ef51c68ec438cf1245fbbac8af8a2f38bcbe3cb2f9e105e46224fcaa8d52f9ab

Analysis

max time kernel
150s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
04-12-2022 10:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ef51c68ec438cf1245fbbac8af8a2f38bcbe3cb2f9e105e46224fcaa8d52f9ab.exe
Size

226KB
MD5

e1a68fd193ea6f726077f859cf44cfa9
SHA1

70cfa4d3cfd10afcf0aab0b95aef12e0ca021271
SHA256

ef51c68ec438cf1245fbbac8af8a2f38bcbe3cb2f9e105e46224fcaa8d52f9ab
SHA512

3bd74f85b94982b93e339b14ac7a1acb2ad95fb878ebe9b1a43736043e73e6b7082cf541e228519a09c989fe127ceab1bb558125fc351faecda27e6265e79023
SSDEEP

3072:9p1I47QE7GxrKLgp0kEEtPMIXHM+gRCM1m5bcT8ULR4g:bO4rgmzmxg9obg1O

Score

10^/10

evasion persistence upx

Malware Config

Signatures

Modifies firewall policy service 2 TTPs 8 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	reg.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\ef51c68ec438cf1245fbbac8af8a2f38bcbe3cb2f9e105e46224fcaa8d52f9ab.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ef51c68ec438cf1245fbbac8af8a2f38bcbe3cb2f9e105e46224fcaa8d52f9ab.exe:*:Enabled:Windows Messanger"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	reg.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\333.exe = "C:\\Users\\Admin\\AppData\\Roaming\\333.exe:*:Enabled:Windows Messanger"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	reg.exe

Adds policy Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run	ef51c68ec438cf1245fbbac8af8a2f38bcbe3cb2f9e105e46224fcaa8d52f9ab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\xer = "C:\\Users\\Admin\\AppData\\Roaming\\333.exe"	ef51c68ec438cf1245fbbac8af8a2f38bcbe3cb2f9e105e46224fcaa8d52f9ab.exe

Executes dropped EXE 1 IoCs

pid	Process
2028	Y2TZ9BXMTH41.exe

Modifies Installed Components in the registry 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\{BE2AECEB-BFC5-010E-FEEF-060DDEE9AE82}	ef51c68ec438cf1245fbbac8af8a2f38bcbe3cb2f9e105e46224fcaa8d52f9ab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Active Setup\Installed Components\{BE2AECEB-BFC5-010E-FEEF-060DDEE9AE82}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\333.exe"	ef51c68ec438cf1245fbbac8af8a2f38bcbe3cb2f9e105e46224fcaa8d52f9ab.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{BE2AECEB-BFC5-010E-FEEF-060DDEE9AE82}	ef51c68ec438cf1245fbbac8af8a2f38bcbe3cb2f9e105e46224fcaa8d52f9ab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{BE2AECEB-BFC5-010E-FEEF-060DDEE9AE82}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\333.exe"	ef51c68ec438cf1245fbbac8af8a2f38bcbe3cb2f9e105e46224fcaa8d52f9ab.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1000-58-0x0000000000400000-0x000000000045D000-memory.dmp	upx
behavioral1/memory/1000-62-0x0000000000400000-0x000000000045D000-memory.dmp	upx
behavioral1/memory/1000-63-0x0000000000400000-0x000000000045D000-memory.dmp	upx
behavioral1/memory/1000-71-0x0000000000400000-0x000000000045D000-memory.dmp	upx
behavioral1/memory/1000-81-0x0000000000400000-0x000000000045D000-memory.dmp	upx

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\International\Geo\Nation	Y2TZ9BXMTH41.exe

Loads dropped DLL 1 IoCs

pid	Process
1000	ef51c68ec438cf1245fbbac8af8a2f38bcbe3cb2f9e105e46224fcaa8d52f9ab.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	ef51c68ec438cf1245fbbac8af8a2f38bcbe3cb2f9e105e46224fcaa8d52f9ab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\xer = "C:\\Users\\Admin\\AppData\\Roaming\\333.exe"	ef51c68ec438cf1245fbbac8af8a2f38bcbe3cb2f9e105e46224fcaa8d52f9ab.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	ef51c68ec438cf1245fbbac8af8a2f38bcbe3cb2f9e105e46224fcaa8d52f9ab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\xer = "C:\\Users\\Admin\\AppData\\Roaming\\333.exe"	ef51c68ec438cf1245fbbac8af8a2f38bcbe3cb2f9e105e46224fcaa8d52f9ab.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1948 set thread context of 1000	1948	ef51c68ec438cf1245fbbac8af8a2f38bcbe3cb2f9e105e46224fcaa8d52f9ab.exe	27

Modifies registry key 1 TTPs 4 IoCs

Modify Registry

T1112

pid	Process
392	reg.exe
1404	reg.exe
544	reg.exe
836	reg.exe

Suspicious use of AdjustPrivilegeToken 35 IoCs

description	pid	Process
Token: 1	1000	ef51c68ec438cf1245fbbac8af8a2f38bcbe3cb2f9e105e46224fcaa8d52f9ab.exe
Token: SeCreateTokenPrivilege	1000	ef51c68ec438cf1245fbbac8af8a2f38bcbe3cb2f9e105e46224fcaa8d52f9ab.exe
Token: SeAssignPrimaryTokenPrivilege	1000	ef51c68ec438cf1245fbbac8af8a2f38bcbe3cb2f9e105e46224fcaa8d52f9ab.exe
Token: SeLockMemoryPrivilege	1000	ef51c68ec438cf1245fbbac8af8a2f38bcbe3cb2f9e105e46224fcaa8d52f9ab.exe
Token: SeIncreaseQuotaPrivilege	1000	ef51c68ec438cf1245fbbac8af8a2f38bcbe3cb2f9e105e46224fcaa8d52f9ab.exe
Token: SeMachineAccountPrivilege	1000	ef51c68ec438cf1245fbbac8af8a2f38bcbe3cb2f9e105e46224fcaa8d52f9ab.exe
Token: SeTcbPrivilege	1000	ef51c68ec438cf1245fbbac8af8a2f38bcbe3cb2f9e105e46224fcaa8d52f9ab.exe
Token: SeSecurityPrivilege	1000	ef51c68ec438cf1245fbbac8af8a2f38bcbe3cb2f9e105e46224fcaa8d52f9ab.exe
Token: SeTakeOwnershipPrivilege	1000	ef51c68ec438cf1245fbbac8af8a2f38bcbe3cb2f9e105e46224fcaa8d52f9ab.exe
Token: SeLoadDriverPrivilege	1000	ef51c68ec438cf1245fbbac8af8a2f38bcbe3cb2f9e105e46224fcaa8d52f9ab.exe
Token: SeSystemProfilePrivilege	1000	ef51c68ec438cf1245fbbac8af8a2f38bcbe3cb2f9e105e46224fcaa8d52f9ab.exe
Token: SeSystemtimePrivilege	1000	ef51c68ec438cf1245fbbac8af8a2f38bcbe3cb2f9e105e46224fcaa8d52f9ab.exe
Token: SeProfSingleProcessPrivilege	1000	ef51c68ec438cf1245fbbac8af8a2f38bcbe3cb2f9e105e46224fcaa8d52f9ab.exe
Token: SeIncBasePriorityPrivilege	1000	ef51c68ec438cf1245fbbac8af8a2f38bcbe3cb2f9e105e46224fcaa8d52f9ab.exe
Token: SeCreatePagefilePrivilege	1000	ef51c68ec438cf1245fbbac8af8a2f38bcbe3cb2f9e105e46224fcaa8d52f9ab.exe
Token: SeCreatePermanentPrivilege	1000	ef51c68ec438cf1245fbbac8af8a2f38bcbe3cb2f9e105e46224fcaa8d52f9ab.exe
Token: SeBackupPrivilege	1000	ef51c68ec438cf1245fbbac8af8a2f38bcbe3cb2f9e105e46224fcaa8d52f9ab.exe
Token: SeRestorePrivilege	1000	ef51c68ec438cf1245fbbac8af8a2f38bcbe3cb2f9e105e46224fcaa8d52f9ab.exe
Token: SeShutdownPrivilege	1000	ef51c68ec438cf1245fbbac8af8a2f38bcbe3cb2f9e105e46224fcaa8d52f9ab.exe
Token: SeDebugPrivilege	1000	ef51c68ec438cf1245fbbac8af8a2f38bcbe3cb2f9e105e46224fcaa8d52f9ab.exe
Token: SeAuditPrivilege	1000	ef51c68ec438cf1245fbbac8af8a2f38bcbe3cb2f9e105e46224fcaa8d52f9ab.exe
Token: SeSystemEnvironmentPrivilege	1000	ef51c68ec438cf1245fbbac8af8a2f38bcbe3cb2f9e105e46224fcaa8d52f9ab.exe
Token: SeChangeNotifyPrivilege	1000	ef51c68ec438cf1245fbbac8af8a2f38bcbe3cb2f9e105e46224fcaa8d52f9ab.exe
Token: SeRemoteShutdownPrivilege	1000	ef51c68ec438cf1245fbbac8af8a2f38bcbe3cb2f9e105e46224fcaa8d52f9ab.exe
Token: SeUndockPrivilege	1000	ef51c68ec438cf1245fbbac8af8a2f38bcbe3cb2f9e105e46224fcaa8d52f9ab.exe
Token: SeSyncAgentPrivilege	1000	ef51c68ec438cf1245fbbac8af8a2f38bcbe3cb2f9e105e46224fcaa8d52f9ab.exe
Token: SeEnableDelegationPrivilege	1000	ef51c68ec438cf1245fbbac8af8a2f38bcbe3cb2f9e105e46224fcaa8d52f9ab.exe
Token: SeManageVolumePrivilege	1000	ef51c68ec438cf1245fbbac8af8a2f38bcbe3cb2f9e105e46224fcaa8d52f9ab.exe
Token: SeImpersonatePrivilege	1000	ef51c68ec438cf1245fbbac8af8a2f38bcbe3cb2f9e105e46224fcaa8d52f9ab.exe
Token: SeCreateGlobalPrivilege	1000	ef51c68ec438cf1245fbbac8af8a2f38bcbe3cb2f9e105e46224fcaa8d52f9ab.exe
Token: 31	1000	ef51c68ec438cf1245fbbac8af8a2f38bcbe3cb2f9e105e46224fcaa8d52f9ab.exe
Token: 32	1000	ef51c68ec438cf1245fbbac8af8a2f38bcbe3cb2f9e105e46224fcaa8d52f9ab.exe
Token: 33	1000	ef51c68ec438cf1245fbbac8af8a2f38bcbe3cb2f9e105e46224fcaa8d52f9ab.exe
Token: 34	1000	ef51c68ec438cf1245fbbac8af8a2f38bcbe3cb2f9e105e46224fcaa8d52f9ab.exe
Token: 35	1000	ef51c68ec438cf1245fbbac8af8a2f38bcbe3cb2f9e105e46224fcaa8d52f9ab.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1948	ef51c68ec438cf1245fbbac8af8a2f38bcbe3cb2f9e105e46224fcaa8d52f9ab.exe
1000	ef51c68ec438cf1245fbbac8af8a2f38bcbe3cb2f9e105e46224fcaa8d52f9ab.exe
1000	ef51c68ec438cf1245fbbac8af8a2f38bcbe3cb2f9e105e46224fcaa8d52f9ab.exe
1000	ef51c68ec438cf1245fbbac8af8a2f38bcbe3cb2f9e105e46224fcaa8d52f9ab.exe

Suspicious use of WriteProcessMemory 45 IoCs

description	pid	Process	procid_target
PID 1948 wrote to memory of 1000	1948	ef51c68ec438cf1245fbbac8af8a2f38bcbe3cb2f9e105e46224fcaa8d52f9ab.exe	27
PID 1948 wrote to memory of 1000	1948	ef51c68ec438cf1245fbbac8af8a2f38bcbe3cb2f9e105e46224fcaa8d52f9ab.exe	27
PID 1948 wrote to memory of 1000	1948	ef51c68ec438cf1245fbbac8af8a2f38bcbe3cb2f9e105e46224fcaa8d52f9ab.exe	27
PID 1948 wrote to memory of 1000	1948	ef51c68ec438cf1245fbbac8af8a2f38bcbe3cb2f9e105e46224fcaa8d52f9ab.exe	27
PID 1948 wrote to memory of 1000	1948	ef51c68ec438cf1245fbbac8af8a2f38bcbe3cb2f9e105e46224fcaa8d52f9ab.exe	27
PID 1948 wrote to memory of 1000	1948	ef51c68ec438cf1245fbbac8af8a2f38bcbe3cb2f9e105e46224fcaa8d52f9ab.exe	27
PID 1948 wrote to memory of 1000	1948	ef51c68ec438cf1245fbbac8af8a2f38bcbe3cb2f9e105e46224fcaa8d52f9ab.exe	27
PID 1948 wrote to memory of 1000	1948	ef51c68ec438cf1245fbbac8af8a2f38bcbe3cb2f9e105e46224fcaa8d52f9ab.exe	27
PID 1948 wrote to memory of 1000	1948	ef51c68ec438cf1245fbbac8af8a2f38bcbe3cb2f9e105e46224fcaa8d52f9ab.exe	27
PID 1000 wrote to memory of 2028	1000	ef51c68ec438cf1245fbbac8af8a2f38bcbe3cb2f9e105e46224fcaa8d52f9ab.exe	28
PID 1000 wrote to memory of 2028	1000	ef51c68ec438cf1245fbbac8af8a2f38bcbe3cb2f9e105e46224fcaa8d52f9ab.exe	28
PID 1000 wrote to memory of 2028	1000	ef51c68ec438cf1245fbbac8af8a2f38bcbe3cb2f9e105e46224fcaa8d52f9ab.exe	28
PID 1000 wrote to memory of 2028	1000	ef51c68ec438cf1245fbbac8af8a2f38bcbe3cb2f9e105e46224fcaa8d52f9ab.exe	28
PID 1000 wrote to memory of 1376	1000	ef51c68ec438cf1245fbbac8af8a2f38bcbe3cb2f9e105e46224fcaa8d52f9ab.exe	29
PID 1000 wrote to memory of 1376	1000	ef51c68ec438cf1245fbbac8af8a2f38bcbe3cb2f9e105e46224fcaa8d52f9ab.exe	29
PID 1000 wrote to memory of 1376	1000	ef51c68ec438cf1245fbbac8af8a2f38bcbe3cb2f9e105e46224fcaa8d52f9ab.exe	29
PID 1000 wrote to memory of 1376	1000	ef51c68ec438cf1245fbbac8af8a2f38bcbe3cb2f9e105e46224fcaa8d52f9ab.exe	29
PID 1000 wrote to memory of 1700	1000	ef51c68ec438cf1245fbbac8af8a2f38bcbe3cb2f9e105e46224fcaa8d52f9ab.exe	30
PID 1000 wrote to memory of 1700	1000	ef51c68ec438cf1245fbbac8af8a2f38bcbe3cb2f9e105e46224fcaa8d52f9ab.exe	30
PID 1000 wrote to memory of 1700	1000	ef51c68ec438cf1245fbbac8af8a2f38bcbe3cb2f9e105e46224fcaa8d52f9ab.exe	30
PID 1000 wrote to memory of 1700	1000	ef51c68ec438cf1245fbbac8af8a2f38bcbe3cb2f9e105e46224fcaa8d52f9ab.exe	30
PID 1000 wrote to memory of 1080	1000	ef51c68ec438cf1245fbbac8af8a2f38bcbe3cb2f9e105e46224fcaa8d52f9ab.exe	33
PID 1000 wrote to memory of 1080	1000	ef51c68ec438cf1245fbbac8af8a2f38bcbe3cb2f9e105e46224fcaa8d52f9ab.exe	33
PID 1000 wrote to memory of 1080	1000	ef51c68ec438cf1245fbbac8af8a2f38bcbe3cb2f9e105e46224fcaa8d52f9ab.exe	33
PID 1000 wrote to memory of 1080	1000	ef51c68ec438cf1245fbbac8af8a2f38bcbe3cb2f9e105e46224fcaa8d52f9ab.exe	33
PID 1376 wrote to memory of 544	1376	cmd.exe	35
PID 1376 wrote to memory of 544	1376	cmd.exe	35
PID 1376 wrote to memory of 544	1376	cmd.exe	35
PID 1376 wrote to memory of 544	1376	cmd.exe	35
PID 1000 wrote to memory of 1412	1000	ef51c68ec438cf1245fbbac8af8a2f38bcbe3cb2f9e105e46224fcaa8d52f9ab.exe	34
PID 1000 wrote to memory of 1412	1000	ef51c68ec438cf1245fbbac8af8a2f38bcbe3cb2f9e105e46224fcaa8d52f9ab.exe	34
PID 1000 wrote to memory of 1412	1000	ef51c68ec438cf1245fbbac8af8a2f38bcbe3cb2f9e105e46224fcaa8d52f9ab.exe	34
PID 1000 wrote to memory of 1412	1000	ef51c68ec438cf1245fbbac8af8a2f38bcbe3cb2f9e105e46224fcaa8d52f9ab.exe	34
PID 1700 wrote to memory of 836	1700	cmd.exe	38
PID 1700 wrote to memory of 836	1700	cmd.exe	38
PID 1700 wrote to memory of 836	1700	cmd.exe	38
PID 1700 wrote to memory of 836	1700	cmd.exe	38
PID 1080 wrote to memory of 392	1080	cmd.exe	39
PID 1080 wrote to memory of 392	1080	cmd.exe	39
PID 1080 wrote to memory of 392	1080	cmd.exe	39
PID 1080 wrote to memory of 392	1080	cmd.exe	39
PID 1412 wrote to memory of 1404	1412	cmd.exe	40
PID 1412 wrote to memory of 1404	1412	cmd.exe	40
PID 1412 wrote to memory of 1404	1412	cmd.exe	40
PID 1412 wrote to memory of 1404	1412	cmd.exe	40

C:\Users\Admin\AppData\Local\Temp\ef51c68ec438cf1245fbbac8af8a2f38bcbe3cb2f9e105e46224fcaa8d52f9ab.exe
"C:\Users\Admin\AppData\Local\Temp\ef51c68ec438cf1245fbbac8af8a2f38bcbe3cb2f9e105e46224fcaa8d52f9ab.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1948
- C:\Users\Admin\AppData\Local\Temp\ef51c68ec438cf1245fbbac8af8a2f38bcbe3cb2f9e105e46224fcaa8d52f9ab.exe
  C:\Users\Admin\AppData\Local\Temp\ef51c68ec438cf1245fbbac8af8a2f38bcbe3cb2f9e105e46224fcaa8d52f9ab.exe
  2⤵
  - Adds policy Run key to start application
  - Modifies Installed Components in the registry
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1000
- - C:\Users\Admin\AppData\Local\Temp\Y2TZ9BXMTH41.exe
    C:\Users\Admin\AppData\Local\Temp\Y2TZ9BXMTH41.exe
    3⤵
    - Executes dropped EXE
    - Checks computer location settings
    PID:2028
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1376
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
      4⤵
      Modifies firewall policy service
      Modifies registry key
      PID:544
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\ef51c68ec438cf1245fbbac8af8a2f38bcbe3cb2f9e105e46224fcaa8d52f9ab.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\ef51c68ec438cf1245fbbac8af8a2f38bcbe3cb2f9e105e46224fcaa8d52f9ab.exe:*:Enabled:Windows Messanger" /f
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1700
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\ef51c68ec438cf1245fbbac8af8a2f38bcbe3cb2f9e105e46224fcaa8d52f9ab.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\ef51c68ec438cf1245fbbac8af8a2f38bcbe3cb2f9e105e46224fcaa8d52f9ab.exe:*:Enabled:Windows Messanger" /f
      4⤵
      Modifies firewall policy service
      Modifies registry key
      PID:836
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1080
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
      4⤵
      Modifies firewall policy service
      Modifies registry key
      PID:392
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\333.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\333.exe:*:Enabled:Windows Messanger" /f
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1412
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\333.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\333.exe:*:Enabled:Windows Messanger" /f
      4⤵
      Modifies firewall policy service
      Modifies registry key
      PID:1404

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Y2TZ9BXMTH41.exe

Filesize
84KB

MD5
41df87cc97cd4727e5fe266c6c06e10d

SHA1
0bbfe2506656fe8ebd432c3721758207f36fa0fd

SHA256
19f8797dc1c69909d8d0fb563d13e955dc98a1d22fdf8b2c551731323d672505

SHA512
7d67b3c11317386971463919e6f8ab479c6b62cd8017a13bbe65acaf8d8fc09ee186d6cde9d3af58e25b4d22f3f94b25f5bca230062bed67d13b8b21d648d191

Download Submit
\Users\Admin\AppData\Local\Temp\Y2TZ9BXMTH41.exe

Filesize
84KB

MD5
41df87cc97cd4727e5fe266c6c06e10d

SHA1
0bbfe2506656fe8ebd432c3721758207f36fa0fd

SHA256
19f8797dc1c69909d8d0fb563d13e955dc98a1d22fdf8b2c551731323d672505

SHA512
7d67b3c11317386971463919e6f8ab479c6b62cd8017a13bbe65acaf8d8fc09ee186d6cde9d3af58e25b4d22f3f94b25f5bca230062bed67d13b8b21d648d191

Download Submit
memory/392-79-0x0000000000000000-mapping.dmp

Download
memory/544-76-0x0000000000000000-mapping.dmp

Download
memory/836-78-0x0000000000000000-mapping.dmp

Download
memory/1000-71-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/1000-67-0x0000000076871000-0x0000000076873000-memory.dmp

Filesize
8KB

Download
memory/1000-63-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/1000-81-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/1000-62-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/1000-58-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/1000-59-0x000000000045BCD0-mapping.dmp

Download
memory/1080-75-0x0000000000000000-mapping.dmp

Download
memory/1376-73-0x0000000000000000-mapping.dmp

Download
memory/1404-80-0x0000000000000000-mapping.dmp

Download
memory/1412-77-0x0000000000000000-mapping.dmp

Download
memory/1700-74-0x0000000000000000-mapping.dmp

Download
memory/1948-61-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1948-56-0x0000000002D90000-0x0000000002EE3000-memory.dmp

Filesize
1.3MB

Download
memory/2028-69-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads