1718d8b476750bb27e79861a85e7fc97191feb02d6dd04a219f34123673e2739

Analysis

max time kernel
150s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
05/03/2024, 08:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b447a0869a20eff4560ef0ad23446ad0.exe
Size

47KB
MD5

b447a0869a20eff4560ef0ad23446ad0
SHA1

af64e24d35e97e572119e8a59210b0de097bcc40
SHA256

1718d8b476750bb27e79861a85e7fc97191feb02d6dd04a219f34123673e2739
SHA512

4be7d3a6bce00185a4426635dcf1b47efac4abdaefb169ba635d130d47bf439554af0d49a5068e4f45ed1b0608005933a30a01faf18ee7c948bad4f58a42e42b
SSDEEP

768:ptnVPu2lqjMlhiAij7n+7HwoKS1dTL0UZ5tOcoYmsPehaaxxha5hz:phVNlub5+7Q0dc05ApYh2haigz

Score

10^/10

aspackv2 persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe System.exe"	servicas.exe

ASPack v2.12-2.42 2 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral1/files/0x000d000000012248-8.dat	aspack_v212_v242
behavioral1/memory/2872-22-0x00000000003B0000-0x00000000003D7000-memory.dmp	aspack_v212_v242

Executes dropped EXE 64 IoCs

pid	Process
1708	System.exe
2120	servicas.exe
2600	System.exe
2748	System.exe
2604	System.exe
2468	System.exe
2492	System.exe
2464	System.exe
2564	System.exe
2104	System.exe
1952	System.exe
2768	System.exe
2912	System.exe
1300	System.exe
2252	System.exe
820	System.exe
1568	System.exe
1828	System.exe
2724	System.exe
1528	System.exe
1432	System.exe
880	System.exe
2308	System.exe
1292	System.exe
2036	System.exe
2428	System.exe
2796	System.exe
2640	System.exe
2844	System.exe
772	System.exe
608	System.exe
808	System.exe
576	System.exe
1788	System.exe
2412	System.exe
1820	System.exe
1120	System.exe
1364	System.exe
1056	System.exe
1604	System.exe
1048	System.exe
1632	System.exe
1068	System.exe
2960	System.exe
1704	System.exe
920	System.exe
2056	System.exe
2528	System.exe
404	System.exe
2276	System.exe
2000	System.exe
3048	System.exe
996	System.exe
1516	System.exe
2396	System.exe
2944	System.exe
1620	System.exe
1584	System.exe
2536	System.exe
1984	System.exe
2872	System.exe
2884	System.exe
2568	System.exe
2172	System.exe

