description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Aonfymhw = "C:\\Windows\\SysWOW64\\dplaysvrd.exe"	DB.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	DB.EXE

pid	Process
3044	AV.EXE
3024	AV2.EXE
2540	DB.EXE
2796	EN.EXE
2888	SB.EXE
2756	dplaysvrd.exe
2248	iA17766JgEfP17766.exe

pid	Process
1700	Ana.exe
1700	Ana.exe
1700	Ana.exe
1700	Ana.exe
1700	Ana.exe
1700	Ana.exe
1700	Ana.exe
1700	Ana.exe
1700	Ana.exe
2540	DB.EXE
2540	DB.EXE
3024	AV2.EXE
3024	AV2.EXE

resource	yara_rule
behavioral5/files/0x002d000000014ff4-18.dat	upx
behavioral5/memory/1700-20-0x00000000004F0000-0x0000000000535000-memory.dmp	upx
behavioral5/memory/2540-29-0x0000000000490000-0x0000000000523000-memory.dmp	upx
behavioral5/memory/2540-33-0x0000000000490000-0x0000000000523000-memory.dmp	upx
behavioral5/memory/2540-34-0x0000000000490000-0x0000000000523000-memory.dmp	upx
behavioral5/memory/2540-35-0x0000000000490000-0x0000000000523000-memory.dmp	upx
behavioral5/memory/2796-48-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral5/files/0x0006000000016d4a-44.dat	upx
behavioral5/memory/2540-93-0x0000000000400000-0x0000000000445000-memory.dmp	upx
behavioral5/memory/2540-94-0x0000000000490000-0x0000000000523000-memory.dmp	upx
behavioral5/memory/3024-98-0x0000000000400000-0x00000000004C3000-memory.dmp	upx
behavioral5/memory/2796-99-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral5/memory/3024-109-0x0000000000400000-0x00000000004C3000-memory.dmp	upx

description	ioc	Process
File created	C:\Windows\SysWOW64\dplaysvrd.exe	DB.EXE
File opened for modification	C:\Windows\SysWOW64\dplaysvrd.exe	DB.EXE

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\30530A0C86EDB1CD5A2A5FE37EF3BF28E69BE16D	AV.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\30530A0C86EDB1CD5A2A5FE37EF3BF28E69BE16D\Blob = 03000000010000001400000030530a0c86edb1cd5a2a5fe37ef3bf28e69be16d2000000001000000b3020000308202af308202180209009168978ee53f5964300d06092a864886f70d010105050030819b310b30090603550406130255533110300e06035504081307566972676e69613110300e060355040713074e65776275727931123010060355040a13094261636f72204c4c43312330210603550403131a746f74616c736f6c7574696f6e616e746976697275732e636f6d312f302d06092a864886f70d010901162061646d696e40746f74616c736f6c7574696f6e616e746976697275732e636f6d301e170d3131303931383131313834395a170d3132303931373131313834395a30819b310b30090603550406130255533110300e06035504081307566972676e69613110300e060355040713074e65776275727931123010060355040a13094261636f72204c4c43312330210603550403131a746f74616c736f6c7574696f6e616e746976697275732e636f6d312f302d06092a864886f70d010901162061646d696e40746f74616c736f6c7574696f6e616e746976697275732e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100cac8419346518527133fdefd7982ac3919f1d6e2f815ecab0b5d219ccf843885645cfd9c35cae2eff8e7506e690b52c587a59c8d667cb671454030bd370fa334b18afb5ea4f4f819a36685a705a8543f320af913ca680a1d32a402db6d3e42d93228e44ba230fda524d490ddc35b922f23d36d95417136ac50afa567e21359350203010001300d06092a864886f70d0101050500038181003c6a7f43ca2cee1caafee88b04777032a4c9d7794222537e3ebe57953198281bdbe0d3a58f7d3eb358f361848f30ad88a364cd0ae3376e6239dedb01497d52d3dd55e78e49375373419ad7e5e2e036f713bf4d96a552f2aa26b35b66d7a83fb2a9b6e317d162d8342f09ccc71b2a1c7d9474ca7872bfa4acd623d61c4491d740	AV.EXE

description	pid	Process
Token: SeDebugPrivilege	2540	DB.EXE
Token: SeShutdownPrivilege	2888	SB.EXE
Token: SeDebugPrivilege	3024	AV2.EXE

description	pid	Process	procid_target
PID 1700 wrote to memory of 3044	1700	Ana.exe	28
PID 1700 wrote to memory of 3044	1700	Ana.exe	28
PID 1700 wrote to memory of 3044	1700	Ana.exe	28
PID 1700 wrote to memory of 3044	1700	Ana.exe	28
PID 1700 wrote to memory of 3024	1700	Ana.exe	29
PID 1700 wrote to memory of 3024	1700	Ana.exe	29
PID 1700 wrote to memory of 3024	1700	Ana.exe	29
PID 1700 wrote to memory of 3024	1700	Ana.exe	29
PID 1700 wrote to memory of 2540	1700	Ana.exe	30
PID 1700 wrote to memory of 2540	1700	Ana.exe	30
PID 1700 wrote to memory of 2540	1700	Ana.exe	30
PID 1700 wrote to memory of 2540	1700	Ana.exe	30
PID 1700 wrote to memory of 2796	1700	Ana.exe	31
PID 1700 wrote to memory of 2796	1700	Ana.exe	31
PID 1700 wrote to memory of 2796	1700	Ana.exe	31
PID 1700 wrote to memory of 2796	1700	Ana.exe	31
PID 1700 wrote to memory of 2888	1700	Ana.exe	32
PID 1700 wrote to memory of 2888	1700	Ana.exe	32
PID 1700 wrote to memory of 2888	1700	Ana.exe	32
PID 1700 wrote to memory of 2888	1700	Ana.exe	32
PID 2540 wrote to memory of 2756	2540	DB.EXE	33
PID 2540 wrote to memory of 2756	2540	DB.EXE	33
PID 2540 wrote to memory of 2756	2540	DB.EXE	33
PID 2540 wrote to memory of 2756	2540	DB.EXE	33
PID 2540 wrote to memory of 2352	2540	DB.EXE	35
PID 2540 wrote to memory of 2352	2540	DB.EXE	35
PID 2540 wrote to memory of 2352	2540	DB.EXE	35
PID 2540 wrote to memory of 2352	2540	DB.EXE	35
PID 2756 wrote to memory of 1936	2756	dplaysvrd.exe	37
PID 2756 wrote to memory of 1936	2756	dplaysvrd.exe	37
PID 2756 wrote to memory of 1936	2756	dplaysvrd.exe	37
PID 2756 wrote to memory of 1936	2756	dplaysvrd.exe	37
PID 3024 wrote to memory of 2248	3024	AV2.EXE	41
PID 3024 wrote to memory of 2248	3024	AV2.EXE	41
PID 3024 wrote to memory of 2248	3024	AV2.EXE	41
PID 3024 wrote to memory of 2248	3024	AV2.EXE	41

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads