metasploit | cfe125f36d37de26cd3d2003ca27710e67ea988c30bfa3a83b86a56cc1f35e6e

Analysis

max time kernel
150s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
16/01/2024, 01:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5e9013e22ff455200a1a014780dbdd5e.exe
Size 497KB
Sample240116-bfjxcaabap
SHA256 cfe125f36d37de26cd3d2003ca27710e67ea988c30bfa3a83b86a56cc1f35e6e
MD5 5e9013e22ff455200a1a014780dbdd5e
SHA1 0e6373420a6a2d58e8bf9421c0c1965aa7992974
SHA512 38942b9965445b68e997c34be7b17ced7461f2a290bb633cbcaf95f1cd7b97fb9ae168664174c712b79d866bc5a366395c31bc4548cbb0cda5b98c2fbe28f8c2
SSDEEP 6144:djrovygY18ZTb218VhPMeaHd7mKo5x12zELLWHicDwxEMGwBMxCtiozL7z3:Dy5hPMeaHro5x5c8xEMGwpXX
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

metasploit backdoor evasion trojan

Malware Config

Extracted

Family

metasploit

Version

encoder/fnstenv_mov

Signatures

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit

Modifies security service 2 TTPs 22 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4"	regedit.exe

Executes dropped EXE 20 IoCs

pid	Process
2952	updates.exe
2792	updates.exe
1064	updates.exe
1960	updates.exe
3036	updates.exe
2244	updates.exe
1900	updates.exe
2344	updates.exe
1800	updates.exe
2848	updates.exe
2636	updates.exe
528	updates.exe
2572	updates.exe
2340	updates.exe
2080	updates.exe
2036	updates.exe
1680	updates.exe
2496	updates.exe
2852	updates.exe
2912	updates.exe

Loads dropped DLL 64 IoCs

pid	Process
1760	5e9013e22ff455200a1a014780dbdd5e.exe
2952	updates.exe
2952	updates.exe
2952	updates.exe
2952	updates.exe
2792	updates.exe
2792	updates.exe
2792	updates.exe
2792	updates.exe
1064	updates.exe
1064	updates.exe
1064	updates.exe
1064	updates.exe
1960	updates.exe
1960	updates.exe
1960	updates.exe
1960	updates.exe
3036	updates.exe
3036	updates.exe
3036	updates.exe
3036	updates.exe
2244	updates.exe
2244	updates.exe
2244	updates.exe
2244	updates.exe
1900	updates.exe
1900	updates.exe
1900	updates.exe
1900	updates.exe
2344	updates.exe
2344	updates.exe
2344	updates.exe
2344	updates.exe
1800	updates.exe
1800	updates.exe
1800	updates.exe
1800	updates.exe
2848	updates.exe
2848	updates.exe
2848	updates.exe
2848	updates.exe
2636	updates.exe
2636	updates.exe
2636	updates.exe
2636	updates.exe
528	updates.exe
528	updates.exe
528	updates.exe
528	updates.exe
2572	updates.exe
2572	updates.exe
2572	updates.exe
2572	updates.exe
2340	updates.exe
2340	updates.exe
2340	updates.exe
2340	updates.exe
2080	updates.exe
2080	updates.exe
2080	updates.exe
2080	updates.exe
2036	updates.exe
2036	updates.exe
2036	updates.exe

Drops file in System32 directory 32 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\updates.exe	updates.exe
File opened for modification	C:\Windows\SysWOW64\updates.exe	updates.exe
File created	C:\Windows\SysWOW64\updates.exe	updates.exe
File opened for modification	C:\Windows\SysWOW64\updates.exe	updates.exe
File opened for modification	C:\Windows\SysWOW64\updates.exe	5e9013e22ff455200a1a014780dbdd5e.exe
File created	C:\Windows\SysWOW64\updates.exe	updates.exe
File created	C:\Windows\SysWOW64\updates.exe	updates.exe
File opened for modification	C:\Windows\SysWOW64\updates.exe	updates.exe
File created	C:\Windows\SysWOW64\updates.exe	updates.exe
File created	C:\Windows\SysWOW64\updates.exe	updates.exe
File opened for modification	C:\Windows\SysWOW64\updates.exe	updates.exe
File opened for modification	C:\Windows\SysWOW64\updates.exe	updates.exe
File opened for modification	C:\Windows\SysWOW64\updates.exe	updates.exe
File created	C:\Windows\SysWOW64\updates.exe	updates.exe
File opened for modification	C:\Windows\SysWOW64\updates.exe	updates.exe
File opened for modification	C:\Windows\SysWOW64\updates.exe	updates.exe
File opened for modification	C:\Windows\SysWOW64\updates.exe	updates.exe
File opened for modification	C:\Windows\SysWOW64\updates.exe	updates.exe
File created	C:\Windows\SysWOW64\updates.exe	updates.exe
File opened for modification	C:\Windows\SysWOW64\updates.exe	updates.exe
File opened for modification	C:\Windows\SysWOW64\updates.exe	updates.exe
File opened for modification	C:\Windows\SysWOW64\updates.exe	updates.exe
File opened for modification	C:\Windows\SysWOW64\updates.exe	updates.exe
File opened for modification	C:\Windows\SysWOW64\updates.exe	updates.exe
File opened for modification	C:\Windows\SysWOW64\updates.exe	updates.exe
File opened for modification	C:\Windows\SysWOW64\updates.exe	updates.exe
File created	C:\Windows\SysWOW64\updates.exe	updates.exe
File created	C:\Windows\SysWOW64\updates.exe	5e9013e22ff455200a1a014780dbdd5e.exe
File opened for modification	C:\Windows\SysWOW64\updates.exe	updates.exe
File created	C:\Windows\SysWOW64\updates.exe	updates.exe
File opened for modification	C:\Windows\SysWOW64\updates.exe	updates.exe
File created	C:\Windows\SysWOW64\updates.exe	updates.exe

Suspicious use of SetThreadContext 11 IoCs

description	pid	Process	procid_target
PID 2500 set thread context of 1760	2500	5e9013e22ff455200a1a014780dbdd5e.exe	28
PID 2952 set thread context of 2792	2952	updates.exe	32
PID 1064 set thread context of 1960	1064	updates.exe	36
PID 3036 set thread context of 2244	3036	updates.exe	40
PID 1900 set thread context of 2344	1900	updates.exe	46
PID 1800 set thread context of 2848	1800	updates.exe	50
PID 2636 set thread context of 528	2636	updates.exe	54
PID 2572 set thread context of 2340	2572	updates.exe	58
PID 2080 set thread context of 2036	2080	updates.exe	62
PID 1680 set thread context of 2496	1680	updates.exe	66
PID 2852 set thread context of 2912	2852	updates.exe	70

Runs .reg file with regedit 11 IoCs

pid	Process
2932	regedit.exe
1088	regedit.exe
2288	regedit.exe
1360	regedit.exe
2248	regedit.exe
2552	regedit.exe
2364	regedit.exe
2756	regedit.exe
1560	regedit.exe
2304	regedit.exe
1512	regedit.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1760	5e9013e22ff455200a1a014780dbdd5e.exe
1760	5e9013e22ff455200a1a014780dbdd5e.exe
1760	5e9013e22ff455200a1a014780dbdd5e.exe
2792	updates.exe
2792	updates.exe
2792	updates.exe
2792	updates.exe
2792	updates.exe
2792	updates.exe
2792	updates.exe
2792	updates.exe
2792	updates.exe
2792	updates.exe
2792	updates.exe
2792	updates.exe
2792	updates.exe
2792	updates.exe
2792	updates.exe
2792	updates.exe
2792	updates.exe
2792	updates.exe
2792	updates.exe
2792	updates.exe
2792	updates.exe
2792	updates.exe
2792	updates.exe
2792	updates.exe
2792	updates.exe
2792	updates.exe
2792	updates.exe
2792	updates.exe
2792	updates.exe
2792	updates.exe
2792	updates.exe
2792	updates.exe
2792	updates.exe
2792	updates.exe
2792	updates.exe
2792	updates.exe
2792	updates.exe
2792	updates.exe
2792	updates.exe
2792	updates.exe
2792	updates.exe
2792	updates.exe
2792	updates.exe
2792	updates.exe
2792	updates.exe
2792	updates.exe
2792	updates.exe
2792	updates.exe
2792	updates.exe
2792	updates.exe
2792	updates.exe
2792	updates.exe
2792	updates.exe
2792	updates.exe
2792	updates.exe
2792	updates.exe
2792	updates.exe
2792	updates.exe
2792	updates.exe
2792	updates.exe
2792	updates.exe