Loads dropped DLL 64 IoCs

pid	Process
2872	b447a0869a20eff4560ef0ad23446ad0.exe
2872	b447a0869a20eff4560ef0ad23446ad0.exe
2120	servicas.exe
2120	servicas.exe
2120	servicas.exe
2120	servicas.exe
2120	servicas.exe
2120	servicas.exe
2120	servicas.exe
2120	servicas.exe
2120	servicas.exe
2120	servicas.exe
2120	servicas.exe
2120	servicas.exe
2120	servicas.exe
2120	servicas.exe
2120	servicas.exe
2120	servicas.exe
2120	servicas.exe
2120	servicas.exe
2120	servicas.exe
2120	servicas.exe
2120	servicas.exe
2120	servicas.exe
2120	servicas.exe
2120	servicas.exe
2120	servicas.exe
2120	servicas.exe
2120	servicas.exe
2120	servicas.exe
2120	servicas.exe
2120	servicas.exe
2120	servicas.exe
2120	servicas.exe
2120	servicas.exe
2120	servicas.exe
2120	servicas.exe
2120	servicas.exe
2120	servicas.exe
2120	servicas.exe
2120	servicas.exe
2120	servicas.exe
2120	servicas.exe
2120	servicas.exe
2120	servicas.exe
2120	servicas.exe
2120	servicas.exe
2120	servicas.exe
2120	servicas.exe
2120	servicas.exe
2120	servicas.exe
2120	servicas.exe
2120	servicas.exe
2120	servicas.exe
2120	servicas.exe
2120	servicas.exe
2120	servicas.exe
2120	servicas.exe
2120	servicas.exe
2120	servicas.exe
2120	servicas.exe
2120	servicas.exe
2120	servicas.exe
2120	servicas.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\System.exe	servicas.exe
File created	C:\Windows\SysWOW64\System.exe	b447a0869a20eff4560ef0ad23446ad0.exe
File opened for modification	C:\Windows\SysWOW64\System.exe	b447a0869a20eff4560ef0ad23446ad0.exe
File created	C:\Windows\SysWOW64\System.exe	System.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\servicas.exe	b447a0869a20eff4560ef0ad23446ad0.exe
File opened for modification	C:\Windows\servicas.exe	b447a0869a20eff4560ef0ad23446ad0.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2872 wrote to memory of 1708	2872	b447a0869a20eff4560ef0ad23446ad0.exe	28
PID 2872 wrote to memory of 1708	2872	b447a0869a20eff4560ef0ad23446ad0.exe	28
PID 2872 wrote to memory of 1708	2872	b447a0869a20eff4560ef0ad23446ad0.exe	28
PID 2872 wrote to memory of 1708	2872	b447a0869a20eff4560ef0ad23446ad0.exe	28
PID 2872 wrote to memory of 2120	2872	b447a0869a20eff4560ef0ad23446ad0.exe	29
PID 2872 wrote to memory of 2120	2872	b447a0869a20eff4560ef0ad23446ad0.exe	29
PID 2872 wrote to memory of 2120	2872	b447a0869a20eff4560ef0ad23446ad0.exe	29
PID 2872 wrote to memory of 2120	2872	b447a0869a20eff4560ef0ad23446ad0.exe	29
PID 2120 wrote to memory of 2600	2120	servicas.exe	30
PID 2120 wrote to memory of 2600	2120	servicas.exe	30
PID 2120 wrote to memory of 2600	2120	servicas.exe	30
PID 2120 wrote to memory of 2600	2120	servicas.exe	30
PID 2120 wrote to memory of 2748	2120	servicas.exe	31
PID 2120 wrote to memory of 2748	2120	servicas.exe	31
PID 2120 wrote to memory of 2748	2120	servicas.exe	31
PID 2120 wrote to memory of 2748	2120	servicas.exe	31
PID 2120 wrote to memory of 2604	2120	servicas.exe	32
PID 2120 wrote to memory of 2604	2120	servicas.exe	32
PID 2120 wrote to memory of 2604	2120	servicas.exe	32
PID 2120 wrote to memory of 2604	2120	servicas.exe	32
PID 2120 wrote to memory of 2468	2120	servicas.exe	33
PID 2120 wrote to memory of 2468	2120	servicas.exe	33
PID 2120 wrote to memory of 2468	2120	servicas.exe	33
PID 2120 wrote to memory of 2468	2120	servicas.exe	33
PID 2120 wrote to memory of 2492	2120	servicas.exe	34
PID 2120 wrote to memory of 2492	2120	servicas.exe	34
PID 2120 wrote to memory of 2492	2120	servicas.exe	34
PID 2120 wrote to memory of 2492	2120	servicas.exe	34
PID 2120 wrote to memory of 2464	2120	servicas.exe	35
PID 2120 wrote to memory of 2464	2120	servicas.exe	35
PID 2120 wrote to memory of 2464	2120	servicas.exe	35
PID 2120 wrote to memory of 2464	2120	servicas.exe	35
PID 2120 wrote to memory of 2564	2120	servicas.exe	36
PID 2120 wrote to memory of 2564	2120	servicas.exe	36
PID 2120 wrote to memory of 2564	2120	servicas.exe	36
PID 2120 wrote to memory of 2564	2120	servicas.exe	36
PID 2120 wrote to memory of 2104	2120	servicas.exe	37
PID 2120 wrote to memory of 2104	2120	servicas.exe	37
PID 2120 wrote to memory of 2104	2120	servicas.exe	37
PID 2120 wrote to memory of 2104	2120	servicas.exe	37
PID 2120 wrote to memory of 1952	2120	servicas.exe	38
PID 2120 wrote to memory of 1952	2120	servicas.exe	38
PID 2120 wrote to memory of 1952	2120	servicas.exe	38
PID 2120 wrote to memory of 1952	2120	servicas.exe	38
PID 2120 wrote to memory of 2768	2120	servicas.exe	39
PID 2120 wrote to memory of 2768	2120	servicas.exe	39
PID 2120 wrote to memory of 2768	2120	servicas.exe	39
PID 2120 wrote to memory of 2768	2120	servicas.exe	39
PID 2120 wrote to memory of 2912	2120	servicas.exe	40
PID 2120 wrote to memory of 2912	2120	servicas.exe	40
PID 2120 wrote to memory of 2912	2120	servicas.exe	40
PID 2120 wrote to memory of 2912	2120	servicas.exe	40
PID 2120 wrote to memory of 1300	2120	servicas.exe	41
PID 2120 wrote to memory of 1300	2120	servicas.exe	41
PID 2120 wrote to memory of 1300	2120	servicas.exe	41
PID 2120 wrote to memory of 1300	2120	servicas.exe	41
PID 2120 wrote to memory of 2252	2120	servicas.exe	42
PID 2120 wrote to memory of 2252	2120	servicas.exe	42
PID 2120 wrote to memory of 2252	2120	servicas.exe	42
PID 2120 wrote to memory of 2252	2120	servicas.exe	42
PID 2120 wrote to memory of 820	2120	servicas.exe	43
PID 2120 wrote to memory of 820	2120	servicas.exe	43
PID 2120 wrote to memory of 820	2120	servicas.exe	43
PID 2120 wrote to memory of 820	2120	servicas.exe	43

