ed1b6a5ae962586d9edc242ffa71fa3d02f6cbbfbafda2d0f221e0fd8fa258bd

Analysis

max time kernel
46s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
04/12/2022, 12:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ed1b6a5ae962586d9edc242ffa71fa3d02f6cbbfbafda2d0f221e0fd8fa258bd.exe
Size

791KB
MD5

63d1eee88fd628d4671419c323b9e77a
SHA1

2849c45484492839c4c114ec9b0e96db88a12d72
SHA256

ed1b6a5ae962586d9edc242ffa71fa3d02f6cbbfbafda2d0f221e0fd8fa258bd
SHA512

57afcf5bc6cb28d51f15e259fcd19d5adf98c81b1703ab0d84370d604dd8719701f8b69c0b3d0684daed9cfbbee93ef03e01fd48118df8654e5047332104fa5a
SSDEEP

12288:END7cWU6wDL+En5wSYcy+7shhPTQ1S3qy+GKBmHJ5hyrJL2jrmQYWcoep58Xb/7W:END7B6ubhGkZKBmHTrHYWcRIs74w

Score

5^/10

Malware Config

Signatures

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\MSVBVM60.DLL	ed1b6a5ae962586d9edc242ffa71fa3d02f6cbbfbafda2d0f221e0fd8fa258bd.exe
File created	C:\Windows\SysWOW64\MSVBVM60.DLL	ed1b6a5ae962586d9edc242ffa71fa3d02f6cbbfbafda2d0f221e0fd8fa258bd.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 732 set thread context of 936	732	ed1b6a5ae962586d9edc242ffa71fa3d02f6cbbfbafda2d0f221e0fd8fa258bd.exe	27
PID 732 set thread context of 0	732	ed1b6a5ae962586d9edc242ffa71fa3d02f6cbbfbafda2d0f221e0fd8fa258bd.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{45046D60-08CA-11CF-A90F-00AA0062BB4C}\ProxyStubClsid32	ed1b6a5ae962586d9edc242ffa71fa3d02f6cbbfbafda2d0f221e0fd8fa258bd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7500A6BA-EB65-11D1-938D-0000F87557C9}\TypeLib	ed1b6a5ae962586d9edc242ffa71fa3d02f6cbbfbafda2d0f221e0fd8fa258bd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{83C49FF0-B294-11D0-9488-00A0C91110ED}\TypeLib\ = "{EA544A21-C82D-11D1-A3E4-00A0C90AEA82}"	ed1b6a5ae962586d9edc242ffa71fa3d02f6cbbfbafda2d0f221e0fd8fa258bd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EB41E8C1-4442-11D1-8906-00A0C9110049}\TypeLib	ed1b6a5ae962586d9edc242ffa71fa3d02f6cbbfbafda2d0f221e0fd8fa258bd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EB41E8C1-4442-11D1-8906-00A0C9110049}\TypeLib\ = "{EA544A21-C82D-11D1-A3E4-00A0C90AEA82}"	ed1b6a5ae962586d9edc242ffa71fa3d02f6cbbfbafda2d0f221e0fd8fa258bd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EB41E8C2-4442-11D1-8906-00A0C9110049}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	ed1b6a5ae962586d9edc242ffa71fa3d02f6cbbfbafda2d0f221e0fd8fa258bd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A4C466B8-499F-101B-BB78-00AA00383CBB}\TypeLib\ = "{000204EF-0000-0000-C000-000000000046}"	ed1b6a5ae962586d9edc242ffa71fa3d02f6cbbfbafda2d0f221e0fd8fa258bd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{45046D60-08CA-11CF-A90F-00AA0062BB4C}\ = "PropertyBag_VB5"	ed1b6a5ae962586d9edc242ffa71fa3d02f6cbbfbafda2d0f221e0fd8fa258bd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4495AD01-C993-11D1-A3E4-00A0C90AEA82}\TypeLib\ = "{EA544A21-C82D-11D1-A3E4-00A0C90AEA82}"	ed1b6a5ae962586d9edc242ffa71fa3d02f6cbbfbafda2d0f221e0fd8fa258bd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C4D651F2-7697-11D1-A1E9-00A0C90F2731}\TypeLib\Version = "6.0"	ed1b6a5ae962586d9edc242ffa71fa3d02f6cbbfbafda2d0f221e0fd8fa258bd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FCFB3D2B-A0FA-1068-A738-08002B3371B5}	ed1b6a5ae962586d9edc242ffa71fa3d02f6cbbfbafda2d0f221e0fd8fa258bd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A4C46780-499F-101B-BB78-00AA00383CBB}\TypeLib\ = "{000204EF-0000-0000-C000-000000000046}"	ed1b6a5ae962586d9edc242ffa71fa3d02f6cbbfbafda2d0f221e0fd8fa258bd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B28FA150-0FF0-11CF-A911-00AA0062BB4C}\ = "AmbientProperties"	ed1b6a5ae962586d9edc242ffa71fa3d02f6cbbfbafda2d0f221e0fd8fa258bd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2CE46480-1A08-11CF-AD63-00AA00614F3E}\TypeLib\ = "{EA544A21-C82D-11D1-A3E4-00A0C90AEA82}"	ed1b6a5ae962586d9edc242ffa71fa3d02f6cbbfbafda2d0f221e0fd8fa258bd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C4D651F0-7697-11D1-A1E9-00A0C90F2731}\TypeLib	ed1b6a5ae962586d9edc242ffa71fa3d02f6cbbfbafda2d0f221e0fd8fa258bd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C4D651F1-7697-11D1-A1E9-00A0C90F2731}\TypeLib\ = "{EA544A21-C82D-11D1-A3E4-00A0C90AEA82}"	ed1b6a5ae962586d9edc242ffa71fa3d02f6cbbfbafda2d0f221e0fd8fa258bd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EB41E8C3-4442-11D1-8906-00A0C9110049}\ = "_DDataBoundAndDataSourceClass"	ed1b6a5ae962586d9edc242ffa71fa3d02f6cbbfbafda2d0f221e0fd8fa258bd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A4C466B8-499F-101B-BB78-00AA00383CBB}\TypeLib	ed1b6a5ae962586d9edc242ffa71fa3d02f6cbbfbafda2d0f221e0fd8fa258bd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7500A6BA-EB65-11D1-938D-0000F87557C9}\ProxyStubClsid32	ed1b6a5ae962586d9edc242ffa71fa3d02f6cbbfbafda2d0f221e0fd8fa258bd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CBB76011-C508-11D1-A3E3-00A0C90AEA82}\TypeLib\Version = "6.0"	ed1b6a5ae962586d9edc242ffa71fa3d02f6cbbfbafda2d0f221e0fd8fa258bd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E43FD401-8715-11D1-98E7-00A0C9702442}\ = "IVbeRuntimeHost"	ed1b6a5ae962586d9edc242ffa71fa3d02f6cbbfbafda2d0f221e0fd8fa258bd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A4C466B8-499F-101B-BB78-00AA00383CBB}\TypeLib\Version = "6.0"	ed1b6a5ae962586d9edc242ffa71fa3d02f6cbbfbafda2d0f221e0fd8fa258bd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{45046D60-08CA-11CF-A90F-00AA0062BB4C}\TypeLib	ed1b6a5ae962586d9edc242ffa71fa3d02f6cbbfbafda2d0f221e0fd8fa258bd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2CE46480-1A08-11CF-AD63-00AA00614F3E}\ProxyStubClsid32	ed1b6a5ae962586d9edc242ffa71fa3d02f6cbbfbafda2d0f221e0fd8fa258bd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C4D651F2-7697-11D1-A1E9-00A0C90F2731}\ = "EventInfo"	ed1b6a5ae962586d9edc242ffa71fa3d02f6cbbfbafda2d0f221e0fd8fa258bd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{14E469E0-BF61-11CF-8385-8F69D8F1350B}\TypeLib	ed1b6a5ae962586d9edc242ffa71fa3d02f6cbbfbafda2d0f221e0fd8fa258bd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EB41E8C1-4442-11D1-8906-00A0C9110049}	ed1b6a5ae962586d9edc242ffa71fa3d02f6cbbfbafda2d0f221e0fd8fa258bd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EB41E8C4-4442-11D1-8906-00A0C9110049}\TypeLib	ed1b6a5ae962586d9edc242ffa71fa3d02f6cbbfbafda2d0f221e0fd8fa258bd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E43FD401-8715-11D1-98E7-00A0C9702442}\ProxyStubClsid32	ed1b6a5ae962586d9edc242ffa71fa3d02f6cbbfbafda2d0f221e0fd8fa258bd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C4D651F0-7697-11D1-A1E9-00A0C90F2731}\ = "EventParameter"	ed1b6a5ae962586d9edc242ffa71fa3d02f6cbbfbafda2d0f221e0fd8fa258bd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{A4C466B8-499F-101B-BB78-00AA00383CBB}\TypeLib\Version = "6.0"	ed1b6a5ae962586d9edc242ffa71fa3d02f6cbbfbafda2d0f221e0fd8fa258bd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A4C466B8-499F-101B-BB78-00AA00383CBB}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	ed1b6a5ae962586d9edc242ffa71fa3d02f6cbbfbafda2d0f221e0fd8fa258bd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4495AD01-C993-11D1-A3E4-00A0C90AEA82}\TypeLib	ed1b6a5ae962586d9edc242ffa71fa3d02f6cbbfbafda2d0f221e0fd8fa258bd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{41A7D761-6018-11CF-9016-00AA0068841E}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	ed1b6a5ae962586d9edc242ffa71fa3d02f6cbbfbafda2d0f221e0fd8fa258bd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{41A7D760-6018-11CF-9016-00AA0068841E}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	