Analysis
-
max time kernel
133s -
max time network
101s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
24-05-2024 03:39
Static task
static1
Behavioral task
behavioral1
Sample
d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe
Resource
win10v2004-20240508-en
General
-
Target
d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe
-
Size
5.5MB
-
MD5
5a74dce08eea9032012d474840ef7d52
-
SHA1
a5d0a5c81c2dc32a9b6fdb919b82b3d42ee8c5a4
-
SHA256
d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832
-
SHA512
1218667da0142e1d29345dce36044d4a08ce251e70576643b5ff163efa5e05f8188c2f842c1b57770d365accccc34e317f8f7a556439f5b82f3c1e9c90c6232b
-
SSDEEP
98304:oseHlHdc5b9dXLVi2xIb7S1fw7pXyZ7oz0R5uz0rbJagkW7kOLIx1qxz8hjFrZBG:Bem17h10XvwPhagz7q2wNPQ00R
Malware Config
Signatures
-
Sets file execution options in registry 2 TTPs 6 IoCs
Processes:
reg.exereg.exereg.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ZhuDongFangYu.exe reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ZhuDongFangYu.exe\debugger = "ntsd -d" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360tray.exe reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360tray.exe\debugger = "ntsd -d" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\debugger = "ntsd -d" reg.exe -
Modifies system executable filetype association 2 TTPs 1 IoCs
Processes:
cmd.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe " cmd.exe -
Drops file in Program Files directory 64 IoCs
Processes:
d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exedescription ioc process File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\javadoc.exe d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\jps.exe d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\jstat.exe d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\bin\java-rmi.exe d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe File opened for modification \??\c:\Program Files\Internet Explorer\iexplore.exe d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\jjs.exe d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ink\TabTip.exe d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\jconsole.exe d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\native2ascii.exe d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\orbd.exe d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\bin\java.exe d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\javah.exe d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\jhat.exe d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\bin\kinit.exe d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Client\AppVLP.exe d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe File opened for modification \??\c:\Program Files\7-Zip\Uninstall.exe d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\wsimport.exe d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\bin\policytool.exe d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\wsgen.exe d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\java.exe d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\unpack200.exe d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\javaws.exe d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\tnameserv.exe d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\jar.exe d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\jmap.exe d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\bin\rmiregistry.exe d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\jdb.exe d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe File opened for modification \??\c:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\misc.exe d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\bin\jjs.exe d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe -
Modifies registry class 14 IoCs
Processes:
cmd.execmd.execmd.execmd.execmd.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\jpgfile\Shell\Open\Command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe " cmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\zipfile\Shell\Open\Command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe " cmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe " cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\jpgfile\Shell cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\jpgfile\Shell\Open cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\zipfile\Shell\Open cmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe " cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\jpgfile\Shell\Open\Command cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\zipfile\Shell cmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.txt \ = " exefile" cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\zipfile cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\zipfile\Shell\Open\Command cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\jpgfile cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.txt cmd.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exepid process 3540 d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe 3540 d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exepid process 3540 d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exepid process 3540 d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe -
Suspicious use of WriteProcessMemory 30 IoCs
Processes:
d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.execmd.exedescription pid process target process PID 3540 wrote to memory of 1820 3540 d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe cmd.exe PID 3540 wrote to memory of 1820 3540 d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe cmd.exe PID 3540 wrote to memory of 1820 3540 d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe cmd.exe PID 3540 wrote to memory of 4492 3540 d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe cmd.exe PID 3540 wrote to memory of 4492 3540 d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe cmd.exe PID 3540 wrote to memory of 4492 3540 d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe cmd.exe PID 3540 wrote to memory of 5080 3540 d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe cmd.exe PID 3540 wrote to memory of 5080 3540 d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe cmd.exe PID 3540 wrote to memory of 5080 3540 d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe cmd.exe PID 3540 wrote to memory of 4840 3540 d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe cmd.exe PID 3540 wrote to memory of 4840 3540 d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe cmd.exe PID 3540 wrote to memory of 4840 3540 d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe cmd.exe PID 3540 wrote to memory of 2120 3540 d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe cmd.exe PID 3540 wrote to memory of 2120 3540 d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe cmd.exe PID 3540 wrote to memory of 2120 3540 d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe cmd.exe PID 3540 wrote to memory of 1800 3540 d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe cmd.exe PID 3540 wrote to memory of 1800 3540 d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe cmd.exe PID 3540 wrote to memory of 1800 3540 d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe cmd.exe PID 3540 wrote to memory of 1728 3540 d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe cmd.exe PID 3540 wrote to memory of 1728 3540 d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe cmd.exe PID 3540 wrote to memory of 1728 3540 d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe cmd.exe PID 4492 wrote to memory of 3620 4492 cmd.exe reg.exe PID 4492 wrote to memory of 3620 4492 cmd.exe reg.exe PID 4492 wrote to memory of 3620 4492 cmd.exe reg.exe PID 4492 wrote to memory of 1652 4492 cmd.exe reg.exe PID 4492 wrote to memory of 1652 4492 cmd.exe reg.exe PID 4492 wrote to memory of 1652 4492 cmd.exe reg.exe PID 4492 wrote to memory of 760 4492 cmd.exe reg.exe PID 4492 wrote to memory of 760 4492 cmd.exe reg.exe PID 4492 wrote to memory of 760 4492 cmd.exe reg.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe"C:\Users\Admin\AppData\Local\Temp\d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe"1⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3540 -
C:\Windows\SysWOW64\cmd.execmd.exe2⤵PID:1820
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\123.bat2⤵
- Suspicious use of WriteProcessMemory
PID:4492 -
C:\Windows\SysWOW64\reg.exereg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\ZhuDongFangYu.exe" /v debugger /t reg_sz /d "ntsd -d" /f3⤵
- Sets file execution options in registry
PID:3620 -
C:\Windows\SysWOW64\reg.exereg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\360tray.exe" /v debugger /t reg_sz /d "ntsd -d" /f3⤵
- Sets file execution options in registry
PID:1652 -
C:\Windows\SysWOW64\reg.exereg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\taskmgr.exe" /v debugger /t reg_sz /d "ntsd -d" /f3⤵
- Sets file execution options in registry
PID:760 -
C:\Windows\SysWOW64\cmd.execmd.exe /c assoc .txt = exefile2⤵
- Modifies registry class
PID:5080 -
C:\Windows\SysWOW64\cmd.execmd.exe /c ftype comfile=C:\Users\Admin\AppData\Local\Temp\d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe2⤵
- Modifies system executable filetype association
- Modifies registry class
PID:4840 -
C:\Windows\SysWOW64\cmd.execmd.exe /c ftype zipfile=C:\Users\Admin\AppData\Local\Temp\d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe2⤵
- Modifies registry class
PID:2120 -
C:\Windows\SysWOW64\cmd.execmd.exe /c ftype jpgfile=C:\Users\Admin\AppData\Local\Temp\d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe2⤵
- Modifies registry class
PID:1800 -
C:\Windows\SysWOW64\cmd.execmd.exe /c ftype txtfile=C:\Users\Admin\AppData\Local\Temp\d1ca033e2cffb8d392975c8690e9c498bcb320f780d2277faa881f64ba6f5832.exe2⤵
- Modifies registry class
PID:1728
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Change Default File Association
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\123.batFilesize
443B
MD570170ba16a737a438223b88279dc6c85
SHA1cc066efa0fca9bc9f44013660dea6b28ddfd6a24
SHA256d3674f4b34a8ca8167160519aa5c66b6024eb09f4cb0c9278bc44370b0efec6a
SHA51237cc8c954544374d0a1ca4d012c9bd0b47781bc9bb8d0c15a8a95b9934893db3bedee867b984c20edabe54c39574abf7250de433aade6c0d544b8dd2c972c6da
-
C:\Program Files\7-Zip\7zG.exeFilesize
5.5MB
MD516a5807f5fae5e41e16b4483f399b6ea
SHA117a96a4c60dd715db5326840ff38eed42aed0cf4
SHA25677deece1549cda46a543419542c947271efbce0157cbd3bc210de8959e8e2b49
SHA5124619d66c5e46689da3ab0adb7f99cfdf8d9a37d1ad194ca4c856d2c602be0422daf51bc6dee23223d4935caac5cfc14a865e049ce998d6aebdef9e9d179dddb9
-
memory/3540-0-0x0000000000400000-0x0000000000C94000-memory.dmpFilesize
8.6MB
-
memory/3540-3-0x0000000000400000-0x0000000000C94000-memory.dmpFilesize
8.6MB
-
memory/3540-2-0x000000000040E000-0x000000000070E000-memory.dmpFilesize
3.0MB
-
memory/3540-1-0x0000000000DD0000-0x0000000000DD1000-memory.dmpFilesize
4KB
-
memory/3540-1020-0x0000000000400000-0x0000000000C94000-memory.dmpFilesize
8.6MB
-
memory/3540-1021-0x000000000040E000-0x000000000070E000-memory.dmpFilesize
3.0MB