Analysis
-
max time kernel
182s -
max time network
211s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
04-12-2022 15:49
Static task
static1
Behavioral task
behavioral1
Sample
d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe
Resource
win7-20220901-en
General
-
Target
d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe
-
Size
2.9MB
-
MD5
c42a9c4d0e651f8ca5ed6d5cffdc3c90
-
SHA1
a8919a39c58d447596bcea5c3ffa29a72559d26b
-
SHA256
d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb
-
SHA512
baa0bb7f1f29f052e07f0b25351ee3e5fe7f704a4b0d9b0d241c13831b436278b8412520311cdb653e131c48f135a847b1554dc6a9e6afd463255623b136e015
-
SSDEEP
49152:YHyuG9rIlVn9AJGNkXcuQPYu4PFIuS6Ez8D36y1d5GC1feWhkBlBFGYpvK:YHGhIlV9AJGngnPOX8+y1d5GAfewkPGR
Malware Config
Extracted
cybergate
2.7 Final
victima
sizehacker.no-ip.org:1337
***Drakonez***
-
enable_keylogger
true
-
enable_message_box
true
-
ftp_directory
./logs/
-
ftp_interval
30
-
injected_process
explorer.exe
-
install_dir
win32
-
install_file
Frost.exe
-
install_flag
true
-
keylogger_enable_ftp
false
-
message_box_caption
texto da mensagem
-
message_box_title
tÃtulo da mensagem
-
password
abcd
-
regkey_hkcu
HKCU
-
regkey_hklm
HKLM
Signatures
-
Adds policy Run key to start application 2 TTPs 4 IoCs
Processes:
d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\win32\\Frost.exe" d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\win32\\Frost.exe" d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe -
Executes dropped EXE 4 IoCs
Processes:
SpyNet.exeSpyNet.exeFrost.exeFrost.exepid process 6348 SpyNet.exe 6380 SpyNet.exe 6432 Frost.exe 6524 Frost.exe -
Modifies Installed Components in the registry 2 TTPs 4 IoCs
Processes:
d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exeexplorer.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{XTHJF30T-T8PL-4E4D-7VGC-4L6R7PF63C1O}\StubPath = "C:\\Windows\\system32\\win32\\Frost.exe Restart" d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{XTHJF30T-T8PL-4E4D-7VGC-4L6R7PF63C1O} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{XTHJF30T-T8PL-4E4D-7VGC-4L6R7PF63C1O}\StubPath = "C:\\Windows\\system32\\win32\\Frost.exe" explorer.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{XTHJF30T-T8PL-4E4D-7VGC-4L6R7PF63C1O} d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe -
Processes:
resource yara_rule behavioral2/memory/2072-135-0x0000000000400000-0x000000000071F000-memory.dmp upx behavioral2/memory/2072-137-0x0000000000400000-0x000000000071F000-memory.dmp upx behavioral2/memory/2072-138-0x0000000000400000-0x000000000071F000-memory.dmp upx behavioral2/memory/2072-139-0x0000000000400000-0x000000000071F000-memory.dmp upx behavioral2/memory/2072-140-0x0000000000400000-0x000000000071F000-memory.dmp upx behavioral2/memory/2072-173-0x0000000000400000-0x000000000071F000-memory.dmp upx C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SpyNet.exe upx C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SpyNet.exe upx behavioral2/memory/6380-186-0x0000000000400000-0x0000000000957000-memory.dmp upx behavioral2/memory/6524-191-0x0000000000400000-0x000000000071F000-memory.dmp upx behavioral2/memory/6524-192-0x0000000000400000-0x000000000071F000-memory.dmp upx behavioral2/memory/6524-193-0x0000000000400000-0x000000000071F000-memory.dmp upx behavioral2/memory/6524-195-0x0000000000400000-0x000000000071F000-memory.dmp upx behavioral2/memory/6380-197-0x0000000000400000-0x0000000000957000-memory.dmp upx -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exeSpyNet.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation SpyNet.exe -
Adds Run key to start application 2 TTPs 6 IoCs
Processes:
d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exeSpyNet.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Windows\CurrentVersion\Run d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\system32\\win32\\Frost.exe" d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce SpyNet.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" SpyNet.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\system32\\win32\\Frost.exe" d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe -
Drops file in System32 directory 5 IoCs
Processes:
d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exeFrost.exed0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exedescription ioc process File opened for modification C:\Windows\SysWOW64\win32\Frost.exe d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe File opened for modification C:\Windows\SysWOW64\win32\ d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe File opened for modification C:\Windows\SysWOW64\win32\Frost.exe Frost.exe File created C:\Windows\SysWOW64\win32\Frost.exe d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe File opened for modification C:\Windows\SysWOW64\win32\Frost.exe d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exeFrost.exedescription pid process target process PID 372 set thread context of 2072 372 d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe PID 6432 set thread context of 6524 6432 Frost.exe Frost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks SCSI registry key(s) 3 TTPs 8 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
SpyNet.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 SpyNet.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags SpyNet.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 SpyNet.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom SpyNet.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 SpyNet.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom SpyNet.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000 SpyNet.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\ConfigFlags SpyNet.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
SpyNet.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 SpyNet.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString SpyNet.exe -
Modifies registry class 1 IoCs
Processes:
d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exepid process 4936 d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exedescription pid process Token: SeDebugPrivilege 4936 d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe Token: SeDebugPrivilege 4936 d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe -
Suspicious use of FindShellTrayWindow 7 IoCs
Processes:
d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exeSpyNet.exepid process 2072 d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe 6380 SpyNet.exe 6380 SpyNet.exe 6380 SpyNet.exe 6380 SpyNet.exe 6380 SpyNet.exe 6380 SpyNet.exe -
Suspicious use of SendNotifyMessage 6 IoCs
Processes:
SpyNet.exepid process 6380 SpyNet.exe 6380 SpyNet.exe 6380 SpyNet.exe 6380 SpyNet.exe 6380 SpyNet.exe 6380 SpyNet.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exeFrost.exepid process 372 d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe 6432 Frost.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exed0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exedescription pid process target process PID 372 wrote to memory of 2072 372 d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe PID 372 wrote to memory of 2072 372 d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe PID 372 wrote to memory of 2072 372 d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe PID 372 wrote to memory of 2072 372 d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe PID 372 wrote to memory of 2072 372 d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe PID 372 wrote to memory of 2072 372 d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe PID 372 wrote to memory of 2072 372 d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe PID 372 wrote to memory of 2072 372 d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe PID 2072 wrote to memory of 1192 2072 d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe Explorer.EXE PID 2072 wrote to memory of 1192 2072 d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe Explorer.EXE PID 2072 wrote to memory of 1192 2072 d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe Explorer.EXE PID 2072 wrote to memory of 1192 2072 d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe Explorer.EXE PID 2072 wrote to memory of 1192 2072 d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe Explorer.EXE PID 2072 wrote to memory of 1192 2072 d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe Explorer.EXE PID 2072 wrote to memory of 1192 2072 d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe Explorer.EXE PID 2072 wrote to memory of 1192 2072 d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe Explorer.EXE PID 2072 wrote to memory of 1192 2072 d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe Explorer.EXE PID 2072 wrote to memory of 1192 2072 d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe Explorer.EXE PID 2072 wrote to memory of 1192 2072 d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe Explorer.EXE PID 2072 wrote to memory of 1192 2072 d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe Explorer.EXE PID 2072 wrote to memory of 1192 2072 d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe Explorer.EXE PID 2072 wrote to memory of 1192 2072 d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe Explorer.EXE PID 2072 wrote to memory of 1192 2072 d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe Explorer.EXE PID 2072 wrote to memory of 1192 2072 d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe Explorer.EXE PID 2072 wrote to memory of 1192 2072 d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe Explorer.EXE PID 2072 wrote to memory of 1192 2072 d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe Explorer.EXE PID 2072 wrote to memory of 1192 2072 d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe Explorer.EXE PID 2072 wrote to memory of 1192 2072 d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe Explorer.EXE PID 2072 wrote to memory of 1192 2072 d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe Explorer.EXE PID 2072 wrote to memory of 1192 2072 d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe Explorer.EXE PID 2072 wrote to memory of 1192 2072 d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe Explorer.EXE PID 2072 wrote to memory of 1192 2072 d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe Explorer.EXE PID 2072 wrote to memory of 1192 2072 d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe Explorer.EXE PID 2072 wrote to memory of 1192 2072 d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe Explorer.EXE PID 2072 wrote to memory of 1192 2072 d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe Explorer.EXE PID 2072 wrote to memory of 1192 2072 d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe Explorer.EXE PID 2072 wrote to memory of 1192 2072 d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe Explorer.EXE PID 2072 wrote to memory of 1192 2072 d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe Explorer.EXE PID 2072 wrote to memory of 1192 2072 d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe Explorer.EXE PID 2072 wrote to memory of 1192 2072 d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe Explorer.EXE PID 2072 wrote to memory of 1192 2072 d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe Explorer.EXE PID 2072 wrote to memory of 1192 2072 d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe Explorer.EXE PID 2072 wrote to memory of 1192 2072 d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe Explorer.EXE PID 2072 wrote to memory of 1192 2072 d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe Explorer.EXE PID 2072 wrote to memory of 1192 2072 d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe Explorer.EXE PID 2072 wrote to memory of 1192 2072 d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe Explorer.EXE PID 2072 wrote to memory of 1192 2072 d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe Explorer.EXE PID 2072 wrote to memory of 1192 2072 d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe Explorer.EXE PID 2072 wrote to memory of 1192 2072 d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe Explorer.EXE PID 2072 wrote to memory of 1192 2072 d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe Explorer.EXE PID 2072 wrote to memory of 1192 2072 d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe Explorer.EXE PID 2072 wrote to memory of 1192 2072 d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe Explorer.EXE PID 2072 wrote to memory of 1192 2072 d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe Explorer.EXE PID 2072 wrote to memory of 1192 2072 d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe Explorer.EXE PID 2072 wrote to memory of 1192 2072 d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe Explorer.EXE PID 2072 wrote to memory of 1192 2072 d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe Explorer.EXE PID 2072 wrote to memory of 1192 2072 d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe Explorer.EXE PID 2072 wrote to memory of 1192 2072 d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe Explorer.EXE PID 2072 wrote to memory of 1192 2072 d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe Explorer.EXE PID 2072 wrote to memory of 1192 2072 d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe Explorer.EXE PID 2072 wrote to memory of 1192 2072 d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe Explorer.EXE PID 2072 wrote to memory of 1192 2072 d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe Explorer.EXE PID 2072 wrote to memory of 1192 2072 d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe Explorer.EXE PID 2072 wrote to memory of 1192 2072 d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe Explorer.EXE
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe"C:\Users\Admin\AppData\Local\Temp\d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe"C:\Users\Admin\AppData\Local\Temp\d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe"3⤵
- Adds policy Run key to start application
- Modifies Installed Components in the registry
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe4⤵
- Modifies Installed Components in the registry
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe"C:\Users\Admin\AppData\Local\Temp\d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb.exe"4⤵
- Checks computer location settings
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\SpyNet.exe"C:\Users\Admin\AppData\Local\Temp\SpyNet.exe"5⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SpyNet.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SpyNet.exe6⤵
- Executes dropped EXE
- Checks computer location settings
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SysWOW64\cscript.exe"C:\Windows\system32\cscript.exe" "C:\Users\Admin\AppData\Local\Temp\teste.vbs"7⤵
-
C:\Windows\SysWOW64\win32\Frost.exe"C:\Windows\system32\win32\Frost.exe"5⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\win32\Frost.exe"C:\Windows\SysWOW64\win32\Frost.exe"6⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SpyNet.exeFilesize
2.0MB
MD598de7bcad1ba2caf74007bd97bc2b505
SHA18a79d06159a339313b810f23835b8417429dd356
SHA256e4b3b3e72bd3bf4052a3136cb811ea54923bc2d7807709992e0345743d49ced8
SHA512ef57cc4f0ad4bf1f54baaf7213bf868c418eebfb0eee3c32ff376b67d5d5337c35a94a1418951d82aae371820ce37eade7cf0a74ce54a4198e18327bd232a35d
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SpyNet.exeFilesize
2.0MB
MD598de7bcad1ba2caf74007bd97bc2b505
SHA18a79d06159a339313b810f23835b8417429dd356
SHA256e4b3b3e72bd3bf4052a3136cb811ea54923bc2d7807709992e0345743d49ced8
SHA512ef57cc4f0ad4bf1f54baaf7213bf868c418eebfb0eee3c32ff376b67d5d5337c35a94a1418951d82aae371820ce37eade7cf0a74ce54a4198e18327bd232a35d
-
C:\Users\Admin\AppData\Local\Temp\SpyNet.exeFilesize
2.3MB
MD5dc2b0103da8f80219d230ddaa5904d74
SHA19bd04800fb519a39db5e9a2a6af19a3b23dc3d1c
SHA256f6977beec3a091a18a8913b0b17e9ed9102561aabfe1f6fda8bf1c688f032358
SHA512b7b9fbaf078af1be6240b8b36be5bdfcfd83afb1ffc0449e05217d38015c945fda342f0f0a9e8b1c52ba70da8a053d54656283ef25eadb2efe329e4d462015b8
-
C:\Users\Admin\AppData\Local\Temp\SpyNet.exeFilesize
2.3MB
MD5dc2b0103da8f80219d230ddaa5904d74
SHA19bd04800fb519a39db5e9a2a6af19a3b23dc3d1c
SHA256f6977beec3a091a18a8913b0b17e9ed9102561aabfe1f6fda8bf1c688f032358
SHA512b7b9fbaf078af1be6240b8b36be5bdfcfd83afb1ffc0449e05217d38015c945fda342f0f0a9e8b1c52ba70da8a053d54656283ef25eadb2efe329e4d462015b8
-
C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txtFilesize
2.9MB
MD5e30e0b2cb532979337c32ffe7ab1afa7
SHA1622760168c4ca8b84064ed5aaf6e5a6baa629e9c
SHA256f6f131b4156c95e1996685629e2085de062e4d57e234102e98264a31800e7673
SHA512e05d791c919661b829fb1ead45d06f855a7ef1db8294118394c72f6003dad4b1fad3beef4832f0cb3bee6e3956f2477dd7edeb2e53dc35f427de259521611b26
-
C:\Users\Admin\AppData\Local\Temp\teste.txtFilesize
2B
MD581051bcc2cf1bedf378224b0a93e2877
SHA1ba8ab5a0280b953aa97435ff8946cbcbb2755a27
SHA2567eb70257593da06f682a3ddda54a9d260d4fc514f645237f5ca74b08f8da61a6
SHA5121b302a2f1e624a5fb5ad94ddc4e5f8bfd74d26fa37512d0e5face303d8c40eee0d0ffa3649f5da43f439914d128166cb6c4774a7caa3b174d7535451eb697b5d
-
C:\Users\Admin\AppData\Local\Temp\teste.vbsFilesize
841B
MD5615964e5ab63a70f0e205a476c48e356
SHA1292620321db69d57ba23fa98d2a89484ddcf83d0
SHA25638a2c0e90a7c86eb5355710dd205f22f84dbba59e688cd3da6394af8c924a102
SHA51269886825baf2075f8e6cdc50b0b34f92d5d06d42db4586396fb3db806fef79986ba5754c7b1251b007cde4f943efe9e3d27800dd7e15f8084fd7e7e6046c3ccc
-
C:\Windows\SysWOW64\win32\Frost.exeFilesize
2.9MB
MD5c42a9c4d0e651f8ca5ed6d5cffdc3c90
SHA1a8919a39c58d447596bcea5c3ffa29a72559d26b
SHA256d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb
SHA512baa0bb7f1f29f052e07f0b25351ee3e5fe7f704a4b0d9b0d241c13831b436278b8412520311cdb653e131c48f135a847b1554dc6a9e6afd463255623b136e015
-
C:\Windows\SysWOW64\win32\Frost.exeFilesize
2.9MB
MD5c42a9c4d0e651f8ca5ed6d5cffdc3c90
SHA1a8919a39c58d447596bcea5c3ffa29a72559d26b
SHA256d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb
SHA512baa0bb7f1f29f052e07f0b25351ee3e5fe7f704a4b0d9b0d241c13831b436278b8412520311cdb653e131c48f135a847b1554dc6a9e6afd463255623b136e015
-
C:\Windows\SysWOW64\win32\Frost.exeFilesize
2.9MB
MD5c42a9c4d0e651f8ca5ed6d5cffdc3c90
SHA1a8919a39c58d447596bcea5c3ffa29a72559d26b
SHA256d0e8055eccfb8680a76de4564e74632f87bb4a2e237140884693c26d550e84cb
SHA512baa0bb7f1f29f052e07f0b25351ee3e5fe7f704a4b0d9b0d241c13831b436278b8412520311cdb653e131c48f135a847b1554dc6a9e6afd463255623b136e015
-
memory/1572-156-0x0000000010470000-0x00000000104CC000-memory.dmpFilesize
368KB
-
memory/1572-194-0x0000000010470000-0x00000000104CC000-memory.dmpFilesize
368KB
-
memory/1572-149-0x0000000000000000-mapping.dmp
-
memory/2072-138-0x0000000000400000-0x000000000071F000-memory.dmpFilesize
3.1MB
-
memory/2072-139-0x0000000000400000-0x000000000071F000-memory.dmpFilesize
3.1MB
-
memory/2072-137-0x0000000000400000-0x000000000071F000-memory.dmpFilesize
3.1MB
-
memory/2072-150-0x0000000010470000-0x00000000104CC000-memory.dmpFilesize
368KB
-
memory/2072-135-0x0000000000400000-0x000000000071F000-memory.dmpFilesize
3.1MB
-
memory/2072-166-0x0000000010530000-0x000000001058C000-memory.dmpFilesize
368KB
-
memory/2072-142-0x0000000010410000-0x000000001046C000-memory.dmpFilesize
368KB
-
memory/2072-134-0x0000000000000000-mapping.dmp
-
memory/2072-140-0x0000000000400000-0x000000000071F000-memory.dmpFilesize
3.1MB
-
memory/2072-173-0x0000000000400000-0x000000000071F000-memory.dmpFilesize
3.1MB
-
memory/2072-158-0x00000000104D0000-0x000000001052C000-memory.dmpFilesize
368KB
-
memory/4936-196-0x0000000010530000-0x000000001058C000-memory.dmpFilesize
368KB
-
memory/4936-172-0x0000000010530000-0x000000001058C000-memory.dmpFilesize
368KB
-
memory/4936-165-0x0000000000000000-mapping.dmp
-
memory/6348-176-0x0000000000000000-mapping.dmp
-
memory/6380-186-0x0000000000400000-0x0000000000957000-memory.dmpFilesize
5.3MB
-
memory/6380-179-0x0000000000000000-mapping.dmp
-
memory/6380-197-0x0000000000400000-0x0000000000957000-memory.dmpFilesize
5.3MB
-
memory/6432-182-0x0000000000000000-mapping.dmp
-
memory/6524-187-0x0000000000000000-mapping.dmp
-
memory/6524-195-0x0000000000400000-0x000000000071F000-memory.dmpFilesize
3.1MB
-
memory/6524-193-0x0000000000400000-0x000000000071F000-memory.dmpFilesize
3.1MB
-
memory/6524-192-0x0000000000400000-0x000000000071F000-memory.dmpFilesize
3.1MB
-
memory/6524-191-0x0000000000400000-0x000000000071F000-memory.dmpFilesize
3.1MB
-
memory/7060-198-0x0000000000000000-mapping.dmp