Analysis
-
max time kernel
152s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
06-12-2022 10:59
Static task
static1
Behavioral task
behavioral1
Sample
e0253c98e65a797fcbe5addf6207d9ca3fed7d5c94214bf2c30741135eebc692.exe
Resource
win7-20220901-en
General
-
Target
e0253c98e65a797fcbe5addf6207d9ca3fed7d5c94214bf2c30741135eebc692.exe
-
Size
600KB
-
MD5
df36daf910c8049303329f0c68459e85
-
SHA1
043570af7cf8983c7d84b89d13eed833e5d7af53
-
SHA256
e0253c98e65a797fcbe5addf6207d9ca3fed7d5c94214bf2c30741135eebc692
-
SHA512
058043d1202a4aa9ea6c04f08b015e4872476967395f936c1cfdfb5ef4de2ed916df3de5c93fe8ba17794c4caacde9fb17406c7d4b66d5169ba388c166e56d65
-
SSDEEP
12288:McCD0ODKrDcsexNTFehkrUnh0olIOOCWjx5Ay9:McMeOHZqkrJolIOOCk39
Malware Config
Extracted
cybergate
v1.09.5
5
miwebhost.no-ip.info:81
78I7IMIKAK471E
-
enable_keylogger
true
-
enable_message_box
false
-
ftp_directory
./logs/
-
ftp_interval
30
-
injected_process
explorer.exe
-
install_dir
install
-
install_file
RAD.exe
-
install_flag
true
-
keylogger_enable_ftp
false
-
message_box_caption
Remote Administration anywhere in the world.
-
message_box_title
CyberGate
-
password
blowfish
-
regkey_hkcu
HKCU
-
regkey_hklm
HKLM
Signatures
-
Adds policy Run key to start application 2 TTPs 4 IoCs
Processes:
e0253c98e65a797fcbe5addf6207d9ca3fed7d5c94214bf2c30741135eebc692.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run e0253c98e65a797fcbe5addf6207d9ca3fed7d5c94214bf2c30741135eebc692.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\install\\RAD.exe" e0253c98e65a797fcbe5addf6207d9ca3fed7d5c94214bf2c30741135eebc692.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run e0253c98e65a797fcbe5addf6207d9ca3fed7d5c94214bf2c30741135eebc692.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\install\\RAD.exe" e0253c98e65a797fcbe5addf6207d9ca3fed7d5c94214bf2c30741135eebc692.exe -
Executes dropped EXE 2 IoCs
Processes:
RAD.exeRAD.exepid process 2512 RAD.exe 2264 RAD.exe -
Modifies Installed Components in the registry 2 TTPs 4 IoCs
Processes:
e0253c98e65a797fcbe5addf6207d9ca3fed7d5c94214bf2c30741135eebc692.exeexplorer.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7153307K-OGK4-AWNO-M8LR-6B24E3I66BEX}\StubPath = "C:\\Windows\\install\\RAD.exe Restart" e0253c98e65a797fcbe5addf6207d9ca3fed7d5c94214bf2c30741135eebc692.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{7153307K-OGK4-AWNO-M8LR-6B24E3I66BEX} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7153307K-OGK4-AWNO-M8LR-6B24E3I66BEX}\StubPath = "C:\\Windows\\install\\RAD.exe" explorer.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{7153307K-OGK4-AWNO-M8LR-6B24E3I66BEX} e0253c98e65a797fcbe5addf6207d9ca3fed7d5c94214bf2c30741135eebc692.exe -
Processes:
resource yara_rule behavioral2/memory/2068-140-0x0000000010410000-0x0000000010476000-memory.dmp upx behavioral2/memory/2068-145-0x0000000010480000-0x00000000104E6000-memory.dmp upx behavioral2/memory/3948-148-0x0000000010480000-0x00000000104E6000-memory.dmp upx behavioral2/memory/3948-149-0x0000000010480000-0x00000000104E6000-memory.dmp upx behavioral2/memory/2068-153-0x00000000104F0000-0x0000000010556000-memory.dmp upx behavioral2/memory/2068-158-0x0000000010560000-0x00000000105C6000-memory.dmp upx behavioral2/memory/4712-162-0x0000000010560000-0x00000000105C6000-memory.dmp upx behavioral2/memory/3948-175-0x0000000010480000-0x00000000104E6000-memory.dmp upx behavioral2/memory/4712-176-0x0000000010560000-0x00000000105C6000-memory.dmp upx -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
e0253c98e65a797fcbe5addf6207d9ca3fed7d5c94214bf2c30741135eebc692.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation e0253c98e65a797fcbe5addf6207d9ca3fed7d5c94214bf2c30741135eebc692.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
e0253c98e65a797fcbe5addf6207d9ca3fed7d5c94214bf2c30741135eebc692.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run e0253c98e65a797fcbe5addf6207d9ca3fed7d5c94214bf2c30741135eebc692.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\install\\RAD.exe" e0253c98e65a797fcbe5addf6207d9ca3fed7d5c94214bf2c30741135eebc692.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Run e0253c98e65a797fcbe5addf6207d9ca3fed7d5c94214bf2c30741135eebc692.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\install\\RAD.exe" e0253c98e65a797fcbe5addf6207d9ca3fed7d5c94214bf2c30741135eebc692.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
e0253c98e65a797fcbe5addf6207d9ca3fed7d5c94214bf2c30741135eebc692.exeRAD.exedescription pid process target process PID 4708 set thread context of 2068 4708 e0253c98e65a797fcbe5addf6207d9ca3fed7d5c94214bf2c30741135eebc692.exe e0253c98e65a797fcbe5addf6207d9ca3fed7d5c94214bf2c30741135eebc692.exe PID 2512 set thread context of 2264 2512 RAD.exe RAD.exe -
Drops file in Windows directory 4 IoCs
Processes:
e0253c98e65a797fcbe5addf6207d9ca3fed7d5c94214bf2c30741135eebc692.exee0253c98e65a797fcbe5addf6207d9ca3fed7d5c94214bf2c30741135eebc692.exedescription ioc process File created C:\Windows\install\RAD.exe e0253c98e65a797fcbe5addf6207d9ca3fed7d5c94214bf2c30741135eebc692.exe File opened for modification C:\Windows\install\RAD.exe e0253c98e65a797fcbe5addf6207d9ca3fed7d5c94214bf2c30741135eebc692.exe File opened for modification C:\Windows\install\RAD.exe e0253c98e65a797fcbe5addf6207d9ca3fed7d5c94214bf2c30741135eebc692.exe File opened for modification C:\Windows\install\ e0253c98e65a797fcbe5addf6207d9ca3fed7d5c94214bf2c30741135eebc692.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4288 2264 WerFault.exe RAD.exe -
Modifies registry class 1 IoCs
Processes:
e0253c98e65a797fcbe5addf6207d9ca3fed7d5c94214bf2c30741135eebc692.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ e0253c98e65a797fcbe5addf6207d9ca3fed7d5c94214bf2c30741135eebc692.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
e0253c98e65a797fcbe5addf6207d9ca3fed7d5c94214bf2c30741135eebc692.exepid process 2068 e0253c98e65a797fcbe5addf6207d9ca3fed7d5c94214bf2c30741135eebc692.exe 2068 e0253c98e65a797fcbe5addf6207d9ca3fed7d5c94214bf2c30741135eebc692.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
e0253c98e65a797fcbe5addf6207d9ca3fed7d5c94214bf2c30741135eebc692.exepid process 4712 e0253c98e65a797fcbe5addf6207d9ca3fed7d5c94214bf2c30741135eebc692.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
explorer.exee0253c98e65a797fcbe5addf6207d9ca3fed7d5c94214bf2c30741135eebc692.exedescription pid process Token: SeBackupPrivilege 3948 explorer.exe Token: SeRestorePrivilege 3948 explorer.exe Token: SeBackupPrivilege 4712 e0253c98e65a797fcbe5addf6207d9ca3fed7d5c94214bf2c30741135eebc692.exe Token: SeRestorePrivilege 4712 e0253c98e65a797fcbe5addf6207d9ca3fed7d5c94214bf2c30741135eebc692.exe Token: SeDebugPrivilege 4712 e0253c98e65a797fcbe5addf6207d9ca3fed7d5c94214bf2c30741135eebc692.exe Token: SeDebugPrivilege 4712 e0253c98e65a797fcbe5addf6207d9ca3fed7d5c94214bf2c30741135eebc692.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
e0253c98e65a797fcbe5addf6207d9ca3fed7d5c94214bf2c30741135eebc692.exepid process 2068 e0253c98e65a797fcbe5addf6207d9ca3fed7d5c94214bf2c30741135eebc692.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
e0253c98e65a797fcbe5addf6207d9ca3fed7d5c94214bf2c30741135eebc692.exeRAD.exepid process 4708 e0253c98e65a797fcbe5addf6207d9ca3fed7d5c94214bf2c30741135eebc692.exe 2512 RAD.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
e0253c98e65a797fcbe5addf6207d9ca3fed7d5c94214bf2c30741135eebc692.exee0253c98e65a797fcbe5addf6207d9ca3fed7d5c94214bf2c30741135eebc692.exedescription pid process target process PID 4708 wrote to memory of 2068 4708 e0253c98e65a797fcbe5addf6207d9ca3fed7d5c94214bf2c30741135eebc692.exe e0253c98e65a797fcbe5addf6207d9ca3fed7d5c94214bf2c30741135eebc692.exe PID 4708 wrote to memory of 2068 4708 e0253c98e65a797fcbe5addf6207d9ca3fed7d5c94214bf2c30741135eebc692.exe e0253c98e65a797fcbe5addf6207d9ca3fed7d5c94214bf2c30741135eebc692.exe PID 4708 wrote to memory of 2068 4708 e0253c98e65a797fcbe5addf6207d9ca3fed7d5c94214bf2c30741135eebc692.exe e0253c98e65a797fcbe5addf6207d9ca3fed7d5c94214bf2c30741135eebc692.exe PID 4708 wrote to memory of 2068 4708 e0253c98e65a797fcbe5addf6207d9ca3fed7d5c94214bf2c30741135eebc692.exe e0253c98e65a797fcbe5addf6207d9ca3fed7d5c94214bf2c30741135eebc692.exe PID 4708 wrote to memory of 2068 4708 e0253c98e65a797fcbe5addf6207d9ca3fed7d5c94214bf2c30741135eebc692.exe e0253c98e65a797fcbe5addf6207d9ca3fed7d5c94214bf2c30741135eebc692.exe PID 4708 wrote to memory of 2068 4708 e0253c98e65a797fcbe5addf6207d9ca3fed7d5c94214bf2c30741135eebc692.exe e0253c98e65a797fcbe5addf6207d9ca3fed7d5c94214bf2c30741135eebc692.exe PID 4708 wrote to memory of 2068 4708 e0253c98e65a797fcbe5addf6207d9ca3fed7d5c94214bf2c30741135eebc692.exe e0253c98e65a797fcbe5addf6207d9ca3fed7d5c94214bf2c30741135eebc692.exe PID 4708 wrote to memory of 2068 4708 e0253c98e65a797fcbe5addf6207d9ca3fed7d5c94214bf2c30741135eebc692.exe e0253c98e65a797fcbe5addf6207d9ca3fed7d5c94214bf2c30741135eebc692.exe PID 4708 wrote to memory of 2068 4708 e0253c98e65a797fcbe5addf6207d9ca3fed7d5c94214bf2c30741135eebc692.exe e0253c98e65a797fcbe5addf6207d9ca3fed7d5c94214bf2c30741135eebc692.exe PID 4708 wrote to memory of 2068 4708 e0253c98e65a797fcbe5addf6207d9ca3fed7d5c94214bf2c30741135eebc692.exe e0253c98e65a797fcbe5addf6207d9ca3fed7d5c94214bf2c30741135eebc692.exe PID 4708 wrote to memory of 2068 4708 e0253c98e65a797fcbe5addf6207d9ca3fed7d5c94214bf2c30741135eebc692.exe e0253c98e65a797fcbe5addf6207d9ca3fed7d5c94214bf2c30741135eebc692.exe PID 4708 wrote to memory of 2068 4708 e0253c98e65a797fcbe5addf6207d9ca3fed7d5c94214bf2c30741135eebc692.exe e0253c98e65a797fcbe5addf6207d9ca3fed7d5c94214bf2c30741135eebc692.exe PID 4708 wrote to memory of 2068 4708 e0253c98e65a797fcbe5addf6207d9ca3fed7d5c94214bf2c30741135eebc692.exe e0253c98e65a797fcbe5addf6207d9ca3fed7d5c94214bf2c30741135eebc692.exe PID 2068 wrote to memory of 2932 2068 e0253c98e65a797fcbe5addf6207d9ca3fed7d5c94214bf2c30741135eebc692.exe Explorer.EXE PID 2068 wrote to memory of 2932 2068 e0253c98e65a797fcbe5addf6207d9ca3fed7d5c94214bf2c30741135eebc692.exe Explorer.EXE PID 2068 wrote to memory of 2932 2068 e0253c98e65a797fcbe5addf6207d9ca3fed7d5c94214bf2c30741135eebc692.exe Explorer.EXE PID 2068 wrote to memory of 2932 2068 e0253c98e65a797fcbe5addf6207d9ca3fed7d5c94214bf2c30741135eebc692.exe Explorer.EXE PID 2068 wrote to memory of 2932 2068 e0253c98e65a797fcbe5addf6207d9ca3fed7d5c94214bf2c30741135eebc692.exe Explorer.EXE PID 2068 wrote to memory of 2932 2068 e0253c98e65a797fcbe5addf6207d9ca3fed7d5c94214bf2c30741135eebc692.exe Explorer.EXE PID 2068 wrote to memory of 2932 2068 e0253c98e65a797fcbe5addf6207d9ca3fed7d5c94214bf2c30741135eebc692.exe Explorer.EXE PID 2068 wrote to memory of 2932 2068 e0253c98e65a797fcbe5addf6207d9ca3fed7d5c94214bf2c30741135eebc692.exe Explorer.EXE PID 2068 wrote to memory of 2932 2068 e0253c98e65a797fcbe5addf6207d9ca3fed7d5c94214bf2c30741135eebc692.exe Explorer.EXE PID 2068 wrote to memory of 2932 2068 e0253c98e65a797fcbe5addf6207d9ca3fed7d5c94214bf2c30741135eebc692.exe Explorer.EXE PID 2068 wrote to memory of 2932 2068 e0253c98e65a797fcbe5addf6207d9ca3fed7d5c94214bf2c30741135eebc692.exe Explorer.EXE PID 2068 wrote to memory of 2932 2068 e0253c98e65a797fcbe5addf6207d9ca3fed7d5c94214bf2c30741135eebc692.exe Explorer.EXE PID 2068 wrote to memory of 2932 2068 e0253c98e65a797fcbe5addf6207d9ca3fed7d5c94214bf2c30741135eebc692.exe Explorer.EXE PID 2068 wrote to memory of 2932 2068 e0253c98e65a797fcbe5addf6207d9ca3fed7d5c94214bf2c30741135eebc692.exe Explorer.EXE PID 2068 wrote to memory of 2932 2068 e0253c98e65a797fcbe5addf6207d9ca3fed7d5c94214bf2c30741135eebc692.exe Explorer.EXE PID 2068 wrote to memory of 2932 2068 e0253c98e65a797fcbe5addf6207d9ca3fed7d5c94214bf2c30741135eebc692.exe Explorer.EXE PID 2068 wrote to memory of 2932 2068 e0253c98e65a797fcbe5addf6207d9ca3fed7d5c94214bf2c30741135eebc692.exe Explorer.EXE PID 2068 wrote to memory of 2932 2068 e0253c98e65a797fcbe5addf6207d9ca3fed7d5c94214bf2c30741135eebc692.exe Explorer.EXE PID 2068 wrote to memory of 2932 2068 e0253c98e65a797fcbe5addf6207d9ca3fed7d5c94214bf2c30741135eebc692.exe Explorer.EXE PID 2068 wrote to memory of 2932 2068 e0253c98e65a797fcbe5addf6207d9ca3fed7d5c94214bf2c30741135eebc692.exe Explorer.EXE PID 2068 wrote to memory of 2932 2068 e0253c98e65a797fcbe5addf6207d9ca3fed7d5c94214bf2c30741135eebc692.exe Explorer.EXE PID 2068 wrote to memory of 2932 2068 e0253c98e65a797fcbe5addf6207d9ca3fed7d5c94214bf2c30741135eebc692.exe Explorer.EXE PID 2068 wrote to memory of 2932 2068 e0253c98e65a797fcbe5addf6207d9ca3fed7d5c94214bf2c30741135eebc692.exe Explorer.EXE PID 2068 wrote to memory of 2932 2068 e0253c98e65a797fcbe5addf6207d9ca3fed7d5c94214bf2c30741135eebc692.exe Explorer.EXE PID 2068 wrote to memory of 2932 2068 e0253c98e65a797fcbe5addf6207d9ca3fed7d5c94214bf2c30741135eebc692.exe Explorer.EXE PID 2068 wrote to memory of 2932 2068 e0253c98e65a797fcbe5addf6207d9ca3fed7d5c94214bf2c30741135eebc692.exe Explorer.EXE PID 2068 wrote to memory of 2932 2068 e0253c98e65a797fcbe5addf6207d9ca3fed7d5c94214bf2c30741135eebc692.exe Explorer.EXE PID 2068 wrote to memory of 2932 2068 e0253c98e65a797fcbe5addf6207d9ca3fed7d5c94214bf2c30741135eebc692.exe Explorer.EXE PID 2068 wrote to memory of 2932 2068 e0253c98e65a797fcbe5addf6207d9ca3fed7d5c94214bf2c30741135eebc692.exe Explorer.EXE PID 2068 wrote to memory of 2932 2068 e0253c98e65a797fcbe5addf6207d9ca3fed7d5c94214bf2c30741135eebc692.exe Explorer.EXE PID 2068 wrote to memory of 2932 2068 e0253c98e65a797fcbe5addf6207d9ca3fed7d5c94214bf2c30741135eebc692.exe Explorer.EXE PID 2068 wrote to memory of 2932 2068 e0253c98e65a797fcbe5addf6207d9ca3fed7d5c94214bf2c30741135eebc692.exe Explorer.EXE PID 2068 wrote to memory of 2932 2068 e0253c98e65a797fcbe5addf6207d9ca3fed7d5c94214bf2c30741135eebc692.exe Explorer.EXE PID 2068 wrote to memory of 2932 2068 e0253c98e65a797fcbe5addf6207d9ca3fed7d5c94214bf2c30741135eebc692.exe Explorer.EXE PID 2068 wrote to memory of 2932 2068 e0253c98e65a797fcbe5addf6207d9ca3fed7d5c94214bf2c30741135eebc692.exe Explorer.EXE PID 2068 wrote to memory of 2932 2068 e0253c98e65a797fcbe5addf6207d9ca3fed7d5c94214bf2c30741135eebc692.exe Explorer.EXE PID 2068 wrote to memory of 2932 2068 e0253c98e65a797fcbe5addf6207d9ca3fed7d5c94214bf2c30741135eebc692.exe Explorer.EXE PID 2068 wrote to memory of 2932 2068 e0253c98e65a797fcbe5addf6207d9ca3fed7d5c94214bf2c30741135eebc692.exe Explorer.EXE PID 2068 wrote to memory of 