e5f5ca11bc1b9933c77af6229c4deaa74c9e259f2fffe20cd9b1f17dff603641

Analysis

max time kernel
170s
max time network
508s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
05/12/2022, 19:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e5f5ca11bc1b9933c77af6229c4deaa74c9e259f2fffe20cd9b1f17dff603641.exe
Size

375KB
MD5

58f15794b6cb886072b48d5f7adcbe5d
SHA1

7dc06fe444373e306abd9d08cb5259ee5534318f
SHA256

e5f5ca11bc1b9933c77af6229c4deaa74c9e259f2fffe20cd9b1f17dff603641
SHA512

d296641d8408c61a010b4d17d1dd8920cca3530175de1be7a05ca24f1b8fedb6a464016d8d7b87390afe17cdf08bbb6c57c4c8a81176161265ad834fd341bd21
SSDEEP

6144:i3TqoIetsvlJ4DGBdu2YpJ3qOe4yufYspgrGQVUAt5OCHmQRGRCnpGj:elI88z4yBU/3qO5yx1rGrAt5OCHjgC0j

Score

8^/10

persistence upx

Malware Config

Signatures

Executes dropped EXE 7 IoCs

pid	Process
1280	Dehew.exe
4100	Dehew.exe
3456	Dehew.exe
2656	Dehew.exe
4112	Dehew.exe
1916	Dehew.exe
2660	Dehew.exe

Modifies Installed Components in the registry 2 TTPs 10 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\Dehew.exe restart"	e5f5ca11bc1b9933c77af6229c4deaa74c9e259f2fffe20cd9b1f17dff603641.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	Dehew.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	Dehew.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Dehew.exe restart"	Dehew.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	Dehew.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Dehew.exe restart"	Dehew.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	e5f5ca11bc1b9933c77af6229c4deaa74c9e259f2fffe20cd9b1f17dff603641.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\Dehew.exe restart"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Dehew.exe restart"	Dehew.exe

UPX packed file 13 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3340-133-0x0000000010000000-0x000000001031C000-memory.dmp	upx
behavioral2/memory/3340-134-0x0000000010000000-0x000000001031C000-memory.dmp	upx
behavioral2/memory/3340-135-0x0000000010000000-0x000000001031C000-memory.dmp	upx
behavioral2/memory/4232-145-0x0000000010000000-0x000000001031C000-memory.dmp	upx
behavioral2/memory/4232-146-0x0000000010000000-0x000000001031C000-memory.dmp	upx
behavioral2/memory/4232-147-0x0000000010000000-0x000000001031C000-memory.dmp	upx
behavioral2/memory/2880-153-0x0000000010000000-0x000000001031C000-memory.dmp	upx
behavioral2/memory/4100-172-0x0000000010000000-0x000000001031C000-memory.dmp	upx
behavioral2/memory/4100-173-0x0000000010000000-0x000000001031C000-memory.dmp	upx
behavioral2/memory/4100-174-0x0000000010000000-0x000000001031C000-memory.dmp	upx
behavioral2/memory/2656-194-0x0000000010000000-0x000000001031C000-memory.dmp	upx
behavioral2/memory/2656-196-0x0000000010000000-0x000000001031C000-memory.dmp	upx
behavioral2/memory/2656-195-0x0000000010000000-0x000000001031C000-memory.dmp	upx

Adds Run key to start application 2 TTPs 24 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	svchost.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	Dehew.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Dehew.exe"	Dehew.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	Dehew.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	Dehew.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Dehew.exe"	Dehew.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Dehew.exe"	e5f5ca11bc1b9933c77af6229c4deaa74c9e259f2fffe20cd9b1f17dff603641.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Dehew.exe"	e5f5ca11bc1b9933c77af6229c4deaa74c9e259f2fffe20cd9b1f17dff603641.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Dehew.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Dehew.exe"	Dehew.exe
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Windows\CurrentVersion\Run	Dehew.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Dehew.exe"	Dehew.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Dehew.exe"	Dehew.exe
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Windows\CurrentVersion\Run	e5f5ca11bc1b9933c77af6229c4deaa74c9e259f2fffe20cd9b1f17dff603641.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Users\\Admin\\AppData\\Local\\Temp\\e5f5ca11bc1b9933c77af6229c4deaa74c9e259f2fffe20cd9b1f17dff603641.exe"	e5f5ca11bc1b9933c77af6229c4deaa74c9e259f2fffe20cd9b1f17dff603641.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Dehew.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Dehew.exe"	Dehew.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	e5f5ca11bc1b9933c77af6229c4deaa74c9e259f2fffe20cd9b1f17dff603641.exe
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Windows\CurrentVersion\Run	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Dehew.exe"	Dehew.exe
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Windows\CurrentVersion\Run	Dehew.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Dehew.exe"	Dehew.exe
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Windows\CurrentVersion\Run	Dehew.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Dehew.exe"	Dehew.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 3128 set thread context of 4232	3128	e5f5ca11bc1b9933c77af6229c4deaa74c9e259f2fffe20cd9b1f17dff603641.exe	78
PID 1280 set thread context of 4100	1280	Dehew.exe	84
PID 3456 set thread context of 2656	3456	Dehew.exe	88
PID 4112 set thread context of 1916	4112	Dehew.exe	92

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\InstallDir\Dehew.exe	Dehew.exe
File created	C:\Windows\InstallDir\Dehew.exe	e5f5ca11bc1b9933c77af6229c4deaa74c9e259f2fffe20cd9b1f17dff603641.exe
File opened for modification	C:\Windows\InstallDir\Dehew.exe	e5f5ca11bc1b9933c77af6229c4deaa74c9e259f2fffe20cd9b1f17dff603641.exe
File created	C:\Windows\InstallDir\Dehew.exe	Dehew.exe
File created	C:\Windows\InstallDir\Dehew.exe	Dehew.exe

Checks SCSI registry key(s) 3 TTPs 32 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	Dehew.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	Dehew.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	Dehew.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	Dehew.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\ConfigFlags	Dehew.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	Dehew.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	e5f5ca11bc1b9933c77af6229c4deaa74c9e259f2fffe20cd9b1f17dff603641.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	Dehew.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	Dehew.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\ConfigFlags	Dehew.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	Dehew.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\ConfigFlags	e5f5ca11bc1b9933c77af6229c4deaa74c9e259f2fffe20cd9b1f17dff603641.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	Dehew.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	Dehew.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	Dehew.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	Dehew.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	Dehew.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	Dehew.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	e5f5ca11bc1b9933c77af6229c4deaa74c9e259f2fffe20cd9b1f17dff603641.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	Dehew.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	Dehew.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	Dehew.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	Dehew.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	Dehew.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	e5f5ca11bc1b9933c77af6229c4deaa74c9e259f2fffe20cd9b1f17dff603641.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	Dehew.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\ConfigFlags	Dehew.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	e5f5ca11bc1b9933c77af6229c4deaa74c9e259f2fffe20cd9b1f17dff603641.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	e5f5ca11bc1b9933c77af6229c4deaa74c9e259f2fffe20cd9b1f17dff603641.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	Dehew.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	e5f5ca11bc1b9933c77af6229c4deaa74c9e259f2fffe20cd9b1f17dff603641.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	e5f5ca11bc1b9933c77af6229c4deaa74c9e259f2fffe20cd9b1f17dff603641.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3128	e5f5ca11bc1b9933c77af6229c4deaa74c9e259f2fffe20cd9b1f17dff603641.exe
3128	e5f5ca11bc1b9933c77af6229c4deaa74c9e259f2fffe20cd9b1f17dff603641.exe
1280	Dehew.exe
1280	Dehew.exe
3456	Dehew.exe
3456	Dehew.exe
4112	Dehew.exe
4112	Dehew.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4232	e5f5ca11bc1b9933c77af6229c4deaa74c9e259f2fffe20cd9b1f17dff603641.exe
4100	Dehew.exe
2656	Dehew.exe
1916	Dehew.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3128 wrote to memory of 3340	3128	e5f5ca11bc1b9933c77af6229c4deaa74c9e259f2fffe20cd9b1f17dff603641.exe	76
PID 3128 wrote to memory of 3340	3128	e5f5ca11bc1b9933c77af6229c4deaa74c9e259f2fffe20cd9b1f17dff603641.exe	76
PID 3128 wrote to memory of 3340	3128	e5f5ca11bc1b9933c77af6229c4deaa74c9e259f2fffe20cd9b1f17dff603641.exe	76
PID 3128 wrote to memory of 3340	3128	e5f5ca11bc1b9933c77af6229c4deaa74c9e259f2fffe20cd9b1f17dff603641.exe	76
PID 3128 wrote to memory of 3340	3128	e5f5ca11bc1b9933c77af6229c4deaa74c9e259f2fffe20cd9b1f17dff603641.exe	76
PID 3128 wrote to memory of 3340	3128	e5f5ca11bc1b9933c77af6229c4deaa74c9e259f2fffe20cd9b1f17dff603641.exe	76
PID 3128 wrote to memory of 2028	3128	e5f5ca11bc1b9933c77af6229c4deaa74c9e259f2fffe20cd9b1f17dff603641.exe	77
PID 3128 wrote to memory of 2028	3128	e5f5ca11bc1b9933c77af6229c4deaa74c9e259f2fffe20cd9b1f17dff603641.exe	77
PID 3128 wrote to memory of 2028	3128	e5f5ca11bc1b9933c77af6229c4deaa74c9e259f2fffe20cd9b1f17dff603641.exe	77
PID 3128 wrote to memory of 2028	3128	e5f5ca11bc1b9933c77af6229c4deaa74c9e259f2fffe20cd9b1f17dff603641.exe	77
PID 3128 wrote to memory of 2028	3128	e5f5ca11bc1b9933c77af6229c4deaa74c9e259f2fffe20cd9b1f17dff603641.exe	77
PID 3128 wrote to memory of 2028	3128	e5f5ca11bc1b9933c77af6229c4deaa74c9e259f2fffe20cd9b1f17dff603641.exe	77
PID 3128 wrote to memory of 4232	3128	e5f5ca11bc1b9933c77af6229c4deaa74c9e259f2fffe20cd9b1f17dff603641.exe	78
PID 3128 wrote to memory of 4232	3128	e5f5ca11bc1b9933c77af6229c4deaa74c9e259f2fffe20cd9b1f17dff603641.exe	78
PID 3128 wrote to memory of 4232	3128	e5f5ca11bc1b9933c77af6229c4deaa74c9e259f2fffe20cd9b1f17dff603641.exe	78
PID 3128 wrote to memory of 4232	3128	e5f5ca11bc1b9933c77af6229c4deaa74c9e259f2fffe20cd9b1f17dff603641.exe	78
PID 3128 wrote to memory of 4232	3128	e5f5ca11bc1b9933c77af6229c4deaa74c9e259f2fffe20cd9b1f17dff603641.exe	78
PID 3128 wrote to memory of 4232	3128	e5f5ca11bc1b9933c77af6229c4deaa74c9e259f2fffe20cd9b1f17dff603641.exe	78
PID 3128 wrote to memory of 4232	3128	e5f5ca11bc1b9933c77af6229c4deaa74c9e259f2fffe20cd9b1f17dff603641.exe	78
PID 3128 wrote to memory of 4232	3128	e5f5ca11bc1b9933c77af6229c4deaa74c9e259f2fffe20cd9b1f17dff603641.exe	78
PID 4232 wrote to memory of 2880	4232	e5f5ca11bc1b9933c77af6229c4deaa74c9e259f2fffe20cd9b1f17dff603641.exe	80
PID 4232 wrote to memory of 2880	4232	e5f5ca11bc1b9933c77af6229c4deaa74c9e259f2fffe20cd9b1f17dff603641.exe	80
PID 4232 wrote to memory of 2880	4232	e5f5ca11bc1b9933c77af6229c4deaa74c9e259f2fffe20cd9b1f17dff603641.exe	80
PID 4232 wrote to memory of 2880	4232	e5f5ca11bc1b9933c77af6229c4deaa74c9e259f2fffe20cd9b1f17dff603641.exe	80
PID 2880 wrote to memory of 1280	2880	svchost.exe	81
PID 2880 wrote to memory of 1280	2880	svchost.exe	81
PID 2880 wrote to memory of 1280	2880	svchost.exe	81
PID 1280 wrote to memory of 3368	1280	Dehew.exe	82
PID 1280 wrote to memory of 3368	1280	Dehew.exe	82
PID 1280 wrote to memory of 3368	1280	Dehew.exe	82
PID 1280 wrote to memory of 3368	1280	Dehew.exe	82
PID 1280 wrote to memory of 3368	1280	Dehew.exe	82
PID 1280 wrote to memory of 3368	1280	Dehew.exe	82
PID 1280 wrote to memory of 2372	1280	Dehew.exe	83
PID 1280 wrote to memory of 2372	1280	Dehew.exe	83
PID 1280 wrote to memory of 2372	1280	Dehew.exe	83
PID 1280 wrote to memory of 2372	1280	Dehew.exe	83
PID 1280 wrote to memory of 2372	1280	Dehew.exe	83
PID 1280 wrote to memory of 2372	1280	Dehew.exe	83
PID 1280 wrote to memory of 4100	1280	Dehew.exe	84
PID 1280 wrote to memory of 4100	1280	Dehew.exe	84
PID 1280 wrote to memory of 4100	1280	Dehew.exe	84
PID 1280 wrote to memory of 4100	1280	Dehew.exe	84
PID 1280 wrote to memory of 4100	1280	Dehew.exe	84
PID 1280 wrote to memory of 4100	1280	Dehew.exe	84
PID 1280 wrote to memory of 4100	1280	Dehew.exe	84
PID 1280 wrote to memory of 4100	1280	Dehew.exe	84
PID 2880 wrote to memory of 3456	2880	svchost.exe	85
PID 2880 wrote to memory of 3456	2880	svchost.exe	85
PID 2880 wrote to memory of 3456	2880	svchost.exe	85
PID 3456 wrote to memory of 1812	3456	Dehew.exe	86
PID 3456 wrote to memory of 1812	3456	Dehew.exe	86
PID 3456 wrote to memory of 1812	3456	Dehew.exe	86
PID 3456 wrote to memory of 1812	3456	Dehew.exe	86
PID 3456 wrote to memory of 1812	3456	Dehew.exe	86
PID 3456 wrote to memory of 1812	3456	Dehew.exe	86
PID 3456 wrote to memory of 4556	3456	Dehew.exe	87
PID 3456 wrote to memory of 4556	3456	Dehew.exe	87
PID 3456 wrote to memory of 4556	3456	Dehew.exe	87
PID 3456 wrote to memory of 4556	3456	Dehew.exe	87
PID 3456 wrote to memory of 4556	3456	Dehew.exe	87
PID 3456 wrote to memory of 4556	3456	Dehew.exe	87
PID 3456 wrote to memory of 2656	3456	Dehew.exe	88
PID 3456 wrote to memory of 2656	3456	Dehew.exe	88

