Overview
overview
3Static
static
1processhac...in.zip
windows10-1703-x64
1x64/ProcessHacker.exe
windows10-1703-x64
1x64/kproce...er.exe
windows10-1703-x64
x64/peview.exe
windows10-1703-x64
3x64/plugin...ls.dll
windows10-1703-x64
1x64/plugin...ns.dll
windows10-1703-x64
1x64/plugin...es.dll
windows10-1703-x64
1x64/plugin...ls.dll
windows10-1703-x64
1x64/plugin...es.dll
windows10-1703-x64
1x64/plugin...ls.dll
windows10-1703-x64
1x64/plugin...ks.dll
windows10-1703-x64
1x64/plugin...rt.dll
windows10-1703-x64
1x64/plugin...us.dll
windows10-1703-x64
1x64/plugin...er.dll
windows10-1703-x64
1x64/plugin...es.dll
windows10-1703-x64
1x64/plugin...er.dll
windows10-1703-x64
1x86/ProcessHacker.exe
windows10-1703-x64
1x86/kproce...er.exe
windows10-1703-x64
x86/peview.exe
windows10-1703-x64
3x86/plugin...ls.dll
windows10-1703-x64
1x86/plugin...ns.dll
windows10-1703-x64
1x86/plugin...es.dll
windows10-1703-x64
1x86/plugin...ls.dll
windows10-1703-x64
1x86/plugin...es.dll
windows10-1703-x64
1x86/plugin...ls.dll
windows10-1703-x64
1x86/plugin...ks.dll
windows10-1703-x64
1x86/plugin...rt.dll
windows10-1703-x64
1x86/plugin...us.dll
windows10-1703-x64
1x86/plugin...er.dll
windows10-1703-x64
1x86/plugin...es.dll
windows10-1703-x64
1x86/plugin...er.dll
windows10-1703-x64
1Analysis
-
max time kernel
149s -
max time network
148s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system -
submitted
01-03-2023 03:03
Static task
static1
Behavioral task
behavioral1
Sample
processhacker-2.39-bin.zip
Resource
win10-20230220-en
windows10-1703-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
x64/ProcessHacker.exe
Resource
win10-20230220-en
windows10-1703-x64
8 signatures
150 seconds
Behavioral task
behavioral3
Sample
x64/kprocesshacker.exe
Resource
win10-20230220-en
windows10-1703-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
x64/peview.exe
Resource
win10-20230220-en
windows10-1703-x64
4 signatures
150 seconds
Behavioral task
behavioral5
Sample
x64/plugins/DotNetTools.dll
Resource
win10-20230220-en
windows10-1703-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
x64/plugins/ExtendedNotifications.dll
Resource
win10-20230220-en
windows10-1703-x64
0 signatures
150 seconds
Behavioral task
behavioral7
Sample
x64/plugins/ExtendedServices.dll
Resource
win10-20230220-en
windows10-1703-x64
0 signatures
150 seconds
Behavioral task
behavioral8
Sample
x64/plugins/ExtendedTools.dll
Resource
win10-20230220-en
windows10-1703-x64
0 signatures
150 seconds
Behavioral task
behavioral9
Sample
x64/plugins/HardwareDevices.dll
Resource
win10-20230220-en
windows10-1703-x64
0 signatures
150 seconds
Behavioral task
behavioral10
Sample
x64/plugins/NetworkTools.dll
Resource
win10-20230220-en
windows10-1703-x64
0 signatures
150 seconds
Behavioral task
behavioral11
Sample
x64/plugins/OnlineChecks.dll
Resource
win10-20230220-en
windows10-1703-x64
0 signatures
150 seconds
Behavioral task
behavioral12
Sample
x64/plugins/SbieSupport.dll
Resource
win10-20230220-en
windows10-1703-x64
0 signatures
150 seconds
Behavioral task
behavioral13
Sample
x64/plugins/ToolStatus.dll
Resource
win10-20230220-en
windows10-1703-x64
0 signatures
150 seconds
Behavioral task
behavioral14
Sample
x64/plugins/Updater.dll
Resource
win10-20230220-en
windows10-1703-x64
0 signatures
150 seconds
Behavioral task
behavioral15
Sample
x64/plugins/UserNotes.dll
Resource
win10-20230220-en
windows10-1703-x64
0 signatures
150 seconds
Behavioral task
behavioral16
Sample
x64/plugins/WindowExplorer.dll
Resource
win10-20230220-en
windows10-1703-x64
0 signatures
150 seconds
Behavioral task
behavioral17
Sample
x86/ProcessHacker.exe
Resource
win10-20230220-en
windows10-1703-x64
7 signatures
150 seconds
Behavioral task
behavioral18
Sample
x86/kprocesshacker.exe
Resource
win10-20230220-en
windows10-1703-x64
0 signatures
150 seconds
Behavioral task
behavioral19
Sample
x86/peview.exe
Resource
win10-20230220-en
windows10-1703-x64
4 signatures
150 seconds
Behavioral task
behavioral20
Sample
x86/plugins/DotNetTools.dll
Resource
win10-20230220-en
windows10-1703-x64
1 signatures
150 seconds
Behavioral task
behavioral21
Sample
x86/plugins/ExtendedNotifications.dll
Resource
win10-20230220-en
windows10-1703-x64
1 signatures
150 seconds
Behavioral task
behavioral22
Sample
x86/plugins/ExtendedServices.dll
Resource
win10-20230220-en
windows10-1703-x64
1 signatures
150 seconds
Behavioral task
behavioral23
Sample
x86/plugins/ExtendedTools.dll
Resource
win10-20230220-en
windows10-1703-x64
1 signatures
150 seconds
Behavioral task
behavioral24
Sample
x86/plugins/HardwareDevices.dll
Resource
win10-20230220-en
windows10-1703-x64
1 signatures
150 seconds
Behavioral task
behavioral25
Sample
x86/plugins/NetworkTools.dll
Resource
win10-20230220-en
windows10-1703-x64
1 signatures
150 seconds
Behavioral task
behavioral26
Sample
x86/plugins/OnlineChecks.dll
Resource
win10-20230220-en
windows10-1703-x64
1 signatures
150 seconds
Behavioral task
behavioral27
Sample
x86/plugins/SbieSupport.dll
Resource
win10-20230220-en
windows10-1703-x64
1 signatures
150 seconds
Behavioral task
behavioral28
Sample
x86/plugins/ToolStatus.dll
Resource
win10-20230220-en
windows10-1703-x64
1 signatures
150 seconds
Behavioral task
behavioral29
Sample
x86/plugins/Updater.dll
Resource
win10-20230220-en
windows10-1703-x64
1 signatures
150 seconds
Behavioral task
behavioral30
Sample
x86/plugins/UserNotes.dll
Resource
win10-20230220-en
windows10-1703-x64
1 signatures
150 seconds
Behavioral task
behavioral31
Sample
x86/plugins/WindowExplorer.dll
Resource
win10-20230220-en
windows10-1703-x64
1 signatures
150 seconds
General
-
Target
x86/ProcessHacker.exe
-
Size
1.4MB
-
MD5
68f9b52895f4d34e74112f3129b3b00d
-
SHA1
c5e2018bf7c0f314fed4fd7fe7e69fa2e648359e
-
SHA256
d4a0fe56316a2c45b9ba9ac1005363309a3edc7acf9e4df64d326a0ff273e80f
-
SHA512
1cd875f9d0301b14645ea608fe61560a229ee395fa061f32675c3d84e41916998f887278d8497a5e875be22ba8fcbcfcbd878a5e2ed1746dc75430b7aed5fede
-
SSDEEP
24576:fsmjNvgp+pxECAucO9iWFT0z7rLuUhFP3MGX:PFgpAiIiWdzUz35X
Score
1/10
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ProcessHacker.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz ProcessHacker.exe -
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f6200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa62000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 ProcessHacker.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 190000000100000010000000749966cecc95c1874194ca7203f9b6200f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d4304000000010000001000000087ce0b7b2a0e4900e158719b37a893722000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 ProcessHacker.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 5c00000001000000040000000008000004000000010000001000000087ce0b7b2a0e4900e158719b37a893720300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f6200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 ProcessHacker.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25 ProcessHacker.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 040000000100000010000000d474de575c39b2d39c8583c5c065498a0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000007431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25190000000100000010000000ba4f3972e7aed9dccdc210db59da13c92000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a ProcessHacker.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 5c000000010000000400000000080000190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc36200000001000000200000007431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8040000000100000010000000d474de575c39b2d39c8583c5c065498a2000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a ProcessHacker.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43 ProcessHacker.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 0f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d432000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 ProcessHacker.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2896 ProcessHacker.exe 2896 ProcessHacker.exe 2896 ProcessHacker.exe 2896 ProcessHacker.exe 2896 ProcessHacker.exe 2896 ProcessHacker.exe 2896 ProcessHacker.exe 2896 ProcessHacker.exe 2896 ProcessHacker.exe 2896 ProcessHacker.exe 2896 ProcessHacker.exe 2896 ProcessHacker.exe 2896 ProcessHacker.exe 2896 ProcessHacker.exe 2896 ProcessHacker.exe 2896 ProcessHacker.exe 2896 ProcessHacker.exe 2896 ProcessHacker.exe 2896 ProcessHacker.exe 2896 ProcessHacker.exe 2896 ProcessHacker.exe 2896 ProcessHacker.exe 2896 ProcessHacker.exe 2896 ProcessHacker.exe 2896 ProcessHacker.exe 2896 ProcessHacker.exe 2896 ProcessHacker.exe 2896 ProcessHacker.exe 2896 ProcessHacker.exe 2896 ProcessHacker.exe 2896 ProcessHacker.exe 2896 ProcessHacker.exe 2896 ProcessHacker.exe 2896 ProcessHacker.exe 2896 ProcessHacker.exe 2896 ProcessHacker.exe 2896 ProcessHacker.exe 2896 ProcessHacker.exe 2896 ProcessHacker.exe 2896 ProcessHacker.exe 2896 ProcessHacker.exe 2896 ProcessHacker.exe 2896 ProcessHacker.exe 2896 ProcessHacker.exe 2896 ProcessHacker.exe 2896 ProcessHacker.exe 2896 ProcessHacker.exe 2896 ProcessHacker.exe 2896 ProcessHacker.exe 2896 ProcessHacker.exe 2896 ProcessHacker.exe 2896 ProcessHacker.exe 2896 ProcessHacker.exe 2896 ProcessHacker.exe 2896 ProcessHacker.exe 2896 ProcessHacker.exe 2896 ProcessHacker.exe 2896 ProcessHacker.exe 2896 ProcessHacker.exe 2896 ProcessHacker.exe 2896 ProcessHacker.exe 2896 ProcessHacker.exe 2896 ProcessHacker.exe 2896 ProcessHacker.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2896 ProcessHacker.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeDebugPrivilege 2896 ProcessHacker.exe Token: SeIncBasePriorityPrivilege 2896 ProcessHacker.exe Token: 33 2896 ProcessHacker.exe Token: SeLoadDriverPrivilege 2896 ProcessHacker.exe Token: SeProfSingleProcessPrivilege 2896 ProcessHacker.exe Token: SeRestorePrivilege 2896 ProcessHacker.exe Token: SeShutdownPrivilege 2896 ProcessHacker.exe Token: SeTakeOwnershipPrivilege 2896 ProcessHacker.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2896 ProcessHacker.exe 2896 ProcessHacker.exe 2896 ProcessHacker.exe 2896 ProcessHacker.exe 2896 ProcessHacker.exe 2896 ProcessHacker.exe 2896 ProcessHacker.exe 2896 ProcessHacker.exe 2896 ProcessHacker.exe 2896 ProcessHacker.exe 2896 ProcessHacker.exe 2896 ProcessHacker.exe 2896 ProcessHacker.exe 2896 ProcessHacker.exe 2896 ProcessHacker.exe 2896 ProcessHacker.exe 2896 ProcessHacker.exe 2896 ProcessHacker.exe 2896 ProcessHacker.exe 2896 ProcessHacker.exe 2896 ProcessHacker.exe 2896 ProcessHacker.exe 2896 ProcessHacker.exe 2896 ProcessHacker.exe 2896 ProcessHacker.exe 2896 ProcessHacker.exe 2896 ProcessHacker.exe 2896 ProcessHacker.exe 2896 ProcessHacker.exe 2896 ProcessHacker.exe 2896 ProcessHacker.exe 2896 ProcessHacker.exe 2896 ProcessHacker.exe 2896 ProcessHacker.exe 2896 ProcessHacker.exe 2896 ProcessHacker.exe 2896 ProcessHacker.exe 2896 ProcessHacker.exe 2896 ProcessHacker.exe 2896 ProcessHacker.exe 2896 ProcessHacker.exe 2896 ProcessHacker.exe 2896 ProcessHacker.exe 2896 ProcessHacker.exe 2896 ProcessHacker.exe 2896 ProcessHacker.exe 2896 ProcessHacker.exe 2896 ProcessHacker.exe 2896 ProcessHacker.exe 2896 ProcessHacker.exe 2896 ProcessHacker.exe 2896 ProcessHacker.exe 2896 ProcessHacker.exe 2896 ProcessHacker.exe 2896 ProcessHacker.exe 2896 ProcessHacker.exe 2896 ProcessHacker.exe 2896 ProcessHacker.exe 2896 ProcessHacker.exe 2896 ProcessHacker.exe 2896 ProcessHacker.exe 2896 ProcessHacker.exe 2896 ProcessHacker.exe 2896 ProcessHacker.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2896 ProcessHacker.exe 2896 ProcessHacker.exe 2896 ProcessHacker.exe 2896 ProcessHacker.exe 2896 ProcessHacker.exe 2896 ProcessHacker.exe 2896 ProcessHacker.exe 2896 ProcessHacker.exe 2896 ProcessHacker.exe 2896 ProcessHacker.exe 2896 ProcessHacker.exe 2896 ProcessHacker.exe 2896 ProcessHacker.exe 2896 ProcessHacker.exe 2896 ProcessHacker.exe 2896 ProcessHacker.exe 2896 ProcessHacker.exe 2896 ProcessHacker.exe 2896 ProcessHacker.exe 2896 ProcessHacker.exe 2896 ProcessHacker.exe 2896 ProcessHacker.exe 2896 ProcessHacker.exe 2896 ProcessHacker.exe 2896 ProcessHacker.exe 2896 ProcessHacker.exe 2896 ProcessHacker.exe 2896 ProcessHacker.exe 2896 ProcessHacker.exe 2896 ProcessHacker.exe 2896 ProcessHacker.exe 2896 ProcessHacker.exe 2896 ProcessHacker.exe 2896 ProcessHacker.exe 2896 ProcessHacker.exe 2896 ProcessHacker.exe 2896 ProcessHacker.exe 2896 ProcessHacker.exe 2896 ProcessHacker.exe 2896 ProcessHacker.exe 2896 ProcessHacker.exe 2896 ProcessHacker.exe 2896 ProcessHacker.exe 2896 ProcessHacker.exe 2896 ProcessHacker.exe 2896 ProcessHacker.exe 2896 ProcessHacker.exe 2896 ProcessHacker.exe 2896 ProcessHacker.exe 2896 ProcessHacker.exe 2896 ProcessHacker.exe 2896 ProcessHacker.exe 2896 ProcessHacker.exe 2896 ProcessHacker.exe 2896 ProcessHacker.exe 2896 ProcessHacker.exe 2896 ProcessHacker.exe 2896 ProcessHacker.exe 2896 ProcessHacker.exe 2896 ProcessHacker.exe 2896 ProcessHacker.exe 2896 ProcessHacker.exe 2896 ProcessHacker.exe 2896 ProcessHacker.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\x86\ProcessHacker.exe"C:\Users\Admin\AppData\Local\Temp\x86\ProcessHacker.exe"1⤵
- Checks processor information in registry
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2896