14390ed276c0186e59e5a42e00b865d8f57cc2d7fa9bf98cc809864a6936541a

Analysis

max time kernel
93s
max time network
94s
platform
windows11-21h2_x64
resource
win11-20240426-en
resource tags

arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system
submitted
15/05/2024, 01:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1hAck Crab Game v3.4/Extreme Injector.exe
Size

1.9MB
MD5

ec801a7d4b72a288ec6c207bb9ff0131
SHA1

32eec2ae1f9e201516fa7fcdc16c4928f7997561
SHA256

b65f40618f584303ca0bcf9b5f88c233cc4237699c0c4bf40ba8facbe8195a46
SHA512

a07dd5e8241de73ce65ff8d74acef4942b85fc45cf6a7baafd3c0f9d330b08e7412f2023ba667e99b40e732a65e8fb4389f7fe73c7b6256ca71e63afe46cdcac
SSDEEP

49152:NNEVtO1U1y1DDDDDD7Llngq7NNMqU0p2Vhk9a:NNEVJyZlng4p2V

Score

6^/10

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
1	raw.githubusercontent.com
2	raw.githubusercontent.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 64 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	Extreme Injector.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616257"	Extreme Injector.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0\0\0\0\NodeSlot = "2"	Extreme Injector.exe
Key created	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	Extreme Injector.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0\0\0\0 = 4e00310000000000af587409100054656d7000003a0009000400efbe9a581078af5874092e0000006b570200000001000000000000000000000000000000b6332901540065006d007000000014000000	Extreme Injector.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 0100000000000000ffffffff	Extreme Injector.exe
Key created	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0\0\0\0\0	Extreme Injector.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	notepad.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e80922b16d365937a46956b92703aca08af0000	Extreme Injector.exe
Key created	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\HAM\AUI\Global.IrisService\V1\LU	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	Extreme Injector.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202	notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2\NodeSlot = "4"	notepad.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1 = 19002f433a5c000000000000000000000000000000000000000000	Extreme Injector.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0\0\0\0\MRUListEx = ffffffff	Extreme Injector.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	Extreme Injector.exe
Key created	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\MicrosoftWindows.Client.CBS_cw5n1h2txyewy	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Documents"	notepad.exe
Key created	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16"	notepad.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	notepad.exe
Key created	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000_Classes\Local Settings	Extreme Injector.exe
Key created	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg	Extreme Injector.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0 = 78003100000000009a5810781100557365727300640009000400efbec5522d60af5874092e0000006c0500000000010000000000000000003a0000000000a06d560055007300650072007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100380031003300000014000000	Extreme Injector.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	Extreme Injector.exe
Key created	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\LogicalViewMode = "1"	notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	notepad.exe
Key created	\Registry\User\S-1-5-21-3062789476-783164490-2318012559-1000_Classes\NotificationData	Extreme Injector.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	Extreme Injector.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0"	Extreme Injector.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	notepad.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0\0\0\0\MRUListEx = 00000000ffffffff	Extreme Injector.exe
Key created	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg	Extreme Injector.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	Extreme Injector.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4"	notepad.exe
Key created	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell	notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	notepad.exe
Key created	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	Extreme Injector.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1"	Extreme Injector.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\HAM\AUI\Global.IrisService\V1\LU\PTT = "133602091591150890"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\HAM\AUI	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0"	notepad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	Extreme Injector.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0\MRUListEx = 00000000ffffffff	Extreme Injector.exe
Key created	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	Extreme Injector.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	Extreme Injector.exe