ed1b6a5ae962586d9edc242ffa71fa3d02f6cbbfbafda2d0f221e0fd8fa258bd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C0324960-2AAA-11CF-AD67-00AA00614F3E}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	ed1b6a5ae962586d9edc242ffa71fa3d02f6cbbfbafda2d0f221e0fd8fa258bd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C0324960-2AAA-11CF-AD67-00AA00614F3E}\TypeLib\ = "{EA544A21-C82D-11D1-A3E4-00A0C90AEA82}"	ed1b6a5ae962586d9edc242ffa71fa3d02f6cbbfbafda2d0f221e0fd8fa258bd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D4E0F020-720A-11CF-8136-00AA00C14959}	ed1b6a5ae962586d9edc242ffa71fa3d02f6cbbfbafda2d0f221e0fd8fa258bd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D4E0F020-720A-11CF-8136-00AA00C14959}\TypeLib	ed1b6a5ae962586d9edc242ffa71fa3d02f6cbbfbafda2d0f221e0fd8fa258bd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{888A5A60-B283-11CF-8AD5-00A0C90AEA82}\ProxyStubClsid32	ed1b6a5ae962586d9edc242ffa71fa3d02f6cbbfbafda2d0f221e0fd8fa258bd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EB41E8C2-4442-11D1-8906-00A0C9110049}\ = "_DDataSourceClass"	ed1b6a5ae962586d9edc242ffa71fa3d02f6cbbfbafda2d0f221e0fd8fa258bd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EB41E8C2-4442-11D1-8906-00A0C9110049}\ProxyStubClsid32	ed1b6a5ae962586d9edc242ffa71fa3d02f6cbbfbafda2d0f221e0fd8fa258bd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EB41E8C5-4442-11D1-8906-00A0C9110049}\TypeLib	ed1b6a5ae962586d9edc242ffa71fa3d02f6cbbfbafda2d0f221e0fd8fa258bd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8284B8A2-A8A8-11D1-A3D2-00A0C90AEA82}\TypeLib\Version = "6.0"	ed1b6a5ae962586d9edc242ffa71fa3d02f6cbbfbafda2d0f221e0fd8fa258bd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{41A7D760-6018-11CF-9016-00AA0068841E}\TypeLib\ = "{EA544A21-C82D-11D1-A3E4-00A0C90AEA82}"	ed1b6a5ae962586d9edc242ffa71fa3d02f6cbbfbafda2d0f221e0fd8fa258bd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B28FA150-0FF0-11CF-A911-00AA0062BB4C}\TypeLib\ = "{EA544A21-C82D-11D1-A3E4-00A0C90AEA82}"	ed1b6a5ae962586d9edc242ffa71fa3d02f6cbbfbafda2d0f221e0fd8fa258bd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BE8F9800-2AAA-11CF-AD67-00AA00614F3E}\TypeLib	ed1b6a5ae962586d9edc242ffa71fa3d02f6cbbfbafda2d0f221e0fd8fa258bd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C4D651F2-7697-11D1-A1E9-00A0C90F2731}\TypeLib\ = "{EA544A21-C82D-11D1-A3E4-00A0C90AEA82}"	ed1b6a5ae962586d9edc242ffa71fa3d02f6cbbfbafda2d0f221e0fd8fa258bd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CBB76011-C508-11D1-A3E3-00A0C90AEA82}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	ed1b6a5ae962586d9edc242ffa71fa3d02f6cbbfbafda2d0f221e0fd8fa258bd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EB41E8C3-4442-11D1-8906-00A0C9110049}\TypeLib\Version = "6.0"	ed1b6a5ae962586d9edc242ffa71fa3d02f6cbbfbafda2d0f221e0fd8fa258bd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8284B8A2-A8A8-11D1-A3D2-00A0C90AEA82}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	ed1b6a5ae962586d9edc242ffa71fa3d02f6cbbfbafda2d0f221e0fd8fa258bd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{737361EC-467F-11D1-810F-0000F87557AA}	ed1b6a5ae962586d9edc242ffa71fa3d02f6cbbfbafda2d0f221e0fd8fa258bd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{45046D60-08CA-11CF-A90F-00AA0062BB4C}	ed1b6a5ae962586d9edc242ffa71fa3d02f6cbbfbafda2d0f221e0fd8fa258bd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{41A7D761-6018-11CF-9016-00AA0068841E}\ = "DataObjectFiles"	ed1b6a5ae962586d9edc242ffa71fa3d02f6cbbfbafda2d0f221e0fd8fa258bd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{41A7D761-6018-11CF-9016-00AA0068841E}\TypeLib\ = "{EA544A21-C82D-11D1-A3E4-00A0C90AEA82}"	