31d6810df2cc38c19f87e3ff65df5c60e3624473c7f120125ad0371a4983aec5

Analysis

max time kernel
150s
max time network
154s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24-12-2023 19:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0f026bef8497788d59923949f52b9644.exe
Size

476KB
MD5

0f026bef8497788d59923949f52b9644
SHA1

efd6b5748d00612cbdc663a6084ebc0ff0bf6bdf
SHA256

31d6810df2cc38c19f87e3ff65df5c60e3624473c7f120125ad0371a4983aec5
SHA512

f4609e593d8a4b229affb3e28b23277d8c16c4c4f4bc969f8e668fc6a7100422f34408261d30b00cc9a5bebcf4c0585cfe26e7761863bdd43eebed52bfd8d5ea
SSDEEP

12288:1k8HAXwdAnc2i+zinpRUF2oMPze+0gKG3UPPxf:1zgXwd7F+zinj2lM6+0gL

Score

10^/10

evasion persistence upx

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	ana7e3.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	deiine.exe

Deletes itself 1 IoCs

pid	Process
1932	cmd.exe

Executes dropped EXE 7 IoCs

pid	Process
1824	ana7e3.exe
2704	deiine.exe
2604	axlog.exe
2584	axlog.exe
2868	dxlog.exe
940	fxlog.exe
336	csrss.exe

Loads dropped DLL 17 IoCs

pid	Process
2116	0f026bef8497788d59923949f52b9644.exe
2116	0f026bef8497788d59923949f52b9644.exe
1824	ana7e3.exe
1824	ana7e3.exe
2116	0f026bef8497788d59923949f52b9644.exe
2116	0f026bef8497788d59923949f52b9644.exe
2152	WerFault.exe
2152	WerFault.exe
2152	WerFault.exe
2152	WerFault.exe
2152	WerFault.exe
2152	WerFault.exe
2116	0f026bef8497788d59923949f52b9644.exe
2116	0f026bef8497788d59923949f52b9644.exe
2152	WerFault.exe
2116	0f026bef8497788d59923949f52b9644.exe
2116	0f026bef8497788d59923949f52b9644.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2584-40-0x0000000000400000-0x000000000040E000-memory.dmp	upx
behavioral1/memory/2584-42-0x0000000000400000-0x000000000040E000-memory.dmp	upx
behavioral1/memory/2584-52-0x0000000000400000-0x000000000040E000-memory.dmp	upx
behavioral1/memory/2584-51-0x0000000000400000-0x000000000040E000-memory.dmp	upx
behavioral1/memory/2584-50-0x0000000000400000-0x000000000040E000-memory.dmp	upx
behavioral1/memory/2584-46-0x0000000000400000-0x000000000040E000-memory.dmp	upx

Adds Run key to start application 2 TTPs 49 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\deiine = "C:\\Users\\Admin\\deiine.exe /d"	deiine.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\deiine = "C:\\Users\\Admin\\deiine.exe /v"	deiine.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\deiine = "C:\\Users\\Admin\\deiine.exe /Y"	deiine.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\deiine = "C:\\Users\\Admin\\deiine.exe /q"	deiine.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\deiine = "C:\\Users\\Admin\\deiine.exe /y"	deiine.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\deiine = "C:\\Users\\Admin\\deiine.exe /t"	ana7e3.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\deiine = "C:\\Users\\Admin\\deiine.exe /O"	deiine.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\deiine = "C:\\Users\\Admin\\deiine.exe /r"	deiine.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\deiine = "C:\\Users\\Admin\\deiine.exe /I"	deiine.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\deiine = "C:\\Users\\Admin\\deiine.exe /T"	deiine.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\deiine = "C:\\Users\\Admin\\deiine.exe /e"	deiine.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\deiine = "C:\\Users\\Admin\\deiine.exe /Z"	deiine.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\deiine = "C:\\Users\\Admin\\deiine.exe /z"	deiine.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\deiine = "C:\\Users\\Admin\\deiine.exe /h"	deiine.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\deiine = "C:\\Users\\Admin\\deiine.exe /A"	deiine.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\deiine = "C:\\Users\\Admin\\deiine.exe /x"	deiine.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\deiine = "C:\\Users\\Admin\\deiine.exe /w"	deiine.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\deiine = "C:\\Users\\Admin\\deiine.exe /L"	deiine.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\deiine = "C:\\Users\\Admin\\deiine.exe /C"	deiine.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\deiine = "C:\\Users\\Admin\\deiine.exe /R"	deiine.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\deiine = "C:\\Users\\Admin\\deiine.exe /g"	deiine.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\deiine = "C:\\Users\\Admin\\deiine.exe /J"	deiine.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\deiine = "C:\\Users\\Admin\\deiine.exe /F"	deiine.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\deiine = "C:\\Users\\Admin\\deiine.exe /D"	deiine.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\deiine = "C:\\Users\\Admin\\deiine.exe /j"	deiine.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\deiine = "C:\\Users\\Admin\\deiine.exe /u"	deiine.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\deiine = "C:\\Users\\Admin\\deiine.exe /B"	deiine.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\deiine = "C:\\Users\\Admin\\deiine.exe /i"	deiine.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\deiine = "C:\\Users\\Admin\\deiine.exe /Q"	deiine.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\deiine = "C:\\Users\\Admin\\deiine.exe /X"	deiine.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\deiine = "C:\\Users\\Admin\\deiine.exe /l"	deiine.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\deiine = "C:\\Users\\Admin\\deiine.exe /V"	deiine.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\deiine = "C:\\Users\\Admin\\deiine.exe /N"	deiine.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\deiine = "C:\\Users\\Admin\\deiine.exe /K"	deiine.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\deiine = "C:\\Users\\Admin\\deiine.exe /m"	deiine.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\deiine = "C:\\Users\\Admin\\deiine.exe /H"	deiine.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\deiine = "C:\\Users\\Admin\\deiine.exe /U"	deiine.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\deiine = "C:\\Users\\Admin\\deiine.exe /p"	deiine.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\deiine = "C:\\Users\\Admin\\deiine.exe /S"	deiine.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\deiine = "C:\\Users\\Admin\\deiine.exe /E"	deiine.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\deiine = "C:\\Users\\Admin\\deiine.exe /P"	deiine.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\deiine = "C:\\Users\\Admin\\deiine.exe /a"	deiine.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\deiine = "C:\\Users\\Admin\\deiine.exe /t"	deiine.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\deiine = "C:\\Users\\Admin\\deiine.exe /o"	deiine.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\deiine = "C:\\Users\\Admin\\deiine.exe /f"	deiine.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\deiine = "C:\\Users\\Admin\\deiine.exe /W"	deiine.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\deiine = "C:\\Users\\Admin\\deiine.exe /n"	deiine.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\deiine = "C:\\Users\\Admin\\deiine.exe /G"	deiine.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\deiine = "C:\\Users\\Admin\\deiine.exe /k"	deiine.exe

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File created	\systemroot\assembly\GAC_64\Desktop.ini	csrss.exe
File created	\systemroot\assembly\GAC_32\Desktop.ini	csrss.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2604 set thread context of 2584	2604	axlog.exe	34
PID 940 set thread context of 2448	940	fxlog.exe	41

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2152	2584	WerFault.exe	34

Enumerates processes with tasklist 1 TTPs 2 IoCs

Process Discovery

T1057

pid	Process
2904	tasklist.exe
292	tasklist.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1824	ana7e3.exe
1824	ana7e3.exe
2704	deiine.exe
2704	deiine.exe
2704	deiine.exe
2704	deiine.exe
2704	deiine.exe
2704	deiine.exe
2704	deiine.exe
2704	deiine.exe
2704	deiine.exe
2704	deiine.exe
2704	deiine.exe
2704	deiine.exe
2704	deiine.exe
2704	deiine.exe
2704	deiine.exe
2704	deiine.exe
2704	deiine.exe
2704	deiine.exe
2704	deiine.exe
2704	deiine.exe
2704	deiine.exe
2704	deiine.exe
2704	deiine.exe
2704	deiine.exe
2704	deiine.exe
2704	deiine.exe
2704	deiine.exe
2704	deiine.exe
2704	deiine.exe
2704	deiine.exe
2704	deiine.exe
2704	deiine.exe
2704	deiine.exe
2704	deiine.exe
2704	deiine.exe
2704	deiine.exe
2704	deiine.exe
2704	deiine.exe
2704	deiine.exe
2704	deiine.exe
2704	deiine.exe
2704	deiine.exe
2704	deiine.exe
2704	deiine.exe
2704	deiine.exe
2704	deiine.exe
940	fxlog.exe
940	fxlog.exe
940	fxlog.exe
2704	deiine.exe
940	fxlog.exe
2704	deiine.exe
2704	deiine.exe
2704	deiine.exe
2704	deiine.exe
2704	deiine.exe
2704	deiine.exe
2704	deiine.exe
2704	deiine.exe
2704	deiine.exe
2704	deiine.exe
2704	deiine.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2904	tasklist.exe
Token: SeDebugPrivilege	940	fxlog.exe
Token: SeDebugPrivilege	940	fxlog.exe
Token: SeDebugPrivilege	292	tasklist.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
2116	0f026bef8497788d59923949f52b9644.exe
1824	ana7e3.exe
2704	deiine.exe
2604	axlog.exe
2868	dxlog.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
336	csrss.exe

Suspicious use of WriteProcessMemory 56 IoCs

description	pid	Process	procid_target
PID 2116 wrote to memory of 1824	2116	0f026bef8497788d59923949f52b9644.exe	28
PID 2116 wrote to memory of 1824	2116	0f026bef8497788d59923949f52b9644.exe	28
PID 2116 wrote to memory of 1824	2116	0f026bef8497788d59923949f52b9644.exe	28
PID 2116 wrote to memory of 1824	2116	0f026bef8497788d59923949f52b9644.exe	28
PID 1824 wrote to memory of 2704	1824	ana7e3.exe	29
PID 1824 wrote to memory of 2704	1824	ana7e3.exe	29
PID 1824 wrote to memory of 2704	1824	ana7e3.exe	29
PID 1824 wrote to memory of 2704	1824	ana7e3.exe	29
PID 1824 wrote to memory of 2844	1824	ana7e3.exe	30
PID 1824 wrote to memory of 2844	1824	ana7e3.exe	30
PID 1824 wrote to memory of 2844	1824	ana7e3.exe	30
PID 1824 wrote to memory of 2844	1824	ana7e3.exe	30
PID 2844 wrote to memory of 2904	2844	cmd.exe	32
PID 2844 wrote to memory of 2904	2844	cmd.exe	32
PID 2844 wrote to memory of 2904	2844	cmd.exe	32
PID 2844 wrote to memory of 2904	2844	cmd.exe	32
PID 2116 wrote to memory of 2604	2116	0f026bef8497788d59923949f52b9644.exe	33
PID 2116 wrote to memory of 2604	2116	0f026bef8497788d59923949f52b9644.exe	33
PID 2116 wrote to memory of 2604	2116	0f026bef8497788d59923949f52b9644.exe	33
PID 2116 wrote to memory of 2604	2116	0f026bef8497788d59923949f52b9644.exe	33
PID 2604 wrote to memory of 2584	2604	axlog.exe	34
PID 2604 wrote to memory of 2584	2604	axlog.exe	34
PID 2604 wrote to memory of 2584	2604	axlog.exe	34
PID 2604 wrote to memory of 2584	2604	axlog.exe	34
PID 2604 wrote to memory of 2584	2604	axlog.exe	34
PID 2604 wrote to memory of 2584	2604	axlog.exe	34
PID 2604 wrote to memory of 2584	2604	axlog.exe	34
PID 2604 wrote to memory of 2584	2604	axlog.exe	34
PID 2584 wrote to memory of 2152	2584	axlog.exe	35
PID 2584 wrote to memory of 2152	2584	axlog.exe	35
PID 2584 wrote to memory of 2152	2584	axlog.exe	35
PID 2584 wrote to memory of 2152	2584	axlog.exe	35
PID 2116 wrote to memory of 2868	2116	0f026bef8497788d59923949f52b9644.exe	37
PID 2116 wrote to memory of 2868	2116	0f026bef8497788d59923949f52b9644.exe	37
PID 2116 wrote to memory of 2868	2116	0f026bef8497788d59923949f52b9644.exe	37
PID 2116 wrote to memory of 2868	2116	0f026bef8497788d59923949f52b9644.exe	37
PID 2116 wrote to memory of 940	2116	0f026bef8497788d59923949f52b9644.exe	40
PID 2116 wrote to memory of 940	2116	0f026bef8497788d59923949f52b9644.exe	40
PID 2116 wrote to memory of 940	2116	0f026bef8497788d59923949f52b9644.exe	40
PID 2116 wrote to memory of 940	2116	0f026bef8497788d59923949f52b9644.exe	40
PID 940 wrote to memory of 1192	940	fxlog.exe	17
PID 940 wrote to memory of 336	940	fxlog.exe	6
PID 940 wrote to memory of 2448	940	fxlog.exe	41
PID 940 wrote to memory of 2448	940	fxlog.exe	41
PID 940 wrote to memory of 2448	940	fxlog.exe	41
PID 940 wrote to memory of 2448	940	fxlog.exe	41
PID 940 wrote to memory of 2448	940	fxlog.exe	41
PID 2116 wrote to memory of 1932	2116	0f026bef8497788d59923949f52b9644.exe	43
PID 2116 wrote to memory of 1932	2116	0f026bef8497788d59923949f52b9644.exe	43
PID 2116 wrote to memory of 1932	2116	0f026bef8497788d59923949f52b9644.exe	43
PID 2116 wrote to memory of 1932	2116	0f026bef8497788d59923949f52b9644.exe	43
PID 1932 wrote to memory of 292	1932	cmd.exe	45
PID 1932 wrote to memory of 292	1932	cmd.exe	45
PID 1932 wrote to memory of 292	1932	cmd.exe	45
PID 1932 wrote to memory of 292	1932	cmd.exe	45
PID 336 wrote to memory of 840	336	csrss.exe	9

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:336

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs
1⤵
PID:840

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1192
- C:\Users\Admin\AppData\Local\Temp\0f026bef8497788d59923949f52b9644.exe
  "C:\Users\Admin\AppData\Local\Temp\0f026bef8497788d59923949f52b9644.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2116
- - C:\Users\Admin\ana7e3.exe
    C:\Users\Admin\ana7e3.exe
    3⤵
    - Modifies visiblity of hidden/system files in Explorer
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1824
  - - C:\Users\Admin\deiine.exe
      "C:\Users\Admin\deiine.exe"
      4⤵
      Modifies visiblity of hidden/system files in Explorer
      Executes dropped EXE
      Adds Run key to start application
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      PID:2704
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c tasklist&&del ana7e3.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2844
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:2904
- - C:\Users\Admin\axlog.exe
    C:\Users\Admin\axlog.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2604
  - - C:\Users\Admin\axlog.exe
      "C:\Users\Admin\axlog.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:2584
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2584 -s 88
        5⤵
        Loads dropped DLL
        Program crash
        
        PID:2152
- - C:\Users\Admin\dxlog.exe
    C:\Users\Admin\dxlog.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2868
- - C:\Users\Admin\fxlog.exe
    C:\Users\Admin\fxlog.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:940
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe"
      4⤵
      PID:2448
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c tasklist&&del 0f026bef8497788d59923949f52b9644.exe
    3⤵
    - Deletes itself
    - Suspicious use of WriteProcessMemory
    PID:1932
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:292

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Process Discovery

T1057

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\dxlog.exe

Filesize
48KB

MD5
64babba1f00427096c6142b81e05c9b0

SHA1
9afad4f72b5bdd4ef164d02f824c7b2be5d732c6

SHA256
5d2419c5555890192f5b966fb24316778d1ce27728aecab0557225945ea2d6c2

SHA512
7abf1d9d83066d1c938a040cacb9da852ca0f7660520840b045d761d2781b7ba1263ecad9178d17026c63c26e45cafad59d3f18afc6d349fb51c06936ec785b0

Download Submit
C:\Windows\system32\consrv.dll

Filesize
53KB

MD5
4d7cde615a0f534bd5e359951829554b

SHA1
c885d00d9000f2a5dbc78f6193a052b36f4fe968

SHA256
414fdf9bdcae5136c1295d6d24740c50a484acd81f1f7d0fb5d5c138607cb80a

SHA512
33d632f9fbb694440a1ca568c90518784278efd1dc9ee2b57028149d56ebe1f7346d5b59dcfafee2eeaa10091dda05f48958e909d6bfc891e037ae1cfbd048d4

Download Submit
\??\globalroot\systemroot\assembly\temp\@

Filesize
2KB

MD5
81d134ef0c174f08264fc9345986be48

SHA1
3ac9a9aa74f3dcfc1e91692a9fa12b69f1c49680

SHA256
32293b8c6a42fcfddd36f0d73bbbd08bef1fecf5a8089e3bc9584e59e776e368

SHA512
c23f4d2633fbcc8198e5d4dbbc03d5cac147d49d2a324a97f1f3be5835d837a1b1145f25702f3993ebfb4b3f426bf33a9957b4eabb61fe70e9839c5fa4a2b507

Download Submit
\Users\Admin\ana7e3.exe

Filesize
228KB

MD5
290efbf2f76c4ef6f2a4b21f68b29888

SHA1
3a6454771d5975be4bb806738dca76ca4f8faaca

SHA256
e61900f8b18ceb66802b0058a24677f6396df1c0ab8a4ac2281fd47929fbaf24

SHA512
c23a40effe75396e7a4d3eea5ffdf0807c076598fda76ea399e320731c56835bee19e3ef4413d7965c17e976cf9a06d0694f4fbfbb4917cb28b0fb3627e5b008

Download Submit
\Users\Admin\axlog.exe

Filesize
76KB

MD5
925c20785e84c26666346a44251104c8

SHA1
2dd55917d669a1165284e1344965a7c35c5c552f

SHA256
7f8af46b5be6d1240777d240352f20c33e41f41f0334c02643aa7890c5d88f1a

SHA512
67b2a7d986793d1d18d63a5697c0a6f018211b3c01b481ff95663fd874ba14c8bc96f3695022d4637e4819ad669eb3d08e3f267c9631af2c4871982a49df958b

Download Submit
\Users\Admin\deiine.exe

Filesize
228KB

MD5
d594b3cebf2ae637644d382cd025b132

SHA1
4a57cd2532b72b02edd4601d707f1ae747a85453

SHA256
4dbaac33ad17c36ab5b7713dc8a97e1978cd6cd609c3755ae56a90cf1e6a6c32

SHA512
6660d990d4aa0b5f1f97943afaf9504a9be3c9edf6ffc6482405c192f3209815be3d5d72a783575e357a07842ac79087a001e1675fe4616da737f2c78d94813a

Download Submit
\Users\Admin\fxlog.exe

Filesize
270KB

MD5
790180622412379c23115e59fb7022be

SHA1
012b064113171c300519a4f7f10beb15c1c285b2

SHA256
f00f2d7ae9eb7ee10636f29acd947da0f1235574c6dcd918e5dc5358287fd613

SHA512
039c8da89d65d58ae021ce4532c842fcda357d5b2580b28d124c76d29a67374414dacf574bf209c044e04819d52e6c4521ed24546b4bfb06aead7a3cfc1e99d4

Download Submit
memory/336-139-0x0000000000A50000-0x0000000000A62000-memory.dmp

Filesize
72KB

Download
memory/336-121-0x0000000000A50000-0x0000000000A62000-memory.dmp

Filesize
72KB

Download
memory/336-120-0x00000000007F0000-0x00000000007F1000-memory.dmp

Filesize
4KB

Download
memory/336-122-0x0000000000A50000-0x0000000000A62000-memory.dmp

Filesize
72KB

Download
memory/336-133-0x00000000007F0000-0x00000000007F1000-memory.dmp

Filesize
4KB

Download
memory/336-134-0x0000000000A50000-0x0000000000A62000-memory.dmp

Filesize
72KB

Download
memory/840-157-0x0000000000920000-0x000000000092B000-memory.dmp

Filesize
44KB

Download
memory/840-146-0x0000000000910000-0x000000000091B000-memory.dmp

Filesize
44KB

Download
memory/840-141-0x0000000000910000-0x000000000091B000-memory.dmp

Filesize
44KB

Download
memory/840-142-0x0000000000900000-0x0000000000908000-memory.dmp

Filesize
32KB

Download
memory/840-151-0x0000000000910000-0x000000000091B000-memory.dmp

Filesize
44KB

Download
memory/840-152-0x0000000000920000-0x000000000092B000-memory.dmp

Filesize
44KB

Download
memory/840-154-0x0000000000920000-0x000000000092B000-memory.dmp

Filesize
44KB

Download
memory/940-107-0x0000000002B30000-0x0000000002B6C000-memory.dmp

Filesize
240KB

Download
memory/940-82-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/940-97-0x0000000002B30000-0x0000000002B6C000-memory.dmp

Filesize
240KB

Download
memory/940-98-0x0000000003110000-0x000000000314C000-memory.dmp

Filesize
240KB

Download
memory/940-99-0x0000000003950000-0x0000000003951000-memory.dmp

Filesize
4KB

Download
memory/940-102-0x0000000002B30000-0x0000000002B6C000-memory.dmp

Filesize
240KB

Download
memory/940-103-0x0000000002B30000-0x0000000002B6C000-memory.dmp

Filesize
240KB

Download
memory/940-80-0x00000000020A0000-0x00000000020A1000-memory.dmp

Filesize
4KB

Download
memory/940-95-0x0000000002B30000-0x0000000002B6C000-memory.dmp

Filesize
240KB

Download
memory/940-81-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/940-96-0x0000000002B30000-0x0000000002B6C000-memory.dmp

Filesize
240KB

Download
memory/940-83-0x0000000002380000-0x00000000023C6000-memory.dmp

Filesize
280KB

Download
memory/940-94-0x0000000003100000-0x0000000003101000-memory.dmp

Filesize
4KB

Download
memory/940-93-0x0000000002B30000-0x0000000002B6C000-memory.dmp

Filesize
240KB

Download
memory/940-92-0x0000000002B30000-0x0000000002B6C000-memory.dmp

Filesize
240KB

Download
memory/940-89-0x0000000002B30000-0x0000000002B6C000-memory.dmp

Filesize
240KB

Download
memory/940-126-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/940-127-0x0000000002380000-0x00000000023C6000-memory.dmp

Filesize
280KB

Download
memory/940-128-0x0000000002B30000-0x0000000002B6C000-memory.dmp

Filesize
240KB

Download
memory/940-129-0x0000000003110000-0x000000000314C000-memory.dmp

Filesize
240KB

Download
memory/940-84-0x0000000002950000-0x0000000002951000-memory.dmp

Filesize
4KB

Download
memory/940-86-0x0000000002B30000-0x0000000002B6C000-memory.dmp

Filesize
240KB

Download
memory/940-85-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/1192-114-0x0000000002B40000-0x0000000002B46000-memory.dmp

Filesize
24KB

Download
memory/1192-109-0x0000000002B30000-0x0000000002B32000-memory.dmp

Filesize
8KB

Download
memory/1192-104-0x0000000002B40000-0x0000000002B46000-memory.dmp

Filesize
24KB

Download
memory/1192-110-0x0000000002B40000-0x0000000002B46000-memory.dmp

Filesize
24KB

Download
memory/2116-130-0x0000000002970000-0x000000000342A000-memory.dmp

Filesize
10.7MB

Download
memory/2584-40-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2584-38-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2584-42-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2584-44-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2584-52-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2584-51-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2584-50-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2584-46-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download