C:\Users\Admin\AppData\Local\Temp\b447a0869a20eff4560ef0ad23446ad0.exe
"C:\Users\Admin\AppData\Local\Temp\b447a0869a20eff4560ef0ad23446ad0.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2872
- C:\Windows\SysWOW64\System.exe
  C:\Windows\system32\System.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  PID:1708
- C:\Windows\servicas.exe
  C:\Windows\servicas.exe
  2⤵
  - Modifies WinLogon for persistence
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:2120
- - C:\Windows\SysWOW64\System.exe
    C:\Windows\system32\System.exe
    3⤵
    - Executes dropped EXE
    PID:2600
- - C:\Windows\SysWOW64\System.exe
    C:\Windows\system32\System.exe
    3⤵
    - Executes dropped EXE
    PID:2748
- - C:\Windows\SysWOW64\System.exe
    C:\Windows\system32\System.exe
    3⤵
    - Executes dropped EXE
    PID:2604
- - C:\Windows\SysWOW64\System.exe
    C:\Windows\system32\System.exe
    3⤵
    - Executes dropped EXE
    PID:2468
- - C:\Windows\SysWOW64\System.exe
    C:\Windows\system32\System.exe
    3⤵
    - Executes dropped EXE
    PID:2492
- - C:\Windows\SysWOW64\System.exe
    C:\Windows\system32\System.exe
    3⤵
    - Executes dropped EXE
    PID:2464
- - C:\Windows\SysWOW64\System.exe
    C:\Windows\system32\System.exe
    3⤵
    - Executes dropped EXE
    PID:2564
- - C:\Windows\SysWOW64\System.exe
    C:\Windows\system32\System.exe
    3⤵
    - Executes dropped EXE
    PID:2104
- - C:\Windows\SysWOW64\System.exe
    C:\Windows\system32\System.exe
    3⤵
    - Executes dropped EXE
    PID:1952
- - C:\Windows\SysWOW64\System.exe
    C:\Windows\system32\System.exe
    3⤵
    - Executes dropped EXE
    PID:2768
- - C:\Windows\SysWOW64\System.exe
    C:\Windows\system32\System.exe
    3⤵
    - Executes dropped EXE
    PID:2912
- - C:\Windows\SysWOW64\System.exe
    C:\Windows\system32\System.exe
    3⤵
    - Executes dropped EXE
    PID:1300
- - C:\Windows\SysWOW64\System.exe
    C:\Windows\system32\System.exe
    3⤵
    - Executes dropped EXE
    PID:2252
- - C:\Windows\SysWOW64\System.exe
    C:\Windows\system32\System.exe
    3⤵
    - Executes dropped EXE
    PID:820
- - C:\Windows\SysWOW64\System.exe
    C:\Windows\system32\System.exe
    3⤵
    - Executes dropped EXE
    PID:1568
- - C:\Windows\SysWOW64\System.exe
    C:\Windows\system32\System.exe
    3⤵
    - Executes dropped EXE
    PID:1828
- - C:\Windows\SysWOW64\System.exe
    C:\Windows\system32\System.exe
    3⤵
    - Executes dropped EXE
    PID:2724
- - C:\Windows\SysWOW64\System.exe
    C:\Windows\system32\System.exe
    3⤵
    - Executes dropped EXE
    PID:1528
- - C:\Windows\SysWOW64\System.exe
    C:\Windows\system32\System.exe
    3⤵
    - Executes dropped EXE
    PID:1432
- - C:\Windows\SysWOW64\System.exe
    C:\Windows\system32\System.exe
    3⤵
    - Executes dropped EXE
    PID:880
- - C:\Windows\SysWOW64\System.exe
    C:\Windows\system32\System.exe
    3⤵
    - Executes dropped EXE
    PID:2308
- - C:\Windows\SysWOW64\System.exe
    C:\Windows\system32\System.exe
    3⤵
    - Executes dropped EXE
    PID:1292
- - C:\Windows\SysWOW64\System.exe
    C:\Windows\system32\System.exe
    3⤵
    - Executes dropped EXE
    PID:2036
- - C:\Windows\SysWOW64\System.exe
    C:\Windows\system32\System.exe
    3⤵
    - Executes dropped EXE
    PID:2428
- - C:\Windows\SysWOW64\System.exe
    C:\Windows\system32\System.exe
    3⤵
    - Executes dropped EXE
    PID:2796
- - C:\Windows\SysWOW64\System.exe
    C:\Windows\system32\System.exe
    3⤵
    - Executes dropped EXE
    PID:2640
- - C:\Windows\SysWOW64\System.exe
    C:\Windows\system32\System.exe
    3⤵
    - Executes dropped EXE
    PID:2844
- - C:\Windows\SysWOW64\System.exe
    C:\Windows\system32\System.exe
    3⤵
    - Executes dropped EXE
    PID:772
- - C:\Windows\SysWOW64\System.exe
    C:\Windows\system32\System.exe
    3⤵
    - Executes dropped EXE
    PID:608
- - C:\Windows\SysWOW64\System.exe
    C:\Windows\system32\System.exe
    3⤵
    - Executes dropped EXE
    PID:808
- - C:\Windows\SysWOW64\System.exe
    C:\Windows\system32\System.exe
    3⤵
    - Executes dropped EXE
    PID:576
- - C:\Windows\SysWOW64\System.exe
    C:\Windows\system32\System.exe
    3⤵
    - Executes dropped EXE
    PID:1788
- - C:\Windows\SysWOW64\System.exe
    C:\Windows\system32\System.exe
    3⤵
    - Executes dropped EXE
    PID:2412
- - C:\Windows\SysWOW64\System.exe
    C:\Windows\system32\System.exe
    3⤵
    - Executes dropped EXE
    PID:1820
- - C:\Windows\SysWOW64\System.exe
    C:\Windows\system32\System.exe
    3⤵
    - Executes dropped EXE
    PID:1120
- - C:\Windows\SysWOW64\System.exe
    C:\Windows\system32\System.exe
    3⤵
    - Executes dropped EXE
    PID:1364
- - C:\Windows\SysWOW64\System.exe
    C:\Windows\system32\System.exe
    3⤵
    - Executes dropped EXE
    PID:1056
- - C:\Windows\SysWOW64\System.exe
    C:\Windows\system32\System.exe
    3⤵
    - Executes dropped EXE
    PID:1604
- - C:\Windows\SysWOW64\System.exe
    C:\Windows\system32\System.exe
    3⤵
    - Executes dropped EXE
    PID:1048
- - C:\Windows\SysWOW64\System.exe
    C:\Windows\system32\System.exe
    3⤵
    - Executes dropped EXE
    PID:1632
- - C:\Windows\SysWOW64\System.exe
    C:\Windows\system32\System.exe
    3⤵
    - Executes dropped EXE
    PID:1068
- - C:\Windows\SysWOW64\System.exe
    C:\Windows\system32\System.exe
    3⤵
    - Executes dropped EXE
    PID:2960
- - C:\Windows\SysWOW64\System.exe
    C:\Windows\system32\System.exe
    3⤵
    - Executes dropped EXE
    PID:1704
- - C:\Windows\SysWOW64\System.exe
    C:\Windows\system32\System.exe
    3⤵
    - Executes dropped EXE
    PID:920
- - C:\Windows\SysWOW64\System.exe
    C:\Windows\system32\System.exe
    3⤵
    - Executes dropped EXE
    PID:2056
- - C:\Windows\SysWOW64\System.exe
    C:\Windows\system32\System.exe
    3⤵
    - Executes dropped EXE
    PID:2528
- - C:\Windows\SysWOW64\System.exe
    C:\Windows\system32\System.exe
    3⤵
    - Executes dropped EXE
    PID:404
- - C:\Windows\SysWOW64\System.exe
    C:\Windows\system32\System.exe
    3⤵
    - Executes dropped EXE
    PID:2276
- - C:\Windows\SysWOW64\System.exe
    C:\Windows\system32\System.exe
    3⤵
    - Executes dropped EXE
    PID:2000
- - C:\Windows\SysWOW64\System.exe
    C:\Windows\system32\System.exe
    3⤵
    - Executes dropped EXE
    PID:3048
- - C:\Windows\SysWOW64\System.exe
    C:\Windows\system32\System.exe
    3⤵
    - Executes dropped EXE
    PID:996
- - C:\Windows\SysWOW64\System.exe
    C:\Windows\system32\System.exe
    3⤵
    - Executes dropped EXE
    PID:1516
- - C:\Windows\SysWOW64\System.exe
    C:\Windows\system32\System.exe
    3⤵
    - Executes dropped EXE
    PID:2396
- - C:\Windows\SysWOW64\System.exe
    C:\Windows\system32\System.exe
    3⤵
    - Executes dropped EXE
    PID:2944
- - C:\Windows\SysWOW64\System.exe
    C:\Windows\system32\System.exe
    3⤵
    - Executes dropped EXE
    PID:1620
- - C:\Windows\SysWOW64\System.exe
    C:\Windows\system32\System.exe
    3⤵
    - Executes dropped EXE
    PID:1584
- - C:\Windows\SysWOW64\System.exe
    C:\Windows\system32\System.exe
    3⤵
    - Executes dropped EXE
    PID:2536
- - C:\Windows\SysWOW64\System.exe
    C:\Windows\system32\System.exe
    3⤵
    - Executes dropped EXE
    PID:1984
- - C:\Windows\SysWOW64\System.exe
    C:\Windows\system32\System.exe
    3⤵
    - Executes dropped EXE
    PID:2872
- - C:\Windows\SysWOW64\System.exe
    C:\Windows\system32\System.exe
    3⤵
    - Executes dropped EXE
    PID:2884
- - C:\Windows\SysWOW64\System.exe
    C:\Windows\system32\System.exe
    3⤵
    - Executes dropped EXE
    PID:2568
- - C:\Windows\SysWOW64\System.exe
    C:\Windows\system32\System.exe
    3⤵
    - Executes dropped EXE
    PID:2172
- - C:\Windows\SysWOW64\System.exe
    C:\Windows\system32\System.exe
    3⤵
    PID:2728
- - C:\Windows\SysWOW64\System.exe
    C:\Windows\system32\System.exe
    3⤵
    PID:2472
- - C:\Windows\SysWOW64\System.exe
    C:\Windows\system32\System.exe
    3⤵
    PID:2860
- - C:\Windows\SysWOW64\System.exe
    C:\Windows\system32\System.exe
    3⤵
    PID:2948
- - C:\Windows\SysWOW64\System.exe
    C:\Windows\system32\System.exe
    3⤵
    PID:2616
- - C:\Windows\SysWOW64\System.exe
    C:\Windows\system32\System.exe
    3⤵
    PID:2444
- - C:\Windows\SysWOW64\System.exe
    C:\Windows\system32\System.exe
    3⤵
    PID:2464
- - C:\Windows\SysWOW64\System.exe
    C:\Windows\system32\System.exe
    3⤵
    PID:2900
- - C:\Windows\SysWOW64\System.exe
    C:\Windows\system32\System.exe
    3⤵
    PID:2332
- - C:\Windows\SysWOW64\System.exe
    C:\Windows\system32\System.exe
    3⤵
    PID:2708
- - C:\Windows\SysWOW64\System.exe
    C:\Windows\system32\System.exe
    3⤵
    PID:1976
- - C:\Windows\SysWOW64\System.exe
    C:\Windows\system32\System.exe
    3⤵
    PID:2532
- - C:\Windows\SysWOW64\System.exe
    C:\Windows\system32\System.exe
    3⤵
    PID:2784
- - C:\Windows\SysWOW64\System.exe
    C:\Windows\system32\System.exe
    3⤵
    PID:2876
- - C:\Windows\SysWOW64\System.exe
    C:\Windows\system32\System.exe
    3⤵
    PID:3040
- - C:\Windows\SysWOW64\System.exe
    C:\Windows\system32\System.exe
    3⤵
    PID:1444
- - C:\Windows\SysWOW64\System.exe
    C:\Windows\system32\System.exe
    3⤵
    PID:1936
- - C:\Windows\SysWOW64\System.exe
    C:\Windows\system32\System.exe
    3⤵
    PID:2336
- - C:\Windows\SysWOW64\System.exe
    C:\Windows\system32\System.exe
    3⤵
    PID:1640
- - C:\Windows\SysWOW64\System.exe
    C:\Windows\system32\System.exe
    3⤵
    PID:288
- - C:\Windows\SysWOW64\System.exe
    C:\Windows\system32\System.exe
    3⤵
    PID:1768
- - C:\Windows\SysWOW64\System.exe
    C:\Windows\system32\System.exe
    3⤵
    PID:1828
- - C:\Windows\SysWOW64\System.exe
    C:\Windows\system32\System.exe
    3⤵
    PID:2724
- - C:\Windows\SysWOW64\System.exe
    C:\Windows\system32\System.exe
    3⤵
    PID:1544
- - C:\Windows\SysWOW64\System.exe
    C:\Windows\system32\System.exe
    3⤵
    PID:872
- - C:\Windows\SysWOW64\System.exe
    C:\Windows\system32\System.exe
    3⤵
    PID:644
- - C:\Windows\SysWOW64\System.exe
    C:\Windows\system32\System.exe
    3⤵
    PID:880
- - C:\Windows\SysWOW64\System.exe
    C:\Windows\system32\System.exe
    3⤵
    PID:2308
- - C:\Windows\SysWOW64\System.exe
    C:\Windows\system32\System.exe
    3⤵
    PID:2076
- - C:\Windows\SysWOW64\System.exe
    C:\Windows\system32\System.exe
    3⤵
    PID:876
- - C:\Windows\SysWOW64\System.exe
    C:\Windows\system32\System.exe
    3⤵
    PID:2796
- - C:\Windows\SysWOW64\System.exe
    C:\Windows\system32\System.exe
    3⤵
    PID:2640
- - C:\Windows\SysWOW64\System.exe
    C:\Windows\system32\System.exe
    3⤵
    PID:2540
- - C:\Windows\SysWOW64\System.exe
    C:\Windows\system32\System.exe
    3⤵
    PID:688
- - C:\Windows\SysWOW64\System.exe
    C:\Windows\system32\System.exe
    3⤵
    PID:788
- - C:\Windows\SysWOW64\System.exe
    C:\Windows\system32\System.exe
    3⤵
    PID:592
- - C:\Windows\SysWOW64\System.exe
    C:\Windows\system32\System.exe
    3⤵
    PID:1788
- - C:\Windows\SysWOW64\System.exe
    C:\Windows\system32\System.exe
    3⤵
    PID:1320
- - C:\Windows\SysWOW64\System.exe
    C:\Windows\system32\System.exe
    3⤵
    PID:2964
- - C:\Windows\SysWOW64\System.exe
    C:\Windows\system32\System.exe
    3⤵
    PID:1364
- - C:\Windows\SysWOW64\System.exe
    C:\Windows\system32\System.exe
    3⤵
    PID:1324
- - C:\Windows\SysWOW64\System.exe
    C:\Windows\system32\System.exe
    3⤵
    PID:1688
- - C:\Windows\SysWOW64\System.exe
    C:\Windows\system32\System.exe
    3⤵
    PID:824

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Windows\SysWOW64\System.exe

Filesize
47KB

MD5
b447a0869a20eff4560ef0ad23446ad0

SHA1
af64e24d35e97e572119e8a59210b0de097bcc40

SHA256
1718d8b476750bb27e79861a85e7fc97191feb02d6dd04a219f34123673e2739

SHA512
4be7d3a6bce00185a4426635dcf1b47efac4abdaefb169ba635d130d47bf439554af0d49a5068e4f45ed1b0608005933a30a01faf18ee7c948bad4f58a42e42b

Download Submit
memory/404-176-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/576-147-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/608-143-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/772-141-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/808-145-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/820-99-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/880-130-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/920-170-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/996-183-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/1048-162-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/1056-159-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/1068-165-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/1120-153-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/1292-133-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/1300-86-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/1364-154-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/1432-128-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/1516-185-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/1528-123-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/1568-105-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/1584-195-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/1604-160-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/1620-191-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/1632-163-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/1704-167-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/1708-15-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/1788-148-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/1820-152-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/1828-114-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/1952-72-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/1984-203-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2000-179-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2036-134-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2056-172-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2104-67-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2120-169-0x0000000001BF0000-0x0000000001C17000-memory.dmp

Filesize
156KB

Download
memory/2120-188-0x0000000001BF0000-0x0000000001C17000-memory.dmp

Filesize
156KB

Download
memory/2120-100-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2120-168-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2120-98-0x0000000001BF0000-0x0000000001C17000-memory.dmp

Filesize
156KB

Download
memory/2120-92-0x0000000001BF0000-0x0000000001C17000-memory.dmp

Filesize
156KB

Download
memory/2120-106-0x0000000001BF0000-0x0000000001C17000-memory.dmp

Filesize
156KB

Download
memory/2120-107-0x0000000001BF0000-0x0000000001C17000-memory.dmp

Filesize
156KB

Download
memory/2120-108-0x0000000001BF0000-0x0000000001C17000-memory.dmp

Filesize
156KB

Download
memory/2120-112-0x0000000001BF0000-0x0000000001C17000-memory.dmp

Filesize
156KB

Download
memory/2120-93-0x0000000001BF0000-0x0000000001C17000-memory.dmp

Filesize
156KB

Download
memory/2120-208-0x0000000001BF0000-0x0000000001C17000-memory.dmp

Filesize
156KB

Download
memory/2120-124-0x0000000001BF0000-0x0000000001C17000-memory.dmp

Filesize
156KB

Download
memory/2120-94-0x0000000001BF0000-0x0000000001C17000-memory.dmp

Filesize
156KB

Download
memory/2120-122-0x0000000001BF0000-0x0000000001C17000-memory.dmp

Filesize
156KB

Download
memory/2120-87-0x0000000001BF0000-0x0000000001C17000-memory.dmp

Filesize
156KB

Download
memory/2120-81-0x0000000001BF0000-0x0000000001C17000-memory.dmp

Filesize
156KB

Download
memory/2120-202-0x0000000001BF0000-0x0000000001C17000-memory.dmp

Filesize
156KB

Download
memory/2120-201-0x0000000001BF0000-0x0000000001C17000-memory.dmp

Filesize
156KB

Download
memory/2120-132-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2120-199-0x0000000001BF0000-0x0000000001C17000-memory.dmp

Filesize
156KB

Download
memory/2120-194-0x0000000001BF0000-0x0000000001C17000-memory.dmp

Filesize
156KB

Download
memory/2120-192-0x0000000001BF0000-0x0000000001C17000-memory.dmp

Filesize
156KB

Download
memory/2120-137-0x0000000001BF0000-0x0000000001C17000-memory.dmp

Filesize
156KB

Download
memory/2120-24-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2120-36-0x0000000001BF0000-0x0000000001C17000-memory.dmp

Filesize
156KB

Download
memory/2120-77-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2120-142-0x0000000001BF0000-0x0000000001C17000-memory.dmp

Filesize
156KB

Download
memory/2120-68-0x0000000001BF0000-0x0000000001C17000-memory.dmp

Filesize
156KB

Download
memory/2120-144-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2120-63-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2120-187-0x0000000001BF0000-0x0000000001C17000-memory.dmp

Filesize
156KB

Download
memory/2120-149-0x0000000001BF0000-0x0000000001C17000-memory.dmp

Filesize
156KB

Download
memory/2120-181-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2120-151-0x0000000001BF0000-0x0000000001C17000-memory.dmp

Filesize
156KB

Download
memory/2120-101-0x0000000001BF0000-0x0000000001C17000-memory.dmp

Filesize
156KB

Download
memory/2120-53-0x0000000001BF0000-0x0000000001C17000-memory.dmp

Filesize
156KB

Download
memory/2120-178-0x0000000001BF0000-0x0000000001C17000-memory.dmp

Filesize
156KB

Download
memory/2120-52-0x0000000001BF0000-0x0000000001C17000-memory.dmp

Filesize
156KB

Download
memory/2120-157-0x0000000001BF0000-0x0000000001C17000-memory.dmp

Filesize
156KB

Download
memory/2120-156-0x0000000001BF0000-0x0000000001C17000-memory.dmp

Filesize
156KB

Download
memory/2120-155-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2120-175-0x0000000001BF0000-0x0000000001C17000-memory.dmp

Filesize
156KB

Download
memory/2120-47-0x0000000001BF0000-0x0000000001C17000-memory.dmp

Filesize
156KB

Download
memory/2120-161-0x0000000001BF0000-0x0000000001C17000-memory.dmp

Filesize
156KB

Download
memory/2120-42-0x0000000001BF0000-0x0000000001C17000-memory.dmp

Filesize
156KB

Download
memory/2120-164-0x0000000001BF0000-0x0000000001C17000-memory.dmp

Filesize
156KB

Download
memory/2120-173-0x0000000001BF0000-0x0000000001C17000-memory.dmp

Filesize
156KB

Download
memory/2120-37-0x0000000001BF0000-0x0000000001C17000-memory.dmp

Filesize
156KB

Download
memory/2120-31-0x0000000001BF0000-0x0000000001C17000-memory.dmp

Filesize
156KB

Download
memory/2120-171-0x0000000001BF0000-0x0000000001C17000-memory.dmp

Filesize
156KB

Download
memory/2252-91-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2276-177-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2308-131-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2396-186-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2412-150-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2428-135-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2464-58-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2468-46-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2492-51-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2528-174-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2536-197-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2564-62-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2568-210-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2600-30-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2604-41-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2640-139-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2724-118-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2748-35-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2768-76-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2796-136-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2844-140-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2872-205-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2872-16-0x00000000003B0000-0x00000000003D7000-memory.dmp

Filesize
156KB

Download
memory/2872-0-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2872-23-0x00000000003B0000-0x00000000003D7000-memory.dmp

Filesize
156KB

Download
memory/2872-22-0x00000000003B0000-0x00000000003D7000-memory.dmp

Filesize
156KB

Download
memory/2872-6-0x00000000003B0000-0x00000000003D7000-memory.dmp

Filesize
156KB

Download
memory/2872-25-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2884-207-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2912-82-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2944-190-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2960-166-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/3048-180-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads