Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
26-05-2024 07:24
Static task
static1
Behavioral task
behavioral1
Sample
1e820ed6dccf8ec6694a9113c9c173cc3a347b5c5e34c093c104da0f82f47afb.exe
Resource
win7-20240221-en
General
-
Target
1e820ed6dccf8ec6694a9113c9c173cc3a347b5c5e34c093c104da0f82f47afb.exe
-
Size
4.4MB
-
MD5
fd37327f6c3016a4621c4ed4d499dbc2
-
SHA1
630c9b0dd6b29641e70b36a1c4a62eff874ef845
-
SHA256
1e820ed6dccf8ec6694a9113c9c173cc3a347b5c5e34c093c104da0f82f47afb
-
SHA512
11630832ae114099d2181be3b775ce40830a199da92113c72d3efc9d0739895aaad13fb071ed3f155444d85c4fb30d652ad5a82bb13fa22de0cbeb573a9a192a
-
SSDEEP
98304:Dws2ANnKXOaeOgmhy0Rmn9zd308KDG235p:FKXbeO77S2pp
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral2/memory/4668-14-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/4668-18-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/4668-15-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/2356-24-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/2356-25-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/2356-23-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/2356-31-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/860-37-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/860-41-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/860-42-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit -
Gh0st RAT payload 11 IoCs
Processes:
resource yara_rule C:\Windows\SysWOW64\240599171.txt family_gh0strat behavioral2/memory/4668-14-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/4668-18-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/4668-15-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/2356-24-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/2356-25-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/2356-23-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/2356-31-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/860-37-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/860-41-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/860-42-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat -
Drops file in Drivers directory 1 IoCs
Processes:
TXPlatfor.exedescription ioc process File created C:\Windows\system32\drivers\QAssist.sys TXPlatfor.exe -
Sets service image path in registry 2 TTPs 1 IoCs
Processes:
TXPlatfor.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys" TXPlatfor.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
HD_1e820ed6dccf8ec6694a9113c9c173cc3a347b5c5e34c093c104da0f82f47afb.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation HD_1e820ed6dccf8ec6694a9113c9c173cc3a347b5c5e34c093c104da0f82f47afb.exe -
Executes dropped EXE 5 IoCs
Processes:
R.exeN.exeTXPlatfor.exeHD_1e820ed6dccf8ec6694a9113c9c173cc3a347b5c5e34c093c104da0f82f47afb.exeTXPlatfor.exepid process 880 R.exe 4668 N.exe 2356 TXPlatfor.exe 4952 HD_1e820ed6dccf8ec6694a9113c9c173cc3a347b5c5e34c093c104da0f82f47afb.exe 860 TXPlatfor.exe -
Loads dropped DLL 1 IoCs
Processes:
R.exepid process 880 R.exe -
Processes:
resource yara_rule behavioral2/memory/4668-14-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/4668-18-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/4668-12-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/4668-15-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/2356-22-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/2356-24-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/2356-25-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/2356-23-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/2356-31-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/860-37-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/860-41-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/860-42-0x0000000010000000-0x00000000101B6000-memory.dmp upx -
Drops file in System32 directory 3 IoCs
Processes:
R.exeN.exedescription ioc process File created C:\Windows\SysWOW64\240599171.txt R.exe File created C:\Windows\SysWOW64\TXPlatfor.exe N.exe File opened for modification C:\Windows\SysWOW64\TXPlatfor.exe N.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Processes:
IEXPLORE.EXEIEXPLORE.EXEdescription ioc process Set value (data) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000150dfb3d7d297149b53fa5015b24f84400000000020000000000106600000001000020000000d203c3db00a18b71797b2b274c33f7b0c0803339b2caf6b52593321234049b36000000000e80000000020000200000007a50e2c404d35c8f58c48ef6c59ac2831cbdd2198721a92791a88f82e82582972000000051ab297663cbf322da157bff3e094ba321f2db1504309323b790629067d3c31640000000cc4f09933bc5537ab441aa55f8799883ad9899081584b597b1ab2998f6f2384231e552e347665748184c2b014255a78278c8be9ed1f6dffc5d979a3d9174db00 IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31108925" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31108925" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31108925" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3550967612" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40db68e93dafda01 IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3552529721" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31108925" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000150dfb3d7d297149b53fa5015b24f844000000000200000000001066000000010000200000006b707c2decd0b23f6dfe93499551d3c4cd070c40f2f359449ebe1b9520082f22000000000e80000000020000200000006dc0ef5b059f81eee95aa1aa124340ca570dcfaf747db58cf7d455b5fb6da4f9200000009cf3255adcf4dc13b3d712b7115d8d9d492259c473f739c356cedfbf546c4be64000000026785a97b092036f066341f89f42f80d74842b7d41915b21cf152850c9399104b04ed46d41cd354e3f1f2e0b52dbb740c4538ac32182302ce6962cda9384c6ec IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3550967612" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30966de93dafda01 IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{FF2D3AB0-1B30-11EF-B865-FE2E36E26D58} = "0" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Software\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423473247" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3552529721" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" IEXPLORE.EXE -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
1e820ed6dccf8ec6694a9113c9c173cc3a347b5c5e34c093c104da0f82f47afb.exepid process 2308 1e820ed6dccf8ec6694a9113c9c173cc3a347b5c5e34c093c104da0f82f47afb.exe 2308 1e820ed6dccf8ec6694a9113c9c173cc3a347b5c5e34c093c104da0f82f47afb.exe -
Suspicious behavior: LoadsDriver 1 IoCs
Processes:
TXPlatfor.exepid process 860 TXPlatfor.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
N.exeTXPlatfor.exedescription pid process Token: SeIncBasePriorityPrivilege 4668 N.exe Token: SeLoadDriverPrivilege 860 TXPlatfor.exe Token: 33 860 TXPlatfor.exe Token: SeIncBasePriorityPrivilege 860 TXPlatfor.exe Token: 33 860 TXPlatfor.exe Token: SeIncBasePriorityPrivilege 860 TXPlatfor.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
IEXPLORE.EXEpid process 1988 IEXPLORE.EXE -
Suspicious use of SetWindowsHookEx 8 IoCs
Processes:
1e820ed6dccf8ec6694a9113c9c173cc3a347b5c5e34c093c104da0f82f47afb.exeIEXPLORE.EXEIEXPLORE.EXEpid process 2308 1e820ed6dccf8ec6694a9113c9c173cc3a347b5c5e34c093c104da0f82f47afb.exe 2308 1e820ed6dccf8ec6694a9113c9c173cc3a347b5c5e34c093c104da0f82f47afb.exe 1988 IEXPLORE.EXE 1988 IEXPLORE.EXE 5040 IEXPLORE.EXE 5040 IEXPLORE.EXE 5040 IEXPLORE.EXE 5040 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 26 IoCs
Processes:
1e820ed6dccf8ec6694a9113c9c173cc3a347b5c5e34c093c104da0f82f47afb.exeN.exeTXPlatfor.execmd.exeHD_1e820ed6dccf8ec6694a9113c9c173cc3a347b5c5e34c093c104da0f82f47afb.exeiexplore.exeIEXPLORE.EXEdescription pid process target process PID 2308 wrote to memory of 880 2308 1e820ed6dccf8ec6694a9113c9c173cc3a347b5c5e34c093c104da0f82f47afb.exe R.exe PID 2308 wrote to memory of 880 2308 1e820ed6dccf8ec6694a9113c9c173cc3a347b5c5e34c093c104da0f82f47afb.exe R.exe PID 2308 wrote to memory of 880 2308 1e820ed6dccf8ec6694a9113c9c173cc3a347b5c5e34c093c104da0f82f47afb.exe R.exe PID 2308 wrote to memory of 4668 2308 1e820ed6dccf8ec6694a9113c9c173cc3a347b5c5e34c093c104da0f82f47afb.exe N.exe PID 2308 wrote to memory of 4668 2308 1e820ed6dccf8ec6694a9113c9c173cc3a347b5c5e34c093c104da0f82f47afb.exe N.exe PID 2308 wrote to memory of 4668 2308 1e820ed6dccf8ec6694a9113c9c173cc3a347b5c5e34c093c104da0f82f47afb.exe N.exe PID 4668 wrote to memory of 1252 4668 N.exe cmd.exe PID 4668 wrote to memory of 1252 4668 N.exe cmd.exe PID 4668 wrote to memory of 1252 4668 N.exe cmd.exe PID 2308 wrote to memory of 4952 2308 1e820ed6dccf8ec6694a9113c9c173cc3a347b5c5e34c093c104da0f82f47afb.exe HD_1e820ed6dccf8ec6694a9113c9c173cc3a347b5c5e34c093c104da0f82f47afb.exe PID 2308 wrote to memory of 4952 2308 1e820ed6dccf8ec6694a9113c9c173cc3a347b5c5e34c093c104da0f82f47afb.exe HD_1e820ed6dccf8ec6694a9113c9c173cc3a347b5c5e34c093c104da0f82f47afb.exe PID 2308 wrote to memory of 4952 2308 1e820ed6dccf8ec6694a9113c9c173cc3a347b5c5e34c093c104da0f82f47afb.exe HD_1e820ed6dccf8ec6694a9113c9c173cc3a347b5c5e34c093c104da0f82f47afb.exe PID 2356 wrote to memory of 860 2356 TXPlatfor.exe TXPlatfor.exe PID 2356 wrote to memory of 860 2356 TXPlatfor.exe TXPlatfor.exe PID 2356 wrote to memory of 860 2356 TXPlatfor.exe TXPlatfor.exe PID 1252 wrote to memory of 60 1252 cmd.exe PING.EXE PID 1252 wrote to memory of 60 1252 cmd.exe PING.EXE PID 1252 wrote to memory of 60 1252 cmd.exe PING.EXE PID 4952 wrote to memory of 4380 4952 HD_1e820ed6dccf8ec6694a9113c9c173cc3a347b5c5e34c093c104da0f82f47afb.exe iexplore.exe PID 4952 wrote to memory of 4380 4952 HD_1e820ed6dccf8ec6694a9113c9c173cc3a347b5c5e34c093c104da0f82f47afb.exe iexplore.exe PID 4952 wrote to memory of 4380 4952 HD_1e820ed6dccf8ec6694a9113c9c173cc3a347b5c5e34c093c104da0f82f47afb.exe iexplore.exe PID 4380 wrote to memory of 1988 4380 iexplore.exe IEXPLORE.EXE PID 4380 wrote to memory of 1988 4380 iexplore.exe IEXPLORE.EXE PID 1988 wrote to memory of 5040 1988 IEXPLORE.EXE IEXPLORE.EXE PID 1988 wrote to memory of 5040 1988 IEXPLORE.EXE IEXPLORE.EXE PID 1988 wrote to memory of 5040 1988 IEXPLORE.EXE IEXPLORE.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\1e820ed6dccf8ec6694a9113c9c173cc3a347b5c5e34c093c104da0f82f47afb.exe"C:\Users\Admin\AppData\Local\Temp\1e820ed6dccf8ec6694a9113c9c173cc3a347b5c5e34c093c104da0f82f47afb.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2308 -
C:\Users\Admin\AppData\Local\Temp\R.exeC:\Users\Admin\AppData\Local\Temp\\R.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:880 -
C:\Users\Admin\AppData\Local\Temp\N.exeC:\Users\Admin\AppData\Local\Temp\\N.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4668 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\N.exe > nul3⤵
- Suspicious use of WriteProcessMemory
PID:1252 -
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.14⤵
- Runs ping.exe
PID:60 -
C:\Users\Admin\AppData\Local\Temp\HD_1e820ed6dccf8ec6694a9113c9c173cc3a347b5c5e34c093c104da0f82f47afb.exeC:\Users\Admin\AppData\Local\Temp\HD_1e820ed6dccf8ec6694a9113c9c173cc3a347b5c5e34c093c104da0f82f47afb.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4952 -
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe" http://se.360.cn/3⤵
- Suspicious use of WriteProcessMemory
PID:4380 -
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE" http://se.360.cn/4⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1988 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1988 CREDAT:17410 /prefetch:25⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:5040
-
C:\Windows\SysWOW64\TXPlatfor.exeC:\Windows\SysWOW64\TXPlatfor.exe -auto1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2356 -
C:\Windows\SysWOW64\TXPlatfor.exeC:\Windows\SysWOW64\TXPlatfor.exe -acsi2⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Executes dropped EXE
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
PID:860
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776Filesize
471B
MD5c41ab5352ba79baac9ac093dd7eb2500
SHA11ffb0e70f86845daba211aeda43cad539d34ffd3
SHA256558e13bb7aa293569457e9703d2db37e8365e2ab670b2c3484ada9336ed24895
SHA512ccebe3f11039e14d39d4102652669fd372d179778bf73fae0659dd01da569bbf850b273cd3a4e13dc77b3fd4fb4d84d01525ac3a0dcb23b297c733da10bc2ff0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776Filesize
404B
MD5f03a5a029ac72270531acf572e73986f
SHA18f422006892d1483ce3566cbc223610e054a6fc8
SHA256b77a37596cac811c8a692f119586913575de24cfe1ac5ebd2dfd88cb0f8bc8f5
SHA512e8d7546fe854e8b8621527266551dba691947bc95d28c6fa3882e8edb00541081938ca689256bff1b8ca60eb9376e739bf34c6408eb1284c8bb10561b2f157ec
-
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\VersionManager\verD3DA.tmpFilesize
15KB
MD51a545d0052b581fbb2ab4c52133846bc
SHA162f3266a9b9925cd6d98658b92adec673cbe3dd3
SHA256557472aeaebf4c1c800b9df14c190f66d62cbabb011300dbedde2dcddd27a6c1
SHA512bd326d111589d87cd6d019378ec725ac9ac7ad4c36f22453941f7d52f90b747ede4783a83dfff6cae1b3bb46690ad49cffa77f2afda019b22863ac485b406e8d
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\Q7QYTB89\suggestions[1].en-USFilesize
17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
-
C:\Users\Admin\AppData\Local\Temp\HD_1e820ed6dccf8ec6694a9113c9c173cc3a347b5c5e34c093c104da0f82f47afb.exeFilesize
2.0MB
MD55ffea70baa8dff06141e3145fbf160a0
SHA1edc2213a63797297f466cdcc4a3862fc2392d649
SHA256c506e1eddacc729428a61f021faae0287471545fb32b5deb5e1d1e7f6f1f576a
SHA5125477a446ea59b56e488433fe0ee433d09d0d46b902842f4dea89d42f8e1f07c3d08737b1248aa0e3dc65f4c1700006d779ba0c79f46ade911999969b84745f52
-
C:\Users\Admin\AppData\Local\Temp\HD_X.datFilesize
2.4MB
MD5b509294fb0703bc2e35e7b20f07de7fc
SHA174b76864f3f045ed1e2742cab5d5a0aca9bb55d5
SHA256b10e20c356c254af8151a48c1d2878a227f22c5ee5d851189971215bc269fe9d
SHA5122636997a929f16cba52b0e5ee58a58d5784c4eaff8570cdf468398864fb17ab3960370c3ea540a07b876b2fcbe423d8877a0862c7a374788d5911798d86811ec
-
C:\Users\Admin\AppData\Local\Temp\N.exeFilesize
377KB
MD54a36a48e58829c22381572b2040b6fe0
SHA1f09d30e44ff7e3f20a5de307720f3ad148c6143b
SHA2563de6c02f52a661b8f934f59541d0cf297bb489eb2155e346b63c7338e09aeaf8
SHA5125d0ea398792f6b9eb3f188813c50b7f43929183b5733d2b595b2fd1c78722764fd15f62db1086b5c7edfb157661a6dcd544ddd80907ee7699dddbca1ef4022d0
-
C:\Users\Admin\AppData\Local\Temp\R.exeFilesize
941KB
MD58dc3adf1c490211971c1e2325f1424d2
SHA14eec4a4e7cb97c5efa6c72e0731cd090c0c4adc5
SHA256bc29f2022ab3b812e50c8681ff196f090c038b5ab51e37daffac4469a8c2eb2c
SHA512ae92ea20b359849dcdba4808119b154e3af5ef3687ee09de1797610fe8c4d3eb9065b068074d35adddb4b225d17c619baff3944cb137ad196bcef7a6507f920d
-
C:\Windows\SysWOW64\240599171.txtFilesize
899KB
MD57ed6705a438d63b94fd34ac929379d93
SHA1cd326d94e67699b650a536d4614b5c4b9fe7ee32
SHA256fc53dd70cfa25e4b00009198f2555c3d609368d9b965e491cb3bf7166650cb4b
SHA51296a8817369ada0dcd201d4728bc1606c6d984da2ddc817cf1f9970fefd4384c1934edd52670bcb77775163f4e1e7c8244d879a6aeb702f23cf8115983aaea90a
-
memory/860-37-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/860-42-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/860-41-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/2356-25-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/2356-31-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/2356-23-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/2356-24-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/2356-22-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/4668-15-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/4668-12-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/4668-18-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/4668-14-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB