Analysis
-
max time kernel
191s -
max time network
196s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
04-12-2022 07:15
Static task
static1
Behavioral task
behavioral1
Sample
e5fd547cb06be9ecdf8e0e48968ec2fc5e6f54588f236c9d6ce65a46439aef09.exe
Resource
win7-20221111-en
General
-
Target
e5fd547cb06be9ecdf8e0e48968ec2fc5e6f54588f236c9d6ce65a46439aef09.exe
-
Size
560KB
-
MD5
54c76a097030347379ba021742244b07
-
SHA1
dea76310c3ee93c4e4c08a5591f5162fef2da5cb
-
SHA256
e5fd547cb06be9ecdf8e0e48968ec2fc5e6f54588f236c9d6ce65a46439aef09
-
SHA512
59329cd544cbd4fb449bc0ddd8afe32116a78deb2e0f2762fa25ae1a72dd5c0e46ebf52f163f7fd214b43d492e79a58246e207550c50d0f4bbb8f8c5ddf08866
-
SSDEEP
12288:pRB0qRa3DtkVQ9YCdXUNDdhPFHMRWFHS4AhguK63/5:pUqRoDtlYgXYNFHIhK6R
Malware Config
Extracted
cybergate
2.6
Victime
buls.no-ip.biz:80
***MUTEX***
-
enable_keylogger
true
-
enable_message_box
false
-
ftp_directory
./logs/
-
ftp_interval
30
-
injected_process
explorer.exe
-
install_dir
System32
-
install_file
svchost.exe
-
install_flag
true
-
keylogger_enable_ftp
false
-
message_box_caption
texto da mensagem
-
message_box_title
tÃtulo da mensagem
-
password
abcd1234
-
regkey_hkcu
HKCU
-
regkey_hklm
HKLM
Signatures
-
Adds policy Run key to start application 2 TTPs 4 IoCs
Processes:
e5fd547cb06be9ecdf8e0e48968ec2fc5e6f54588f236c9d6ce65a46439aef09.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Users\\Admin\\AppData\\Roaming\\System32\\svchost.exe" e5fd547cb06be9ecdf8e0e48968ec2fc5e6f54588f236c9d6ce65a46439aef09.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run e5fd547cb06be9ecdf8e0e48968ec2fc5e6f54588f236c9d6ce65a46439aef09.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Users\\Admin\\AppData\\Roaming\\System32\\svchost.exe" e5fd547cb06be9ecdf8e0e48968ec2fc5e6f54588f236c9d6ce65a46439aef09.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run e5fd547cb06be9ecdf8e0e48968ec2fc5e6f54588f236c9d6ce65a46439aef09.exe -
Executes dropped EXE 7 IoCs
Processes:
svchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exepid process 480 svchost.exe 548 svchost.exe 1480 svchost.exe 1640 svchost.exe 1692 svchost.exe 768 svchost.exe 1156 svchost.exe -
Modifies Installed Components in the registry 2 TTPs 4 IoCs
Processes:
e5fd547cb06be9ecdf8e0e48968ec2fc5e6f54588f236c9d6ce65a46439aef09.exeexplorer.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{S1VVJ81Y-FT4U-861Y-4C83-I67BS20Y781F} e5fd547cb06be9ecdf8e0e48968ec2fc5e6f54588f236c9d6ce65a46439aef09.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{S1VVJ81Y-FT4U-861Y-4C83-I67BS20Y781F}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\System32\\svchost.exe Restart" e5fd547cb06be9ecdf8e0e48968ec2fc5e6f54588f236c9d6ce65a46439aef09.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{S1VVJ81Y-FT4U-861Y-4C83-I67BS20Y781F} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{S1VVJ81Y-FT4U-861Y-4C83-I67BS20Y781F}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\System32\\svchost.exe" explorer.exe -
Processes:
