f16b75b2522ea30f217e7fc7831c37a38d7ebfc30ca46359abd3f3624aff3.exe b97f16b75b2522ea30f217e7fc7831c37a38d7ebfc30ca46359abd3f3624aff3.exe PID 1288 wrote to memory of 936 1288 b97f16b75b2522ea30f217e7fc7831c37a38d7ebfc30ca46359abd3f3624aff3.exe b97f16b75b2522ea30f217e7fc7831c37a38d7ebfc30ca46359abd3f3624aff3.exe PID 1288 wrote to memory of 936 1288 b97f16b75b2522ea30f217e7fc7831c37a38d7ebfc30ca46359abd3f3624aff3.exe b97f16b75b2522ea30f217e7fc7831c37a38d7ebfc30ca46359abd3f3624aff3.exe PID 1288 wrote to memory of 936 1288 b97f16b75b2522ea30f217e7fc7831c37a38d7ebfc30ca46359abd3f3624aff3.exe b97f16b75b2522ea30f217e7fc7831c37a38d7ebfc30ca46359abd3f3624aff3.exe PID 1288 wrote to memory of 936 1288 b97f16b75b2522ea30f217e7fc7831c37a38d7ebfc30ca46359abd3f3624aff3.exe b97f16b75b2522ea30f217e7fc7831c37a38d7ebfc30ca46359abd3f3624aff3.exe PID 1288 wrote to memory of 936 1288 b97f16b75b2522ea30f217e7fc7831c37a38d7ebfc30ca46359abd3f3624aff3.exe b97f16b75b2522ea30f217e7fc7831c37a38d7ebfc30ca46359abd3f3624aff3.exe PID 1288 wrote to memory of 936 1288 b97f16b75b2522ea30f217e7fc7831c37a38d7ebfc30ca46359abd3f3624aff3.exe b97f16b75b2522ea30f217e7fc7831c37a38d7ebfc30ca46359abd3f3624aff3.exe PID 1288 wrote to memory of 936 1288 b97f16b75b2522ea30f217e7fc7831c37a38d7ebfc30ca46359abd3f3624aff3.exe b97f16b75b2522ea30f217e7fc7831c37a38d7ebfc30ca46359abd3f3624aff3.exe PID 1288 wrote to memory of 936 1288 b97f16b75b2522ea30f217e7fc7831c37a38d7ebfc30ca46359abd3f3624aff3.exe b97f16b75b2522ea30f217e7fc7831c37a38d7ebfc30ca46359abd3f3624aff3.exe PID 1288 wrote to memory of 936 1288 b97f16b75b2522ea30f217e7fc7831c37a38d7ebfc30ca46359abd3f3624aff3.exe b97f16b75b2522ea30f217e7fc7831c37a38d7ebfc30ca46359abd3f3624aff3.exe PID 1288 wrote to memory of 936 1288 b97f16b75b2522ea30f217e7fc7831c37a38d7ebfc30ca46359abd3f3624aff3.exe b97f16b75b2522ea30f217e7fc7831c37a38d7ebfc30ca46359abd3f3624aff3.exe PID 1288 wrote to memory of 936 1288 b97f16b75b2522ea30f217e7fc7831c37a38d7ebfc30ca46359abd3f3624aff3.exe b97f16b75b2522ea30f217e7fc7831c37a38d7ebfc30ca46359abd3f3624aff3.exe PID 1288 wrote to memory of 936 1288 b97f16b75b2522ea30f217e7fc7831c37a38d7ebfc30ca46359abd3f3624aff3.exe b97f16b75b2522ea30f217e7fc7831c37a38d7ebfc30ca46359abd3f3624aff3.exe PID 1288 wrote to memory of 936 1288 b97f16b75b2522ea30f217e7fc7831c37a38d7ebfc30ca46359abd3f3624aff3.exe b97f16b75b2522ea30f217e7fc7831c37a38d7ebfc30ca46359abd3f3624aff3.exe PID 1288 wrote to memory of 936 1288 b97f16b75b2522ea30f217e7fc7831c37a38d7ebfc30ca46359abd3f3624aff3.exe b97f16b75b2522ea30f217e7fc7831c37a38d7ebfc30ca46359abd3f3624aff3.exe PID 1288 wrote to memory of 936 1288 b97f16b75b2522ea30f217e7fc7831c37a38d7ebfc30ca46359abd3f3624aff3.exe b97f16b75b2522ea30f217e7fc7831c37a38d7ebfc30ca46359abd3f3624aff3.exe PID 1288 wrote to memory of 936 1288 b97f16b75b2522ea30f217e7fc7831c37a38d7ebfc30ca46359abd3f3624aff3.exe b97f16b75b2522ea30f217e7fc7831c37a38d7ebfc30ca46359abd3f3624aff3.exe PID 1288 wrote to memory of 936 1288 b97f16b75b2522ea30f217e7fc7831c37a38d7ebfc30ca46359abd3f3624aff3.exe b97f16b75b2522ea30f217e7fc7831c37a38d7ebfc30ca46359abd3f3624aff3.exe -
Views/modifies file attributes 1 TTPs 2 IoCs
Processes:
attrib.exeattrib.exepid process 1036 attrib.exe 1260 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b97f16b75b2522ea30f217e7fc7831c37a38d7ebfc30ca46359abd3f3624aff3.exe"C:\Users\Admin\AppData\Local\Temp\b97f16b75b2522ea30f217e7fc7831c37a38d7ebfc30ca46359abd3f3624aff3.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\b97f16b75b2522ea30f217e7fc7831c37a38d7ebfc30ca46359abd3f3624aff3.exeC:\Users\Admin\AppData\Local\Temp\b97f16b75b2522ea30f217e7fc7831c37a38d7ebfc30ca46359abd3f3624aff3.exe2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\b97f16b75b2522ea30f217e7fc7831c37a38d7ebfc30ca46359abd3f3624aff3.exe"C:\Users\Admin\AppData\Local\Temp\b97f16b75b2522ea30f217e7fc7831c37a38d7ebfc30ca46359abd3f3624aff3.exe"3⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\autoinicio.vbs"4⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\attrib.exe"C:\Windows\System32\attrib.exe" +r +s +h C:\Users\Admin\AppData\Roaming\avgPro5⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Windows\SysWOW64\attrib.exe"C:\Windows\System32\attrib.exe" +r +s +h C:\Users\Admin\AppData\Roaming\avgPro\*.*5⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Users\Admin\AppData\Roaming\avgPro\avgPro.exe"C:\Users\Admin\AppData\Roaming\avgPro\avgPro.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\avgPro\avgPro.exeC:\Users\Admin\AppData\Roaming\avgPro\avgPro.exe5⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txtFilesize
219KB
MD549a3f0b2f6c9ffca5a5e4738cc699d00
SHA141390b11287f0c7df8a4c59842a49764c4a97a9c
SHA2560907f35dd4f118069491151976668d22e501a574281f251a6091b1c6990d9449
SHA51206b3bc0c46d782b1746505a9cdac26b72eea9d9ee8937d5c2a69096dbb39547f9ec4086e7af81109a5a6f852743f494d27f5ad4379b4cae21e6500dae40c70a9
-
C:\Users\Admin\AppData\Local\Temp\autoinicio.vbsFilesize
281B
MD5fb15fc83e75954b713eb68f19b3e34a6
SHA196bdcbb7ea67d7a0e1c6d46999264bf5e91c46ea
SHA2561e23295ffa92bb65099fbc7293caf419100a0ca5cd6921ec7bf8ddc4e9980347
SHA512b120cee2681bd7d8d06b9a08f11982d0b66cbbf7606e28a7b38d19818f9e257c6a2e8df80dc9884115419134e63e19efff6140035bf8124670a87e588b098cc9
-
C:\Users\Admin\AppData\Roaming\avgPro\avgPro.exeFilesize
461KB
MD545534195afd36071c6127a31a50415a8
SHA12782267ca60fcc138adcd2b3b3bda0c2f7b584f3
SHA256b97f16b75b2522ea30f217e7fc7831c37a38d7ebfc30ca46359abd3f3624aff3
SHA5120d441dfad134bec110ce08fb40eca753bf109582606c1a221f0c9a6cdca2479b3f4ebc091a268725a53b73e45af672d762656d7df3fda993cbbdb334b8c6a915
-
C:\Users\Admin\AppData\Roaming\avgPro\avgPro.exeFilesize
461KB
MD545534195afd36071c6127a31a50415a8
SHA12782267ca60fcc138adcd2b3b3bda0c2f7b584f3
SHA256b97f16b75b2522ea30f217e7fc7831c37a38d7ebfc30ca46359abd3f3624aff3
SHA5120d441dfad134bec110ce08fb40eca753bf109582606c1a221f0c9a6cdca2479b3f4ebc091a268725a53b73e45af672d762656d7df3fda993cbbdb334b8c6a915
-
C:\Users\Admin\AppData\Roaming\avgPro\avgPro.exeFilesize
461KB
MD545534195afd36071c6127a31a50415a8
SHA12782267ca60fcc138adcd2b3b3bda0c2f7b584f3
SHA256b97f16b75b2522ea30f217e7fc7831c37a38d7ebfc30ca46359abd3f3624aff3
SHA5120d441dfad134bec110ce08fb40eca753bf109582606c1a221f0c9a6cdca2479b3f4ebc091a268725a53b73e45af672d762656d7df3fda993cbbdb334b8c6a915
-
\Users\Admin\AppData\Roaming\avgPro\avgPro.exeFilesize
461KB
MD545534195afd36071c6127a31a50415a8
SHA12782267ca60fcc138adcd2b3b3bda0c2f7b584f3
SHA256b97f16b75b2522ea30f217e7fc7831c37a38d7ebfc30ca46359abd3f3624aff3
SHA5120d441dfad134bec110ce08fb40eca753bf109582606c1a221f0c9a6cdca2479b3f4ebc091a268725a53b73e45af672d762656d7df3fda993cbbdb334b8c6a915
-
\Users\Admin\AppData\Roaming\avgPro\avgPro.exeFilesize
461KB
MD545534195afd36071c6127a31a50415a8
SHA12782267ca60fcc138adcd2b3b3bda0c2f7b584f3
SHA256b97f16b75b2522ea30f217e7fc7831c37a38d7ebfc30ca46359abd3f3624aff3
SHA5120d441dfad134bec110ce08fb40eca753bf109582606c1a221f0c9a6cdca2479b3f4ebc091a268725a53b73e45af672d762656d7df3fda993cbbdb334b8c6a915
-
memory/936-63-0x0000000000000000-mapping.dmp
-
memory/936-68-0x0000000024010000-0x000000002406F000-memory.dmpFilesize
380KB
-
memory/936-70-0x0000000024010000-0x000000002406F000-memory.dmpFilesize
380KB
-
memory/936-91-0x0000000024010000-0x000000002406F000-memory.dmpFilesize
380KB
-
memory/936-94-0x0000000024010000-0x000000002406F000-memory.dmpFilesize
380KB
-
memory/1036-77-0x0000000000000000-mapping.dmp
-
memory/1260-78-0x0000000000000000-mapping.dmp
-
memory/1288-65-0x0000000024010000-0x000000002406F000-memory.dmpFilesize
380KB
-
memory/1288-58-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/1288-71-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/1288-57-0x000000000040BBD8-mapping.dmp
-
memory/1288-56-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/1288-61-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/1288-60-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/1288-59-0x00000000757A1000-0x00000000757A3000-memory.dmpFilesize
8KB
-
memory/1724-86-0x000000000040BBD8-mapping.dmp
-
memory/1724-90-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/1724-92-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/1724-93-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/1820-81-0x0000000000000000-mapping.dmp
-
memory/1952-74-0x0000000000000000-mapping.dmp