Analysis
-
max time kernel
150s -
max time network
142s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
04-12-2022 15:49
Static task
static1
Behavioral task
behavioral1
Sample
d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe
Resource
win7-20220901-en
General
-
Target
d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe
-
Size
2.9MB
-
MD5
c42a9c4d0e651f8ca5ed6d5cffdc3c90
-
SHA1
a8919a39c58d447596bcea5c3ffa29a72559d26b
-
SHA256
d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb
-
SHA512
baa0bb7f1f29f052e07f0b25351ee3e5fe7f704a4b0d9b0d241c13831b436278b8412520311cdb653e131c48f135a847b1554dc6a9e6afd463255623b136e015
-
SSDEEP
49152:YHyuG9rIlVn9AJGNkXcuQPYu4PFIuS6Ez8D36y1d5GC1feWhkBlBFGYpvK:YHGhIlV9AJGngnPOX8+y1d5GAfewkPGR
Malware Config
Extracted
cybergate
2.7 Final
victima
sizehacker.no-ip.org:1337
***Drakonez***
-
enable_keylogger
true
-
enable_message_box
true
-
ftp_directory
./logs/
-
ftp_interval
30
-
injected_process
explorer.exe
-
install_dir
win32
-
install_file
Frost.exe
-
install_flag
true
-
keylogger_enable_ftp
false
-
message_box_caption
texto da mensagem
-
message_box_title
tÃtulo da mensagem
-
password
abcd
-
regkey_hkcu
HKCU
-
regkey_hklm
HKLM
Signatures
-
Adds policy Run key to start application 2 TTPs 4 IoCs
Processes:
d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\win32\\Frost.exe" d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\win32\\Frost.exe" d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe -
Executes dropped EXE 4 IoCs
Processes:
SpyNet.exeSpyNet.exeFrost.exeFrost.exepid process 4316 SpyNet.exe 4352 SpyNet.exe 4392 Frost.exe 4424 Frost.exe -
Modifies Installed Components in the registry 2 TTPs 4 IoCs
Processes:
d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exeexplorer.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{XTHJF30T-T8PL-4E4D-7VGC-4L6R7PF63C1O} d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{XTHJF30T-T8PL-4E4D-7VGC-4L6R7PF63C1O}\StubPath = "C:\\Windows\\system32\\win32\\Frost.exe Restart" d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{XTHJF30T-T8PL-4E4D-7VGC-4L6R7PF63C1O} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{XTHJF30T-T8PL-4E4D-7VGC-4L6R7PF63C1O}\StubPath = "C:\\Windows\\system32\\win32\\Frost.exe" explorer.exe -
Processes:
resource yara_rule behavioral1/memory/1688-56-0x0000000000400000-0x000000000071F000-memory.dmp upx behavioral1/memory/1688-60-0x0000000000400000-0x000000000071F000-memory.dmp upx behavioral1/memory/1688-61-0x0000000000400000-0x000000000071F000-memory.dmp upx behavioral1/memory/1688-62-0x0000000000400000-0x000000000071F000-memory.dmp upx behavioral1/memory/1688-104-0x0000000000400000-0x000000000071F000-memory.dmp upx \Users\Admin\AppData\Local\Temp\IXP000.TMP\SpyNet.exe upx \Users\Admin\AppData\Local\Temp\IXP000.TMP\SpyNet.exe upx C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SpyNet.exe upx behavioral1/memory/4316-112-0x0000000002660000-0x0000000002BB7000-memory.dmp upx behavioral1/memory/4352-128-0x0000000000400000-0x0000000000957000-memory.dmp upx behavioral1/memory/4424-129-0x0000000000400000-0x000000000071F000-memory.dmp upx behavioral1/memory/4424-130-0x0000000000400000-0x000000000071F000-memory.dmp upx behavioral1/memory/4424-131-0x0000000000400000-0x000000000071F000-memory.dmp upx behavioral1/memory/4424-132-0x0000000000400000-0x000000000071F000-memory.dmp upx behavioral1/memory/4424-137-0x0000000000400000-0x000000000071F000-memory.dmp upx behavioral1/memory/4352-141-0x0000000000400000-0x0000000000957000-memory.dmp upx -
Loads dropped DLL 6 IoCs
Processes:
d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exeSpyNet.exepid process 2908 d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe 2908 d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe 4316 SpyNet.exe 4316 SpyNet.exe 2908 d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe 2908 d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe -
Adds Run key to start application 2 TTPs 6 IoCs
Processes:
SpyNet.exed0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce SpyNet.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" SpyNet.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\system32\\win32\\Frost.exe" d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\system32\\win32\\Frost.exe" d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe -
Drops file in System32 directory 5 IoCs
Processes:
d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exed0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exeFrost.exedescription ioc process File created C:\Windows\SysWOW64\win32\Frost.exe d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe File opened for modification C:\Windows\SysWOW64\win32\Frost.exe d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe File opened for modification C:\Windows\SysWOW64\win32\Frost.exe d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe File opened for modification C:\Windows\SysWOW64\win32\ d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe File opened for modification C:\Windows\SysWOW64\win32\Frost.exe Frost.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exeFrost.exedescription pid process target process PID 1492 set thread context of 1688 1492 d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe PID 4392 set thread context of 4424 4392 Frost.exe Frost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
SpyNet.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 SpyNet.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString SpyNet.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exepid process 2908 d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exedescription pid process Token: SeDebugPrivilege 2908 d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe Token: SeDebugPrivilege 2908 d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe -
Suspicious use of FindShellTrayWindow 7 IoCs
Processes:
d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exeSpyNet.exepid process 1688 d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe 4352 SpyNet.exe 4352 SpyNet.exe 4352 SpyNet.exe 4352 SpyNet.exe 4352 SpyNet.exe 4352 SpyNet.exe -
Suspicious use of SendNotifyMessage 6 IoCs
Processes:
SpyNet.exepid process 4352 SpyNet.exe 4352 SpyNet.exe 4352 SpyNet.exe 4352 SpyNet.exe 4352 SpyNet.exe 4352 SpyNet.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exeFrost.exepid process 1492 d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe 4392 Frost.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exed0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exedescription pid process target process PID 1492 wrote to memory of 1688 1492 d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe PID 1492 wrote to memory of 1688 1492 d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe PID 1492 wrote to memory of 1688 1492 d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe PID 1492 wrote to memory of 1688 1492 d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe PID 1492 wrote to memory of 1688 1492 d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe PID 1492 wrote to memory of 1688 1492 d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe PID 1492 wrote to memory of 1688 1492 d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe PID 1492 wrote to memory of 1688 1492 d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe PID 1492 wrote to memory of 1688 1492 d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe PID 1688 wrote to memory of 1424 1688 d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe Explorer.EXE PID 1688 wrote to memory of 1424 1688 d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe Explorer.EXE PID 1688 wrote to memory of 1424 1688 d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe Explorer.EXE PID 1688 wrote to memory of 1424 1688 d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe Explorer.EXE PID 1688 wrote to memory of 1424 1688 d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe Explorer.EXE PID 1688 wrote to memory of 1424 1688 d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe Explorer.EXE PID 1688 wrote to memory of 1424 1688 d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe Explorer.EXE PID 1688 wrote to memory of 1424 1688 d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe Explorer.EXE PID 1688 wrote to memory of 1424 1688 d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe Explorer.EXE PID 1688 wrote to memory of 1424 1688 d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe Explorer.EXE PID 1688 wrote to memory of 1424 1688 d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe Explorer.EXE PID 1688 wrote to memory of 1424 1688 d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe Explorer.EXE PID 1688 wrote to memory of 1424 1688 d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe Explorer.EXE PID 1688 wrote to memory of 1424 1688 d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe Explorer.EXE PID 1688 wrote to memory of 1424 1688 d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe Explorer.EXE PID 1688 wrote to memory of 1424 1688 d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe Explorer.EXE PID 1688 wrote to memory of 1424 1688 d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe Explorer.EXE PID 1688 wrote to memory of 1424 1688 d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe Explorer.EXE PID 1688 wrote to memory of 1424 1688 d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe Explorer.EXE PID 1688 wrote to memory of 1424 1688 d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe Explorer.EXE PID 1688 wrote to memory of 1424 1688 d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe Explorer.EXE PID 1688 wrote to memory of 1424 1688 d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe Explorer.EXE PID 1688 wrote to memory of 1424 1688 d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe Explorer.EXE PID 1688 wrote to memory of 1424 1688 d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe Explorer.EXE PID 1688 wrote to memory of 1424 1688 d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe Explorer.EXE PID 1688 wrote to memory of 1424 1688 d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe Explorer.EXE PID 1688 wrote to memory of 1424 1688 d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe Explorer.EXE PID 1688 wrote to memory of 1424 1688 d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe Explorer.EXE PID 1688 wrote to memory of 1424 1688 d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe Explorer.EXE PID 1688 wrote to memory of 1424 1688 d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe Explorer.EXE PID 1688 wrote to memory of 1424 1688 d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe Explorer.EXE PID 1688 wrote to memory of 1424 1688 d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe Explorer.EXE PID 1688 wrote to memory of 1424 1688 d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe Explorer.EXE PID 1688 wrote to memory of 1424 1688 d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe Explorer.EXE PID 1688 wrote to memory of 1424 1688 d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe Explorer.EXE PID 1688 wrote to memory of 1424 1688 d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe Explorer.EXE PID 1688 wrote to memory of 1424 1688 d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe Explorer.EXE PID 1688 wrote to memory of 1424 1688 d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe Explorer.EXE PID 1688 wrote to memory of 1424 1688 d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe Explorer.EXE PID 1688 wrote to memory of 1424 1688 d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe Explorer.EXE PID 1688 wrote to memory of 1424 1688 d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe Explorer.EXE PID 1688 wrote to memory of 1424 1688 d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe Explorer.EXE PID 1688 wrote to memory of 1424 1688 d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe Explorer.EXE PID 1688 wrote to memory of 1424 1688 d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe Explorer.EXE PID 1688 wrote to memory of 1424 1688 d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe Explorer.EXE PID 1688 wrote to memory of 1424 1688 d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe Explorer.EXE PID 1688 wrote to memory of 1424 1688 d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe Explorer.EXE PID 1688 wrote to memory of 1424 1688 d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe Explorer.EXE PID 1688 wrote to memory of 1424 1688 d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe Explorer.EXE PID 1688 wrote to memory of 1424 1688 d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe Explorer.EXE PID 1688 wrote to memory of 1424 1688 d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe Explorer.EXE PID 1688 wrote to memory of 1424 1688 d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe Explorer.EXE PID 1688 wrote to memory of 1424 1688 d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe Explorer.EXE PID 1688 wrote to memory of 1424 1688 d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe Explorer.EXE PID 1688 wrote to memory of 1424 1688 d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe Explorer.EXE
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe"C:\Users\Admin\AppData\Local\Temp\d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe"C:\Users\Admin\AppData\Local\Temp\d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe"3⤵
- Adds policy Run key to start application
- Modifies Installed Components in the registry
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe4⤵
- Modifies Installed Components in the registry
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe"C:\Users\Admin\AppData\Local\Temp\d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe"4⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\SpyNet.exe"C:\Users\Admin\AppData\Local\Temp\SpyNet.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SpyNet.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SpyNet.exe6⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SysWOW64\cscript.exe"C:\Windows\system32\cscript.exe" "C:\Users\Admin\AppData\Local\Temp\teste.vbs"7⤵
-
C:\Windows\SysWOW64\win32\Frost.exe"C:\Windows\system32\win32\Frost.exe"5⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\win32\Frost.exe"C:\Windows\SysWOW64\win32\Frost.exe"6⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SpyNet.exeFilesize
2.0MB
MD598de7bcad1ba2caf74007bd97bc2b505
SHA18a79d06159a339313b810f23835b8417429dd356
SHA256e4b3b3e72bd3bf4052a3136cb811ea54923bc2d7807709992e0345743d49ced8
SHA512ef57cc4f0ad4bf1f54baaf7213bf868c418eebfb0eee3c32ff376b67d5d5337c35a94a1418951d82aae371820ce37eade7cf0a74ce54a4198e18327bd232a35d
-
C:\Users\Admin\AppData\Local\Temp\SpyNet.exeFilesize
2.3MB
MD5dc2b0103da8f80219d230ddaa5904d74
SHA19bd04800fb519a39db5e9a2a6af19a3b23dc3d1c
SHA256f6977beec3a091a18a8913b0b17e9ed9102561aabfe1f6fda8bf1c688f032358
SHA512b7b9fbaf078af1be6240b8b36be5bdfcfd83afb1ffc0449e05217d38015c945fda342f0f0a9e8b1c52ba70da8a053d54656283ef25eadb2efe329e4d462015b8
-
C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txtFilesize
2.9MB
MD5e30e0b2cb532979337c32ffe7ab1afa7
SHA1622760168c4ca8b84064ed5aaf6e5a6baa629e9c
SHA256f6f131b4156c95e1996685629e2085de062e4d57e234102e98264a31800e7673
SHA512e05d791c919661b829fb1ead45d06f855a7ef1db8294118394c72f6003dad4b1fad3beef4832f0cb3bee6e3956f2477dd7edeb2e53dc35f427de259521611b26
-
C:\Users\Admin\AppData\Local\Temp\teste.txtFilesize
2B
MD581051bcc2cf1bedf378224b0a93e2877
SHA1ba8ab5a0280b953aa97435ff8946cbcbb2755a27
SHA2567eb70257593da06f682a3ddda54a9d260d4fc514f645237f5ca74b08f8da61a6
SHA5121b302a2f1e624a5fb5ad94ddc4e5f8bfd74d26fa37512d0e5face303d8c40eee0d0ffa3649f5da43f439914d128166cb6c4774a7caa3b174d7535451eb697b5d
-
C:\Users\Admin\AppData\Local\Temp\teste.vbsFilesize
841B
MD5615964e5ab63a70f0e205a476c48e356
SHA1292620321db69d57ba23fa98d2a89484ddcf83d0
SHA25638a2c0e90a7c86eb5355710dd205f22f84dbba59e688cd3da6394af8c924a102
SHA51269886825baf2075f8e6cdc50b0b34f92d5d06d42db4586396fb3db806fef79986ba5754c7b1251b007cde4f943efe9e3d27800dd7e15f8084fd7e7e6046c3ccc
-
C:\Windows\SysWOW64\win32\Frost.exeFilesize
2.9MB
MD5c42a9c4d0e651f8ca5ed6d5cffdc3c90
SHA1a8919a39c58d447596bcea5c3ffa29a72559d26b
SHA256d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb
SHA512baa0bb7f1f29f052e07f0b25351ee3e5fe7f704a4b0d9b0d241c13831b436278b8412520311cdb653e131c48f135a847b1554dc6a9e6afd463255623b136e015
-
C:\Windows\SysWOW64\win32\Frost.exeFilesize
2.9MB
MD5c42a9c4d0e651f8ca5ed6d5cffdc3c90
SHA1a8919a39c58d447596bcea5c3ffa29a72559d26b
SHA256d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb
SHA512baa0bb7f1f29f052e07f0b25351ee3e5fe7f704a4b0d9b0d241c13831b436278b8412520311cdb653e131c48f135a847b1554dc6a9e6afd463255623b136e015
-
C:\Windows\SysWOW64\win32\Frost.exeFilesize
2.9MB
MD5c42a9c4d0e651f8ca5ed6d5cffdc3c90
SHA1a8919a39c58d447596bcea5c3ffa29a72559d26b
SHA256d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb
SHA512baa0bb7f1f29f052e07f0b25351ee3e5fe7f704a4b0d9b0d241c13831b436278b8412520311cdb653e131c48f135a847b1554dc6a9e6afd463255623b136e015
-
\Users\Admin\AppData\Local\Temp\IXP000.TMP\SpyNet.exeFilesize
2.0MB
MD598de7bcad1ba2caf74007bd97bc2b505
SHA18a79d06159a339313b810f23835b8417429dd356
SHA256e4b3b3e72bd3bf4052a3136cb811ea54923bc2d7807709992e0345743d49ced8
SHA512ef57cc4f0ad4bf1f54baaf7213bf868c418eebfb0eee3c32ff376b67d5d5337c35a94a1418951d82aae371820ce37eade7cf0a74ce54a4198e18327bd232a35d
-
\Users\Admin\AppData\Local\Temp\IXP000.TMP\SpyNet.exeFilesize
2.0MB
MD598de7bcad1ba2caf74007bd97bc2b505
SHA18a79d06159a339313b810f23835b8417429dd356
SHA256e4b3b3e72bd3bf4052a3136cb811ea54923bc2d7807709992e0345743d49ced8
SHA512ef57cc4f0ad4bf1f54baaf7213bf868c418eebfb0eee3c32ff376b67d5d5337c35a94a1418951d82aae371820ce37eade7cf0a74ce54a4198e18327bd232a35d
-
\Users\Admin\AppData\Local\Temp\SpyNet.exeFilesize
2.3MB
MD5dc2b0103da8f80219d230ddaa5904d74
SHA19bd04800fb519a39db5e9a2a6af19a3b23dc3d1c
SHA256f6977beec3a091a18a8913b0b17e9ed9102561aabfe1f6fda8bf1c688f032358
SHA512b7b9fbaf078af1be6240b8b36be5bdfcfd83afb1ffc0449e05217d38015c945fda342f0f0a9e8b1c52ba70da8a053d54656283ef25eadb2efe329e4d462015b8
-
\Users\Admin\AppData\Local\Temp\SpyNet.exeFilesize
2.3MB
MD5dc2b0103da8f80219d230ddaa5904d74
SHA19bd04800fb519a39db5e9a2a6af19a3b23dc3d1c
SHA256f6977beec3a091a18a8913b0b17e9ed9102561aabfe1f6fda8bf1c688f032358
SHA512b7b9fbaf078af1be6240b8b36be5bdfcfd83afb1ffc0449e05217d38015c945fda342f0f0a9e8b1c52ba70da8a053d54656283ef25eadb2efe329e4d462015b8
-
\Windows\SysWOW64\win32\Frost.exeFilesize
2.9MB
MD5c42a9c4d0e651f8ca5ed6d5cffdc3c90
SHA1a8919a39c58d447596bcea5c3ffa29a72559d26b
SHA256d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb
SHA512baa0bb7f1f29f052e07f0b25351ee3e5fe7f704a4b0d9b0d241c13831b436278b8412520311cdb653e131c48f135a847b1554dc6a9e6afd463255623b136e015
-
\Windows\SysWOW64\win32\Frost.exeFilesize
2.9MB
MD5c42a9c4d0e651f8ca5ed6d5cffdc3c90
SHA1a8919a39c58d447596bcea5c3ffa29a72559d26b
SHA256d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb
SHA512baa0bb7f1f29f052e07f0b25351ee3e5fe7f704a4b0d9b0d241c13831b436278b8412520311cdb653e131c48f135a847b1554dc6a9e6afd463255623b136e015
-
memory/636-75-0x0000000075341000-0x0000000075343000-memory.dmpFilesize
8KB
-
memory/636-73-0x0000000000000000-mapping.dmp
-
memory/636-86-0x0000000010470000-0x00000000104CC000-memory.dmpFilesize
368KB
-
memory/1424-70-0x0000000010410000-0x000000001046C000-memory.dmpFilesize
368KB
-
memory/1688-88-0x00000000104D0000-0x000000001052C000-memory.dmpFilesize
368KB
-
memory/1688-56-0x0000000000400000-0x000000000071F000-memory.dmpFilesize
3.1MB
-
memory/1688-104-0x0000000000400000-0x000000000071F000-memory.dmpFilesize
3.1MB
-
memory/1688-64-0x0000000010410000-0x000000001046C000-memory.dmpFilesize
368KB
-
memory/1688-96-0x0000000010530000-0x000000001058C000-memory.dmpFilesize
368KB
-
memory/1688-60-0x0000000000400000-0x000000000071F000-memory.dmpFilesize
3.1MB
-
memory/1688-62-0x0000000000400000-0x000000000071F000-memory.dmpFilesize
3.1MB
-
memory/1688-61-0x0000000000400000-0x000000000071F000-memory.dmpFilesize
3.1MB
-
memory/1688-59-0x0000000076BA1000-0x0000000076BA3000-memory.dmpFilesize
8KB
-
memory/1688-76-0x0000000010470000-0x00000000104CC000-memory.dmpFilesize
368KB
-
memory/1688-57-0x000000000071D3B0-mapping.dmp
-
memory/2908-116-0x0000000010530000-0x000000001058C000-memory.dmpFilesize
368KB
-
memory/2908-140-0x0000000010530000-0x000000001058C000-memory.dmpFilesize
368KB
-
memory/2908-95-0x0000000000000000-mapping.dmp
-
memory/4316-115-0x0000000002660000-0x0000000002BB7000-memory.dmpFilesize
5.3MB
-
memory/4316-107-0x0000000000000000-mapping.dmp
-
memory/4316-139-0x0000000002660000-0x0000000002BB7000-memory.dmpFilesize
5.3MB
-
memory/4316-138-0x0000000002660000-0x0000000002BB7000-memory.dmpFilesize
5.3MB
-
memory/4316-112-0x0000000002660000-0x0000000002BB7000-memory.dmpFilesize
5.3MB
-
memory/4352-111-0x0000000000000000-mapping.dmp
-
memory/4352-128-0x0000000000400000-0x0000000000957000-memory.dmpFilesize
5.3MB
-
memory/4352-141-0x0000000000400000-0x0000000000957000-memory.dmpFilesize
5.3MB
-
memory/4392-119-0x0000000000000000-mapping.dmp
-
memory/4424-129-0x0000000000400000-0x000000000071F000-memory.dmpFilesize
3.1MB
-
memory/4424-137-0x0000000000400000-0x000000000071F000-memory.dmpFilesize
3.1MB
-
memory/4424-132-0x0000000000400000-0x000000000071F000-memory.dmpFilesize
3.1MB
-
memory/4424-131-0x0000000000400000-0x000000000071F000-memory.dmpFilesize
3.1MB
-
memory/4424-130-0x0000000000400000-0x000000000071F000-memory.dmpFilesize
3.1MB
-
memory/4424-124-0x000000000071D3B0-mapping.dmp
-
memory/4488-133-0x0000000000000000-mapping.dmp