Malware Analysis Report

2025-03-15 00:31

Sample ID 240603-2egzgabd3s
Target 1907c3dcacbab77141e45cd1bb6d22ec2ebc71e04799aa7ce7bb9b4868bb53cf
SHA256 1907c3dcacbab77141e45cd1bb6d22ec2ebc71e04799aa7ce7bb9b4868bb53cf
Tags
persistence
score
7/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
7/10

SHA256

1907c3dcacbab77141e45cd1bb6d22ec2ebc71e04799aa7ce7bb9b4868bb53cf

Threat Level: Shows suspicious behavior

The file 1907c3dcacbab77141e45cd1bb6d22ec2ebc71e04799aa7ce7bb9b4868bb53cf was found to be: Shows suspicious behavior.

Malicious Activity Summary

persistence

Executes dropped EXE

Modifies system executable filetype association

Loads dropped DLL

Drops file in System32 directory

Drops file in Windows directory

Unsigned PE

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Modifies registry class

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of SetWindowsHookEx

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-03 22:29

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-03 22:29

Reported

2024-06-03 22:32

Platform

win7-20240508-en

Max time kernel

149s

Max time network

126s

Command Line

"C:\Users\Admin\AppData\Local\Temp\1907c3dcacbab77141e45cd1bb6d22ec2ebc71e04799aa7ce7bb9b4868bb53cf.exe"

Signatures

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\system\rundll32.exe N/A

Modifies system executable filetype association

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command C:\Users\Admin\AppData\Local\Temp\1907c3dcacbab77141e45cd1bb6d22ec2ebc71e04799aa7ce7bb9b4868bb53cf.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" C:\Users\Admin\AppData\Local\Temp\1907c3dcacbab77141e45cd1bb6d22ec2ebc71e04799aa7ce7bb9b4868bb53cf.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" C:\Users\Admin\AppData\Local\Temp\1907c3dcacbab77141e45cd1bb6d22ec2ebc71e04799aa7ce7bb9b4868bb53cf.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command C:\Windows\system\rundll32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" C:\Windows\system\rundll32.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\¢«.exe C:\Users\Admin\AppData\Local\Temp\1907c3dcacbab77141e45cd1bb6d22ec2ebc71e04799aa7ce7bb9b4868bb53cf.exe N/A
File created C:\Windows\SysWOW64\¢«.exe C:\Users\Admin\AppData\Local\Temp\1907c3dcacbab77141e45cd1bb6d22ec2ebc71e04799aa7ce7bb9b4868bb53cf.exe N/A
File opened for modification C:\Windows\SysWOW64\notepad¢¬.exe C:\Users\Admin\AppData\Local\Temp\1907c3dcacbab77141e45cd1bb6d22ec2ebc71e04799aa7ce7bb9b4868bb53cf.exe N/A
File created C:\Windows\SysWOW64\notepad¢¬.exe C:\Users\Admin\AppData\Local\Temp\1907c3dcacbab77141e45cd1bb6d22ec2ebc71e04799aa7ce7bb9b4868bb53cf.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\system\rundll32.exe C:\Users\Admin\AppData\Local\Temp\1907c3dcacbab77141e45cd1bb6d22ec2ebc71e04799aa7ce7bb9b4868bb53cf.exe N/A
File created C:\Windows\system\rundll32.exe C:\Users\Admin\AppData\Local\Temp\1907c3dcacbab77141e45cd1bb6d22ec2ebc71e04799aa7ce7bb9b4868bb53cf.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\Software\Classes\MSipv C:\Users\Admin\AppData\Local\Temp\1907c3dcacbab77141e45cd1bb6d22ec2ebc71e04799aa7ce7bb9b4868bb53cf.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\txtfile\shell\open\command C:\Users\Admin\AppData\Local\Temp\1907c3dcacbab77141e45cd1bb6d22ec2ebc71e04799aa7ce7bb9b4868bb53cf.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "notepad¢¬ %1" C:\Users\Admin\AppData\Local\Temp\1907c3dcacbab77141e45cd1bb6d22ec2ebc71e04799aa7ce7bb9b4868bb53cf.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" C:\Windows\system\rundll32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" C:\Users\Admin\AppData\Local\Temp\1907c3dcacbab77141e45cd1bb6d22ec2ebc71e04799aa7ce7bb9b4868bb53cf.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\MSipv\MainVer = "506" C:\Windows\system\rundll32.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command C:\Windows\system\rundll32.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\txtfile\shell\open\command C:\Windows\system\rundll32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "notepad¢¬ %1" C:\Windows\system\rundll32.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command C:\Users\Admin\AppData\Local\Temp\1907c3dcacbab77141e45cd1bb6d22ec2ebc71e04799aa7ce7bb9b4868bb53cf.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\MSipv C:\Windows\system\rundll32.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\MSipv\MainSetup = "1717453778" C:\Windows\system\rundll32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "notepad.exe %1" C:\Users\Admin\AppData\Local\Temp\1907c3dcacbab77141e45cd1bb6d22ec2ebc71e04799aa7ce7bb9b4868bb53cf.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" C:\Users\Admin\AppData\Local\Temp\1907c3dcacbab77141e45cd1bb6d22ec2ebc71e04799aa7ce7bb9b4868bb53cf.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\MSipv\MainUp = "1717453778" C:\Windows\system\rundll32.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\1907c3dcacbab77141e45cd1bb6d22ec2ebc71e04799aa7ce7bb9b4868bb53cf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1907c3dcacbab77141e45cd1bb6d22ec2ebc71e04799aa7ce7bb9b4868bb53cf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1907c3dcacbab77141e45cd1bb6d22ec2ebc71e04799aa7ce7bb9b4868bb53cf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1907c3dcacbab77141e45cd1bb6d22ec2ebc71e04799aa7ce7bb9b4868bb53cf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1907c3dcacbab77141e45cd1bb6d22ec2ebc71e04799aa7ce7bb9b4868bb53cf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1907c3dcacbab77141e45cd1bb6d22ec2ebc71e04799aa7ce7bb9b4868bb53cf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1907c3dcacbab77141e45cd1bb6d22ec2ebc71e04799aa7ce7bb9b4868bb53cf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1907c3dcacbab77141e45cd1bb6d22ec2ebc71e04799aa7ce7bb9b4868bb53cf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1907c3dcacbab77141e45cd1bb6d22ec2ebc71e04799aa7ce7bb9b4868bb53cf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1907c3dcacbab77141e45cd1bb6d22ec2ebc71e04799aa7ce7bb9b4868bb53cf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1907c3dcacbab77141e45cd1bb6d22ec2ebc71e04799aa7ce7bb9b4868bb53cf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1907c3dcacbab77141e45cd1bb6d22ec2ebc71e04799aa7ce7bb9b4868bb53cf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1907c3dcacbab77141e45cd1bb6d22ec2ebc71e04799aa7ce7bb9b4868bb53cf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1907c3dcacbab77141e45cd1bb6d22ec2ebc71e04799aa7ce7bb9b4868bb53cf.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Windows\system\rundll32.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\1907c3dcacbab77141e45cd1bb6d22ec2ebc71e04799aa7ce7bb9b4868bb53cf.exe

"C:\Users\Admin\AppData\Local\Temp\1907c3dcacbab77141e45cd1bb6d22ec2ebc71e04799aa7ce7bb9b4868bb53cf.exe"

C:\Windows\system\rundll32.exe

C:\Windows\system\rundll32.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 www.zigui.org udp
HK 103.251.237.123:80 www.zigui.org tcp

Files

memory/1252-0-0x0000000000400000-0x0000000000415A00-memory.dmp

C:\Windows\SysWOW64\notepad¢¬.exe

MD5 32f7be798e77fffa066790af9ee9579d
SHA1 89c416f346b2ce2430db60ff41e27042bf5b9420
SHA256 a6496af4f365b9448591113cf1e7321b4830f4b138d5b285c4a5a4fc7d7195c5
SHA512 fd7c5e191b7a986f4c109064a9a6d44dfdfaffedc184b82ceb3ac884a948c24a1a1b67b0f6fc3e166e1512e145652be6313665dc722b70b934c4ac3300cd6c89

memory/1252-12-0x0000000000270000-0x0000000000286000-memory.dmp

\Windows\system\rundll32.exe

MD5 f5303973b55d49f4b04699f21b78d053
SHA1 97ece96bd954d61aa3c19ae1410549fadc2a83ef
SHA256 687d3cc883e1780594eb4117c95b0eb753c33e875dbd0d5a5b1e14a52361fa1a
SHA512 38c9a1d05cb1d1c9028b3f142dd921858b9f2f474d9ea2e2630e6f7868a221fe0239445b12c6ce5c98178f9690dd1a3691c5bcd1b65a551f4f7ea87f7a01dd86

memory/2092-19-0x0000000000400000-0x0000000000415A00-memory.dmp

memory/1252-18-0x0000000000270000-0x0000000000286000-memory.dmp

memory/1252-21-0x0000000000400000-0x0000000000415A00-memory.dmp

memory/1252-22-0x0000000000270000-0x0000000000272000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-03 22:29

Reported

2024-06-03 22:32

Platform

win10v2004-20240426-en

Max time kernel

150s

Max time network

96s

Command Line

"C:\Users\Admin\AppData\Local\Temp\1907c3dcacbab77141e45cd1bb6d22ec2ebc71e04799aa7ce7bb9b4868bb53cf.exe"

Signatures

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\system\rundll32.exe N/A

Modifies system executable filetype association

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command C:\Users\Admin\AppData\Local\Temp\1907c3dcacbab77141e45cd1bb6d22ec2ebc71e04799aa7ce7bb9b4868bb53cf.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" C:\Users\Admin\AppData\Local\Temp\1907c3dcacbab77141e45cd1bb6d22ec2ebc71e04799aa7ce7bb9b4868bb53cf.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" C:\Users\Admin\AppData\Local\Temp\1907c3dcacbab77141e45cd1bb6d22ec2ebc71e04799aa7ce7bb9b4868bb53cf.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command C:\Windows\system\rundll32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" C:\Windows\system\rundll32.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\¢«.exe C:\Users\Admin\AppData\Local\Temp\1907c3dcacbab77141e45cd1bb6d22ec2ebc71e04799aa7ce7bb9b4868bb53cf.exe N/A
File created C:\Windows\SysWOW64\¢«.exe C:\Users\Admin\AppData\Local\Temp\1907c3dcacbab77141e45cd1bb6d22ec2ebc71e04799aa7ce7bb9b4868bb53cf.exe N/A
File opened for modification C:\Windows\SysWOW64\notepad¢¬.exe C:\Users\Admin\AppData\Local\Temp\1907c3dcacbab77141e45cd1bb6d22ec2ebc71e04799aa7ce7bb9b4868bb53cf.exe N/A
File created C:\Windows\SysWOW64\notepad¢¬.exe C:\Users\Admin\AppData\Local\Temp\1907c3dcacbab77141e45cd1bb6d22ec2ebc71e04799aa7ce7bb9b4868bb53cf.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\system\rundll32.exe C:\Users\Admin\AppData\Local\Temp\1907c3dcacbab77141e45cd1bb6d22ec2ebc71e04799aa7ce7bb9b4868bb53cf.exe N/A
File created C:\Windows\system\rundll32.exe C:\Users\Admin\AppData\Local\Temp\1907c3dcacbab77141e45cd1bb6d22ec2ebc71e04799aa7ce7bb9b4868bb53cf.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command C:\Windows\system\rundll32.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\txtfile\shell\open\command C:\Windows\system\rundll32.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\MSipv C:\Users\Admin\AppData\Local\Temp\1907c3dcacbab77141e45cd1bb6d22ec2ebc71e04799aa7ce7bb9b4868bb53cf.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" C:\Users\Admin\AppData\Local\Temp\1907c3dcacbab77141e45cd1bb6d22ec2ebc71e04799aa7ce7bb9b4868bb53cf.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\MSipv\MainUp = "1717453777" C:\Windows\system\rundll32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" C:\Windows\system\rundll32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "notepad¢¬ %1" C:\Windows\system\rundll32.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command C:\Users\Admin\AppData\Local\Temp\1907c3dcacbab77141e45cd1bb6d22ec2ebc71e04799aa7ce7bb9b4868bb53cf.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" C:\Users\Admin\AppData\Local\Temp\1907c3dcacbab77141e45cd1bb6d22ec2ebc71e04799aa7ce7bb9b4868bb53cf.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "notepad¢¬ %1" C:\Users\Admin\AppData\Local\Temp\1907c3dcacbab77141e45cd1bb6d22ec2ebc71e04799aa7ce7bb9b4868bb53cf.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\MSipv\MainVer = "506" C:\Windows\system\rundll32.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\txtfile\shell\open\command C:\Users\Admin\AppData\Local\Temp\1907c3dcacbab77141e45cd1bb6d22ec2ebc71e04799aa7ce7bb9b4868bb53cf.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "notepad.exe %1" C:\Users\Admin\AppData\Local\Temp\1907c3dcacbab77141e45cd1bb6d22ec2ebc71e04799aa7ce7bb9b4868bb53cf.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\MSipv C:\Windows\system\rundll32.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\MSipv\MainSetup = "1717453777" C:\Windows\system\rundll32.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\1907c3dcacbab77141e45cd1bb6d22ec2ebc71e04799aa7ce7bb9b4868bb53cf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1907c3dcacbab77141e45cd1bb6d22ec2ebc71e04799aa7ce7bb9b4868bb53cf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1907c3dcacbab77141e45cd1bb6d22ec2ebc71e04799aa7ce7bb9b4868bb53cf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1907c3dcacbab77141e45cd1bb6d22ec2ebc71e04799aa7ce7bb9b4868bb53cf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1907c3dcacbab77141e45cd1bb6d22ec2ebc71e04799aa7ce7bb9b4868bb53cf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1907c3dcacbab77141e45cd1bb6d22ec2ebc71e04799aa7ce7bb9b4868bb53cf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1907c3dcacbab77141e45cd1bb6d22ec2ebc71e04799aa7ce7bb9b4868bb53cf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1907c3dcacbab77141e45cd1bb6d22ec2ebc71e04799aa7ce7bb9b4868bb53cf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1907c3dcacbab77141e45cd1bb6d22ec2ebc71e04799aa7ce7bb9b4868bb53cf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1907c3dcacbab77141e45cd1bb6d22ec2ebc71e04799aa7ce7bb9b4868bb53cf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1907c3dcacbab77141e45cd1bb6d22ec2ebc71e04799aa7ce7bb9b4868bb53cf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1907c3dcacbab77141e45cd1bb6d22ec2ebc71e04799aa7ce7bb9b4868bb53cf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1907c3dcacbab77141e45cd1bb6d22ec2ebc71e04799aa7ce7bb9b4868bb53cf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1907c3dcacbab77141e45cd1bb6d22ec2ebc71e04799aa7ce7bb9b4868bb53cf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1907c3dcacbab77141e45cd1bb6d22ec2ebc71e04799aa7ce7bb9b4868bb53cf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1907c3dcacbab77141e45cd1bb6d22ec2ebc71e04799aa7ce7bb9b4868bb53cf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1907c3dcacbab77141e45cd1bb6d22ec2ebc71e04799aa7ce7bb9b4868bb53cf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1907c3dcacbab77141e45cd1bb6d22ec2ebc71e04799aa7ce7bb9b4868bb53cf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1907c3dcacbab77141e45cd1bb6d22ec2ebc71e04799aa7ce7bb9b4868bb53cf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1907c3dcacbab77141e45cd1bb6d22ec2ebc71e04799aa7ce7bb9b4868bb53cf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1907c3dcacbab77141e45cd1bb6d22ec2ebc71e04799aa7ce7bb9b4868bb53cf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1907c3dcacbab77141e45cd1bb6d22ec2ebc71e04799aa7ce7bb9b4868bb53cf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1907c3dcacbab77141e45cd1bb6d22ec2ebc71e04799aa7ce7bb9b4868bb53cf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1907c3dcacbab77141e45cd1bb6d22ec2ebc71e04799aa7ce7bb9b4868bb53cf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1907c3dcacbab77141e45cd1bb6d22ec2ebc71e04799aa7ce7bb9b4868bb53cf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1907c3dcacbab77141e45cd1bb6d22ec2ebc71e04799aa7ce7bb9b4868bb53cf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1907c3dcacbab77141e45cd1bb6d22ec2ebc71e04799aa7ce7bb9b4868bb53cf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1907c3dcacbab77141e45cd1bb6d22ec2ebc71e04799aa7ce7bb9b4868bb53cf.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Windows\system\rundll32.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\1907c3dcacbab77141e45cd1bb6d22ec2ebc71e04799aa7ce7bb9b4868bb53cf.exe

"C:\Users\Admin\AppData\Local\Temp\1907c3dcacbab77141e45cd1bb6d22ec2ebc71e04799aa7ce7bb9b4868bb53cf.exe"

C:\Windows\system\rundll32.exe

C:\Windows\system\rundll32.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 www.zigui.org udp
HK 103.251.237.123:80 www.zigui.org tcp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 249.197.17.2.in-addr.arpa udp
US 8.8.8.8:53 75.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 240.197.17.2.in-addr.arpa udp
US 8.8.8.8:53 22.236.111.52.in-addr.arpa udp

Files

memory/1660-0-0x0000000000400000-0x0000000000415A00-memory.dmp

C:\Windows\SysWOW64\notepad¢¬.exe

MD5 413aa2ef613e0c47937a8f5d9fc22ad3
SHA1 0a8e7b33a50c2119f2be2228cadd7bd707a75269
SHA256 a2958cf8e689a3c9fb20224f5aa175f54107c38f38e33f8633bcb400df5b7949
SHA512 3611bbd0713ceefbb698f1b9d5f97ed8a6bb9875285d64761e2b8bb04328d390ca921487e88585f750a60f272f7c6f7d4f27e1d4741fd7f544fc6645cc82102f

C:\Windows\System\rundll32.exe

MD5 94cb523d6ecc14b99325f7e9d219e101
SHA1 3fde8d4ad01e2d999ee2a9aca416efce445adc08
SHA256 9e79d898a08d2cd1ae6a73f745c8216cc0b0d77a46ea3476c8bbe0b3f3d45186
SHA512 c03ef53cd6a4bf6f57bb2a54513c907180e3a9e1401d8e7ade3dc2bbcedc696f75a7cfb8cbd03582f64148c0c70dd821caa948a4a159d5796d00068ca11f0535

memory/1660-13-0x0000000000400000-0x0000000000415A00-memory.dmp