Malware Analysis Report

2025-03-15 07:45

Sample ID 240210-nrd7fsde86
Target applehook_temp.exe
SHA256 ae21ba5180792c82ca62a790eb46de8d521e95bf5c8fe79d7db8d4593fca32db
Tags
gozi banker evasion isfb persistence trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

ae21ba5180792c82ca62a790eb46de8d521e95bf5c8fe79d7db8d4593fca32db

Threat Level: Known bad

The file applehook_temp.exe was found to be: Known bad.

Malicious Activity Summary

gozi banker evasion isfb persistence trojan

Gozi

Modifies visiblity of hidden/system files in Explorer

Executes dropped EXE

Adds Run key to start application

Drops file in System32 directory

Drops file in Windows directory

Unsigned PE

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-02-10 11:37

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-02-10 11:37

Reported

2024-02-10 12:10

Platform

win10v2004-20231215-en

Max time kernel

1805s

Max time network

1337s

Command Line

"C:\Users\Admin\AppData\Local\Temp\applehook_temp.exe"

Signatures

Gozi

banker trojan gozi

Modifies visiblity of hidden/system files in Explorer

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" \??\c:\windows\resources\themes\explorer.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" \??\c:\windows\resources\svchost.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO" \??\c:\windows\resources\themes\explorer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO" \??\c:\windows\resources\themes\explorer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO" \??\c:\windows\resources\svchost.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO" \??\c:\windows\resources\svchost.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\explorer.exe \??\c:\windows\resources\themes\explorer.exe N/A
File opened for modification C:\Windows\SysWOW64\explorer.exe \??\c:\windows\resources\svchost.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification \??\c:\windows\resources\themes\explorer.exe C:\Windows\Resources\Themes\icsys.icn.exe N/A
File opened for modification \??\c:\windows\resources\spoolsv.exe \??\c:\windows\resources\themes\explorer.exe N/A
File opened for modification \??\c:\windows\resources\svchost.exe \??\c:\windows\resources\spoolsv.exe N/A
File opened for modification C:\Windows\Resources\tjud.exe \??\c:\windows\resources\themes\explorer.exe N/A
File opened for modification C:\Windows\Resources\Themes\tjcm.cmn \??\c:\windows\resources\themes\explorer.exe N/A
File opened for modification C:\Windows\Resources\Themes\icsys.icn.exe C:\Users\Admin\AppData\Local\Temp\applehook_temp.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\applehook_temp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\applehook_temp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\applehook_temp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\applehook_temp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\applehook_temp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\applehook_temp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\applehook_temp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\applehook_temp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\applehook_temp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\applehook_temp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\applehook_temp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\applehook_temp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\applehook_temp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\applehook_temp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\applehook_temp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\applehook_temp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\applehook_temp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\applehook_temp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\applehook_temp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\applehook_temp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\applehook_temp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\applehook_temp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\applehook_temp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\applehook_temp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\applehook_temp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\applehook_temp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\applehook_temp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\applehook_temp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\applehook_temp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\applehook_temp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\applehook_temp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\applehook_temp.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A \??\c:\windows\resources\themes\explorer.exe N/A
N/A N/A \??\c:\windows\resources\svchost.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 208 wrote to memory of 1920 N/A C:\Users\Admin\AppData\Local\Temp\applehook_temp.exe \??\c:\users\admin\appdata\local\temp\applehook_temp.exe 
PID 208 wrote to memory of 1920 N/A C:\Users\Admin\AppData\Local\Temp\applehook_temp.exe \??\c:\users\admin\appdata\local\temp\applehook_temp.exe 
PID 208 wrote to memory of 4332 N/A C:\Users\Admin\AppData\Local\Temp\applehook_temp.exe C:\Windows\Resources\Themes\icsys.icn.exe
PID 208 wrote to memory of 4332 N/A C:\Users\Admin\AppData\Local\Temp\applehook_temp.exe C:\Windows\Resources\Themes\icsys.icn.exe
PID 208 wrote to memory of 4332 N/A C:\Users\Admin\AppData\Local\Temp\applehook_temp.exe C:\Windows\Resources\Themes\icsys.icn.exe
PID 1920 wrote to memory of 3340 N/A \??\c:\users\admin\appdata\local\temp\applehook_temp.exe  C:\Windows\system32\cmd.exe
PID 1920 wrote to memory of 3340 N/A \??\c:\users\admin\appdata\local\temp\applehook_temp.exe  C:\Windows\system32\cmd.exe
PID 3340 wrote to memory of 3212 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\certutil.exe
PID 3340 wrote to memory of 3212 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\certutil.exe
PID 3340 wrote to memory of 2236 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\find.exe
PID 3340 wrote to memory of 2236 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\find.exe
PID 3340 wrote to memory of 4692 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\find.exe
PID 3340 wrote to memory of 4692 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\find.exe
PID 4332 wrote to memory of 4856 N/A C:\Windows\Resources\Themes\icsys.icn.exe \??\c:\windows\resources\themes\explorer.exe
PID 4332 wrote to memory of 4856 N/A C:\Windows\Resources\Themes\icsys.icn.exe \??\c:\windows\resources\themes\explorer.exe
PID 4332 wrote to memory of 4856 N/A C:\Windows\Resources\Themes\icsys.icn.exe \??\c:\windows\resources\themes\explorer.exe
PID 4856 wrote to memory of 4812 N/A \??\c:\windows\resources\themes\explorer.exe \??\c:\windows\resources\spoolsv.exe
PID 4856 wrote to memory of 4812 N/A \??\c:\windows\resources\themes\explorer.exe \??\c:\windows\resources\spoolsv.exe
PID 4856 wrote to memory of 4812 N/A \??\c:\windows\resources\themes\explorer.exe \??\c:\windows\resources\spoolsv.exe
PID 4812 wrote to memory of 3008 N/A \??\c:\windows\resources\spoolsv.exe \??\c:\windows\resources\svchost.exe
PID 4812 wrote to memory of 3008 N/A \??\c:\windows\resources\spoolsv.exe \??\c:\windows\resources\svchost.exe
PID 4812 wrote to memory of 3008 N/A \??\c:\windows\resources\spoolsv.exe \??\c:\windows\resources\svchost.exe
PID 3008 wrote to memory of 3140 N/A \??\c:\windows\resources\svchost.exe \??\c:\windows\resources\spoolsv.exe
PID 3008 wrote to memory of 3140 N/A \??\c:\windows\resources\svchost.exe \??\c:\windows\resources\spoolsv.exe
PID 3008 wrote to memory of 3140 N/A \??\c:\windows\resources\svchost.exe \??\c:\windows\resources\spoolsv.exe
PID 1920 wrote to memory of 3104 N/A \??\c:\users\admin\appdata\local\temp\applehook_temp.exe  C:\Windows\system32\cmd.exe
PID 1920 wrote to memory of 3104 N/A \??\c:\users\admin\appdata\local\temp\applehook_temp.exe  C:\Windows\system32\cmd.exe
PID 1920 wrote to memory of 1464 N/A \??\c:\users\admin\appdata\local\temp\applehook_temp.exe  C:\Windows\system32\cmd.exe
PID 1920 wrote to memory of 1464 N/A \??\c:\users\admin\appdata\local\temp\applehook_temp.exe  C:\Windows\system32\cmd.exe
PID 1920 wrote to memory of 2256 N/A \??\c:\users\admin\appdata\local\temp\applehook_temp.exe  C:\Windows\system32\cmd.exe
PID 1920 wrote to memory of 2256 N/A \??\c:\users\admin\appdata\local\temp\applehook_temp.exe  C:\Windows\system32\cmd.exe
PID 1920 wrote to memory of 2524 N/A \??\c:\users\admin\appdata\local\temp\applehook_temp.exe  C:\Windows\system32\cmd.exe
PID 1920 wrote to memory of 2524 N/A \??\c:\users\admin\appdata\local\temp\applehook_temp.exe  C:\Windows\system32\cmd.exe
PID 1920 wrote to memory of 3600 N/A \??\c:\users\admin\appdata\local\temp\applehook_temp.exe  C:\Windows\system32\cmd.exe
PID 1920 wrote to memory of 3600 N/A \??\c:\users\admin\appdata\local\temp\applehook_temp.exe  C:\Windows\system32\cmd.exe
PID 1920 wrote to memory of 4600 N/A \??\c:\users\admin\appdata\local\temp\applehook_temp.exe  C:\Windows\system32\cmd.exe
PID 1920 wrote to memory of 4600 N/A \??\c:\users\admin\appdata\local\temp\applehook_temp.exe  C:\Windows\system32\cmd.exe
PID 1920 wrote to memory of 3604 N/A \??\c:\users\admin\appdata\local\temp\applehook_temp.exe  C:\Windows\system32\cmd.exe
PID 1920 wrote to memory of 3604 N/A \??\c:\users\admin\appdata\local\temp\applehook_temp.exe  C:\Windows\system32\cmd.exe
PID 3604 wrote to memory of 2392 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 3604 wrote to memory of 2392 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 1920 wrote to memory of 2776 N/A \??\c:\users\admin\appdata\local\temp\applehook_temp.exe  C:\Windows\system32\cmd.exe
PID 1920 wrote to memory of 2776 N/A \??\c:\users\admin\appdata\local\temp\applehook_temp.exe  C:\Windows\system32\cmd.exe
PID 1920 wrote to memory of 1076 N/A \??\c:\users\admin\appdata\local\temp\applehook_temp.exe  C:\Windows\system32\cmd.exe
PID 1920 wrote to memory of 1076 N/A \??\c:\users\admin\appdata\local\temp\applehook_temp.exe  C:\Windows\system32\cmd.exe
PID 1076 wrote to memory of 2464 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 1076 wrote to memory of 2464 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 1920 wrote to memory of 4120 N/A \??\c:\users\admin\appdata\local\temp\applehook_temp.exe  C:\Windows\system32\cmd.exe
PID 1920 wrote to memory of 4120 N/A \??\c:\users\admin\appdata\local\temp\applehook_temp.exe  C:\Windows\system32\cmd.exe
PID 1920 wrote to memory of 3164 N/A \??\c:\users\admin\appdata\local\temp\applehook_temp.exe  C:\Windows\system32\cmd.exe
PID 1920 wrote to memory of 3164 N/A \??\c:\users\admin\appdata\local\temp\applehook_temp.exe  C:\Windows\system32\cmd.exe
PID 3164 wrote to memory of 3492 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 3164 wrote to memory of 3492 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 1920 wrote to memory of 3116 N/A \??\c:\users\admin\appdata\local\temp\applehook_temp.exe  C:\Windows\system32\cmd.exe
PID 1920 wrote to memory of 3116 N/A \??\c:\users\admin\appdata\local\temp\applehook_temp.exe  C:\Windows\system32\cmd.exe
PID 1920 wrote to memory of 4036 N/A \??\c:\users\admin\appdata\local\temp\applehook_temp.exe  C:\Windows\system32\cmd.exe
PID 1920 wrote to memory of 4036 N/A \??\c:\users\admin\appdata\local\temp\applehook_temp.exe  C:\Windows\system32\cmd.exe
PID 4036 wrote to memory of 4040 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 4036 wrote to memory of 4040 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 1920 wrote to memory of 1160 N/A \??\c:\users\admin\appdata\local\temp\applehook_temp.exe  C:\Windows\system32\cmd.exe
PID 1920 wrote to memory of 1160 N/A \??\c:\users\admin\appdata\local\temp\applehook_temp.exe  C:\Windows\system32\cmd.exe
PID 1920 wrote to memory of 1672 N/A \??\c:\users\admin\appdata\local\temp\applehook_temp.exe  C:\Windows\system32\cmd.exe
PID 1920 wrote to memory of 1672 N/A \??\c:\users\admin\appdata\local\temp\applehook_temp.exe  C:\Windows\system32\cmd.exe
PID 1672 wrote to memory of 4196 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe

Processes

C:\Users\Admin\AppData\Local\Temp\applehook_temp.exe

"C:\Users\Admin\AppData\Local\Temp\applehook_temp.exe"

\??\c:\users\admin\appdata\local\temp\applehook_temp.exe 

c:\users\admin\appdata\local\temp\applehook_temp.exe 

C:\Windows\Resources\Themes\icsys.icn.exe

C:\Windows\Resources\Themes\icsys.icn.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c certutil -hashfile "c:\users\admin\appdata\local\temp\applehook_temp.exe " MD5 | find /i /v "md5" | find /i /v "certutil"

C:\Windows\system32\certutil.exe

certutil -hashfile "c:\users\admin\appdata\local\temp\applehook_temp.exe " MD5

C:\Windows\system32\find.exe

find /i /v "md5"

C:\Windows\system32\find.exe

find /i /v "certutil"

\??\c:\windows\resources\themes\explorer.exe

c:\windows\resources\themes\explorer.exe

\??\c:\windows\resources\spoolsv.exe

c:\windows\resources\spoolsv.exe SE

\??\c:\windows\resources\svchost.exe

c:\windows\resources\svchost.exe

\??\c:\windows\resources\spoolsv.exe

c:\windows\resources\spoolsv.exe PR

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c color 5

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c cls

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c cls

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c cls

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c cls

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c color 5

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c wmic diskdrive get model, serialnumber

C:\Windows\System32\Wbem\WMIC.exe

wmic diskdrive get model, serialnumber

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c ECHO CPU

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c wmic cpu get serialnumber

C:\Windows\System32\Wbem\WMIC.exe

wmic cpu get serialnumber

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c ECHO BIOS

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c wmic bios get serialnumber

C:\Windows\System32\Wbem\WMIC.exe

wmic bios get serialnumber

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c ECHO Motherboard

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c wmic baseboard get serialnumber

C:\Windows\System32\Wbem\WMIC.exe

wmic baseboard get serialnumber

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c ECHO smBIOS UUID

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c wmic path win32_computersystemproduct get uuid

C:\Windows\System32\Wbem\WMIC.exe

wmic path win32_computersystemproduct get uuid

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c getmac

C:\Windows\system32\getmac.exe

getmac

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c cls

Network

Country Destination Domain Proto
US 8.8.8.8:53 keyauth.win udp
US 104.26.1.5:443 keyauth.win tcp
US 8.8.8.8:53 183.142.211.20.in-addr.arpa udp
US 8.8.8.8:53 5.1.26.104.in-addr.arpa udp
US 8.8.8.8:53 x2.c.lencr.org udp
GB 173.222.13.40:80 x2.c.lencr.org tcp
US 8.8.8.8:53 194.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 40.13.222.173.in-addr.arpa udp
N/A 127.0.0.1:55516 tcp
N/A 127.0.0.1:55518 tcp
US 8.8.8.8:53 0.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 104.26.1.5:443 keyauth.win tcp
US 104.26.1.5:443 keyauth.win tcp
N/A 127.0.0.1:55554 tcp
N/A 127.0.0.1:55556 tcp
N/A 127.0.0.1:55559 tcp
N/A 127.0.0.1:55561 tcp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 217.135.221.88.in-addr.arpa udp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 26.178.89.13.in-addr.arpa udp
US 8.8.8.8:53 codecmd01.googlecode.com udp
NL 142.250.27.82:80 codecmd01.googlecode.com tcp
US 8.8.8.8:53 82.27.250.142.in-addr.arpa udp
US 8.8.8.8:53 codecmd02.googlecode.com udp
NL 142.250.27.82:80 codecmd02.googlecode.com tcp

Files

memory/208-0-0x0000000000400000-0x000000000041F000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\applehook_temp.exe 

MD5 ce537fe72153547615133027f822117e
SHA1 fb2c057974c3f8ee00d465fbc8476adc70cf3bb2
SHA256 63e75051f007465837e130a3fa577c544ed82ebb29b06b98e265328f70430f6d
SHA512 b2c483174a9447ef1b16f56e4a2913b178b737025f93c64163b0a5340a0a9b2eb5ae45c99a5ea5c7e30b19df982e9ecd1b0039c010369786a7a6e10bbc166c68

C:\Windows\Resources\Themes\icsys.icn.exe

MD5 0846d04802d0d2bc256dae2aae810494
SHA1 622b46409360a6ce85f9cf689c779e4c05d9b341
SHA256 5e3874494812f76e3bcd64fbf76c38d96fc720ca33a11b0aac72e85589ce6e67
SHA512 a62166cb7b8c9da3a4614c77442db66bb9b89c02999ab7f8b865f2c5b061f1c35761531d2ccc049fab211f3d0790d6fa42e983e99c59a19f179cc4fb41d05da0

memory/4332-11-0x0000000000400000-0x000000000041F000-memory.dmp

\??\c:\users\admin\appdata\local\temp\applehook_temp.exe 

MD5 fb015ddb83ca5e720882868eee644419
SHA1 6df7047e55d9cec3f3741c85a41b50df7eaf1183
SHA256 bf09ec94bfb540317de293ba2ee830d9f28978bfb3787b6cbb467a97ffca1b82
SHA512 14fa4622f92be071ed1eb1bd3850ab4babab3f9770bd47d808164bf39c2f0c296d6c7dad41927d0ad4fff38494426519df6dc29f2f61af74d0906db1a8ac7195

C:\Windows\Resources\Themes\explorer.exe

MD5 e6373fe29877ec46fe80a8f62bd9ac27
SHA1 6c87bd739910e7d0a1aa6c9fa39f4a05d27976dc
SHA256 e4f5cf36d13c6ce0b510a17ed0bf558ac065292152301155353990507dc20171
SHA512 9b2c77a70f7a88b95ef91db7fe0a7488e624e69a9df2f438d70e0c071da20767d9d2d774e68cc61144ae51a612a667dac76cfcd9ffb5ebaa88be021dc06863d7

C:\Windows\Resources\Themes\explorer.exe

MD5 0d42bc335fe012a8ef511451165a16b8
SHA1 31078dce496744b380d51e5a2cc12e9c2151e716
SHA256 2249b869b9c0741be62de42f4d553a8b116bc126f4075831ab42eeac0f29b6ba
SHA512 a32ecf6fb9176a8648bd560a5b95c9012a031748e486b4ef66d49a557f21ae469c9738f20b6898e99cd54b056e0dc8698d2e5999687bad35b30381025ae150fb

C:\Windows\Resources\spoolsv.exe

MD5 f8828c98ae29df48173887014efeaa77
SHA1 db133820ac05c9e563a3f1bb9cd11a9c330b41d5
SHA256 421d97adc0bc2bbbe08843dfb9aba7d403ff58949e065924ea4a62a45282f287
SHA512 22961188718335f1286a927744ad4965774f6acbf4b041ed70b231650d12f0ad1ef7deadfacaf5eb27171d47253370f8fa8057e2ea3c05a5cad77b8448465a02

C:\Windows\Resources\svchost.exe

MD5 59a5c10d3ed9db158ac2ef26e3e05e2f
SHA1 bdfb54033f66a63d531e84ae535295a0430958d4
SHA256 240661b0e173914ab953081ba8457ed7ea2ff2c0cc5d105d9eb41feba71ce1ef
SHA512 cfddd1174e443bf42d666286a77c4c8db0bffb7db4a6e2747aa1239ff10ba2188910d588289904cc099db3770f49fdfa8dd045ca98090f4ff0a6da089a7e278e

memory/3140-44-0x0000000000400000-0x000000000041F000-memory.dmp

memory/4332-46-0x0000000000400000-0x000000000041F000-memory.dmp

memory/4812-45-0x0000000000400000-0x000000000041F000-memory.dmp

memory/208-47-0x0000000000400000-0x000000000041F000-memory.dmp

memory/4856-48-0x0000000000400000-0x000000000041F000-memory.dmp

memory/3008-49-0x0000000000400000-0x000000000041F000-memory.dmp