64345c64a8c7d5284c5f47f17bc0a8ab1c3509c278c109718b918ba6f3197317

Analysis

max time kernel
187s
max time network
193s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 12:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

420d027e39579a6ead3c92699ebc7567.exe
Size

460KB
MD5

420d027e39579a6ead3c92699ebc7567
SHA1

c1c08b77d14d6b33848ee6d04d4a30aafe3d8a08
SHA256

64345c64a8c7d5284c5f47f17bc0a8ab1c3509c278c109718b918ba6f3197317
SHA512

a73921528df774c64579ffe5337c1b5f144ca75ad2949a2d7a739572aa83173e697232fd9d3f16b30f7f01b47815b2a739be6843beb6bb3b91f664b21ff3e631
SSDEEP

12288:glSt6oIHNOhU5O5TYo4XqTig5GSR9CClDDL:glSt69HNx6T/5xT

Score

10^/10

evasion persistence upx

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	cuehee.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	iBdqphzke5.exe

Deletes itself 1 IoCs

pid	Process
1976	cmd.exe

Executes dropped EXE 7 IoCs

pid	Process
2152	iBdqphzke5.exe
3044	cuehee.exe
2036	astat.exe
2688	astat.exe
2268	dstat.exe
1576	fstat.exe
336	csrss.exe

Loads dropped DLL 14 IoCs

pid	Process
2740	420d027e39579a6ead3c92699ebc7567.exe
2740	420d027e39579a6ead3c92699ebc7567.exe
2152	iBdqphzke5.exe
2152	iBdqphzke5.exe
2740	420d027e39579a6ead3c92699ebc7567.exe
2740	420d027e39579a6ead3c92699ebc7567.exe
1140	WerFault.exe
1140	WerFault.exe
1140	WerFault.exe
2740	420d027e39579a6ead3c92699ebc7567.exe
2740	420d027e39579a6ead3c92699ebc7567.exe
1140	WerFault.exe
2740	420d027e39579a6ead3c92699ebc7567.exe
2740	420d027e39579a6ead3c92699ebc7567.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2688-41-0x0000000000400000-0x000000000040E000-memory.dmp	upx
behavioral1/memory/2688-43-0x0000000000400000-0x000000000040E000-memory.dmp	upx
behavioral1/memory/2688-47-0x0000000000400000-0x000000000040E000-memory.dmp	upx
behavioral1/memory/2688-50-0x0000000000400000-0x000000000040E000-memory.dmp	upx
behavioral1/memory/2688-53-0x0000000000400000-0x000000000040E000-memory.dmp	upx
behavioral1/memory/2688-52-0x0000000000400000-0x000000000040E000-memory.dmp	upx

Adds Run key to start application 2 TTPs 52 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Windows\CurrentVersion\Run\cuehee = "C:\\Users\\Admin\\cuehee.exe /U"	cuehee.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Windows\CurrentVersion\Run\cuehee = "C:\\Users\\Admin\\cuehee.exe /x"	cuehee.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Windows\CurrentVersion\Run\cuehee = "C:\\Users\\Admin\\cuehee.exe /V"	cuehee.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Windows\CurrentVersion\Run\cuehee = "C:\\Users\\Admin\\cuehee.exe /Z"	cuehee.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Windows\CurrentVersion\Run\cuehee = "C:\\Users\\Admin\\cuehee.exe /r"	cuehee.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Windows\CurrentVersion\Run\cuehee = "C:\\Users\\Admin\\cuehee.exe /i"	cuehee.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Windows\CurrentVersion\Run\cuehee = "C:\\Users\\Admin\\cuehee.exe /K"	cuehee.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Windows\CurrentVersion\Run\cuehee = "C:\\Users\\Admin\\cuehee.exe /O"	cuehee.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Windows\CurrentVersion\Run\cuehee = "C:\\Users\\Admin\\cuehee.exe /a"	cuehee.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Windows\CurrentVersion\Run\cuehee = "C:\\Users\\Admin\\cuehee.exe /g"	cuehee.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Windows\CurrentVersion\Run\cuehee = "C:\\Users\\Admin\\cuehee.exe /T"	cuehee.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Windows\CurrentVersion\Run\cuehee = "C:\\Users\\Admin\\cuehee.exe /D"	cuehee.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Windows\CurrentVersion\Run\cuehee = "C:\\Users\\Admin\\cuehee.exe /N"	cuehee.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Windows\CurrentVersion\Run\cuehee = "C:\\Users\\Admin\\cuehee.exe /q"	cuehee.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Windows\CurrentVersion\Run\cuehee = "C:\\Users\\Admin\\cuehee.exe /m"	cuehee.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Windows\CurrentVersion\Run\cuehee = "C:\\Users\\Admin\\cuehee.exe /B"	cuehee.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Windows\CurrentVersion\Run\cuehee = "C:\\Users\\Admin\\cuehee.exe /z"	cuehee.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Windows\CurrentVersion\Run\cuehee = "C:\\Users\\Admin\\cuehee.exe /f"	cuehee.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Windows\CurrentVersion\Run\cuehee = "C:\\Users\\Admin\\cuehee.exe /y"	cuehee.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Windows\CurrentVersion\Run\cuehee = "C:\\Users\\Admin\\cuehee.exe /l"	cuehee.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Windows\CurrentVersion\Run\cuehee = "C:\\Users\\Admin\\cuehee.exe /s"	cuehee.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Windows\CurrentVersion\Run\cuehee = "C:\\Users\\Admin\\cuehee.exe /M"	cuehee.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Windows\CurrentVersion\Run\cuehee = "C:\\Users\\Admin\\cuehee.exe /n"	cuehee.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Windows\CurrentVersion\Run\cuehee = "C:\\Users\\Admin\\cuehee.exe /u"	cuehee.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Windows\CurrentVersion\Run\cuehee = "C:\\Users\\Admin\\cuehee.exe /Q"	cuehee.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Windows\CurrentVersion\Run\cuehee = "C:\\Users\\Admin\\cuehee.exe /b"	cuehee.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Windows\CurrentVersion\Run\cuehee = "C:\\Users\\Admin\\cuehee.exe /E"	cuehee.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Windows\CurrentVersion\Run\cuehee = "C:\\Users\\Admin\\cuehee.exe /H"	cuehee.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Windows\CurrentVersion\Run\cuehee = "C:\\Users\\Admin\\cuehee.exe /h"	cuehee.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Windows\CurrentVersion\Run\cuehee = "C:\\Users\\Admin\\cuehee.exe /j"	cuehee.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Windows\CurrentVersion\Run\cuehee = "C:\\Users\\Admin\\cuehee.exe /J"	cuehee.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Windows\CurrentVersion\Run\cuehee = "C:\\Users\\Admin\\cuehee.exe /R"	cuehee.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Windows\CurrentVersion\Run\cuehee = "C:\\Users\\Admin\\cuehee.exe /I"	cuehee.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Windows\CurrentVersion\Run\cuehee = "C:\\Users\\Admin\\cuehee.exe /X"	cuehee.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Windows\CurrentVersion\Run\cuehee = "C:\\Users\\Admin\\cuehee.exe /P"	cuehee.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Windows\CurrentVersion\Run\cuehee = "C:\\Users\\Admin\\cuehee.exe /G"	cuehee.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Windows\CurrentVersion\Run\cuehee = "C:\\Users\\Admin\\cuehee.exe /I"	iBdqphzke5.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Windows\CurrentVersion\Run\cuehee = "C:\\Users\\Admin\\cuehee.exe /A"	cuehee.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Windows\CurrentVersion\Run\cuehee = "C:\\Users\\Admin\\cuehee.exe /C"	cuehee.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Windows\CurrentVersion\Run\cuehee = "C:\\Users\\Admin\\cuehee.exe /Y"	cuehee.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Windows\CurrentVersion\Run\cuehee = "C:\\Users\\Admin\\cuehee.exe /w"	cuehee.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Windows\CurrentVersion\Run\cuehee = "C:\\Users\\Admin\\cuehee.exe /F"	cuehee.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Windows\CurrentVersion\Run\cuehee = "C:\\Users\\Admin\\cuehee.exe /S"	cuehee.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Windows\CurrentVersion\Run\cuehee = "C:\\Users\\Admin\\cuehee.exe /p"	cuehee.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Windows\CurrentVersion\Run\cuehee = "C:\\Users\\Admin\\cuehee.exe /v"	cuehee.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Windows\CurrentVersion\Run\cuehee = "C:\\Users\\Admin\\cuehee.exe /W"	cuehee.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Windows\CurrentVersion\Run\cuehee = "C:\\Users\\Admin\\cuehee.exe /k"	cuehee.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Windows\CurrentVersion\Run\cuehee = "C:\\Users\\Admin\\cuehee.exe /d"	cuehee.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Windows\CurrentVersion\Run\cuehee = "C:\\Users\\Admin\\cuehee.exe /L"	cuehee.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Windows\CurrentVersion\Run\cuehee = "C:\\Users\\Admin\\cuehee.exe /e"	cuehee.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Windows\CurrentVersion\Run\cuehee = "C:\\Users\\Admin\\cuehee.exe /o"	cuehee.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Windows\CurrentVersion\Run\cuehee = "C:\\Users\\Admin\\cuehee.exe /t"	cuehee.exe

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File created	\systemroot\assembly\GAC_64\Desktop.ini	csrss.exe
File created	\systemroot\assembly\GAC_32\Desktop.ini	csrss.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2036 set thread context of 2688	2036	astat.exe	34
PID 1576 set thread context of 1484	1576	fstat.exe	40

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1140	2688	WerFault.exe	34

Enumerates processes with tasklist 1 TTPs 2 IoCs

Process Discovery

T1057

pid	Process
2944	tasklist.exe
1984	tasklist.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2152	iBdqphzke5.exe
2152	iBdqphzke5.exe
3044	cuehee.exe
3044	cuehee.exe
3044	cuehee.exe
3044	cuehee.exe
3044	cuehee.exe
3044	cuehee.exe
3044	cuehee.exe
3044	cuehee.exe
3044	cuehee.exe
3044	cuehee.exe
3044	cuehee.exe
3044	cuehee.exe
3044	cuehee.exe
3044	cuehee.exe
3044	cuehee.exe
3044	cuehee.exe
3044	cuehee.exe
3044	cuehee.exe
3044	cuehee.exe
3044	cuehee.exe
3044	cuehee.exe
3044	cuehee.exe
3044	cuehee.exe
3044	cuehee.exe
3044	cuehee.exe
3044	cuehee.exe
3044	cuehee.exe
3044	cuehee.exe
3044	cuehee.exe
3044	cuehee.exe
3044	cuehee.exe
3044	cuehee.exe
3044	cuehee.exe
3044	cuehee.exe
3044	cuehee.exe
3044	cuehee.exe
3044	cuehee.exe
3044	cuehee.exe
3044	cuehee.exe
3044	cuehee.exe
3044	cuehee.exe
3044	cuehee.exe
3044	cuehee.exe
3044	cuehee.exe
3044	cuehee.exe
3044	cuehee.exe
3044	cuehee.exe
1576	fstat.exe
1576	fstat.exe
1576	fstat.exe
3044	cuehee.exe
3044	cuehee.exe
3044	cuehee.exe
3044	cuehee.exe
3044	cuehee.exe
3044	cuehee.exe
3044	cuehee.exe
3044	cuehee.exe
3044	cuehee.exe
3044	cuehee.exe
3044	cuehee.exe
3044	cuehee.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2944	tasklist.exe
Token: SeDebugPrivilege	1576	fstat.exe
Token: SeDebugPrivilege	1576	fstat.exe
Token: SeDebugPrivilege	1984	tasklist.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
2740	420d027e39579a6ead3c92699ebc7567.exe
2152	iBdqphzke5.exe
3044	cuehee.exe
2036	astat.exe
2268	dstat.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
336	csrss.exe