ed1b6a5ae962586d9edc242ffa71fa3d02f6cbbfbafda2d0f221e0fd8fa258bd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2CE46480-1A08-11CF-AD63-00AA00614F3E}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	ed1b6a5ae962586d9edc242ffa71fa3d02f6cbbfbafda2d0f221e0fd8fa258bd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{888A5A60-B283-11CF-8AD5-00A0C90AEA82}	ed1b6a5ae962586d9edc242ffa71fa3d02f6cbbfbafda2d0f221e0fd8fa258bd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EB41E8C5-4442-11D1-8906-00A0C9110049}\ = "_DPersistableDataSourceClass"	ed1b6a5ae962586d9edc242ffa71fa3d02f6cbbfbafda2d0f221e0fd8fa258bd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EB41E8C5-4442-11D1-8906-00A0C9110049}\TypeLib\ = "{EA544A21-C82D-11D1-A3E4-00A0C90AEA82}"	ed1b6a5ae962586d9edc242ffa71fa3d02f6cbbfbafda2d0f221e0fd8fa258bd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C4D651F0-7697-11D1-A1E9-00A0C90F2731}\ProxyStubClsid32	ed1b6a5ae962586d9edc242ffa71fa3d02f6cbbfbafda2d0f221e0fd8fa258bd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{83C49FF0-B294-11D0-9488-00A0C91110ED}\ = "DataMembers"	ed1b6a5ae962586d9edc242ffa71fa3d02f6cbbfbafda2d0f221e0fd8fa258bd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EB41E8C1-4442-11D1-8906-00A0C9110049}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	ed1b6a5ae962586d9edc242ffa71fa3d02f6cbbfbafda2d0f221e0fd8fa258bd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EB41E8C1-4442-11D1-8906-00A0C9110049}\TypeLib\Version = "6.0"	ed1b6a5ae962586d9edc242ffa71fa3d02f6cbbfbafda2d0f221e0fd8fa258bd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A4C466B8-499F-101B-BB78-00AA00383CBB}	ed1b6a5ae962586d9edc242ffa71fa3d02f6cbbfbafda2d0f221e0fd8fa258bd.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
936	ed1b6a5ae962586d9edc242ffa71fa3d02f6cbbfbafda2d0f221e0fd8fa258bd.exe
936	ed1b6a5ae962586d9edc242ffa71fa3d02f6cbbfbafda2d0f221e0fd8fa258bd.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
732	ed1b6a5ae962586d9edc242ffa71fa3d02f6cbbfbafda2d0f221e0fd8fa258bd.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 732 wrote to memory of 936	732	ed1b6a5ae962586d9edc242ffa71fa3d02f6cbbfbafda2d0f221e0fd8fa258bd.exe	27
PID 732 wrote to memory of 936	732	ed1b6a5ae962586d9edc242ffa71fa3d02f6cbbfbafda2d0f221e0fd8fa258bd.exe	27
PID 732 wrote to memory of 936	732	ed1b6a5ae962586d9edc242ffa71fa3d02f6cbbfbafda2d0f221e0fd8fa258bd.exe	27
PID 732 wrote to memory of 936	732	ed1b6a5ae962586d9edc242ffa71fa3d02f6cbbfbafda2d0f221e0fd8fa258bd.exe	27
PID 732 wrote to memory of 936	732	ed1b6a5ae962586d9edc242ffa71fa3d02f6cbbfbafda2d0f221e0fd8fa258bd.exe	27
PID 732 wrote to memory of 936	732	ed1b6a5ae962586d9edc242ffa71fa3d02f6cbbfbafda2d0f221e0fd8fa258bd.exe	27
PID 732 wrote to memory of 936	732	ed1b6a5ae962586d9edc242ffa71fa3d02f6cbbfbafda2d0f221e0fd8fa258bd.exe	27
PID 732 wrote to memory of 936	732	ed1b6a5ae962586d9edc242ffa71fa3d02f6cbbfbafda2d0f221e0fd8fa258bd.exe	27
PID 732 wrote to memory of 0	732	ed1b6a5ae962586d9edc242ffa71fa3d02f6cbbfbafda2d0f221e0fd8fa258bd.exe
PID 732 wrote to memory of 0	732	ed1b6a5ae962586d9edc242ffa71fa3d02f6cbbfbafda2d0f221e0fd8fa258bd.exe
PID 732 wrote to memory of 0	732	ed1b6a5ae962586d9edc242ffa71fa3d02f6cbbfbafda2d0f221e0fd8fa258bd.exe
PID 732 wrote to memory of 0	732	ed1b6a5ae962586d9edc242ffa71fa3d02f6cbbfbafda2d0f221e0fd8fa258bd.exe
PID 936 wrote to memory of 1412	936	ed1b6a5ae962586d9edc242ffa71fa3d02f6cbbfbafda2d0f221e0fd8fa258bd.exe	14
PID 936 wrote to memory of 1412	936	ed1b6a5ae962586d9edc242ffa71fa3d02f6cbbfbafda2d0f221e0fd8fa258bd.exe	14
PID 936 wrote to memory of 1412	936	ed1b6a5ae962586d9edc242ffa71fa3d02f6cbbfbafda2d0f221e0fd8fa258bd.exe	14
PID 936 wrote to memory of 1412	936	ed1b6a5ae962586d9edc242ffa71fa3d02f6cbbfbafda2d0f221e0fd8fa258bd.exe	14

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1412
- C:\Users\Admin\AppData\Local\Temp\ed1b6a5ae962586d9edc242ffa71fa3d02f6cbbfbafda2d0f221e0fd8fa258bd.exe
  "C:\Users\Admin\AppData\Local\Temp\ed1b6a5ae962586d9edc242ffa71fa3d02f6cbbfbafda2d0f221e0fd8fa258bd.exe"
  2⤵
  - Drops file in System32 directory
  - Suspicious use of SetThreadContext
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:732
- - C:\Users\Admin\AppData\Local\Temp\ed1b6a5ae962586d9edc242ffa71fa3d02f6cbbfbafda2d0f221e0fd8fa258bd.exe
    "C:\Users\Admin\AppData\Local\Temp\ed1b6a5ae962586d9edc242ffa71fa3d02f6cbbfbafda2d0f221e0fd8fa258bd.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:936

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/0-59-0x0000000000400000-0x0000000000408960-memory.dmp

Filesize
34KB

Download
memory/732-60-0x0000000000400000-0x00000000004FD000-memory.dmp

Filesize
1012KB

Download
memory/936-56-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/936-61-0x0000000000400000-0x0000000000408960-memory.dmp

Filesize
34KB

Download
memory/936-62-0x0000000075091000-0x0000000075093000-memory.dmp

Filesize
8KB

Download
memory/936-66-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/1412-63-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download