Suspicious use of SetWindowsHookEx 11 IoCs

pid	Process
2500	5e9013e22ff455200a1a014780dbdd5e.exe
2952	updates.exe
1064	updates.exe
3036	updates.exe
1900	updates.exe
1800	updates.exe
2636	updates.exe
2572	updates.exe
2080	updates.exe
1680	updates.exe
2852	updates.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2500 wrote to memory of 1760	2500	5e9013e22ff455200a1a014780dbdd5e.exe	28
PID 2500 wrote to memory of 1760	2500	5e9013e22ff455200a1a014780dbdd5e.exe	28
PID 2500 wrote to memory of 1760	2500	5e9013e22ff455200a1a014780dbdd5e.exe	28
PID 2500 wrote to memory of 1760	2500	5e9013e22ff455200a1a014780dbdd5e.exe	28
PID 2500 wrote to memory of 1760	2500	5e9013e22ff455200a1a014780dbdd5e.exe	28
PID 2500 wrote to memory of 1760	2500	5e9013e22ff455200a1a014780dbdd5e.exe	28
PID 2500 wrote to memory of 1760	2500	5e9013e22ff455200a1a014780dbdd5e.exe	28
PID 2500 wrote to memory of 1760	2500	5e9013e22ff455200a1a014780dbdd5e.exe	28
PID 2500 wrote to memory of 1760	2500	5e9013e22ff455200a1a014780dbdd5e.exe	28
PID 2500 wrote to memory of 1760	2500	5e9013e22ff455200a1a014780dbdd5e.exe	28
PID 2500 wrote to memory of 1760	2500	5e9013e22ff455200a1a014780dbdd5e.exe	28
PID 1760 wrote to memory of 2760	1760	5e9013e22ff455200a1a014780dbdd5e.exe	29
PID 1760 wrote to memory of 2760	1760	5e9013e22ff455200a1a014780dbdd5e.exe	29
PID 1760 wrote to memory of 2760	1760	5e9013e22ff455200a1a014780dbdd5e.exe	29
PID 1760 wrote to memory of 2760	1760	5e9013e22ff455200a1a014780dbdd5e.exe	29
PID 2760 wrote to memory of 2288	2760	cmd.exe	30
PID 2760 wrote to memory of 2288	2760	cmd.exe	30
PID 2760 wrote to memory of 2288	2760	cmd.exe	30
PID 2760 wrote to memory of 2288	2760	cmd.exe	30
PID 1760 wrote to memory of 2952	1760	5e9013e22ff455200a1a014780dbdd5e.exe	31
PID 1760 wrote to memory of 2952	1760	5e9013e22ff455200a1a014780dbdd5e.exe	31
PID 1760 wrote to memory of 2952	1760	5e9013e22ff455200a1a014780dbdd5e.exe	31
PID 1760 wrote to memory of 2952	1760	5e9013e22ff455200a1a014780dbdd5e.exe	31
PID 1760 wrote to memory of 2952	1760	5e9013e22ff455200a1a014780dbdd5e.exe	31
PID 1760 wrote to memory of 2952	1760	5e9013e22ff455200a1a014780dbdd5e.exe	31
PID 1760 wrote to memory of 2952	1760	5e9013e22ff455200a1a014780dbdd5e.exe	31
PID 2952 wrote to memory of 2792	2952	updates.exe	32
PID 2952 wrote to memory of 2792	2952	updates.exe	32
PID 2952 wrote to memory of 2792	2952	updates.exe	32
PID 2952 wrote to memory of 2792	2952	updates.exe	32
PID 2952 wrote to memory of 2792	2952	updates.exe	32
PID 2952 wrote to memory of 2792	2952	updates.exe	32
PID 2952 wrote to memory of 2792	2952	updates.exe	32
PID 2952 wrote to memory of 2792	2952	updates.exe	32
PID 2952 wrote to memory of 2792	2952	updates.exe	32
PID 2952 wrote to memory of 2792	2952	updates.exe	32
PID 2952 wrote to memory of 2792	2952	updates.exe	32
PID 2952 wrote to memory of 2792	2952	updates.exe	32
PID 2952 wrote to memory of 2792	2952	updates.exe	32
PID 2952 wrote to memory of 2792	2952	updates.exe	32
PID 2792 wrote to memory of 2788	2792	updates.exe	33
PID 2792 wrote to memory of 2788	2792	updates.exe	33
PID 2792 wrote to memory of 2788	2792	updates.exe	33
PID 2792 wrote to memory of 2788	2792	updates.exe	33
PID 2792 wrote to memory of 2788	2792	updates.exe	33
PID 2792 wrote to memory of 2788	2792	updates.exe	33
PID 2792 wrote to memory of 2788	2792	updates.exe	33
PID 2788 wrote to memory of 1560	2788	cmd.exe	34
PID 2788 wrote to memory of 1560	2788	cmd.exe	34
PID 2788 wrote to memory of 1560	2788	cmd.exe	34
PID 2788 wrote to memory of 1560	2788	cmd.exe	34
PID 2788 wrote to memory of 1560	2788	cmd.exe	34
PID 2788 wrote to memory of 1560	2788	cmd.exe	34
PID 2788 wrote to memory of 1560	2788	cmd.exe	34
PID 2792 wrote to memory of 1064	2792	updates.exe	35
PID 2792 wrote to memory of 1064	2792	updates.exe	35
PID 2792 wrote to memory of 1064	2792	updates.exe	35
PID 2792 wrote to memory of 1064	2792	updates.exe	35
PID 2792 wrote to memory of 1064	2792	updates.exe	35
PID 2792 wrote to memory of 1064	2792	updates.exe	35
PID 2792 wrote to memory of 1064	2792	updates.exe	35
PID 1064 wrote to memory of 1960	1064	updates.exe	36
PID 1064 wrote to memory of 1960	1064	updates.exe	36
PID 1064 wrote to memory of 1960	1064	updates.exe	36

C:\Users\Admin\AppData\Local\Temp\5e9013e22ff455200a1a014780dbdd5e.exe
"C:\Users\Admin\AppData\Local\Temp\5e9013e22ff455200a1a014780dbdd5e.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2500
- C:\Users\Admin\AppData\Local\Temp\5e9013e22ff455200a1a014780dbdd5e.exe
  2⤵
  - Loads dropped DLL
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1760
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c c:\a.bat
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2760
  - - C:\Windows\SysWOW64\regedit.exe
      REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
      4⤵
      Modifies security service
      Runs .reg file with regedit
      PID:2288
- - C:\Windows\SysWOW64\updates.exe
    C:\Windows\system32\updates.exe 528 "C:\Users\Admin\AppData\Local\Temp\5e9013e22ff455200a1a014780dbdd5e.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in System32 directory
    - Suspicious use of SetThreadContext
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2952
  - - C:\Windows\SysWOW64\updates.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops file in System32 directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:2792
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c c:\a.bat
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2788
      - C:\Windows\SysWOW64\regedit.exe
        
        REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
        6⤵
        Modifies security service
        Runs .reg file with regedit
        
        PID:1560
    - - C:\Windows\SysWOW64\updates.exe
        
        C:\Windows\system32\updates.exe 1160 "C:\Windows\SysWOW64\updates.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1064
      - C:\Windows\SysWOW64\updates.exe
        
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        
        PID:1960
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c c:\a.bat
        7⤵
        
        PID:2116
        
        C:\Windows\SysWOW64\regedit.exe
        
        REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
        8⤵
        Modifies security service
        Runs .reg file with regedit
        
        PID:2304
        
        C:\Windows\SysWOW64\updates.exe
        
        C:\Windows\system32\updates.exe 1160 "C:\Windows\SysWOW64\updates.exe"
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:3036
        
        C:\Windows\SysWOW64\updates.exe
        
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        
        PID:2244
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c c:\a.bat
        9⤵
        
        PID:2856
        
        C:\Windows\SysWOW64\updates.exe
        
        C:\Windows\system32\updates.exe 1160 "C:\Windows\SysWOW64\updates.exe"
        9⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:1900
        
        C:\Windows\SysWOW64\updates.exe
        
        10⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        
        PID:2344
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c c:\a.bat
        11⤵
        
        PID:2216
        
        C:\Windows\SysWOW64\regedit.exe
        
        REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
        12⤵
        Modifies security service
        Runs .reg file with regedit
        
        PID:2552
        
        C:\Windows\SysWOW64\updates.exe
        
        C:\Windows\system32\updates.exe 1160 "C:\Windows\SysWOW64\updates.exe"
        11⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:1800
        
        C:\Windows\SysWOW64\updates.exe
        
        12⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        
        PID:2848
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c c:\a.bat
        13⤵
        
        PID:2588
        
        C:\Windows\SysWOW64\regedit.exe
        
        REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
        14⤵
        Modifies security service
        Runs .reg file with regedit
        
        PID:2364
        
        C:\Windows\SysWOW64\updates.exe
        
        C:\Windows\system32\updates.exe 1160 "C:\Windows\SysWOW64\updates.exe"
        13⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:2636
        
        C:\Windows\SysWOW64\updates.exe
        
        14⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        
        PID:528
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c c:\a.bat
        15⤵
        
        PID:2196
        
        C:\Windows\SysWOW64\regedit.exe
        
        REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
        16⤵
        Modifies security service
        Runs .reg file with regedit
        
        PID:2756
        
        C:\Windows\SysWOW64\updates.exe
        
        C:\Windows\system32\updates.exe 1160 "C:\Windows\SysWOW64\updates.exe"
        15⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:2572
        
        C:\Windows\SysWOW64\updates.exe
        
        16⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        
        PID:2340
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c c:\a.bat
        17⤵
        
        PID:1968
        
        C:\Windows\SysWOW64\regedit.exe
        
        REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
        18⤵
        Modifies security service
        Runs .reg file with regedit
        
        PID:1360
        
        C:\Windows\SysWOW64\updates.exe
        
        C:\Windows\system32\updates.exe 1160 "C:\Windows\SysWOW64\updates.exe"
        17⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:2080
        
        C:\Windows\SysWOW64\updates.exe
        
        18⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        
        PID:2036
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c c:\a.bat
        19⤵
        
        PID:3024
        
        C:\Windows\SysWOW64\regedit.exe
        
        REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
        20⤵
        Modifies security service
        Runs .reg file with regedit
        
        PID:2248
        
        C:\Windows\SysWOW64\updates.exe
        
        C:\Windows\system32\updates.exe 1160 "C:\Windows\SysWOW64\updates.exe"
        19⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:1680
        
        C:\Windows\SysWOW64\updates.exe
        
        20⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2496
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c c:\a.bat
        21⤵
        
        PID:1516
        
        C:\Windows\SysWOW64\regedit.exe
        
        REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
        22⤵
        Modifies security service
        Runs .reg file with regedit
        
        PID:2932
        
        C:\Windows\SysWOW64\updates.exe
        
        C:\Windows\system32\updates.exe 1164 "C:\Windows\SysWOW64\updates.exe"
        21⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:2852
        
        C:\Windows\SysWOW64\updates.exe
        
        22⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2912
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c c:\a.bat
        23⤵
        
        PID:2264
        
        C:\Windows\SysWOW64\regedit.exe
        
        REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
        24⤵
        Modifies security service
        Runs .reg file with regedit
        
        PID:1088

C:\Windows\SysWOW64\regedit.exe
REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
1⤵
- Modifies security service
- Runs .reg file with regedit
PID:1512

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1.reg

Path C:\Users\Admin\AppData\Local\Temp\1.reg
Size 384B
SHA256 32eae568e5a03070b122719c66798a0574658b85dc61bcf3c48eae29f4d77851
MD5 c93c561465db53bf9a99759de9d25f07
SHA1 5386934828e2c2589bfe394ac1f03ffbfba93bfa
SHA512 bb0163e1a26f6b7cfd4ce214ae33a56e446fa74efca7682352ab52aa4b4d5b5b92a141e3e2a12b76f33827b1cd423f3d862cc973079d5da291832ce6a9fb9b18
MD5 SHA1 SHA512

Submit Download

1.reg

Path C:\Users\Admin\AppData\Local\Temp\1.reg
Size 3KB
SHA256 f360fb5740172b6b4dd59c1ac30b480511665ae991196f833167e275d91f943e
MD5 9e5db93bd3302c217b15561d8f1e299d
SHA1 95a5579b336d16213909beda75589fd0a2091f30
SHA512 b5547e5047a3c43397ee846ff9d5979cba45ba44671db5c5df5536d9dc26262e27a8645a08e0cf35960a3601dc0f6f5fe8d47ae232c9ca44d6899e97d36fb25a
MD5 SHA1 SHA512

Submit Download

a.bat

Path C:\a.bat
Size 5KB
SHA256 ce4674afd978d1401596d22a0961f90c8fb53c5bd55649684e1a999c8cf77876
MD5 0019a0451cc6b9659762c3e274bc04fb
SHA1 5259e256cc0908f2846e532161b989f1295f479b
SHA512 314c23ec37cb0cd4443213c019c4541df968447353b422ef6fff1e7ddf6c983c80778787408b7ca9b81e580a6a7f1589ca7f43c022e6fc16182973580ed4d904
SSDEEP 96:riZ6ie0DiQDiVDiVsHQi7NifhbR/i2OjOpiAqWr2vKV+A2gp6rmP2L9MCIMdwvbA:HGGSaaxb32O1iczC
MD5 SHA1 SHA512 SSDEEP

Submit Download

updates.exe

Path \Windows\SysWOW64\updates.exe
Size 497KB
SHA256 cfe125f36d37de26cd3d2003ca27710e67ea988c30bfa3a83b86a56cc1f35e6e
MD5 5e9013e22ff455200a1a014780dbdd5e
SHA1 0e6373420a6a2d58e8bf9421c0c1965aa7992974
SHA512 38942b9965445b68e997c34be7b17ced7461f2a290bb633cbcaf95f1cd7b97fb9ae168664174c712b79d866bc5a366395c31bc4548cbb0cda5b98c2fbe28f8c2
SSDEEP 6144:djrovygY18ZTb218VhPMeaHd7mKo5x12zELLWHicDwxEMGwBMxCtiozL7z3:Dy5hPMeaHro5x5c8xEMGwpXX
MD5 SHA1 SHA512 SSDEEP

Submit Download

updates.exe

Path \Windows\SysWOW64\updates.exe
Size 128KB
SHA256 5dd72a984abbbec9e99e611dbbf6e3d14a69540af46fc6d50def48d2e77ecf50
MD5 9bbab57d795124f18e996f5d0716088c
SHA1 3a105840d47309502d16d1843baad5af7901a944
SHA512 06814a3fdc38fd021071cd0544c22e58a94838d0e0afa8ffa849468f9543e2b93025c78d07699cb56bb145e93c8cdaa98e85d668c1242f2c9eeb3c723548a3c7
SSDEEP 1536:dG4mWayZbScTBPxDjW/4yAAXKSo/eMkIQhKOjeeYABOZa:dh1dPxXyAAvo/fQhrHqa
MD5 SHA1 SHA512 SSDEEP

Submit Download

updates.exe

Path \Windows\SysWOW64\updates.exe
Size 473KB
SHA256 ae9063ab1abd4c985fe2d73bcc99d1216e7e0cc2b36b8dfba5b78df39c30d8a7
MD5 89bcc22e7320b98f9ec0a5bb9577aa43
SHA1 fc16925267eab8befeeff65a5dfbc2980bce8d84
SHA512 958d322a791a206373277d72fdbf1e811bc6aa4a898b73dbb915116985d7e5da538f7afd9b7c62513c5566967595b13cea2c10d32b2db455c7f6c010899dd774
SSDEEP 6144:djrovygY18ZTb218VhPMeaHd7mKo5x12zELLWHicDwxEMGwBMxCtios:Dy5hPMeaHro5x5c8xEMGwps
MD5 SHA1 SHA512 SSDEEP

Submit Download

updates.exe

Path \Windows\SysWOW64\updates.exe
Size 361KB
SHA256 b6c93587b478c7156573026f162c4c5ef7ab4e0746d3114a456739579411950f
MD5 f0891d1d1638c340dbb3608f0e9c04f2
SHA1 faa57b72f3e18b0dc0665bd5c17a56823a2af4ba
SHA512 aa2b207e392a2e58396aedf51b4aa72b72f8dbfe9140b4eaf93fdf350e5ac8975ec5c61378c4a623a84c6731068a77c59fe8253651fb4d92b32c6230fda6992c
SSDEEP 6144:djrovygY18ZTb218VhPMeaHd7mKo5x12zELLWHicDG:Dy5hPMeaHro5x5cy
MD5 SHA1 SHA512 SSDEEP

Submit Download

updates.exe

Path \Windows\SysWOW64\updates.exe
Size 163KB
SHA256 a8934b420291bb545c6aa5bb762406a361b7ac28500a87c9cb0b4e14422d4703
MD5 558d2b693a62f45d6de650709d2de4c9
SHA1 8a4c5786f4caf2f4f5d18fd2142e9199e57b6ddd
SHA512 e851cf3272a9c5d3d47c3d5dbf3bf2d62a164f0d225a2b81e230d9a0da91a5d4c9d6f8821747cf5fae9287f1ae167f089de2d97ba2e1f3afdcf9715252e6bb71
SSDEEP 3072:dh1dPxXyAAvo/fQhrHqKNFjV61IC18ZNtmI2q+:djrovygY18ZTb2l
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/528-1046-0x0000000000400000-0x00000000004A3000-memory.dmp

Download

memory/528-913-0x0000000000400000-0x00000000004A3000-memory.dmp

Download

memory/1760-130-0x0000000000400000-0x00000000004A3000-memory.dmp

Download

memory/1760-2-0x0000000000400000-0x00000000004A3000-memory.dmp

Download

memory/1760-8-0x0000000000400000-0x00000000004A3000-memory.dmp

Download

memory/1760-14-0x0000000000400000-0x00000000004A3000-memory.dmp

Download

memory/1760-7-0x0000000000400000-0x00000000004A3000-memory.dmp

Download

memory/1760-12-0x0000000000400000-0x00000000004A3000-memory.dmp

Download

memory/1760-10-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Download

memory/1760-4-0x0000000000400000-0x00000000004A3000-memory.dmp

Download

memory/1760-16-0x0000000000400000-0x00000000004A3000-memory.dmp

Download

memory/1760-6-0x0000000000400000-0x00000000004A3000-memory.dmp

Download

memory/1760-9-0x0000000000400000-0x00000000004A3000-memory.dmp

Download

memory/1960-317-0x0000000000400000-0x00000000004A3000-memory.dmp

Download

memory/1960-325-0x0000000000400000-0x00000000004A3000-memory.dmp

Download

memory/1960-344-0x0000000000400000-0x00000000004A3000-memory.dmp

Download

memory/2036-1328-0x0000000000400000-0x00000000004A3000-memory.dmp

Download

memory/2036-1186-0x0000000000400000-0x00000000004A3000-memory.dmp

Download

memory/2244-585-0x0000000000400000-0x00000000004A3000-memory.dmp

Download

memory/2340-1297-0x0000000000400000-0x00000000004A3000-memory.dmp

Download

memory/2340-1047-0x0000000000400000-0x00000000004A3000-memory.dmp

Download

memory/2344-619-0x0000000000400000-0x00000000004A3000-memory.dmp

Download

memory/2344-749-0x0000000000400000-0x00000000004A3000-memory.dmp

Download

memory/2496-1329-0x0000000000400000-0x00000000004A3000-memory.dmp

Download

memory/2496-1462-0x0000000000400000-0x00000000004A3000-memory.dmp

Download

memory/2792-157-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Download

memory/2792-176-0x0000000000400000-0x00000000004A3000-memory.dmp

Download

memory/2792-175-0x0000000000400000-0x00000000004A3000-memory.dmp

Download

memory/2792-167-0x0000000000400000-0x00000000004A3000-memory.dmp

Download

memory/2848-1022-0x0000000000400000-0x00000000004A3000-memory.dmp

Download

memory/2848-776-0x0000000000400000-0x00000000004A3000-memory.dmp

Download

memory/2912-1470-0x0000000000400000-0x00000000004A3000-memory.dmp

Download