Analysis
-
max time kernel
120s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20231020-en -
resource tags
arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system -
submitted
25-11-2023 22:58
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
98b80e7fed4b3492ca1fb4e44fc8b239739e66679a92e27d9a37a1968b9d1c4c.exe
Resource
win7-20231020-en
windows7-x64
15 signatures
150 seconds
Behavioral task
behavioral2
Sample
98b80e7fed4b3492ca1fb4e44fc8b239739e66679a92e27d9a37a1968b9d1c4c.exe
Resource
win10v2004-20231025-en
windows10-2004-x64
11 signatures
150 seconds
General
-
Target
98b80e7fed4b3492ca1fb4e44fc8b239739e66679a92e27d9a37a1968b9d1c4c.exe
-
Size
4.1MB
-
MD5
38ba300995f10a2fc95bdf4428ca6405
-
SHA1
2a03a9350c7ec86b66ea48042a7e61c88a3db7eb
-
SHA256
98b80e7fed4b3492ca1fb4e44fc8b239739e66679a92e27d9a37a1968b9d1c4c
-
SHA512
7c08878434aa53ae269e5a4e98111e5f2e4f477e9d1ae719df3ca13f32f64aa3b3ccadbad008282309d116452e5e4b39018d4e5802daf26e5d50cc1083a97de2
-
SSDEEP
49152:d9utIMHSlVNEPS5B8riKy3hEPLna+NiW56wCpVHJNt/Mn+s8KuqGaX0ToIBAUZL1:7jMS5+riKyePLVNP6THJvJBAUZLjh
Score
10/10
Malware Config
Signatures
-
Generic Chinese Botnet
A botnet originating from China which is currently unnamed publicly.
-
Chinese Botnet payload 1 IoCs
resource yara_rule behavioral1/memory/2256-8-0x0000000010000000-0x0000000010018000-memory.dmp unk_chinese_botnet -
Executes dropped EXE 3 IoCs
pid Process 2256 shibie.exe 2144 Inkfbls.exe 2036 Inkfbls.exe -
Loads dropped DLL 2 IoCs
pid Process 1736 98b80e7fed4b3492ca1fb4e44fc8b239739e66679a92e27d9a37a1968b9d1c4c.exe 1736 98b80e7fed4b3492ca1fb4e44fc8b239739e66679a92e27d9a37a1968b9d1c4c.exe -
Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\K: shibie.exe File opened (read-only) \??\L: shibie.exe File opened (read-only) \??\O: shibie.exe File opened (read-only) \??\R: shibie.exe File opened (read-only) \??\V: shibie.exe File opened (read-only) \??\G: shibie.exe File opened (read-only) \??\H: shibie.exe File opened (read-only) \??\I: shibie.exe File opened (read-only) \??\Y: shibie.exe File opened (read-only) \??\Z: shibie.exe File opened (read-only) \??\Q: shibie.exe File opened (read-only) \??\S: shibie.exe File opened (read-only) \??\E: shibie.exe File opened (read-only) \??\M: shibie.exe File opened (read-only) \??\P: shibie.exe File opened (read-only) \??\W: shibie.exe File opened (read-only) \??\X: shibie.exe File opened (read-only) \??\B: shibie.exe File opened (read-only) \??\J: shibie.exe File opened (read-only) \??\T: shibie.exe File opened (read-only) \??\N: shibie.exe File opened (read-only) \??\U: shibie.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat Inkfbls.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat Inkfbls.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\Microsoft Kwmcwq\Inkfbls.exe shibie.exe File opened for modification C:\Program Files (x86)\Microsoft Kwmcwq\Inkfbls.exe shibie.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz shibie.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 shibie.exe -
Modifies data under HKEY_USERS 49 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" Inkfbls.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{E64B05A1-05B8-4670-9529-032B4B04CCC7} Inkfbls.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad Inkfbls.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\1a-52-bb-42-ab-53\WpadDecision = "0" Inkfbls.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings Inkfbls.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ Inkfbls.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 Inkfbls.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" Inkfbls.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{E64B05A1-05B8-4670-9529-032B4B04CCC7}\1a-52-bb-42-ab-53 Inkfbls.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{E64B05A1-05B8-4670-9529-032B4B04CCC7}\WpadDecisionTime = a08615fdf21fda01 Inkfbls.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\1a-52-bb-42-ab-53 Inkfbls.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\1a-52-bb-42-ab-53\WpadDecisionReason = "1" Inkfbls.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" Inkfbls.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\1a-52-bb-42-ab-53\WpadDecision = "0" Inkfbls.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 Inkfbls.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{E64B05A1-05B8-4670-9529-032B4B04CCC7}\WpadDecisionReason = "1" Inkfbls.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\1a-52-bb-42-ab-53\WpadDecisionReason = "1" Inkfbls.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\1a-52-bb-42-ab-53\WpadDecisionTime = 40cc6503f31fda01 Inkfbls.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings Inkfbls.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{E64B05A1-05B8-4670-9529-032B4B04CCC7}\WpadDecision = "0" Inkfbls.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{E64B05A1-05B8-4670-9529-032B4B04CCC7}\WpadNetworkName = "Network 3" Inkfbls.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" Inkfbls.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\1a-52-bb-42-ab-53\WpadDetectedUrl Inkfbls.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f001d000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 Inkfbls.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections Inkfbls.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad Inkfbls.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix Inkfbls.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" Inkfbls.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\1a-52-bb-42-ab-53 Inkfbls.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" Inkfbls.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" Inkfbls.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{E64B05A1-05B8-4670-9529-032B4B04CCC7}\1a-52-bb-42-ab-53 Inkfbls.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" Inkfbls.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" Inkfbls.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f001d000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 Inkfbls.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix Inkfbls.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings Inkfbls.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\1a-52-bb-42-ab-53\WpadDecisionTime = a08615fdf21fda01 Inkfbls.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{E64B05A1-05B8-4670-9529-032B4B04CCC7}\WpadDecisionTime = 40cc6503f31fda01 Inkfbls.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{E64B05A1-05B8-4670-9529-032B4B04CCC7} Inkfbls.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ Inkfbls.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000004000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f001d000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 Inkfbls.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\1a-52-bb-42-ab-53\WpadDecisionTime = a08615fdf21fda01 Inkfbls.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings Inkfbls.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{E64B05A1-05B8-4670-9529-032B4B04CCC7}\WpadDecisionReason = "1" Inkfbls.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{E64B05A1-05B8-4670-9529-032B4B04CCC7}\WpadNetworkName = "Network 3" Inkfbls.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections Inkfbls.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" Inkfbls.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{E64B05A1-05B8-4670-9529-032B4B04CCC7}\WpadDecision = "0" Inkfbls.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1736 98b80e7fed4b3492ca1fb4e44fc8b239739e66679a92e27d9a37a1968b9d1c4c.exe 2256 shibie.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1736 98b80e7fed4b3492ca1fb4e44fc8b239739e66679a92e27d9a37a1968b9d1c4c.exe -
Suspicious use of AdjustPrivilegeToken 56 IoCs
description pid Process Token: 33 1736 98b80e7fed4b3492ca1fb4e44fc8b239739e66679a92e27d9a37a1968b9d1c4c.exe Token: SeIncBasePriorityPrivilege 1736 98b80e7fed4b3492ca1fb4e44fc8b239739e66679a92e27d9a37a1968b9d1c4c.exe Token: 33 1736 98b80e7fed4b3492ca1fb4e44fc8b239739e66679a92e27d9a37a1968b9d1c4c.exe Token: SeIncBasePriorityPrivilege 1736 98b80e7fed4b3492ca1fb4e44fc8b239739e66679a92e27d9a37a1968b9d1c4c.exe Token: 33 1736 98b80e7fed4b3492ca1fb4e44fc8b239739e66679a92e27d9a37a1968b9d1c4c.exe Token: SeIncBasePriorityPrivilege 1736 98b80e7fed4b3492ca1fb4e44fc8b239739e66679a92e27d9a37a1968b9d1c4c.exe Token: 33 1736 98b80e7fed4b3492ca1fb4e44fc8b239739e66679a92e27d9a37a1968b9d1c4c.exe Token: SeIncBasePriorityPrivilege 1736 98b80e7fed4b3492ca1fb4e44fc8b239739e66679a92e27d9a37a1968b9d1c4c.exe Token: 33 1736 98b80e7fed4b3492ca1fb4e44fc8b239739e66679a92e27d9a37a1968b9d1c4c.exe Token: SeIncBasePriorityPrivilege 1736 98b80e7fed4b3492ca1fb4e44fc8b239739e66679a92e27d9a37a1968b9d1c4c.exe Token: 33 1736 98b80e7fed4b3492ca1fb4e44fc8b239739e66679a92e27d9a37a1968b9d1c4c.exe Token: SeIncBasePriorityPrivilege 1736 98b80e7fed4b3492ca1fb4e44fc8b239739e66679a92e27d9a37a1968b9d1c4c.exe Token: 33 1736 98b80e7fed4b3492ca1fb4e44fc8b239739e66679a92e27d9a37a1968b9d1c4c.exe Token: SeIncBasePriorityPrivilege 1736 98b80e7fed4b3492ca1fb4e44fc8b239739e66679a92e27d9a37a1968b9d1c4c.exe Token: 33 1736 98b80e7fed4b3492ca1fb4e44fc8b239739e66679a92e27d9a37a1968b9d1c4c.exe Token: SeIncBasePriorityPrivilege 1736 98b80e7fed4b3492ca1fb4e44fc8b239739e66679a92e27d9a37a1968b9d1c4c.exe Token: 33 1736 98b80e7fed4b3492ca1fb4e44fc8b239739e66679a92e27d9a37a1968b9d1c4c.exe Token: SeIncBasePriorityPrivilege 1736 98b80e7fed4b3492ca1fb4e44fc8b239739e66679a92e27d9a37a1968b9d1c4c.exe Token: 33 1736 98b80e7fed4b3492ca1fb4e44fc8b239739e66679a92e27d9a37a1968b9d1c4c.exe Token: SeIncBasePriorityPrivilege 1736 98b80e7fed4b3492ca1fb4e44fc8b239739e66679a92e27d9a37a1968b9d1c4c.exe Token: 33 1736 98b80e7fed4b3492ca1fb4e44fc8b239739e66679a92e27d9a37a1968b9d1c4c.exe Token: SeIncBasePriorityPrivilege 1736 98b80e7fed4b3492ca1fb4e44fc8b239739e66679a92e27d9a37a1968b9d1c4c.exe Token: 33 1736 98b80e7fed4b3492ca1fb4e44fc8b239739e66679a92e27d9a37a1968b9d1c4c.exe Token: SeIncBasePriorityPrivilege 1736 98b80e7fed4b3492ca1fb4e44fc8b239739e66679a92e27d9a37a1968b9d1c4c.exe Token: 33 1736 98b80e7fed4b3492ca1fb4e44fc8b239739e66679a92e27d9a37a1968b9d1c4c.exe Token: SeIncBasePriorityPrivilege 1736 98b80e7fed4b3492ca1fb4e44fc8b239739e66679a92e27d9a37a1968b9d1c4c.exe Token: 33 1736 98b80e7fed4b3492ca1fb4e44fc8b239739e66679a92e27d9a37a1968b9d1c4c.exe Token: SeIncBasePriorityPrivilege 1736 98b80e7fed4b3492ca1fb4e44fc8b239739e66679a92e27d9a37a1968b9d1c4c.exe Token: 33 1736 98b80e7fed4b3492ca1fb4e44fc8b239739e66679a92e27d9a37a1968b9d1c4c.exe Token: SeIncBasePriorityPrivilege 1736 98b80e7fed4b3492ca1fb4e44fc8b239739e66679a92e27d9a37a1968b9d1c4c.exe Token: 33 1736 98b80e7fed4b3492ca1fb4e44fc8b239739e66679a92e27d9a37a1968b9d1c4c.exe Token: SeIncBasePriorityPrivilege 1736 98b80e7fed4b3492ca1fb4e44fc8b239739e66679a92e27d9a37a1968b9d1c4c.exe Token: 33 1736 98b80e7fed4b3492ca1fb4e44fc8b239739e66679a92e27d9a37a1968b9d1c4c.exe Token: SeIncBasePriorityPrivilege 1736 98b80e7fed4b3492ca1fb4e44fc8b239739e66679a92e27d9a37a1968b9d1c4c.exe Token: 33 1736 98b80e7fed4b3492ca1fb4e44fc8b239739e66679a92e27d9a37a1968b9d1c4c.exe Token: SeIncBasePriorityPrivilege 1736 98b80e7fed4b3492ca1fb4e44fc8b239739e66679a92e27d9a37a1968b9d1c4c.exe Token: 33 1736 98b80e7fed4b3492ca1fb4e44fc8b239739e66679a92e27d9a37a1968b9d1c4c.exe Token: SeIncBasePriorityPrivilege 1736 98b80e7fed4b3492ca1fb4e44fc8b239739e66679a92e27d9a37a1968b9d1c4c.exe Token: 33 1736 98b80e7fed4b3492ca1fb4e44fc8b239739e66679a92e27d9a37a1968b9d1c4c.exe Token: SeIncBasePriorityPrivilege 1736 98b80e7fed4b3492ca1fb4e44fc8b239739e66679a92e27d9a37a1968b9d1c4c.exe Token: 33 1736 98b80e7fed4b3492ca1fb4e44fc8b239739e66679a92e27d9a37a1968b9d1c4c.exe Token: SeIncBasePriorityPrivilege 1736 98b80e7fed4b3492ca1fb4e44fc8b239739e66679a92e27d9a37a1968b9d1c4c.exe Token: 33 1736 98b80e7fed4b3492ca1fb4e44fc8b239739e66679a92e27d9a37a1968b9d1c4c.exe Token: SeIncBasePriorityPrivilege 1736 98b80e7fed4b3492ca1fb4e44fc8b239739e66679a92e27d9a37a1968b9d1c4c.exe Token: 33 1736 98b80e7fed4b3492ca1fb4e44fc8b239739e66679a92e27d9a37a1968b9d1c4c.exe Token: SeIncBasePriorityPrivilege 1736 98b80e7fed4b3492ca1fb4e44fc8b239739e66679a92e27d9a37a1968b9d1c4c.exe Token: 33 1736 98b80e7fed4b3492ca1fb4e44fc8b239739e66679a92e27d9a37a1968b9d1c4c.exe Token: SeIncBasePriorityPrivilege 1736 98b80e7fed4b3492ca1fb4e44fc8b239739e66679a92e27d9a37a1968b9d1c4c.exe Token: 33 1736 98b80e7fed4b3492ca1fb4e44fc8b239739e66679a92e27d9a37a1968b9d1c4c.exe Token: SeIncBasePriorityPrivilege 1736 98b80e7fed4b3492ca1fb4e44fc8b239739e66679a92e27d9a37a1968b9d1c4c.exe Token: 33 1736 98b80e7fed4b3492ca1fb4e44fc8b239739e66679a92e27d9a37a1968b9d1c4c.exe Token: SeIncBasePriorityPrivilege 1736 98b80e7fed4b3492ca1fb4e44fc8b239739e66679a92e27d9a37a1968b9d1c4c.exe Token: 33 1736 98b80e7fed4b3492ca1fb4e44fc8b239739e66679a92e27d9a37a1968b9d1c4c.exe Token: SeIncBasePriorityPrivilege 1736 98b80e7fed4b3492ca1fb4e44fc8b239739e66679a92e27d9a37a1968b9d1c4c.exe Token: 33 1736 98b80e7fed4b3492ca1fb4e44fc8b239739e66679a92e27d9a37a1968b9d1c4c.exe Token: SeIncBasePriorityPrivilege 1736 98b80e7fed4b3492ca1fb4e44fc8b239739e66679a92e27d9a37a1968b9d1c4c.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 1736 98b80e7fed4b3492ca1fb4e44fc8b239739e66679a92e27d9a37a1968b9d1c4c.exe 1736 98b80e7fed4b3492ca1fb4e44fc8b239739e66679a92e27d9a37a1968b9d1c4c.exe 2256 shibie.exe 2144 Inkfbls.exe 2036 Inkfbls.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1736 wrote to memory of 2256 1736 98b80e7fed4b3492ca1fb4e44fc8b239739e66679a92e27d9a37a1968b9d1c4c.exe 28 PID 1736 wrote to memory of 2256 1736 98b80e7fed4b3492ca1fb4e44fc8b239739e66679a92e27d9a37a1968b9d1c4c.exe 28 PID 1736 wrote to memory of 2256 1736 98b80e7fed4b3492ca1fb4e44fc8b239739e66679a92e27d9a37a1968b9d1c4c.exe 28 PID 1736 wrote to memory of 2256 1736 98b80e7fed4b3492ca1fb4e44fc8b239739e66679a92e27d9a37a1968b9d1c4c.exe 28 PID 2144 wrote to memory of 2036 2144 Inkfbls.exe 31 PID 2144 wrote to memory of 2036 2144 Inkfbls.exe 31 PID 2144 wrote to memory of 2036 2144 Inkfbls.exe 31 PID 2144 wrote to memory of 2036 2144 Inkfbls.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\98b80e7fed4b3492ca1fb4e44fc8b239739e66679a92e27d9a37a1968b9d1c4c.exe"C:\Users\Admin\AppData\Local\Temp\98b80e7fed4b3492ca1fb4e44fc8b239739e66679a92e27d9a37a1968b9d1c4c.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1736 -
C:\Users\Admin\AppData\Local\Temp\shibie.exeC:\Users\Admin\AppData\Local\Temp\\shibie.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2256
-
-
C:\Program Files (x86)\Microsoft Kwmcwq\Inkfbls.exe"C:\Program Files (x86)\Microsoft Kwmcwq\Inkfbls.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2144 -
C:\Program Files (x86)\Microsoft Kwmcwq\Inkfbls.exe"C:\Program Files (x86)\Microsoft Kwmcwq\Inkfbls.exe" Win72⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:2036
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.0MB
MD5cd59e1fba80e9b5314be38df0da8a797
SHA1e3a01d14112e33a847ff691dcb55b9e20af7641e
SHA2566d6b8c45b17fe29eceba63abd9cd9368bfc763aca583d4023f0c97a25853d0bf
SHA512ea293cf0137c44bf40b07467e2d64e9dc5f63b6bfc9097df7d1c556186ea14207afbd1b922c9901da7a04303f77cac5e5871c5f1e3e23410f7f602169157e7fe
-
Filesize
1.0MB
MD5cd59e1fba80e9b5314be38df0da8a797
SHA1e3a01d14112e33a847ff691dcb55b9e20af7641e
SHA2566d6b8c45b17fe29eceba63abd9cd9368bfc763aca583d4023f0c97a25853d0bf
SHA512ea293cf0137c44bf40b07467e2d64e9dc5f63b6bfc9097df7d1c556186ea14207afbd1b922c9901da7a04303f77cac5e5871c5f1e3e23410f7f602169157e7fe
-
Filesize
1.0MB
MD5cd59e1fba80e9b5314be38df0da8a797
SHA1e3a01d14112e33a847ff691dcb55b9e20af7641e
SHA2566d6b8c45b17fe29eceba63abd9cd9368bfc763aca583d4023f0c97a25853d0bf
SHA512ea293cf0137c44bf40b07467e2d64e9dc5f63b6bfc9097df7d1c556186ea14207afbd1b922c9901da7a04303f77cac5e5871c5f1e3e23410f7f602169157e7fe
-
Filesize
1.0MB
MD5cd59e1fba80e9b5314be38df0da8a797
SHA1e3a01d14112e33a847ff691dcb55b9e20af7641e
SHA2566d6b8c45b17fe29eceba63abd9cd9368bfc763aca583d4023f0c97a25853d0bf
SHA512ea293cf0137c44bf40b07467e2d64e9dc5f63b6bfc9097df7d1c556186ea14207afbd1b922c9901da7a04303f77cac5e5871c5f1e3e23410f7f602169157e7fe
-
Filesize
1.0MB
MD5cd59e1fba80e9b5314be38df0da8a797
SHA1e3a01d14112e33a847ff691dcb55b9e20af7641e
SHA2566d6b8c45b17fe29eceba63abd9cd9368bfc763aca583d4023f0c97a25853d0bf
SHA512ea293cf0137c44bf40b07467e2d64e9dc5f63b6bfc9097df7d1c556186ea14207afbd1b922c9901da7a04303f77cac5e5871c5f1e3e23410f7f602169157e7fe
-
Filesize
1.0MB
MD5cd59e1fba80e9b5314be38df0da8a797
SHA1e3a01d14112e33a847ff691dcb55b9e20af7641e
SHA2566d6b8c45b17fe29eceba63abd9cd9368bfc763aca583d4023f0c97a25853d0bf
SHA512ea293cf0137c44bf40b07467e2d64e9dc5f63b6bfc9097df7d1c556186ea14207afbd1b922c9901da7a04303f77cac5e5871c5f1e3e23410f7f602169157e7fe
-
Filesize
1.0MB
MD5cd59e1fba80e9b5314be38df0da8a797
SHA1e3a01d14112e33a847ff691dcb55b9e20af7641e
SHA2566d6b8c45b17fe29eceba63abd9cd9368bfc763aca583d4023f0c97a25853d0bf
SHA512ea293cf0137c44bf40b07467e2d64e9dc5f63b6bfc9097df7d1c556186ea14207afbd1b922c9901da7a04303f77cac5e5871c5f1e3e23410f7f602169157e7fe
-
Filesize
1.0MB
MD5cd59e1fba80e9b5314be38df0da8a797
SHA1e3a01d14112e33a847ff691dcb55b9e20af7641e
SHA2566d6b8c45b17fe29eceba63abd9cd9368bfc763aca583d4023f0c97a25853d0bf
SHA512ea293cf0137c44bf40b07467e2d64e9dc5f63b6bfc9097df7d1c556186ea14207afbd1b922c9901da7a04303f77cac5e5871c5f1e3e23410f7f602169157e7fe