zgrat | 8ea33dfd0e80f75db31401ac0a7402ec254c1f6be6445b3cc87433973b6f3fc2

Analysis

max time kernel
128s
max time network
127s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
28/04/2024, 14:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c4ce7109b1726ddb0f45b77316d3fc19.exe
Size 3.0MB
Sample240428-saffeaac55
SHA256 8ea33dfd0e80f75db31401ac0a7402ec254c1f6be6445b3cc87433973b6f3fc2
MD5 c4ce7109b1726ddb0f45b77316d3fc19
SHA1 e9929dee90cfd12cfe49bf6146101e8c310b5db2
SHA512 3db22066c1c1bd3cb25249c0d738811637ade9c3de38070a269ab31b936a52347006919c3039747f9269e4caf7593349a8c9820151f6b7bf054ec415ee3e76c9
SSDEEP 49152:sTzNVCOWR7F0wDpFsCR5+ybqFDCCsM6uKOu5aAhOYCzvLZVyWwxXuRi4oaopn:SZ67F02FyyWccuFPavL7XCYihn
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

zgrat rat

Malware Config

Signatures

Detect ZGRat V1 34 IoCs

resource	yara_rule
behavioral1/memory/2176-3-0x000000001B740000-0x000000001B9D2000-memory.dmp	family_zgrat_v1
behavioral1/memory/2176-9-0x000000001B740000-0x000000001B9CB000-memory.dmp	family_zgrat_v1
behavioral1/memory/2176-15-0x000000001B740000-0x000000001B9CB000-memory.dmp	family_zgrat_v1
behavioral1/memory/2176-4-0x000000001B740000-0x000000001B9CB000-memory.dmp	family_zgrat_v1
behavioral1/memory/2176-21-0x000000001B740000-0x000000001B9CB000-memory.dmp	family_zgrat_v1
behavioral1/memory/2176-5-0x000000001B740000-0x000000001B9CB000-memory.dmp	family_zgrat_v1
behavioral1/memory/2176-49-0x000000001B740000-0x000000001B9CB000-memory.dmp	family_zgrat_v1
behavioral1/memory/2176-55-0x000000001B740000-0x000000001B9CB000-memory.dmp	family_zgrat_v1
behavioral1/memory/2176-7-0x000000001B740000-0x000000001B9CB000-memory.dmp	family_zgrat_v1
behavioral1/memory/2176-61-0x000000001B740000-0x000000001B9CB000-memory.dmp	family_zgrat_v1
behavioral1/memory/2176-13-0x000000001B740000-0x000000001B9CB000-memory.dmp	family_zgrat_v1
behavioral1/memory/2176-17-0x000000001B740000-0x000000001B9CB000-memory.dmp	family_zgrat_v1
behavioral1/memory/2176-11-0x000000001B740000-0x000000001B9CB000-memory.dmp	family_zgrat_v1
behavioral1/memory/2176-19-0x000000001B740000-0x000000001B9CB000-memory.dmp	family_zgrat_v1
behavioral1/memory/2176-25-0x000000001B740000-0x000000001B9CB000-memory.dmp	family_zgrat_v1
behavioral1/memory/2176-31-0x000000001B740000-0x000000001B9CB000-memory.dmp	family_zgrat_v1
behavioral1/memory/2176-35-0x000000001B740000-0x000000001B9CB000-memory.dmp	family_zgrat_v1
behavioral1/memory/2176-39-0x000000001B740000-0x000000001B9CB000-memory.dmp	family_zgrat_v1
behavioral1/memory/2176-37-0x000000001B740000-0x000000001B9CB000-memory.dmp	family_zgrat_v1
behavioral1/memory/2176-33-0x000000001B740000-0x000000001B9CB000-memory.dmp	family_zgrat_v1
behavioral1/memory/2176-29-0x000000001B740000-0x000000001B9CB000-memory.dmp	family_zgrat_v1
behavioral1/memory/2176-27-0x000000001B740000-0x000000001B9CB000-memory.dmp	family_zgrat_v1
behavioral1/memory/2176-23-0x000000001B740000-0x000000001B9CB000-memory.dmp	family_zgrat_v1
behavioral1/memory/2176-41-0x000000001B740000-0x000000001B9CB000-memory.dmp	family_zgrat_v1
behavioral1/memory/2176-43-0x000000001B740000-0x000000001B9CB000-memory.dmp	family_zgrat_v1
behavioral1/memory/2176-45-0x000000001B740000-0x000000001B9CB000-memory.dmp	family_zgrat_v1
behavioral1/memory/2176-65-0x000000001B740000-0x000000001B9CB000-memory.dmp	family_zgrat_v1
behavioral1/memory/2176-63-0x000000001B740000-0x000000001B9CB000-memory.dmp	family_zgrat_v1
behavioral1/memory/2176-59-0x000000001B740000-0x000000001B9CB000-memory.dmp	family_zgrat_v1
behavioral1/memory/2176-57-0x000000001B740000-0x000000001B9CB000-memory.dmp	family_zgrat_v1
behavioral1/memory/2176-53-0x000000001B740000-0x000000001B9CB000-memory.dmp	family_zgrat_v1
behavioral1/memory/2176-51-0x000000001B740000-0x000000001B9CB000-memory.dmp	family_zgrat_v1
behavioral1/memory/2176-47-0x000000001B740000-0x000000001B9CB000-memory.dmp	family_zgrat_v1
behavioral1/memory/2176-67-0x000000001B740000-0x000000001B9CB000-memory.dmp	family_zgrat_v1

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\csrss.vbs	c4ce7109b1726ddb0f45b77316d3fc19.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2176 set thread context of 1048	2176	c4ce7109b1726ddb0f45b77316d3fc19.exe	39

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d06c00497c99da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000956a857f77d9fdf2752c753e215ba0b941d8a58b0e69f6c41042439668715afb000000000e80000000020000200000001e02458c364632750112a752d00a2ea10326d08867f7c71a4a1a8f817d3ab02b90000000d90058c61479ea5f4d02d352fc9006560937454e4d9255e7e56f13ea84babfe73160c7e55c22c5a02e641f26a1b28c33802c8a4316bf40f97c0675d81597504f75bd1aa579d983b15f9da79b36f9e7c5f3d6b6b6dc6c4aea19ac77235139a2a4e75ae5e4a45513ec9f851e4a756a7821b93f08b4789bbe538572f7ada8668e77c7e17a3f83e2f479a73e7531ea4a2cbf40000000ae7c94b7c94da3928f4b302bc018379cc4bdd063c7891a836373d38f5e114d3bce00613a8f3e04020a80a4b6fc53edab91bf692d80948fab7b48c3f82fbe5ba1	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d1000000000200000000001066000000010000200000002425538859e9139e543d2b35e068158d02750e0a608406ed31cd382931b63b2f000000000e80000000020000200000008fba0bef60519d4321da3a0822412aaf1dbe35110b72012f4a1a5447e2d5a75120000000a6feab29969bdf962a71a69cac3af2de9f73ef35957bc4aa6f199c4d3445984b400000009a1c62f6989ed2ae7b1c8e425d9be87e485b4721516888352f49bb20ce7e5ef5b6628ae24224a11bd3e687730c172b2941975f73419712d196c7497adc9011e5	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{62F61591-056F-11EF-97A3-C6E8F1D2B27D} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420478033"	iexplore.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
2176	c4ce7109b1726ddb0f45b77316d3fc19.exe
2176	c4ce7109b1726ddb0f45b77316d3fc19.exe
2176	c4ce7109b1726ddb0f45b77316d3fc19.exe
2176	c4ce7109b1726ddb0f45b77316d3fc19.exe
2176	c4ce7109b1726ddb0f45b77316d3fc19.exe
2176	c4ce7109b1726ddb0f45b77316d3fc19.exe
2176	c4ce7109b1726ddb0f45b77316d3fc19.exe
2176	c4ce7109b1726ddb0f45b77316d3fc19.exe
2176	c4ce7109b1726ddb0f45b77316d3fc19.exe
2176	c4ce7109b1726ddb0f45b77316d3fc19.exe
2176	c4ce7109b1726ddb0f45b77316d3fc19.exe
2176	c4ce7109b1726ddb0f45b77316d3fc19.exe
2176	c4ce7109b1726ddb0f45b77316d3fc19.exe
2176	c4ce7109b1726ddb0f45b77316d3fc19.exe
2584	powershell.exe
2104	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2176	c4ce7109b1726ddb0f45b77316d3fc19.exe
Token: SeDebugPrivilege	2176	c4ce7109b1726ddb0f45b77316d3fc19.exe
Token: SeDebugPrivilege	2584	powershell.exe
Token: SeDebugPrivilege	2104	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
608	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
608	iexplore.exe
608	iexplore.exe
936	IEXPLORE.EXE
936	IEXPLORE.EXE
936	IEXPLORE.EXE
936	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 2176 wrote to memory of 2584	2176	c4ce7109b1726ddb0f45b77316d3fc19.exe	28
PID 2176 wrote to memory of 2584	2176	c4ce7109b1726ddb0f45b77316d3fc19.exe	28
PID 2176 wrote to memory of 2584	2176	c4ce7109b1726ddb0f45b77316d3fc19.exe	28
PID 2176 wrote to memory of 2104	2176	c4ce7109b1726ddb0f45b77316d3fc19.exe	30
PID 2176 wrote to memory of 2104	2176	c4ce7109b1726ddb0f45b77316d3fc19.exe	30
PID 2176 wrote to memory of 2104	2176	c4ce7109b1726ddb0f45b77316d3fc19.exe	30
PID 2176 wrote to memory of 2240	2176	c4ce7109b1726ddb0f45b77316d3fc19.exe	32
PID 2176 wrote to memory of 2240	2176	c4ce7109b1726ddb0f45b77316d3fc19.exe	32
PID 2176 wrote to memory of 2240	2176	c4ce7109b1726ddb0f45b77316d3fc19.exe	32
PID 2176 wrote to memory of 1308	2176	c4ce7109b1726ddb0f45b77316d3fc19.exe	33
PID 2176 wrote to memory of 1308	2176	c4ce7109b1726ddb0f45b77316d3fc19.exe	33
PID 2176 wrote to memory of 1308	2176	c4ce7109b1726ddb0f45b77316d3fc19.exe	33
PID 2176 wrote to memory of 1916	2176	c4ce7109b1726ddb0f45b77316d3fc19.exe	34
PID 2176 wrote to memory of 1916	2176	c4ce7109b1726ddb0f45b77316d3fc19.exe	34
PID 2176 wrote to memory of 1916	2176	c4ce7109b1726ddb0f45b77316d3fc19.exe	34
PID 2176 wrote to memory of 2216	2176	c4ce7109b1726ddb0f45b77316d3fc19.exe	35
PID 2176 wrote to memory of 2216	2176	c4ce7109b1726ddb0f45b77316d3fc19.exe	35
PID 2176 wrote to memory of 2216	2176	c4ce7109b1726ddb0f45b77316d3fc19.exe	35
PID 2176 wrote to memory of 1920	2176	c4ce7109b1726ddb0f45b77316d3fc19.exe	36
PID 2176 wrote to memory of 1920	2176	c4ce7109b1726ddb0f45b77316d3fc19.exe	36
PID 2176 wrote to memory of 1920	2176	c4ce7109b1726ddb0f45b77316d3fc19.exe	36
PID 2176 wrote to memory of 1804	2176	c4ce7109b1726ddb0f45b77316d3fc19.exe	37
PID 2176 wrote to memory of 1804	2176	c4ce7109b1726ddb0f45b77316d3fc19.exe	37
PID 2176 wrote to memory of 1804	2176	c4ce7109b1726ddb0f45b77316d3fc19.exe	37
PID 2176 wrote to memory of 2236	2176	c4ce7109b1726ddb0f45b77316d3fc19.exe	38
PID 2176 wrote to memory of 2236	2176	c4ce7109b1726ddb0f45b77316d3fc19.exe	38
PID 2176 wrote to memory of 2236	2176	c4ce7109b1726ddb0f45b77316d3fc19.exe	38
PID 2176 wrote to memory of 1048	2176	c4ce7109b1726ddb0f45b77316d3fc19.exe	39
PID 2176 wrote to memory of 1048	2176	c4ce7109b1726ddb0f45b77316d3fc19.exe	39
PID 2176 wrote to memory of 1048	2176	c4ce7109b1726ddb0f45b77316d3fc19.exe	39
PID 2176 wrote to memory of 1048	2176	c4ce7109b1726ddb0f45b77316d3fc19.exe	39
PID 2176 wrote to memory of 1048	2176	c4ce7109b1726ddb0f45b77316d3fc19.exe	39
PID 2176 wrote to memory of 1048	2176	c4ce7109b1726ddb0f45b77316d3fc19.exe	39
PID 2176 wrote to memory of 1048	2176	c4ce7109b1726ddb0f45b77316d3fc19.exe	39
PID 2176 wrote to memory of 1048	2176	c4ce7109b1726ddb0f45b77316d3fc19.exe	39
PID 2104 wrote to memory of 608	2104	powershell.exe	40
PID 2104 wrote to memory of 608	2104	powershell.exe	40
PID 2104 wrote to memory of 608	2104	powershell.exe	40
PID 608 wrote to memory of 936	608	iexplore.exe	42
PID 608 wrote to memory of 936	608	iexplore.exe	42
PID 608 wrote to memory of 936	608	iexplore.exe	42
PID 608 wrote to memory of 936	608	iexplore.exe	42

C:\Users\Admin\AppData\Local\Temp\c4ce7109b1726ddb0f45b77316d3fc19.exe
"C:\Users\Admin\AppData\Local\Temp\c4ce7109b1726ddb0f45b77316d3fc19.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2176
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAYwA0AGMAZQA3ADEAMAA5AGIAMQA3ADIANgBkAGQAYgAwAGYANAA1AGIANwA3ADMAMQA2AGQAMwBmAGMAMQA5AC4AZQB4AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAcgBvAGMAZQBzAHMAIABjADQAYwBlADcAMQAwADkAYgAxADcAMgA2AGQAZABiADAAZgA0ADUAYgA3ADcAMwAxADYAZAAzAGYAYwAxADkALgBlAHgAZQA7AEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIABDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABkAG8AYwB1AG0AZQBuAHQAcwBcAGMAcwByAHMAcwAuAGUAeABlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAHIAbwBjAGUAcwBzACAAYwBzAHIAcwBzAC4AZQB4AGUA
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2584
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Start-Process "https://www.google.com"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2104
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" https://www.google.com/
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:608
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:608 CREDAT:275457 /prefetch:2
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:936
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe"
  2⤵
  PID:2240
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe"
  2⤵
  PID:1308
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe"
  2⤵
  PID:1916
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe"
  2⤵
  PID:2216
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe"
  2⤵
  PID:1920
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe"
  2⤵
  PID:1804
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe"
  2⤵
  PID:2236
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe"
  2⤵
  PID:1048

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

590aee7bdd69b59b.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Size 7KB
SHA256 1f9e1eb03e06c444093a05dd9db7b22262eeeb8efeeea55767b6179c380294e7
MD5 f777fc2e2ccc377510ddc3802d941ea3
SHA1 448ed42a4d71ae295d61bec21228a46000d8afde
SHA512 f87296f565a7856bd06918834789c64fb797f45cd193716d966caa26d049c1eac723b13a916d9f4c5e31f510dc9b0e078ce7b13433e05f5524baf1eb28bf52ab
SSDEEP 96:QFKCBM8YnqvsqvJCwo2FKCBM8YnqvsEHyqvJCwornlYAQHgo7WeXlUVV:UD8UoWD8AHnorndRo7WeW
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2176-27-0x000000001B740000-0x000000001B9CB000-memory.dmp

Download

memory/2176-7-0x000000001B740000-0x000000001B9CB000-memory.dmp

Download

memory/2176-3-0x000000001B740000-0x000000001B9D2000-memory.dmp

Download

memory/2176-9-0x000000001B740000-0x000000001B9CB000-memory.dmp

Download

memory/2176-15-0x000000001B740000-0x000000001B9CB000-memory.dmp

Download

memory/2176-4-0x000000001B740000-0x000000001B9CB000-memory.dmp

Download

memory/2176-21-0x000000001B740000-0x000000001B9CB000-memory.dmp

Download

memory/2176-5-0x000000001B740000-0x000000001B9CB000-memory.dmp

Download

memory/2176-49-0x000000001B740000-0x000000001B9CB000-memory.dmp

Download

memory/2176-23-0x000000001B740000-0x000000001B9CB000-memory.dmp

Download

memory/2176-0-0x00000000010A0000-0x000000000139E000-memory.dmp

Download

memory/2176-61-0x000000001B740000-0x000000001B9CB000-memory.dmp

Download

memory/2176-13-0x000000001B740000-0x000000001B9CB000-memory.dmp

Download

memory/2176-17-0x000000001B740000-0x000000001B9CB000-memory.dmp

Download

memory/2176-11-0x000000001B740000-0x000000001B9CB000-memory.dmp

Download

memory/2176-19-0x000000001B740000-0x000000001B9CB000-memory.dmp

Download

memory/2176-25-0x000000001B740000-0x000000001B9CB000-memory.dmp

Download

memory/2176-31-0x000000001B740000-0x000000001B9CB000-memory.dmp

Download

memory/2176-35-0x000000001B740000-0x000000001B9CB000-memory.dmp

Download

memory/2176-39-0x000000001B740000-0x000000001B9CB000-memory.dmp

Download

memory/2176-37-0x000000001B740000-0x000000001B9CB000-memory.dmp

Download

memory/2176-33-0x000000001B740000-0x000000001B9CB000-memory.dmp

Download

memory/2176-2-0x000000001B100000-0x000000001B180000-memory.dmp

Download

memory/2176-29-0x000000001B740000-0x000000001B9CB000-memory.dmp

Download

memory/2176-55-0x000000001B740000-0x000000001B9CB000-memory.dmp

Download

memory/2176-41-0x000000001B740000-0x000000001B9CB000-memory.dmp

Download

memory/2176-43-0x000000001B740000-0x000000001B9CB000-memory.dmp

Download

memory/2176-45-0x000000001B740000-0x000000001B9CB000-memory.dmp

Download

memory/2176-65-0x000000001B740000-0x000000001B9CB000-memory.dmp

Download

memory/2176-63-0x000000001B740000-0x000000001B9CB000-memory.dmp

Download

memory/2176-59-0x000000001B740000-0x000000001B9CB000-memory.dmp

Download

memory/2176-57-0x000000001B740000-0x000000001B9CB000-memory.dmp

Download

memory/2176-53-0x000000001B740000-0x000000001B9CB000-memory.dmp

Download

memory/2176-51-0x000000001B740000-0x000000001B9CB000-memory.dmp

Download

memory/2176-47-0x000000001B740000-0x000000001B9CB000-memory.dmp

Download

memory/2176-67-0x000000001B740000-0x000000001B9CB000-memory.dmp

Download

memory/2176-4884-0x0000000000360000-0x0000000000361000-memory.dmp

Download

memory/2176-4886-0x00000000004A0000-0x00000000004EC000-memory.dmp

Download

memory/2176-4885-0x0000000000FC0000-0x000000000108E000-memory.dmp

Download

memory/2176-4887-0x000007FEF5710000-0x000007FEF60FC000-memory.dmp

Download

memory/2176-4888-0x000000001B100000-0x000000001B180000-memory.dmp

Download

memory/2176-4890-0x0000000077300000-0x00000000774A9000-memory.dmp

Download

memory/2176-4891-0x000000001ADF0000-0x000000001AE44000-memory.dmp

Download

memory/2176-1-0x000007FEF5710000-0x000007FEF60FC000-memory.dmp

Download

memory/2176-4914-0x000007FEF5710000-0x000007FEF60FC000-memory.dmp

Download

memory/2176-4915-0x0000000077300000-0x00000000774A9000-memory.dmp

Download

memory/2584-4916-0x000000001B830000-0x000000001BB12000-memory.dmp

Download

memory/2584-4917-0x0000000001E80000-0x0000000001E88000-memory.dmp

Download