301a3f5017e578fb04b0eb33f45831bb9bb8318020e0a18d222ebea08bf1c75f

Resubmissions

23/03/2024, 23:50

240323-3vttmsed88 10

12/12/2020, 10:26

201212-wddwj75xse 10

Analysis

max time kernel
150s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
23/03/2024, 23:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

301a3f5017e578fb04b0eb33f45831bb9bb8318020e0a18d222ebea08bf1c75f.bin.exe
Size

413KB
MD5

3023d7526b479ea3df315a5b1779a43d
SHA1

b5ae71b96a28b9353a4f33c5370ac18750937c17
SHA256

301a3f5017e578fb04b0eb33f45831bb9bb8318020e0a18d222ebea08bf1c75f
SHA512

67fe1cf7538e8ef76b6acbba99326af0de58464bf5710ae6fa7b85d73da9a84c58122de6b87c7d9560f0d366de711a95d03be231c1018eacb7489fd32aeb0834
SSDEEP

6144:OpZsqlbu151gFomsCfv6hdgnkG6FSXrIiucY6/4sTj3GUcqcPVpNghCQ:Ussu15qlsmShRG6mIiucN42qxqcC

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\ProgramData\\bijms\\nahngot.exe,explorer.exe"	301a3f5017e578fb04b0eb33f45831bb9bb8318020e0a18d222ebea08bf1c75f.bin.exe

Modifies security service 2 TTPs 2 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\MpsSvc\Parameters\PortKeywords\DHCP	svchost.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Parameters\PortKeywords\DHCP\Collection	svchost.exe

Deletes itself 1 IoCs

pid	Process
2252	cmd.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\5sq6s = "C:\\ProgramData\\cbvp\\fwva.exe"	301a3f5017e578fb04b0eb33f45831bb9bb8318020e0a18d222ebea08bf1c75f.bin.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\appcompat\programs\RecentFileCache.bcf	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2532	svchost.exe
2596	svchost.exe
2596	svchost.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1420	taskmgr.exe

Suspicious behavior: MapViewOfSection 6 IoCs

pid	Process
2752	301a3f5017e578fb04b0eb33f45831bb9bb8318020e0a18d222ebea08bf1c75f.bin.exe
2752	301a3f5017e578fb04b0eb33f45831bb9bb8318020e0a18d222ebea08bf1c75f.bin.exe
2596	svchost.exe
2596	svchost.exe
2752	301a3f5017e578fb04b0eb33f45831bb9bb8318020e0a18d222ebea08bf1c75f.bin.exe
2752	301a3f5017e578fb04b0eb33f45831bb9bb8318020e0a18d222ebea08bf1c75f.bin.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2532	svchost.exe
Token: SeDebugPrivilege	1420	taskmgr.exe
Token: SeAssignPrimaryTokenPrivilege	864	svchost.exe
Token: SeIncreaseQuotaPrivilege	864	svchost.exe
Token: SeSecurityPrivilege	864	svchost.exe
Token: SeTakeOwnershipPrivilege	864	svchost.exe
Token: SeLoadDriverPrivilege	864	svchost.exe
Token: SeSystemtimePrivilege	864	svchost.exe
Token: SeBackupPrivilege	864	svchost.exe
Token: SeRestorePrivilege	864	svchost.exe
Token: SeShutdownPrivilege	864	svchost.exe
Token: SeSystemEnvironmentPrivilege	864	svchost.exe
Token: SeUndockPrivilege	864	svchost.exe
Token: SeManageVolumePrivilege	864	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	864	svchost.exe
Token: SeIncreaseQuotaPrivilege	864	svchost.exe
Token: SeSecurityPrivilege	864	svchost.exe
Token: SeTakeOwnershipPrivilege	864	svchost.exe
Token: SeLoadDriverPrivilege	864	svchost.exe
Token: SeSystemtimePrivilege	864	svchost.exe
Token: SeBackupPrivilege	864	svchost.exe
Token: SeRestorePrivilege	864	svchost.exe
Token: SeShutdownPrivilege	864	svchost.exe
Token: SeSystemEnvironmentPrivilege	864	svchost.exe
Token: SeUndockPrivilege	864	svchost.exe
Token: SeManageVolumePrivilege	864	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	864	svchost.exe
Token: SeIncreaseQuotaPrivilege	864	svchost.exe
Token: SeSecurityPrivilege	864	svchost.exe
Token: SeTakeOwnershipPrivilege	864	svchost.exe
Token: SeLoadDriverPrivilege	864	svchost.exe
Token: SeSystemtimePrivilege	864	svchost.exe
Token: SeBackupPrivilege	864	svchost.exe
Token: SeRestorePrivilege	864	svchost.exe
Token: SeShutdownPrivilege	864	svchost.exe
Token: SeSystemEnvironmentPrivilege	864	svchost.exe
Token: SeUndockPrivilege	864	svchost.exe
Token: SeManageVolumePrivilege	864	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	864	svchost.exe
Token: SeIncreaseQuotaPrivilege	864	svchost.exe
Token: SeSecurityPrivilege	864	svchost.exe
Token: SeTakeOwnershipPrivilege	864	svchost.exe
Token: SeLoadDriverPrivilege	864	svchost.exe
Token: SeSystemtimePrivilege	864	svchost.exe
Token: SeBackupPrivilege	864	svchost.exe
Token: SeRestorePrivilege	864	svchost.exe
Token: SeShutdownPrivilege	864	svchost.exe
Token: SeSystemEnvironmentPrivilege	864	svchost.exe
Token: SeUndockPrivilege	864	svchost.exe
Token: SeManageVolumePrivilege	864	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	864	svchost.exe
Token: SeIncreaseQuotaPrivilege	864	svchost.exe
Token: SeSecurityPrivilege	864	svchost.exe
Token: SeTakeOwnershipPrivilege	864	svchost.exe
Token: SeLoadDriverPrivilege	864	svchost.exe
Token: SeSystemtimePrivilege	864	svchost.exe
Token: SeBackupPrivilege	864	svchost.exe
Token: SeRestorePrivilege	864	svchost.exe
Token: SeShutdownPrivilege	864	svchost.exe
Token: SeSystemEnvironmentPrivilege	864	svchost.exe
Token: SeUndockPrivilege	864	svchost.exe
Token: SeManageVolumePrivilege	864	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	864	svchost.exe
Token: SeIncreaseQuotaPrivilege	864	svchost.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2596	svchost.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
2596	svchost.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe
1420	taskmgr.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
260	smss.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2752 wrote to memory of 2596	2752	301a3f5017e578fb04b0eb33f45831bb9bb8318020e0a18d222ebea08bf1c75f.bin.exe	28
PID 2752 wrote to memory of 2596	2752	301a3f5017e578fb04b0eb33f45831bb9bb8318020e0a18d222ebea08bf1c75f.bin.exe	28
PID 2752 wrote to memory of 2596	2752	301a3f5017e578fb04b0eb33f45831bb9bb8318020e0a18d222ebea08bf1c75f.bin.exe	28
PID 2752 wrote to memory of 2596	2752	301a3f5017e578fb04b0eb33f45831bb9bb8318020e0a18d222ebea08bf1c75f.bin.exe	28
PID 2596 wrote to memory of 2532	2596	svchost.exe	29
PID 2596 wrote to memory of 2532	2596	svchost.exe	29
PID 2596 wrote to memory of 2532	2596	svchost.exe	29
PID 2596 wrote to memory of 2532	2596	svchost.exe	29
PID 2532 wrote to memory of 260	2532	svchost.exe	1
PID 2532 wrote to memory of 336	2532	svchost.exe	2
PID 2752 wrote to memory of 1784	2752	301a3f5017e578fb04b0eb33f45831bb9bb8318020e0a18d222ebea08bf1c75f.bin.exe	30
PID 2752 wrote to memory of 1784	2752	301a3f5017e578fb04b0eb33f45831bb9bb8318020e0a18d222ebea08bf1c75f.bin.exe	30
PID 2752 wrote to memory of 1784	2752	301a3f5017e578fb04b0eb33f45831bb9bb8318020e0a18d222ebea08bf1c75f.bin.exe	30
PID 2752 wrote to memory of 1784	2752	301a3f5017e578fb04b0eb33f45831bb9bb8318020e0a18d222ebea08bf1c75f.bin.exe	30
PID 2752 wrote to memory of 2252	2752	301a3f5017e578fb04b0eb33f45831bb9bb8318020e0a18d222ebea08bf1c75f.bin.exe	31
PID 2752 wrote to memory of 2252	2752	301a3f5017e578fb04b0eb33f45831bb9bb8318020e0a18d222ebea08bf1c75f.bin.exe	31
PID 2752 wrote to memory of 2252	2752	301a3f5017e578fb04b0eb33f45831bb9bb8318020e0a18d222ebea08bf1c75f.bin.exe	31
PID 2752 wrote to memory of 2252	2752	301a3f5017e578fb04b0eb33f45831bb9bb8318020e0a18d222ebea08bf1c75f.bin.exe	31
PID 2532 wrote to memory of 364	2532	svchost.exe	3
PID 2532 wrote to memory of 388	2532	svchost.exe	4
PID 2532 wrote to memory of 432	2532	svchost.exe	5
PID 2532 wrote to memory of 468	2532	svchost.exe	6
PID 388 wrote to memory of 700	388	csrss.exe	32
PID 388 wrote to memory of 700	388	csrss.exe	32
PID 388 wrote to memory of 700	388	csrss.exe	32
PID 2532 wrote to memory of 484	2532	svchost.exe	7
PID 388 wrote to memory of 1928	388	csrss.exe	33
PID 388 wrote to memory of 1928	388	csrss.exe	33
PID 388 wrote to memory of 1928	388	csrss.exe	33
PID 388 wrote to memory of 1928	388	csrss.exe	33
PID 2252 wrote to memory of 1928	2252	cmd.exe	33
PID 2252 wrote to memory of 1928	2252	cmd.exe	33
PID 2252 wrote to memory of 1928	2252	cmd.exe	33
PID 2252 wrote to memory of 1928	2252	cmd.exe	33
PID 2532 wrote to memory of 492	2532	svchost.exe	8
PID 2532 wrote to memory of 604	2532	svchost.exe	9
PID 2532 wrote to memory of 680	2532	svchost.exe	10
PID 2532 wrote to memory of 764	2532	svchost.exe	11
PID 2532 wrote to memory of 824	2532	svchost.exe	12
PID 2532 wrote to memory of 864	2532	svchost.exe	13
PID 2532 wrote to memory of 1012	2532	svchost.exe	15
PID 2532 wrote to memory of 340	2532	svchost.exe	16
PID 2532 wrote to memory of 1040	2532	svchost.exe	17
PID 2532 wrote to memory of 1092	2532	svchost.exe	18
PID 2532 wrote to memory of 1124	2532	svchost.exe	19
PID 2532 wrote to memory of 1188	2532	svchost.exe	20
PID 2532 wrote to memory of 2148	2532	svchost.exe	24
PID 2532 wrote to memory of 2892	2532	svchost.exe	25
PID 388 wrote to memory of 1420	388	csrss.exe	34
PID 388 wrote to memory of 1420	388	csrss.exe	34
PID 388 wrote to memory of 1420	388	csrss.exe	34
PID 388 wrote to memory of 1420	388	csrss.exe	34
PID 388 wrote to memory of 1420	388	csrss.exe	34
PID 336 wrote to memory of 2796	336	csrss.exe	35
PID 336 wrote to memory of 2796	336	csrss.exe	35
PID 864 wrote to memory of 2796	864	svchost.exe	35
PID 864 wrote to memory of 2796	864	svchost.exe	35
PID 864 wrote to memory of 2796	864	svchost.exe	35
PID 336 wrote to memory of 888	336	csrss.exe	36
PID 336 wrote to memory of 888	336	csrss.exe	36
PID 604 wrote to memory of 888	604	svchost.exe	36
PID 604 wrote to memory of 888	604	svchost.exe	36
PID 604 wrote to memory of 888	604	svchost.exe	36
PID 2532 wrote to memory of 1420	2532	svchost.exe	34

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
1928	attrib.exe

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe
1⤵
- Suspicious use of UnmapMainImage
PID:260

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
- Suspicious use of WriteProcessMemory
PID:336

C:\Windows\system32\wininit.exe
wininit.exe
1⤵
PID:364
- C:\Windows\system32\services.exe
  C:\Windows\system32\services.exe
  2⤵
  PID:468
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k DcomLaunch
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:604
  - - C:\Windows\system32\wbem\wmiprvse.exe
      C:\Windows\system32\wbem\wmiprvse.exe -Embedding
      4⤵
      PID:888
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k RPCSS
    3⤵
    PID:680
- - C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
    3⤵
    - Modifies security service
    PID:764
- - C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
    3⤵
    PID:824
  - - C:\Windows\system32\Dwm.exe
      "C:\Windows\system32\Dwm.exe"
      4⤵
      PID:1188
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k netsvcs
    3⤵
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:864
  - - C:\Windows\system32\wbem\WMIADAP.EXE
      wmiadap.exe /F /T /R
      4⤵
      PID:2796
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalService
    3⤵
    PID:1012
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k NetworkService
    3⤵
    PID:340
- - C:\Windows\System32\spoolsv.exe
    C:\Windows\System32\spoolsv.exe
    3⤵
    PID:1040
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
    3⤵
    PID:1092
- - C:\Windows\system32\taskhost.exe
    "taskhost.exe"
    3⤵
    PID:1124
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
    3⤵
    PID:2148
- - C:\Windows\system32\sppsvc.exe
    C:\Windows\system32\sppsvc.exe
    3⤵
    PID:2892
- C:\Windows\system32\lsass.exe
  C:\Windows\system32\lsass.exe
  2⤵
  PID:484
- C:\Windows\system32\lsm.exe
  C:\Windows\system32\lsm.exe
  2⤵
  PID:492

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
- Suspicious use of WriteProcessMemory
PID:388
- C:\Windows\system32\conhost.exe
  \??\C:\Windows\system32\conhost.exe "-9969084541825130179-1056484498-946034262056648482-11613342356049442023202509"
  2⤵
  PID:700

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:432

C:\Users\Admin\AppData\Local\Temp\301a3f5017e578fb04b0eb33f45831bb9bb8318020e0a18d222ebea08bf1c75f.bin.exe
"C:\Users\Admin\AppData\Local\Temp\301a3f5017e578fb04b0eb33f45831bb9bb8318020e0a18d222ebea08bf1c75f.bin.exe"
1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2752
- C:\Windows\syswow64\svchost.exe
  C:\Windows\syswow64\svchost.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2596
- - C:\Windows\syswow64\svchost.exe
    C:\Windows\syswow64\svchost.exe
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2532
- C:\Windows\syswow64\svchost.exe
  C:\Windows\syswow64\svchost.exe
  2⤵
  PID:1784
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\Xjl5h8mE4As5vJ.bat" 301a3f5017e578fb04b0eb33f45831bb9bb8318020e0a18d222ebea08bf1c75f.bin.exe"
  2⤵
  - Deletes itself
  - Suspicious use of WriteProcessMemory
  PID:2252
- - C:\Windows\SysWOW64\attrib.exe
    attrib -r -s -h 301a3f5017e578fb04b0eb33f45831bb9bb8318020e0a18d222ebea08bf1c75f.bin.exe
    3⤵
    - Views/modifies file attributes
    PID:1928

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1420

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\bijms\nahngot.exe

Filesize
413KB

MD5
3023d7526b479ea3df315a5b1779a43d

SHA1
b5ae71b96a28b9353a4f33c5370ac18750937c17

SHA256
301a3f5017e578fb04b0eb33f45831bb9bb8318020e0a18d222ebea08bf1c75f

SHA512
67fe1cf7538e8ef76b6acbba99326af0de58464bf5710ae6fa7b85d73da9a84c58122de6b87c7d9560f0d366de711a95d03be231c1018eacb7489fd32aeb0834

Download Submit
C:\ProgramData\cxg\wscpt.flx

Filesize
417KB

MD5
e00524afdf6afa0445769d0a963cd80d

SHA1
b093fa0ccde2a7c65d6723fd0d1e0eae17fcdf51

SHA256
182b4438405bd550085c48d4bd5c09f4b884113c92278bc48b6d47bb1d7c1c1f

SHA512
d6af78a7776d681fe83f37968d57e063ac9f17d4b8d8115e35b1d532cdedd33707a6092c39b7e5a8d68e9d361597c8a0c224c2ab7139ed5958e4ff1446a14ec9

Download Submit
C:\ProgramData\llirjg\iwurns.uyn

Filesize
9KB

MD5
50248170d0f755c5a311b61a59181ad9

SHA1
93486b1a90b7c802ccdccc88c27abac5076c5ef2

SHA256
acba531431c5043991a7335011169ccd0025632f78e3925216fdf68edb4a8dca

SHA512
cd3d5a511ccdc2e9e95cacb6c7dce02e71afe6eb6ccd32da29f00894da945f51b3eb5c1acdae9b7b1007bc13754dc6fb71f343d8a0c9a8bfca8ba7db773f4d85

Download Submit
C:\Users\Admin\AppData\Local\Temp\Xjl5h8mE4As5vJ.bat

Filesize
74B

MD5
f488b5df4ab36b2fa1c78c041f5a433c

SHA1
fe8b77ce17a48de7d7e6f7bfe7b8411701ebb12f

SHA256
ce0e7dceca9e877c8ad232acef340c246f6f553e841dbcff18a9b458cd0fae1c

SHA512
3df780bf8f3c2b547606f2dfc5552ab5140fdb089681f5945d2aec23d3eeb13d1546ea100881d6c830110c79c60f113788b1fbc7fd674a3578f9e2f76ea54ea7

Download Submit
C:\Users\Admin\AppData\Local\Temp\dxxwfol.tzg

Filesize
249B

MD5
68e031d1729db228c9a448f15cb30583

SHA1
7d5b0c77ea1f3b059bfd425f97dc7d780ab7c9d9

SHA256
9800cc7f1278e69bceb1ca127bb12d5e45fc9ed104ec0d0eeaf958811bee94e9

SHA512
1b77cfed131744b1d7c5f52135806a201ca6c9f2669c0aaa3582dff1094716b6b8e63355a86aa4506fe2b72ca22e0d43df327a72f49bad12d5a46eb0325fa780

Download Submit
memory/260-55-0x0000000000110000-0x0000000000160000-memory.dmp

Filesize
320KB

Download
memory/260-64-0x0000000000110000-0x0000000000160000-memory.dmp

Filesize
320KB

Download
memory/260-60-0x0000000000110000-0x0000000000160000-memory.dmp

Filesize
320KB

Download
memory/336-121-0x0000000000200000-0x0000000000201000-memory.dmp

Filesize
4KB

Download
memory/336-66-0x0000000000A70000-0x0000000000AC0000-memory.dmp

Filesize
320KB

Download
memory/336-67-0x0000000000A70000-0x0000000000AC0000-memory.dmp

Filesize
320KB

Download
memory/340-176-0x00000000009B0000-0x0000000000A00000-memory.dmp

Filesize
320KB

Download
memory/364-91-0x00000000007A0000-0x00000000007F0000-memory.dmp

Filesize
320KB

Download
memory/388-110-0x0000000000AC0000-0x0000000000AD0000-memory.dmp

Filesize
64KB

Download
memory/388-99-0x0000000001FC0000-0x0000000002010000-memory.dmp

Filesize
320KB

Download
memory/432-106-0x0000000000830000-0x0000000000880000-memory.dmp

Filesize
320KB

Download
memory/468-111-0x0000000000C90000-0x0000000000CE0000-memory.dmp

Filesize
320KB

Download
memory/484-118-0x0000000000230000-0x0000000000280000-memory.dmp

Filesize
320KB

Download
memory/492-123-0x0000000000860000-0x00000000008B0000-memory.dmp

Filesize
320KB

Download
memory/604-128-0x00000000003B0000-0x0000000000400000-memory.dmp

Filesize
320KB

Download
memory/680-131-0x00000000003E0000-0x0000000000430000-memory.dmp

Filesize
320KB

Download
memory/764-133-0x0000000000880000-0x00000000008D0000-memory.dmp

Filesize
320KB

Download
memory/824-139-0x0000000000890000-0x00000000008E0000-memory.dmp

Filesize
320KB

Download
memory/864-142-0x0000000000E90000-0x0000000000EE0000-memory.dmp

Filesize
320KB

Download
memory/1012-152-0x0000000000110000-0x0000000000160000-memory.dmp

Filesize
320KB

Download
memory/1040-179-0x0000000001C00000-0x0000000001C50000-memory.dmp

Filesize
320KB

Download
memory/1092-166-0x0000000000200000-0x0000000000201000-memory.dmp

Filesize
4KB

Download
memory/1092-182-0x0000000000990000-0x00000000009E0000-memory.dmp

Filesize
320KB

Download
memory/1124-171-0x0000000000360000-0x0000000000362000-memory.dmp

Filesize
8KB

Download
memory/1124-183-0x0000000001C80000-0x0000000001CD0000-memory.dmp

Filesize
320KB

Download
memory/1188-186-0x0000000000380000-0x00000000003D0000-memory.dmp

Filesize
320KB

Download
memory/1784-88-0x0000000000080000-0x00000000000BF000-memory.dmp

Filesize
252KB

Download
memory/1784-100-0x0000000000220000-0x000000000022F000-memory.dmp

Filesize
60KB

Download
memory/1784-92-0x0000000000080000-0x00000000000BF000-memory.dmp

Filesize
252KB

Download
memory/1784-125-0x0000000000260000-0x0000000000270000-memory.dmp

Filesize
64KB

Download
memory/1784-71-0x0000000000080000-0x00000000000BF000-memory.dmp

Filesize
252KB

Download
memory/2148-187-0x00000000003E0000-0x00000000003E2000-memory.dmp

Filesize
8KB

Download
memory/2148-188-0x0000000000190000-0x00000000001E0000-memory.dmp

Filesize
320KB

Download
memory/2532-185-0x0000000001C80000-0x0000000001CD0000-memory.dmp

Filesize
320KB

Download
memory/2532-146-0x0000000000080000-0x00000000000BF000-memory.dmp

Filesize
252KB

Download
memory/2532-58-0x00000000001E0000-0x00000000001E2000-memory.dmp

Filesize
8KB

Download
memory/2532-62-0x0000000000200000-0x0000000000201000-memory.dmp

Filesize
4KB

Download
memory/2532-162-0x0000000000110000-0x0000000000160000-memory.dmp

Filesize
320KB

Download
memory/2532-61-0x0000000000210000-0x0000000000211000-memory.dmp

Filesize
4KB

Download
memory/2532-56-0x00000000001D0000-0x00000000001DF000-memory.dmp

Filesize
60KB

Download
memory/2532-54-0x0000000000180000-0x00000000001BF000-memory.dmp

Filesize
252KB

Download
memory/2532-154-0x00000000001E0000-0x00000000001E2000-memory.dmp

Filesize
8KB

Download
memory/2532-169-0x0000000000200000-0x0000000000201000-memory.dmp

Filesize
4KB

Download
memory/2532-148-0x0000000000E90000-0x0000000000EE0000-memory.dmp

Filesize
320KB

Download
memory/2532-144-0x0000000000080000-0x00000000000BF000-memory.dmp

Filesize
252KB

Download
memory/2532-175-0x0000000000360000-0x0000000000362000-memory.dmp

Filesize
8KB

Download
memory/2532-48-0x0000000000080000-0x00000000000BF000-memory.dmp

Filesize
252KB

Download
memory/2532-47-0x0000000000080000-0x00000000000BF000-memory.dmp

Filesize
252KB

Download
memory/2532-46-0x0000000000080000-0x00000000000BF000-memory.dmp

Filesize
252KB

Download
memory/2532-40-0x0000000000890000-0x0000000000898000-memory.dmp

Filesize
32KB

Download
memory/2532-44-0x0000000000890000-0x0000000000898000-memory.dmp

Filesize
32KB

Download
memory/2596-35-0x00000000001A0000-0x00000000001A1000-memory.dmp

Filesize
4KB

Download
memory/2596-29-0x0000000000890000-0x0000000000898000-memory.dmp

Filesize
32KB

Download
memory/2596-36-0x0000000000190000-0x0000000000191000-memory.dmp

Filesize
4KB

Download
memory/2596-41-0x0000000000290000-0x0000000000291000-memory.dmp

Filesize
4KB

Download
memory/2596-43-0x0000000000290000-0x0000000000291000-memory.dmp

Filesize
4KB

Download
memory/2596-45-0x0000000000290000-0x0000000000291000-memory.dmp

Filesize
4KB

Download
memory/2596-112-0x00000000000C0000-0x00000000000FF000-memory.dmp

Filesize
252KB

Download
memory/2596-37-0x0000000000290000-0x0000000000298000-memory.dmp

Filesize
32KB

Download
memory/2596-34-0x0000000000030000-0x0000000000031000-memory.dmp

Filesize
4KB

Download
memory/2596-33-0x00000000000C0000-0x00000000000FF000-memory.dmp

Filesize
252KB

Download
memory/2596-102-0x0000000000290000-0x00000000002A0000-memory.dmp

Filesize
64KB

Download
memory/2596-95-0x0000000000260000-0x0000000000270000-memory.dmp

Filesize
64KB

Download
memory/2596-32-0x00000000000C0000-0x00000000000FF000-memory.dmp

Filesize
252KB

Download
memory/2596-31-0x00000000000C0000-0x00000000000FF000-memory.dmp

Filesize
252KB

Download
memory/2596-30-0x0000000000890000-0x0000000000898000-memory.dmp

Filesize
32KB

Download
memory/2596-135-0x0000000000290000-0x0000000000298000-memory.dmp

Filesize
32KB

Download
memory/2596-98-0x0000000000270000-0x000000000027E000-memory.dmp

Filesize
56KB

Download
memory/2596-140-0x00000000001B0000-0x00000000001B1000-memory.dmp

Filesize
4KB

Download
memory/2596-89-0x0000000000260000-0x0000000000270000-memory.dmp

Filesize
64KB

Download
memory/2752-8-0x0000000000170000-0x0000000000171000-memory.dmp

Filesize
4KB

Download
memory/2752-39-0x00000000000F0000-0x0000000000130000-memory.dmp

Filesize
256KB

Download
memory/2752-0-0x00000000000F0000-0x0000000000130000-memory.dmp

Filesize
256KB

Download
memory/2752-7-0x00000000000F0000-0x0000000000130000-memory.dmp

Filesize
256KB

Download
memory/2752-9-0x0000000000170000-0x0000000000171000-memory.dmp

Filesize
4KB

Download
memory/2752-10-0x0000000000170000-0x0000000000171000-memory.dmp

Filesize
4KB

Download
memory/2752-59-0x0000000000180000-0x0000000000181000-memory.dmp

Filesize
4KB

Download
memory/2752-12-0x0000000000170000-0x0000000000171000-memory.dmp

Filesize
4KB

Download
memory/2752-52-0x0000000000170000-0x0000000000171000-memory.dmp

Filesize
4KB

Download
memory/2752-97-0x00000000000F0000-0x0000000000130000-memory.dmp

Filesize
256KB

Download
memory/2752-5-0x00000000000F0000-0x0000000000130000-memory.dmp

Filesize
256KB

Download
memory/2752-49-0x0000000000170000-0x0000000000171000-memory.dmp

Filesize
4KB

Download
memory/2752-51-0x0000000000170000-0x0000000000171000-memory.dmp

Filesize
4KB

Download
memory/2752-50-0x0000000000170000-0x0000000000171000-memory.dmp

Filesize
4KB

Download
memory/2752-21-0x0000000000180000-0x0000000000181000-memory.dmp

Filesize
4KB

Download
memory/2752-17-0x0000000000170000-0x0000000000171000-memory.dmp

Filesize
4KB

Download
memory/2752-16-0x0000000000150000-0x0000000000151000-memory.dmp

Filesize
4KB

Download
memory/2752-24-0x0000000000140000-0x0000000000141000-memory.dmp

Filesize
4KB

Download
memory/2752-1-0x0000000000650000-0x00000000006A8000-memory.dmp

Filesize
352KB

Download