resource yara_rule behavioral1/memory/1772-71-0x0000000024010000-0x0000000024072000-memory.dmp upx behavioral1/memory/1772-80-0x0000000024080000-0x00000000240E2000-memory.dmp upx behavioral1/memory/1760-85-0x0000000024080000-0x00000000240E2000-memory.dmp upx behavioral1/memory/1760-88-0x0000000024080000-0x00000000240E2000-memory.dmp upx behavioral1/memory/1772-90-0x00000000240F0000-0x0000000024152000-memory.dmp upx behavioral1/memory/1772-103-0x0000000024160000-0x00000000241C2000-memory.dmp upx behavioral1/memory/688-118-0x0000000024160000-0x00000000241C2000-memory.dmp upx behavioral1/memory/688-119-0x0000000024160000-0x00000000241C2000-memory.dmp upx behavioral1/memory/548-128-0x0000000024080000-0x00000000240E2000-memory.dmp upx behavioral1/memory/1480-138-0x0000000024080000-0x00000000240E2000-memory.dmp upx behavioral1/memory/1480-151-0x0000000024080000-0x00000000240E2000-memory.dmp upx behavioral1/memory/688-152-0x0000000024160000-0x00000000241C2000-memory.dmp upx behavioral1/memory/1480-168-0x0000000024080000-0x00000000240E2000-memory.dmp upx -
Loads dropped DLL 3 IoCs
Processes:
explorer.exepid process 1760 explorer.exe 1760 explorer.exe 1760 explorer.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
e5fd547cb06be9ecdf8e0e48968ec2fc5e6f54588f236c9d6ce65a46439aef09.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run e5fd547cb06be9ecdf8e0e48968ec2fc5e6f54588f236c9d6ce65a46439aef09.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Users\\Admin\\AppData\\Roaming\\System32\\svchost.exe" e5fd547cb06be9ecdf8e0e48968ec2fc5e6f54588f236c9d6ce65a46439aef09.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run e5fd547cb06be9ecdf8e0e48968ec2fc5e6f54588f236c9d6ce65a46439aef09.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Users\\Admin\\AppData\\Roaming\\System32\\svchost.exe" e5fd547cb06be9ecdf8e0e48968ec2fc5e6f54588f236c9d6ce65a46439aef09.exe -
Drops file in System32 directory 3 IoCs
Processes:
e5fd547cb06be9ecdf8e0e48968ec2fc5e6f54588f236c9d6ce65a46439aef09.exesvchost.exedescription ioc process File opened for modification C:\Windows\SysWOW64\svchost.exe e5fd547cb06be9ecdf8e0e48968ec2fc5e6f54588f236c9d6ce65a46439aef09.exe File created C:\Windows\SysWOW64\svchost.exe e5fd547cb06be9ecdf8e0e48968ec2fc5e6f54588f236c9d6ce65a46439aef09.exe File opened for modification C:\Windows\SysWOW64\svchost.exe svchost.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
e5fd547cb06be9ecdf8e0e48968ec2fc5e6f54588f236c9d6ce65a46439aef09.exesvchost.exesvchost.exesvchost.exedescription pid process target process PID 1188 set thread context of 1772 1188 e5fd547cb06be9ecdf8e0e48968ec2fc5e6f54588f236c9d6ce65a46439aef09.exe e5fd547cb06be9ecdf8e0e48968ec2fc5e6f54588f236c9d6ce65a46439aef09.exe PID 480 set thread context of 548 480 svchost.exe svchost.exe PID 1640 set thread context of 1692 1640 svchost.exe svchost.exe PID 768 set thread context of 1156 768 svchost.exe svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
e5fd547cb06be9ecdf8e0e48968ec2fc5e6f54588f236c9d6ce65a46439aef09.exesvchost.exesvchost.exepid process 1772 e5fd547cb06be9ecdf8e0e48968ec2fc5e6f54588f236c9d6ce65a46439aef09.exe 548 svchost.exe 1692 svchost.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
svchost.exepid process 1480 svchost.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
svchost.exedescription pid process Token: SeDebugPrivilege 1480 svchost.exe Token: SeDebugPrivilege 1480 svchost.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
e5fd547cb06be9ecdf8e0e48968ec2fc5e6f54588f236c9d6ce65a46439aef09.exepid process 1772 e5fd547cb06be9ecdf8e0e48968ec2fc5e6f54588f236c9d6ce65a46439aef09.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
e5fd547cb06be9ecdf8e0e48968ec2fc5e6f54588f236c9d6ce65a46439aef09.exesvchost.exesvchost.exesvchost.exepid process 1188 e5fd547cb06be9ecdf8e0e48968ec2fc5e6f54588f236c9d6ce65a46439aef09.exe 480 svchost.exe 1640 svchost.exe 768 svchost.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
e5fd547cb06be9ecdf8e0e48968ec2fc5e6f54588f236c9d6ce65a46439aef09.exee5fd547cb06be9ecdf8e0e48968ec2fc5e6f54588f236c9d6ce65a46439aef09.exedescription pid process target process PID 1188 wrote to memory of 1772 1188 e5fd547cb06be9ecdf8e0e48968ec2fc5e6f54588f236c9d6ce65a46439aef09.exe e5fd547cb06be9ecdf8e0e48968ec2fc5e6f54588f236c9d6ce65a46439aef09.exe PID 1188 wrote to memory of 1772 1188 e5fd547cb06be9ecdf8e0e48968ec2fc5e6f54588f236c9d6ce65a46439aef09.exe e5fd547cb06be9ecdf8e0e48968ec2fc5e6f54588f236c9d6ce65a46439aef09.exe PID 1188 wrote to memory of 1772 1188 e5fd547cb06be9ecdf8e0e48968ec2fc5e6f54588f236c9d6ce65a46439aef09.exe e5fd547cb06be9ecdf8e0e48968ec2fc5e6f54588f236c9d6ce65a46439aef09.exe PID 1188 wrote to memory of 1772 1188 e5fd547cb06be9ecdf8e0e48968ec2fc5e6f54588f236c9d6ce65a46439aef09.exe e5fd547cb06be9ecdf8e0e48968ec2fc5e6f54588f236c9d6ce65a46439aef09.exe PID 1188 wrote to memory of 1772 1188 e5fd547cb06be9ecdf8e0e48968ec2fc5e6f54588f236c9d6ce65a46439aef09.exe e5fd547cb06be9ecdf8e0e48968ec2fc5e6f54588f236c9d6ce65a46439aef09.exe PID 1188 wrote to memory of 1772 1188 e5fd547cb06be9ecdf8e0e48968ec2fc5e6f54588f236c9d6ce65a46439aef09.exe e5fd547cb06be9ecdf8e0e48968ec2fc5e6f54588f236c9d6ce65a46439aef09.exe PID 1188 wrote to memory of 1772 1188 e5fd547cb06be9ecdf8e0e48968ec2fc5e6f54588f236c9d6ce65a46439aef09.exe e5fd547cb06be9ecdf8e0e48968ec2fc5e6f54588f236c9d6ce65a46439aef09.exe PID 1188 wrote to memory of 1772 1188 e5fd547cb06be9ecdf8e0e48968ec2fc5e6f54588f236c9d6ce65a46439aef09.exe e5fd547cb06be9ecdf8e0e48968ec2fc5e6f54588f236c9d6ce65a46439aef09.exe PID 1188 wrote to memory of 1772 1188 e5fd547cb06be9ecdf8e0e48968ec2fc5e6f54588f236c9d6ce65a46439aef09.exe e5fd547cb06be9ecdf8e0e48968ec2fc5e6f54588f236c9d6ce65a46439aef09.exe PID 1188 wrote to memory of 1772 1188 e5fd547cb06be9ecdf8e0e48968ec2fc5e6f54588f236c9d6ce65a46439aef09.exe e5fd547cb06be9ecdf8e0e48968ec2fc5e6f54588f236c9d6ce65a46439aef09.exe PID 1188 wrote to memory of 1772 1188 e5fd547cb06be9ecdf8e0e48968ec2fc5e6f54588f236c9d6ce65a46439aef09.exe e5fd547cb06be9ecdf8e0e48968ec2fc5e6f54588f236c9d6ce65a46439aef09.exe PID 1188 wrote to memory of 1772 1188 e5fd547cb06be9ecdf8e0e48968ec2fc5e6f54588f236c9d6ce65a46439aef09.exe e5fd547cb06be9ecdf8e0e48968ec2fc5e6f54588f236c9d6ce65a46439aef09.exe PID 1188 wrote to memory of 1772 1188 e5fd547cb06be9ecdf8e0e48968ec2fc5e6f54588f236c9d6ce65a46439aef09.exe e5fd547cb06be9ecdf8e0e48968ec2fc5e6f54588f236c9d6ce65a46439aef09.exe PID 1188 wrote to memory of 1772 1188 e5fd547cb06be9ecdf8e0e48968ec2fc5e6f54588f236c9d6ce65a46439aef09.exe e5fd547cb06be9ecdf8e0e48968ec2fc5e6f54588f236c9d6ce65a46439aef09.exe PID 1772 wrote to memory of 1244 1772 e5fd547cb06be9ecdf8e0e48968ec2fc5e6f54588f236c9d6ce65a46439aef09.exe Explorer.EXE PID 1772 wrote to memory of 1244 1772 e5fd547cb06be9ecdf8e0e48968ec2fc5e6f54588f236c9d6ce65a46439aef09.exe Explorer.EXE PID 1772 wrote to memory of 1244 1772 e5fd547cb06be9ecdf8e0e48968ec2fc5e6f54588f236c9d6ce65a46439aef09.exe Explorer.EXE PID 1772 wrote to memory of 1244 1772 e5fd547cb06be9ecdf8e0e48968ec2fc5e6f54588f236c9d6ce65a46439aef09.exe Explorer.EXE PID 1772 wrote to memory of 1244 1772 e5fd547cb06be9ecdf8e0e48968ec2fc5e6f54588f236c9d6ce65a46439aef09.exe Explorer.EXE PID 1772 wrote to memory of 1244 1772 e5fd547cb06be9ecdf8e0e48968ec2fc5e6f54588f236c9d6ce65a46439aef09.exe Explorer.EXE PID 1772 wrote to memory of 1244 1772 e5fd547cb06be9ecdf8e0e48968ec2fc5e6f54588f236c9d6ce65a46439aef09.exe Explorer.EXE PID 1772 wrote to memory of 1244 1772 e5fd547cb06be9ecdf8e0e48968ec2fc5e6f54588f236c9d6ce65a46439aef09.exe Explorer.EXE PID 1772 wrote to memory of 1244 1772 e5fd547cb06be9ecdf8e0e48968ec2fc5e6f54588f236c9d6ce65a46439aef09.exe Explorer.EXE PID 1772 wrote to memory of 1244 1772 e5fd547cb06be9ecdf8e0e48968ec2fc5e6f54588f236c9d6ce65a46439aef09.exe Explorer.EXE PID 1772 wrote to memory of 1244 1772 e5fd547cb06be9ecdf8e0e48968ec2fc5e6f54588f236c9d6ce65a46439aef09.exe Explorer.EXE PID 1772 wrote to memory of 1244 1772 e5fd547cb06be9ecdf8e0e48968ec2fc5e6f54588f236c9d6ce65a46439aef09.exe Explorer.EXE PID 1772 wrote to memory of 1244 1772 e5fd547cb06be9ecdf8e0e48968ec2fc5e6f54588f236c9d6ce65a46439aef09.exe Explorer.EXE PID 1772 wrote to memory of 1244 1772 e5fd547cb06be9ecdf8e0e48968ec2fc5e6f54588f236c9d6ce65a46439aef09.exe Explorer.EXE PID 1772 wrote to memory of 1244 1772 e5fd547cb06be9ecdf8e0e48968ec2fc5e6f54588f236c9d6ce65a46439aef09.exe Explorer.EXE PID 1772 wrote to memory of 1244 1772 e5fd547cb06be9ecdf8e0e48968ec2fc5e6f54588f236c9d6ce65a46439aef09.exe Explorer.EXE PID 1772 wrote to memory of 1244 1772 e5fd547cb06be9ecdf8e0e48968ec2fc5e6f54588f236c9d6ce65a46439aef09.exe Explorer.EXE PID 1772 wrote to memory of 1244 1772 e5fd547cb06be9ecdf8e0e48968ec2fc5e6f54588f236c9d6ce65a46439aef09.exe Explorer.EXE PID 1772 wrote to memory of 1244 1772 e5fd547cb06be9ecdf8e0e48968ec2fc5e6f54588f236c9d6ce65a46439aef09.exe Explorer.EXE PID 1772 wrote to memory of 1244 1772 e5fd547cb06be9ecdf8e0e48968ec2fc5e6f54588f236c9d6ce65a46439aef09.exe Explorer.EXE PID 1772 wrote to memory of 1244 1772 e5fd547cb06be9ecdf8e0e48968ec2fc5e6f54588f236c9d6ce65a46439aef09.exe Explorer.EXE PID 1772 wrote to memory of 1244 1772 e5fd547cb06be9ecdf8e0e48968ec2fc5e6f54588f236c9d6ce65a46439aef09.exe Explorer.EXE PID 1772 wrote to memory of 1244 1772 e5fd547cb06be9ecdf8e0e48968ec2fc5e6f54588f236c9d6ce65a46439aef09.exe Explorer.EXE PID 1772 wrote to memory of 1244 1772 e5fd547cb06be9ecdf8e0e48968ec2fc5e6f54588f236c9d6ce65a46439aef09.exe Explorer.EXE PID 1772 wrote to memory of 1244 1772 e5fd547cb06be9ecdf8e0e48968ec2fc5e6f54588f236c9d6ce65a46439aef09.exe Explorer.EXE PID 1772 wrote to memory of 1244 1772 e5fd547cb06be9ecdf8e0e48968ec2fc5e6f54588f236c9d6ce65a46439aef09.exe Explorer.EXE PID 1772 wrote to memory of 1244 1772 e5fd547cb06be9ecdf8e0e48968ec2fc5e6f54588f236c9d6ce65a46439aef09.exe Explorer.EXE PID 1772 wrote to memory of 1244 1772 e5fd547cb06be9ecdf8e0e48968ec2fc5e6f54588f236c9d6ce65a46439aef09.exe Explorer.EXE PID 1772 wrote to memory of 1244 1772 e5fd547cb06be9ecdf8e0e48968ec2fc5e6f54588f236c9d6ce65a46439aef09.exe