Analysis
-
max time kernel
170s -
max time network
177s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
24/12/2023, 19:53
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0f026bef8497788d59923949f52b9644.exe
Resource
win7-20231215-en
windows7-x64
16 signatures
150 seconds
Behavioral task
behavioral2
Sample
0f026bef8497788d59923949f52b9644.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
12 signatures
150 seconds
General
-
Target
0f026bef8497788d59923949f52b9644.exe
-
Size
476KB
-
MD5
0f026bef8497788d59923949f52b9644
-
SHA1
efd6b5748d00612cbdc663a6084ebc0ff0bf6bdf
-
SHA256
31d6810df2cc38c19f87e3ff65df5c60e3624473c7f120125ad0371a4983aec5
-
SHA512
f4609e593d8a4b229affb3e28b23277d8c16c4c4f4bc969f8e668fc6a7100422f34408261d30b00cc9a5bebcf4c0585cfe26e7761863bdd43eebed52bfd8d5ea
-
SSDEEP
12288:1k8HAXwdAnc2i+zinpRUF2oMPze+0gKG3UPPxf:1zgXwd7F+zinj2lM6+0gL
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" liewue.exe Set value (int) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" ana7e3.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\Control Panel\International\Geo\Nation ana7e3.exe Key value queried \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\Control Panel\International\Geo\Nation 0f026bef8497788d59923949f52b9644.exe -
Executes dropped EXE 6 IoCs
pid Process 2852 ana7e3.exe 4504 liewue.exe 3712 axlog.exe 1984 axlog.exe 3828 dxlog.exe 4476 fxlog.exe -
resource yara_rule behavioral2/memory/1984-47-0x0000000000400000-0x000000000040E000-memory.dmp upx behavioral2/memory/1984-50-0x0000000000400000-0x000000000040E000-memory.dmp upx behavioral2/memory/1984-51-0x0000000000400000-0x000000000040E000-memory.dmp upx behavioral2/memory/1984-54-0x0000000000400000-0x000000000040E000-memory.dmp upx -
Adds Run key to start application 2 TTPs 51 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\liewue = "C:\\Users\\Admin\\liewue.exe /J" ana7e3.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\liewue = "C:\\Users\\Admin\\liewue.exe /q" liewue.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\liewue = "C:\\Users\\Admin\\liewue.exe /j" liewue.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\liewue = "C:\\Users\\Admin\\liewue.exe /L" liewue.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\liewue = "C:\\Users\\Admin\\liewue.exe /k" liewue.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\liewue = "C:\\Users\\Admin\\liewue.exe /T" liewue.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\liewue = "C:\\Users\\Admin\\liewue.exe /Z" liewue.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\liewue = "C:\\Users\\Admin\\liewue.exe /n" liewue.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\liewue = "C:\\Users\\Admin\\liewue.exe /g" liewue.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\liewue = "C:\\Users\\Admin\\liewue.exe /a" liewue.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\liewue = "C:\\Users\\Admin\\liewue.exe /z" liewue.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\liewue = "C:\\Users\\Admin\\liewue.exe /Y" liewue.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\liewue = "C:\\Users\\Admin\\liewue.exe /G" liewue.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\liewue = "C:\\Users\\Admin\\liewue.exe /b" liewue.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\liewue = "C:\\Users\\Admin\\liewue.exe /S" liewue.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\liewue = "C:\\Users\\Admin\\liewue.exe /K" liewue.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\liewue = "C:\\Users\\Admin\\liewue.exe /s" liewue.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\liewue = "C:\\Users\\Admin\\liewue.exe /O" liewue.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\liewue = "C:\\Users\\Admin\\liewue.exe /v" liewue.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\liewue = "C:\\Users\\Admin\\liewue.exe /c" liewue.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\liewue = "C:\\Users\\Admin\\liewue.exe /r" liewue.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\liewue = "C:\\Users\\Admin\\liewue.exe /W" liewue.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\liewue = "C:\\Users\\Admin\\liewue.exe /P" liewue.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\liewue = "C:\\Users\\Admin\\liewue.exe /A" liewue.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\liewue = "C:\\Users\\Admin\\liewue.exe /h" liewue.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\liewue = "C:\\Users\\Admin\\liewue.exe /H" liewue.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\liewue = "C:\\Users\\Admin\\liewue.exe /e" liewue.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\liewue = "C:\\Users\\Admin\\liewue.exe /R" liewue.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\liewue = "C:\\Users\\Admin\\liewue.exe /F" liewue.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\liewue = "C:\\Users\\Admin\\liewue.exe /C" liewue.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\liewue = "C:\\Users\\Admin\\liewue.exe /V" liewue.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\liewue = "C:\\Users\\Admin\\liewue.exe /J" liewue.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\liewue = "C:\\Users\\Admin\\liewue.exe /l" liewue.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\liewue = "C:\\Users\\Admin\\liewue.exe /o" liewue.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\liewue = "C:\\Users\\Admin\\liewue.exe /U" liewue.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\liewue = "C:\\Users\\Admin\\liewue.exe /N" liewue.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\liewue = "C:\\Users\\Admin\\liewue.exe /E" liewue.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\liewue = "C:\\Users\\Admin\\liewue.exe /m" liewue.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\liewue = "C:\\Users\\Admin\\liewue.exe /D" liewue.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\liewue = "C:\\Users\\Admin\\liewue.exe /y" liewue.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\liewue = "C:\\Users\\Admin\\liewue.exe /t" liewue.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\liewue = "C:\\Users\\Admin\\liewue.exe /w" liewue.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\liewue = "C:\\Users\\Admin\\liewue.exe /f" liewue.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\liewue = "C:\\Users\\Admin\\liewue.exe /d" liewue.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\liewue = "C:\\Users\\Admin\\liewue.exe /x" liewue.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\liewue = "C:\\Users\\Admin\\liewue.exe /i" liewue.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\liewue = "C:\\Users\\Admin\\liewue.exe /p" liewue.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\liewue = "C:\\Users\\Admin\\liewue.exe /M" liewue.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\liewue = "C:\\Users\\Admin\\liewue.exe /Q" liewue.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\liewue = "C:\\Users\\Admin\\liewue.exe /B" liewue.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\liewue = "C:\\Users\\Admin\\liewue.exe /X" liewue.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 3712 set thread context of 1984 3712 axlog.exe 98 PID 4476 set thread context of 556 4476 fxlog.exe 108 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Enumerates processes with tasklist 1 TTPs 2 IoCs
pid Process 4608 tasklist.exe 388 tasklist.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2852 ana7e3.exe 2852 ana7e3.exe 2852 ana7e3.exe 2852 ana7e3.exe 1984 axlog.exe 1984 axlog.exe 4504 liewue.exe 4504 liewue.exe 4504 liewue.exe 4504 liewue.exe 1984 axlog.exe 1984 axlog.exe 4504 liewue.exe 4504 liewue.exe 4504 liewue.exe 4504 liewue.exe 4504 liewue.exe 4504 liewue.exe 4504 liewue.exe 4504 liewue.exe 1984 axlog.exe 1984 axlog.exe 4504 liewue.exe 4504 liewue.exe 1984 axlog.exe 1984 axlog.exe 1984 axlog.exe 1984 axlog.exe 4504 liewue.exe 4504 liewue.exe 4504 liewue.exe 4504 liewue.exe 4504 liewue.exe 4504 liewue.exe 1984 axlog.exe 1984 axlog.exe 1984 axlog.exe 1984 axlog.exe 4504 liewue.exe 4504 liewue.exe 1984 axlog.exe 1984 axlog.exe 4504 liewue.exe 4504 liewue.exe 4504 liewue.exe 4504 liewue.exe 1984 axlog.exe 1984 axlog.exe 4504 liewue.exe 4504 liewue.exe 1984 axlog.exe 1984 axlog.exe 4504 liewue.exe 4504 liewue.exe 1984 axlog.exe 1984 axlog.exe 4504 liewue.exe 4504 liewue.exe 1984 axlog.exe 1984 axlog.exe 1984 axlog.exe 1984 axlog.exe 4504 liewue.exe 4504 liewue.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 4608 tasklist.exe Token: SeDebugPrivilege 4476 fxlog.exe Token: SeDebugPrivilege 388 tasklist.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 2552 0f026bef8497788d59923949f52b9644.exe 2852 ana7e3.exe 4504 liewue.exe 3712 axlog.exe 3828 dxlog.exe -
Suspicious use of WriteProcessMemory 45 IoCs
description pid Process procid_target PID 2552 wrote to memory of 2852 2552 0f026bef8497788d59923949f52b9644.exe 89 PID 2552 wrote to memory of 2852 2552 0f026bef8497788d59923949f52b9644.exe 89 PID 2552 wrote to memory of 2852 2552 0f026bef8497788d59923949f52b9644.exe 89 PID 2852 wrote to memory of 4504 2852 ana7e3.exe 94 PID 2852 wrote to memory of 4504 2852 ana7e3.exe 94 PID 2852 wrote to memory of 4504 2852 ana7e3.exe 94 PID 2552 wrote to memory of 3712 2552 0f026bef8497788d59923949f52b9644.exe 95 PID 2552 wrote to memory of 3712 2552 0f026bef8497788d59923949f52b9644.exe 95 PID 2552 wrote to memory of 3712 2552 0f026bef8497788d59923949f52b9644.exe 95 PID 2852 wrote to memory of 4116 2852 ana7e3.exe 96 PID 2852 wrote to memory of 4116 2852 ana7e3.exe 96 PID 2852 wrote to memory of 4116 2852 ana7e3.exe 96 PID 3712 wrote to memory of 1984 3712 axlog.exe 98 PID 3712 wrote to memory of 1984 3712 axlog.exe 98 PID 3712 wrote to memory of 1984 3712 axlog.exe 98 PID 3712 wrote to memory of 1984 3712 axlog.exe 98 PID 3712 wrote to memory of 1984 3712 axlog.exe 98 PID 3712 wrote to memory of 1984 3712 axlog.exe 98 PID 3712 wrote to memory of 1984 3712 axlog.exe 98 PID 3712 wrote to memory of 1984 3712 axlog.exe 98 PID 4116 wrote to memory of 4608 4116 cmd.exe 99 PID 4116 wrote to memory of 4608 4116 cmd.exe 99 PID 4116 wrote to memory of 4608 4116 cmd.exe 99 PID 2552 wrote to memory of 3828 2552 0f026bef8497788d59923949f52b9644.exe 100 PID 2552 wrote to memory of 3828 2552 0f026bef8497788d59923949f52b9644.exe 100 PID 2552 wrote to memory of 3828 2552 0f026bef8497788d59923949f52b9644.exe 100 PID 4504 wrote to memory of 4608 4504 liewue.exe 99 PID 4504 wrote to memory of 4608 4504 liewue.exe 99 PID 2552 wrote to memory of 4476 2552 0f026bef8497788d59923949f52b9644.exe 107 PID 2552 wrote to memory of 4476 2552 0f026bef8497788d59923949f52b9644.exe 107 PID 2552 wrote to memory of 4476 2552 0f026bef8497788d59923949f52b9644.exe 107 PID 4476 wrote to memory of 556 4476 fxlog.exe 108 PID 4476 wrote to memory of 556 4476 fxlog.exe 108 PID 4476 wrote to memory of 556 4476 fxlog.exe 108 PID 4476 wrote to memory of 556 4476 fxlog.exe 108 PID 2552 wrote to memory of 4520 2552 0f026bef8497788d59923949f52b9644.exe 112 PID 2552 wrote to memory of 4520 2552 0f026bef8497788d59923949f52b9644.exe 112 PID 2552 wrote to memory of 4520 2552 0f026bef8497788d59923949f52b9644.exe 112 PID 4520 wrote to memory of 388 4520 cmd.exe 113 PID 4520 wrote to memory of 388 4520 cmd.exe 113 PID 4520 wrote to memory of 388 4520 cmd.exe 113 PID 4504 wrote to memory of 4520 4504 liewue.exe 112 PID 4504 wrote to memory of 4520 4504 liewue.exe 112 PID 4504 wrote to memory of 388 4504 liewue.exe 113 PID 4504 wrote to memory of 388 4504 liewue.exe 113
Processes
-
C:\Users\Admin\AppData\Local\Temp\0f026bef8497788d59923949f52b9644.exe"C:\Users\Admin\AppData\Local\Temp\0f026bef8497788d59923949f52b9644.exe"1⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2552 -
C:\Users\Admin\ana7e3.exeC:\Users\Admin\ana7e3.exe2⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2852 -
C:\Users\Admin\liewue.exe"C:\Users\Admin\liewue.exe"3⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4504
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c tasklist&&del ana7e3.exe3⤵
- Suspicious use of WriteProcessMemory
PID:4116 -
C:\Windows\SysWOW64\tasklist.exetasklist4⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:4608
-
-
-
-
C:\Users\Admin\axlog.exeC:\Users\Admin\axlog.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3712 -
C:\Users\Admin\axlog.exe"C:\Users\Admin\axlog.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1984
-
-
-
C:\Users\Admin\dxlog.exeC:\Users\Admin\dxlog.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3828
-
-
C:\Users\Admin\fxlog.exeC:\Users\Admin\fxlog.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4476 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"3⤵PID:556
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c tasklist&&del 0f026bef8497788d59923949f52b9644.exe2⤵
- Suspicious use of WriteProcessMemory
PID:4520 -
C:\Windows\SysWOW64\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:388
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
228KB
MD5290efbf2f76c4ef6f2a4b21f68b29888
SHA13a6454771d5975be4bb806738dca76ca4f8faaca
SHA256e61900f8b18ceb66802b0058a24677f6396df1c0ab8a4ac2281fd47929fbaf24
SHA512c23a40effe75396e7a4d3eea5ffdf0807c076598fda76ea399e320731c56835bee19e3ef4413d7965c17e976cf9a06d0694f4fbfbb4917cb28b0fb3627e5b008
-
Filesize
76KB
MD5925c20785e84c26666346a44251104c8
SHA12dd55917d669a1165284e1344965a7c35c5c552f
SHA2567f8af46b5be6d1240777d240352f20c33e41f41f0334c02643aa7890c5d88f1a
SHA51267b2a7d986793d1d18d63a5697c0a6f018211b3c01b481ff95663fd874ba14c8bc96f3695022d4637e4819ad669eb3d08e3f267c9631af2c4871982a49df958b
-
Filesize
48KB
MD564babba1f00427096c6142b81e05c9b0
SHA19afad4f72b5bdd4ef164d02f824c7b2be5d732c6
SHA2565d2419c5555890192f5b966fb24316778d1ce27728aecab0557225945ea2d6c2
SHA5127abf1d9d83066d1c938a040cacb9da852ca0f7660520840b045d761d2781b7ba1263ecad9178d17026c63c26e45cafad59d3f18afc6d349fb51c06936ec785b0
-
Filesize
270KB
MD5790180622412379c23115e59fb7022be
SHA1012b064113171c300519a4f7f10beb15c1c285b2
SHA256f00f2d7ae9eb7ee10636f29acd947da0f1235574c6dcd918e5dc5358287fd613
SHA512039c8da89d65d58ae021ce4532c842fcda357d5b2580b28d124c76d29a67374414dacf574bf209c044e04819d52e6c4521ed24546b4bfb06aead7a3cfc1e99d4
-
Filesize
228KB
MD5cc1c1d42811360cf96e9f25a6cf47452
SHA1bc4cfca190095b413114a60e714e3e4399c9a075
SHA25688e8065a53d11eabd07c93972f5db80e8a8aa92e7e12b1bd0bb9bd98a4672207
SHA512b16449b338b1811b979d31050fab5bf982cba27e4052732651a136cc8ba8f91dae00b071522d0a17dadbaeb99b39e97cb7be382ec56294444bfdbe24f2bbfb07