9152487eb3e160e6f8d97b1489189f479d845b044018ccf92479021ab70656c4

Analysis

max time kernel
150s
max time network
139s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 12:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6e733e40eb840af9f13d09395e4985f3.exe
Size

1.2MB
MD5

6e733e40eb840af9f13d09395e4985f3
SHA1

7595ea346535ca77ca954923426e9b6c344c495f
SHA256

9152487eb3e160e6f8d97b1489189f479d845b044018ccf92479021ab70656c4
SHA512

474187364de53a27182f6668184d3f80fa1e654d54f5b505129a388d761541ffd5bc2aa929b21a99d7bb19692a3a0071f061d32856c5eeee8fecbf13ff0cfda1
SSDEEP

24576:GIx5Kx34IQb8xlusz8HUCa2+9eu1e4B4KuOYrbRL+wdyQH:GCYF4IQwxhzeUCaF9PTjuZrbvyQH

Score

7^/10

adware persistence stealer

Malware Config

Signatures

Executes dropped EXE 5 IoCs

pid	Process
2100	rinst.exe
2224	VulanProF94.Crack.exe
2600	windowsz.exe
2816	rinst.exe
2400	khoahocphothong.net.exe

Loads dropped DLL 22 IoCs

pid	Process
2180	6e733e40eb840af9f13d09395e4985f3.exe
2180	6e733e40eb840af9f13d09395e4985f3.exe
2180	6e733e40eb840af9f13d09395e4985f3.exe
2180	6e733e40eb840af9f13d09395e4985f3.exe
2100	rinst.exe
2100	rinst.exe
2100	rinst.exe
2100	rinst.exe
2224	VulanProF94.Crack.exe
2224	VulanProF94.Crack.exe
2224	VulanProF94.Crack.exe
2224	VulanProF94.Crack.exe
2600	windowsz.exe
2600	windowsz.exe
2816	rinst.exe
2600	windowsz.exe
2816	rinst.exe
2816	rinst.exe
2400	khoahocphothong.net.exe
2400	khoahocphothong.net.exe
2180	6e733e40eb840af9f13d09395e4985f3.exe
2224	VulanProF94.Crack.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\windowsz = "C:\\Windows\\SysWOW64\\windowsz.exe"	windowsz.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\khoahocphothong.net = "C:\\Windows\\SysWOW64\\khoahocphothong.net.exe"	khoahocphothong.net.exe

Installs/modifies Browser Helper Object 2 TTPs 5 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{1E1B2879-88FF-11D3-8D96-D7ACAC95951A}	windowsz.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{1E1B2879-88FF-11D3-8D96-D7ACAC95951A}	khoahocphothong.net.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{1E1B2879-88FF-11D3-8D96-D7ACAC95951A}\ = "PK IE Plugin"	khoahocphothong.net.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{1E1B2879-88FF-11D3-8D96-D7ACAC95951A}	windowsz.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{1E1B2879-88FF-11D3-8D96-D7ACAC95951A}\ = "PK IE Plugin"	windowsz.exe

Drops file in System32 directory 14 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\pk.bin	rinst.exe
File created	C:\Windows\SysWOW64\rinst.exe	rinst.exe
File created	C:\Windows\SysWOW64\windowsz.exe	rinst.exe
File created	C:\Windows\SysWOW64\windowszwb.dll	rinst.exe
File created	C:\Windows\SysWOW64\rinst.exe	rinst.exe
File opened for modification	C:\Windows\SysWOW64\pk.bin	khoahocphothong.net.exe
File created	C:\Windows\SysWOW64\windowszhk.dll	rinst.exe
File created	C:\Windows\SysWOW64\inst.dat	rinst.exe
File created	C:\Windows\SysWOW64\khoahocphothong.net.exe	rinst.exe
File opened for modification	C:\Windows\SysWOW64\inst.dat	rinst.exe
File opened for modification	C:\Windows\SysWOW64\pk.bin	windowsz.exe
File opened for modification	C:\Windows\SysWOW64\pk.bin	rinst.exe
File created	C:\Windows\SysWOW64\khoahocphothong.nethk.dll	rinst.exe
File created	C:\Windows\SysWOW64\khoahocphothong.netwb.dll	rinst.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1E1B2879-88FF-11D3-8D96-D7ACAC95951A}\TypeLib	windowsz.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1E1B286C-88FF-11D3-8D96-D7ACAC95951A}\1.0\0\win32\ = "C:\\Windows\\SysWOW64\\windowszwb.dll"	windowsz.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1E1B2878-88FF-11D3-8D96-D7ACAC95951A}\TypeLib	khoahocphothong.net.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1E1B2879-88FF-11D3-8D96-D7ACAC95951A}\ProgID	windowsz.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1E1B2879-88FF-11D3-8D96-D7ACAC95951A}\VersionIndependentProgID\ = "PK.IE"	windowsz.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1E1B286C-88FF-11D3-8D96-D7ACAC95951A}\1.0\ = "BPK IE Plugin Type Library"	windowsz.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1E1B286C-88FF-11D3-8D96-D7ACAC95951A}\1.0\HELPDIR	windowsz.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1E1B2879-88FF-11D3-8D96-D7ACAC95951A}\TypeLib	windowsz.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1E1B2879-88FF-11D3-8D96-D7ACAC95951A}	windowsz.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1E1B2878-88FF-11D3-8D96-D7ACAC95951A}\ = "IViewSource"	khoahocphothong.net.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1E1B2879-88FF-11D3-8D96-D7ACAC95951A}\InprocServer32	windowsz.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1E1B2879-88FF-11D3-8D96-D7ACAC95951A}\InprocServer32\ThreadingModel = "Apartment"	khoahocphothong.net.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1E1B2878-88FF-11D3-8D96-D7ACAC95951A}\TypeLib	windowsz.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\PK.IE\CurVer	windowsz.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1E1B286C-88FF-11D3-8D96-D7ACAC95951A}\1.0\HELPDIR	khoahocphothong.net.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1E1B2879-88FF-11D3-8D96-D7ACAC95951A}\ProgID	windowsz.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1E1B2879-88FF-11D3-8D96-D7ACAC95951A}\VersionIndependentProgID	windowsz.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1E1B286C-88FF-11D3-8D96-D7ACAC95951A}\1.0	windowsz.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PK.IE.1\CLSID\ = "{1E1B2879-88FF-11D3-8D96-D7ACAC95951A}"	khoahocphothong.net.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PK.IE	khoahocphothong.net.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1E1B2878-88FF-11D3-8D96-D7ACAC95951A}\TypeLib	windowsz.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1E1B2878-88FF-11D3-8D96-D7ACAC95951A}\TypeLib\Version = "1.0"	windowsz.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1E1B286C-88FF-11D3-8D96-D7ACAC95951A}\1.0\HELPDIR	windowsz.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1E1B2879-88FF-11D3-8D96-D7ACAC95951A}\VersionIndependentProgID\ = "PK.IE"	khoahocphothong.net.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1E1B286C-88FF-11D3-8D96-D7ACAC95951A}	khoahocphothong.net.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1E1B2879-88FF-11D3-8D96-D7ACAC95951A}\InprocServer32	windowsz.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PK.IE\CurVer\ = "PK.IE.1"	khoahocphothong.net.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PK.IE\CLSID\ = "{1E1B2879-88FF-11D3-8D96-D7ACAC95951A}"	windowsz.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PK.IE\CurVer\ = "PK.IE.1"	windowsz.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\PK.IE	windowsz.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1E1B286C-88FF-11D3-8D96-D7ACAC95951A}\1.0\FLAGS	windowsz.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1E1B2879-88FF-11D3-8D96-D7ACAC95951A}\InprocServer32	khoahocphothong.net.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PK.IE.1	windowsz.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1E1B2878-88FF-11D3-8D96-D7ACAC95951A}	windowsz.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PK.IE.1\ = "IE Plugin Class"	khoahocphothong.net.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1E1B286C-88FF-11D3-8D96-D7ACAC95951A}\1.0\ = "BPK IE Plugin Type Library"	khoahocphothong.net.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1E1B2878-88FF-11D3-8D96-D7ACAC95951A}\TypeLib	khoahocphothong.net.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1E1B2878-88FF-11D3-8D96-D7ACAC95951A}\TypeLib\ = "{1E1B286C-88FF-11D3-8D96-D7ACAC95951A}"	khoahocphothong.net.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1E1B2879-88FF-11D3-8D96-D7ACAC95951A}\InprocServer32\ = "C:\\Windows\\SysWOW64\\windowszwb.dll"	windowsz.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1E1B2878-88FF-11D3-8D96-D7ACAC95951A}\TypeLib\ = "{1E1B286C-88FF-11D3-8D96-D7ACAC95951A}"	windowsz.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\PK.IE\CLSID	windowsz.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1E1B2878-88FF-11D3-8D96-D7ACAC95951A}\TypeLib	windowsz.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1E1B2879-88FF-11D3-8D96-D7ACAC95951A}\TypeLib\ = "{1E1B286C-88FF-11D3-8D96-D7ACAC95951A}"	khoahocphothong.net.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1E1B2879-88FF-11D3-8D96-D7ACAC95951A}\ = "IE Plugin Class"	windowsz.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1E1B2878-88FF-11D3-8D96-D7ACAC95951A}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	windowsz.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1E1B2878-88FF-11D3-8D96-D7ACAC95951A}\ProxyStubClsid32	windowsz.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PK.IE\CLSID\ = "{1E1B2879-88FF-11D3-8D96-D7ACAC95951A}"	khoahocphothong.net.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1E1B286C-88FF-11D3-8D96-D7ACAC95951A}\1.0	khoahocphothong.net.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1E1B2879-88FF-11D3-8D96-D7ACAC95951A}	windowsz.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1E1B2879-88FF-11D3-8D96-D7ACAC95951A}\InprocServer32\ThreadingModel = "Apartment"	windowsz.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1E1B2878-88FF-11D3-8D96-D7ACAC95951A}\TypeLib\ = "{1E1B286C-88FF-11D3-8D96-D7ACAC95951A}"	windowsz.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1E1B2878-88FF-11D3-8D96-D7ACAC95951A}\ = "IViewSource"	windowsz.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1E1B2879-88FF-11D3-8D96-D7ACAC95951A}\Programmable	windowsz.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1E1B286C-88FF-11D3-8D96-D7ACAC95951A}\1.0\HELPDIR\ = "C:\\Windows\\SysWOW64\\"	khoahocphothong.net.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1E1B2878-88FF-11D3-8D96-D7ACAC95951A}\ = "IViewSource"	khoahocphothong.net.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1E1B2878-88FF-11D3-8D96-D7ACAC95951A}\TypeLib\ = "{1E1B286C-88FF-11D3-8D96-D7ACAC95951A}"	khoahocphothong.net.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PK.IE\ = "IE Class"	windowsz.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\PK.IE.1	windowsz.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1E1B2878-88FF-11D3-8D96-D7ACAC95951A}	windowsz.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1E1B286C-88FF-11D3-8D96-D7ACAC95951A}\1.0\FLAGS	khoahocphothong.net.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1E1B2878-88FF-11D3-8D96-D7ACAC95951A}	khoahocphothong.net.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PK.IE.1\ = "IE Plugin Class"	windowsz.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1E1B2879-88FF-11D3-8D96-D7ACAC95951A}\ProgID	khoahocphothong.net.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1E1B286C-88FF-11D3-8D96-D7ACAC95951A}\1.0\FLAGS\ = "0"	khoahocphothong.net.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
2600	windowsz.exe
2600	windowsz.exe
2600	windowsz.exe
2400	khoahocphothong.net.exe
2400	khoahocphothong.net.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
2600	windowsz.exe
2600	windowsz.exe
2600	windowsz.exe
2600	windowsz.exe
2600	windowsz.exe
2600	windowsz.exe
2600	windowsz.exe
2600	windowsz.exe
2400	khoahocphothong.net.exe
2400	khoahocphothong.net.exe
2400	khoahocphothong.net.exe
2400	khoahocphothong.net.exe
2400	khoahocphothong.net.exe
2400	khoahocphothong.net.exe
2400	khoahocphothong.net.exe
2400	khoahocphothong.net.exe
2400	khoahocphothong.net.exe
2400	khoahocphothong.net.exe
2400	khoahocphothong.net.exe
2400	khoahocphothong.net.exe
2400	khoahocphothong.net.exe
2400	khoahocphothong.net.exe
2400	khoahocphothong.net.exe
2400	khoahocphothong.net.exe
2400	khoahocphothong.net.exe
2400	khoahocphothong.net.exe
2400	khoahocphothong.net.exe
2400	khoahocphothong.net.exe
2400	khoahocphothong.net.exe
2400	khoahocphothong.net.exe
2400	khoahocphothong.net.exe
2400	khoahocphothong.net.exe
2400	khoahocphothong.net.exe
2400	khoahocphothong.net.exe
2400	khoahocphothong.net.exe
2400	khoahocphothong.net.exe
2400	khoahocphothong.net.exe
2400	khoahocphothong.net.exe
2400	khoahocphothong.net.exe
2400	khoahocphothong.net.exe
2400	khoahocphothong.net.exe
2400	khoahocphothong.net.exe
2400	khoahocphothong.net.exe
2400	khoahocphothong.net.exe
2400	khoahocphothong.net.exe
2400	khoahocphothong.net.exe
2400	khoahocphothong.net.exe
2400	khoahocphothong.net.exe
2400	khoahocphothong.net.exe
2400	khoahocphothong.net.exe
2400	khoahocphothong.net.exe
2400	khoahocphothong.net.exe
2400	khoahocphothong.net.exe
2400	khoahocphothong.net.exe
2400	khoahocphothong.net.exe
2400	khoahocphothong.net.exe
2400	khoahocphothong.net.exe
2400	khoahocphothong.net.exe
2400	khoahocphothong.net.exe
2400	khoahocphothong.net.exe
2400	khoahocphothong.net.exe
2400	khoahocphothong.net.exe
2400	khoahocphothong.net.exe
2400	khoahocphothong.net.exe

Suspicious use of SetWindowsHookEx 16 IoCs

pid	Process
2600	windowsz.exe
2600	windowsz.exe
2600	windowsz.exe
2600	windowsz.exe
2600	windowsz.exe
2600	windowsz.exe
2600	windowsz.exe
2400	khoahocphothong.net.exe
2400	khoahocphothong.net.exe
2400	khoahocphothong.net.exe
2400	khoahocphothong.net.exe
2400	khoahocphothong.net.exe
2400	khoahocphothong.net.exe
2400	khoahocphothong.net.exe
2400	khoahocphothong.net.exe
2400	khoahocphothong.net.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 2180 wrote to memory of 2100	2180	6e733e40eb840af9f13d09395e4985f3.exe	28
PID 2180 wrote to memory of 2100	2180	6e733e40eb840af9f13d09395e4985f3.exe	28
PID 2180 wrote to memory of 2100	2180	6e733e40eb840af9f13d09395e4985f3.exe	28
PID 2180 wrote to memory of 2100	2180	6e733e40eb840af9f13d09395e4985f3.exe	28
PID 2100 wrote to memory of 2224	2100	rinst.exe	29
PID 2100 wrote to memory of 2224	2100	rinst.exe	29
PID 2100 wrote to memory of 2224	2100	rinst.exe	29
PID 2100 wrote to memory of 2224	2100	rinst.exe	29
PID 2100 wrote to memory of 2600	2100	rinst.exe	30
PID 2100 wrote to memory of 2600	2100	rinst.exe	30
PID 2100 wrote to memory of 2600	2100	rinst.exe	30
PID 2100 wrote to memory of 2600	2100	rinst.exe	30
PID 2224 wrote to memory of 2816	2224	VulanProF94.Crack.exe	31
PID 2224 wrote to memory of 2816	2224	VulanProF94.Crack.exe	31
PID 2224 wrote to memory of 2816	2224	VulanProF94.Crack.exe	31
PID 2224 wrote to memory of 2816	2224	VulanProF94.Crack.exe	31
PID 2816 wrote to memory of 2400	2816	rinst.exe	32
PID 2816 wrote to memory of 2400	2816	rinst.exe	32
PID 2816 wrote to memory of 2400	2816	rinst.exe	32
PID 2816 wrote to memory of 2400	2816	rinst.exe	32

C:\Users\Admin\AppData\Local\Temp\6e733e40eb840af9f13d09395e4985f3.exe
"C:\Users\Admin\AppData\Local\Temp\6e733e40eb840af9f13d09395e4985f3.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2180
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\rinst.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\rinst.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:2100
- - C:\Users\Admin\AppData\Local\Temp\RarSFX0\VulanProF94.Crack.exe
    "C:\Users\Admin\AppData\Local\Temp\RarSFX0\VulanProF94.Crack.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:2224
  - - C:\Users\Admin\AppData\Local\Temp\RarSFX1\rinst.exe
      "C:\Users\Admin\AppData\Local\Temp\RarSFX1\rinst.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops file in System32 directory
      Suspicious use of WriteProcessMemory
      PID:2816
    - - C:\Windows\SysWOW64\khoahocphothong.net.exe
        
        C:\Windows\system32\khoahocphothong.net.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Installs/modifies Browser Helper Object
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        
        PID:2400
- - C:\Windows\SysWOW64\windowsz.exe
    C:\Windows\system32\windowsz.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Installs/modifies Browser Helper Object
    - Drops file in System32 directory
    - Modifies registry class
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    PID:2600

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Browser Extensions

T1176

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RarSFX0\VulanProF94.Crack.exe

Filesize
959KB

MD5
e367cb48cd82099f9742c991c46fbd7b

SHA1
572ad459c1e0890afc73e76b0146b60084ad4584

SHA256
93de318ff9b92ac29a4cf118ebb426cc935f6cde8c96460659c5466f345f0bb8

SHA512
395635ce5ad68f5070b79f26bb76ebc503a0116975a1f29ec92c4235a8715adcdb6e424739bd9e7b9222e75cdfe68dd50f238c297aea33de2ce5dcb343fdafdc

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\inst.dat

Filesize
996B

MD5
54f5dbcf4b39a481d30784c99831e309

SHA1
3e8cc267683e9c830dcc4fa9e25e50f7bc999105

SHA256
6dff5d5ee810a5cb830289b2138dcf4c3863cdbd383365e41110dc50a7671374

SHA512
3df8a92e56dc222700ea7562fa4d3b45eb827860d4232a153cbc06bfd36a74f9103536f5c66065e8fb3a258070f791fe3c26ffa6afc7ddc8cde48a49c829a812

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\pk.bin

Filesize
4KB

MD5
1c82ad81db951e13462a790032877fec

SHA1
cb71be3c926885764ec460822511c03c5802134b

SHA256
0cf02dac4e829841c22e133ce02b4aa0e582c6c4abfd373979277bc03a367ca8

SHA512
08c1c1969037a6b46f157b2fe6ac1c7b268e1797270c41217fb8fd1638e1f206971e124841a27da189614eab53dfe41cec7c46f24f248fd532b3f1f2119fd72e

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\windowsz.exe

Filesize
424KB

MD5
20355cda3740d36f368c574b25cbcf99

SHA1
9836923db49e0af88dc9ccba969f303c0c5d0b09

SHA256
3e9953938f7743aaa0863538d8e6625b2b12e9154596846a1cae7eb57d3c58f2

SHA512
85e154b6fbf26d4a3b114dd1341ad0489cf6cdd300572ab55ff4e02be3094c4cb085cef5307189a9193c31f5b3da1d8ad9c44bc4c4b3ee5f7256a87ed8189547

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\windowszhk.dll

Filesize
24KB

MD5
9c74175621b5f6ac5c9300a7cc42874d

SHA1
9c40871935caf66b92c14999cc7653c81793fb82

SHA256
2364ee7e6afd021abdbb9438aabdf6db827f9555bfb869108671f6fa081811cd

SHA512
2581c1f2f2cecbda15673da60ca5881fb7e387850c9df057d412dd06e58b6b4633107086fe056e7288647be47870978c5845b529b12904a7a98f94efe5d021de

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\windowszwb.dll

Filesize
40KB

MD5
43049fb2de37b684caf0e497ab096567

SHA1
1e76088f033c618af65572ff8df2983938a65057

SHA256
a915c8157d5209e22d7bab32768dde99a123893164940c01a943b851c10ef8fb

SHA512
f73257aa167b2034bfebdf7343f589f6140c7cdd45b8b3a696866ee8500f6a2e22df124a4dcf2c084d4b6efe1d2a46837c42069d8af5f5d1e9622c3abb80b165

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\inst.dat

Filesize
996B

MD5
f34339e5f721aa7d1a742a0172330094

SHA1
87303a0d03cc4fd941d6da52c8d1bf649ca7ece8

SHA256
d484263d11f5aa576fc11074834241e352272cd15c9b8e891aa042aa78a2c750

SHA512
b582522636329490eaac3bc970991e7a3923646075f3a0c4e79ec14b4b7faee89281ee8573002ef9cd5488539feec306f1a192d930e9bfbb36fad53386b8d74b

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\khoahocphothong.net.exe

Filesize
424KB

MD5
f663e93c5579939cfb5fe99af1709718

SHA1
ab56041ad5885095889e87b765d8be79e495fb26

SHA256
b839386716007754bc82621d4961f91f6ba98fd025a7e54a0698e8a1d060f7c4

SHA512
6dd40394aeec71e4bddf2f433fb9623a376ae3506a3e4ba22ee091c154ffcf25944bc5ceda9140e4c7b3f7e3fe2f98380940e87450ee9229f6d7d3cb609987f5

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\khoahocphothong.nethk.dll

Filesize
24KB

MD5
9b60660cccada3f585c3e4284195e9c5

SHA1
8c21b1490ccc99088a87f6b7495951a320355df1

SHA256
c13d3f6a1bb8a9d652eb7802a3b2dbbf31580cbef1983a982d1a4b73ca45693e

SHA512
d68baed804995afa41003393e2894f7fb473d63399a24af0ebcd8955b2789b0989372fb7f06a7d2b67a664c4d44e084867e81cc198737da0d0aafefc4e45afca

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\khoahocphothong.netwb.dll

Filesize
40KB

MD5
ea84c1f4209e797370ab6e19c8c83b66

SHA1
6e00610a3efd07be1c9911181a8ee17da4647f11

SHA256
aec793cf2d4a69bf091092f6048cb72f5ea7bea99c039fc4b82ff26f63f97754

SHA512
83eaad1b220488dbb59935739e66878d6f29871c692ec5b74ca36ff790e2cb2cfc09ae326ca6e67111b904e2d63bebb7f7b569461e479c892535b4e64d502769

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\pk.bin

Filesize
4KB

MD5
d3918d6798d8b0d36325ee84df3867b2

SHA1
8e137c5cd5c5acac82c36fde506f0ced039fad9a

SHA256
c1d638ba2e1b507ca7a863a1c0a156790128471f628bc0edf0a0599820406d38

SHA512
302ae4e140a6ee9d3b2ec7b90d0f6f154583964a603ac44c48b022fb713d98e7ace8b8d88f206663978d51147f31ff61b9343b116d5b0b655905144ac19b0590

Download Submit
C:\Windows\SysWOW64\pk.bin

Filesize
4KB

MD5
8e8e18b982439951472d2359b9af8e59

SHA1
3b8933c900152a2bd30bb22b68a8bfbe2f41d399

SHA256
855d4b4f9743eb2194f58e9e6ca7305266c036ae948ec4c12b8c516cc564109f

SHA512
ef08571759996916c5af52d5a3487017a47f8a7735e1cd6fbdf3daa5349559a80cb835b95acac3cf7a08b887dd524d0c9e5b02e8c989cfa7a1c4785ae2b2f37f

Download Submit
C:\Windows\SysWOW64\pk.bin

Filesize
4KB

MD5
d91055e16388bcfff4e033a8b2628b77

SHA1
e38b04d48f3719ea716afdffd6746094c4d06576

SHA256
e222da323226e3b5b345e0e1ff949b62afc393b2c16a727acc528ff2d755dbf2

SHA512
b0aa5ff750a05df6426eb96c6ed27f73541bbbe1688c140bd83f1409f6c127d62fe5b0d30c52e07c34aad67012e9b28bd7e423e9089a368a61a8f5ddb17a931a

Download Submit
C:\Windows\SysWOW64\windowszhk.dll

Filesize
24KB

MD5
9ac9028338d1b353a7cacb563bb91df7

SHA1
a20c5dee8f05c91686324cec2d5b092bafe58339

SHA256
93c0e7f41d5d74217189e4cc2d5cdb8f97d8e5eeef0a0dcf4cecd67e3393682c

SHA512
ac83c8f7b6fe913487015d8d7a2e430e917d230b6b2907150f6c4a73bf64c3a02320dddc29fea03db5df8ac5620d8a902fe7be80ba1b1bd1e6f5b8b1b016ddfe

Download Submit
C:\Windows\SysWOW64\windowszwb.dll

Filesize
40KB

MD5
21d4e01f38b5efd64ad6816fa0b44677

SHA1
5242d2c5b450c773b9fa3ad014a8aba9b7bb206a

SHA256
3285df0c25d4b9b6d5ccbe166a3ce3d04f5cb3a0d61c8bf29bf5f953e51b0977

SHA512
77dae941676a56664da89c7670d29ed5402032c8040df1cc231986733c78f0dc56c41f7a276ec9ea8336e3fa2bfc68d3121048e9585bf0d8a98917d799f669b8

Download Submit
\Users\Admin\AppData\Local\Temp\RarSFX0\rinst.exe

Filesize
7KB

MD5
fbe4bab53f74d3049ef4b306d4cd8742

SHA1
6504b63908997a71a65997fa31eda4ae4de013e7

SHA256
446658dd5af649857fff445c600f26cdc1d0c19c86a080f312b89b1890182092

SHA512
d458ab806a3ed3d1494a13ad8a75df874a0b227cb4f337996cb82df3c4a26dc9c4fe48a664b53b052a4af123ea8d89911d9d9493870e6b5992d5621a32260c2f

Download Submit
\Windows\SysWOW64\windowsz.exe

Filesize
424KB

MD5
994ffae187f4e567c6efee378af66ad0

SHA1
0cc35d07e909b7f6595b9c698fe1a8b9b39c7def

SHA256
f0b707b1ab25024ba5a65f68cd4380a66ef0ce9bb880a92e1feee818854fe423

SHA512
bd5320327a24fbab8934395d272869bfa97d77a2ee44ac6eec8fa79b3ffbd4a049bf9dfeeb6b8cc946c295a07bd07ddba41d81c76d452d2c5587b4bf92559e0a

Download Submit
memory/2180-122-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2180-123-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2224-125-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2224-126-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads