Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
29-05-2024 16:11
Static task
static1
Behavioral task
behavioral1
Sample
5eb75eb167af4d1b5883e2938af9202594068fc92bd5cdf55e951614ecef8ae8.exe
Resource
win7-20240419-en
General
-
Target
5eb75eb167af4d1b5883e2938af9202594068fc92bd5cdf55e951614ecef8ae8.exe
-
Size
4.0MB
-
MD5
04424a5bb943a3308ebbc813a42c4af6
-
SHA1
cea9d17cd451e46e072305a2fd20f7688df41f40
-
SHA256
5eb75eb167af4d1b5883e2938af9202594068fc92bd5cdf55e951614ecef8ae8
-
SHA512
cdd54cb9e5324a3d42a342a707c4f753c5286c55879b0119e8e437bf7f36bd853275a32e33ea8b52ed46f577a48ca24ddc71e000ca2c472c5ba952bde001a31b
-
SSDEEP
49152:1CwsbCANnKXferL7Vwe/Gg0P+Wh3hqz1UnUhO3YEpjF1Zpr42KedC/:ows2ANnKXOaeOgmhoz1jqtK2Kh
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral2/memory/1420-14-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/1420-15-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/1420-18-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/3544-24-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/3544-27-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/3544-33-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/3544-23-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/5096-37-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/5096-39-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/5096-42-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit -
Gh0st RAT payload 11 IoCs
Processes:
resource yara_rule C:\Windows\SysWOW64\240596437.txt family_gh0strat behavioral2/memory/1420-14-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/1420-15-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/1420-18-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/3544-24-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/3544-27-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/3544-33-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/3544-23-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/5096-37-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/5096-39-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/5096-42-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat -
Drops file in Drivers directory 1 IoCs
Processes:
TXPlatfor.exedescription ioc process File created C:\Windows\system32\drivers\QAssist.sys TXPlatfor.exe -
Sets service image path in registry 2 TTPs 1 IoCs
Processes:
TXPlatfor.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys" TXPlatfor.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
HD_5eb75eb167af4d1b5883e2938af9202594068fc92bd5cdf55e951614ecef8ae8.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation HD_5eb75eb167af4d1b5883e2938af9202594068fc92bd5cdf55e951614ecef8ae8.exe -
Executes dropped EXE 5 IoCs
Processes:
R.exeN.exeTXPlatfor.exeHD_5eb75eb167af4d1b5883e2938af9202594068fc92bd5cdf55e951614ecef8ae8.exeTXPlatfor.exepid process 1648 R.exe 1420 N.exe 3544 TXPlatfor.exe 3844 HD_5eb75eb167af4d1b5883e2938af9202594068fc92bd5cdf55e951614ecef8ae8.exe 5096 TXPlatfor.exe -
Loads dropped DLL 1 IoCs
Processes:
R.exepid process 1648 R.exe -
Processes:
resource yara_rule behavioral2/memory/1420-12-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/1420-14-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/1420-15-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/1420-18-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/3544-21-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/3544-24-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/3544-27-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/3544-33-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/3544-23-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/5096-37-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/5096-39-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/5096-42-0x0000000010000000-0x00000000101B6000-memory.dmp upx -
Drops file in System32 directory 3 IoCs
Processes:
R.exeN.exedescription ioc process File created C:\Windows\SysWOW64\240596437.txt R.exe File created C:\Windows\SysWOW64\TXPlatfor.exe N.exe File opened for modification C:\Windows\SysWOW64\TXPlatfor.exe N.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3860 1648 WerFault.exe R.exe -
Processes:
IEXPLORE.EXEIEXPLORE.EXEdescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Software\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004f8caa1c9f4cba428e26b677a31a634000000000020000000000106600000001000020000000dbfea612a7a737da7726cee87e16ecdc67ca40a306ad6a273f508fa6ebd15cbd000000000e8000000002000020000000f5de24ff6f879b20bd785570ce8c63e667af17aec78f4f8cb560cbdd3778da7f20000000874da8ced414ea91f8ccfdc92df4c4f464982c85275c5ee250443d82183a380c40000000c8bfb89e9b6d8e0a6ef6e39fc5672f4c90141a1dc8f2cfa9d4852769e6b6d771b426e86fc19ed35a1bf68e3ad0f76e8d6dcb3e58f06b94546006dbaec58735fc IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60f2c309e3b1da01 IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50adc809e3b1da01 IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "4130681510" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004f8caa1c9f4cba428e26b677a31a634000000000020000000000106600000001000020000000383b8dcd2012c8fd93f6b67c6ee5875ded4b5675ec6a0c36666034d342a45124000000000e8000000002000020000000d6f06bab10b9bc5e6656624bb5e314a18514b0fbc28aa4b6b14af5c8eec17789200000005611542a36c5850875842c44e2312906d20ffc535390e45828df4cb05e12ecc64000000064a47b102ac71f653a99aa4b066ab998a1348f25663885057afa9ff2f0a24d1e61b02acb6785bc6decc56d4942320ace31ac5e368c01950db8a436b83fddbb08 IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{1FC8AC0C-1DD6-11EF-A2D1-620C7149A6B2} = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "4164432093" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423764071" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31109602" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31109602" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "4130681510" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "4164432093" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31109602" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31109602" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery IEXPLORE.EXE -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
5eb75eb167af4d1b5883e2938af9202594068fc92bd5cdf55e951614ecef8ae8.exepid process 4708 5eb75eb167af4d1b5883e2938af9202594068fc92bd5cdf55e951614ecef8ae8.exe 4708 5eb75eb167af4d1b5883e2938af9202594068fc92bd5cdf55e951614ecef8ae8.exe -
Suspicious behavior: LoadsDriver 1 IoCs
Processes:
TXPlatfor.exepid process 5096 TXPlatfor.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
N.exeTXPlatfor.exedescription pid process Token: SeIncBasePriorityPrivilege 1420 N.exe Token: SeLoadDriverPrivilege 5096 TXPlatfor.exe Token: 33 5096 TXPlatfor.exe Token: SeIncBasePriorityPrivilege 5096 TXPlatfor.exe Token: 33 5096 TXPlatfor.exe Token: SeIncBasePriorityPrivilege 5096 TXPlatfor.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
IEXPLORE.EXEpid process 812 IEXPLORE.EXE -
Suspicious use of SetWindowsHookEx 8 IoCs
Processes:
5eb75eb167af4d1b5883e2938af9202594068fc92bd5cdf55e951614ecef8ae8.exeIEXPLORE.EXEIEXPLORE.EXEpid process 4708 5eb75eb167af4d1b5883e2938af9202594068fc92bd5cdf55e951614ecef8ae8.exe 4708 5eb75eb167af4d1b5883e2938af9202594068fc92bd5cdf55e951614ecef8ae8.exe 812 IEXPLORE.EXE 812 IEXPLORE.EXE 4640 IEXPLORE.EXE 4640 IEXPLORE.EXE 4640 IEXPLORE.EXE 4640 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 26 IoCs
Processes:
5eb75eb167af4d1b5883e2938af9202594068fc92bd5cdf55e951614ecef8ae8.exeN.exeTXPlatfor.execmd.exeHD_5eb75eb167af4d1b5883e2938af9202594068fc92bd5cdf55e951614ecef8ae8.exeiexplore.exeIEXPLORE.EXEdescription pid process target process PID 4708 wrote to memory of 1648 4708 5eb75eb167af4d1b5883e2938af9202594068fc92bd5cdf55e951614ecef8ae8.exe R.exe PID 4708 wrote to memory of 1648 4708 5eb75eb167af4d1b5883e2938af9202594068fc92bd5cdf55e951614ecef8ae8.exe R.exe PID 4708 wrote to memory of 1648 4708 5eb75eb167af4d1b5883e2938af9202594068fc92bd5cdf55e951614ecef8ae8.exe R.exe PID 4708 wrote to memory of 1420 4708 5eb75eb167af4d1b5883e2938af9202594068fc92bd5cdf55e951614ecef8ae8.exe N.exe PID 4708 wrote to memory of 1420 4708 5eb75eb167af4d1b5883e2938af9202594068fc92bd5cdf55e951614ecef8ae8.exe N.exe PID 4708 wrote to memory of 1420 4708 5eb75eb167af4d1b5883e2938af9202594068fc92bd5cdf55e951614ecef8ae8.exe N.exe PID 1420 wrote to memory of 3084 1420 N.exe cmd.exe PID 1420 wrote to memory of 3084 1420 N.exe cmd.exe PID 1420 wrote to memory of 3084 1420 N.exe cmd.exe PID 4708 wrote to memory of 3844 4708 5eb75eb167af4d1b5883e2938af9202594068fc92bd5cdf55e951614ecef8ae8.exe HD_5eb75eb167af4d1b5883e2938af9202594068fc92bd5cdf55e951614ecef8ae8.exe PID 4708 wrote to memory of 3844 4708 5eb75eb167af4d1b5883e2938af9202594068fc92bd5cdf55e951614ecef8ae8.exe HD_5eb75eb167af4d1b5883e2938af9202594068fc92bd5cdf55e951614ecef8ae8.exe PID 4708 wrote to memory of 3844 4708 5eb75eb167af4d1b5883e2938af9202594068fc92bd5cdf55e951614ecef8ae8.exe HD_5eb75eb167af4d1b5883e2938af9202594068fc92bd5cdf55e951614ecef8ae8.exe PID 3544 wrote to memory of 5096 3544 TXPlatfor.exe TXPlatfor.exe PID 3544 wrote to memory of 5096 3544 TXPlatfor.exe TXPlatfor.exe PID 3544 wrote to memory of 5096 3544 TXPlatfor.exe TXPlatfor.exe PID 3084 wrote to memory of 976 3084 cmd.exe PING.EXE PID 3084 wrote to memory of 976 3084 cmd.exe PING.EXE PID 3084 wrote to memory of 976 3084 cmd.exe PING.EXE PID 3844 wrote to memory of 2532 3844 HD_5eb75eb167af4d1b5883e2938af9202594068fc92bd5cdf55e951614ecef8ae8.exe iexplore.exe PID 3844 wrote to memory of 2532 3844 HD_5eb75eb167af4d1b5883e2938af9202594068fc92bd5cdf55e951614ecef8ae8.exe iexplore.exe PID 3844 wrote to memory of 2532 3844 HD_5eb75eb167af4d1b5883e2938af9202594068fc92bd5cdf55e951614ecef8ae8.exe iexplore.exe PID 2532 wrote to memory of 812 2532 iexplore.exe IEXPLORE.EXE PID 2532 wrote to memory of 812 2532 iexplore.exe IEXPLORE.EXE PID 812 wrote to memory of 4640 812 IEXPLORE.EXE IEXPLORE.EXE PID 812 wrote to memory of 4640 812 IEXPLORE.EXE IEXPLORE.EXE PID 812 wrote to memory of 4640 812 IEXPLORE.EXE IEXPLORE.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\5eb75eb167af4d1b5883e2938af9202594068fc92bd5cdf55e951614ecef8ae8.exe"C:\Users\Admin\AppData\Local\Temp\5eb75eb167af4d1b5883e2938af9202594068fc92bd5cdf55e951614ecef8ae8.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\R.exeC:\Users\Admin\AppData\Local\Temp\\R.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1648 -s 4483⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\N.exeC:\Users\Admin\AppData\Local\Temp\\N.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\N.exe > nul3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.14⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Local\Temp\HD_5eb75eb167af4d1b5883e2938af9202594068fc92bd5cdf55e951614ecef8ae8.exeC:\Users\Admin\AppData\Local\Temp\HD_5eb75eb167af4d1b5883e2938af9202594068fc92bd5cdf55e951614ecef8ae8.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe" http://se.360.cn/3⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE" http://se.360.cn/4⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:812 CREDAT:17410 /prefetch:25⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1648 -ip 16481⤵
-
C:\Windows\SysWOW64\TXPlatfor.exeC:\Windows\SysWOW64\TXPlatfor.exe -auto1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\TXPlatfor.exeC:\Windows\SysWOW64\TXPlatfor.exe -acsi2⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Executes dropped EXE
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776Filesize
471B
MD5a78885dc856faeb57c7549a4b25d6a6a
SHA162cd1234f65a694281b47fb54f6aeb300d023093
SHA256d586a36a410c287a57fb08f3e0e137f7fa66a303aaa86396c72b81f6abad2c63
SHA512f41c11f88c04a6f3c8fa528c199790ed701d4f5577820881d29d78f239d03171962942deaa8e53320d83784d77a013d243f84b8f4bcd47fb97e056a197f2093b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776Filesize
404B
MD5627d66bdc4801d57b692873de12f2875
SHA18dc1d7a0a4de3498e86c01e90fa1511a415e6d7e
SHA256645050055b9bdafc47a28aef274db47cc1755a4e9fcf1875d099b90c48d7d23f
SHA512f4b9bd1c845354907a9e3243a5317ad312e43abfece7336f070465aed64f6bbb214959423538c032c01d7157cb558d9e1e1c8b0380819d08a339fba4e4d419d3
-
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\VersionManager\verD09E.tmpFilesize
15KB
MD51a545d0052b581fbb2ab4c52133846bc
SHA162f3266a9b9925cd6d98658b92adec673cbe3dd3
SHA256557472aeaebf4c1c800b9df14c190f66d62cbabb011300dbedde2dcddd27a6c1
SHA512bd326d111589d87cd6d019378ec725ac9ac7ad4c36f22453941f7d52f90b747ede4783a83dfff6cae1b3bb46690ad49cffa77f2afda019b22863ac485b406e8d
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\Z5ILU938\suggestions[1].en-USFilesize
17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
-
C:\Users\Admin\AppData\Local\Temp\HD_5eb75eb167af4d1b5883e2938af9202594068fc92bd5cdf55e951614ecef8ae8.exeFilesize
1.1MB
MD545ebd25a2158aed5d54f1164c964c860
SHA115b6b76c2853b8309e2b2182bb02b42c8c1e9371
SHA25622b1e9dd9ec5a056817f425234674aa961a649758f13308a698a4c92854ce4c3
SHA51216cfdaa5d59d73f7cdd58f621b68b4b22d775b556194f40aa04c99c8798eddc5dbefe844ea3c161c0e188de2143f9c16764011ac68efcfb0d658e84d3cbb0419
-
C:\Users\Admin\AppData\Local\Temp\HD_X.datFilesize
2.9MB
MD5b7ab7ab6b9c445db7a50620450970f77
SHA1683a231521d6dd10664aec1b70f182065d24aef7
SHA25604bf4712a8fbde15c7aab1397dbf6bda316d2221b5eaabaa1aadc31df52444bb
SHA5122771b164a5598d5f7cbc85ad2baae18b2a4b7bda9ad77194c304dc39ec38ba00e810c71820d1508743182eb33a36aa99474e897ba34050b20c29ccc8e5f5197b
-
C:\Users\Admin\AppData\Local\Temp\N.exeFilesize
377KB
MD54a36a48e58829c22381572b2040b6fe0
SHA1f09d30e44ff7e3f20a5de307720f3ad148c6143b
SHA2563de6c02f52a661b8f934f59541d0cf297bb489eb2155e346b63c7338e09aeaf8
SHA5125d0ea398792f6b9eb3f188813c50b7f43929183b5733d2b595b2fd1c78722764fd15f62db1086b5c7edfb157661a6dcd544ddd80907ee7699dddbca1ef4022d0
-
C:\Users\Admin\AppData\Local\Temp\R.exeFilesize
941KB
MD58dc3adf1c490211971c1e2325f1424d2
SHA14eec4a4e7cb97c5efa6c72e0731cd090c0c4adc5
SHA256bc29f2022ab3b812e50c8681ff196f090c038b5ab51e37daffac4469a8c2eb2c
SHA512ae92ea20b359849dcdba4808119b154e3af5ef3687ee09de1797610fe8c4d3eb9065b068074d35adddb4b225d17c619baff3944cb137ad196bcef7a6507f920d
-
C:\Windows\SysWOW64\240596437.txtFilesize
899KB
MD50ea572dddfbad4b1571d9303ff0c3b19
SHA10cbffaa84db8c9c1c739a032378b2e6995fcaa0c
SHA256fb70755ccf0eec39694f2a60326c7150cd4cdb69065025758ed1a1cb26856c83
SHA5122284ad9ad65d049e2035c9342a06c4c87a6f0213b14a2ffe5b2189bb72fcfca34f0d831dda8539b2df41d0bc88f85771c07ca8e155a114a39f3caa1c0d6c4a5c
-
memory/1420-15-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/1420-18-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/1420-14-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/1420-12-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/3544-27-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/3544-33-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/3544-23-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/3544-24-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/3544-21-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/5096-37-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/5096-39-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/5096-42-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB