Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
170s -
max time network
508s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
05/12/2022, 19:24
Static task
static1
Behavioral task
behavioral1
Sample
e5f5ca11bc1b9933c77af6229c4deaa74c9e259f2fffe20cd9b1f17dff603641.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
e5f5ca11bc1b9933c77af6229c4deaa74c9e259f2fffe20cd9b1f17dff603641.exe
Resource
win10v2004-20221111-en
General
-
Target
e5f5ca11bc1b9933c77af6229c4deaa74c9e259f2fffe20cd9b1f17dff603641.exe
-
Size
375KB
-
MD5
58f15794b6cb886072b48d5f7adcbe5d
-
SHA1
7dc06fe444373e306abd9d08cb5259ee5534318f
-
SHA256
e5f5ca11bc1b9933c77af6229c4deaa74c9e259f2fffe20cd9b1f17dff603641
-
SHA512
d296641d8408c61a010b4d17d1dd8920cca3530175de1be7a05ca24f1b8fedb6a464016d8d7b87390afe17cdf08bbb6c57c4c8a81176161265ad834fd341bd21
-
SSDEEP
6144:i3TqoIetsvlJ4DGBdu2YpJ3qOe4yufYspgrGQVUAt5OCHmQRGRCnpGj:elI88z4yBU/3qO5yx1rGrAt5OCHjgC0j
Malware Config
Signatures
-
Executes dropped EXE 7 IoCs
pid Process 1280 Dehew.exe 4100 Dehew.exe 3456 Dehew.exe 2656 Dehew.exe 4112 Dehew.exe 1916 Dehew.exe 2660 Dehew.exe -
Modifies Installed Components in the registry 2 TTPs 10 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\Dehew.exe restart" e5f5ca11bc1b9933c77af6229c4deaa74c9e259f2fffe20cd9b1f17dff603641.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2} svchost.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2} Dehew.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2} Dehew.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Dehew.exe restart" Dehew.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2} Dehew.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Dehew.exe restart" Dehew.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2} e5f5ca11bc1b9933c77af6229c4deaa74c9e259f2fffe20cd9b1f17dff603641.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\Dehew.exe restart" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Dehew.exe restart" Dehew.exe -
resource yara_rule behavioral2/memory/3340-133-0x0000000010000000-0x000000001031C000-memory.dmp upx behavioral2/memory/3340-134-0x0000000010000000-0x000000001031C000-memory.dmp upx behavioral2/memory/3340-135-0x0000000010000000-0x000000001031C000-memory.dmp upx behavioral2/memory/4232-145-0x0000000010000000-0x000000001031C000-memory.dmp upx behavioral2/memory/4232-146-0x0000000010000000-0x000000001031C000-memory.dmp upx behavioral2/memory/4232-147-0x0000000010000000-0x000000001031C000-memory.dmp upx behavioral2/memory/2880-153-0x0000000010000000-0x000000001031C000-memory.dmp upx behavioral2/memory/4100-172-0x0000000010000000-0x000000001031C000-memory.dmp upx behavioral2/memory/4100-173-0x0000000010000000-0x000000001031C000-memory.dmp upx behavioral2/memory/4100-174-0x0000000010000000-0x000000001031C000-memory.dmp upx behavioral2/memory/2656-194-0x0000000010000000-0x000000001031C000-memory.dmp upx behavioral2/memory/2656-196-0x0000000010000000-0x000000001031C000-memory.dmp upx behavioral2/memory/2656-195-0x0000000010000000-0x000000001031C000-memory.dmp upx -
Adds Run key to start application 2 TTPs 24 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run svchost.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run Dehew.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Dehew.exe" Dehew.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run Dehew.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run Dehew.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Dehew.exe" Dehew.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Dehew.exe" e5f5ca11bc1b9933c77af6229c4deaa74c9e259f2fffe20cd9b1f17dff603641.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Dehew.exe" e5f5ca11bc1b9933c77af6229c4deaa74c9e259f2fffe20cd9b1f17dff603641.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Dehew.exe" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Dehew.exe" Dehew.exe Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Windows\CurrentVersion\Run Dehew.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Dehew.exe" Dehew.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Dehew.exe" Dehew.exe Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Windows\CurrentVersion\Run e5f5ca11bc1b9933c77af6229c4deaa74c9e259f2fffe20cd9b1f17dff603641.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Users\\Admin\\AppData\\Local\\Temp\\e5f5ca11bc1b9933c77af6229c4deaa74c9e259f2fffe20cd9b1f17dff603641.exe" e5f5ca11bc1b9933c77af6229c4deaa74c9e259f2fffe20cd9b1f17dff603641.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Dehew.exe" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Dehew.exe" Dehew.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run e5f5ca11bc1b9933c77af6229c4deaa74c9e259f2fffe20cd9b1f17dff603641.exe Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Windows\CurrentVersion\Run svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Dehew.exe" Dehew.exe Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Windows\CurrentVersion\Run Dehew.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\Dehew.exe" Dehew.exe Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Windows\CurrentVersion\Run Dehew.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Dehew.exe" Dehew.exe -
Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 3128 set thread context of 4232 3128 e5f5ca11bc1b9933c77af6229c4deaa74c9e259f2fffe20cd9b1f17dff603641.exe 78 PID 1280 set thread context of 4100 1280 Dehew.exe 84 PID 3456 set thread context of 2656 3456 Dehew.exe 88 PID 4112 set thread context of 1916 4112 Dehew.exe 92 -
Drops file in Windows directory 5 IoCs
description ioc Process File created C:\Windows\InstallDir\Dehew.exe Dehew.exe File created C:\Windows\InstallDir\Dehew.exe e5f5ca11bc1b9933c77af6229c4deaa74c9e259f2fffe20cd9b1f17dff603641.exe File opened for modification C:\Windows\InstallDir\Dehew.exe e5f5ca11bc1b9933c77af6229c4deaa74c9e259f2fffe20cd9b1f17dff603641.exe File created C:\Windows\InstallDir\Dehew.exe Dehew.exe File created C:\Windows\InstallDir\Dehew.exe Dehew.exe -
Checks SCSI registry key(s) 3 TTPs 32 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom Dehew.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 Dehew.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000 Dehew.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags Dehew.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\ConfigFlags Dehew.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 Dehew.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 e5f5ca11bc1b9933c77af6229c4deaa74c9e259f2fffe20cd9b1f17dff603641.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 Dehew.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 Dehew.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\ConfigFlags Dehew.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom Dehew.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\ConfigFlags e5f5ca11bc1b9933c77af6229c4deaa74c9e259f2fffe20cd9b1f17dff603641.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom Dehew.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom Dehew.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 Dehew.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom Dehew.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 Dehew.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000 Dehew.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom e5f5ca11bc1b9933c77af6229c4deaa74c9e259f2fffe20cd9b1f17dff603641.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 Dehew.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000 Dehew.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags Dehew.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 Dehew.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags Dehew.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000 e5f5ca11bc1b9933c77af6229c4deaa74c9e259f2fffe20cd9b1f17dff603641.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom Dehew.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\ConfigFlags Dehew.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 e5f5ca11bc1b9933c77af6229c4deaa74c9e259f2fffe20cd9b1f17dff603641.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags e5f5ca11bc1b9933c77af6229c4deaa74c9e259f2fffe20cd9b1f17dff603641.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 Dehew.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 e5f5ca11bc1b9933c77af6229c4deaa74c9e259f2fffe20cd9b1f17dff603641.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom e5f5ca11bc1b9933c77af6229c4deaa74c9e259f2fffe20cd9b1f17dff603641.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 3128 e5f5ca11bc1b9933c77af6229c4deaa74c9e259f2fffe20cd9b1f17dff603641.exe 3128 e5f5ca11bc1b9933c77af6229c4deaa74c9e259f2fffe20cd9b1f17dff603641.exe 1280 Dehew.exe 1280 Dehew.exe 3456 Dehew.exe 3456 Dehew.exe 4112 Dehew.exe 4112 Dehew.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 4232 e5f5ca11bc1b9933c77af6229c4deaa74c9e259f2fffe20cd9b1f17dff603641.exe 4100 Dehew.exe 2656 Dehew.exe 1916 Dehew.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3128 wrote to memory of 3340 3128 e5f5ca11bc1b9933c77af6229c4deaa74c9e259f2fffe20cd9b1f17dff603641.exe 76 PID 3128 wrote to memory of 3340 3128 e5f5ca11bc1b9933c77af6229c4deaa74c9e259f2fffe20cd9b1f17dff603641.exe 76 PID 3128 wrote to memory of 3340 3128 e5f5ca11bc1b9933c77af6229c4deaa74c9e259f2fffe20cd9b1f17dff603641.exe 76 PID 3128 wrote to memory of 3340 3128 e5f5ca11bc1b9933c77af6229c4deaa74c9e259f2fffe20cd9b1f17dff603641.exe 76 PID 3128 wrote to memory of 3340 3128 e5f5ca11bc1b9933c77af6229c4deaa74c9e259f2fffe20cd9b1f17dff603641.exe 76 PID 3128 wrote to memory of 3340 3128 e5f5ca11bc1b9933c77af6229c4deaa74c9e259f2fffe20cd9b1f17dff603641.exe 76 PID 3128 wrote to memory of 2028 3128 e5f5ca11bc1b9933c77af6229c4deaa74c9e259f2fffe20cd9b1f17dff603641.exe 77 PID 3128 wrote to memory of 2028 3128 e5f5ca11bc1b9933c77af6229c4deaa74c9e259f2fffe20cd9b1f17dff603641.exe 77 PID 3128 wrote to memory of 2028 3128 e5f5ca11bc1b9933c77af6229c4deaa74c9e259f2fffe20cd9b1f17dff603641.exe 77 PID 3128 wrote to memory of 2028 3128 e5f5ca11bc1b9933c77af6229c4deaa74c9e259f2fffe20cd9b1f17dff603641.exe 77 PID 3128 wrote to memory of 2028 3128 e5f5ca11bc1b9933c77af6229c4deaa74c9e259f2fffe20cd9b1f17dff603641.exe 77 PID 3128 wrote to memory of 2028 3128 e5f5ca11bc1b9933c77af6229c4deaa74c9e259f2fffe20cd9b1f17dff603641.exe 77 PID 3128 wrote to memory of 4232 3128 e5f5ca11bc1b9933c77af6229c4deaa74c9e259f2fffe20cd9b1f17dff603641.exe 78 PID 3128 wrote to memory of 4232 3128 e5f5ca11bc1b9933c77af6229c4deaa74c9e259f2fffe20cd9b1f17dff603641.exe 78 PID 3128 wrote to memory of 4232 3128 e5f5ca11bc1b9933c77af6229c4deaa74c9e259f2fffe20cd9b1f17dff603641.exe 78 PID 3128 wrote to memory of 4232 3128 e5f5ca11bc1b9933c77af6229c4deaa74c9e259f2fffe20cd9b1f17dff603641.exe 78 PID 3128 wrote to memory of 4232 3128 e5f5ca11bc1b9933c77af6229c4deaa74c9e259f2fffe20cd9b1f17dff603641.exe 78 PID 3128 wrote to memory of 4232 3128 e5f5ca11bc1b9933c77af6229c4deaa74c9e259f2fffe20cd9b1f17dff603641.exe 78 PID 3128 wrote to memory of 4232 3128 e5f5ca11bc1b9933c77af6229c4deaa74c9e259f2fffe20cd9b1f17dff603641.exe 78 PID 3128 wrote to memory of 4232 3128 e5f5ca11bc1b9933c77af6229c4deaa74c9e259f2fffe20cd9b1f17dff603641.exe 78 PID 4232 wrote to memory of 2880 4232 e5f5ca11bc1b9933c77af6229c4deaa74c9e259f2fffe20cd9b1f17dff603641.exe 80 PID 4232 wrote to memory of 2880 4232 e5f5ca11bc1b9933c77af6229c4deaa74c9e259f2fffe20cd9b1f17dff603641.exe 80 PID 4232 wrote to memory of 2880 4232 e5f5ca11bc1b9933c77af6229c4deaa74c9e259f2fffe20cd9b1f17dff603641.exe 80 PID 4232 wrote to memory of 2880 4232 e5f5ca11bc1b9933c77af6229c4deaa74c9e259f2fffe20cd9b1f17dff603641.exe 80 PID 2880 wrote to memory of 1280 2880 svchost.exe 81 PID 2880 wrote to memory of 1280 2880 svchost.exe 81 PID 2880 wrote to memory of 1280 2880 svchost.exe 81 PID 1280 wrote to memory of 3368 1280 Dehew.exe 82 PID 1280 wrote to memory of 3368 1280 Dehew.exe 82 PID 1280 wrote to memory of 3368 1280 Dehew.exe 82 PID 1280 wrote to memory of 3368 1280 Dehew.exe 82 PID 1280 wrote to memory of 3368 1280 Dehew.exe 82 PID 1280 wrote to memory of 3368 1280 Dehew.exe 82 PID 1280 wrote to memory of 2372 1280 Dehew.exe 83 PID 1280 wrote to memory of 2372 1280 Dehew.exe 83 PID 1280 wrote to memory of 2372 1280 Dehew.exe 83 PID 1280 wrote to memory of 2372 1280 Dehew.exe 83 PID 1280 wrote to memory of 2372 1280 Dehew.exe 83 PID 1280 wrote to memory of 2372 1280 Dehew.exe 83 PID 1280 wrote to memory of 4100 1280 Dehew.exe 84 PID 1280 wrote to memory of 4100 1280 Dehew.exe 84 PID 1280 wrote to memory of 4100 1280 Dehew.exe 84 PID 1280 wrote to memory of 4100 1280 Dehew.exe 84 PID 1280 wrote to memory of 4100 1280 Dehew.exe 84 PID 1280 wrote to memory of 4100 1280 Dehew.exe 84 PID 1280 wrote to memory of 4100 1280 Dehew.exe 84 PID 1280 wrote to memory of 4100 1280 Dehew.exe 84 PID 2880 wrote to memory of 3456 2880 svchost.exe 85 PID 2880 wrote to memory of 3456 2880 svchost.exe 85 PID 2880 wrote to memory of 3456 2880 svchost.exe 85 PID 3456 wrote to memory of 1812 3456 Dehew.exe 86 PID 3456 wrote to memory of 1812 3456 Dehew.exe 86 PID 3456 wrote to memory of 1812 3456 Dehew.exe 86 PID 3456 wrote to memory of 1812 3456 Dehew.exe 86 PID 3456 wrote to memory of 1812 3456 Dehew.exe 86 PID 3456 wrote to memory of 1812 3456 Dehew.exe 86 PID 3456 wrote to memory of 4556 3456 Dehew.exe 87 PID 3456 wrote to memory of 4556 3456 Dehew.exe 87 PID 3456 wrote to memory of 4556 3456 Dehew.exe 87 PID 3456 wrote to memory of 4556 3456 Dehew.exe 87 PID 3456 wrote to memory of 4556 3456 Dehew.exe 87 PID 3456 wrote to memory of 4556 3456 Dehew.exe 87 PID 3456 wrote to memory of 2656 3456 Dehew.exe 88 PID 3456 wrote to memory of 2656 3456 Dehew.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\e5f5ca11bc1b9933c77af6229c4deaa74c9e259f2fffe20cd9b1f17dff603641.exe"C:\Users\Admin\AppData\Local\Temp\e5f5ca11bc1b9933c77af6229c4deaa74c9e259f2fffe20cd9b1f17dff603641.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3128 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"2⤵PID:3340
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"2⤵PID:2028
-
-
C:\Users\Admin\AppData\Local\Temp\e5f5ca11bc1b9933c77af6229c4deaa74c9e259f2fffe20cd9b1f17dff603641.exeC:\Users\Admin\AppData\Local\Temp\e5f5ca11bc1b9933c77af6229c4deaa74c9e259f2fffe20cd9b1f17dff603641.exe2⤵
- Modifies Installed Components in the registry
- Adds Run key to start application
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4232 -
C:\Windows\SysWOW64\svchost.exesvchost.exe3⤵
- Modifies Installed Components in the registry
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2880 -
C:\Windows\InstallDir\Dehew.exe"C:\Windows\InstallDir\Dehew.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1280 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"5⤵PID:3368
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"5⤵PID:2372
-
-
C:\Windows\InstallDir\Dehew.exeC:\Windows\InstallDir\Dehew.exe5⤵
- Executes dropped EXE
- Modifies Installed Components in the registry
- Adds Run key to start application
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of SetWindowsHookEx
PID:4100
-
-
-
C:\Windows\InstallDir\Dehew.exe"C:\Windows\InstallDir\Dehew.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3456 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"5⤵PID:1812
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"5⤵PID:4556
-
-
C:\Windows\InstallDir\Dehew.exeC:\Windows\InstallDir\Dehew.exe5⤵
- Executes dropped EXE
- Modifies Installed Components in the registry
- Adds Run key to start application
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of SetWindowsHookEx
PID:2656
-
-
-
C:\Windows\InstallDir\Dehew.exe"C:\Windows\InstallDir\Dehew.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
PID:4112 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"5⤵PID:3552
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"5⤵PID:2112
-
-
C:\Windows\InstallDir\Dehew.exeC:\Windows\InstallDir\Dehew.exe5⤵
- Executes dropped EXE
- Modifies Installed Components in the registry
- Adds Run key to start application
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of SetWindowsHookEx
PID:1916
-
-
-
C:\Windows\InstallDir\Dehew.exe"C:\Windows\InstallDir\Dehew.exe"4⤵
- Executes dropped EXE
PID:2660 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"5⤵PID:4620
-
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
375KB
MD558f15794b6cb886072b48d5f7adcbe5d
SHA17dc06fe444373e306abd9d08cb5259ee5534318f
SHA256e5f5ca11bc1b9933c77af6229c4deaa74c9e259f2fffe20cd9b1f17dff603641
SHA512d296641d8408c61a010b4d17d1dd8920cca3530175de1be7a05ca24f1b8fedb6a464016d8d7b87390afe17cdf08bbb6c57c4c8a81176161265ad834fd341bd21
-
Filesize
375KB
MD558f15794b6cb886072b48d5f7adcbe5d
SHA17dc06fe444373e306abd9d08cb5259ee5534318f
SHA256e5f5ca11bc1b9933c77af6229c4deaa74c9e259f2fffe20cd9b1f17dff603641
SHA512d296641d8408c61a010b4d17d1dd8920cca3530175de1be7a05ca24f1b8fedb6a464016d8d7b87390afe17cdf08bbb6c57c4c8a81176161265ad834fd341bd21
-
Filesize
375KB
MD558f15794b6cb886072b48d5f7adcbe5d
SHA17dc06fe444373e306abd9d08cb5259ee5534318f
SHA256e5f5ca11bc1b9933c77af6229c4deaa74c9e259f2fffe20cd9b1f17dff603641
SHA512d296641d8408c61a010b4d17d1dd8920cca3530175de1be7a05ca24f1b8fedb6a464016d8d7b87390afe17cdf08bbb6c57c4c8a81176161265ad834fd341bd21
-
Filesize
375KB
MD558f15794b6cb886072b48d5f7adcbe5d
SHA17dc06fe444373e306abd9d08cb5259ee5534318f
SHA256e5f5ca11bc1b9933c77af6229c4deaa74c9e259f2fffe20cd9b1f17dff603641
SHA512d296641d8408c61a010b4d17d1dd8920cca3530175de1be7a05ca24f1b8fedb6a464016d8d7b87390afe17cdf08bbb6c57c4c8a81176161265ad834fd341bd21
-
Filesize
375KB
MD558f15794b6cb886072b48d5f7adcbe5d
SHA17dc06fe444373e306abd9d08cb5259ee5534318f
SHA256e5f5ca11bc1b9933c77af6229c4deaa74c9e259f2fffe20cd9b1f17dff603641
SHA512d296641d8408c61a010b4d17d1dd8920cca3530175de1be7a05ca24f1b8fedb6a464016d8d7b87390afe17cdf08bbb6c57c4c8a81176161265ad834fd341bd21
-
Filesize
375KB
MD558f15794b6cb886072b48d5f7adcbe5d
SHA17dc06fe444373e306abd9d08cb5259ee5534318f
SHA256e5f5ca11bc1b9933c77af6229c4deaa74c9e259f2fffe20cd9b1f17dff603641
SHA512d296641d8408c61a010b4d17d1dd8920cca3530175de1be7a05ca24f1b8fedb6a464016d8d7b87390afe17cdf08bbb6c57c4c8a81176161265ad834fd341bd21
-
Filesize
375KB
MD558f15794b6cb886072b48d5f7adcbe5d
SHA17dc06fe444373e306abd9d08cb5259ee5534318f
SHA256e5f5ca11bc1b9933c77af6229c4deaa74c9e259f2fffe20cd9b1f17dff603641
SHA512d296641d8408c61a010b4d17d1dd8920cca3530175de1be7a05ca24f1b8fedb6a464016d8d7b87390afe17cdf08bbb6c57c4c8a81176161265ad834fd341bd21
-
Filesize
375KB
MD558f15794b6cb886072b48d5f7adcbe5d
SHA17dc06fe444373e306abd9d08cb5259ee5534318f
SHA256e5f5ca11bc1b9933c77af6229c4deaa74c9e259f2fffe20cd9b1f17dff603641
SHA512d296641d8408c61a010b4d17d1dd8920cca3530175de1be7a05ca24f1b8fedb6a464016d8d7b87390afe17cdf08bbb6c57c4c8a81176161265ad834fd341bd21
-
Filesize
375KB
MD558f15794b6cb886072b48d5f7adcbe5d
SHA17dc06fe444373e306abd9d08cb5259ee5534318f
SHA256e5f5ca11bc1b9933c77af6229c4deaa74c9e259f2fffe20cd9b1f17dff603641
SHA512d296641d8408c61a010b4d17d1dd8920cca3530175de1be7a05ca24f1b8fedb6a464016d8d7b87390afe17cdf08bbb6c57c4c8a81176161265ad834fd341bd21
-
Filesize
375KB
MD558f15794b6cb886072b48d5f7adcbe5d
SHA17dc06fe444373e306abd9d08cb5259ee5534318f
SHA256e5f5ca11bc1b9933c77af6229c4deaa74c9e259f2fffe20cd9b1f17dff603641
SHA512d296641d8408c61a010b4d17d1dd8920cca3530175de1be7a05ca24f1b8fedb6a464016d8d7b87390afe17cdf08bbb6c57c4c8a81176161265ad834fd341bd21