Key created	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0\0\0	Extreme Injector.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2 = 3a002e803accbfb42cdb4c42b0297fe99a87c641260001002600efbe11000000c09cb57bea97da01db44267eea97da0112f0ff9dea97da0114000000	notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\HAM\AUI\Global.IrisService\V1\LU\PCT = "133602090980639722"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	notepad.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	Extreme Injector.exe
Key created	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	Extreme Injector.exe
Key created	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3	Extreme Injector.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	Extreme Injector.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	Extreme Injector.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	Extreme Injector.exe
Key created	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\HAM\AUI\Global.IrisService	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\LogicalViewMode = "1"	Extreme Injector.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0\0\MRUListEx = 00000000ffffffff	Extreme Injector.exe
Key created	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0\0\0\0	Extreme Injector.exe
Key created	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	notepad.exe
Key created	\REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg	notepad.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3876	Extreme Injector.exe
3876	Extreme Injector.exe
3876	Extreme Injector.exe
3876	Extreme Injector.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3876	Extreme Injector.exe
Token: 33	3876	Extreme Injector.exe
Token: SeIncBasePriorityPrivilege	3876	Extreme Injector.exe
Token: SeDebugPrivilege	3876	Extreme Injector.exe
Token: 33	3876	Extreme Injector.exe
Token: SeIncBasePriorityPrivilege	3876	Extreme Injector.exe
Token: 33	3876	Extreme Injector.exe
Token: SeIncBasePriorityPrivilege	3876	Extreme Injector.exe
Token: 33	3876	Extreme Injector.exe
Token: SeIncBasePriorityPrivilege	3876	Extreme Injector.exe
Token: 33	3876	Extreme Injector.exe
Token: SeIncBasePriorityPrivilege	3876	Extreme Injector.exe
Token: 33	3876	Extreme Injector.exe
Token: SeIncBasePriorityPrivilege	3876	Extreme Injector.exe
Token: 33	3876	Extreme Injector.exe
Token: SeIncBasePriorityPrivilege	3876	Extreme Injector.exe
Token: 33	3876	Extreme Injector.exe
Token: SeIncBasePriorityPrivilege	3876	Extreme Injector.exe
Token: 33	3876	Extreme Injector.exe
Token: SeIncBasePriorityPrivilege	3876	Extreme Injector.exe
Token: 33	3876	Extreme Injector.exe
Token: SeIncBasePriorityPrivilege	3876	Extreme Injector.exe
Token: 33	3876	Extreme Injector.exe
Token: SeIncBasePriorityPrivilege	3876	Extreme Injector.exe
Token: 33	3876	Extreme Injector.exe
Token: SeIncBasePriorityPrivilege	3876	Extreme Injector.exe
Token: 33	3876	Extreme Injector.exe
Token: SeIncBasePriorityPrivilege	3876	Extreme Injector.exe
Token: 33	3876	Extreme Injector.exe
Token: SeIncBasePriorityPrivilege	3876	Extreme Injector.exe
Token: 33	3876	Extreme Injector.exe
Token: SeIncBasePriorityPrivilege	3876	Extreme Injector.exe
Token: 33	3876	Extreme Injector.exe
Token: SeIncBasePriorityPrivilege	3876	Extreme Injector.exe
Token: 33	3876	Extreme Injector.exe
Token: SeIncBasePriorityPrivilege	3876	Extreme Injector.exe
Token: 33	3876	Extreme Injector.exe
Token: SeIncBasePriorityPrivilege	3876	Extreme Injector.exe
Token: 33	3876	Extreme Injector.exe
Token: SeIncBasePriorityPrivilege	3876	Extreme Injector.exe
Token: 33	3876	Extreme Injector.exe
Token: SeIncBasePriorityPrivilege	3876	Extreme Injector.exe
Token: 33	3876	Extreme Injector.exe
Token: SeIncBasePriorityPrivilege	3876	Extreme Injector.exe
Token: 33	3876	Extreme Injector.exe
Token: SeIncBasePriorityPrivilege	3876	Extreme Injector.exe
Token: 33	3876	Extreme Injector.exe
Token: SeIncBasePriorityPrivilege	3876	Extreme Injector.exe
Token: 33	3876	Extreme Injector.exe
Token: SeIncBasePriorityPrivilege	3876	Extreme Injector.exe
Token: 33	3876	Extreme Injector.exe
Token: SeIncBasePriorityPrivilege	3876	Extreme Injector.exe
Token: 33	3876	Extreme Injector.exe
Token: SeIncBasePriorityPrivilege	3876	Extreme Injector.exe
Token: 33	3876	Extreme Injector.exe
Token: SeIncBasePriorityPrivilege	3876	Extreme Injector.exe
Token: 33	3876	Extreme Injector.exe
Token: SeIncBasePriorityPrivilege	3876	Extreme Injector.exe
Token: 33	3876	Extreme Injector.exe
Token: SeIncBasePriorityPrivilege	3876	Extreme Injector.exe
Token: 33	3876	Extreme Injector.exe
Token: SeIncBasePriorityPrivilege	3876	Extreme Injector.exe
Token: 33	3876	Extreme Injector.exe
Token: SeIncBasePriorityPrivilege	3876	Extreme Injector.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
3876	Extreme Injector.exe
3876	Extreme Injector.exe
1524	notepad.exe
1524	notepad.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
808	svchost.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3876 wrote to memory of 808	3876	Extreme Injector.exe	8
PID 808 wrote to memory of 4340	808	svchost.exe	83
PID 808 wrote to memory of 4340	808	svchost.exe	83

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p
1⤵
- Modifies registry class
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:808
- C:\Windows\system32\DllHost.exe
  C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
  2⤵
  PID:4340

C:\Users\Admin\AppData\Local\Temp\1hAck Crab Game v3.4\Extreme Injector.exe
"C:\Users\Admin\AppData\Local\Temp\1hAck Crab Game v3.4\Extreme Injector.exe"
1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3876

C:\Windows\system32\notepad.exe
"C:\Windows\system32\notepad.exe"
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1524

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db

Filesize
14KB

MD5
e2f2ee5c6c990801e3f1cbdc48107140

SHA1
b01fd2dfedf9214e6d9dca41f29f636f98106b25

SHA256
0e3480a818fbbe8f4b710ebc231860fd38efc4013f6f63e18a15fd88dd005773

SHA512
2cfb11f4e45664f6c14017419232b6b86b908893097e640524d615ae3d46d93ec20c83a2a8dd643ea1e9e5e7aa38c6e92287a8908f297f809f61399107209f9c

Download Submit
memory/3876-7-0x00007FFDC6D60000-0x00007FFDC7822000-memory.dmp

Filesize
10.8MB

Download
memory/3876-2-0x00007FFDC6D60000-0x00007FFDC7822000-memory.dmp

Filesize
10.8MB

Download
memory/3876-3-0x000000001D640000-0x000000001D652000-memory.dmp

Filesize
72KB

Download
memory/3876-4-0x000000001D6A0000-0x000000001D6DC000-memory.dmp

Filesize
240KB

Download
memory/3876-6-0x00007FFDC6D60000-0x00007FFDC7822000-memory.dmp

Filesize
10.8MB

Download
memory/3876-0-0x00007FFDC6D63000-0x00007FFDC6D65000-memory.dmp

Filesize
8KB

Download
memory/3876-8-0x00007FFDC6D63000-0x00007FFDC6D65000-memory.dmp

Filesize
8KB

Download
memory/3876-9-0x00007FFDC6D60000-0x00007FFDC7822000-memory.dmp

Filesize
10.8MB

Download
memory/3876-10-0x00007FFDC6D60000-0x00007FFDC7822000-memory.dmp

Filesize
10.8MB

Download
memory/3876-11-0x00007FFDC6D60000-0x00007FFDC7822000-memory.dmp

Filesize
10.8MB

Download
memory/3876-16-0x00007FFDC6D60000-0x00007FFDC7822000-memory.dmp

Filesize
10.8MB

Download
memory/3876-1-0x00000000002B0000-0x0000000000496000-memory.dmp

Filesize
1.9MB

Download