Explorer.EXE PID 1772 wrote to memory of 1244 1772 e5fd547cb06be9ecdf8e0e48968ec2fc5e6f54588f236c9d6ce65a46439aef09.exe Explorer.EXE PID 1772 wrote to memory of 1244 1772 e5fd547cb06be9ecdf8e0e48968ec2fc5e6f54588f236c9d6ce65a46439aef09.exe Explorer.EXE PID 1772 wrote to memory of 1244 1772 e5fd547cb06be9ecdf8e0e48968ec2fc5e6f54588f236c9d6ce65a46439aef09.exe Explorer.EXE PID 1772 wrote to memory of 1244 1772 e5fd547cb06be9ecdf8e0e48968ec2fc5e6f54588f236c9d6ce65a46439aef09.exe Explorer.EXE PID 1772 wrote to memory of 1244 1772 e5fd547cb06be9ecdf8e0e48968ec2fc5e6f54588f236c9d6ce65a46439aef09.exe Explorer.EXE PID 1772 wrote to memory of 1244 1772 e5fd547cb06be9ecdf8e0e48968ec2fc5e6f54588f236c9d6ce65a46439aef09.exe Explorer.EXE PID 1772 wrote to memory of 1244 1772 e5fd547cb06be9ecdf8e0e48968ec2fc5e6f54588f236c9d6ce65a46439aef09.exe Explorer.EXE PID 1772 wrote to memory of 1244 1772 e5fd547cb06be9ecdf8e0e48968ec2fc5e6f54588f236c9d6ce65a46439aef09.exe Explorer.EXE PID 1772 wrote to memory of 1244 1772 e5fd547cb06be9ecdf8e0e48968ec2fc5e6f54588f236c9d6ce65a46439aef09.exe Explorer.EXE PID 1772 wrote to memory of 1244 1772 e5fd547cb06be9ecdf8e0e48968ec2fc5e6f54588f236c9d6ce65a46439aef09.exe Explorer.EXE PID 1772 wrote to memory of 1244 1772 e5fd547cb06be9ecdf8e0e48968ec2fc5e6f54588f236c9d6ce65a46439aef09.exe Explorer.EXE PID 1772 wrote to memory of 1244 1772 e5fd547cb06be9ecdf8e0e48968ec2fc5e6f54588f236c9d6ce65a46439aef09.exe Explorer.EXE PID 1772 wrote to memory of 1244 1772 e5fd547cb06be9ecdf8e0e48968ec2fc5e6f54588f236c9d6ce65a46439aef09.exe Explorer.EXE PID 1772 wrote to memory of 1244 1772 e5fd547cb06be9ecdf8e0e48968ec2fc5e6f54588f236c9d6ce65a46439aef09.exe Explorer.EXE PID 1772 wrote to memory of 1244 1772 e5fd547cb06be9ecdf8e0e48968ec2fc5e6f54588f236c9d6ce65a46439aef09.exe Explorer.EXE PID 1772 wrote to memory of 1244 1772 e5fd547cb06be9ecdf8e0e48968ec2fc5e6f54588f236c9d6ce65a46439aef09.exe Explorer.EXE PID 1772 wrote to memory of 1244 1772 e5fd547cb06be9ecdf8e0e48968ec2fc5e6f54588f236c9d6ce65a46439aef09.exe Explorer.EXE PID 1772 wrote to memory of 1244 1772 e5fd547cb06be9ecdf8e0e48968ec2fc5e6f54588f236c9d6ce65a46439aef09.exe Explorer.EXE PID 1772 wrote to memory of 1244 1772 e5fd547cb06be9ecdf8e0e48968ec2fc5e6f54588f236c9d6ce65a46439aef09.exe Explorer.EXE PID 1772 wrote to memory of 1244 1772 e5fd547cb06be9ecdf8e0e48968ec2fc5e6f54588f236c9d6ce65a46439aef09.exe Explorer.EXE PID 1772 wrote to memory of 1244 1772 e5fd547cb06be9ecdf8e0e48968ec2fc5e6f54588f236c9d6ce65a46439aef09.exe Explorer.EXE
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\e5fd547cb06be9ecdf8e0e48968ec2fc5e6f54588f236c9d6ce65a46439aef09.exe"C:\Users\Admin\AppData\Local\Temp\e5fd547cb06be9ecdf8e0e48968ec2fc5e6f54588f236c9d6ce65a46439aef09.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\e5fd547cb06be9ecdf8e0e48968ec2fc5e6f54588f236c9d6ce65a46439aef09.exeC:\Users\Admin\AppData\Local\Temp\e5fd547cb06be9ecdf8e0e48968ec2fc5e6f54588f236c9d6ce65a46439aef09.exe3⤵
- Adds policy Run key to start application
- Modifies Installed Components in the registry
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe4⤵
- Modifies Installed Components in the registry
- Loads dropped DLL
-
