blackmoon | 58df7b839d34916ebae21d29e997af3a6cd00de0c939402202467a247bfed6fd

Analysis

max time kernel
150s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
05-04-2024 14:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d6cded3c9fc8ca880b8bfbfbbf78e96e_JaffaCakes118.exe
Size

375KB
MD5

d6cded3c9fc8ca880b8bfbfbbf78e96e
SHA1

0764cf56ae697694152f6eec6e6b5d7876eeeb87
SHA256

58df7b839d34916ebae21d29e997af3a6cd00de0c939402202467a247bfed6fd
SHA512

217b7d5cf48e0b14f271d774000ca13fd06ce62511a9fc9095e526636f6675669b9345c18a710a61a4e5266cc21ad3e8c1e0ca5a2827c1a041f5676efc7f6a5c
SSDEEP

6144:tczH+8QD8sg+ZvFXaczH+8QD8sg+ZvFX:CaHFZvFbaHFZvF

Score

10^/10

blackmoon banker trojan upx

Malware Config

Signatures

Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
trojan banker blackmoon

Detect Blackmoon payload 13 IoCs

resource	yara_rule
behavioral2/memory/1428-4-0x0000000000400000-0x0000000000478000-memory.dmp	family_blackmoon
behavioral2/memory/352-9-0x0000000000400000-0x0000000000478000-memory.dmp	family_blackmoon
behavioral2/memory/3048-10-0x0000000000400000-0x0000000000478000-memory.dmp	family_blackmoon
behavioral2/memory/3048-18-0x0000000000400000-0x0000000000478000-memory.dmp	family_blackmoon
behavioral2/memory/4624-22-0x0000000000400000-0x0000000000478000-memory.dmp	family_blackmoon
behavioral2/memory/4564-26-0x0000000000400000-0x0000000000478000-memory.dmp	family_blackmoon
behavioral2/memory/4816-27-0x0000000000400000-0x0000000000478000-memory.dmp	family_blackmoon
behavioral2/memory/4816-36-0x0000000000400000-0x0000000000478000-memory.dmp	family_blackmoon
behavioral2/memory/1004-40-0x0000000000400000-0x0000000000478000-memory.dmp	family_blackmoon
behavioral2/memory/1988-43-0x0000000000400000-0x0000000000478000-memory.dmp	family_blackmoon
behavioral2/memory/2640-45-0x0000000000400000-0x0000000000478000-memory.dmp	family_blackmoon
behavioral2/memory/1988-46-0x0000000000400000-0x0000000000478000-memory.dmp	family_blackmoon
behavioral2/memory/2640-47-0x0000000000400000-0x0000000000478000-memory.dmp	family_blackmoon

Executes dropped EXE 8 IoCs

pid	Process
352	xywhg.exe
3048	xywhg.exe
4624	oyarce.exe
4564	xywhg.exe
4816	xywhg.exe
1004	oyarce.exe
1988	xywhg.exe
2640	xywhg.exe

UPX packed file 15 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1428-0-0x0000000000400000-0x0000000000478000-memory.dmp	upx
behavioral2/memory/1428-4-0x0000000000400000-0x0000000000478000-memory.dmp	upx
behavioral2/files/0x0007000000023204-5.dat	upx
behavioral2/memory/352-9-0x0000000000400000-0x0000000000478000-memory.dmp	upx
behavioral2/memory/3048-10-0x0000000000400000-0x0000000000478000-memory.dmp	upx
behavioral2/memory/3048-18-0x0000000000400000-0x0000000000478000-memory.dmp	upx
behavioral2/memory/4624-22-0x0000000000400000-0x0000000000478000-memory.dmp	upx
behavioral2/memory/4564-26-0x0000000000400000-0x0000000000478000-memory.dmp	upx
behavioral2/memory/4816-27-0x0000000000400000-0x0000000000478000-memory.dmp	upx
behavioral2/memory/4816-36-0x0000000000400000-0x0000000000478000-memory.dmp	upx
behavioral2/memory/1004-40-0x0000000000400000-0x0000000000478000-memory.dmp	upx
behavioral2/memory/1988-43-0x0000000000400000-0x0000000000478000-memory.dmp	upx
behavioral2/memory/2640-45-0x0000000000400000-0x0000000000478000-memory.dmp	upx
behavioral2/memory/1988-46-0x0000000000400000-0x0000000000478000-memory.dmp	upx
behavioral2/memory/2640-47-0x0000000000400000-0x0000000000478000-memory.dmp	upx

