Analysis
-
max time kernel
140s -
max time network
126s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
23/06/2024, 23:24
Static task
static1
Behavioral task
behavioral1
Sample
7c99fb7998f53e24b6178179a35e669c4f0f76434ddfa215578add1fdf5fc022.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
7c99fb7998f53e24b6178179a35e669c4f0f76434ddfa215578add1fdf5fc022.exe
Resource
win10v2004-20240611-en
General
-
Target
7c99fb7998f53e24b6178179a35e669c4f0f76434ddfa215578add1fdf5fc022.exe
-
Size
45KB
-
MD5
5cb5c3636b6645e157b743403dba2feb
-
SHA1
dddef6c7e69aff104112bfcdc9ee31162363bbb3
-
SHA256
7c99fb7998f53e24b6178179a35e669c4f0f76434ddfa215578add1fdf5fc022
-
SHA512
eb22c52654f09c06db0e5ff0cf72a274bd4121cd36bf6c757388924b030f33fce2d2d6eed111528079869820ed29fed4dded2eee0c2cf3d8bc81fb1782086895
-
SSDEEP
768:8V5hy+7c6OXdfwEQ90NoZCi5TXbRzjEDta8jFqjsZvI2YxrQiP+ZRDd+RYTl/iU7:8h7xsCKosi5pzjIcdRiTpqMGxs3L
Malware Config
Signatures
-
Event Triggered Execution: Image File Execution Options Injection 1 TTPs 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ZhuDongFangYu.exe reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ZhuDongFangYu.exe\debugger = "ntsd -d" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360tray.exe reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360tray.exe\debugger = "ntsd -d" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\debugger = "ntsd -d" reg.exe -
Modifies system executable filetype association 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\7c99fb7998f53e24b6178179a35e669c4f0f76434ddfa215578add1fdf5fc022.exe " cmd.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\jstack.exe 7c99fb7998f53e24b6178179a35e669c4f0f76434ddfa215578add1fdf5fc022.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\msoasb.exe 7c99fb7998f53e24b6178179a35e669c4f0f76434ddfa215578add1fdf5fc022.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE 7c99fb7998f53e24b6178179a35e669c4f0f76434ddfa215578add1fdf5fc022.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe 7c99fb7998f53e24b6178179a35e669c4f0f76434ddfa215578add1fdf5fc022.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe 7c99fb7998f53e24b6178179a35e669c4f0f76434ddfa215578add1fdf5fc022.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe 7c99fb7998f53e24b6178179a35e669c4f0f76434ddfa215578add1fdf5fc022.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe 7c99fb7998f53e24b6178179a35e669c4f0f76434ddfa215578add1fdf5fc022.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe 7c99fb7998f53e24b6178179a35e669c4f0f76434ddfa215578add1fdf5fc022.exe File opened for modification \??\c:\Program Files\Internet Explorer\ielowutil.exe 7c99fb7998f53e24b6178179a35e669c4f0f76434ddfa215578add1fdf5fc022.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE 7c99fb7998f53e24b6178179a35e669c4f0f76434ddfa215578add1fdf5fc022.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe 7c99fb7998f53e24b6178179a35e669c4f0f76434ddfa215578add1fdf5fc022.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe 7c99fb7998f53e24b6178179a35e669c4f0f76434ddfa215578add1fdf5fc022.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\jarsigner.exe 7c99fb7998f53e24b6178179a35e669c4f0f76434ddfa215578add1fdf5fc022.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\schemagen.exe 7c99fb7998f53e24b6178179a35e669c4f0f76434ddfa215578add1fdf5fc022.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\msoia.exe 7c99fb7998f53e24b6178179a35e669c4f0f76434ddfa215578add1fdf5fc022.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe 7c99fb7998f53e24b6178179a35e669c4f0f76434ddfa215578add1fdf5fc022.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe 7c99fb7998f53e24b6178179a35e669c4f0f76434ddfa215578add1fdf5fc022.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\bin\ssvagent.exe 7c99fb7998f53e24b6178179a35e669c4f0f76434ddfa215578add1fdf5fc022.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe 7c99fb7998f53e24b6178179a35e669c4f0f76434ddfa215578add1fdf5fc022.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe 7c99fb7998f53e24b6178179a35e669c4f0f76434ddfa215578add1fdf5fc022.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\bin\keytool.exe 7c99fb7998f53e24b6178179a35e669c4f0f76434ddfa215578add1fdf5fc022.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\bin\rmid.exe 7c99fb7998f53e24b6178179a35e669c4f0f76434ddfa215578add1fdf5fc022.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe 7c99fb7998f53e24b6178179a35e669c4f0f76434ddfa215578add1fdf5fc022.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe 7c99fb7998f53e24b6178179a35e669c4f0f76434ddfa215578add1fdf5fc022.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\java.exe 7c99fb7998f53e24b6178179a35e669c4f0f76434ddfa215578add1fdf5fc022.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\bin\orbd.exe 7c99fb7998f53e24b6178179a35e669c4f0f76434ddfa215578add1fdf5fc022.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE 7c99fb7998f53e24b6178179a35e669c4f0f76434ddfa215578add1fdf5fc022.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\jmap.exe 7c99fb7998f53e24b6178179a35e669c4f0f76434ddfa215578add1fdf5fc022.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe 7c99fb7998f53e24b6178179a35e669c4f0f76434ddfa215578add1fdf5fc022.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\jinfo.exe 7c99fb7998f53e24b6178179a35e669c4f0f76434ddfa215578add1fdf5fc022.exe File opened for modification \??\c:\Program Files\Internet Explorer\iexplore.exe 7c99fb7998f53e24b6178179a35e669c4f0f76434ddfa215578add1fdf5fc022.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE 7c99fb7998f53e24b6178179a35e669c4f0f76434ddfa215578add1fdf5fc022.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe 7c99fb7998f53e24b6178179a35e669c4f0f76434ddfa215578add1fdf5fc022.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\bin\javaw.exe 7c99fb7998f53e24b6178179a35e669c4f0f76434ddfa215578add1fdf5fc022.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\bin\pack200.exe 7c99fb7998f53e24b6178179a35e669c4f0f76434ddfa215578add1fdf5fc022.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE 7c99fb7998f53e24b6178179a35e669c4f0f76434ddfa215578add1fdf5fc022.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\kinit.exe 7c99fb7998f53e24b6178179a35e669c4f0f76434ddfa215578add1fdf5fc022.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\klist.exe 7c99fb7998f53e24b6178179a35e669c4f0f76434ddfa215578add1fdf5fc022.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\tnameserv.exe 7c99fb7998f53e24b6178179a35e669c4f0f76434ddfa215578add1fdf5fc022.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\createdump.exe 7c99fb7998f53e24b6178179a35e669c4f0f76434ddfa215578add1fdf5fc022.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe 7c99fb7998f53e24b6178179a35e669c4f0f76434ddfa215578add1fdf5fc022.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE 7c99fb7998f53e24b6178179a35e669c4f0f76434ddfa215578add1fdf5fc022.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe 7c99fb7998f53e24b6178179a35e669c4f0f76434ddfa215578add1fdf5fc022.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE 7c99fb7998f53e24b6178179a35e669c4f0f76434ddfa215578add1fdf5fc022.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe 7c99fb7998f53e24b6178179a35e669c4f0f76434ddfa215578add1fdf5fc022.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe 7c99fb7998f53e24b6178179a35e669c4f0f76434ddfa215578add1fdf5fc022.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe 7c99fb7998f53e24b6178179a35e669c4f0f76434ddfa215578add1fdf5fc022.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe 7c99fb7998f53e24b6178179a35e669c4f0f76434ddfa215578add1fdf5fc022.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\bin\rmiregistry.exe 7c99fb7998f53e24b6178179a35e669c4f0f76434ddfa215578add1fdf5fc022.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\pack200.exe 7c99fb7998f53e24b6178179a35e669c4f0f76434ddfa215578add1fdf5fc022.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE 7c99fb7998f53e24b6178179a35e669c4f0f76434ddfa215578add1fdf5fc022.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe 7c99fb7998f53e24b6178179a35e669c4f0f76434ddfa215578add1fdf5fc022.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\javaw.exe 7c99fb7998f53e24b6178179a35e669c4f0f76434ddfa215578add1fdf5fc022.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\bin\javacpl.exe 7c99fb7998f53e24b6178179a35e669c4f0f76434ddfa215578add1fdf5fc022.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ink\TabTip.exe 7c99fb7998f53e24b6178179a35e669c4f0f76434ddfa215578add1fdf5fc022.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\jstatd.exe 7c99fb7998f53e24b6178179a35e669c4f0f76434ddfa215578add1fdf5fc022.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe 7c99fb7998f53e24b6178179a35e669c4f0f76434ddfa215578add1fdf5fc022.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\msoev.exe 7c99fb7998f53e24b6178179a35e669c4f0f76434ddfa215578add1fdf5fc022.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\chrome_proxy.exe 7c99fb7998f53e24b6178179a35e669c4f0f76434ddfa215578add1fdf5fc022.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\extcheck.exe 7c99fb7998f53e24b6178179a35e669c4f0f76434ddfa215578add1fdf5fc022.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\rmic.exe 7c99fb7998f53e24b6178179a35e669c4f0f76434ddfa215578add1fdf5fc022.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\javah.exe 7c99fb7998f53e24b6178179a35e669c4f0f76434ddfa215578add1fdf5fc022.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE 7c99fb7998f53e24b6178179a35e669c4f0f76434ddfa215578add1fdf5fc022.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe 7c99fb7998f53e24b6178179a35e669c4f0f76434ddfa215578add1fdf5fc022.exe -
Modifies registry class 14 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\jpgfile\Shell\Open cmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\jpgfile\Shell\Open\Command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\7c99fb7998f53e24b6178179a35e669c4f0f76434ddfa215578add1fdf5fc022.exe " cmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\7c99fb7998f53e24b6178179a35e669c4f0f76434ddfa215578add1fdf5fc022.exe " cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\zipfile\Shell cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\zipfile\Shell\Open\Command cmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\zipfile\Shell\Open\Command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\7c99fb7998f53e24b6178179a35e669c4f0f76434ddfa215578add1fdf5fc022.exe " cmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\7c99fb7998f53e24b6178179a35e669c4f0f76434ddfa215578add1fdf5fc022.exe " cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\jpgfile cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\jpgfile\Shell cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.txt cmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.txt \ = " exefile" cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\zipfile\Shell\Open cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\zipfile cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\jpgfile\Shell\Open\Command cmd.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2356 7c99fb7998f53e24b6178179a35e669c4f0f76434ddfa215578add1fdf5fc022.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2356 7c99fb7998f53e24b6178179a35e669c4f0f76434ddfa215578add1fdf5fc022.exe -
Suspicious use of WriteProcessMemory 30 IoCs
description pid Process procid_target PID 2356 wrote to memory of 1692 2356 7c99fb7998f53e24b6178179a35e669c4f0f76434ddfa215578add1fdf5fc022.exe 82 PID 2356 wrote to memory of 1692 2356 7c99fb7998f53e24b6178179a35e669c4f0f76434ddfa215578add1fdf5fc022.exe 82 PID 2356 wrote to memory of 1692 2356 7c99fb7998f53e24b6178179a35e669c4f0f76434ddfa215578add1fdf5fc022.exe 82 PID 2356 wrote to memory of 4392 2356 7c99fb7998f53e24b6178179a35e669c4f0f76434ddfa215578add1fdf5fc022.exe 87 PID 2356 wrote to memory of 4392 2356 7c99fb7998f53e24b6178179a35e669c4f0f76434ddfa215578add1fdf5fc022.exe 87 PID 2356 wrote to memory of 4392 2356 7c99fb7998f53e24b6178179a35e669c4f0f76434ddfa215578add1fdf5fc022.exe 87 PID 2356 wrote to memory of 4484 2356 7c99fb7998f53e24b6178179a35e669c4f0f76434ddfa215578add1fdf5fc022.exe 88 PID 2356 wrote to memory of 4484 2356 7c99fb7998f53e24b6178179a35e669c4f0f76434ddfa215578add1fdf5fc022.exe 88 PID 2356 wrote to memory of 4484 2356 7c99fb7998f53e24b6178179a35e669c4f0f76434ddfa215578add1fdf5fc022.exe 88 PID 2356 wrote to memory of 4532 2356 7c99fb7998f53e24b6178179a35e669c4f0f76434ddfa215578add1fdf5fc022.exe 89 PID 2356 wrote to memory of 4532 2356 7c99fb7998f53e24b6178179a35e669c4f0f76434ddfa215578add1fdf5fc022.exe 89 PID 2356 wrote to memory of 4532 2356 7c99fb7998f53e24b6178179a35e669c4f0f76434ddfa215578add1fdf5fc022.exe 89 PID 2356 wrote to memory of 2024 2356 7c99fb7998f53e24b6178179a35e669c4f0f76434ddfa215578add1fdf5fc022.exe 90 PID 2356 wrote to memory of 2024 2356 7c99fb7998f53e24b6178179a35e669c4f0f76434ddfa215578add1fdf5fc022.exe 90 PID 2356 wrote to memory of 2024 2356 7c99fb7998f53e24b6178179a35e669c4f0f76434ddfa215578add1fdf5fc022.exe 90 PID 2356 wrote to memory of 4996 2356 7c99fb7998f53e24b6178179a35e669c4f0f76434ddfa215578add1fdf5fc022.exe 91 PID 2356 wrote to memory of 4996 2356 7c99fb7998f53e24b6178179a35e669c4f0f76434ddfa215578add1fdf5fc022.exe 91 PID 2356 wrote to memory of 4996 2356 7c99fb7998f53e24b6178179a35e669c4f0f76434ddfa215578add1fdf5fc022.exe 91 PID 2356 wrote to memory of 4564 2356 7c99fb7998f53e24b6178179a35e669c4f0f76434ddfa215578add1fdf5fc022.exe 92 PID 2356 wrote to memory of 4564 2356 7c99fb7998f53e24b6178179a35e669c4f0f76434ddfa215578add1fdf5fc022.exe 92 PID 2356 wrote to memory of 4564 2356 7c99fb7998f53e24b6178179a35e669c4f0f76434ddfa215578add1fdf5fc022.exe 92 PID 4392 wrote to memory of 1824 4392 cmd.exe 99 PID 4392 wrote to memory of 1824 4392 cmd.exe 99 PID 4392 wrote to memory of 1824 4392 cmd.exe 99 PID 4392 wrote to memory of 408 4392 cmd.exe 100 PID 4392 wrote to memory of 408 4392 cmd.exe 100 PID 4392 wrote to memory of 408 4392 cmd.exe 100 PID 4392 wrote to memory of 4588 4392 cmd.exe 101 PID 4392 wrote to memory of 4588 4392 cmd.exe 101 PID 4392 wrote to memory of 4588 4392 cmd.exe 101
Processes
-
C:\Users\Admin\AppData\Local\Temp\7c99fb7998f53e24b6178179a35e669c4f0f76434ddfa215578add1fdf5fc022.exe"C:\Users\Admin\AppData\Local\Temp\7c99fb7998f53e24b6178179a35e669c4f0f76434ddfa215578add1fdf5fc022.exe"1⤵
- Drops file in Program Files directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2356 -
C:\Windows\SysWOW64\cmd.execmd.exe2⤵PID:1692
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\123.bat2⤵
- Suspicious use of WriteProcessMemory
PID:4392 -
C:\Windows\SysWOW64\reg.exereg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\ZhuDongFangYu.exe" /v debugger /t reg_sz /d "ntsd -d" /f3⤵
- Event Triggered Execution: Image File Execution Options Injection
PID:1824
-
-
C:\Windows\SysWOW64\reg.exereg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\360tray.exe" /v debugger /t reg_sz /d "ntsd -d" /f3⤵
- Event Triggered Execution: Image File Execution Options Injection
PID:408
-
-
C:\Windows\SysWOW64\reg.exereg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\taskmgr.exe" /v debugger /t reg_sz /d "ntsd -d" /f3⤵
- Event Triggered Execution: Image File Execution Options Injection
PID:4588
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c assoc .txt = exefile2⤵
- Modifies registry class
PID:4484
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c ftype comfile=C:\Users\Admin\AppData\Local\Temp\7c99fb7998f53e24b6178179a35e669c4f0f76434ddfa215578add1fdf5fc022.exe2⤵
- Modifies system executable filetype association
- Modifies registry class
PID:4532
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c ftype zipfile=C:\Users\Admin\AppData\Local\Temp\7c99fb7998f53e24b6178179a35e669c4f0f76434ddfa215578add1fdf5fc022.exe2⤵
- Modifies registry class
PID:2024
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c ftype jpgfile=C:\Users\Admin\AppData\Local\Temp\7c99fb7998f53e24b6178179a35e669c4f0f76434ddfa215578add1fdf5fc022.exe2⤵
- Modifies registry class
PID:4996
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c ftype txtfile=C:\Users\Admin\AppData\Local\Temp\7c99fb7998f53e24b6178179a35e669c4f0f76434ddfa215578add1fdf5fc022.exe2⤵
- Modifies registry class
PID:4564
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
443B
MD570170ba16a737a438223b88279dc6c85
SHA1cc066efa0fca9bc9f44013660dea6b28ddfd6a24
SHA256d3674f4b34a8ca8167160519aa5c66b6024eb09f4cb0c9278bc44370b0efec6a
SHA51237cc8c954544374d0a1ca4d012c9bd0b47781bc9bb8d0c15a8a95b9934893db3bedee867b984c20edabe54c39574abf7250de433aade6c0d544b8dd2c972c6da
-
Filesize
45KB
MD5deca883928d1a2adcba3392de2ee5d24
SHA195d00b618d6f048ff857760040488746e98be252
SHA25619a4a0e8973fe3a5806743d788b56e0d62708d2e8e4a30fa6825ad63fe91ce4a
SHA512e50547713c5c6701f2d744498cea9ec3b2f32f0924d614bfc31f3157fa817c48f5e8a5092a939dcea44a7903ea112180a9fd2ce9c2d8f26930eb6421e6816ab6