4aff974db2413e19562609cfa92f7a0c22a1f392c6b44fc0305740f79f323e9d

Analysis

max time kernel
150s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
28/01/2024, 17:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Funshion/Funshion.exe
Size 2.7MB
Sample240128-vp9c5secf7
SHA256 d1faf8d2282bbe2f15715f703076a145f0c64e3b8c7d2f6f966ad9bcce9f463f
MD5 12c92913e1e2f029be52e0f3103c3c16
SHA1 27c755028045ba0304033a68121a255482aa7bf7
SHA512 48baa2229cc6c63991fb6a471ab3043f877da6b2dbfeb9a1196a2a6237386621ac4f240d2752c463f17a49f3d0d74716cb0f9009ea3d55efef101644a1fb391d
SSDEEP 49152:xJUfDTk1VsrS2tOWQMtXDeN0y7lBnvrOqyd+gsAnT6LAsr:snkjq/DeN0yH6q0+lLAo
MD5 SHA1 SHA512 SSDEEP

Score

4^/10

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\INF\setupapi.app.log	dxdiag.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	Funshion.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\fsp\shell\open\ddeexec\ = "%1"	Funshion.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{E21BE468-5C18-43EB-B0CC-DB93A847D769}\FilterData = 020000000000600002000000000000003070693300000000000000000100000000000000000000003074793300000000500000006000000031706933080000000000000000000000000000000000000083eb36e44f52ce119f530020af0ba77000000000000000000000000000000000	Funshion.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\fsp\shell	Funshion.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject.1\CLSID\ = "{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}"	dxdiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject	dxdiag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\ = "DxDiagClassObject Class"	dxdiag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagProvider\CurVer\ = "DxDiag.DxDiagClassObject.1"	dxdiag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E21BE468-5C18-43EB-B0CC-DB93A847D769}\InprocServer32\ThreadingModel = "Both"	Funshion.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A65B8071-3BFE-4213-9A5B-491DA4461CA7}\ProgID	dxdiag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{E21BE468-5C18-43EB-B0CC-DB93A847D769}\CLSID = "{E21BE468-5C18-43EB-B0CC-DB93A847D769}"	Funshion.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4665E44B-8B9A-4515-A086-E94ECE374608}\InprocServer32	Funshion.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\fsp\shell\open\ddeexec\Topic\ = "FSP"	Funshion.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{765035B3-5944-4A94-806B-20EE3415F26F}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Funshion\\rmsp.ax"	Funshion.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{941A4793-A705-4312-8DFC-C11CA05F397E}\ = "RealAudio Decoder"	Funshion.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{941A4793-A705-4312-8DFC-C11CA05F397E}\InprocServer32\ThreadingModel = "Both"	Funshion.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3C78B8E2-6C4D-11D1-AEE2-0000F7754B98}\InprocServer32\ThreadingModel = "Both"	Funshion.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{3C78B8E2-6C4D-11D1-AEE2-0000F7754B98}	Funshion.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{3C78B8E2-6C4D-11D1-AEE2-0000F7754B98}\FriendlyName = "AAC Parser"	Funshion.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\ForceRemove	dxdiag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\InprocServer32\ = "C:\\Windows\\SysWOW64\\dxdiagn.dll"	dxdiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagProvider	dxdiag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6AC7C19E-8CA0-4E3D-9A9F-2881DE29E0AC}\ = "CoreAAC Audio Decoder"	Funshion.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BBFC1A2A-D3A2-4610-847D-26592022F86E}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Funshion\\CoreAAC.ax"	Funshion.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E21BE468-5C18-43EB-B0CC-DB93A847D769}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Funshion\\rmsp.ax"	Funshion.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject.1\ = "DxDiagClassObject Class"	dxdiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\ProgID	dxdiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{941A4793-A705-4312-8DFC-C11CA05F397E}\InprocServer32	Funshion.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A65B8071-3BFE-4213-9A5B-491DA4461CA7}\VersionIndependentProgID	dxdiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BBFC1A2A-D3A2-4610-847D-26592022F86E}	Funshion.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3C78B8E2-6C4D-11D1-AEE2-0000F7754B98}\ = "aac_parser"	Funshion.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{3C78B8E2-6C4D-11D1-AEE2-0000F7754B98}\CLSID = "{3C78B8E2-6C4D-11D1-AEE2-0000F7754B98}"	Funshion.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BBFC1A2A-D3A2-4610-847D-26592022F86E}\ = "CoreAAC Audio Decoder Info"	Funshion.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{6AC7C19E-8CA0-4E3D-9A9F-2881DE29E0AC}\CLSID = "{6AC7C19E-8CA0-4E3D-9A9F-2881DE29E0AC}"	Funshion.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\fsp\DefaultIcon	Funshion.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\fsp\shell\open\ddeexec\Application	Funshion.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject\CLSID\ = "{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}"	dxdiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject\CurVer	dxdiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID	dxdiag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{765035B3-5944-4A94-806B-20EE3415F26F}\CLSID = "{765035B3-5944-4A94-806B-20EE3415F26F}"	Funshion.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3C78B8E2-6C4D-11D1-AEE2-0000F7754B98}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Funshion\\aac_parser.ax"	Funshion.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{3C78B8E2-6C4D-11D1-AEE2-0000F7754B98}\FilterData = 02000000000040000200000000000000307069330000000000000000010000000000000000000000307479330000000060000000700000003170693308000000000000000100000000000000000000003074793300000000800000009000000083eb36e44f52ce119f530020af0ba77087eb36e44f52ce119f530020af0ba7706175647300001000800000aa00389b71ff00000000001000800000aa00389b71	Funshion.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\fsp	Funshion.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\fsp\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Funshion\\Funshion.exe\" %1"	Funshion.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{238D0F23-5DC9-45A6-9BE2-666160C324DD}\ = "RealVideo Decoder"	Funshion.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{765035B3-5944-4A94-806B-20EE3415F26F}\FriendlyName = "RealMedia Source"	Funshion.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BBFC1A2A-D3A2-4610-847D-26592022F86E}\InprocServer32	Funshion.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\fsp\ = "URL: fsp Protocol"	Funshion.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{765035B3-5944-4A94-806B-20EE3415F26F}\InprocServer32	Funshion.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject.1\CLSID	dxdiag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject\ = "DxDiagClassObject Class"	dxdiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagProvider.1	dxdiag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagProvider\ = "DxDiagProvider Class"	dxdiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E21BE468-5C18-43EB-B0CC-DB93A847D769}	Funshion.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\ProgID\ = "DxDiag.DxDiagClassObject.1"	dxdiag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4665E44B-8B9A-4515-A086-E94ECE374608}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Funshion\\CoreAAC.ax"	Funshion.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagProvider\CLSID	dxdiag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{E21BE468-5C18-43EB-B0CC-DB93A847D769}\FriendlyName = "RealMedia Splitter"	Funshion.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{765035B3-5944-4A94-806B-20EE3415F26F}	Funshion.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{238D0F23-5DC9-45A6-9BE2-666160C324DD}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Funshion\\rmsp.ax"	Funshion.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject\CLSID	dxdiag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{941A4793-A705-4312-8DFC-C11CA05F397E}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Funshion\\rmsp.ax"	Funshion.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagProvider.1\ = "DxDiagProvider Class"	dxdiag.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{941A4793-A705-4312-8DFC-C11CA05F397E}\FilterData = 020000000000400002000000000000003070693300000000000000000900000000000000000000003074793300000000e0000000f00000003174793300000000e0000000000100003274793300000000e0000000100100003374793300000000e0000000200100003474793300000000e0000000300100003574793300000000e0000000400100003674793300000000e0000000500100003774793300000000e0000000600100003874793300000000e0000000700100003170693308000000000000000100000000000000000000003074793300000000e0000000800100006175647300001000800000aa00389b7131345f3400001000800000aa00389b7132385f3800001000800000aa00389b714154524300001000800000aa00389b71434f4f4b00001000800000aa00389b71444e455400001000800000aa00389b715349505200001000800000aa00389b71ff00000000001000800000aa00389b715241414300001000800000aa00389b715241435000001000800000aa00389b710100000000001000800000aa00389b71	Funshion.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Media Type\{E436EB83-524F-11CE-9F53-0020AF0BA770}\{57428EC6-C2B2-44A2-AA9C-28F0B6A5C48E}\Source Filter = "{E436EBB5-524F-11CE-9F53-0020AF0BA770}"	Funshion.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
828	dxdiag.exe
828	dxdiag.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeManageVolumePrivilege	2192	Funshion.exe
Token: SeRestorePrivilege	828	dxdiag.exe
Token: SeRestorePrivilege	828	dxdiag.exe
Token: SeRestorePrivilege	828	dxdiag.exe
Token: SeRestorePrivilege	828	dxdiag.exe
Token: SeRestorePrivilege	828	dxdiag.exe
Token: SeRestorePrivilege	828	dxdiag.exe
Token: SeRestorePrivilege	828	dxdiag.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2192	Funshion.exe
2192	Funshion.exe
2192	Funshion.exe
2192	Funshion.exe
2192	Funshion.exe
2192	Funshion.exe
2192	Funshion.exe
2192	Funshion.exe
2192	Funshion.exe
2192	Funshion.exe
2192	Funshion.exe
2192	Funshion.exe
2192	Funshion.exe
2192	Funshion.exe
2192	Funshion.exe
2192	Funshion.exe
2192	Funshion.exe
2192	Funshion.exe
2192	Funshion.exe
2192	Funshion.exe
2192	Funshion.exe
2192	Funshion.exe
2192	Funshion.exe
2192	Funshion.exe
2192	Funshion.exe
2192	Funshion.exe
2192	Funshion.exe
2192	Funshion.exe
2192	Funshion.exe
2192	Funshion.exe
2192	Funshion.exe
2192	Funshion.exe
2192	Funshion.exe
2192	Funshion.exe
2192	Funshion.exe
2192	Funshion.exe
2192	Funshion.exe
2192	Funshion.exe
2192	Funshion.exe
2192	Funshion.exe
2192	Funshion.exe
2192	Funshion.exe
2192	Funshion.exe
2192	Funshion.exe
2192	Funshion.exe
2192	Funshion.exe
2192	Funshion.exe
2192	Funshion.exe
2192	Funshion.exe
2192	Funshion.exe
2192	Funshion.exe
2192	Funshion.exe
2192	Funshion.exe
2192	Funshion.exe
2192	Funshion.exe
2192	Funshion.exe
2192	Funshion.exe
2192	Funshion.exe
2192	Funshion.exe
2192	Funshion.exe
2192	Funshion.exe
2192	Funshion.exe
2192	Funshion.exe
2192	Funshion.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
2192	Funshion.exe
2192	Funshion.exe
2192	Funshion.exe
2192	Funshion.exe
2192	Funshion.exe
2192	Funshion.exe
2192	Funshion.exe
2192	Funshion.exe
2192	Funshion.exe
2192	Funshion.exe
2192	Funshion.exe
2192	Funshion.exe
2192	Funshion.exe
2192	Funshion.exe
2192	Funshion.exe
2192	Funshion.exe
2192	Funshion.exe
2192	Funshion.exe
2192	Funshion.exe
2192	Funshion.exe
2192	Funshion.exe
2192	Funshion.exe
2192	Funshion.exe
2192	Funshion.exe
2192	Funshion.exe
2192	Funshion.exe
2192	Funshion.exe
2192	Funshion.exe
2192	Funshion.exe
2192	Funshion.exe
2192	Funshion.exe
2192	Funshion.exe
2192	Funshion.exe
2192	Funshion.exe
2192	Funshion.exe
2192	Funshion.exe
2192	Funshion.exe
2192	Funshion.exe
2192	Funshion.exe
2192	Funshion.exe
2192	Funshion.exe
2192	Funshion.exe
2192	Funshion.exe
2192	Funshion.exe
2192	Funshion.exe
2192	Funshion.exe
2192	Funshion.exe
2192	Funshion.exe
2192	Funshion.exe
2192	Funshion.exe
2192	Funshion.exe
2192	Funshion.exe
2192	Funshion.exe
2192	Funshion.exe
2192	Funshion.exe
2192	Funshion.exe
2192	Funshion.exe
2192	Funshion.exe
2192	Funshion.exe
2192	Funshion.exe
2192	Funshion.exe
2192	Funshion.exe
2192	Funshion.exe
2192	Funshion.exe

Suspicious use of SetWindowsHookEx 9 IoCs

pid	Process
2192	Funshion.exe
2192	Funshion.exe
2192	Funshion.exe
2192	Funshion.exe
2192	Funshion.exe
2192	Funshion.exe
2192	Funshion.exe
2192	Funshion.exe
828	dxdiag.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2192 wrote to memory of 2636	2192	Funshion.exe	28
PID 2192 wrote to memory of 2636	2192	Funshion.exe	28
PID 2192 wrote to memory of 2636	2192	Funshion.exe	28
PID 2192 wrote to memory of 2636	2192	Funshion.exe	28
PID 2192 wrote to memory of 828	2192	Funshion.exe	30
PID 2192 wrote to memory of 828	2192	Funshion.exe	30
PID 2192 wrote to memory of 828	2192	Funshion.exe	30
PID 2192 wrote to memory of 828	2192	Funshion.exe	30
PID 2192 wrote to memory of 2156	2192	Funshion.exe	35
PID 2192 wrote to memory of 2156	2192	Funshion.exe	35
PID 2192 wrote to memory of 2156	2192	Funshion.exe	35
PID 2192 wrote to memory of 2156	2192	Funshion.exe	35

C:\Users\Admin\AppData\Local\Temp\Funshion\Funshion.exe
"C:\Users\Admin\AppData\Local\Temp\Funshion\Funshion.exe"
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2192
- C:\Users\Admin\AppData\Local\Temp\Funshion\XPSP2Patch\evid4226-vc80-mt.exe
  --silent
  2⤵
  PID:2636
- C:\Windows\SysWOW64\dxdiag.exe
  dxdiag.exe /whql:off /t C:\Users\Admin\funshion\fsdxdiag.txt
  2⤵
  - Drops file in Windows directory
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:828
- C:\Windows\SysWOW64\tracert.exe
  tracert.exe -d -h 16 -w 800 209.131.36.158
  2⤵
  PID:2156

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

errorPageStrings[2]

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4R90HQQX\errorPageStrings[2]
Size 2KB
SHA256 9466d620dc57835a2475f8f71e304f54aee7160e134ba160baae0f19e5e71e66
MD5 e3e4a98353f119b80b323302f26b78fa
SHA1 20ee35a370cdd3a8a7d04b506410300fd0a6a864
SHA512 d8e4d73c76804a5abebd5dbc3a86dcdb6e73107b873175a8de67332c113fb7c4899890bf7972e467866fa4cd100a7e2a10a770e5a9c41cbf23b54351b771dcee
MD5 SHA1 SHA512

Submit Download

funshion.ini

Path C:\Users\Admin\AppData\Local\Temp\Funshion\funshion.ini
Size 129B
SHA256 40c2bb267f04ece42442d4fc62538d95ff8d50176c5063114e9bbbb91d84d281
MD5 252c55e068d62fbe2ba1932dd83ac40c
SHA1 b2ab22f5e407dc62c65be2e968a2cab6d79782e1
SHA512 44fd6a5ed6bcecfe7f24439d7881ded7bed956f9bdc1c9c7134541f3a0b1ebe86ecbcd230a902cd4c7faa59d1d361c8336d8b3d73e849f79c224b1a33e20ddf1
MD5 SHA1 SHA512

Submit Download

funshion.ini

Path C:\Users\Admin\AppData\Local\Temp\Funshion\funshion.ini
Size 156B
SHA256 88fd6ab7ad01eb9a8e15c4950fc44b9a6549c35640175fa62313f556ecd9790a
MD5 096aed8d4981b0d4c64695a05fc83a6d
SHA1 072ee3334d2dbf2a72b32763bf2207f1ebe91369
SHA512 8cceacc4da9e10ab38842ad66ccd3b9bef0bc43186cd0fafb189769ae38ffefb54fcb01a7e4db5b6cbde273da963fbbceef038a959efcb367e3795175ad61328
MD5 SHA1 SHA512

Submit Download

funshion.ini

Path C:\Users\Admin\AppData\Local\Temp\Funshion\funshion.ini
Size 72B
SHA256 abf8143c836df5bafe398cc275b02d840813d93f7a40ccd642d01f9ec9a3b646
MD5 d4e46d8d02f0ef65cf60a1a3723ba70f
SHA1 ceb19e356594a07f7811e1ef811fccd935dc1b4e
SHA512 b2e9a8b5356a001b15676251cc9e99cb5a2f28e2e350eb3539b39485fe0b2408c30e131cd5e1e999e7f24640e14b4fcf0e3061d716008dc32884759cae8d9d74
MD5 SHA1 SHA512

Submit Download

FunShion.ini

Path C:\Users\Admin\FunShion.ini
Size 192B
SHA256 233a8d5c4e6de7a9a564293006b183427676e6baef14c1ae2a01a63549f76260
MD5 18cbc1233d905de963c2966d548c38b6
SHA1 4fdb3b64e335a57595ff51e09953994fc58f2da7
SHA512 4f23205421b0f697422e6710239ddf534473c94a5a09a8466537723928120ed8418e77e191c1f5ca8008cf8338ded24c1d7b09ab3e2d51fb790c3e603c3344c6
MD5 SHA1 SHA512

Submit Download

FunShion.ini

Path C:\Users\Admin\FunShion.ini
Size 238B
SHA256 e558d4cfbd9d7ccb7fbe693386302445639a68c4ff3db900e6c0e6dcfbf5d3d6
MD5 97351ac65a77734ddaa0fda64f881fdd
SHA1 850fcba4a29ab5fcc3fc731ce677d1f9a0c32889
SHA512 6caa396c70508d4e8613068a240aadd1c684d1ff0b75520c3521d9f991e51a47d11a78a9bb449d09f5aab6c4f59e5134544ec97843efd70859a1218fbfab20e6
MD5 SHA1 SHA512

Submit Download

FunShion.ini

Path C:\Users\Admin\FunShion.ini
Size 320B
SHA256 64323a6d7c6d9910f28b1a0cfa9019549dc1da164b5152ebb3800a37976dfe83
MD5 99c5959bff131001dd76be3dca5ce7d0
SHA1 9f098ddf36edbb7ae84ee071d9819ba8306be4f9
SHA512 a272119e4ce883c09c42e7d8e430d20d0db5551ee2b97926d24933c9a1ce9e7f42be2cfdc880d5a0131cbf1ae4e0a5bfc7d7295cd853e15eb7d74900e3933b72
MD5 SHA1 SHA512

Submit Download

FunShion.ini

Path C:\Users\Admin\FunShion.ini
Size 65B
SHA256 8d1ff906f8fecd9c5e66d49a309dcb45eb923ece244d9c299ce9ffe3d4b0ca09
MD5 098663c45b01751b04762fc0673f566c
SHA1 6d746d9355e37feb05df8f47121b1ea57f5feced
SHA512 028b3dbf32756d01be54df786d50ad941a6a7ca033863d7b4c696be62cfd1a1701b598ff9a761f073821237f395bcf21edf479ef609a66a1ae7c62b95210c356
MD5 SHA1 SHA512

Submit Download

FunShion.ini

Path C:\Users\Admin\FunShion.ini
Size 84B
SHA256 427ab42b688fa370cff14cc83d0c0a1b87453e0368b4ceb67b87f3c45934de60
MD5 09c482888fbc41e0e24af137c684f47f
SHA1 94598fb470baafcb34eaa68271a7292481e0101d
SHA512 6ffb3544b7a680d02e7f8fd9b46382bc4cf449e8545624be27cb8e9799b3b09da7e371dffba3db015d2f77f13d37c0c82efe271fcece222a7cd6c89a2618a1e2
MD5 SHA1 SHA512

Submit Download

memory/828-200-0x0000000001EC0000-0x0000000001F1C000-memory.dmp

Download

memory/828-202-0x0000000001EC0000-0x0000000001EEA000-memory.dmp

Download

memory/828-211-0x0000000001EC0000-0x0000000001EEA000-memory.dmp

Download

memory/828-203-0x0000000001EC0000-0x0000000001EEA000-memory.dmp

Download

memory/828-199-0x0000000001EC0000-0x0000000001F1C000-memory.dmp

Download

memory/828-197-0x0000000000360000-0x000000000036A000-memory.dmp

Download

memory/828-196-0x0000000000360000-0x000000000036A000-memory.dmp

Download

memory/828-198-0x0000000000360000-0x000000000036A000-memory.dmp

Download

memory/2192-106-0x0000000004B90000-0x0000000004ED6000-memory.dmp

Download

memory/2192-97-0x0000000002280000-0x0000000002281000-memory.dmp

Download

memory/2192-149-0x0000000005260000-0x0000000005275000-memory.dmp

Download

memory/2192-133-0x00000000051F0000-0x000000000525B000-memory.dmp

Download

memory/2192-205-0x0000000002280000-0x0000000002281000-memory.dmp

Download

memory/2192-150-0x0000000005B10000-0x0000000005BA4000-memory.dmp

Download

memory/2192-81-0x0000000002570000-0x000000000259E000-memory.dmp

Download

memory/2192-79-0x0000000000860000-0x000000000087B000-memory.dmp

Download