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	xywhg.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	xywhg.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	xywhg.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	xywhg.exe

Drops file in Windows directory 14 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\fonts\fswxoj\xywhg.exe	oyarce.exe
File opened for modification	\??\c:\windows\ime\huwyxe\oyarce.exe	xywhg.exe
File opened for modification	\??\c:\windows\ime\huwyxe\oyarce.exe	xywhg.exe
File created	\??\c:\windows\fonts\fswxoj\BestPower.pow	xywhg.exe
File created	\??\c:\windows\fonts\fswxoj\BestPower.pow	xywhg.exe
File created	\??\c:\windows\fonts\fswxoj\BestPower.pow	xywhg.exe
File created	\??\c:\windows\fonts\fswxoj\HighPower.pow	xywhg.exe
File opened for modification	\??\c:\windows\fonts\fswxoj\xywhg.exe	oyarce.exe
File created	\??\c:\windows\fonts\fswxoj\HighPower.pow	xywhg.exe
File opened for modification	\??\c:\windows\fonts\fswxoj\xywhg.exe	d6cded3c9fc8ca880b8bfbfbbf78e96e_JaffaCakes118.exe
File created	\??\c:\windows\ime\huwyxe\oyarce.exe	xywhg.exe
File opened for modification	\??\c:\windows\ime\huwyxe\oyarce.exe	xywhg.exe
File created	\??\c:\windows\fonts\fswxoj\HighPower.pow	xywhg.exe
File created	\??\c:\windows\fonts\fswxoj\xywhg.exe	d6cded3c9fc8ca880b8bfbfbbf78e96e_JaffaCakes118.exe

Program crash 3 IoCs

pid	pid_target	Process	procid_target
4836	3048	WerFault.exe	93
4736	4816	WerFault.exe	142
520	2640	WerFault.exe	178

Creates scheduled task(s) 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
3200	schtasks.exe
928	schtasks.exe
5024	schtasks.exe

Modifies data under HKEY_USERS 24 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	xywhg.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	xywhg.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	xywhg.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	xywhg.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	xywhg.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	xywhg.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	xywhg.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	xywhg.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	xywhg.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	xywhg.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	xywhg.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	xywhg.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	xywhg.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	xywhg.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	xywhg.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	xywhg.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	xywhg.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	xywhg.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	xywhg.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	xywhg.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	xywhg.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	xywhg.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	xywhg.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	xywhg.exe

Runs ping.exe 1 TTPs 3 IoCs

Remote System Discovery

T1018

pid	Process
1424	PING.EXE
3300	PING.EXE
1600	PING.EXE

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
1428	d6cded3c9fc8ca880b8bfbfbbf78e96e_JaffaCakes118.exe
1428	d6cded3c9fc8ca880b8bfbfbbf78e96e_JaffaCakes118.exe
352	xywhg.exe
352	xywhg.exe
3048	xywhg.exe
3048	xywhg.exe
4624	oyarce.exe
4624	oyarce.exe
4624	oyarce.exe
4624	oyarce.exe
4624	oyarce.exe
4624	oyarce.exe
4564	xywhg.exe
4564	xywhg.exe
4816	xywhg.exe
4816	xywhg.exe
1004	oyarce.exe
1004	oyarce.exe
1004	oyarce.exe
1004	oyarce.exe
1004	oyarce.exe
1004	oyarce.exe
1988	xywhg.exe
1988	xywhg.exe
2640	xywhg.exe
2640	xywhg.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1428	d6cded3c9fc8ca880b8bfbfbbf78e96e_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1428	d6cded3c9fc8ca880b8bfbfbbf78e96e_JaffaCakes118.exe
Token: SeDebugPrivilege	352	xywhg.exe
Token: SeDebugPrivilege	3048	xywhg.exe
Token: SeAssignPrimaryTokenPrivilege	2356	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2356	WMIC.exe
Token: SeSecurityPrivilege	2356	WMIC.exe
Token: SeTakeOwnershipPrivilege	2356	WMIC.exe
Token: SeLoadDriverPrivilege	2356	WMIC.exe
Token: SeSystemtimePrivilege	2356	WMIC.exe
Token: SeBackupPrivilege	2356	WMIC.exe
Token: SeRestorePrivilege	2356	WMIC.exe
Token: SeShutdownPrivilege	2356	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2356	WMIC.exe
Token: SeUndockPrivilege	2356	WMIC.exe
Token: SeManageVolumePrivilege	2356	WMIC.exe
Token: SeAssignPrimaryTokenPrivilege	2356	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2356	WMIC.exe
Token: SeSecurityPrivilege	2356	WMIC.exe
Token: SeTakeOwnershipPrivilege	2356	WMIC.exe
Token: SeLoadDriverPrivilege	2356	WMIC.exe
Token: SeSystemtimePrivilege	2356	WMIC.exe
Token: SeBackupPrivilege	2356	WMIC.exe
Token: SeRestorePrivilege	2356	WMIC.exe
Token: SeShutdownPrivilege	2356	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2356	WMIC.exe
Token: SeUndockPrivilege	2356	WMIC.exe
Token: SeManageVolumePrivilege	2356	WMIC.exe
Token: SeAssignPrimaryTokenPrivilege	5088	WMIC.exe
Token: SeIncreaseQuotaPrivilege	5088	WMIC.exe
Token: SeSecurityPrivilege	5088	WMIC.exe
Token: SeTakeOwnershipPrivilege	5088	WMIC.exe
Token: SeLoadDriverPrivilege	5088	WMIC.exe
Token: SeSystemtimePrivilege	5088	WMIC.exe
Token: SeBackupPrivilege	5088	WMIC.exe
Token: SeRestorePrivilege	5088	WMIC.exe
Token: SeShutdownPrivilege	5088	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5088	WMIC.exe
Token: SeUndockPrivilege	5088	WMIC.exe
Token: SeManageVolumePrivilege	5088	WMIC.exe
Token: SeAssignPrimaryTokenPrivilege	5088	WMIC.exe
Token: SeIncreaseQuotaPrivilege	5088	WMIC.exe
Token: SeSecurityPrivilege	5088	WMIC.exe
Token: SeTakeOwnershipPrivilege	5088	WMIC.exe
Token: SeLoadDriverPrivilege	5088	WMIC.exe
Token: SeSystemtimePrivilege	5088	WMIC.exe
Token: SeBackupPrivilege	5088	WMIC.exe
Token: SeRestorePrivilege	5088	WMIC.exe
Token: SeShutdownPrivilege	5088	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5088	WMIC.exe
Token: SeUndockPrivilege	5088	WMIC.exe
Token: SeManageVolumePrivilege	5088	WMIC.exe
Token: SeAssignPrimaryTokenPrivilege	1008	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1008	WMIC.exe
Token: SeSecurityPrivilege	1008	WMIC.exe
Token: SeTakeOwnershipPrivilege	1008	WMIC.exe
Token: SeLoadDriverPrivilege	1008	WMIC.exe
Token: SeSystemtimePrivilege	1008	WMIC.exe
Token: SeBackupPrivilege	1008	WMIC.exe
Token: SeRestorePrivilege	1008	WMIC.exe
Token: SeShutdownPrivilege	1008	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1008	WMIC.exe
Token: SeUndockPrivilege	1008	WMIC.exe
Token: SeManageVolumePrivilege	1008	WMIC.exe
Token: SeAssignPrimaryTokenPrivilege	1008	WMIC.exe

Suspicious use of SetWindowsHookEx 9 IoCs

pid	Process
1428	d6cded3c9fc8ca880b8bfbfbbf78e96e_JaffaCakes118.exe
352	xywhg.exe
3048	xywhg.exe
4624	oyarce.exe
4564	xywhg.exe
4816	xywhg.exe
1004	oyarce.exe
1988	xywhg.exe
2640	xywhg.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1428 wrote to memory of 788	1428	d6cded3c9fc8ca880b8bfbfbbf78e96e_JaffaCakes118.exe	87
PID 1428 wrote to memory of 788	1428	d6cded3c9fc8ca880b8bfbfbbf78e96e_JaffaCakes118.exe	87
PID 1428 wrote to memory of 788	1428	d6cded3c9fc8ca880b8bfbfbbf78e96e_JaffaCakes118.exe	87
PID 788 wrote to memory of 1424	788	cmd.exe	89
PID 788 wrote to memory of 1424	788	cmd.exe	89
PID 788 wrote to memory of 1424	788	cmd.exe	89
PID 788 wrote to memory of 352	788	cmd.exe	92
PID 788 wrote to memory of 352	788	cmd.exe	92
PID 788 wrote to memory of 352	788	cmd.exe	92
PID 3048 wrote to memory of 3520	3048	xywhg.exe	101
PID 3048 wrote to memory of 3520	3048	xywhg.exe	101
PID 3048 wrote to memory of 3520	3048	xywhg.exe	101
PID 3520 wrote to memory of 2356	3520	cmd.exe	103
PID 3520 wrote to memory of 2356	3520	cmd.exe	103
PID 3520 wrote to memory of 2356	3520	cmd.exe	103
PID 3520 wrote to memory of 5088	3520	cmd.exe	104
PID 3520 wrote to memory of 5088	3520	cmd.exe	104
PID 3520 wrote to memory of 5088	3520	cmd.exe	104
PID 3520 wrote to memory of 1008	3520	cmd.exe	105
PID 3520 wrote to memory of 1008	3520	cmd.exe	105
PID 3520 wrote to memory of 1008	3520	cmd.exe	105
PID 3048 wrote to memory of 4024	3048	xywhg.exe	106
PID 3048 wrote to memory of 4024	3048	xywhg.exe	106
PID 3048 wrote to memory of 4024	3048	xywhg.exe	106
PID 3048 wrote to memory of 2496	3048	xywhg.exe	107
PID 3048 wrote to memory of 2496	3048	xywhg.exe	107
PID 3048 wrote to memory of 2496	3048	xywhg.exe	107
PID 4024 wrote to memory of 4588	4024	cmd.exe	110
PID 4024 wrote to memory of 4588	4024	cmd.exe	110
PID 4024 wrote to memory of 4588	4024	cmd.exe	110
PID 2496 wrote to memory of 4216	2496	cmd.exe	111
PID 2496 wrote to memory of 4216	2496	cmd.exe	111
PID 2496 wrote to memory of 4216	2496	cmd.exe	111
PID 3048 wrote to memory of 4940	3048	xywhg.exe	112
PID 3048 wrote to memory of 4940	3048	xywhg.exe	112
PID 3048 wrote to memory of 4940	3048	xywhg.exe	112
PID 3048 wrote to memory of 1060	3048	xywhg.exe	113
PID 3048 wrote to memory of 1060	3048	xywhg.exe	113
PID 3048 wrote to memory of 1060	3048	xywhg.exe	113
PID 4024 wrote to memory of 1700	4024	cmd.exe	116
PID 4024 wrote to memory of 1700	4024	cmd.exe	116
PID 4024 wrote to memory of 1700	4024	cmd.exe	116
PID 4940 wrote to memory of 816	4940	cmd.exe	117
PID 4940 wrote to memory of 816	4940	cmd.exe	117
PID 4940 wrote to memory of 816	4940	cmd.exe	117
PID 1060 wrote to memory of 3080	1060	cmd.exe	118
PID 1060 wrote to memory of 3080	1060	cmd.exe	118
PID 1060 wrote to memory of 3080	1060	cmd.exe	118
PID 4940 wrote to memory of 3200	4940	cmd.exe	119
PID 4940 wrote to memory of 3200	4940	cmd.exe	119
PID 4940 wrote to memory of 3200	4940	cmd.exe	119
PID 3080 wrote to memory of 3280	3080	cmd.exe	120
PID 3080 wrote to memory of 3280	3080	cmd.exe	120
PID 3080 wrote to memory of 3280	3080	cmd.exe	120
PID 3048 wrote to memory of 1920	3048	xywhg.exe	121
PID 3048 wrote to memory of 1920	3048	xywhg.exe	121
PID 3048 wrote to memory of 1920	3048	xywhg.exe	121
PID 4024 wrote to memory of 520	4024	cmd.exe	123
PID 4024 wrote to memory of 520	4024	cmd.exe	123
PID 4024 wrote to memory of 520	4024	cmd.exe	123
PID 1920 wrote to memory of 4320	1920	cmd.exe	124
PID 1920 wrote to memory of 4320	1920	cmd.exe	124
PID 1920 wrote to memory of 4320	1920	cmd.exe	124
PID 4320 wrote to memory of 2404	4320	cmd.exe	125

C:\Users\Admin\AppData\Local\Temp\d6cded3c9fc8ca880b8bfbfbbf78e96e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\d6cded3c9fc8ca880b8bfbfbbf78e96e_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1428
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ping 127.0.0.1 -n 5 & Start c:\windows\fonts\fswxoj\xywhg.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:788
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 5
    3⤵
    - Runs ping.exe
    PID:1424
- - \??\c:\windows\fonts\fswxoj\xywhg.exe
    c:\windows\fonts\fswxoj\xywhg.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:352

\??\c:\windows\fonts\fswxoj\xywhg.exe
c:\windows\fonts\fswxoj\xywhg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3048
- C:\Windows\SysWOW64\cmd.exe
  cmd /c wmic /NAMESPACE:"\\root\subscription" PATH __EventFilter WHERE Name="efxbg" DELETE & wmic /NAMESPACE:"\\root\subscription" PATH CommandLineEventConsumer WHERE Name="sdqn" DELETE & wmic /NAMESPACE:"\\root\subscription" PATH __FilterToConsumerBinding WHERE Filter="__EventFilter.Name='efxbg'" DELETE
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3520
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic /NAMESPACE:"\\root\subscription" PATH __EventFilter WHERE Name="efxbg" DELETE
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2356
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic /NAMESPACE:"\\root\subscription" PATH CommandLineEventConsumer WHERE Name="sdqn" DELETE
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5088
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic /NAMESPACE:"\\root\subscription" PATH __FilterToConsumerBinding WHERE Filter="__EventFilter.Name='efxbg'" DELETE
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1008
- C:\Windows\SysWOW64\cmd.exe
  cmd /c wmic /NAMESPACE:"\\root\subscription" PATH __EventFilter CREATE Name="efxbg", EventNameSpace="root\cimv2",QueryLanguage="WQL", Query="SELECT * FROM __InstanceModificationEvent WITHIN 30 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'" & wmic /NAMESPACE:"\\root\subscription" PATH CommandLineEventConsumer CREATE Name="sdqn",CommandLineTemplate="c:\windows\ime\huwyxe\oyarce.exe" & wmic /NAMESPACE:"\\root\subscription" PATH __FilterToConsumerBinding CREATE Filter="__EventFilter.Name="efxbg"", Consumer="CommandLineEventConsumer.Name="sdqn""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4024
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic /NAMESPACE:"\\root\subscription" PATH __EventFilter CREATE Name="efxbg", EventNameSpace="root\cimv2",QueryLanguage="WQL", Query="SELECT * FROM __InstanceModificationEvent WITHIN 30 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'"
    3⤵
    PID:4588
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic /NAMESPACE:"\\root\subscription" PATH CommandLineEventConsumer CREATE Name="sdqn",CommandLineTemplate="c:\windows\ime\huwyxe\oyarce.exe"
    3⤵
    PID:1700
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic /NAMESPACE:"\\root\subscription" PATH __FilterToConsumerBinding CREATE Filter="__EventFilter.Name="efxbg"", Consumer="CommandLineEventConsumer.Name="sdqn""
    3⤵
    PID:520
- C:\Windows\SysWOW64\cmd.exe
  cmd /c Schtasks /DELETE /TN xcqvh /F
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2496
- - C:\Windows\SysWOW64\schtasks.exe
    Schtasks /DELETE /TN xcqvh /F
    3⤵
    PID:4216
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Y|schtasks /create /sc minute /mo 30 /tn "xcqvh" /ru system /tr "c:\windows\ime\huwyxe\oyarce.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4940
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    PID:816
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 30 /tn "xcqvh" /ru system /tr "c:\windows\ime\huwyxe\oyarce.exe"
    3⤵
    - Creates scheduled task(s)
    PID:3200
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c cmd /c powercfg -import c:\windows\fonts\fswxoj\BestPower.pow
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1060
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c powercfg -import c:\windows\fonts\fswxoj\BestPower.pow
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3080
  - - C:\Windows\SysWOW64\powercfg.exe
      powercfg -import c:\windows\fonts\fswxoj\BestPower.pow
      4⤵
      PID:3280
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c cmd /c powercfg -setactive 9d381d62-d713-42c8-993c-ac5450e6f195
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1920
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c powercfg -setactive 9d381d62-d713-42c8-993c-ac5450e6f195
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4320
  - - C:\Windows\SysWOW64\powercfg.exe
      powercfg -setactive 9d381d62-d713-42c8-993c-ac5450e6f195
      4⤵
      PID:2404
- C:\Windows\SysWOW64\cmd.exe
  cmd /c powercfg -h off
  2⤵
  PID:4444
- - C:\Windows\SysWOW64\powercfg.exe
    powercfg -h off
    3⤵
    PID:1932
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3048 -s 1336
  2⤵
  - Program crash
  PID:4836

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3048 -ip 3048
1⤵
PID:4484

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:1908

\??\c:\windows\ime\huwyxe\oyarce.exe
c:\windows\ime\huwyxe\oyarce.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4624
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ping 127.0.0.1 -n 5 & Start c:\windows\fonts\fswxoj\xywhg.exe
  2⤵
  PID:1168
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 5
    3⤵
    - Runs ping.exe
    PID:3300
- - \??\c:\windows\fonts\fswxoj\xywhg.exe
    c:\windows\fonts\fswxoj\xywhg.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:4564

\??\c:\windows\fonts\fswxoj\xywhg.exe
c:\windows\fonts\fswxoj\xywhg.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4816
- C:\Windows\SysWOW64\cmd.exe
  cmd /c wmic /NAMESPACE:"\\root\subscription" PATH __EventFilter WHERE Name="efxbg" DELETE & wmic /NAMESPACE:"\\root\subscription" PATH CommandLineEventConsumer WHERE Name="sdqn" DELETE & wmic /NAMESPACE:"\\root\subscription" PATH __FilterToConsumerBinding WHERE Filter="__EventFilter.Name='efxbg'" DELETE
  2⤵
  PID:3128
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic /NAMESPACE:"\\root\subscription" PATH __EventFilter WHERE Name="efxbg" DELETE
    3⤵
    PID:1532
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic /NAMESPACE:"\\root\subscription" PATH CommandLineEventConsumer WHERE Name="sdqn" DELETE
    3⤵
    PID:3280
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic /NAMESPACE:"\\root\subscription" PATH __FilterToConsumerBinding WHERE Filter="__EventFilter.Name='efxbg'" DELETE
    3⤵
    PID:2936
- C:\Windows\SysWOW64\cmd.exe
  cmd /c wmic /NAMESPACE:"\\root\subscription" PATH __EventFilter CREATE Name="efxbg", EventNameSpace="root\cimv2",QueryLanguage="WQL", Query="SELECT * FROM __InstanceModificationEvent WITHIN 30 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'" & wmic /NAMESPACE:"\\root\subscription" PATH CommandLineEventConsumer CREATE Name="sdqn",CommandLineTemplate="c:\windows\ime\huwyxe\oyarce.exe" & wmic /NAMESPACE:"\\root\subscription" PATH __FilterToConsumerBinding CREATE Filter="__EventFilter.Name="efxbg"", Consumer="CommandLineEventConsumer.Name="sdqn""
  2⤵
  PID:4328
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic /NAMESPACE:"\\root\subscription" PATH __EventFilter CREATE Name="efxbg", EventNameSpace="root\cimv2",QueryLanguage="WQL", Query="SELECT * FROM __InstanceModificationEvent WITHIN 30 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'"
    3⤵
    PID:4444
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic /NAMESPACE:"\\root\subscription" PATH CommandLineEventConsumer CREATE Name="sdqn",CommandLineTemplate="c:\windows\ime\huwyxe\oyarce.exe"
    3⤵
    PID:1912
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic /NAMESPACE:"\\root\subscription" PATH __FilterToConsumerBinding CREATE Filter="__EventFilter.Name="efxbg"", Consumer="CommandLineEventConsumer.Name="sdqn""
    3⤵
    PID:2200
- C:\Windows\SysWOW64\cmd.exe
  cmd /c Schtasks /DELETE /TN xcqvh /F
  2⤵
  PID:4396
- - C:\Windows\SysWOW64\schtasks.exe
    Schtasks /DELETE /TN xcqvh /F
    3⤵
    PID:3924
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Y|schtasks /create /sc minute /mo 30 /tn "xcqvh" /ru system /tr "c:\windows\ime\huwyxe\oyarce.exe"
  2⤵
  PID:4544
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    PID:5112
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 30 /tn "xcqvh" /ru system /tr "c:\windows\ime\huwyxe\oyarce.exe"
    3⤵
    - Creates scheduled task(s)
    PID:928
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c cmd /c powercfg -import c:\windows\fonts\fswxoj\BestPower.pow
  2⤵
  PID:3444
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c powercfg -import c:\windows\fonts\fswxoj\BestPower.pow
    3⤵
    PID:4844
  - - C:\Windows\SysWOW64\powercfg.exe
      powercfg -import c:\windows\fonts\fswxoj\BestPower.pow
      4⤵
      PID:2176
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c cmd /c powercfg -setactive a98d5248-2e01-40c4-9181-7ceed82f092c
  2⤵
  PID:3012
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c powercfg -setactive a98d5248-2e01-40c4-9181-7ceed82f092c
    3⤵
    PID:3220
  - - C:\Windows\SysWOW64\powercfg.exe
      powercfg -setactive a98d5248-2e01-40c4-9181-7ceed82f092c
      4⤵
      PID:3552
- C:\Windows\SysWOW64\cmd.exe
  cmd /c powercfg -h off
  2⤵
  PID:1156
- - C:\Windows\SysWOW64\powercfg.exe
    powercfg -h off
    3⤵
    PID:4268
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4816 -s 1380
  2⤵
  - Program crash
  PID:4736

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 4816 -ip 4816
1⤵
PID:4428

\??\c:\windows\ime\huwyxe\oyarce.exe
c:\windows\ime\huwyxe\oyarce.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1004
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ping 127.0.0.1 -n 5 & Start c:\windows\fonts\fswxoj\xywhg.exe
  2⤵
  PID:2148
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 5
    3⤵
    - Runs ping.exe
    PID:1600
- - \??\c:\windows\fonts\fswxoj\xywhg.exe
    c:\windows\fonts\fswxoj\xywhg.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:1988

\??\c:\windows\fonts\fswxoj\xywhg.exe
c:\windows\fonts\fswxoj\xywhg.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2640
- C:\Windows\SysWOW64\cmd.exe
  cmd /c wmic /NAMESPACE:"\\root\subscription" PATH __EventFilter WHERE Name="efxbg" DELETE & wmic /NAMESPACE:"\\root\subscription" PATH CommandLineEventConsumer WHERE Name="sdqn" DELETE & wmic /NAMESPACE:"\\root\subscription" PATH __FilterToConsumerBinding WHERE Filter="__EventFilter.Name='efxbg'" DELETE
  2⤵
  PID:1316
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic /NAMESPACE:"\\root\subscription" PATH __EventFilter WHERE Name="efxbg" DELETE
    3⤵
    PID:4340
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic /NAMESPACE:"\\root\subscription" PATH CommandLineEventConsumer WHERE Name="sdqn" DELETE
    3⤵
    PID:3204
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic /NAMESPACE:"\\root\subscription" PATH __FilterToConsumerBinding WHERE Filter="__EventFilter.Name='efxbg'" DELETE
    3⤵
    PID:1528
- C:\Windows\SysWOW64\cmd.exe
  cmd /c wmic /NAMESPACE:"\\root\subscription" PATH __EventFilter CREATE Name="efxbg", EventNameSpace="root\cimv2",QueryLanguage="WQL", Query="SELECT * FROM __InstanceModificationEvent WITHIN 30 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'" & wmic /NAMESPACE:"\\root\subscription" PATH CommandLineEventConsumer CREATE Name="sdqn",CommandLineTemplate="c:\windows\ime\huwyxe\oyarce.exe" & wmic /NAMESPACE:"\\root\subscription" PATH __FilterToConsumerBinding CREATE Filter="__EventFilter.Name="efxbg"", Consumer="CommandLineEventConsumer.Name="sdqn""
  2⤵
  PID:1532
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic /NAMESPACE:"\\root\subscription" PATH __EventFilter CREATE Name="efxbg", EventNameSpace="root\cimv2",QueryLanguage="WQL", Query="SELECT * FROM __InstanceModificationEvent WITHIN 30 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'"
    3⤵
    PID:4820
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic /NAMESPACE:"\\root\subscription" PATH CommandLineEventConsumer CREATE Name="sdqn",CommandLineTemplate="c:\windows\ime\huwyxe\oyarce.exe"
    3⤵
    PID:3048
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic /NAMESPACE:"\\root\subscription" PATH __FilterToConsumerBinding CREATE Filter="__EventFilter.Name="efxbg"", Consumer="CommandLineEventConsumer.Name="sdqn""
    3⤵
    PID:1076
- C:\Windows\SysWOW64\cmd.exe
  cmd /c Schtasks /DELETE /TN xcqvh /F
  2⤵
  PID:1860
- - C:\Windows\SysWOW64\schtasks.exe
    Schtasks /DELETE /TN xcqvh /F
    3⤵
    PID:5000
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Y|schtasks /create /sc minute /mo 30 /tn "xcqvh" /ru system /tr "c:\windows\ime\huwyxe\oyarce.exe"
  2⤵
  PID:948
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    PID:776
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 30 /tn "xcqvh" /ru system /tr "c:\windows\ime\huwyxe\oyarce.exe"
    3⤵
    - Creates scheduled task(s)
    PID:5024
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c cmd /c powercfg -import c:\windows\fonts\fswxoj\BestPower.pow
  2⤵
  PID:4416
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c powercfg -import c:\windows\fonts\fswxoj\BestPower.pow
    3⤵
    PID:4884
  - - C:\Windows\SysWOW64\powercfg.exe
      powercfg -import c:\windows\fonts\fswxoj\BestPower.pow
      4⤵
      PID:3888
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c cmd /c powercfg -setactive 2fff61cd-f309-4ca7-b576-1231d3dba4ed
  2⤵
  PID:4964
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c powercfg -setactive 2fff61cd-f309-4ca7-b576-1231d3dba4ed
    3⤵
    PID:2176
  - - C:\Windows\SysWOW64\powercfg.exe
      powercfg -setactive 2fff61cd-f309-4ca7-b576-1231d3dba4ed
      4⤵
      PID:4132
- C:\Windows\SysWOW64\cmd.exe
  cmd /c powercfg -h off
  2⤵
  PID:4256
- - C:\Windows\SysWOW64\powercfg.exe
    powercfg -h off
    3⤵
    PID:1656
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2640 -s 1084
  2⤵
  - Program crash
  PID:520

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 2640 -ip 2640
1⤵
PID:1920

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Fonts\fswxoj\xywhg.exe

Filesize
437KB

MD5
c484d003c450ff3ec9fe7140514748c8

SHA1
2beb80894f643bb4369cbbf40fac50c8a4fffd1c

SHA256
52c7324c3bf746d59d4e72f26152959cf708c12262a64d41cc8c92c3a5fedcc1

SHA512
0126e8a666c340d0d636fa9a0c5f73165c98a667f5202bc9432217f786e36ac5e09096f6e538653e1918e638f357c34f1061171439abb9367bdf6004ce007458

Download Submit
memory/352-9-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/1004-40-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/1428-4-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/1428-0-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/1988-46-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/1988-43-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/2640-45-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/2640-47-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/3048-10-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/3048-18-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/4564-26-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/4624-22-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/4816-36-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/4816-27-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download