C:\Users\Admin\AppData\Roaming\System32\svchost.exe"C:\Users\Admin\AppData\Roaming\System32\svchost.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\System32\svchost.exeC:\Users\Admin\AppData\Roaming\System32\svchost.exe6⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"7⤵
-
C:\Users\Admin\AppData\Roaming\System32\svchost.exe"C:\Users\Admin\AppData\Roaming\System32\svchost.exe"7⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\System32\svchost.exe"C:\Users\Admin\AppData\Roaming\System32\svchost.exe"8⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\System32\svchost.exeC:\Users\Admin\AppData\Roaming\System32\svchost.exe9⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\System32\svchost.exe"C:\Users\Admin\AppData\Roaming\System32\svchost.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\System32\svchost.exeC:\Users\Admin\AppData\Roaming\System32\svchost.exe6⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\e5fd547cb06be9ecdf8e0e48968ec2fc5e6f54588f236c9d6ce65a46439aef09.exe"C:\Users\Admin\AppData\Local\Temp\e5fd547cb06be9ecdf8e0e48968ec2fc5e6f54588f236c9d6ce65a46439aef09.exe"4⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txtFilesize
229KB
MD5924ed30b390702c4283aae5b5735414c
SHA1ab8450cf890e1ba50abded442ea60132f6638450
SHA2565bebe5c1aa342b944c99838f6d51e07d369ea44d9e1ca99be17635a2f1b18cfa
SHA512276e1ce6da744919931d6901bd3e85dfc57f83bb331498dba9d9f1ad5305df457e5c30bdaaacca2c9bbdc6be76ed21ce79e5ddbb42c05bfe06192196ad373f0b
-
C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txtFilesize
229KB
MD5bcfff1b8778c79e6cb6d34a1c2d7bd5d
SHA1b69b3cf7ae5a198e7d3fe57b9d1836906ea4acef
SHA25696993b2469f5537765218aab405ccb224f12c5492121217d9ef9afc0bf33325b
SHA512622cdfade86d1c40e4850380dce6b896a8a622a5e7f2d1685ad7c00344b4634c709550b42e564d2de30555bea76930bd2ce6b73890abb68851ea5765d3977df8
-
C:\Users\Admin\AppData\Roaming\System32\svchost.exeFilesize
560KB
MD554c76a097030347379ba021742244b07
SHA1dea76310c3ee93c4e4c08a5591f5162fef2da5cb
SHA256e5fd547cb06be9ecdf8e0e48968ec2fc5e6f54588f236c9d6ce65a46439aef09
SHA51259329cd544cbd4fb449bc0ddd8afe32116a78deb2e0f2762fa25ae1a72dd5c0e46ebf52f163f7fd214b43d492e79a58246e207550c50d0f4bbb8f8c5ddf08866
-
C:\Users\Admin\AppData\Roaming\System32\svchost.exeFilesize
560KB
MD554c76a097030347379ba021742244b07
SHA1dea76310c3ee93c4e4c08a5591f5162fef2da5cb
SHA256e5fd547cb06be9ecdf8e0e48968ec2fc5e6f54588f236c9d6ce65a46439aef09
SHA51259329cd544cbd4fb449bc0ddd8afe32116a78deb2e0f2762fa25ae1a72dd5c0e46ebf52f163f7fd214b43d492e79a58246e207550c50d0f4bbb8f8c5ddf08866
-
C:\Users\Admin\AppData\Roaming\System32\svchost.exeFilesize
560KB
MD554c76a097030347379ba021742244b07
SHA1dea76310c3ee93c4e4c08a5591f5162fef2da5cb
SHA256e5fd547cb06be9ecdf8e0e48968ec2fc5e6f54588f236c9d6ce65a46439aef09
SHA51259329cd544cbd4fb449bc0ddd8afe32116a78deb2e0f2762fa25ae1a72dd5c0e46ebf52f163f7fd214b43d492e79a58246e207550c50d0f4bbb8f8c5ddf08866
-
C:\Users\Admin\AppData\Roaming\System32\svchost.exeFilesize
560KB
MD554c76a097030347379ba021742244b07
SHA1dea76310c3ee93c4e4c08a5591f5162fef2da5cb
SHA256e5fd547cb06be9ecdf8e0e48968ec2fc5e6f54588f236c9d6ce65a46439aef09
SHA51259329cd544cbd4fb449bc0ddd8afe32116a78deb2e0f2762fa25ae1a72dd5c0e46ebf52f163f7fd214b43d492e79a58246e207550c50d0f4bbb8f8c5ddf08866
-
C:\Users\Admin\AppData\Roaming\System32\svchost.exeFilesize
