d0024fbc2f166639aab20236e9fad73d58c7579a13921db27ba2902290f81c1d

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
12/02/2024, 14:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9754ed1850613133670ce6744da7bf2c.exe
Size

304KB
MD5

9754ed1850613133670ce6744da7bf2c
SHA1

5f6a5ee9f74fee0a69a96ee68b43ac1f06279bcf
SHA256

d0024fbc2f166639aab20236e9fad73d58c7579a13921db27ba2902290f81c1d
SHA512

fa6a95fb66bb9539aee13e7f5aae044ce966cabc5d0e68f3948337bc123b6f14664999c1d2a08b8f4a0919a57e1d80b00f3dfd1a2f5c585107f78f36381859d9
SSDEEP

6144:ascPtZKAWVNHZ2iSgSVn5+7jIdUDETTq7xPRU3P:rMoVNHZ1vSVI78dfaNPRWP

Score

10^/10

evasion persistence upx

Malware Config

Signatures

Modifies firewall policy service 2 TTPs 8 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\%windir%/system32/winamptürk.exe = "C:\\Windows\\system32\\winamptürk.exe:*:Enabled:winamptürk.exe"	9754ed1850613133670ce6744da7bf2c.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	winamptürk.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\%windir%/system32/winamptürk.exe = "C:\\Windows\\system32\\winamptürk.exe:*:Enabled:winamptürk.exe"	winamptürk.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	winamptürk.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\%windir%/system32/winamptürk.exe = "C:\\Windows\\system32\\winamptürk.exe:*:Enabled:winamptürk.exe"	winamptürk.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	9754ed1850613133670ce6744da7bf2c.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	9754ed1850613133670ce6744da7bf2c.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	9754ed1850613133670ce6744da7bf2c.exe

Nirsoft 1 IoCs

resource	yara_rule
behavioral2/memory/3112-19-0x0000000000400000-0x000000000041B000-memory.dmp	Nirsoft

Executes dropped EXE 3 IoCs

pid	Process
3112	ntkernelloader.exe
4176	winamptürk.exe
3152	winamptürk.exe

Loads dropped DLL 4 IoCs

pid	Process
2588	9754ed1850613133670ce6744da7bf2c.exe
2588	9754ed1850613133670ce6744da7bf2c.exe
4176	winamptürk.exe
3152	winamptürk.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x0006000000023209-16.dat	upx
behavioral2/memory/3112-18-0x0000000000400000-0x000000000041B000-memory.dmp	upx
behavioral2/memory/3112-19-0x0000000000400000-0x000000000041B000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\gcServ = "C:\\Windows\\system32\\winamptürk.exe"	9754ed1850613133670ce6744da7bf2c.exe

Drops file in System32 directory 11 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\mswinsck.ocx	9754ed1850613133670ce6744da7bf2c.exe
File created	C:\Windows\SysWOW64\winamptürk.exe	9754ed1850613133670ce6744da7bf2c.exe
File opened for modification	C:\Windows\SysWOW64\winamptürk.exe	9754ed1850613133670ce6744da7bf2c.exe
File created	C:\Windows\SysWOW64\optrves.dll	9754ed1850613133670ce6744da7bf2c.exe
File created	C:\Windows\SysWOW64\winamptürk.exe	winamptürk.exe
File opened for modification	C:\Windows\SysWOW64\optrves.dll	winamptürk.exe
File opened for modification	C:\Windows\SysWOW64\mswinsck.ocx	winamptürk.exe
File created	C:\Windows\SysWOW64\winamptürk.exe	winamptürk.exe
File opened for modification	C:\Windows\SysWOW64\ntkernelloader.exe	9754ed1850613133670ce6744da7bf2c.exe
File created	C:\Windows\SysWOW64\micdriverz.dll	ntkernelloader.exe
File opened for modification	C:\Windows\SysWOW64\mswinsck.ocx	winamptürk.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock.1\CLSID\ = "{248DD896-BB45-11CF-9ABC-0080C7E7B78D}"	9754ed1850613133670ce6744da7bf2c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Implemented Categories	9754ed1850613133670ce6744da7bf2c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Implemented Categories\{0DE86A52-2BAA-11CF-A229-00AA003D7352}	9754ed1850613133670ce6744da7bf2c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\ProxyStubClsid32	9754ed1850613133670ce6744da7bf2c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\InprocServer32\ThreadingModel = "Apartment"	9754ed1850613133670ce6744da7bf2c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock.1\CLSID	9754ed1850613133670ce6744da7bf2c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\HELPDIR\	9754ed1850613133670ce6744da7bf2c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib	9754ed1850613133670ce6744da7bf2c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\ProxyStubClsid32	9754ed1850613133670ce6744da7bf2c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib	9754ed1850613133670ce6744da7bf2c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\Version = "1.0"	9754ed1850613133670ce6744da7bf2c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0	9754ed1850613133670ce6744da7bf2c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\HELPDIR	9754ed1850613133670ce6744da7bf2c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD897-BB45-11CF-9ABC-0080C7E7B78D}\InprocServer32	9754ed1850613133670ce6744da7bf2c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\ = "Microsoft Winsock Control 6.0 (SP5)"	9754ed1850613133670ce6744da7bf2c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\ = "{248DD890-BB45-11CF-9ABC-0080C7E7B78D}"	9754ed1850613133670ce6744da7bf2c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\FLAGS\ = "2"	9754ed1850613133670ce6744da7bf2c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\InprocServer32	9754ed1850613133670ce6744da7bf2c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib	9754ed1850613133670ce6744da7bf2c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\VersionIndependentProgID	9754ed1850613133670ce6744da7bf2c.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD897-BB45-11CF-9ABC-0080C7E7B78D}	9754ed1850613133670ce6744da7bf2c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\0	9754ed1850613133670ce6744da7bf2c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}	9754ed1850613133670ce6744da7bf2c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\ = "{248DD890-BB45-11CF-9ABC-0080C7E7B78D}"	9754ed1850613133670ce6744da7bf2c.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}	9754ed1850613133670ce6744da7bf2c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock\CurVer\ = "MSWinsock.Winsock.1"	9754ed1850613133670ce6744da7bf2c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	9754ed1850613133670ce6744da7bf2c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\ProxyStubClsid32	9754ed1850613133670ce6744da7bf2c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	9754ed1850613133670ce6744da7bf2c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\MiscStatus	9754ed1850613133670ce6744da7bf2c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\FLAGS	9754ed1850613133670ce6744da7bf2c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\VersionIndependentProgID\ = "MSWinsock.Winsock"	9754ed1850613133670ce6744da7bf2c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Version\ = "1.0"	9754ed1850613133670ce6744da7bf2c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Implemented Categories\{40FC6ED4-2438-11CF-A3DB-080036F12502}	9754ed1850613133670ce6744da7bf2c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Implemented Categories\{0DE86A53-2BAA-11CF-A229-00AA003D7352}	9754ed1850613133670ce6744da7bf2c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock\CLSID	9754ed1850613133670ce6744da7bf2c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock\CurVer	9754ed1850613133670ce6744da7bf2c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\ToolboxBitmap32	9754ed1850613133670ce6744da7bf2c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\0\win32	9754ed1850613133670ce6744da7bf2c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\0\win32\ = "C:\\Windows\\SysWow64\\MSWINSCK.ocx"	9754ed1850613133670ce6744da7bf2c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}	9754ed1850613133670ce6744da7bf2c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\ = "IMSWinsockControl"	9754ed1850613133670ce6744da7bf2c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Programmable	9754ed1850613133670ce6744da7bf2c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\MiscStatus\1\ = "132497"	9754ed1850613133670ce6744da7bf2c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\ProgID	9754ed1850613133670ce6744da7bf2c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Implemented Categories\{0DE86A57-2BAA-11CF-A229-00AA003D7352}	9754ed1850613133670ce6744da7bf2c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}	9754ed1850613133670ce6744da7bf2c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\ = "{248DD890-BB45-11CF-9ABC-0080C7E7B78D}"	9754ed1850613133670ce6744da7bf2c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\ = "Microsoft WinSock Control, version 6.0"	9754ed1850613133670ce6744da7bf2c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock\CLSID\ = "{248DD896-BB45-11CF-9ABC-0080C7E7B78D}"	9754ed1850613133670ce6744da7bf2c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\ = "DMSWinsockControlEvents"	9754ed1850613133670ce6744da7bf2c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\ = "DMSWinsockControlEvents"	9754ed1850613133670ce6744da7bf2c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib	9754ed1850613133670ce6744da7bf2c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\ProxyStubClsid32	9754ed1850613133670ce6744da7bf2c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\ToolboxBitmap32\ = "C:\\Windows\\SysWow64\\MSWINSCK.ocx, 1"	9754ed1850613133670ce6744da7bf2c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\ = "{248DD890-BB45-11CF-9ABC-0080C7E7B78D}"	9754ed1850613133670ce6744da7bf2c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}	9754ed1850613133670ce6744da7bf2c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\Version = "1.0"	9754ed1850613133670ce6744da7bf2c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock\ = "Microsoft WinSock Control, version 6.0"	9754ed1850613133670ce6744da7bf2c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\ProgID\ = "MSWinsock.Winsock.1"	9754ed1850613133670ce6744da7bf2c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Implemented Categories\{40FC6ED5-2438-11CF-A3DB-080036F12502}	9754ed1850613133670ce6744da7bf2c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Control	9754ed1850613133670ce6744da7bf2c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\ = "IMSWinsockControl"	9754ed1850613133670ce6744da7bf2c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock.1\ = "Microsoft WinSock Control, version 6.0"	9754ed1850613133670ce6744da7bf2c.exe

Suspicious behavior: GetForegroundWindowSpam 3 IoCs

pid	Process
2588	9754ed1850613133670ce6744da7bf2c.exe
4176	winamptürk.exe
3152	winamptürk.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2588	9754ed1850613133670ce6744da7bf2c.exe
4176	winamptürk.exe
3152	winamptürk.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2588 wrote to memory of 3112	2588	9754ed1850613133670ce6744da7bf2c.exe	90
PID 2588 wrote to memory of 3112	2588	9754ed1850613133670ce6744da7bf2c.exe	90
PID 2588 wrote to memory of 3112	2588	9754ed1850613133670ce6744da7bf2c.exe	90
PID 2588 wrote to memory of 4176	2588	9754ed1850613133670ce6744da7bf2c.exe	95
PID 2588 wrote to memory of 4176	2588	9754ed1850613133670ce6744da7bf2c.exe	95
PID 2588 wrote to memory of 4176	2588	9754ed1850613133670ce6744da7bf2c.exe	95
PID 4176 wrote to memory of 3152	4176	winamptürk.exe	96
PID 4176 wrote to memory of 3152	4176	winamptürk.exe	96
PID 4176 wrote to memory of 3152	4176	winamptürk.exe	96

C:\Users\Admin\AppData\Local\Temp\9754ed1850613133670ce6744da7bf2c.exe
"C:\Users\Admin\AppData\Local\Temp\9754ed1850613133670ce6744da7bf2c.exe"
1⤵
- Modifies firewall policy service
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2588
- C:\Windows\SysWOW64\ntkernelloader.exe
  C:\Windows\system32\ntkernelloader.exe /stext C:\Windows\system32\micdriverz.dll
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  PID:3112
- C:\Windows\SysWOW64\winamptürk.exe
  C:\Windows\system32\winamptürk.exe
  2⤵
  - Modifies firewall policy service
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4176
- - C:\Windows\SysWOW64\winamptürk.exe
    C:\Windows\system32\winamptürk.exe
    3⤵
    - Modifies firewall policy service
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in System32 directory
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:3152

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\mswinsck.ocx

Filesize
106KB

MD5
3d8fd62d17a44221e07d5c535950449b

SHA1
6c9d2ecdd7c2d1b9660d342e2b95a82229486d27

SHA256
eba048e3a9cb11671d0e3c5a0b243b304d421762361fe24fd5ea08cb66704b09

SHA512
501e22a0f99e18f6405356184506bc5849adc2c1df3bdee71f2b4514ab0e3e36673b4aecbd615d24ebb4be5a28570b2a6f80bd52331edb658f7a5f5a9d686d10

Download Submit
C:\Windows\SysWOW64\ntkernelloader.exe

Filesize
43KB

MD5
588ab9262f42d01d153257ce3b71ebfe

SHA1
09e06a95a39ed524b8c85cb26bc9e8ce6ad57bfa

SHA256
4fce527ab68ba2d951f35ece37bff7ca3eb4b83e37ff903c49c0d6f4882610b8

SHA512
a08492b26aa2b0c4f2c6ebba51a160e8905392b528f3b38bd757553c9187de7891d8aeee75c7f9296d869d38590ecc71facb9512e8dee42f8f9729cc31de1b6d

Download Submit
C:\Windows\SysWOW64\optrves.dll

Filesize
817B

MD5
cdd0490b4c9b4e3f22e5ff0a07684189

SHA1
81d8cf232768d5f6e74129494e83207846d8c984

SHA256
530c012e704448d6832a17da37e3f2fb9fa2ce577bceee27b19aaeaf1788a099

SHA512
2fe153b954203d794d838e72faaea3162662d7ff9dcda5f935d2f49b067f9b138e6576342482a140bb9ee8f5d0e16c7b8a3a11f46d7d4e2e801ebecce5fc2ddd

Download Submit
C:\Windows\SysWOW64\optrves.dll

Filesize
1KB

MD5
6c07bab3f3f820cefd024c129a87a0c5

SHA1
16409c77aed06f0147ce4ad47c85db319e54610c

SHA256
89313ab556ac98e57dd07e2a7a604589780a91f3c0b1c05efe1505e80eb4ede1

SHA512
9123768b8a053a0f87b8e2524ddf9e0dad59a759878a8dca4ce0b6e95d3f7a5fe89558526952ac9aae6b439f22135bbabace2074f2e89551ab26f47f649bd718

Download Submit
C:\Windows\SysWOW64\winamptürk.exe

Filesize
304KB

MD5
9754ed1850613133670ce6744da7bf2c

SHA1
5f6a5ee9f74fee0a69a96ee68b43ac1f06279bcf

SHA256
d0024fbc2f166639aab20236e9fad73d58c7579a13921db27ba2902290f81c1d

SHA512
fa6a95fb66bb9539aee13e7f5aae044ce966cabc5d0e68f3948337bc123b6f14664999c1d2a08b8f4a0919a57e1d80b00f3dfd1a2f5c585107f78f36381859d9

Download Submit
memory/3112-18-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/3112-19-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads