Analysis
-
max time kernel
122s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
24-05-2024 03:39
Static task
static1
Behavioral task
behavioral1
Sample
d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe
Resource
win10v2004-20240508-en
General
-
Target
d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe
-
Size
5.5MB
-
MD5
5a74dce08eea9032012d474840ef7d52
-
SHA1
a5d0a5c81c2dc32a9b6fdb919b82b3d42ee8c5a4
-
SHA256
d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832
-
SHA512
1218667da0142e1d29345dce36044d4a08ce251e70576643b5ff163efa5e05f8188c2f842c1b57770d365accccc34e317f8f7a556439f5b82f3c1e9c90c6232b
-
SSDEEP
98304:oseHlHdc5b9dXLVi2xIb7S1fw7pXyZ7oz0R5uz0rbJagkW7kOLIx1qxz8hjFrZBG:Bem17h10XvwPhagz7q2wNPQ00R
Malware Config
Signatures
-
Sets file execution options in registry 2 TTPs 6 IoCs
Processes:
reg.exereg.exereg.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360tray.exe reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360tray.exe\debugger = "ntsd -d" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\debugger = "ntsd -d" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ZhuDongFangYu.exe reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ZhuDongFangYu.exe\debugger = "ntsd -d" reg.exe -
Modifies system executable filetype association 2 TTPs 1 IoCs
Processes:
cmd.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe " cmd.exe -
Drops file in System32 directory 1 IoCs
Processes:
d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exedescription ioc process File opened for modification \??\c:\Windows\SysWOW64\regedit.exe d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe -
Drops file in Program Files directory 64 IoCs
Processes:
d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exedescription ioc process File opened for modification \??\c:\Program Files\Microsoft Games\Minesweeper\MineSweeper.exe d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe File opened for modification \??\c:\Program Files\Mozilla Firefox\uninstall\helper.exe d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe File opened for modification \??\c:\Program Files\Common Files\Microsoft Shared\ink\ConvertInkStore.exe d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\unpack200.exe d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\jre\bin\java-rmi.exe d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\CNFNOT32.EXE d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe File opened for modification \??\c:\Program Files\Microsoft Games\FreeCell\FreeCell.exe d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe File opened for modification \??\c:\Program Files\Mozilla Firefox\default-browser-agent.exe d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Reader 9.0\Reader\Eula.exe d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe File opened for modification \??\c:\Program Files (x86)\Common Files\microsoft shared\ink\pipanel.exe d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe File opened for modification \??\c:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe File opened for modification \??\c:\Program Files\Java\jre7\bin\rmiregistry.exe d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe File opened for modification \??\c:\Program Files\Windows Media Player\wmprph.exe d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe File opened for modification \??\c:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\ODeploy.exe d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\chrome_proxy.exe d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\jmc.exe d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe File opened for modification \??\c:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\LICLUA.EXE d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\jre\bin\orbd.exe d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe File opened for modification \??\c:\Program Files\Java\jre7\bin\kinit.exe d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe File opened for modification \??\c:\Program Files\Java\jre7\bin\ssvagent.exe d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe File opened for modification \??\c:\Program Files\Java\jre7\bin\unpack200.exe d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe File opened for modification \??\c:\Program Files (x86)\Common Files\Adobe\Updater6\AdobeUpdaterInstallMgr.exe d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe File opened for modification \??\c:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\policytool.exe d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\jre\bin\java.exe d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\VPREVIEW.EXE d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe File opened for modification \??\c:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Oarpmany.exe d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\MSACCESS.EXE d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe File opened for modification \??\c:\Program Files\Windows NT\Accessories\wordpad.exe d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe File opened for modification \??\c:\Program Files\Common Files\Microsoft Shared\ink\mip.exe d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe File opened for modification \??\c:\Program Files\Internet Explorer\ieinstal.exe d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\klist.exe d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe File opened for modification \??\c:\Program Files\Windows Sidebar\sidebar.exe d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\GRAPH.EXE d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe File opened for modification \??\c:\Program Files\Microsoft Games\Multiplayer\Checkers\chkrzm.exe d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe File opened for modification \??\c:\Program Files\Windows Journal\Journal.exe d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe File opened for modification \??