Analysis
-
max time kernel
141s -
max time network
135s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
19/06/2024, 21:07
Behavioral task
behavioral1
Sample
43bf73e410e3b06f7aaf6e58e34e67371509963938f154585747faeef42c248c.exe
Resource
win7-20240221-en
windows7-x64
17 signatures
150 seconds
Behavioral task
behavioral2
Sample
43bf73e410e3b06f7aaf6e58e34e67371509963938f154585747faeef42c248c.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
17 signatures
150 seconds
General
-
Target
43bf73e410e3b06f7aaf6e58e34e67371509963938f154585747faeef42c248c.exe
-
Size
336KB
-
MD5
986125409916faea3e1e3cb81df08b1f
-
SHA1
1da335b4d05e55d038ce30b7abdf110ecd0d8145
-
SHA256
43bf73e410e3b06f7aaf6e58e34e67371509963938f154585747faeef42c248c
-
SHA512
ef0585ed5fbe4e5e1bb8e6cc29205329f6450fdc8a2ac016eedf01c09c0bd97156950c6d4ff22fd516128c7bdd15d2c6ceab7cfdc1041a0e231e4e13f0b0b324
-
SSDEEP
6144:vYZTNk3D6LyUXwLLk+cR3qh0GQ43VJRD0ew+/UO:vSNC80I+cR3R03VseuO
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe gphone.exe" 43bf73e410e3b06f7aaf6e58e34e67371509963938f154585747faeef42c248c.exe -
UPX dump on OEP (original entry point) 12 IoCs
resource yara_rule behavioral2/memory/3340-0-0x0000000000400000-0x00000000004B5000-memory.dmp UPX behavioral2/files/0x00080000000235f7-10.dat UPX behavioral2/memory/3340-30-0x0000000000400000-0x00000000004B5000-memory.dmp UPX behavioral2/memory/3340-31-0x0000000000400000-0x00000000004B5000-memory.dmp UPX behavioral2/memory/3340-32-0x0000000000400000-0x00000000004B5000-memory.dmp UPX behavioral2/memory/3340-33-0x0000000000400000-0x00000000004B5000-memory.dmp UPX behavioral2/memory/3340-37-0x0000000000400000-0x00000000004B5000-memory.dmp UPX behavioral2/memory/3340-38-0x0000000000400000-0x00000000004B5000-memory.dmp UPX behavioral2/memory/3340-39-0x0000000000400000-0x00000000004B5000-memory.dmp UPX behavioral2/memory/3340-42-0x0000000000400000-0x00000000004B5000-memory.dmp UPX behavioral2/memory/3340-43-0x0000000000400000-0x00000000004B5000-memory.dmp UPX behavioral2/memory/3340-44-0x0000000000400000-0x00000000004B5000-memory.dmp UPX -
Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" 43bf73e410e3b06f7aaf6e58e34e67371509963938f154585747faeef42c248c.exe -
Disables Task Manager via registry modification
-
resource yara_rule behavioral2/memory/3340-0-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/files/0x00080000000235f7-10.dat upx behavioral2/memory/3340-30-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/3340-31-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/3340-32-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/3340-33-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/3340-37-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/3340-38-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/3340-39-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/3340-42-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/3340-43-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/3340-44-0x0000000000400000-0x00000000004B5000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Yahoo Messengger = "C:\\Windows\\system32\\gphone.exe" 43bf73e410e3b06f7aaf6e58e34e67371509963938f154585747faeef42c248c.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\p: 43bf73e410e3b06f7aaf6e58e34e67371509963938f154585747faeef42c248c.exe File opened (read-only) \??\q: 43bf73e410e3b06f7aaf6e58e34e67371509963938f154585747faeef42c248c.exe File opened (read-only) \??\r: 43bf73e410e3b06f7aaf6e58e34e67371509963938f154585747faeef42c248c.exe File opened (read-only) \??\v: 43bf73e410e3b06f7aaf6e58e34e67371509963938f154585747faeef42c248c.exe File opened (read-only) \??\i: 43bf73e410e3b06f7aaf6e58e34e67371509963938f154585747faeef42c248c.exe File opened (read-only) \??\j: 43bf73e410e3b06f7aaf6e58e34e67371509963938f154585747faeef42c248c.exe File opened (read-only) \??\l: 43bf73e410e3b06f7aaf6e58e34e67371509963938f154585747faeef42c248c.exe File opened (read-only) \??\n: 43bf73e410e3b06f7aaf6e58e34e67371509963938f154585747faeef42c248c.exe File opened (read-only) \??\y: 43bf73e410e3b06f7aaf6e58e34e67371509963938f154585747faeef42c248c.exe File opened (read-only) \??\z: 43bf73e410e3b06f7aaf6e58e34e67371509963938f154585747faeef42c248c.exe File opened (read-only) \??\a: 43bf73e410e3b06f7aaf6e58e34e67371509963938f154585747faeef42c248c.exe File opened (read-only) \??\o: 43bf73e410e3b06f7aaf6e58e34e67371509963938f154585747faeef42c248c.exe File opened (read-only) \??\x: 43bf73e410e3b06f7aaf6e58e34e67371509963938f154585747faeef42c248c.exe File opened (read-only) \??\b: 43bf73e410e3b06f7aaf6e58e34e67371509963938f154585747faeef42c248c.exe File opened (read-only) \??\h: 43bf73e410e3b06f7aaf6e58e34e67371509963938f154585747faeef42c248c.exe File opened (read-only) \??\t: 43bf73e410e3b06f7aaf6e58e34e67371509963938f154585747faeef42c248c.exe File opened (read-only) \??\s: 43bf73e410e3b06f7aaf6e58e34e67371509963938f154585747faeef42c248c.exe File opened (read-only) \??\u: 43bf73e410e3b06f7aaf6e58e34e67371509963938f154585747faeef42c248c.exe File opened (read-only) \??\w: 43bf73e410e3b06f7aaf6e58e34e67371509963938f154585747faeef42c248c.exe File opened (read-only) \??\e: 43bf73e410e3b06f7aaf6e58e34e67371509963938f154585747faeef42c248c.exe File opened (read-only) \??\g: 43bf73e410e3b06f7aaf6e58e34e67371509963938f154585747faeef42c248c.exe File opened (read-only) \??\k: 43bf73e410e3b06f7aaf6e58e34e67371509963938f154585747faeef42c248c.exe File opened (read-only) \??\m: 43bf73e410e3b06f7aaf6e58e34e67371509963938f154585747faeef42c248c.exe -
AutoIT Executable 10 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/3340-30-0x0000000000400000-0x00000000004B5000-memory.dmp autoit_exe behavioral2/memory/3340-31-0x0000000000400000-0x00000000004B5000-memory.dmp autoit_exe behavioral2/memory/3340-32-0x0000000000400000-0x00000000004B5000-memory.dmp autoit_exe behavioral2/memory/3340-33-0x0000000000400000-0x00000000004B5000-memory.dmp autoit_exe behavioral2/memory/3340-37-0x0000000000400000-0x00000000004B5000-memory.dmp autoit_exe behavioral2/memory/3340-38-0x0000000000400000-0x00000000004B5000-memory.dmp autoit_exe behavioral2/memory/3340-39-0x0000000000400000-0x00000000004B5000-memory.dmp autoit_exe behavioral2/memory/3340-42-0x0000000000400000-0x00000000004B5000-memory.dmp autoit_exe behavioral2/memory/3340-43-0x0000000000400000-0x00000000004B5000-memory.dmp autoit_exe behavioral2/memory/3340-44-0x0000000000400000-0x00000000004B5000-memory.dmp autoit_exe -
Drops autorun.inf file 1 TTPs 3 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification F:\\autorun.inf 43bf73e410e3b06f7aaf6e58e34e67371509963938f154585747faeef42c248c.exe File created \??\d:\autorun.inf 43bf73e410e3b06f7aaf6e58e34e67371509963938f154585747faeef42c248c.exe File created \??\f:\autorun.inf 43bf73e410e3b06f7aaf6e58e34e67371509963938f154585747faeef42c248c.exe -
Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\SysWOW64\gphone.exe 43bf73e410e3b06f7aaf6e58e34e67371509963938f154585747faeef42c248c.exe File opened for modification C:\Windows\SysWOW64\gphone.exe 43bf73e410e3b06f7aaf6e58e34e67371509963938f154585747faeef42c248c.exe File opened for modification C:\Windows\SysWOW64\autorun.ini 43bf73e410e3b06f7aaf6e58e34e67371509963938f154585747faeef42c248c.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\gphone.exe 43bf73e410e3b06f7aaf6e58e34e67371509963938f154585747faeef42c248c.exe File opened for modification C:\Windows\gphone.exe 43bf73e410e3b06f7aaf6e58e34e67371509963938f154585747faeef42c248c.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Software\Microsoft\Internet Explorer\Main 43bf73e410e3b06f7aaf6e58e34e67371509963938f154585747faeef42c248c.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main 43bf73e410e3b06f7aaf6e58e34e67371509963938f154585747faeef42c248c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Default_Page_URL = "http://googleinindia.blogspot.com" 43bf73e410e3b06f7aaf6e58e34e67371509963938f154585747faeef42c248c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Default_Search_URL = "http://googleinindia.blogspot.com" 43bf73e410e3b06f7aaf6e58e34e67371509963938f154585747faeef42c248c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Search Page = "http://googleinindia.blogspot.com" 43bf73e410e3b06f7aaf6e58e34e67371509963938f154585747faeef42c248c.exe -
Modifies Internet Explorer start page 1 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Start Page = "http://googleinindia.blogspot.com" 43bf73e410e3b06f7aaf6e58e34e67371509963938f154585747faeef42c248c.exe Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://googleinindia.blogspot.com" 43bf73e410e3b06f7aaf6e58e34e67371509963938f154585747faeef42c248c.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3340 43bf73e410e3b06f7aaf6e58e34e67371509963938f154585747faeef42c248c.exe 3340 43bf73e410e3b06f7aaf6e58e34e67371509963938f154585747faeef42c248c.exe 3340 43bf73e410e3b06f7aaf6e58e34e67371509963938f154585747faeef42c248c.exe 3340 43bf73e410e3b06f7aaf6e58e34e67371509963938f154585747faeef42c248c.exe 3340 43bf73e410e3b06f7aaf6e58e34e67371509963938f154585747faeef42c248c.exe 3340 43bf73e410e3b06f7aaf6e58e34e67371509963938f154585747faeef42c248c.exe 3340 43bf73e410e3b06f7aaf6e58e34e67371509963938f154585747faeef42c248c.exe 3340 43bf73e410e3b06f7aaf6e58e34e67371509963938f154585747faeef42c248c.exe 3340 43bf73e410e3b06f7aaf6e58e34e67371509963938f154585747faeef42c248c.exe 3340 43bf73e410e3b06f7aaf6e58e34e67371509963938f154585747faeef42c248c.exe 3340 43bf73e410e3b06f7aaf6e58e34e67371509963938f154585747faeef42c248c.exe 3340 43bf73e410e3b06f7aaf6e58e34e67371509963938f154585747faeef42c248c.exe 3340 43bf73e410e3b06f7aaf6e58e34e67371509963938f154585747faeef42c248c.exe 3340 43bf73e410e3b06f7aaf6e58e34e67371509963938f154585747faeef42c248c.exe 3340 43bf73e410e3b06f7aaf6e58e34e67371509963938f154585747faeef42c248c.exe 3340 43bf73e410e3b06f7aaf6e58e34e67371509963938f154585747faeef42c248c.exe 3340 43bf73e410e3b06f7aaf6e58e34e67371509963938f154585747faeef42c248c.exe 3340 43bf73e410e3b06f7aaf6e58e34e67371509963938f154585747faeef42c248c.exe 3340 43bf73e410e3b06f7aaf6e58e34e67371509963938f154585747faeef42c248c.exe 3340 43bf73e410e3b06f7aaf6e58e34e67371509963938f154585747faeef42c248c.exe 3340 43bf73e410e3b06f7aaf6e58e34e67371509963938f154585747faeef42c248c.exe 3340 43bf73e410e3b06f7aaf6e58e34e67371509963938f154585747faeef42c248c.exe 3340 43bf73e410e3b06f7aaf6e58e34e67371509963938f154585747faeef42c248c.exe 3340 43bf73e410e3b06f7aaf6e58e34e67371509963938f154585747faeef42c248c.exe 3340 43bf73e410e3b06f7aaf6e58e34e67371509963938f154585747faeef42c248c.exe 3340 43bf73e410e3b06f7aaf6e58e34e67371509963938f154585747faeef42c248c.exe 3340 43bf73e410e3b06f7aaf6e58e34e67371509963938f154585747faeef42c248c.exe 3340 43bf73e410e3b06f7aaf6e58e34e67371509963938f154585747faeef42c248c.exe 3340 43bf73e410e3b06f7aaf6e58e34e67371509963938f154585747faeef42c248c.exe 3340 43bf73e410e3b06f7aaf6e58e34e67371509963938f154585747faeef42c248c.exe 3340 43bf73e410e3b06f7aaf6e58e34e67371509963938f154585747faeef42c248c.exe 3340 43bf73e410e3b06f7aaf6e58e34e67371509963938f154585747faeef42c248c.exe 3340 43bf73e410e3b06f7aaf6e58e34e67371509963938f154585747faeef42c248c.exe 3340 43bf73e410e3b06f7aaf6e58e34e67371509963938f154585747faeef42c248c.exe 3340 43bf73e410e3b06f7aaf6e58e34e67371509963938f154585747faeef42c248c.exe 3340 43bf73e410e3b06f7aaf6e58e34e67371509963938f154585747faeef42c248c.exe 3340 43bf73e410e3b06f7aaf6e58e34e67371509963938f154585747faeef42c248c.exe 3340 43bf73e410e3b06f7aaf6e58e34e67371509963938f154585747faeef42c248c.exe 3340 43bf73e410e3b06f7aaf6e58e34e67371509963938f154585747faeef42c248c.exe 3340 43bf73e410e3b06f7aaf6e58e34e67371509963938f154585747faeef42c248c.exe 3340 43bf73e410e3b06f7aaf6e58e34e67371509963938f154585747faeef42c248c.exe 3340 43bf73e410e3b06f7aaf6e58e34e67371509963938f154585747faeef42c248c.exe 3340 43bf73e410e3b06f7aaf6e58e34e67371509963938f154585747faeef42c248c.exe 3340 43bf73e410e3b06f7aaf6e58e34e67371509963938f154585747faeef42c248c.exe 3340 43bf73e410e3b06f7aaf6e58e34e67371509963938f154585747faeef42c248c.exe 3340 43bf73e410e3b06f7aaf6e58e34e67371509963938f154585747faeef42c248c.exe 3340 43bf73e410e3b06f7aaf6e58e34e67371509963938f154585747faeef42c248c.exe 3340 43bf73e410e3b06f7aaf6e58e34e67371509963938f154585747faeef42c248c.exe 3340 43bf73e410e3b06f7aaf6e58e34e67371509963938f154585747faeef42c248c.exe 3340 43bf73e410e3b06f7aaf6e58e34e67371509963938f154585747faeef42c248c.exe 3340 43bf73e410e3b06f7aaf6e58e34e67371509963938f154585747faeef42c248c.exe 3340 43bf73e410e3b06f7aaf6e58e34e67371509963938f154585747faeef42c248c.exe 3340 43bf73e410e3b06f7aaf6e58e34e67371509963938f154585747faeef42c248c.exe 3340 43bf73e410e3b06f7aaf6e58e34e67371509963938f154585747faeef42c248c.exe 3340 43bf73e410e3b06f7aaf6e58e34e67371509963938f154585747faeef42c248c.exe 3340 43bf73e410e3b06f7aaf6e58e34e67371509963938f154585747faeef42c248c.exe 3340 43bf73e410e3b06f7aaf6e58e34e67371509963938f154585747faeef42c248c.exe 3340 43bf73e410e3b06f7aaf6e58e34e67371509963938f154585747faeef42c248c.exe 3340 43bf73e410e3b06f7aaf6e58e34e67371509963938f154585747faeef42c248c.exe 3340 43bf73e410e3b06f7aaf6e58e34e67371509963938f154585747faeef42c248c.exe 3340 43bf73e410e3b06f7aaf6e58e34e67371509963938f154585747faeef42c248c.exe 3340 43bf73e410e3b06f7aaf6e58e34e67371509963938f154585747faeef42c248c.exe 3340 43bf73e410e3b06f7aaf6e58e34e67371509963938f154585747faeef42c248c.exe 3340 43bf73e410e3b06f7aaf6e58e34e67371509963938f154585747faeef42c248c.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: 33 3340 43bf73e410e3b06f7aaf6e58e34e67371509963938f154585747faeef42c248c.exe Token: SeIncBasePriorityPrivilege 3340 43bf73e410e3b06f7aaf6e58e34e67371509963938f154585747faeef42c248c.exe Token: 33 3340 43bf73e410e3b06f7aaf6e58e34e67371509963938f154585747faeef42c248c.exe Token: SeIncBasePriorityPrivilege 3340 43bf73e410e3b06f7aaf6e58e34e67371509963938f154585747faeef42c248c.exe Token: 33 3340 43bf73e410e3b06f7aaf6e58e34e67371509963938f154585747faeef42c248c.exe Token: SeIncBasePriorityPrivilege 3340 43bf73e410e3b06f7aaf6e58e34e67371509963938f154585747faeef42c248c.exe -
Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 3340 wrote to memory of 3292 3340 43bf73e410e3b06f7aaf6e58e34e67371509963938f154585747faeef42c248c.exe 89 PID 3340 wrote to memory of 3292 3340 43bf73e410e3b06f7aaf6e58e34e67371509963938f154585747faeef42c248c.exe 89 PID 3340 wrote to memory of 3292 3340 43bf73e410e3b06f7aaf6e58e34e67371509963938f154585747faeef42c248c.exe 89 PID 3292 wrote to memory of 5100 3292 cmd.exe 91 PID 3292 wrote to memory of 5100 3292 cmd.exe 91 PID 3292 wrote to memory of 5100 3292 cmd.exe 91 PID 3340 wrote to memory of 4956 3340 43bf73e410e3b06f7aaf6e58e34e67371509963938f154585747faeef42c248c.exe 92 PID 3340 wrote to memory of 4956 3340 43bf73e410e3b06f7aaf6e58e34e67371509963938f154585747faeef42c248c.exe 92 PID 3340 wrote to memory of 4956 3340 43bf73e410e3b06f7aaf6e58e34e67371509963938f154585747faeef42c248c.exe 92 PID 4956 wrote to memory of 2916 4956 cmd.exe 94 PID 4956 wrote to memory of 2916 4956 cmd.exe 94 PID 4956 wrote to memory of 2916 4956 cmd.exe 94 PID 3340 wrote to memory of 1200 3340 43bf73e410e3b06f7aaf6e58e34e67371509963938f154585747faeef42c248c.exe 98 PID 3340 wrote to memory of 1200 3340 43bf73e410e3b06f7aaf6e58e34e67371509963938f154585747faeef42c248c.exe 98 PID 3340 wrote to memory of 1200 3340 43bf73e410e3b06f7aaf6e58e34e67371509963938f154585747faeef42c248c.exe 98 PID 1200 wrote to memory of 3300 1200 cmd.exe 100 PID 1200 wrote to memory of 3300 1200 cmd.exe 100 PID 1200 wrote to memory of 3300 1200 cmd.exe 100 PID 3340 wrote to memory of 3704 3340 43bf73e410e3b06f7aaf6e58e34e67371509963938f154585747faeef42c248c.exe 101 PID 3340 wrote to memory of 3704 3340 43bf73e410e3b06f7aaf6e58e34e67371509963938f154585747faeef42c248c.exe 101 PID 3340 wrote to memory of 3704 3340 43bf73e410e3b06f7aaf6e58e34e67371509963938f154585747faeef42c248c.exe 101 PID 3704 wrote to memory of 4736 3704 cmd.exe 103 PID 3704 wrote to memory of 4736 3704 cmd.exe 103 PID 3704 wrote to memory of 4736 3704 cmd.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\43bf73e410e3b06f7aaf6e58e34e67371509963938f154585747faeef42c248c.exe"C:\Users\Admin\AppData\Local\Temp\43bf73e410e3b06f7aaf6e58e34e67371509963938f154585747faeef42c248c.exe"1⤵
- Modifies WinLogon for persistence
- Disables RegEdit via registry modification
- Adds Run key to start application
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3340 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C AT /delete /yes2⤵
- Suspicious use of WriteProcessMemory
PID:3292 -
C:\Windows\SysWOW64\at.exeAT /delete /yes3⤵PID:5100
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\gphone.exe2⤵
- Suspicious use of WriteProcessMemory
PID:4956 -
C:\Windows\SysWOW64\at.exeAT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\gphone.exe3⤵PID:2916
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C cacls "C:\system volume information" /e /g "Admin":f2⤵
- Suspicious use of WriteProcessMemory
PID:1200 -
C:\Windows\SysWOW64\cacls.execacls "C:\system volume information" /e /g "Admin":f3⤵PID:3300
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C cacls "C:\system volume information" /e /g "Admin":f2⤵
- Suspicious use of WriteProcessMemory
PID:3704 -
C:\Windows\SysWOW64\cacls.execacls "C:\system volume information" /e /g "Admin":f3⤵PID:4736
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4100,i,14221647728265121051,6840906015709541562,262144 --variations-seed-version --mojo-platform-channel-handle=3960 /prefetch:81⤵PID:3116
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
96B
MD50450bd6f856c038a41ab0e645b3b293b
SHA1ebbca685215823672fd692f6c3612f06dc30e084
SHA25611c6c38ee3e9cf9802cac107f4e4c24a070b0e43467842f401feee33b6967d5d
SHA512d1b0ed2662b274abd80e8d33775fcfaa30fe693707dc61ff2e0c2bd2f2ce50d2f3cac5d2a9f4f2fdf4232ebe72206fd47b86305d0c4d4d1bd147ba913e110fb8
-
Filesize
336KB
MD5986125409916faea3e1e3cb81df08b1f
SHA11da335b4d05e55d038ce30b7abdf110ecd0d8145
SHA25643bf73e410e3b06f7aaf6e58e34e67371509963938f154585747faeef42c248c
SHA512ef0585ed5fbe4e5e1bb8e6cc29205329f6450fdc8a2ac016eedf01c09c0bd97156950c6d4ff22fd516128c7bdd15d2c6ceab7cfdc1041a0e231e4e13f0b0b324