560KB
MD554c76a097030347379ba021742244b07
SHA1dea76310c3ee93c4e4c08a5591f5162fef2da5cb
SHA256e5fd547cb06be9ecdf8e0e48968ec2fc5e6f54588f236c9d6ce65a46439aef09
SHA51259329cd544cbd4fb449bc0ddd8afe32116a78deb2e0f2762fa25ae1a72dd5c0e46ebf52f163f7fd214b43d492e79a58246e207550c50d0f4bbb8f8c5ddf08866
-
C:\Users\Admin\AppData\Roaming\System32\svchost.exeFilesize
560KB
MD554c76a097030347379ba021742244b07
SHA1dea76310c3ee93c4e4c08a5591f5162fef2da5cb
SHA256e5fd547cb06be9ecdf8e0e48968ec2fc5e6f54588f236c9d6ce65a46439aef09
SHA51259329cd544cbd4fb449bc0ddd8afe32116a78deb2e0f2762fa25ae1a72dd5c0e46ebf52f163f7fd214b43d492e79a58246e207550c50d0f4bbb8f8c5ddf08866
-
C:\Users\Admin\AppData\Roaming\System32\svchost.exeFilesize
560KB
MD554c76a097030347379ba021742244b07
SHA1dea76310c3ee93c4e4c08a5591f5162fef2da5cb
SHA256e5fd547cb06be9ecdf8e0e48968ec2fc5e6f54588f236c9d6ce65a46439aef09
SHA51259329cd544cbd4fb449bc0ddd8afe32116a78deb2e0f2762fa25ae1a72dd5c0e46ebf52f163f7fd214b43d492e79a58246e207550c50d0f4bbb8f8c5ddf08866
-
C:\Users\Admin\AppData\Roaming\System32\svchost.exeFilesize
560KB
MD554c76a097030347379ba021742244b07
SHA1dea76310c3ee93c4e4c08a5591f5162fef2da5cb
SHA256e5fd547cb06be9ecdf8e0e48968ec2fc5e6f54588f236c9d6ce65a46439aef09
SHA51259329cd544cbd4fb449bc0ddd8afe32116a78deb2e0f2762fa25ae1a72dd5c0e46ebf52f163f7fd214b43d492e79a58246e207550c50d0f4bbb8f8c5ddf08866
-
\Users\Admin\AppData\Roaming\System32\svchost.exeFilesize
560KB
MD554c76a097030347379ba021742244b07
SHA1dea76310c3ee93c4e4c08a5591f5162fef2da5cb
SHA256e5fd547cb06be9ecdf8e0e48968ec2fc5e6f54588f236c9d6ce65a46439aef09
SHA51259329cd544cbd4fb449bc0ddd8afe32116a78deb2e0f2762fa25ae1a72dd5c0e46ebf52f163f7fd214b43d492e79a58246e207550c50d0f4bbb8f8c5ddf08866
-
\Users\Admin\AppData\Roaming\System32\svchost.exeFilesize
560KB
MD554c76a097030347379ba021742244b07
SHA1dea76310c3ee93c4e4c08a5591f5162fef2da5cb
SHA256e5fd547cb06be9ecdf8e0e48968ec2fc5e6f54588f236c9d6ce65a46439aef09
SHA51259329cd544cbd4fb449bc0ddd8afe32116a78deb2e0f2762fa25ae1a72dd5c0e46ebf52f163f7fd214b43d492e79a58246e207550c50d0f4bbb8f8c5ddf08866
-
\Users\Admin\AppData\Roaming\System32\svchost.exeFilesize
560KB
MD554c76a097030347379ba021742244b07
SHA1dea76310c3ee93c4e4c08a5591f5162fef2da5cb
SHA256e5fd547cb06be9ecdf8e0e48968ec2fc5e6f54588f236c9d6ce65a46439aef09
SHA51259329cd544cbd4fb449bc0ddd8afe32116a78deb2e0f2762fa25ae1a72dd5c0e46ebf52f163f7fd214b43d492e79a58246e207550c50d0f4bbb8f8c5ddf08866
-
memory/480-117-0x0000000002141000-0x0000000002145000-memory.dmpFilesize
16KB
-
memory/480-97-0x0000000000000000-mapping.dmp
-
memory/480-114-0x0000000000400000-0x000000000048E000-memory.dmpFilesize
568KB
-
memory/480-116-0x00000000002E0000-0x0000000000319000-memory.dmpFilesize
228KB
-
memory/480-100-0x0000000000400000-0x000000000048E000-memory.dmpFilesize
568KB
-
memory/548-120-0x0000000000400000-0x0000000000450000-memory.dmpFilesize
320KB
-
memory/548-128-0x0000000024080000-0x00000000240E2000-memory.dmpFilesize
392KB
-
memory/548-107-0x000000000040BBF4-mapping.dmp
-
memory/548-136-0x0000000000400000-0x0000000000450000-memory.dmpFilesize
320KB
-
memory/688-119-0x0000000024160000-0x00000000241C2000-memory.dmpFilesize
392KB
-
memory/688-152-0x0000000024160000-0x00000000241C2000-memory.dmpFilesize
392KB
-
memory/688-118-0x0000000024160000-0x00000000241C2000-memory.dmpFilesize
392KB
-
memory/688-96-0x0000000000000000-mapping.dmp
-
memory/768-153-0x0000000000000000-mapping.dmp
-
memory/768-162-0x0000000000400000-0x000000000048E000-memory.dmpFilesize
568KB
-
memory/768-163-0x0000000000260000-0x0000000000299000-memory.dmpFilesize
228KB
-
memory/1156-166-0x0000000000400000-0x0000000000450000-memory.dmpFilesize
320KB
-
memory/1156-159-0x000000000040BBF4-mapping.dmp
-
memory/1156-170-0x0000000000400000-0x0000000000450000-memory.dmpFilesize
320KB
-
memory/1156-169-0x0000000000400000-0x0000000000450000-memory.dmpFilesize
320KB
-
memory/1188-61-0x0000000000400000-0x000000000048E000-memory.dmpFilesize
568KB
-
memory/1188-66-0x0000000000270000-0x00000000002A9000-memory.dmpFilesize
228KB
-
memory/1188-65-0x0000000000400000-0x000000000048E000-memory.dmpFilesize
568KB
-
memory/1188-54-0x0000000000400000-0x000000000048E000-memory.dmpFilesize
568KB
-
memory/1188-60-0x0000000001FE1000-0x0000000001FE5000-memory.dmpFilesize
16KB
-
memory/1188-59-0x0000000000270000-0x00000000002A9000-memory.dmpFilesize
228KB
-
memory/1188-58-0x0000000000220000-0x0000000000224000-memory.dmpFilesize
16KB
-
memory/1188-57-0x0000000000400000-0x000000000048E000-memory.dmpFilesize
568KB
-
memory/1244-74-0x0000000024010000-0x0000000024072000-memory.dmpFilesize
392KB
-
memory/1480-168-0x0000000024080000-0x00000000240E2000-memory.dmpFilesize
392KB
-
memory/1480-151-0x0000000024080000-0x00000000240E2000-memory.dmpFilesize
392KB
-
memory/1480-126-0x0000000000000000-mapping.dmp
-
memory/1480-138-0x0000000024080000-0x00000000240E2000-memory.dmpFilesize
392KB
-
memory/1640-146-0x00000000002F0000-0x0000000000329000-memory.dmpFilesize
228KB
-
memory/1640-133-0x0000000000000000-mapping.dmp
-
memory/1640-145-0x0000000000400000-0x000000000048E000-memory.dmpFilesize
568KB
-
memory/1692-142-0x000000000040BBF4-mapping.dmp
-
memory/1692-167-0x0000000000400000-0x0000000000450000-memory.dmpFilesize
320KB
-
memory/1692-149-0x0000000000400000-0x0000000000450000-memory.dmpFilesize
320KB
-
memory/1692-150-0x0000000000400000-0x0000000000450000-memory.dmpFilesize
320KB
-
memory/1760-77-0x0000000000000000-mapping.dmp
-
memory/1760-79-0x0000000074D01000-0x0000000074D03000-memory.dmpFilesize
8KB
-
memory/1760-88-0x0000000024080000-0x00000000240E2000-memory.dmpFilesize
392KB
-
memory/1760-85-0x0000000024080000-0x00000000240E2000-memory.dmpFilesize
392KB
-
memory/1772-80-0x0000000024080000-0x00000000240E2000-memory.dmpFilesize
392KB
-
memory/1772-90-0x00000000240F0000-0x0000000024152000-memory.dmpFilesize
392KB
-
memory/1772-103-0x0000000024160000-0x00000000241C2000-memory.dmpFilesize
392KB
-
memory/1772-71-0x0000000024010000-0x0000000024072000-memory.dmpFilesize
392KB
-
memory/1772-69-0x0000000000400000-0x0000000000450000-memory.dmpFilesize
320KB
-
memory/1772-68-0x0000000000400000-0x0000000000450000-memory.dmpFilesize
320KB
-
memory/1772-67-0x0000000075BE1000-0x0000000075BE3000-memory.dmpFilesize
8KB
-
memory/1772-115-0x0000000000400000-0x0000000000450000-memory.dmpFilesize
320KB
-
memory/1772-64-0x0000000000400000-0x0000000000450000-memory.dmpFilesize
320KB
-
memory/1772-63-0x000000000040BBF4-mapping.dmp
-
memory/1772-62-0x0000000000400000-0x0000000000450000-memory.dmpFilesize
320KB