C:\Users\Admin\AppData\Local\Temp\e5f5ca11bc1b9933c77af6229c4deaa74c9e259f2fffe20cd9b1f17dff603641.exe
"C:\Users\Admin\AppData\Local\Temp\e5f5ca11bc1b9933c77af6229c4deaa74c9e259f2fffe20cd9b1f17dff603641.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:3340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:2028
- C:\Users\Admin\AppData\Local\Temp\e5f5ca11bc1b9933c77af6229c4deaa74c9e259f2fffe20cd9b1f17dff603641.exe
  C:\Users\Admin\AppData\Local\Temp\e5f5ca11bc1b9933c77af6229c4deaa74c9e259f2fffe20cd9b1f17dff603641.exe
  2⤵
  - Modifies Installed Components in the registry
  - Adds Run key to start application
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4232
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - Modifies Installed Components in the registry
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:2880
  - - C:\Windows\InstallDir\Dehew.exe
      "C:\Windows\InstallDir\Dehew.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:1280
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        5⤵
        
        PID:3368
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        5⤵
        
        PID:2372
    - - C:\Windows\InstallDir\Dehew.exe
        
        C:\Windows\InstallDir\Dehew.exe
        5⤵
        Executes dropped EXE
        Modifies Installed Components in the registry
        Adds Run key to start application
        Drops file in Windows directory
        Checks SCSI registry key(s)
        Suspicious use of SetWindowsHookEx
        
        PID:4100
  - - C:\Windows\InstallDir\Dehew.exe
      "C:\Windows\InstallDir\Dehew.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:3456
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        5⤵
        
        PID:1812
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        5⤵
        
        PID:4556
    - - C:\Windows\InstallDir\Dehew.exe
        
        C:\Windows\InstallDir\Dehew.exe
        5⤵
        Executes dropped EXE
        Modifies Installed Components in the registry
        Adds Run key to start application
        Drops file in Windows directory
        Checks SCSI registry key(s)
        Suspicious use of SetWindowsHookEx
        
        PID:2656
  - - C:\Windows\InstallDir\Dehew.exe
      "C:\Windows\InstallDir\Dehew.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      PID:4112
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        5⤵
        
        PID:3552
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        5⤵
        
        PID:2112
    - - C:\Windows\InstallDir\Dehew.exe
        
        C:\Windows\InstallDir\Dehew.exe
        5⤵
        Executes dropped EXE
        Modifies Installed Components in the registry
        Adds Run key to start application
        Drops file in Windows directory
        Checks SCSI registry key(s)
        Suspicious use of SetWindowsHookEx
        
        PID:1916
  - - C:\Windows\InstallDir\Dehew.exe
      "C:\Windows\InstallDir\Dehew.exe"
      4⤵
      Executes dropped EXE
      PID:2660
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        5⤵
        
        PID:4620

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\InstallDir\Dehew.exe

Filesize
375KB

MD5
58f15794b6cb886072b48d5f7adcbe5d

SHA1
7dc06fe444373e306abd9d08cb5259ee5534318f

SHA256
e5f5ca11bc1b9933c77af6229c4deaa74c9e259f2fffe20cd9b1f17dff603641

SHA512
d296641d8408c61a010b4d17d1dd8920cca3530175de1be7a05ca24f1b8fedb6a464016d8d7b87390afe17cdf08bbb6c57c4c8a81176161265ad834fd341bd21

Download Submit
C:\Users\Admin\AppData\Roaming\InstallDir\Dehew.exe

Filesize
375KB

MD5
58f15794b6cb886072b48d5f7adcbe5d

SHA1
7dc06fe444373e306abd9d08cb5259ee5534318f

SHA256
e5f5ca11bc1b9933c77af6229c4deaa74c9e259f2fffe20cd9b1f17dff603641

SHA512
d296641d8408c61a010b4d17d1dd8920cca3530175de1be7a05ca24f1b8fedb6a464016d8d7b87390afe17cdf08bbb6c57c4c8a81176161265ad834fd341bd21

Download Submit
C:\Windows\InstallDir\Dehew.exe

Filesize
375KB

MD5
58f15794b6cb886072b48d5f7adcbe5d

SHA1
7dc06fe444373e306abd9d08cb5259ee5534318f

SHA256
e5f5ca11bc1b9933c77af6229c4deaa74c9e259f2fffe20cd9b1f17dff603641

SHA512
d296641d8408c61a010b4d17d1dd8920cca3530175de1be7a05ca24f1b8fedb6a464016d8d7b87390afe17cdf08bbb6c57c4c8a81176161265ad834fd341bd21

Download Submit
C:\Windows\InstallDir\Dehew.exe

Filesize
375KB

MD5
58f15794b6cb886072b48d5f7adcbe5d

SHA1
7dc06fe444373e306abd9d08cb5259ee5534318f

SHA256
e5f5ca11bc1b9933c77af6229c4deaa74c9e259f2fffe20cd9b1f17dff603641

SHA512
d296641d8408c61a010b4d17d1dd8920cca3530175de1be7a05ca24f1b8fedb6a464016d8d7b87390afe17cdf08bbb6c57c4c8a81176161265ad834fd341bd21

Download Submit
C:\Windows\InstallDir\Dehew.exe

Filesize
375KB

MD5
58f15794b6cb886072b48d5f7adcbe5d

SHA1
7dc06fe444373e306abd9d08cb5259ee5534318f

SHA256
e5f5ca11bc1b9933c77af6229c4deaa74c9e259f2fffe20cd9b1f17dff603641

SHA512
d296641d8408c61a010b4d17d1dd8920cca3530175de1be7a05ca24f1b8fedb6a464016d8d7b87390afe17cdf08bbb6c57c4c8a81176161265ad834fd341bd21

Download Submit
C:\Windows\InstallDir\Dehew.exe

Filesize
375KB

MD5
58f15794b6cb886072b48d5f7adcbe5d

SHA1
7dc06fe444373e306abd9d08cb5259ee5534318f

SHA256
e5f5ca11bc1b9933c77af6229c4deaa74c9e259f2fffe20cd9b1f17dff603641

SHA512
d296641d8408c61a010b4d17d1dd8920cca3530175de1be7a05ca24f1b8fedb6a464016d8d7b87390afe17cdf08bbb6c57c4c8a81176161265ad834fd341bd21

Download Submit
C:\Windows\InstallDir\Dehew.exe

Filesize
375KB

MD5
58f15794b6cb886072b48d5f7adcbe5d

SHA1
7dc06fe444373e306abd9d08cb5259ee5534318f

SHA256
e5f5ca11bc1b9933c77af6229c4deaa74c9e259f2fffe20cd9b1f17dff603641

SHA512
d296641d8408c61a010b4d17d1dd8920cca3530175de1be7a05ca24f1b8fedb6a464016d8d7b87390afe17cdf08bbb6c57c4c8a81176161265ad834fd341bd21

Download Submit
C:\Windows\InstallDir\Dehew.exe

Filesize
375KB

MD5
58f15794b6cb886072b48d5f7adcbe5d

SHA1
7dc06fe444373e306abd9d08cb5259ee5534318f

SHA256
e5f5ca11bc1b9933c77af6229c4deaa74c9e259f2fffe20cd9b1f17dff603641

SHA512
d296641d8408c61a010b4d17d1dd8920cca3530175de1be7a05ca24f1b8fedb6a464016d8d7b87390afe17cdf08bbb6c57c4c8a81176161265ad834fd341bd21

Download Submit
C:\Windows\InstallDir\Dehew.exe

Filesize
375KB

MD5
58f15794b6cb886072b48d5f7adcbe5d

SHA1
7dc06fe444373e306abd9d08cb5259ee5534318f

SHA256
e5f5ca11bc1b9933c77af6229c4deaa74c9e259f2fffe20cd9b1f17dff603641

SHA512
d296641d8408c61a010b4d17d1dd8920cca3530175de1be7a05ca24f1b8fedb6a464016d8d7b87390afe17cdf08bbb6c57c4c8a81176161265ad834fd341bd21

Download Submit
C:\Windows\InstallDir\Dehew.exe

Filesize
375KB

MD5
58f15794b6cb886072b48d5f7adcbe5d

SHA1
7dc06fe444373e306abd9d08cb5259ee5534318f

SHA256
e5f5ca11bc1b9933c77af6229c4deaa74c9e259f2fffe20cd9b1f17dff603641

SHA512
d296641d8408c61a010b4d17d1dd8920cca3530175de1be7a05ca24f1b8fedb6a464016d8d7b87390afe17cdf08bbb6c57c4c8a81176161265ad834fd341bd21

Download Submit
memory/1916-222-0x0000000010001000-0x00000000102CA000-memory.dmp

Filesize
2.8MB

Download
memory/1916-221-0x0000000010001000-0x00000000102CA000-memory.dmp

Filesize
2.8MB

Download
memory/2656-195-0x0000000010000000-0x000000001031C000-memory.dmp

Filesize
3.1MB

Download
memory/2656-200-0x0000000010001000-0x00000000102CA000-memory.dmp

Filesize
2.8MB

Download
memory/2656-196-0x0000000010000000-0x000000001031C000-memory.dmp

Filesize
3.1MB

Download
memory/2656-194-0x0000000010000000-0x000000001031C000-memory.dmp

Filesize
3.1MB

Download
memory/2656-198-0x00000000102CA000-0x000000001031B000-memory.dmp

Filesize
324KB

Download
memory/2656-199-0x0000000010001000-0x00000000102CA000-memory.dmp

Filesize
2.8MB

Download
memory/2880-153-0x0000000010000000-0x000000001031C000-memory.dmp

Filesize
3.1MB

Download
memory/3340-133-0x0000000010000000-0x000000001031C000-memory.dmp

Filesize
3.1MB

Download
memory/3340-134-0x0000000010000000-0x000000001031C000-memory.dmp

Filesize
3.1MB

Download
memory/3340-135-0x0000000010000000-0x000000001031C000-memory.dmp

Filesize
3.1MB

Download
memory/4100-173-0x0000000010000000-0x000000001031C000-memory.dmp

Filesize
3.1MB

Download
memory/4100-177-0x0000000010001000-0x00000000102CA000-memory.dmp

Filesize
2.8MB

Download
memory/4100-172-0x0000000010000000-0x000000001031C000-memory.dmp

Filesize
3.1MB

Download
memory/4100-176-0x0000000010001000-0x00000000102CA000-memory.dmp

Filesize
2.8MB

Download
memory/4100-175-0x00000000102CA000-0x000000001031B000-memory.dmp

Filesize
324KB

Download
memory/4100-174-0x0000000010000000-0x000000001031C000-memory.dmp

Filesize
3.1MB

Download
memory/4232-145-0x0000000010000000-0x000000001031C000-memory.dmp

Filesize
3.1MB

Download
memory/4232-148-0x00000000102CA000-0x000000001031B000-memory.dmp

Filesize
324KB

Download
memory/4232-147-0x0000000010000000-0x000000001031C000-memory.dmp

Filesize
3.1MB

Download
memory/4232-146-0x0000000010000000-0x000000001031C000-memory.dmp

Filesize
3.1MB

Download
memory/4232-149-0x0000000010001000-0x00000000102CA000-memory.dmp

Filesize
2.8MB

Download
memory/4232-150-0x00000000102CA000-0x000000001031B000-memory.dmp

Filesize
324KB

Download
memory/4232-151-0x0000000010001000-0x00000000102CA000-memory.dmp

Filesize
2.8MB

Download
memory/4232-154-0x0000000010001000-0x00000000102CA000-memory.dmp

Filesize
2.8MB

Download