\c:\Program Files\Windows Mail\wabmig.exe d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\IEContentService.exe d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\jstack.exe d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\jre\bin\jp2launcher.exe d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec.exe d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe File opened for modification \??\c:\Program Files\Microsoft Games\Multiplayer\Backgammon\bckgzm.exe d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe File opened for modification \??\c:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe File opened for modification \??\c:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\jhat.exe d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\jstatd.exe d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe File opened for modification \??\c:\Program Files\Java\jre7\bin\klist.exe d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\excelcnv.exe d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe File opened for modification \??\c:\Program Files\Internet Explorer\iexplore.exe d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\jre\bin\javacpl.exe d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe File opened for modification \??\c:\Program Files\Windows Media Player\WMPDMC.exe d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe File opened for modification \??\c:\Program Files (x86)\Windows Media Player\setup_wm.exe d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe File opened for modification \??\c:\Program Files\DVD Maker\DVDMaker.exe d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Reader 9.0\Reader\AdobeCollabSync.exe d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe File opened for modification \??\c:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe File opened for modification \??\c:\Program Files (x86)\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPREARM.EXE d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\jvisualvm.exe d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\jre\bin\jabswitch.exe d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\jre\bin\policytool.exe d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\rmiregistry.exe d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe File opened for modification \??\c:\Program Files\Windows Mail\wab.exe d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe -
Drops file in Windows directory 12 IoCs
Processes:
d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exedescription ioc process File opened for modification \??\c:\Windows\Boot\PCAT\memtest.exe d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe File opened for modification \??\c:\Windows\explorer.exe d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe File opened for modification \??\c:\Windows\fveupdate.exe d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe File opened for modification \??\c:\Windows\HelpPane.exe d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe File opened for modification \??\c:\Windows\hh.exe d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe File opened for modification \??\c:\Windows\notepad.exe d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe File opened for modification \??\c:\Windows\twunk_16.exe d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe File opened for modification \??\c:\Windows\winhlp32.exe d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe File opened for modification \??\c:\Windows\bfsvc.exe d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe File opened for modification \??\c:\Windows\splwow64.exe d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe File opened for modification \??\c:\Windows\twunk_32.exe d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe File opened for modification \??\c:\Windows\write.exe d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe -
Modifies registry class 14 IoCs
Processes:
cmd.execmd.execmd.execmd.execmd.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\zipfile\Shell\Open\Command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe " cmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe " cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\jpgfile\Shell cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\jpgfile\Shell\Open\Command cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.txt cmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.txt \ = " exefile" cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\zipfile\Shell\Open\Command cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\jpgfile cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\jpgfile\Shell\Open cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\zipfile cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\zipfile\Shell cmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\jpgfile\Shell\Open\Command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe " cmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe " cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\zipfile\Shell\Open cmd.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exepid process 2028 d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exepid process 2028 d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exepid process 2028 d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe -
Suspicious use of WriteProcessMemory 40 IoCs
Processes:
d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.execmd.exedescription pid process target process PID 2028 wrote to memory of 2856 2028 d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe cmd.exe PID 2028 wrote to memory of 2856 2028 d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe cmd.exe PID 2028 wrote to memory of 2856 2028 d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe cmd.exe PID 2028 wrote to memory of 2856 2028 d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe cmd.exe PID 2028 wrote to memory of 2896 2028 d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe cmd.exe PID 2028 wrote to memory of 2896 2028 d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe cmd.exe PID 2028 wrote to memory of 2896 2028 d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe cmd.exe PID 2028 wrote to memory of 2896 2028 d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe cmd.exe PID 2028 wrote to memory of 2960 2028 d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe cmd.exe PID 2028 wrote to memory of 2960 2028 d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe cmd.exe PID 2028 wrote to memory of 2960 2028 d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe cmd.exe PID 2028 wrote to memory of 2960 2028 d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe cmd.exe PID 2028 wrote to memory of 2864 2028 d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe cmd.exe PID 2028 wrote to memory of 2864 2028 d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe cmd.exe PID 2028 wrote to memory of 2864 2028 d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe cmd.exe PID 2028 wrote to memory of 2864 2028 d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe cmd.exe PID 2028 wrote to memory of 980 2028 d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe cmd.exe PID 2028 wrote to memory of 980 2028 d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe cmd.exe PID 2028 wrote to memory of 980 2028 d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe cmd.exe PID 2028 wrote to memory of 980 2028 d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe cmd.exe PID 2028 wrote to memory of 1988 2028 d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe cmd.exe PID 2028 wrote to memory of 1988 2028 d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe cmd.exe PID 2028 wrote to memory of 1988 2028 d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe cmd.exe PID 2028 wrote to memory of 1988 2028 d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe cmd.exe PID 2028 wrote to memory of 2924 2028 d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe cmd.exe PID 2028 wrote to memory of 2924 2028 d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe cmd.exe PID 2028 wrote to memory of 2924 2028 d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe cmd.exe PID 2028 wrote to memory of 2924 2028 d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe cmd.exe PID 2896 wrote to memory of 2848 2896 cmd.exe reg.exe PID 2896 wrote to memory of 2848 2896 cmd.exe reg.exe PID 2896 wrote to memory of 2848 2896 cmd.exe reg.exe PID 2896 wrote to memory of 2848 2896 cmd.exe reg.exe PID 2896 wrote to memory of 2024 2896 cmd.exe reg.exe PID 2896 wrote to memory of 2024 2896 cmd.exe reg.exe PID 2896 wrote to memory of 2024 2896 cmd.exe reg.exe PID 2896 wrote to memory of 2024 2896 cmd.exe reg.exe PID 2896 wrote to memory of 2992 2896 cmd.exe reg.exe PID 2896 wrote to memory of 2992 2896 cmd.exe reg.exe PID 2896 wrote to memory of 2992 2896 cmd.exe reg.exe PID 2896 wrote to memory of 2992 2896 cmd.exe reg.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe"C:\Users\Admin\AppData\Local\Temp\d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd.exe2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c C:\123.bat2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exereg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\ZhuDongFangYu.exe" /v debugger /t reg_sz /d "ntsd -d" /f3⤵
- Sets file execution options in registry
-
C:\Windows\SysWOW64\reg.exereg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\360tray.exe" /v debugger /t reg_sz /d "ntsd -d" /f3⤵
- Sets file execution options in registry
-
C:\Windows\SysWOW64\reg.exereg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\taskmgr.exe" /v debugger /t reg_sz /d "ntsd -d" /f3⤵
- Sets file execution options in registry
-
C:\Windows\SysWOW64\cmd.execmd.exe /c assoc .txt = exefile2⤵
- Modifies registry class
-
C:\Windows\SysWOW64\cmd.execmd.exe /c ftype comfile=C:\Users\Admin\AppData\Local\Temp\d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe2⤵
- Modifies system executable filetype association
- Modifies registry class
-
C:\Windows\SysWOW64\cmd.execmd.exe /c ftype zipfile=C:\Users\Admin\AppData\Local\Temp\d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe2⤵
- Modifies registry class
-
C:\Windows\SysWOW64\cmd.execmd.exe /c ftype jpgfile=C:\Users\Admin\AppData\Local\Temp\d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe2⤵
- Modifies registry class
-
C:\Windows\SysWOW64\cmd.execmd.exe /c ftype txtfile=C:\Users\Admin\AppData\Local\Temp\d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe2⤵
- Modifies registry class
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Change Default File Association
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\123.batFilesize
443B
MD570170ba16a737a438223b88279dc6c85
SHA1cc066efa0fca9bc9f44013660dea6b28ddfd6a24
SHA256d3674f4b34a8ca8167160519aa5c66b6024eb09f4cb0c9278bc44370b0efec6a
SHA51237cc8c954544374d0a1ca4d012c9bd0b47781bc9bb8d0c15a8a95b9934893db3bedee867b984c20edabe54c39574abf7250de433aade6c0d544b8dd2c972c6da
-
C:\Program Files\7-Zip\7zG.exeFilesize
5.5MB
MD52e6971f000f251d8db20461e21ae6078
SHA1ee4605c8e2d423e8d2752dd0a246533d1ee876c1
SHA256de68333a7a3991b0f9c465bdead413db4b827a354af478a0eb31d980c3523cd0
SHA5126c4f9714a14697d36e4edcea8fb75850da8ae5f86c4b9af4edcf3a221ef78f8d10f905f2ac41293335abb240f84dedf282e6a48a037ab683da42adeb0e2f7286
-
memory/2028-0-0x0000000000400000-0x0000000000C94000-memory.dmpFilesize
8.6MB
-
memory/2028-3-0x0000000000260000-0x0000000000261000-memory.dmpFilesize
4KB
-
memory/2028-5-0x0000000000260000-0x0000000000261000-memory.dmpFilesize
4KB
-
memory/2028-1-0x0000000000260000-0x0000000000261000-memory.dmpFilesize
4KB
-
memory/2028-6-0x0000000000400000-0x0000000000C94000-memory.dmpFilesize
8.6MB
-
memory/2028-8-0x000000000040E000-0x000000000070E000-memory.dmpFilesize
3.0MB
-
memory/2028-11-0x0000000000400000-0x0000000000C94000-memory.dmpFilesize
8.6MB
-
memory/2028-1080-0x0000000000400000-0x0000000000C94000-memory.dmpFilesize
8.6MB