ba0bbaddf18f94738a211534ebdeb4b9b9722996f2570e09fbd0a9eac85f14fa

General

Target

2484ae3c3b81170f75e6ee512c04e14a.exe
Size

156KB
MD5

2484ae3c3b81170f75e6ee512c04e14a
SHA1

cf49513796222e75e7f8ce53f30939059762324e
SHA256

ba0bbaddf18f94738a211534ebdeb4b9b9722996f2570e09fbd0a9eac85f14fa
SHA512

63b431e63650fa6f48d459ab55648e7f92cf9fcf78e9a6f22adacf82e6718a2a7b8faec927eb12a911d8cbf4f042d29a0ebcca1685a322741bece7365f2c7fcb
SSDEEP

3072:XASDiVGZgXVnV7yKbSMVhUUeBN9UYH+IPbhqFrefpFMUoh:iGWXDyKbSQ5IRPsFYMhh

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2060 set thread context of 2880	2060	2484ae3c3b81170f75e6ee512c04e14a.exe	28

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\PCGWIN32.LI5	2484ae3c3b81170f75e6ee512c04e14a.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\{99775875-CABF0019-E35A976B-94476C72}	2484ae3c3b81170f75e6ee512c04e14a.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\{99775875-CABF0019-E35A976B-94476C72}\ = 5952677e1907223fc212af7f666d0100086d456047073aca2f8662cb71b9101745ba28167dbb2c1161784c57603a4317d68ac4a0f6d3ab89c1e4dcd88c8fbc5d6df31ceecd2283cf461d0b701e9b734e26bddbd0490098ae4a9da773a559484807fd15eff802ac0f7d421019fb74d15b384e2d1d5c0c33a1a6bbcb29393c97d1cacbd826f475e9a4a3e64e55fd08ef61fdf0ac6ede838df9e3d3d68ec4a2ca086a1b13b6c6a4ab36991b37ce2ac2bf11ad3c7c126dc180bbc95667751a9849881c9e8f8c7d43ac0e5e3d8d90bf7e5293794190f8ff506dfb5f2eb263a6ae654268509d8ff09d1c70b35b618e98ddf273d8618b98c1f4cc67a02a739e160d4b9cfe0e6ca2bfc12d23209ee94cdba3c9897bbf16d28bcede9c72b3e9e9fb982e3243efdec2b2001612b5795b28b67b9a2eb05d9870756ed4433516a8cbfaa1e99bfb0e917d80ac203ec5131889c9844476a764ca55c0f87492d6370baa9e2673b4d629c480d4d4b507a78a15b804d5d987f7faea9666fb759157340a95190bb7fe9a6c0ebdc32c1eff336d21bcec6ca2838979c3e8ae5a1ccfb1022397b6b5141b45f6641a250f2b22fe095207f60a552748fae557778aeae1de2732ea1106f414d445fb3491557c48ef393dd0ec7e40538b7639155048bb63d14970245975f0649f55cd785f2932c4e1b5b0a790253e58edf1ff5b6d8e20dc85333be6ae0b225eb78d154374695744752968c4fd94eff70265e118df9936f02358c997a9fbc68f9ae375bfcae0fef74fa4a585e9d6cdd7ef9baddb32007028f9e1834352ac77c6d596ea4160e7213ab8d1d67005a3b8f6ae1a3cc92fe3e2f1af67bd6a6f95c2487699a5f054ecfb4016f4bb65d14800a559f8b056de7a0dd1608bc721f5c41b2436c71b15f6c89526772b1a06c93b8456647517d80ab5591b4c8e032216897b1b2e8ebd226f694284f9f9d757f50ad4414ae3199ef44c9401bb38d16db40064c52547645af689956377695a40f1f5a7972a0a81793790da700e973cf56ddb00765ddb3071595f4cb221900c419d5cf04f6afdff901206bf5bedf6fc6aacb980eb27065afbce2ea363318e541cf54f6b82a6e00403399ed473cad6183a33d1de438db683d4613b1096c78a8a20780f51c284b1b6e39b79c92ca4ff5892f2761f65b2b8a6ae15dd048f6502348f67fd2a2c87633596943a3428956178149745fa34d0557c781329b61824f1f994177a7a2f97e24ab78165e878e6edb4df973205d714c58ae44776aa658157a73a4517d8b50a98414ea41d47707ae4a999a47344160b3b466e055df8cc544049cd44c36b79e1ef8402188f7142e497b6fa25d04442ab27398a6c205daa70df2fcd22a09192b73e5a2c499d44f309511c048d9ba30916847b18e98f8042308f63bdd6ac4aa09fa20da03c7bef2e9d3df0ac669ecb0c3e2153b0869004323be9d6fbb42ea6dd55cf08e227484a7d076fea4266d7bbf511d707ba7a96d1cb8499264c95e107f3aa1e5833ca16214ba4065bf5cea7e2ea37be1a6d491c3c3291effc7d6c90dfc8cdf81c514d08c061c02014aa7b41d658ca8b39a16c9bddb1cf543d391014ff45ed7be0d64c747de9901c848dd4c3b91ed3738eeee2a2a73ef5ed982330ee5b42f6d69a7b3156608bfafe916c3b5ca98fc4fd2810857957a8ba1a90c9b407d77af56fa7c29abfce2de2e05ffdf22f501db130df5332419130bf5b520e3f5d5230f967974a3a016f13a2f6285445c6a84b2446dbe57167649aab0881fba711ca40be852c74c35511b808d3e341ae739cd60cba1eefb37d9110cbf946d74b0ade017254a9f703d5213b4c56fd8bac1e1c33cf6ee2032866006569681c2173085e417247112a3c676d2a7cbf132d06bca52c6b7da650a43f55d27846ad9ba0365ed54c777f5a128f00bdf590a7bc6a6e01dd287399a6b34b29fe2452b5c1970b7a7e29937c312f60bda3103ecfed7d7f6c529f818d70bc6bec7e812d673cd5edc4a03680142409e900df2b4d3920d0ef48e28740254714bab66e9b7c09adc0ff0d520009f19f9732caa7980571d8d40c367d955087f5159807ceaa62be2712aa08df9b0d89bfdb92b648da40c9bbe3e98940e479f8d0d44685d5ab3b39a92ca0fd32ace182041ec9321ca9f1a75015bb44eeb5fc586c77de5a7337562acbe7415afcf1d0573c752dd8208c251e1bcdf6c39a0e493d382c1561b854aa3926680503f4b6952af759aa8c06c2e53ff49228b01c17313a20a91de070641315cef462946f45a2287eff93adf97cd3514ecffde2530e713cd02dbc60d350b1311b60b64d543cc8edd9bf0badde3ccc13e27e58d377f95a6b31c1542849a147403acb6f01428c497c589309b11ca78db59f68f2236eee7c9cd3b389d11f84b246160b756664ea297f2752faf95653caf607ea8a4067d68a4bc17e37adea80c6422a4e79a394f9f51067bd7593e4fe7a92d1c9cbdb26f175e8e486c6657ae42f2462bbc8699f804dca7ce0d35189f8581077cbd519b83452db07b6fae4afb9bd57ecc5e2e45ee633ea5e780d6d9ca0724f61a2909080859ddb8fc99d44cc17fe7a6cd7fe756da4bcfaefe81d7bb32ea6bc0a53e14ed8e20a8706456b0826c575a424b6891a1f0fb2a226b6ab1a390994e045f2b8e79655f544a7ab0a615fb0b2d2103105acd8e2f0e12acf79bd94ec05a004319bacce3e7c92d3cfc9dd64f31be6b14a50014dd8ff8a92874ec51deb30666de55c77cfaaa2f8002997804ad2a7c19593b84eee3ddc6c71fd24af4702fab7ae15038ba63e1a938e3123abc61e3bb36e2183a7212a5ce773452694cb3661db643148541fb53268a099b3b3619638f46fabdd598cf37cde6d32a0e180338329e138ac6d2243e71eea0d007cc72dd5dcf74e9a6376611b6436f9e5d7640a9bf909283c07ef7add290c807f3ed253be762c2be1e6d7a50af7f9aaeb3e3e932d09fc78aeab823e19d308069f3b8d6e00030b768665aa38f9146bb706d56b4bd93eb4d328be6352ee419ca84f414278f6ababa64144240529549f3b72d667859aeb4ebea352e137202af5b928af3b025679cbd3f9b6175a3a37d1eacfdf020d071f0572c8196270ee553d08ace34351b6849a18f1f35719754c947f88d2a040919dfb4fd1c27858ef8b1d06f00b26a6d58a0be7c6452a083f85d257f84ad7e745e54818bf0fad62c3296e445d39f0906cc5bf6b2dc6fc2b507e81930009e51c348c5b7f7152ecf85cefb31d16333b6696fb8aae390228b7a16a939906b37be6966a7a3fa992df3632aad73f0a92790690cb7239912fb302d9494c2063d3968ecbc219894c03c3fed9ed74431956b37a5617750aa8bebeadd223b11eeff3a2e9c627c51aab09993c3451194488158448e723558e7722da49765c9b330e29c3fc0e527d8190c7362a65c158ef4d226019dac88f845dc730451734859948337daed322c69fc40de45cbb8d51c3ff46121b81b14020bbd3a9069c358e546237095a20776f5a424939e76c8a010068697f846d6b5c46f15beff1dde0b03cd42eb743152e4883c5d1a77f7ad211c8f422da0976dc2bce9e033216a9fb3ba9aea7637adee90c04fd4b1361f6285a23f04617358ae89ebe0ded2063631edecd	2484ae3c3b81170f75e6ee512c04e14a.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\{99775875-CABF0019-E35A976B-94476C72}\ = 5292d7081907223fc212af7f666d0100086d456047073aca2f8662cb71b9101745ba28167dbb2c1161784c57603a4317d68ac4a0f6d3ab89c1e4dcd88c8fbc5d6df31ceecd2283cf461d0b701e9b734e26bddbd0490098ae4a9da773a559484807fd15eff802ac0f7d421019fb74d15b384e2d1d5c0c33a1a6bbcb29393c97d1cacbd826f475e9a4a3e64e55fd08ef61fdf0ac6ede838df9e3d3d68ec4a2ca086a1b13b6c6a4ab36991b37ce2ac2bf11ad3c7c126dc180bbc95667751a9849881c9e8f8c7d43ac0e5e3d8d90bf7e5293794190f8ff506dfb5f2eb263a6ae654268509d8ff09d1c70b35b618e98ddf273d8618b98c1f4cc67a02a739e160d4b9cfe0e6ca2bfc12d23209ee94cdba3c9897bbf16d28bcede9c72b3e9e9fb982e3243efdec2b2001612b5795b28b67b9a2eb05d9870756ed4433516a8cbfaa1e99bfb0e917d80ac203ec5131889c9844476a764ca55c0f87492d6370baa9e2673b4d629c480d4d4b507a78a15b804d5d987f7faea9666fb759157340a95190bb7fe9a6c0ebdc32c1eff336d21bcec6ca2838979c3e8ae5a1ccfb1022397b6b5141b45f6641a250f2b22fe095207f60a552748fae557778aeae1de2732ea1106f414d445fb3491557c48ef393dd0ec7e40538b7639155048bb63d14970245975f0649f55cd785f2932c4e1b5b0a790253e58edf1ff5b6d8e20dc85333be6ae0b225eb78d154374695744752968c4fd94eff70265e118df1981f62358c997a9fbc68f9ae375bfcae0fef74fa4a585e9d6cdd7ef9baddb32007028f9e1834352ac77c6d596ea4160e7213ab8d1d67005a3b8f6ae1a3cc92fe3e2f1af67bd6a6f95c2487699a5f054ecfb4016f4bb65d14800a559f8b056de7a0dd1608bc721f5c41b2436c71b15f6c89526772b1a06c93b8456647517d80ab5591b4c8e032216897b1b2e8ebd226f694284f9f9d757f50ad4414ae3199ef44c9401bb38d16db40064c52547645af689956377695a40f1f5a7972a0a81793790da700e973cf56ddb00765ddb3071595f4cb221900c419d5cf04f6afdff901206bf5bedf6fc6aacb980eb27065afbce2ea363318e541cf54f6b82a6e00403399ed473cad6183a33d1de438db683d4613b1096c78a8a20780f51c284b1b6e39b79c92ca4ff5892f2761f65b2b8a6ae15dd048f6502348f67fd2a2c87633596943a3428956178149745fa34d0557c781329b61824f1f994177a7a2f97e24ab78165e878e6edb4df973205d714c58ae44776aa658157a73a4517d8b50a98414ea41d47707ae4a999a47344160b3b466e055df8cc544049cd44c36b79e1ef8402188f7142e497b6fa25d04442ab27398a6c205daa70df2fcd22a09192b73e5a2c499d44f309511c048d9ba30916847b18e98f8042308f63bdd6ac4aa09fa20da03c7bef2e9d3df0ac669ecb0c3e2153b0869004323be9d6fbb42ea6dd55cf08e227484a7d076fea4266d7bbf511d707ba7a96d1cb8499264c95e107f3aa1e5833ca16214ba4065bf5cea7e2ea37be1a6d491c3c3291effc7d6c90dfc8cdf81c514d08c061c02014aa7b41d658ca8b39a16c9bddb1cf543d391014ff45ed7be0d64c747de9901c848dd4c3b91ed3738eeee2a2a73ef5ed982330ee5b42f6d69a7b3156608bfafe916c3b5ca98fc4fd2810857957a8ba1a90c9b407d77af56fa7c29abfce2de2e05ffdf22f501db130df5332419130bf5b520e3f5d5230f967974a3a016f13a2f6285445c6a84b2446dbe57167649aab0881fba711ca40be852c74c35511b808d3e341ae739cd60cba1eefb37d9110cbf946d74b0ade017254a9f703d5213b4c56fd8bac1e1c33cf6ee2032866006569681c2173085e417247112a3c676d2a7cbf132d06bca52c6b7da650a43f55d27846ad9ba0365ed54c777f5a128f00bdf590a7bc6a6e01dd287399a6b34b29fe2452b5c1970b7a7e29937c312f60bda3103ecfed7d7f6c529f818d70bc6bec7e812d673cd5edc4a03680142409e900df2b4d3920d0ef48e28740254714bab66e9b7c09adc0ff0d520009f19f9732caa7980571d8d40c367d955087f5159807ceaa62be2712aa08df9b0d89bfdb92b648da40c9bbe3e98940e479f8d0d44685d5ab3b39a92ca0fd32ace182041ec9321ca9f1a75015bb44eeb5fc586c77de5a7337562acbe7415afcf1d0573c752dd8208c251e1bcdf6c39a0e493d382c1561b854aa3926680503f4b6952af759aa8c06c2e53ff49228b01c17313a20a91de070641315cef462946f45a2287eff93adf97cd3514ecffde2530e713cd02dbc60d350b1311b60b64d543cc8edd9bf0badde3ccc13e27e58d377f95a6b31c1542849a147403acb6f01428c497c589309b11ca78db59f68f2236eee7c9cd3b389d11f84b246160b756664ea297f2752faf95653caf607ea8a4067d68a4bc17e37adea80c6422a4e79a394f9f51067bd7593e4fe7a92d1c9cbdb26f175e8e486c6657ae42f2462bbc8699f804dca7ce0d35189f8581077cbd519b83452db07b6fae4afb9bd57ecc5e2e45ee633ea5e780d6d9ca0724f61a2909080859ddb8fc99d44cc17fe7a6cd7fe756da4bcfaefe81d7bb32ea6bc0a53e14ed8e20a8706456b0826c575a424b6891a1f0fb2a226b6ab1a390994e045f2b8e79655f544a7ab0a615fb0b2d2103105acd8e2f0e12acf79bd94ec05a004319bacce3e7c92d3cfc9dd64f31be6b14a50014dd8ff8a92874ec51deb30666de55c77cfaaa2f8002997804ad2a7c19593b84eee3ddc6c71fd24af4702fab7ae15038ba63e1a938e3123abc61e3bb36e2183a7212a5ce773452694cb3661db643148541fb53268a099b3b3619638f46fabdd598cf37cde6d32a0e180338329e138ac6d2243e71eea0d007cc72dd5dcf74e9a6376611b6436f9e5d7640a9bf909283c07ef7add290c807f3ed253be762c2be1e6d7a50af7f9aaeb3e3e932d09fc78aeab823e19d308069f3b8d6e00030b768665aa38f9146bb706d56b4bd93eb4d328be6352ee419ca84f414278f6ababa64144240529549f3b72d667859aeb4ebea352e137202af5b928af3b025679cbd3f9b6175a3a37d1eacfdf020d071f0572c8196270ee553d08ace34351b6849a18f1f35719754c947f88d2a040919dfb4fd1c27858ef8b1d06f00b26a6d58a0be7c6452a083f85d257f84ad7e745e54818bf0fad62c3296e445d39f0906cc5bf6b2dc6fc2b507e81930009e51c348c5b7f7152ecf85cefb31d16333b6696fb8aae390228b7a16a939906b37be6966a7a3fa992df3632aad73f0a92790690cb7239912fb302d9494c2063d3968ecbc219894c03c3fed9ed74431956b37a5617750aa8bebeadd223b11eeff3a2e9c627c51aab09993c3451194488158448e723558e7722da49765c9b330e29c3fc0e527d8190c7362a65c158ef4d226019dac88f845dc730451734859948337daed322c69fc40de45cbb8d51c3ff46121b81b14020bbd3a9069c358e546237095a20776f5a424939e76c8a010068697f846d6b5c46f15beff1dde0b03cd42eb743152e4883c5d1a77f7ad211c8f422da0976dc2bce9e033216a9fb3ba9aea7637adee90c04fd4b1361f6285a23f04617358ae89ebe0ded2063631edecd	2484ae3c3b81170f75e6ee512c04e14a.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\{99775875-CABF0019-E35A976B-94476C72}\ = e09b27b81907223fc212af7f666d0100086d456047073aca2f8662cb71b9101745ba28167dbb2c1161784c57603a4317d68ac4a0f6d3ab89c1e4dcd88c8fbc5d6df31ceecd2283cf461d0b701e9b734e26bddbd0490098ae4a9da773a559484807fd15eff802ac0f7d421019fb74d15b384e2d1d5c0c33a1a6bbcb29393c97d1cacbd826f475e9a4a3e64e55fd08ef61fdf0ac6ede838df9e3d3d68ec4a2ca086d1b13b6c6a4ab36991b37ce2ac2bf11ad3c7c126dc180bbc95667751a9849881c9e8f8c7d43ac0e5e3d8d90bf7e5293794190f8ff506dfb5f2eb263a6ae654268509d8ff09d1c70b35b618e98ddf273d8618b98c1f4cc67a02a739e160d4b9cfe0e6ca2bfc12d23209ee94cdba3c9897bbf16d28bcede9c72b3e9e9fb982e3243efdec2b2001612b5795b28b67b9a2eb05d9870756ed4433516a8cbfaa1e99bfb0e917d80ac203ec5131889c9844476a764ca55c0f87492d6370baa9e2673b4d629c480d4d4b507a78a15b804d5d987f7faea9666fb759157340a95190bb7fe9a6c0ebdc32c1eff336d21bcec6ca2838979c3e8ae5a1ccfb1022397b6b5141b45f6641a250f2b22fe095207f60a552748fae557778aeae1de2732ea1106f414d445fb3491557c48ef393dd0ec7e40538b7639155048bb63d14970245975f0649f55cd785f2932c4e1b5b0a790253e58edf1ff5b6d8e20dc85333be6ae0b225eb78d154374695744752968c4fd94eff70265e118df3933f52358c997a9fbc68f9ae375bfcae0fef74fa4a585e9d6cdd7ef9baddb32007028f9e1834352ac77c6d596ea4160e7213ab8d1d67005a3b8f6ae1a3cc92fe3e2f1af67bd6a6f95c2487699a5f054ecfb4016f4bb65d14800a559f8b056de7a0dd1608bc721f5c41b2436c71b15f6c89526772b1a06c93b8456647517d80ab5591b4c8e032216897b1b2e8ebd226f694284f9f9d757f50ad4414ae3199ef44c9401bb38d16db40064c52547645af689956377695a40f1f5a7972a0a81793790da700e973cf56ddb00765ddb3071595f4cb221900c419d5cf04f6afdff901206bf5bedf6fc6aacb980eb27065afbce2ea363318e541cf54f6b82a6e00403399ed473cad6183a33d1de438db683d4613b1096c78a8a20780f51c284b1b6e39b79c92ca4ff5892f2761f65b2b8a6ae15dd048f6502348f67fd2a2c87633596943a3428956178149745fa34d0557c781329b61824f1f994177a7a2f97e24ab78165e878e6edb4df973205d714c58ae44776aa658157a73a4517d8b50a98414ea41d47707ae4a999a47344160b3b466e055df8cc544049cd44c36b79e1ef8402188f7142e497b6fa25d04442ab27398a6c205daa70df2fcd22a09192b73e5a2c499d44f309511c048d9ba30916847b18e98f8042308f63bdd6ac4aa09fa20da03c7bef2e9d3df0ac669ecb0c3e2153b0869004323be9d6fbb42ea6dd55cf08e227484a7d076fea4266d7bbf511d707ba7a96d1cb8499264c95e107f3aa1e5833ca16214ba4065bf5cea7e2ea37be1a6d491c3c3291effc7d6c90dfc8cdf81c514d08c061c02014aa7b41d658ca8b39a16c9bddb1cf543d391014ff45ed7be0d64c747de9901c848dd4c3b91ed3738eeee2a2a73ef5ed982330ee5b42f6d69a7b3156608bfafe916c3b5ca98fc4fd2810857957a8ba1a90c9b407d77af56fa7c29abfce2de2e05ffdf22f501db130df5332419130bf5b520e3f5d5230f967974a3a016f13a2f6285445c6a84b2446dbe57167649aab0881fba711ca40be852c74c35511b808d3e341ae739cd60cba1eefb37d9110cbf946d74b0ade017254a9f703d5213b4c56fd8bac1e1c33cf6ee2032866006569681c2173085e417247112a3c676d2a7cbf132d06bca52c6b7da650a43f55d27846ad9ba0365ed54c777f5a128f00bdf590a7bc6a6e01dd287399a6b34b29fe2452b5c1970b7a7e29937c312f60bda3103ecfed7d7f6c529f818d70bc6bec7e812d673cd5edc4a03680142409e900df2b4d3920d0ef48e28740254714bab66e9b7c09adc0ff0d520009f19f9732caa7980571d8d40c367d955087f5159807ceaa62be2712aa08df9b0d89bfdb92b648da40c9bbe3e98940e479f8d0d44685d5ab3b39a92ca0fd32ace182041ec9321ca9f1a75015bb44eeb5fc586c77de5a7337562acbe7415afcf1d0573c752dd8208c251e1bcdf6c39a0e493d382c1561b854aa3926680503f4b6952af759aa8c06c2e53ff49228b01c17313a20a91de070641315cef462946f45a2287eff93adf97cd3514ecffde2530e713cd02dbc60d350b1311b60b64d543cc8edd9bf0badde3ccc13e27e58d377f95a6b31c1542849a147403acb6f01428c497c589309b11ca78db59f68f2236eee7c9cd3b389d11f84b246160b756664ea297f2752faf95653caf607ea8a4067d68a4bc17e37adea80c6422a4e79a394f9f51067bd7593e4fe7a92d1c9cbdb26f175e8e486c6657ae42f2462bbc8699f804dca7ce0d35189f8581077cbd519b83452db07b6fae4afb9bd57ecc5e2e45ee633ea5e780d6d9ca0724f61a2909080859ddb8fc99d44cc17fe7a6cd7fe756da4bcfaefe81d7bb32ea6bc0a53e14ed8e20a8706456b0826c575a424b6891a1f0fb2a226b6ab1a390994e045f2b8e79655f544a7ab0a615fb0b2d2103105acd8e2f0e12acf79bd94ec05a004319bacce3e7c92d3cfc9dd64f31be6b14a50014dd8ff8a92874ec51deb30666de55c77cfaaa2f8002997804ad2a7c19593b84eee3ddc6c71fd24af4702fab7ae15038ba63e1a938e3123abc61e3bb36e2183a7212a5ce773452694cb3661db643148541fb53268a099b3b3619638f46fabdd598cf37cde6d32a0e180338329e138ac6d2243e71eea0d007cc72dd5dcf74e9a6376611b6436f9e5d7640a9bf909283c07ef7add290c807f3ed253be762c2be1e6d7a50af7f9aaeb3e3e932d09fc78aeab823e19d308069f3b8d6e00030b768665aa38f9146bb706d56b4bd93eb4d328be6352ee419ca84f414278f6ababa64144240529549f3b72d667859aeb4ebea352e137202af5b928af3b025679cbd3f9b6175a3a37d1eacfdf020d071f0572c8196270ee553d08ace34351b6849a18f1f35719754c947f88d2a040919dfb4fd1c27858ef8b1d06f00b26a6d58a0be7c6452a083f85d257f84ad7e745e54818bf0fad62c3296e445d39f0906cc5bf6b2dc6fc2b507e81930009e51c348c5b7f7152ecf85cefb31d16333b6696fb8aae390228b7a16a939906b37be6966a7a3fa992df3632aad73f0a92790690cb7239912fb302d9494c2063d3968ecbc219894c03c3fed9ed74431956b37a5617750aa8bebeadd223b11eeff3a2e9c627c51aab09993c3451194488158448e723558e7722da49765c9b330e29c3fc0e527d8190c7362a65c158ef4d226019dac88f845dc730451734859948337daed322c69fc40de45cbb8d51c3ff46121b81b14020bbd3a9069c358e546237095a20776f5a424939e76c8a010068697f846d6b5c46f15beff1dde0b03cd42eb743152e4883c5d1a77f7ad211c8f422da0976dc2bce9e033216a9fb3ba9aea7637adee90c04fd4b1361f6285a23f04617358ae89ebe0ded2063631edecd	2484ae3c3b81170f75e6ee512c04e14a.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2060	2484ae3c3b81170f75e6ee512c04e14a.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2060 wrote to memory of 2880	2060	2484ae3c3b81170f75e6ee512c04e14a.exe	28
PID 2060 wrote to memory of 2880	2060	2484ae3c3b81170f75e6ee512c04e14a.exe	28
PID 2060 wrote to memory of 2880	2060	2484ae3c3b81170f75e6ee512c04e14a.exe	28
PID 2060 wrote to memory of 2880	2060	2484ae3c3b81170f75e6ee512c04e14a.exe	28
PID 2060 wrote to memory of 2880	2060	2484ae3c3b81170f75e6ee512c04e14a.exe	28
PID 2060 wrote to memory of 2880	2060	2484ae3c3b81170f75e6ee512c04e14a.exe	28
PID 2060 wrote to memory of 2880	2060	2484ae3c3b81170f75e6ee512c04e14a.exe	28
PID 2060 wrote to memory of 2880	2060	2484ae3c3b81170f75e6ee512c04e14a.exe	28

C:\Users\Admin\AppData\Local\Temp\2484ae3c3b81170f75e6ee512c04e14a.exe
"C:\Users\Admin\AppData\Local\Temp\2484ae3c3b81170f75e6ee512c04e14a.exe"
1⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2060
- C:\Users\Admin\AppData\Local\Temp\2484ae3c3b81170f75e6ee512c04e14a.exe
  C:\Users\Admin\AppData\Local\Temp\2484ae3c3b81170f75e6ee512c04e14a.exe
  2⤵
  PID:2880

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\PCGWIN32.LI5

Filesize
2KB

MD5
32d32badc2cd31d0aaf60665620d3ae2

SHA1
7436dd23742e8594a62fb6500a097bd1cc711c08

SHA256
a21049f98d7786e943c21a4155f9d43f8422731b924ab7b0496e9ec8eb7f28e6

SHA512
ff317663b16d17279a9116c53bad83b2ac84e236d8fcced35befe203ccd09e5f5ceb9cef8651810b501f2ba9070b0bcdd1e5e550cb614caf4218d7de2c4e3581

Download Submit
memory/2060-0-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2060-13-0x0000000000320000-0x0000000000347000-memory.dmp

Filesize
156KB

Download
memory/2060-24-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2880-20-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2880-18-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2880-16-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2880-22-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2880-25-0x0000000000400000-0x0000000000408960-memory.dmp

Filesize
34KB

Download
memory/2880-26-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2880-14-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2880-27-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2880-28-0x0000000000400000-0x0000000000408960-memory.dmp

Filesize
34KB

Download
memory/2880-29-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download

Analysis

Sharing