Suspicious use of WriteProcessMemory 58 IoCs

description	pid	Process	procid_target
PID 2740 wrote to memory of 2152	2740	420d027e39579a6ead3c92699ebc7567.exe	28
PID 2740 wrote to memory of 2152	2740	420d027e39579a6ead3c92699ebc7567.exe	28
PID 2740 wrote to memory of 2152	2740	420d027e39579a6ead3c92699ebc7567.exe	28
PID 2740 wrote to memory of 2152	2740	420d027e39579a6ead3c92699ebc7567.exe	28
PID 2152 wrote to memory of 3044	2152	iBdqphzke5.exe	30
PID 2152 wrote to memory of 3044	2152	iBdqphzke5.exe	30
PID 2152 wrote to memory of 3044	2152	iBdqphzke5.exe	30
PID 2152 wrote to memory of 3044	2152	iBdqphzke5.exe	30
PID 2740 wrote to memory of 2036	2740	420d027e39579a6ead3c92699ebc7567.exe	31
PID 2740 wrote to memory of 2036	2740	420d027e39579a6ead3c92699ebc7567.exe	31
PID 2740 wrote to memory of 2036	2740	420d027e39579a6ead3c92699ebc7567.exe	31
PID 2740 wrote to memory of 2036	2740	420d027e39579a6ead3c92699ebc7567.exe	31
PID 2152 wrote to memory of 2852	2152	iBdqphzke5.exe	32
PID 2152 wrote to memory of 2852	2152	iBdqphzke5.exe	32
PID 2152 wrote to memory of 2852	2152	iBdqphzke5.exe	32
PID 2152 wrote to memory of 2852	2152	iBdqphzke5.exe	32
PID 2036 wrote to memory of 2688	2036	astat.exe	34
PID 2036 wrote to memory of 2688	2036	astat.exe	34
PID 2036 wrote to memory of 2688	2036	astat.exe	34
PID 2036 wrote to memory of 2688	2036	astat.exe	34
PID 2852 wrote to memory of 2944	2852	cmd.exe	35
PID 2852 wrote to memory of 2944	2852	cmd.exe	35
PID 2852 wrote to memory of 2944	2852	cmd.exe	35
PID 2852 wrote to memory of 2944	2852	cmd.exe	35
PID 2036 wrote to memory of 2688	2036	astat.exe	34
PID 2036 wrote to memory of 2688	2036	astat.exe	34
PID 2036 wrote to memory of 2688	2036	astat.exe	34
PID 2036 wrote to memory of 2688	2036	astat.exe	34
PID 2688 wrote to memory of 1140	2688	astat.exe	36
PID 2688 wrote to memory of 1140	2688	astat.exe	36
PID 2688 wrote to memory of 1140	2688	astat.exe	36
PID 2688 wrote to memory of 1140	2688	astat.exe	36
PID 2740 wrote to memory of 2268	2740	420d027e39579a6ead3c92699ebc7567.exe	38
PID 2740 wrote to memory of 2268	2740	420d027e39579a6ead3c92699ebc7567.exe	38
PID 2740 wrote to memory of 2268	2740	420d027e39579a6ead3c92699ebc7567.exe	38
PID 2740 wrote to memory of 2268	2740	420d027e39579a6ead3c92699ebc7567.exe	38
PID 2740 wrote to memory of 1576	2740	420d027e39579a6ead3c92699ebc7567.exe	39
PID 2740 wrote to memory of 1576	2740	420d027e39579a6ead3c92699ebc7567.exe	39
PID 2740 wrote to memory of 1576	2740	420d027e39579a6ead3c92699ebc7567.exe	39
PID 2740 wrote to memory of 1576	2740	420d027e39579a6ead3c92699ebc7567.exe	39
PID 1576 wrote to memory of 1380	1576	fstat.exe	9
PID 1576 wrote to memory of 336	1576	fstat.exe	24
PID 1576 wrote to memory of 1484	1576	fstat.exe	40
PID 1576 wrote to memory of 1484	1576	fstat.exe	40
PID 1576 wrote to memory of 1484	1576	fstat.exe	40
PID 1576 wrote to memory of 1484	1576	fstat.exe	40
PID 1576 wrote to memory of 1484	1576	fstat.exe	40
PID 2740 wrote to memory of 1976	2740	420d027e39579a6ead3c92699ebc7567.exe	42
PID 2740 wrote to memory of 1976	2740	420d027e39579a6ead3c92699ebc7567.exe	42
PID 2740 wrote to memory of 1976	2740	420d027e39579a6ead3c92699ebc7567.exe	42
PID 2740 wrote to memory of 1976	2740	420d027e39579a6ead3c92699ebc7567.exe	42
PID 1976 wrote to memory of 1984	1976	cmd.exe	44
PID 1976 wrote to memory of 1984	1976	cmd.exe	44
PID 1976 wrote to memory of 1984	1976	cmd.exe	44
PID 1976 wrote to memory of 1984	1976	cmd.exe	44
PID 3044 wrote to memory of 1984	3044	cuehee.exe	44
PID 3044 wrote to memory of 1984	3044	cuehee.exe	44
PID 336 wrote to memory of 844	336	csrss.exe	7

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs
1⤵
PID:844

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1380
- C:\Users\Admin\AppData\Local\Temp\420d027e39579a6ead3c92699ebc7567.exe
  "C:\Users\Admin\AppData\Local\Temp\420d027e39579a6ead3c92699ebc7567.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2740
- - C:\Users\Admin\iBdqphzke5.exe
    C:\Users\Admin\iBdqphzke5.exe
    3⤵
    - Modifies visiblity of hidden/system files in Explorer
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2152
  - - C:\Users\Admin\cuehee.exe
      "C:\Users\Admin\cuehee.exe"
      4⤵
      Modifies visiblity of hidden/system files in Explorer
      Executes dropped EXE
      Adds Run key to start application
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3044
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c tasklist&&del iBdqphzke5.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2852
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:2944
- - C:\Users\Admin\astat.exe
    C:\Users\Admin\astat.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2036
  - - C:\Users\Admin\astat.exe
      "C:\Users\Admin\astat.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:2688
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2688 -s 88
        5⤵
        Loads dropped DLL
        Program crash
        
        PID:1140
- - C:\Users\Admin\dstat.exe
    C:\Users\Admin\dstat.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2268
- - C:\Users\Admin\fstat.exe
    C:\Users\Admin\fstat.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1576
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe"
      4⤵
      PID:1484
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c tasklist&&del 420d027e39579a6ead3c92699ebc7567.exe
    3⤵
    - Deletes itself
    - Suspicious use of WriteProcessMemory
    PID:1976
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:1984

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:336

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Process Discovery

T1057

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\astat.exe

Filesize
60KB

MD5
87c6498966e3f85fac743c89050aa312

SHA1
05c165c34cbfa14e4925c33ace81992b0f50a2b5

SHA256
30c8328585e41968aff773da16cedbe590dcefd293c7fa74a69c557ecbf2c3c5

SHA512
740f7159ee78f73e57c92e583b8c4f97c5dd49b68b9c321da976d7e318819daa28e8dfc76e95e1e3ccee643dc464324c40b481d1849863e287d826adb577b420

Download Submit
C:\Windows\system32\consrv.dll

Filesize
53KB

MD5
4d7cde615a0f534bd5e359951829554b

SHA1
c885d00d9000f2a5dbc78f6193a052b36f4fe968

SHA256
414fdf9bdcae5136c1295d6d24740c50a484acd81f1f7d0fb5d5c138607cb80a

SHA512
33d632f9fbb694440a1ca568c90518784278efd1dc9ee2b57028149d56ebe1f7346d5b59dcfafee2eeaa10091dda05f48958e909d6bfc891e037ae1cfbd048d4

Download Submit
\??\globalroot\systemroot\assembly\temp\@

Filesize
2KB

MD5
5725c6ea19b306c262bca4bcd5a5b2fc

SHA1
d6e9758e8d28662a00d4fb6694a1ce8b672a4d46

SHA256
9e70931111cdf5750af6fbef850ff625d56a3d26138ec60a5bcafadafd701447

SHA512
c703605f08143eea0d4f5a8bfac89599e6667aba94147cf7dab67ebd17e8fa7b4ff7d330c442874a36533d0e2358f22a1ff860eaa4655419c1ef18e19a9bd7e1

Download Submit
\Users\Admin\cuehee.exe

Filesize
244KB

MD5
4ba47c41d6d5c849e0023005a73da25f

SHA1
6446d892052e0e087c387897f09b5595b6b9defc

SHA256
99ae8f603100eb4d73b01363862305a2b860eda4fdacbca36d8a0ee274f88d53

SHA512
416cd498b974a8bcc8a94be410b61adf5290bad0e8436b379e42ce98b3a029c237936e6db2f9b1312dfd177c97bf651f066c86542626f8333e35ad49f6986d09

Download Submit
\Users\Admin\dstat.exe

Filesize
36KB

MD5
b6da847084e39e0cecf175c32c91b4bb

SHA1
fbfd9494fabed5220cdf01866ff088fe7adc535b

SHA256
065781e8a55cf59cb926d5950e0039e19b50b1e081023404fbff4d7a32fc9cbe

SHA512
59d372ea36904cd48c99f2f34740c22004b35c5e5dada2417813b0463292af19e4aa5ba4552cc443da373e40ba03a1f7906019a567806806f5972c202a31d9d2

Download Submit
\Users\Admin\fstat.exe

Filesize
271KB

MD5
34353cf7e1d1b10bcbbcae0745110535

SHA1
2fb471681daac6f6d66477b7772025da4f58c508

SHA256
b2d7a66e2d10d8943e48d6f3ad75237ff379e82ab0101a620406c4569be1d959

SHA512
7404f82abfabd21d6f2a88b55f6f0ff886bb0a1f16a9d45c6883d74daa26451f862a10a78646c549c3a3264ba4bd9fb44949d470493af895973dd05a0ec311e6

Download Submit
\Users\Admin\iBdqphzke5.exe

Filesize
244KB

MD5
a4cdb62cf4866a17e742e7e9cc73d237

SHA1
30d94f8e872455ac569949ac4c768d0a0cdfbba7

SHA256
c741d649bf5b72fbe97470820ce994ce29b153baae14af10c3a2a9adc3098b32

SHA512
c4447f95565d3e5dc0ef7712382325280bedf127ac682f85f4043b586afb4188633f2c73277595eb31fe45d992107492f42c82a71f448286a9cb8fac4bfb3671

Download Submit
memory/336-127-0x0000000002150000-0x0000000002162000-memory.dmp

Filesize
72KB

Download
memory/336-125-0x00000000020F0000-0x00000000020F1000-memory.dmp

Filesize
4KB

Download
memory/336-142-0x0000000002150000-0x0000000002162000-memory.dmp

Filesize
72KB

Download
memory/336-138-0x0000000002150000-0x0000000002162000-memory.dmp

Filesize
72KB

Download
memory/336-128-0x0000000002150000-0x0000000002162000-memory.dmp

Filesize
72KB

Download
memory/844-154-0x0000000002150000-0x0000000002162000-memory.dmp

Filesize
72KB

Download
memory/844-155-0x00000000008B0000-0x00000000008BB000-memory.dmp

Filesize
44KB

Download
memory/844-153-0x00000000008A0000-0x00000000008AB000-memory.dmp

Filesize
44KB

Download
memory/844-145-0x00000000008A0000-0x00000000008AB000-memory.dmp

Filesize
44KB

Download
memory/844-149-0x00000000008A0000-0x00000000008AB000-memory.dmp

Filesize
44KB

Download
memory/1380-103-0x00000000025A0000-0x00000000025A6000-memory.dmp

Filesize
24KB

Download
memory/1380-112-0x00000000025A0000-0x00000000025A6000-memory.dmp

Filesize
24KB

Download
memory/1380-108-0x00000000025A0000-0x00000000025A6000-memory.dmp

Filesize
24KB

Download
memory/1380-105-0x0000000002590000-0x0000000002592000-memory.dmp

Filesize
8KB

Download
memory/1576-78-0x00000000020A0000-0x00000000020A1000-memory.dmp

Filesize
4KB

Download
memory/1576-115-0x0000000002380000-0x00000000023C6000-memory.dmp

Filesize
280KB

Download
memory/1576-91-0x0000000002B60000-0x0000000002B9D000-memory.dmp

Filesize
244KB

Download
memory/1576-92-0x0000000003100000-0x0000000003101000-memory.dmp

Filesize
4KB

Download
memory/1576-93-0x0000000002B60000-0x0000000002B9D000-memory.dmp

Filesize
244KB

Download
memory/1576-94-0x0000000002B60000-0x0000000002B9D000-memory.dmp

Filesize
244KB

Download
memory/1576-95-0x0000000002B60000-0x0000000002B9D000-memory.dmp

Filesize
244KB

Download
memory/1576-96-0x0000000003110000-0x000000000314D000-memory.dmp

Filesize
244KB

Download
memory/1576-98-0x0000000003810000-0x0000000003811000-memory.dmp

Filesize
4KB

Download
memory/1576-100-0x0000000002B60000-0x0000000002B9D000-memory.dmp

Filesize
244KB

Download
memory/1576-101-0x0000000002B60000-0x0000000002B9D000-memory.dmp

Filesize
244KB

Download
memory/1576-87-0x0000000002B60000-0x0000000002B9D000-memory.dmp

Filesize
244KB

Download
memory/1576-102-0x0000000002B60000-0x0000000002B9D000-memory.dmp

Filesize
244KB

Download
memory/1576-86-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/1576-83-0x0000000002B60000-0x0000000002B9D000-memory.dmp

Filesize
244KB

Download
memory/1576-82-0x0000000002950000-0x0000000002951000-memory.dmp

Filesize
4KB

Download
memory/1576-113-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/1576-90-0x0000000002B60000-0x0000000002B9D000-memory.dmp

Filesize
244KB

Download
memory/1576-117-0x0000000002B60000-0x0000000002B9D000-memory.dmp

Filesize
244KB

Download
memory/1576-119-0x0000000003110000-0x000000000314D000-memory.dmp

Filesize
244KB

Download
memory/1576-81-0x0000000002380000-0x00000000023C6000-memory.dmp

Filesize
280KB

Download
memory/1576-80-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/1576-79-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/1576-132-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/1576-134-0x0000000003110000-0x000000000314D000-memory.dmp

Filesize
244KB

Download
memory/1576-133-0x0000000002B60000-0x0000000002B9D000-memory.dmp

Filesize
244KB

Download
memory/2152-28-0x00000000032E0000-0x0000000003D9A000-memory.dmp

Filesize
10.7MB

Download
memory/2688-52-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2688-53-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2688-50-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2688-45-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2688-47-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2688-43-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2688-41-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2688-39-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download