metasploit | cfe125f36d37de26cd3d2003ca27710e67ea988c30bfa3a83b86a56cc1f35e6e

Analysis

max time kernel
122s
max time network
131s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
16/01/2024, 01:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5e9013e22ff455200a1a014780dbdd5e.exe
Size 497KB
Sample240116-bfjxcaabap
SHA256 cfe125f36d37de26cd3d2003ca27710e67ea988c30bfa3a83b86a56cc1f35e6e
MD5 5e9013e22ff455200a1a014780dbdd5e
SHA1 0e6373420a6a2d58e8bf9421c0c1965aa7992974
SHA512 38942b9965445b68e997c34be7b17ced7461f2a290bb633cbcaf95f1cd7b97fb9ae168664174c712b79d866bc5a366395c31bc4548cbb0cda5b98c2fbe28f8c2
SSDEEP 6144:djrovygY18ZTb218VhPMeaHd7mKo5x12zELLWHicDwxEMGwBMxCtiozL7z3:Dy5hPMeaHro5x5c8xEMGwpXX
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

metasploit backdoor evasion trojan

Malware Config

Extracted

Family

metasploit

Version

encoder/fnstenv_mov

Signatures

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit

Modifies security service 2 TTPs 18 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4"	regedit.exe

Executes dropped EXE 18 IoCs

pid	Process
5236	updates.exe
2528	updates.exe
2304	updates.exe
2612	updates.exe
5460	updates.exe
1204	updates.exe
4088	updates.exe
3532	updates.exe
3288	updates.exe
5100	updates.exe
5596	updates.exe
4448	updates.exe
2936	updates.exe
6132	updates.exe
5176	updates.exe
3172	updates.exe
3644	updates.exe
2452	updates.exe

Drops file in System32 directory 27 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\updates.exe	updates.exe
File opened for modification	C:\Windows\SysWOW64\updates.exe	updates.exe
File opened for modification	C:\Windows\SysWOW64\updates.exe	updates.exe
File created	C:\Windows\SysWOW64\updates.exe	updates.exe
File created	C:\Windows\SysWOW64\updates.exe	updates.exe
File opened for modification	C:\Windows\SysWOW64\updates.exe	updates.exe
File opened for modification	C:\Windows\SysWOW64\updates.exe	updates.exe
File opened for modification	C:\Windows\SysWOW64\updates.exe	updates.exe
File opened for modification	C:\Windows\SysWOW64\updates.exe	updates.exe
File opened for modification	C:\Windows\SysWOW64\updates.exe	5e9013e22ff455200a1a014780dbdd5e.exe
File created	C:\Windows\SysWOW64\updates.exe	updates.exe
File opened for modification	C:\Windows\SysWOW64\updates.exe	updates.exe
File created	C:\Windows\SysWOW64\updates.exe	updates.exe
File opened for modification	C:\Windows\SysWOW64\updates.exe	updates.exe
File opened for modification	C:\Windows\SysWOW64\updates.exe	updates.exe
File created	C:\Windows\SysWOW64\updates.exe	updates.exe
File opened for modification	C:\Windows\SysWOW64\updates.exe	updates.exe
File opened for modification	C:\Windows\SysWOW64\updates.exe	updates.exe
File created	C:\Windows\SysWOW64\updates.exe	updates.exe
File opened for modification	C:\Windows\SysWOW64\updates.exe	updates.exe
File created	C:\Windows\SysWOW64\updates.exe	5e9013e22ff455200a1a014780dbdd5e.exe
File created	C:\Windows\SysWOW64\updates.exe	updates.exe
File opened for modification	C:\Windows\SysWOW64\updates.exe	updates.exe
File opened for modification	C:\Windows\SysWOW64\updates.exe	updates.exe
File opened for modification	C:\Windows\SysWOW64\updates.exe	updates.exe
File created	C:\Windows\SysWOW64\updates.exe	updates.exe
File opened for modification	C:\Windows\SysWOW64\updates.exe	updates.exe

Suspicious use of SetThreadContext 10 IoCs

description	pid	Process	procid_target
PID 4464 set thread context of 5064	4464	5e9013e22ff455200a1a014780dbdd5e.exe	87
PID 5236 set thread context of 2528	5236	updates.exe	91
PID 2304 set thread context of 2612	2304	updates.exe	105
PID 5460 set thread context of 1204	5460	updates.exe	111
PID 4088 set thread context of 3532	4088	updates.exe	117
PID 3288 set thread context of 5100	3288	updates.exe	120
PID 5596 set thread context of 4448	5596	updates.exe	127
PID 2936 set thread context of 6132	2936	updates.exe	129
PID 5176 set thread context of 3172	5176	updates.exe	140
PID 3644 set thread context of 2452	3644	updates.exe	145

Runs .reg file with regedit 11 IoCs

pid	Process
1452	regedit.exe
4448	regedit.exe
5328	regedit.exe
4052	regedit.exe
5392	regedit.exe
4732	regedit.exe
5656	regedit.exe
5384	regedit.exe
624	regedit.exe
4720	regedit.exe
5360	regedit.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5064	5e9013e22ff455200a1a014780dbdd5e.exe
5064	5e9013e22ff455200a1a014780dbdd5e.exe
5064	5e9013e22ff455200a1a014780dbdd5e.exe
5064	5e9013e22ff455200a1a014780dbdd5e.exe
2528	updates.exe
2528	updates.exe
2528	updates.exe
2528	updates.exe
2528	updates.exe
2528	updates.exe
2528	updates.exe
2528	updates.exe
2528	updates.exe
2528	updates.exe
2528	updates.exe
2528	updates.exe
2528	updates.exe
2528	updates.exe
2528	updates.exe
2528	updates.exe
2528	updates.exe
2528	updates.exe
2528	updates.exe
2528	updates.exe
2528	updates.exe
2528	updates.exe
2528	updates.exe
2528	updates.exe
2528	updates.exe
2528	updates.exe
2528	updates.exe
2528	updates.exe
2528	updates.exe
2528	updates.exe
2528	updates.exe
2528	updates.exe
2528	updates.exe
2528	updates.exe
2528	updates.exe
2528	updates.exe
2528	updates.exe
2528	updates.exe
2528	updates.exe
2528	updates.exe
2528	updates.exe
2528	updates.exe
2528	updates.exe
2528	updates.exe
2528	updates.exe
2528	updates.exe
2528	updates.exe
2528	updates.exe
2528	updates.exe
2528	updates.exe
2528	updates.exe
2528	updates.exe
2528	updates.exe
2528	updates.exe
2528	updates.exe
2528	updates.exe
2528	updates.exe
2528	updates.exe
2528	updates.exe
2528	updates.exe

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
4464	5e9013e22ff455200a1a014780dbdd5e.exe
5236	updates.exe
2304	updates.exe
5460	updates.exe
4088	updates.exe
3288	updates.exe
5596	updates.exe
2936	updates.exe
5176	updates.exe
3644	updates.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4464 wrote to memory of 5064	4464	5e9013e22ff455200a1a014780dbdd5e.exe	87
PID 4464 wrote to memory of 5064	4464	5e9013e22ff455200a1a014780dbdd5e.exe	87
PID 4464 wrote to memory of 5064	4464	5e9013e22ff455200a1a014780dbdd5e.exe	87
PID 4464 wrote to memory of 5064	4464	5e9013e22ff455200a1a014780dbdd5e.exe	87
PID 4464 wrote to memory of 5064	4464	5e9013e22ff455200a1a014780dbdd5e.exe	87
PID 4464 wrote to memory of 5064	4464	5e9013e22ff455200a1a014780dbdd5e.exe	87
PID 4464 wrote to memory of 5064	4464	5e9013e22ff455200a1a014780dbdd5e.exe	87
PID 4464 wrote to memory of 5064	4464	5e9013e22ff455200a1a014780dbdd5e.exe	87
PID 4464 wrote to memory of 5064	4464	5e9013e22ff455200a1a014780dbdd5e.exe	87
PID 4464 wrote to memory of 5064	4464	5e9013e22ff455200a1a014780dbdd5e.exe	87
PID 5064 wrote to memory of 1440	5064	5e9013e22ff455200a1a014780dbdd5e.exe	88
PID 5064 wrote to memory of 1440	5064	5e9013e22ff455200a1a014780dbdd5e.exe	88
PID 5064 wrote to memory of 1440	5064	5e9013e22ff455200a1a014780dbdd5e.exe	88
PID 1440 wrote to memory of 5392	1440	cmd.exe	89
PID 1440 wrote to memory of 5392	1440	cmd.exe	89
PID 1440 wrote to memory of 5392	1440	cmd.exe	89
PID 5064 wrote to memory of 5236	5064	5e9013e22ff455200a1a014780dbdd5e.exe	90
PID 5064 wrote to memory of 5236	5064	5e9013e22ff455200a1a014780dbdd5e.exe	90
PID 5064 wrote to memory of 5236	5064	5e9013e22ff455200a1a014780dbdd5e.exe	90
PID 5236 wrote to memory of 2528	5236	updates.exe	91
PID 5236 wrote to memory of 2528	5236	updates.exe	91
PID 5236 wrote to memory of 2528	5236	updates.exe	91
PID 5236 wrote to memory of 2528	5236	updates.exe	91
PID 5236 wrote to memory of 2528	5236	updates.exe	91
PID 5236 wrote to memory of 2528	5236	updates.exe	91
PID 5236 wrote to memory of 2528	5236	updates.exe	91
PID 5236 wrote to memory of 2528	5236	updates.exe	91
PID 5236 wrote to memory of 2528	5236	updates.exe	91
PID 5236 wrote to memory of 2528	5236	updates.exe	91
PID 2528 wrote to memory of 5212	2528	updates.exe	92
PID 2528 wrote to memory of 5212	2528	updates.exe	92
PID 2528 wrote to memory of 5212	2528	updates.exe	92
PID 5212 wrote to memory of 4732	5212	cmd.exe	93
PID 5212 wrote to memory of 4732	5212	cmd.exe	93
PID 5212 wrote to memory of 4732	5212	cmd.exe	93
PID 2528 wrote to memory of 2304	2528	updates.exe	104
PID 2528 wrote to memory of 2304	2528	updates.exe	104
PID 2528 wrote to memory of 2304	2528	updates.exe	104
PID 2304 wrote to memory of 2612	2304	updates.exe	105
PID 2304 wrote to memory of 2612	2304	updates.exe	105
PID 2304 wrote to memory of 2612	2304	updates.exe	105
PID 2304 wrote to memory of 2612	2304	updates.exe	105
PID 2304 wrote to memory of 2612	2304	updates.exe	105
PID 2304 wrote to memory of 2612	2304	updates.exe	105
PID 2304 wrote to memory of 2612	2304	updates.exe	105
PID 2304 wrote to memory of 2612	2304	updates.exe	105
PID 2304 wrote to memory of 2612	2304	updates.exe	105
PID 2304 wrote to memory of 2612	2304	updates.exe	105
PID 2612 wrote to memory of 3460	2612	updates.exe	106
PID 2612 wrote to memory of 3460	2612	updates.exe	106
PID 2612 wrote to memory of 3460	2612	updates.exe	106
PID 3460 wrote to memory of 5656	3460	cmd.exe	107
PID 3460 wrote to memory of 5656	3460	cmd.exe	107
PID 3460 wrote to memory of 5656	3460	cmd.exe	107
PID 2612 wrote to memory of 5460	2612	updates.exe	110
PID 2612 wrote to memory of 5460	2612	updates.exe	110
PID 2612 wrote to memory of 5460	2612	updates.exe	110
PID 5460 wrote to memory of 1204	5460	updates.exe	111
PID 5460 wrote to memory of 1204	5460	updates.exe	111
PID 5460 wrote to memory of 1204	5460	updates.exe	111
PID 5460 wrote to memory of 1204	5460	updates.exe	111
PID 5460 wrote to memory of 1204	5460	updates.exe	111
PID 5460 wrote to memory of 1204	5460	updates.exe	111
PID 5460 wrote to memory of 1204	5460	updates.exe	111

C:\Users\Admin\AppData\Local\Temp\5e9013e22ff455200a1a014780dbdd5e.exe
"C:\Users\Admin\AppData\Local\Temp\5e9013e22ff455200a1a014780dbdd5e.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4464
- C:\Users\Admin\AppData\Local\Temp\5e9013e22ff455200a1a014780dbdd5e.exe
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5064
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c c:\a.bat
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1440
  - - C:\Windows\SysWOW64\regedit.exe
      REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
      4⤵
      Modifies security service
      Runs .reg file with regedit
      PID:5392
- - C:\Windows\SysWOW64\updates.exe
    C:\Windows\system32\updates.exe 1056 "C:\Users\Admin\AppData\Local\Temp\5e9013e22ff455200a1a014780dbdd5e.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Suspicious use of SetThreadContext
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:5236
  - - C:\Windows\SysWOW64\updates.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:2528
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c c:\a.bat
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:5212
      - C:\Windows\SysWOW64\regedit.exe
        
        REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
        6⤵
        Modifies security service
        Runs .reg file with regedit
        
        PID:4732
    - - C:\Windows\SysWOW64\updates.exe
        
        C:\Windows\system32\updates.exe 1736 "C:\Windows\SysWOW64\updates.exe"
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2304
      - C:\Windows\SysWOW64\updates.exe
        
        6⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2612
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c c:\a.bat
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:3460
        
        C:\Windows\SysWOW64\regedit.exe
        
        REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
        8⤵
        Modifies security service
        Runs .reg file with regedit
        
        PID:5656
        
        C:\Windows\SysWOW64\regedit.exe
        
        REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
        9⤵
        Runs .reg file with regedit
        
        PID:4052
        
        C:\Windows\SysWOW64\updates.exe
        
        C:\Windows\system32\updates.exe 1712 "C:\Windows\SysWOW64\updates.exe"
        7⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:5460
        
        C:\Windows\SysWOW64\updates.exe
        
        8⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1204
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c c:\a.bat
        9⤵
        
        PID:2676
        
        C:\Windows\SysWOW64\regedit.exe
        
        REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
        10⤵
        Modifies security service
        Runs .reg file with regedit
        
        PID:1452
        
        C:\Windows\SysWOW64\updates.exe
        
        C:\Windows\system32\updates.exe 1712 "C:\Windows\SysWOW64\updates.exe"
        9⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:4088
        
        C:\Windows\SysWOW64\updates.exe
        
        10⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3532
        
        C:\Windows\SysWOW64\updates.exe
        
        C:\Windows\system32\updates.exe 1712 "C:\Windows\SysWOW64\updates.exe"
        11⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:3288
        
        C:\Windows\SysWOW64\updates.exe
        
        12⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:5100
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c c:\a.bat
        13⤵
        
        PID:724
        
        C:\Windows\SysWOW64\regedit.exe
        
        REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
        14⤵
        Modifies security service
        Runs .reg file with regedit
        
        PID:5384
        
        C:\Windows\SysWOW64\updates.exe
        
        C:\Windows\system32\updates.exe 1708 "C:\Windows\SysWOW64\updates.exe"
        13⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:5596
        
        C:\Windows\SysWOW64\updates.exe
        
        14⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4448
        
        C:\Windows\SysWOW64\updates.exe
        
        C:\Windows\system32\updates.exe 1712 "C:\Windows\SysWOW64\updates.exe"
        15⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:2936
        
        C:\Windows\SysWOW64\updates.exe
        
        16⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:6132
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c c:\a.bat
        17⤵
        
        PID:3456
        
        C:\Windows\SysWOW64\regedit.exe
        
        REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
        18⤵
        Modifies security service
        Runs .reg file with regedit
        
        PID:624
        
        C:\Windows\SysWOW64\updates.exe
        
        C:\Windows\system32\updates.exe 1712 "C:\Windows\SysWOW64\updates.exe"
        17⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:5176
        
        C:\Windows\SysWOW64\updates.exe
        
        18⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3172
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c c:\a.bat
        19⤵
        
        PID:3508
        
        C:\Windows\SysWOW64\updates.exe
        
        C:\Windows\system32\updates.exe 1712 "C:\Windows\SysWOW64\updates.exe"
        19⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:3644

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c c:\a.bat
1⤵
PID:4000
- C:\Windows\SysWOW64\regedit.exe
  REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
  2⤵
  - Modifies security service
  - Runs .reg file with regedit
  PID:4448
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c c:\a.bat
    3⤵
    PID:1884
  - - C:\Windows\SysWOW64\regedit.exe
      REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
      4⤵
      Modifies security service
      Runs .reg file with regedit
      PID:5328

C:\Windows\SysWOW64\regedit.exe
REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
1⤵
- Modifies security service
- Runs .reg file with regedit
PID:4720

C:\Windows\SysWOW64\regedit.exe
REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
1⤵
- Runs .reg file with regedit
PID:5360

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c c:\a.bat
1⤵
PID:1620

C:\Windows\SysWOW64\updates.exe
1⤵
- Executes dropped EXE
PID:2452
- C:\Windows\SysWOW64\updates.exe
  C:\Windows\system32\updates.exe 1712 "C:\Windows\SysWOW64\updates.exe"
  2⤵
  PID:2984

C:\Windows\SysWOW64\updates.exe
1⤵
PID:5628
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c c:\a.bat
  2⤵
  PID:5656

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1.reg

Path C:\Users\Admin\AppData\Local\Temp\1.reg
Size 2KB
SHA256 672e3c47827c2fc929fc92cd7d2a61d9ba41e847f876a1e5486e2701cbc3cb06
MD5 501effddf60a974e98b67dc8921aa7e8
SHA1 734dfe4b508dbc1527ec92e91821a1251aec5b2e
SHA512 28081046c5b0eb6a5578134e19af2a447d38afda338bd3ae4c2fc0054460580d47f9ab6d8c9001ff605e76df462e7bbcab80be15deaf3ca6264e20717dfb9c1c
MD5 SHA1 SHA512

Submit Download

1.reg

Path C:\Users\Admin\AppData\Local\Temp\1.reg
Size 3KB
SHA256 f360fb5740172b6b4dd59c1ac30b480511665ae991196f833167e275d91f943e
MD5 9e5db93bd3302c217b15561d8f1e299d
SHA1 95a5579b336d16213909beda75589fd0a2091f30
SHA512 b5547e5047a3c43397ee846ff9d5979cba45ba44671db5c5df5536d9dc26262e27a8645a08e0cf35960a3601dc0f6f5fe8d47ae232c9ca44d6899e97d36fb25a
MD5 SHA1 SHA512

Submit Download

1.reg

Path C:\Users\Admin\AppData\Local\Temp\1.reg
Size 2KB
SHA256 fd1be29f1f4b9fc4a8d9b583c4d2114f17c062998c833b2085960ac02ef82019
MD5 b79d7c7385eb2936ecd5681762227a9b
SHA1 c2a21fb49bd3cc8be9baac1bf6f6389453ad785d
SHA512 7ea049afca363ff483f57b9fff1e213006d689eb4406cefe7f1e096c46b41e7908f1e4d69e1411ae56eb1c4e19489c9322176ffdd8ea2f1c37213eb51f03ef5b
MD5 SHA1 SHA512

Submit Download

1.reg

Path C:\Users\Admin\AppData\Local\Temp\1.reg
Size 1KB
SHA256 ee2b1a70a028c6d66757d68a847b4631fc722c1e9bfc2ce714b5202f43ec6b57
MD5 2299014e9ce921b7045e958d39d83e74
SHA1 26ed64f84417eb05d1d9d48441342ca1363084da
SHA512 0a1922752065a6ab7614ca8a12d5d235dfb088d3759b831de51124894adae79637713d7dee2eb87668fa85e37f3ba00d85a727a7ba3a6301fbf1d47f80c6a08f
MD5 SHA1 SHA512

Submit Download

1.reg

Path C:\Users\Admin\AppData\Local\Temp\1.reg
Size 849B
SHA256 c11beaac10a5e00391ef4b41be8c240f59c5a2dc930aead6d7db237fcd2641fb
MD5 558ce6da965ba1758d112b22e15aa5a2
SHA1 a365542609e4d1dc46be62928b08612fcabe2ede
SHA512 37f7f10c3d201b11cc5224ae69c5990eb33b4430c601d3c21f6bec9323621120442e0cfa49e1f4eda459ea4ac750277e446dca78b9e44c1445bd891e4e460b5c
MD5 SHA1 SHA512

Submit Download

1.reg

Path C:\Users\Admin\AppData\Local\Temp\1.reg
Size 784B
SHA256 8cd3b8dd28ac014cf973d9ab4b03af1c274bbc9b5ee0ee4ab8af0bdb01573b84
MD5 5a466127fedf6dbcd99adc917bd74581
SHA1 a2e60b101c8789b59360d95a64ec07d0723c4d38
SHA512 695cafc932bc8f0a514bc515860cb275297665de63ca3394b55f42c457761ebf654d29d504674681a77b34e3356a469e8c5b97ff7efc24de330d5375f025cba5
MD5 SHA1 SHA512

Submit Download

updates.exe

Path C:\Windows\SysWOW64\updates.exe
Size 153KB
SHA256 76aae9156bf065e0246d9811fe4bebeba1b219f994fb6b7ce088d78281581a06
MD5 e4b6edc308b092c5d1c7e79229f47e69
SHA1 beefe436adf82c6ffab5442e3746abe07eb1d8e4
SHA512 97708282d5e61d9023512ddf2832d4f5b134c8cf1f0019565671d9360e67c50bf721cd213e1db3bb5110ef74d2f5bf263028fd613825eb4bf7581fd4aa2eba08
SSDEEP 3072:dh1dPxXyAAvo/fQhrHqKNFjV61IC18ZNtmI2m:djrovygY18ZTb2m
MD5 SHA1 SHA512 SSDEEP

Submit Download

updates.exe

Path C:\Windows\SysWOW64\updates.exe
Size 215KB
SHA256 469ae23865db93f3f2cd2539697f0acde1e6eb708924f802e07d47c57872ca2c
MD5 a553fc46a8a6f752b312e873551e83bf
SHA1 e50d7da6402b4b0021950c73e6c1fd7c738858d0
SHA512 358bc62bd18be6e529b15495937d34b410fa8da90aaad17acd269496fc0bfb33186f3f19494f7009dadf8e95c9232d5e07452abdb717a61c892f308ac43997d6
SSDEEP 3072:dh1dPxXyAAvo/fQhrHqKNFjV61IC18ZNtmI2qO784AYEVhsqOUMeafvjxh:djrovygY18ZTb218VhPMeaHdh
MD5 SHA1 SHA512 SSDEEP

Submit Download

updates.exe

Path C:\Windows\SysWOW64\updates.exe
Size 224KB
SHA256 98bab8a6f23235079f204b65fa44a9cfa3b783e15bf46552f25743140cdb272b
MD5 48fc72f4fe9ab18b789909d0225b38f8
SHA1 76f3f5654250429a6e6f5f535a686c7b0d5595e7
SHA512 d19b19fcf463b84f8656ad743504a17acb9fe4626f75af33e932dabe9a96b05c820fcaa1709283f9e2a35c90ce1ef95faf32f236a83e9b997e3a635b3aa2af5d
SSDEEP 3072:dh1dPxXyAAvo/fQhrHqKNFjV61IC18ZNtmI2qO784AYEVhsqOUMeafvjxvAY9cPW:djrovygY18ZTb218VhPMeaHd7m6
MD5 SHA1 SHA512 SSDEEP

Submit Download

updates.exe

Path C:\Windows\SysWOW64\updates.exe
Size 497KB
SHA256 cfe125f36d37de26cd3d2003ca27710e67ea988c30bfa3a83b86a56cc1f35e6e
MD5 5e9013e22ff455200a1a014780dbdd5e
SHA1 0e6373420a6a2d58e8bf9421c0c1965aa7992974
SHA512 38942b9965445b68e997c34be7b17ced7461f2a290bb633cbcaf95f1cd7b97fb9ae168664174c712b79d866bc5a366395c31bc4548cbb0cda5b98c2fbe28f8c2
SSDEEP 6144:djrovygY18ZTb218VhPMeaHd7mKo5x12zELLWHicDwxEMGwBMxCtiozL7z3:Dy5hPMeaHro5x5c8xEMGwpXX
MD5 SHA1 SHA512 SSDEEP

Submit Download

updates.exe

Path C:\Windows\SysWOW64\updates.exe
Size 273KB
SHA256 22ba1227933e791875fab52aa9b61740fe3cda412c4d18eb14f3fb066835a967
MD5 eae1ba22ec9e108a7fc3f675325422a5
SHA1 e9c1c4b0bb719c888662a0d8b72761406ae1e1b0
SHA512 ed8edf09dde48c352a31a8183f7780b39b33c6719abc5427d4d83390724ea6d436598550dfa8268d3d4a8a8aa43610433f91ef4ab0405eec62f1dc8a9a39990b
SSDEEP 6144:djrovygY18ZTb218VhPMeaHd7mKo5x12zw:Dy5hPMeaHro5xF
MD5 SHA1 SHA512 SSDEEP

Submit Download

updates.exe

Path C:\Windows\SysWOW64\updates.exe
Size 340KB
SHA256 ffa1e182c293fd9f42d640836e216bda06c10b4f67d8670c1397e45dc5184ceb
MD5 9ca330442af0ec2796a2e421356ef147
SHA1 7b30bc534457011ea386f5a76932cee40e65f571
SHA512 918ad6753fed2d0d0307748737ef865ad8e3e07cb130b1965f2556df9ddad8d76a551717dbb09775cd5045c62b942e6f64a44fc63f58ccde9dcd420589906e15
SSDEEP 6144:djrovygY18ZTb218VhPMeaHd7mKo5x12zELLWHig:Dy5hPMeaHro5x5g
MD5 SHA1 SHA512 SSDEEP

Submit Download

updates.exe

Path C:\Windows\SysWOW64\updates.exe
Size 38KB
SHA256 f1ba0e10750af3c90ebabd6ec3d6b1e266ce2b7ca5effb7453b6168c4f91f6a0
MD5 10f09af3425e41b1dfe2c522dddf389f
SHA1 7c2a52ada20bc49e501af938c71bb8017d6a2739
SHA512 02c57b1d1c5b195f95109908564b76ba7a14d6eba732f19a0546ae6f58ba0a534d60e6b93b628c01050144621ea42813070cd89b5d736eeef81911b0913475cc
SSDEEP 384:gCIcUFux+pZ8d40kcJPZ9BoFwDZ4/R5UKcWeuIKeuwyv3HeuDxUmawRHHHQe9Ur2:gCqgcK+Sf+SWeuIKeunHeu/9Ugucl
MD5 SHA1 SHA512 SSDEEP

Submit Download

a.bat

Path \??\c:\a.bat
Size 5KB
SHA256 ce4674afd978d1401596d22a0961f90c8fb53c5bd55649684e1a999c8cf77876
MD5 0019a0451cc6b9659762c3e274bc04fb
SHA1 5259e256cc0908f2846e532161b989f1295f479b
SHA512 314c23ec37cb0cd4443213c019c4541df968447353b422ef6fff1e7ddf6c983c80778787408b7ca9b81e580a6a7f1589ca7f43c022e6fc16182973580ed4d904
SSDEEP 96:riZ6ie0DiQDiVDiVsHQi7NifhbR/i2OjOpiAqWr2vKV+A2gp6rmP2L9MCIMdwvbA:HGGSaaxb32O1iczC
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1204-390-0x0000000000400000-0x00000000004A3000-memory.dmp

Download

memory/1204-486-0x0000000000400000-0x00000000004A3000-memory.dmp

Download

memory/2452-1007-0x0000000000400000-0x00000000004A3000-memory.dmp

Download

memory/2452-1243-0x0000000000400000-0x00000000004A3000-memory.dmp

Download

memory/2528-169-0x0000000000400000-0x00000000004A3000-memory.dmp

Download

memory/2528-239-0x0000000000400000-0x00000000004A3000-memory.dmp

Download

memory/2612-345-0x0000000000400000-0x00000000004A3000-memory.dmp

Download

memory/2612-256-0x0000000000400000-0x00000000004A3000-memory.dmp

Download

memory/3172-923-0x0000000000400000-0x00000000004A3000-memory.dmp

Download

memory/3172-884-0x0000000000400000-0x00000000004A3000-memory.dmp

Download

memory/3532-501-0x0000000000400000-0x00000000004A3000-memory.dmp

Download

memory/3532-500-0x0000000000400000-0x00000000004A3000-memory.dmp

Download

memory/4448-746-0x0000000000400000-0x00000000004A3000-memory.dmp

Download

memory/4448-656-0x0000000000400000-0x00000000004A3000-memory.dmp

Download

memory/5064-2-0x0000000000400000-0x00000000004A3000-memory.dmp

Download

memory/5064-116-0x0000000000400000-0x00000000004A3000-memory.dmp

Download

memory/5064-7-0x0000000000400000-0x00000000004A3000-memory.dmp

Download

memory/5064-4-0x0000000000400000-0x00000000004A3000-memory.dmp

Download

memory/5100-624-0x0000000000400000-0x00000000004A3000-memory.dmp

Download

memory/5100-515-0x0000000000400000-0x00000000004A3000-memory.dmp

Download

memory/5628-1130-0x0000000000400000-0x00000000004A3000-memory.dmp

Download

memory/6132-761-0x0000000000400000-0x00000000004A3000-memory.dmp

Download

memory/6132-869-0x0000000000400000-0x00000000004A3000-memory.dmp

Download