Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
101b7f039e2b...67.exe
windows7-x64
101b7f039e2b...67.exe
windows10-2004-x64
101bc393e569...5e.exe
windows7-x64
101bc393e569...5e.exe
windows10-2004-x64
101d25e50b1c...af.exe
windows7-x64
101d25e50b1c...af.exe
windows10-2004-x64
101d9b74bfd7...93.exe
windows7-x64
101d9b74bfd7...93.exe
windows10-2004-x64
101e62a268e2...29.exe
windows7-x64
101e62a268e2...29.exe
windows10-2004-x64
101ed6220c49...b1.exe
windows7-x64
101ed6220c49...b1.exe
windows10-2004-x64
101ee2d1e645...0a.exe
windows7-x64
101ee2d1e645...0a.exe
windows10-2004-x64
101f7f6ca2d7...0a.exe
windows7-x64
101f7f6ca2d7...0a.exe
windows10-2004-x64
101f9c6d71f4...5a.exe
windows7-x64
101f9c6d71f4...5a.exe
windows10-2004-x64
1020573eab37...45.exe
windows7-x64
1020573eab37...45.exe
windows10-2004-x64
1020d1c11837...7d.exe
windows7-x64
1020d1c11837...7d.exe
windows10-2004-x64
1020e0fb805b...2e.exe
windows7-x64
1020e0fb805b...2e.exe
windows10-2004-x64
102122f46b77...53.exe
windows7-x64
102122f46b77...53.exe
windows10-2004-x64
1021550d2e10...4f.exe
windows7-x64
1021550d2e10...4f.exe
windows10-2004-x64
10235041460f...03.exe
windows7-x64
1235041460f...03.exe
windows10-2004-x64
102356c0cbe0...de.doc
windows7-x64
102356c0cbe0...de.doc
windows10-2004-x64
10Analysis
-
max time kernel
150s -
max time network
160s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
24/07/2023, 06:32
Static task
static1
Behavioral task
behavioral1
Sample
1b7f039e2beb71993aa281ed8137e45b1b9708531b54e3b46d347baa3cc6fc67.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
1b7f039e2beb71993aa281ed8137e45b1b9708531b54e3b46d347baa3cc6fc67.exe
Resource
win10v2004-20230703-en
Behavioral task
behavioral3
Sample
1bc393e569289b6d134bec11c9898225745d2348a8a297bf5fcb3c73a64c385e.exe
Resource
win7-20230712-en
Behavioral task
behavioral4
Sample
1bc393e569289b6d134bec11c9898225745d2348a8a297bf5fcb3c73a64c385e.exe
Resource
win10v2004-20230703-en
Behavioral task
behavioral5
Sample
1d25e50b1c8cefb11b2ecc991be88c017d2cea828110f855e031da595684ceaf.exe
Resource
win7-20230712-en
Behavioral task
behavioral6
Sample
1d25e50b1c8cefb11b2ecc991be88c017d2cea828110f855e031da595684ceaf.exe
Resource
win10v2004-20230703-en
Behavioral task
behavioral7
Sample
1d9b74bfd7d922cfd20bc8197eb35c39ac6d4ed60b918b83133feb4ea7973c93.exe
Resource
win7-20230712-en
Behavioral task
behavioral8
Sample
1d9b74bfd7d922cfd20bc8197eb35c39ac6d4ed60b918b83133feb4ea7973c93.exe
Resource
win10v2004-20230703-en
Behavioral task
behavioral9
Sample
1e62a268e2511720e6cbf0f77780e3147ca2d060d75118d5e0984e3059593829.exe
Resource
win7-20230712-en
Behavioral task
behavioral10
Sample
1e62a268e2511720e6cbf0f77780e3147ca2d060d75118d5e0984e3059593829.exe
Resource
win10v2004-20230703-en
Behavioral task
behavioral11
Sample
1ed6220c4999b159446756990086fc270642dcba035ed1ea45126e3dd081c0b1.exe
Resource
win7-20230712-en
Behavioral task
behavioral12
Sample
1ed6220c4999b159446756990086fc270642dcba035ed1ea45126e3dd081c0b1.exe
Resource
win10v2004-20230703-en
Behavioral task
behavioral13
Sample
1ee2d1e645387a169bdc6a904e47b6a2546e4d34546733b4aedb7bb22371f90a.exe
Resource
win7-20230712-en
Behavioral task
behavioral14
Sample
1ee2d1e645387a169bdc6a904e47b6a2546e4d34546733b4aedb7bb22371f90a.exe
Resource
win10v2004-20230703-en
Behavioral task
behavioral15
Sample
1f7f6ca2d7c0431e07e974158a6e23129fdc19994f687be71daa68aa82b4510a.exe
Resource
win7-20230712-en
Behavioral task
behavioral16
Sample
1f7f6ca2d7c0431e07e974158a6e23129fdc19994f687be71daa68aa82b4510a.exe
Resource
win10v2004-20230703-en
Behavioral task
behavioral17
Sample
1f9c6d71f4eba009486692e8734d2ed0ac586ad0310811c8e938985bc0385e5a.exe
Resource
win7-20230712-en
Behavioral task
behavioral18
Sample
1f9c6d71f4eba009486692e8734d2ed0ac586ad0310811c8e938985bc0385e5a.exe
Resource
win10v2004-20230703-en
Behavioral task
behavioral19
Sample
20573eab37017ad0c5ad37228fdcc5e6f5c64dddbb275f50ee4dcc8dc3d43145.exe
Resource
win7-20230712-en
Behavioral task
behavioral20
Sample
20573eab37017ad0c5ad37228fdcc5e6f5c64dddbb275f50ee4dcc8dc3d43145.exe
Resource
win10v2004-20230703-en
Behavioral task
behavioral21
Sample
20d1c1183762918f8077963504cb6971ff65352a34197d534a4d40fe68e0c97d.exe
Resource
win7-20230712-en
Behavioral task
behavioral22
Sample
20d1c1183762918f8077963504cb6971ff65352a34197d534a4d40fe68e0c97d.exe
Resource
win10v2004-20230703-en
Behavioral task
behavioral23
Sample
20e0fb805bd4501e8361c68b8a2ab67fced87ebfd25c9012e42d38aa83a4bd2e.exe
Resource
win7-20230712-en
Behavioral task
behavioral24
Sample
20e0fb805bd4501e8361c68b8a2ab67fced87ebfd25c9012e42d38aa83a4bd2e.exe
Resource
win10v2004-20230703-en
Behavioral task
behavioral25
Sample
2122f46b7744ea7cabea57095f4cdcbcdcf176232cfae669e7119c5bd607bf53.exe
Resource
win7-20230712-en
Behavioral task
behavioral26
Sample
2122f46b7744ea7cabea57095f4cdcbcdcf176232cfae669e7119c5bd607bf53.exe
Resource
win10v2004-20230703-en
Behavioral task
behavioral27
Sample
21550d2e10232016be388e50579cb7767f0e6c3e2283bab6b4e552077eee834f.exe
Resource
win7-20230712-en
Behavioral task
behavioral28
Sample
21550d2e10232016be388e50579cb7767f0e6c3e2283bab6b4e552077eee834f.exe
Resource
win10v2004-20230703-en
Behavioral task
behavioral29
Sample
235041460fe585e7438589fc41e393df65545cb735907908eaaa4103d1564f03.exe
Resource
win7-20230712-en
Behavioral task
behavioral30
Sample
235041460fe585e7438589fc41e393df65545cb735907908eaaa4103d1564f03.exe
Resource
win10v2004-20230703-en
Behavioral task
behavioral31
Sample
2356c0cbe09585e025c3fdfae9a004c20f3f4d9d0ff4a89d5add85974f0afade.doc
Resource
win7-20230712-en
Behavioral task
behavioral32
Sample
2356c0cbe09585e025c3fdfae9a004c20f3f4d9d0ff4a89d5add85974f0afade.doc
Resource
win10v2004-20230703-en
General
-
Target
235041460fe585e7438589fc41e393df65545cb735907908eaaa4103d1564f03.exe
-
Size
845KB
-
MD5
effea511a4db1847bf104df4470e5b06
-
SHA1
ce111a8c18d2dbc8fb9c80db1d737f3610b1aa5c
-
SHA256
235041460fe585e7438589fc41e393df65545cb735907908eaaa4103d1564f03
-
SHA512
a61aa12cf938033c63816c7102e29fb2a74e516bd845a423205ef650e1beeeaae04fcf40a8d9057b11518fc1bf486d9522919ac646d3a3bd8ab7eba552c955b8
-
SSDEEP
24576:mSGE0FpCqi/Uv7XtIONwzLduiE1RP0G886D:mSCwZ87XtRytEytD
Malware Config
Signatures
-
MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
-
MassLogger Main payload 6 IoCs
resource yara_rule behavioral30/memory/4068-154-0x0000000000400000-0x0000000000541000-memory.dmp family_masslogger behavioral30/memory/4068-155-0x0000000000400000-0x0000000000541000-memory.dmp family_masslogger behavioral30/memory/4068-156-0x0000000000B50000-0x0000000000BEA000-memory.dmp family_masslogger behavioral30/memory/4068-158-0x0000000000B50000-0x0000000000BEA000-memory.dmp family_masslogger behavioral30/memory/4068-174-0x0000000076F10000-0x0000000077000000-memory.dmp family_masslogger behavioral30/memory/4068-190-0x0000000000400000-0x0000000000541000-memory.dmp family_masslogger -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\Control Panel\International\Geo\Nation jsdhdh.exe -
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wen.vbs notepad.exe -
Executes dropped EXE 3 IoCs
pid Process 548 jsdhdh.exe 4068 jsdhdh.exe 4040 jsdhdh.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral30/memory/4068-146-0x0000000000400000-0x0000000000541000-memory.dmp upx behavioral30/memory/4068-151-0x0000000000400000-0x0000000000541000-memory.dmp upx behavioral30/memory/4068-154-0x0000000000400000-0x0000000000541000-memory.dmp upx behavioral30/memory/4068-155-0x0000000000400000-0x0000000000541000-memory.dmp upx -
Accesses Microsoft Outlook profiles 1 TTPs 42 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 jsdhdh.exe Key queried \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 jsdhdh.exe Key queried \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook jsdhdh.exe Key opened \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 jsdhdh.exe Key queried \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook jsdhdh.exe Key queried \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook jsdhdh.exe Key created \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook jsdhdh.exe Key created \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook jsdhdh.exe Key created \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 jsdhdh.exe Key created \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 jsdhdh.exe Key queried \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 jsdhdh.exe Key opened \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 jsdhdh.exe Key queried \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook jsdhdh.exe Key created \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 jsdhdh.exe Key opened \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 jsdhdh.exe Key created \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 jsdhdh.exe Key opened \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 jsdhdh.exe Key created \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 jsdhdh.exe Key created \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook jsdhdh.exe Key created \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 jsdhdh.exe Key opened \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 jsdhdh.exe Key queried \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook jsdhdh.exe Key created \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook jsdhdh.exe Key queried \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook jsdhdh.exe Key created \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 jsdhdh.exe Key created \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 jsdhdh.exe Key created \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook jsdhdh.exe Key created \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 jsdhdh.exe Key created \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 jsdhdh.exe Key created \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 jsdhdh.exe Key created \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 jsdhdh.exe Key queried \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 jsdhdh.exe Key opened \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 jsdhdh.exe Key created \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 jsdhdh.exe Key queried \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook jsdhdh.exe Key created \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 jsdhdh.exe Key queried \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 jsdhdh.exe Key queried \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 jsdhdh.exe Key created \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook jsdhdh.exe Key queried \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 jsdhdh.exe Key created \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook jsdhdh.exe Key queried \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 jsdhdh.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 38 api.ipify.org -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 548 set thread context of 4068 548 jsdhdh.exe 89 -
NTFS ADS 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\appdata\jsdhdh.exe:ZoneIdentifier notepad.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 4068 jsdhdh.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4676 235041460fe585e7438589fc41e393df65545cb735907908eaaa4103d1564f03.exe 4676 235041460fe585e7438589fc41e393df65545cb735907908eaaa4103d1564f03.exe 548 jsdhdh.exe 548 jsdhdh.exe 4040 jsdhdh.exe 4040 jsdhdh.exe 4040 jsdhdh.exe 4040 jsdhdh.exe 4040 jsdhdh.exe 4040 jsdhdh.exe 4040 jsdhdh.exe 4040 jsdhdh.exe 4040 jsdhdh.exe 4040 jsdhdh.exe 4040 jsdhdh.exe 4040 jsdhdh.exe 4040 jsdhdh.exe 4040 jsdhdh.exe 4040 jsdhdh.exe 4040 jsdhdh.exe 4040 jsdhdh.exe 4040 jsdhdh.exe 4040 jsdhdh.exe 4040 jsdhdh.exe 4040 jsdhdh.exe 4040 jsdhdh.exe 4040 jsdhdh.exe 4040 jsdhdh.exe 4040 jsdhdh.exe 4040 jsdhdh.exe 4040 jsdhdh.exe 4040 jsdhdh.exe 4040 jsdhdh.exe 4040 jsdhdh.exe 4040 jsdhdh.exe 4040 jsdhdh.exe 4040 jsdhdh.exe 4040 jsdhdh.exe 4040 jsdhdh.exe 4040 jsdhdh.exe 4040 jsdhdh.exe 4040 jsdhdh.exe 4040 jsdhdh.exe 4040 jsdhdh.exe 4040 jsdhdh.exe 4040 jsdhdh.exe 4040 jsdhdh.exe 4040 jsdhdh.exe 4040 jsdhdh.exe 4040 jsdhdh.exe 4040 jsdhdh.exe 4040 jsdhdh.exe 4040 jsdhdh.exe 4040 jsdhdh.exe 4040 jsdhdh.exe 4040 jsdhdh.exe 4040 jsdhdh.exe 4040 jsdhdh.exe 4040 jsdhdh.exe 4040 jsdhdh.exe 4040 jsdhdh.exe 4040 jsdhdh.exe 4040 jsdhdh.exe 4040 jsdhdh.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 548 jsdhdh.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4068 jsdhdh.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4068 jsdhdh.exe -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 4676 wrote to memory of 1352 4676 235041460fe585e7438589fc41e393df65545cb735907908eaaa4103d1564f03.exe 87 PID 4676 wrote to memory of 1352 4676 235041460fe585e7438589fc41e393df65545cb735907908eaaa4103d1564f03.exe 87 PID 4676 wrote to memory of 1352 4676 235041460fe585e7438589fc41e393df65545cb735907908eaaa4103d1564f03.exe 87 PID 4676 wrote to memory of 1352 4676 235041460fe585e7438589fc41e393df65545cb735907908eaaa4103d1564f03.exe 87 PID 4676 wrote to memory of 1352 4676 235041460fe585e7438589fc41e393df65545cb735907908eaaa4103d1564f03.exe 87 PID 1352 wrote to memory of 548 1352 notepad.exe 88 PID 1352 wrote to memory of 548 1352 notepad.exe 88 PID 1352 wrote to memory of 548 1352 notepad.exe 88 PID 548 wrote to memory of 4068 548 jsdhdh.exe 89 PID 548 wrote to memory of 4068 548 jsdhdh.exe 89 PID 548 wrote to memory of 4068 548 jsdhdh.exe 89 PID 548 wrote to memory of 4040 548 jsdhdh.exe 90 PID 548 wrote to memory of 4040 548 jsdhdh.exe 90 PID 548 wrote to memory of 4040 548 jsdhdh.exe 90 -
outlook_office_path 1 IoCs
description ioc Process Key queried \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 jsdhdh.exe -
outlook_win_path 1 IoCs
description ioc Process Key queried \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 jsdhdh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\235041460fe585e7438589fc41e393df65545cb735907908eaaa4103d1564f03.exe"C:\Users\Admin\AppData\Local\Temp\235041460fe585e7438589fc41e393df65545cb735907908eaaa4103d1564f03.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4676 -
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"2⤵
- Drops startup file
- NTFS ADS
- Suspicious use of WriteProcessMemory
PID:1352 -
C:\Users\Admin\AppData\Roaming\appdata\jsdhdh.exe"C:\Users\Admin\AppData\Roaming\appdata\jsdhdh.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:548 -
C:\Users\Admin\AppData\Roaming\appdata\jsdhdh.exe"C:\Users\Admin\AppData\Roaming\appdata\jsdhdh.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- outlook_office_path
- outlook_win_path
PID:4068
-
-
C:\Users\Admin\AppData\Roaming\appdata\jsdhdh.exe"C:\Users\Admin\AppData\Roaming\appdata\jsdhdh.exe" 2 4068 2406459844⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4040
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
845KB
MD5effea511a4db1847bf104df4470e5b06
SHA1ce111a8c18d2dbc8fb9c80db1d737f3610b1aa5c
SHA256235041460fe585e7438589fc41e393df65545cb735907908eaaa4103d1564f03
SHA512a61aa12cf938033c63816c7102e29fb2a74e516bd845a423205ef650e1beeeaae04fcf40a8d9057b11518fc1bf486d9522919ac646d3a3bd8ab7eba552c955b8
-
Filesize
845KB
MD5effea511a4db1847bf104df4470e5b06
SHA1ce111a8c18d2dbc8fb9c80db1d737f3610b1aa5c
SHA256235041460fe585e7438589fc41e393df65545cb735907908eaaa4103d1564f03
SHA512a61aa12cf938033c63816c7102e29fb2a74e516bd845a423205ef650e1beeeaae04fcf40a8d9057b11518fc1bf486d9522919ac646d3a3bd8ab7eba552c955b8
-
Filesize
845KB
MD5effea511a4db1847bf104df4470e5b06
SHA1ce111a8c18d2dbc8fb9c80db1d737f3610b1aa5c
SHA256235041460fe585e7438589fc41e393df65545cb735907908eaaa4103d1564f03
SHA512a61aa12cf938033c63816c7102e29fb2a74e516bd845a423205ef650e1beeeaae04fcf40a8d9057b11518fc1bf486d9522919ac646d3a3bd8ab7eba552c955b8
-
Filesize
845KB
MD5effea511a4db1847bf104df4470e5b06
SHA1ce111a8c18d2dbc8fb9c80db1d737f3610b1aa5c
SHA256235041460fe585e7438589fc41e393df65545cb735907908eaaa4103d1564f03
SHA512a61aa12cf938033c63816c7102e29fb2a74e516bd845a423205ef650e1beeeaae04fcf40a8d9057b11518fc1bf486d9522919ac646d3a3bd8ab7eba552c955b8