2932 2068 e0253c98e65a797fcbe5addf6207d9ca3fed7d5c94214bf2c30741135eebc692.exe Explorer.EXE PID 2068 wrote to memory of 2932 2068 e0253c98e65a797fcbe5addf6207d9ca3fed7d5c94214bf2c30741135eebc692.exe Explorer.EXE PID 2068 wrote to memory of 2932 2068 e0253c98e65a797fcbe5addf6207d9ca3fed7d5c94214bf2c30741135eebc692.exe Explorer.EXE PID 2068 wrote to memory of 2932 2068 e0253c98e65a797fcbe5addf6207d9ca3fed7d5c94214bf2c30741135eebc692.exe Explorer.EXE PID 2068 wrote to memory of 2932 2068 e0253c98e65a797fcbe5addf6207d9ca3fed7d5c94214bf2c30741135eebc692.exe Explorer.EXE PID 2068 wrote to memory of 2932 2068 e0253c98e65a797fcbe5addf6207d9ca3fed7d5c94214bf2c30741135eebc692.exe Explorer.EXE PID 2068 wrote to memory of 2932 2068 e0253c98e65a797fcbe5addf6207d9ca3fed7d5c94214bf2c30741135eebc692.exe Explorer.EXE PID 2068 wrote to memory of 2932 2068 e0253c98e65a797fcbe5addf6207d9ca3fed7d5c94214bf2c30741135eebc692.exe Explorer.EXE PID 2068 wrote to memory of 2932 2068 e0253c98e65a797fcbe5addf6207d9ca3fed7d5c94214bf2c30741135eebc692.exe Explorer.EXE PID 2068 wrote to memory of 2932 2068 e0253c98e65a797fcbe5addf6207d9ca3fed7d5c94214bf2c30741135eebc692.exe Explorer.EXE PID 2068 wrote to memory of 2932 2068 e0253c98e65a797fcbe5addf6207d9ca3fed7d5c94214bf2c30741135eebc692.exe Explorer.EXE PID 2068 wrote to memory of 2932 2068 e0253c98e65a797fcbe5addf6207d9ca3fed7d5c94214bf2c30741135eebc692.exe Explorer.EXE PID 2068 wrote to memory of 2932 2068 e0253c98e65a797fcbe5addf6207d9ca3fed7d5c94214bf2c30741135eebc692.exe Explorer.EXE
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\e0253c98e65a797fcbe5addf6207d9ca3fed7d5c94214bf2c30741135eebc692.exe"C:\Users\Admin\AppData\Local\Temp\e0253c98e65a797fcbe5addf6207d9ca3fed7d5c94214bf2c30741135eebc692.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\e0253c98e65a797fcbe5addf6207d9ca3fed7d5c94214bf2c30741135eebc692.exe"C:\Users\Admin\AppData\Local\Temp\e0253c98e65a797fcbe5addf6207d9ca3fed7d5c94214bf2c30741135eebc692.exe"3⤵
- Adds policy Run key to start application
- Modifies Installed Components in the registry
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe4⤵
- Modifies Installed Components in the registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\e0253c98e65a797fcbe5addf6207d9ca3fed7d5c94214bf2c30741135eebc692.exe"C:\Users\Admin\AppData\Local\Temp\e0253c98e65a797fcbe5addf6207d9ca3fed7d5c94214bf2c30741135eebc692.exe"4⤵
- Checks computer location settings
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\install\RAD.exe"C:\Windows\install\RAD.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
C:\Windows\install\RAD.exe"C:\Windows\install\RAD.exe"6⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2264 -s 5567⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 2264 -ip 22641⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\Admin2.txtFilesize
225KB
MD54fe441f2f8dc81497acafbd38f5ae627
SHA167a1978b6f74faa9ed1794d7a1f4053cae51f538
SHA256967b1164b3bbb07d3e44905f7507bfab5ac94084dc391f44dca81e73266b6891
SHA512b70d037df95c4a789f13c34d9f896d12c0e5493aae809cefce80cf7f7a329761e7e1a9c697bbbeecc6d5c66b3e5b1cecc022ff44034a1af4fae1542227baf4db
-
C:\Windows\install\RAD.exeFilesize
600KB
MD5df36daf910c8049303329f0c68459e85
SHA1043570af7cf8983c7d84b89d13eed833e5d7af53
SHA256e0253c98e65a797fcbe5addf6207d9ca3fed7d5c94214bf2c30741135eebc692
SHA512058043d1202a4aa9ea6c04f08b015e4872476967395f936c1cfdfb5ef4de2ed916df3de5c93fe8ba17794c4caacde9fb17406c7d4b66d5169ba388c166e56d65
-
C:\Windows\install\RAD.exeFilesize
600KB
MD5df36daf910c8049303329f0c68459e85
SHA1043570af7cf8983c7d84b89d13eed833e5d7af53
SHA256e0253c98e65a797fcbe5addf6207d9ca3fed7d5c94214bf2c30741135eebc692
SHA512058043d1202a4aa9ea6c04f08b015e4872476967395f936c1cfdfb5ef4de2ed916df3de5c93fe8ba17794c4caacde9fb17406c7d4b66d5169ba388c166e56d65
-
C:\Windows\install\RAD.exeFilesize
600KB
MD5df36daf910c8049303329f0c68459e85
SHA1043570af7cf8983c7d84b89d13eed833e5d7af53
SHA256e0253c98e65a797fcbe5addf6207d9ca3fed7d5c94214bf2c30741135eebc692
SHA512058043d1202a4aa9ea6c04f08b015e4872476967395f936c1cfdfb5ef4de2ed916df3de5c93fe8ba17794c4caacde9fb17406c7d4b66d5169ba388c166e56d65
-
memory/2068-153-0x00000000104F0000-0x0000000010556000-memory.dmpFilesize
408KB
-
memory/2068-136-0x0000000000400000-0x0000000000451000-memory.dmpFilesize
324KB
-
memory/2068-140-0x0000000010410000-0x0000000010476000-memory.dmpFilesize
408KB
-
memory/2068-145-0x0000000010480000-0x00000000104E6000-memory.dmpFilesize
408KB
-
memory/2068-135-0x0000000000400000-0x0000000000451000-memory.dmpFilesize
324KB
-
memory/2068-163-0x0000000000400000-0x0000000000451000-memory.dmpFilesize
324KB
-
memory/2068-138-0x0000000000400000-0x0000000000451000-memory.dmpFilesize
324KB
-
memory/2068-137-0x0000000000400000-0x0000000000451000-memory.dmpFilesize
324KB
-
memory/2068-134-0x0000000000000000-mapping.dmp
-
memory/2068-158-0x0000000010560000-0x00000000105C6000-memory.dmpFilesize
408KB
-
memory/2264-168-0x0000000000000000-mapping.dmp
-
memory/2264-172-0x0000000000400000-0x0000000000451000-memory.dmpFilesize
324KB
-
memory/2264-173-0x0000000000400000-0x0000000000451000-memory.dmpFilesize
324KB
-
memory/2264-174-0x0000000000400000-0x0000000000451000-memory.dmpFilesize
324KB
-
memory/2512-164-0x0000000000000000-mapping.dmp
-
memory/3948-149-0x0000000010480000-0x00000000104E6000-memory.dmpFilesize
408KB
-
memory/3948-148-0x0000000010480000-0x00000000104E6000-memory.dmpFilesize
408KB
-
memory/3948-144-0x0000000000000000-mapping.dmp
-
memory/3948-175-0x0000000010480000-0x00000000104E6000-memory.dmpFilesize
408KB
-
memory/4712-157-0x0000000000000000-mapping.dmp
-
memory/4712-162-0x0000000010560000-0x00000000105C6000-memory.dmpFilesize
408KB
-
memory/4712-176-0x0000000010560000-0x00000000105C6000-memory.dmpFilesize
408KB