9a9e962f5ffbf83bcd4c4e75a968986d77bddeb11fea7e74534673e93e99c20e

Analysis

max time kernel
0s
max time network
110s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
09-01-2024 12:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4e430563a138c5fd55d7f7a7ea561806.exe
Size

2.0MB
MD5

4e430563a138c5fd55d7f7a7ea561806
SHA1

58a2f0061dc12629ea6a8113b1ee78fd4703c93a
SHA256

9a9e962f5ffbf83bcd4c4e75a968986d77bddeb11fea7e74534673e93e99c20e
SHA512

2ca274c002ebb6fba19d8cc043e0f758d1498c37b4970e351ce0d0ac60fa9b858213f2d475629778b6996014f1ee8d7b71a8153aaee483d97660713ca530cb4f
SSDEEP

49152:ACOxOJTYTGDqc6dGomH6gOT9dkwZMfxPUTqn9ic6f:HOx0pD36wo0f+hS30cc

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
220	mightkak.exe
3420	mightkak.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Index = "C:\\Windows\\system32\\wbem\\systray.exe"	Process not Found

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\wbem\systray.exe	Process not Found
File opened for modification	C:\Windows\SysWOW64\wbem\systray.exe	Process not Found
File created	\??\c:\windows\SysWOW64\tmp0101.bat	Process not Found

Drops file in Windows directory 7 IoCs

description	ioc	Process
File created	\??\c:\windows\kak.bat	Process not Found
File opened for modification	\??\c:\windows\kak.bat	Process not Found
File created	\??\c:\windows\kak2.bat	Process not Found
File opened for modification	\??\c:\windows\kak2.bat	Process not Found
File created	C:\windows\mightkak.exe	Process not Found
File created	C:\windows\mightkak.reg	Process not Found
File created	\??\c:\windows\ntldr.txt	Process not Found

Creates scheduled task(s) 1 TTPs 8 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2600	schtasks.exe
4508	schtasks.exe
832	schtasks.exe
4508	schtasks.exe
4392	schtasks.exe
3452	schtasks.exe
4944	schtasks.exe
2492	schtasks.exe

Runs .reg file with regedit 2 IoCs

pid	Process
3188	regedit.exe
2020	regedit.exe

Runs ping.exe 1 TTPs 12 IoCs

Remote System Discovery

T1018

pid	Process
2036	PING.EXE
3116	PING.EXE
2848	PING.EXE
4808	PING.EXE
3188	PING.EXE
2056	PING.EXE
4904	PING.EXE
2636	PING.EXE
4248	PING.EXE
4640	PING.EXE
1320	PING.EXE
4772	PING.EXE

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4532	Process not Found
4532	Process not Found
4532	Process not Found
4532	Process not Found
4532	Process not Found
4532	Process not Found
4532	Process not Found
4532	Process not Found
4532	Process not Found
4532	Process not Found
4532	Process not Found
4532	Process not Found
4532	Process not Found
4532	Process not Found

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeBackupPrivilege	220	mightkak.exe
Token: SeRestorePrivilege	220	mightkak.exe
Token: SeBackupPrivilege	3420	mightkak.exe
Token: SeRestorePrivilege	3420	mightkak.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4532	4e430563a138c5fd55d7f7a7ea561806.exe
4532	4e430563a138c5fd55d7f7a7ea561806.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 4532 wrote to memory of 220	4532	Process not Found	158
PID 4532 wrote to memory of 220	4532	Process not Found	158
PID 4532 wrote to memory of 220	4532	Process not Found	158
PID 4532 wrote to memory of 2020	4532	Process not Found	157
PID 4532 wrote to memory of 2020	4532	Process not Found	157
PID 4532 wrote to memory of 2020	4532	Process not Found	157
PID 4532 wrote to memory of 3420	4532	Process not Found	156
PID 4532 wrote to memory of 3420	4532	Process not Found	156
PID 4532 wrote to memory of 3420	4532	Process not Found	156
PID 4532 wrote to memory of 764	4532	Process not Found	154
PID 4532 wrote to memory of 764	4532	Process not Found	154
PID 4532 wrote to memory of 764	4532	Process not Found	154
PID 4532 wrote to memory of 3068	4532	Process not Found	227
PID 4532 wrote to memory of 3068	4532	Process not Found	227
PID 4532 wrote to memory of 3068	4532	Process not Found	227
PID 4532 wrote to memory of 4944	4532	Process not Found	152
PID 4532 wrote to memory of 4944	4532	Process not Found	152
PID 4532 wrote to memory of 4944	4532	Process not Found	152
PID 4532 wrote to memory of 3452	4532	Process not Found	149
PID 4532 wrote to memory of 3452	4532	Process not Found	149
PID 4532 wrote to memory of 3452	4532	Process not Found	149
PID 4532 wrote to memory of 4392	4532	Process not Found	148
PID 4532 wrote to memory of 4392	4532	Process not Found	148
PID 4532 wrote to memory of 4392	4532	Process not Found	148
PID 4532 wrote to memory of 4508	4532	Process not Found	147
PID 4532 wrote to memory of 4508	4532	Process not Found	147
PID 4532 wrote to memory of 4508	4532	Process not Found	147
PID 4532 wrote to memory of 1928	4532	Process not Found	146
PID 4532 wrote to memory of 1928	4532	Process not Found	146
PID 4532 wrote to memory of 1928	4532	Process not Found	146
PID 764 wrote to memory of 1552	764	cmd.exe	143
PID 764 wrote to memory of 1552	764	cmd.exe	143
PID 764 wrote to memory of 1552	764	cmd.exe	143

C:\Users\Admin\AppData\Local\Temp\4e430563a138c5fd55d7f7a7ea561806.exe
"C:\Users\Admin\AppData\Local\Temp\4e430563a138c5fd55d7f7a7ea561806.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:4532
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c c:\windows\system32\tmp0101.bat
  2⤵
  PID:1928
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /create /tn initia4 /tr c:\windows\kak2.bat /sc ONLOGON /ru system
  2⤵
  - Creates scheduled task(s)
  PID:4508
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /create /tn initia3 /tr c:\windows\kak2.bat /sc onstart /ru system
  2⤵
  - Creates scheduled task(s)
  PID:4392
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /create /tn initia2 /tr c:\windows\kak.bat /sc ONLOGON /ru system
  2⤵
  - Creates scheduled task(s)
  PID:3452
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /create /tn initia /tr c:\windows\kak.bat /sc onstart /ru system
  2⤵
  - Creates scheduled task(s)
  PID:4944
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c c:\windows\kak.bat
  2⤵
  PID:3068
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c c:\windows\kak2.bat
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:764
- C:\Windows\mightkak.exe
  mightkak.exe -on "hklm\SYSTEM\CurrentControlSet\Control\Session Manager" -ot reg -actn ace -ace "n:todos;p:full" -ace "n:system;p:create_subkey;m:deny;i:np"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:3420
- C:\Windows\SysWOW64\regedit.exe
  regedit /S c:\Windows\mightkak.reg
  2⤵
  - Runs .reg file with regedit
  PID:2020
- C:\Windows\mightkak.exe
  mightkak.exe -on "hklm\SYSTEM\CurrentControlSet\Control\Session Manager" -ot reg -actn ace -ace "n:todos;p:full" -ace "n:todos;p:create_subkey;m:deny;i:np"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:220

C:\Windows\SysWOW64\regsvr32.exe
regsvr32 /s /u c:\arquiv~1\GbPlugin\bb.gpc
1⤵
PID:2196

C:\Windows\SysWOW64\regsvr32.exe
regsvr32 /s /u c:\arquiv~1\GbPlugin\gbieh.gmd
1⤵
PID:760

C:\Windows\SysWOW64\regsvr32.exe
regsvr32 /s /u c:\arquiv~1\GbPlugin\gbiehuni.dll
1⤵
PID:4704

C:\Windows\SysWOW64\regsvr32.exe
regsvr32 /s /u c:\arquiv~1\GbPlugin\gbpdist.dll
1⤵
PID:3604

C:\Windows\SysWOW64\regsvr32.exe
regsvr32 /s /u c:\arquiv~1\Scpad\sshib.dll
1⤵
PID:4100

C:\Windows\SysWOW64\cacls.exe
cacls c:\arquiv~1\GbPlugin\bb.gpc /D todos
1⤵
PID:3048

C:\Windows\SysWOW64\cacls.exe
cacls c:\arquiv~1\GbPlugin\GbpSv.exe /D todos
1⤵
PID:3480

C:\Windows\SysWOW64\cacls.exe
cacls c:\arquiv~1\GbPlugin\gbpsv.exe /D todos
1⤵
PID:4056

C:\Windows\SysWOW64\cacls.exe
cacls c:\arquiv~1\Scpad\scpsssh2.dll /D todos
1⤵
PID:1732

C:\Windows\SysWOW64\cacls.exe
cacls c:\windows\kak.bat /G todos:F
1⤵
PID:3960

C:\Windows\SysWOW64\cacls.exe
cacls c:\arquiv~1\Scpad\sshib.dll /D todos
1⤵
PID:3524

C:\Windows\SysWOW64\cacls.exe
cacls c:\arquiv~1\Scpad\scpMIB.dll /D todos
1⤵
PID:1520

C:\Windows\SysWOW64\cacls.exe
cacls c:\arquiv~1\Scpad\scpLIB.dll /D todos
1⤵
PID:812

C:\Windows\SysWOW64\cacls.exe
cacls c:\windows\downlo~1\uni.gpc /D todos
1⤵
PID:2352

C:\Windows\SysWOW64\cacls.exe
cacls c:\windows\downlo~1\Cef.gpc /D todos
1⤵
PID:3352

C:\Windows\SysWOW64\cacls.exe
cacls c:\windows\downlo~1\gbiehcef.dll /D todos
1⤵
PID:4432

C:\Windows\SysWOW64\cacls.exe
cacls c:\windows\downlo~1\gbiehabn.dll /D todos
1⤵
PID:2960

C:\Windows\SysWOW64\cacls.exe
cacls c:\windows\downlo~1\gbiehuni.dll /D todos
1⤵
PID:4668

C:\Windows\SysWOW64\cacls.exe
cacls c:\arquiv~1\GbPlugin\gbpdist.dll /D todos
1⤵
PID:1424

C:\Windows\SysWOW64\cacls.exe
cacls c:\arquiv~1\GbPlugin\uni.gpc /D todos
1⤵
PID:4984

C:\Windows\SysWOW64\cacls.exe
cacls c:\arquiv~1\GbPlugin\Cef.gpc /D todos
1⤵
PID:4296

C:\Windows\SysWOW64\cacls.exe
cacls c:\arquiv~1\GbPlugin\gbiehcef.dll /D todos
1⤵
PID:1188

C:\Windows\SysWOW64\cacls.exe
cacls c:\arquiv~1\GbPlugin\gbiehabn.dll /D todos
1⤵
PID:3056

C:\Windows\SysWOW64\cacls.exe
cacls c:\arquiv~1\GbPlugin\gbiehuni.dll /D todos
1⤵
PID:1152

C:\Windows\SysWOW64\cacls.exe
cacls c:\arquiv~1\GbPlugin\gbieh.gmd /D todos
1⤵
PID:4320

C:\Windows\SysWOW64\cacls.exe
cacls c:\arquiv~1\GbPlugin\gbieh.dll /D todos
1⤵
PID:4936

C:\Windows\SysWOW64\regsvr32.exe
regsvr32 /s /u c:\arquiv~1\Scpad\scpsssh2.dll
1⤵
PID:1004

C:\Windows\SysWOW64\regsvr32.exe
regsvr32 /s /u c:\arquiv~1\Scpad\scpMIB.dll
1⤵
PID:1400

C:\Windows\SysWOW64\regsvr32.exe
regsvr32 /s /u c:\arquiv~1\Scpad\scpLIB.dll
1⤵
PID:1844

C:\Windows\SysWOW64\regsvr32.exe
regsvr32 /s /u c:\arquiv~1\GbPlugin\gbpsv.exe
1⤵
PID:3384

C:\Windows\SysWOW64\PING.EXE
PING -n 3 -w 000
1⤵
- Runs ping.exe
PID:4808

C:\Windows\SysWOW64\wbem\systray.exe
C:\Windows\system32\wbem\systray.exe
1⤵
PID:2904
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c c:\windows\system32\tmp0101.bat
  2⤵
  PID:4068
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /create /tn initia4 /tr c:\windows\kak2.bat /sc ONLOGON /ru system
  2⤵
  - Creates scheduled task(s)
  PID:2492
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /create /tn initia3 /tr c:\windows\kak2.bat /sc onstart /ru system
  2⤵
  - Creates scheduled task(s)
  PID:2600
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /create /tn initia2 /tr c:\windows\kak.bat /sc ONLOGON /ru system
  2⤵
  - Creates scheduled task(s)
  PID:4508
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /create /tn initia /tr c:\windows\kak.bat /sc onstart /ru system
  2⤵
  - Creates scheduled task(s)
  PID:832
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c c:\windows\kak.bat
  2⤵
  PID:4660
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c c:\windows\kak2.bat
  2⤵
  PID:764
- - C:\Windows\SysWOW64\cacls.exe
    cacls c:\windows\kak.bat /G todos:F
    3⤵
    PID:1552
- C:\Windows\mightkak.exe
  mightkak.exe -on "hklm\SYSTEM\CurrentControlSet\Control\Session Manager" -ot reg -actn ace -ace "n:todos;p:full" -ace "n:system;p:create_subkey;m:deny;i:np"
  2⤵
  PID:396
- C:\Windows\SysWOW64\regedit.exe
  regedit /S c:\Windows\mightkak.reg
  2⤵
  - Runs .reg file with regedit
  PID:3188
- C:\Windows\mightkak.exe
  mightkak.exe -on "hklm\SYSTEM\CurrentControlSet\Control\Session Manager" -ot reg -actn ace -ace "n:todos;p:full" -ace "n:todos;p:create_subkey;m:deny;i:np"
  2⤵
  PID:4836

C:\Windows\SysWOW64\regsvr32.exe
regsvr32 /s /u c:\arquiv~1\GbPlugin\bb.gpc
1⤵
PID:4704

C:\Windows\SysWOW64\regsvr32.exe
regsvr32 /s /u c:\arquiv~1\GbPlugin\cef.gpc
1⤵
PID:4456

C:\Windows\SysWOW64\regsvr32.exe
regsvr32 /s /u c:\arquiv~1\GbPlugin\gbieh.gmd
1⤵
PID:3200

C:\Windows\SysWOW64\regsvr32.exe
regsvr32 /s /u c:\arquiv~1\GbPlugin\gbiehuni.dll
1⤵
PID:2280

C:\Windows\SysWOW64\regsvr32.exe
regsvr32 /s /u c:\arquiv~1\GbPlugin\gbpdist.dll
1⤵
PID:3376

C:\Windows\SysWOW64\regsvr32.exe
regsvr32 /s /u c:\arquiv~1\Scpad\scpLIB.dll
1⤵
PID:5004

C:\Windows\SysWOW64\regsvr32.exe
regsvr32 /s /u c:\arquiv~1\Scpad\scpsssh2.dll
1⤵
PID:1424

C:\Windows\SysWOW64\cacls.exe
cacls c:\arquiv~1\GbPlugin\gbieh.gmd /D todos
1⤵
PID:3028

C:\Windows\SysWOW64\cacls.exe
cacls c:\arquiv~1\GbPlugin\GbpSv.exe /D todos
1⤵
PID:1820

C:\Windows\SysWOW64\cacls.exe
cacls c:\windows\downlo~1\gbiehuni.dll /D todos
1⤵
PID:2228

C:\Windows\SysWOW64\cacls.exe
cacls c:\arquiv~1\Scpad\scpLIB.dll /D todos
1⤵
PID:3972

C:\Windows\SysWOW64\cacls.exe
cacls c:\windows\kak.bat /G todos:F
1⤵
PID:3988

C:\Windows\SysWOW64\cacls.exe
cacls c:\arquiv~1\Scpad\sshib.dll /D todos
1⤵
PID:4608

C:\Windows\SysWOW64\cacls.exe
cacls c:\arquiv~1\Scpad\scpsssh2.dll /D todos
1⤵
PID:216

C:\Windows\SysWOW64\cacls.exe
cacls c:\arquiv~1\Scpad\scpMIB.dll /D todos
1⤵
PID:348

C:\Windows\SysWOW64\cacls.exe
cacls c:\windows\downlo~1\uni.gpc /D todos
1⤵
PID:3984

C:\Windows\SysWOW64\cacls.exe
cacls c:\windows\downlo~1\Cef.gpc /D todos
1⤵
PID:436

C:\Windows\SysWOW64\cacls.exe
cacls c:\windows\downlo~1\gbiehcef.dll /D todos
1⤵
PID:3220

C:\Windows\SysWOW64\cacls.exe
cacls c:\windows\downlo~1\gbiehabn.dll /D todos
1⤵
PID:3808

C:\Windows\SysWOW64\cacls.exe
cacls c:\arquiv~1\GbPlugin\gbpsv.exe /D todos
1⤵
PID:4888

C:\Windows\SysWOW64\cacls.exe
cacls c:\arquiv~1\GbPlugin\gbpdist.dll /D todos
1⤵
PID:2972

C:\Windows\SysWOW64\cacls.exe
cacls c:\arquiv~1\GbPlugin\uni.gpc /D todos
1⤵
PID:3408

C:\Windows\SysWOW64\cacls.exe
cacls c:\arquiv~1\GbPlugin\Cef.gpc /D todos
1⤵
PID:868

C:\Windows\SysWOW64\cacls.exe
cacls c:\arquiv~1\GbPlugin\gbiehcef.dll /D todos
1⤵
PID:404

C:\Windows\SysWOW64\cacls.exe
cacls c:\arquiv~1\GbPlugin\gbiehabn.dll /D todos
1⤵
PID:4348

C:\Windows\SysWOW64\cacls.exe
cacls c:\arquiv~1\GbPlugin\gbiehuni.dll /D todos
1⤵
PID:3352

C:\Windows\SysWOW64\cacls.exe
cacls c:\arquiv~1\GbPlugin\bb.gpc /D todos
1⤵
PID:2372

C:\Windows\SysWOW64\cacls.exe
cacls c:\arquiv~1\GbPlugin\gbieh.dll /D todos
1⤵
PID:1088

C:\Windows\SysWOW64\regsvr32.exe
regsvr32 /s /u c:\arquiv~1\Scpad\sshib.dll
1⤵
PID:3632

C:\Windows\SysWOW64\regsvr32.exe
regsvr32 /s /u c:\arquiv~1\Scpad\scpMIB.dll
1⤵
PID:5048

C:\Windows\SysWOW64\regsvr32.exe
regsvr32 /s /u c:\arquiv~1\GbPlugin\gbpsv.exe
1⤵
PID:1176

C:\Windows\SysWOW64\regsvr32.exe
regsvr32 /s /u c:\arquiv~1\GbPlugin\gbiehcef.dll
1⤵
PID:1188

C:\Windows\SysWOW64\regsvr32.exe
regsvr32 /s /u c:\arquiv~1\GbPlugin\gbiehabn.dll
1⤵
PID:3372

C:\Windows\SysWOW64\regsvr32.exe
regsvr32 /s /u c:\windows\downlo~1\gbiehcef.dll
1⤵
PID:3648

C:\Windows\SysWOW64\PING.EXE
PING -n 1 -w 000
1⤵
- Runs ping.exe
PID:3188

C:\Windows\SysWOW64\PING.EXE
PING -n 3 -w 000
1⤵
- Runs ping.exe
PID:2036

C:\Windows\SysWOW64\PING.EXE
PING -n 3 -w 000
1⤵
- Runs ping.exe
PID:1320

C:\Windows\SysWOW64\PING.EXE
PING -n 1 -w 000
1⤵
- Runs ping.exe
PID:4772

C:\Windows\SysWOW64\PING.EXE
PING -n 1 -w 000
1⤵
- Runs ping.exe
PID:3116

C:\Windows\SysWOW64\PING.EXE
PING -n 1 -w 000
1⤵
- Runs ping.exe
PID:2056

C:\Windows\SysWOW64\regsvr32.exe
regsvr32 /s /u c:\windows\downlo~1\gbiehabn.dll
1⤵
PID:2624

C:\Windows\SysWOW64\regsvr32.exe
regsvr32 /s /u c:\windows\downlo~1\gbiehuni.dll
1⤵
PID:2540

C:\Windows\SysWOW64\regsvr32.exe
regsvr32 /s /u c:\windows\system32\scpsssh2.dll
1⤵
PID:2392

C:\Windows\SysWOW64\regsvr32.exe
regsvr32 /s /u c:\arquiv~1\GbPlugin\gbieh.dll
1⤵
PID:5068

C:\Windows\SysWOW64\cacls.exe
cacls c:\windows\kak.bat /G todos:F
1⤵
PID:2184

C:\Windows\SysWOW64\PING.EXE
PING -n 3 -w 000
1⤵
- Runs ping.exe
PID:4904

C:\Windows\SysWOW64\PING.EXE
PING -n 1 -w 000
1⤵
- Runs ping.exe
PID:2636

C:\Windows\SysWOW64\PING.EXE
PING -n 1 -w 000
1⤵
- Runs ping.exe
PID:2848

C:\Windows\SysWOW64\PING.EXE
PING -n 1 -w 000
1⤵
- Runs ping.exe
PID:4248

C:\Windows\SysWOW64\PING.EXE
PING -n 1 -w 000
1⤵
- Runs ping.exe
PID:4640

C:\Windows\SysWOW64\regsvr32.exe
regsvr32 /s /u c:\arquiv~1\GbPlugin\gbiehcef.dll
1⤵
PID:5076

C:\Windows\SysWOW64\regsvr32.exe
regsvr32 /s /u c:\arquiv~1\GbPlugin\gbiehabn.dll
1⤵
PID:532

C:\Windows\SysWOW64\regsvr32.exe
regsvr32 /s /u c:\windows\downlo~1\gbiehcef.dll
1⤵
PID:448

C:\Windows\SysWOW64\regsvr32.exe
regsvr32 /s /u c:\windows\downlo~1\gbiehabn.dll
1⤵
PID:2312

C:\Windows\SysWOW64\regsvr32.exe
regsvr32 /s /u c:\windows\downlo~1\gbiehuni.dll
1⤵
PID:2980

C:\Windows\SysWOW64\regsvr32.exe
regsvr32 /s /u c:\windows\system32\scpsssh2.dll
1⤵
PID:984

C:\Windows\SysWOW64\regsvr32.exe
regsvr32 /s /u c:\arquiv~1\GbPlugin\gbieh.dll
1⤵
PID:4812

C:\Windows\SysWOW64\regsvr32.exe
regsvr32 /s /u c:\arquiv~1\GbPlugin\cef.gpc
1⤵
PID:4048

C:\Windows\System32\sihclient.exe
C:\Windows\System32\sihclient.exe /cv g9X4XDm2E06RD3CgmStK7A.0.2
1⤵
PID:3068

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Remote System Discovery

T1018

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\WINDOWS\ntldr.txt

Filesize
3B

MD5
dcf2024ce15b54188e9de12e855fc761

SHA1
faae2c0b81dda269ffad17fbbd86e370f7890528

SHA256
f7217e671e4f819bc69da9d1a2d3683c26a327473bc5623a81aaaf59362bcd6e

SHA512
1919d049fef030430aa17fedd80a28e95db16ca00374737021a4d2024253a0ec8657019b3e40b33ef165e192412a4fc5b0e5e4619f8077a13664d7744c739fdf

Download Submit
C:\Windows\SysWOW64\wbem\systray.exe

Filesize
15KB

MD5
5d1feb1c162f749e5a182ad1c1cd9172

SHA1
0eb576e43edea72c6bc686d3c146e904dd3d1ed9

SHA256
197d764b7dcfcceb94d128828cbdbcfbf535c5f1882ac9cd0fb937c625dd4667

SHA512
f21c96d04a9b278e7117485f160cf6860b2123b992478572a6a7419018bbd141d2debf7ad2c5750d5f5059dedc2fcb42429a611b03a8754c68b65678c80764fc

Download Submit
C:\Windows\SysWOW64\wbem\systray.exe

Filesize
4KB

MD5
9282aeb05a536d2770fbed9fcc407fc3

SHA1
7d84f70b0e464d7d901abc802466f412aabc6b32

SHA256
af0853d6883bd7b0618ee7942a50c90d350a03ae70b03f3e064ad4d177c7dffd

SHA512
6f42d9b9d121b3edb18d53905cfaf3bf11d75659ea401de89445aaa152b68e7d9471f53739e80ebed777ec85f14ba3b13366cf061d0f5da28caa2111391808ae

Download Submit
C:\Windows\mightkak.exe

Filesize
252KB

MD5
19bb0722fdbeb638df3b66b1ac1552f1

SHA1
7d9f036a3b49b9b9c6b0eb41b789837e188a8da0

SHA256
4c3e18a58be2b15784a3460c7d49f1b50755dd3ccef8003d15aa7b2ae847e748

SHA512
169a3da36cc749f12812a1ab625da622042567aad0ecebbf6fc10848ccd1cb136c5182941120d7c92881ef488a2b8b559392117cfd2050f3ecde54bad7cdb36f

Download Submit
\??\c:\Windows\mightkak.reg

Filesize
39KB

MD5
5dabfc06b6f95be78f9a8035dc5222a8

SHA1
db27ad18e333c3355f526b66821434ade1ec6cff

SHA256
e30928bfa743c4ef5ad95337af6e135208e3e3b75248e384208af7f130538a84

SHA512
fe818ca83e1bb8c6a5155a1d66c09f957c4a0699f358d427bd261b1da031f9671ba23d118f467d549eefb19aabb4a83fa3e7566ae67950dbd1fdf7c0a20477eb

Download Submit
\??\c:\windows\SysWOW64\tmp0101.bat

Filesize
493B

MD5
c087e83ceba28662eea05be5469de35a

SHA1
e0976223a768eefe8f398db3e4cf997e3185d6ef

SHA256
0436751f6bd854039bbee6e629a44ff6fca19923249c873acdae6c0892fc43ea

SHA512
3781edeb7138394da10ea9d58db3bc0ec5b760127a75bd915b7bc85b874ee8a1289ccaa65bc801d396c3960cff15e2857003ce45a71cef0bea3736b7e2f5a018

Download Submit
\??\c:\windows\SysWOW64\tmp0101.bat

Filesize
463B

MD5
c3248e0f422299116834542e27cd3f45

SHA1
fcd5cfce031703b8d65ae6b5f27d821e5f453ed8

SHA256
6f12a34c4bf70d37b597fa0d06019ab53a596551c33ece15e1f0a446a8b59dcc

SHA512
3531071d8ff589b16719e824cc947de112208ebfbfff265ec384d967616dd07b0c061126726e46e1c5acce7e1a0825edebe073d1c297d77985042c452c90b027

Download Submit
\??\c:\windows\kak.bat

Filesize
2KB

MD5
0e0cc25778021a8066b33281fd7979de

SHA1
3fb2272e50ccb40f1d8c742fe9f8db4e2fbdbf53

SHA256
f2d959e38c6b759cf84d8342bcc810211d635706ecd5f4a2fede2bdd64591641

SHA512
9b80301100a24050497a02ccfbf2815c3b7262db494b99d0689a3ae9559231dd17df2630a35edaf693c4963ead71c6dc008448b144b17a23e8e83b9150d4cbb3

Download Submit
\??\c:\windows\kak2.bat

Filesize
60B

MD5
d4c455e4e7e187673e5d7059d52d559a

SHA1
d7230bb387bca90367de1f377b0089e6004733a1

SHA256
f2d3c4687c6e41f462be4ea4880ae43afdf96e34603abef5d051f303a8855b76

SHA512
3d7b0f0b22188bcb494edcda43de22389f3285e2e0499030860dfd9361fc4d15ab410c5aae947433bc5f58c86750d67d8226c014d39d8b807fc96be3cbf74457

Download Submit
memory/2904-27-0x0000000000400000-0x00000000013AA000-memory.dmp

Filesize
15.7MB

Download
memory/2904-28-0x0000000001550000-0x0000000001551000-memory.dmp

Filesize
4KB

Download
memory/2904-43-0x00000000061E0000-0x00000000061E1000-memory.dmp

Filesize
4KB

Download
memory/2904-44-0x0000000000400000-0x00000000013AA000-memory.dmp

Filesize
15.7MB

Download
memory/4532-22-0x0000000006320000-0x0000000006321000-memory.dmp

Filesize
4KB

Download
memory/4532-0-0x0000000000400000-0x00000000013AA000-memory.dmp

Filesize
15.7MB

Download
memory/4532-23-0x0000000000400000-0x00000000013AA000-memory.dmp

Filesize
15.7MB

Download
memory/4532-1-0x00000000014F0000-0x00000000014F1000-memory.dmp

Filesize
4KB

Download