Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
04/07/2024, 20:49
Static task
static1
Behavioral task
behavioral1
Sample
0a93aa809b1434993902d22c9b7c251df74afbf697ab46ca0795375dfa8684f2.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
0a93aa809b1434993902d22c9b7c251df74afbf697ab46ca0795375dfa8684f2.exe
Resource
win10v2004-20240704-en
General
-
Target
0a93aa809b1434993902d22c9b7c251df74afbf697ab46ca0795375dfa8684f2.exe
-
Size
45KB
-
MD5
9699e218755a21af962abcc8e604dff0
-
SHA1
47a01bf81c139357d77fc273e652412357555ab4
-
SHA256
0a93aa809b1434993902d22c9b7c251df74afbf697ab46ca0795375dfa8684f2
-
SHA512
d5a970ec158bfe3814e787dff71d9fc87f1155ba4df9d40c03f3e57edfee2231fdc5c9dfb0387ad58cf39d068f063b44b884ed4ec0180f567fc63712bffa60e5
-
SSDEEP
768:8V5hy+7c6OXdfwEQ90NoZCi5TXbRzjEDta8jFqjsZvI2YxrQiP+ZRDd+RYTl/iUW:8h7xsCKosi5pzjIcdRiTpqMGxs3Ef
Malware Config
Signatures
-
Event Triggered Execution: Image File Execution Options Injection 1 TTPs 6 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ZhuDongFangYu.exe\debugger = "ntsd -d" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360tray.exe reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360tray.exe\debugger = "ntsd -d" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\debugger = "ntsd -d" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ZhuDongFangYu.exe reg.exe -
Modifies system executable filetype association 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\0a93aa809b1434993902d22c9b7c251df74afbf697ab46ca0795375dfa8684f2.exe " cmd.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification \??\c:\Windows\SysWOW64\regedit.exe 0a93aa809b1434993902d22c9b7c251df74afbf697ab46ca0795375dfa8684f2.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\jre\bin\keytool.exe 0a93aa809b1434993902d22c9b7c251df74afbf697ab46ca0795375dfa8684f2.exe File opened for modification \??\c:\Program Files (x86)\Common Files\microsoft shared\ink\pipanel.exe 0a93aa809b1434993902d22c9b7c251df74afbf697ab46ca0795375dfa8684f2.exe File opened for modification \??\c:\Program Files (x86)\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPREARM.EXE 0a93aa809b1434993902d22c9b7c251df74afbf697ab46ca0795375dfa8684f2.exe File opened for modification \??\c:\Program Files (x86)\Windows Media Player\wmlaunch.exe 0a93aa809b1434993902d22c9b7c251df74afbf697ab46ca0795375dfa8684f2.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\apt.exe 0a93aa809b1434993902d22c9b7c251df74afbf697ab46ca0795375dfa8684f2.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\ONENOTE.EXE 0a93aa809b1434993902d22c9b7c251df74afbf697ab46ca0795375dfa8684f2.exe File opened for modification \??\c:\Program Files\7-Zip\7z.exe 0a93aa809b1434993902d22c9b7c251df74afbf697ab46ca0795375dfa8684f2.exe File opened for modification \??\c:\Program Files\Java\jre7\bin\jabswitch.exe 0a93aa809b1434993902d22c9b7c251df74afbf697ab46ca0795375dfa8684f2.exe File opened for modification \??\c:\Program Files (x86)\Common Files\microsoft shared\Source Engine\OSE.EXE 0a93aa809b1434993902d22c9b7c251df74afbf697ab46ca0795375dfa8684f2.exe File opened for modification \??\c:\Program Files\Windows NT\Accessories\wordpad.exe 0a93aa809b1434993902d22c9b7c251df74afbf697ab46ca0795375dfa8684f2.exe File opened for modification \??\c:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe 0a93aa809b1434993902d22c9b7c251df74afbf697ab46ca0795375dfa8684f2.exe File opened for modification \??\c:\Program Files\Windows Media Player\wmlaunch.exe 0a93aa809b1434993902d22c9b7c251df74afbf697ab46ca0795375dfa8684f2.exe File opened for modification \??\c:\Program Files\Windows Photo Viewer\ImagingDevices.exe 0a93aa809b1434993902d22c9b7c251df74afbf697ab46ca0795375dfa8684f2.exe File opened for modification \??\c:\Program Files\Common Files\Microsoft Shared\MSInfo\msinfo32.exe 0a93aa809b1434993902d22c9b7c251df74afbf697ab46ca0795375dfa8684f2.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe 0a93aa809b1434993902d22c9b7c251df74afbf697ab46ca0795375dfa8684f2.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\jre\bin\jp2launcher.exe 0a93aa809b1434993902d22c9b7c251df74afbf697ab46ca0795375dfa8684f2.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\jre\bin\rmid.exe 0a93aa809b1434993902d22c9b7c251df74afbf697ab46ca0795375dfa8684f2.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\jre\bin\ssvagent.exe 0a93aa809b1434993902d22c9b7c251df74afbf697ab46ca0795375dfa8684f2.exe File opened for modification \??\c:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\SmartTagInstall.exe 0a93aa809b1434993902d22c9b7c251df74afbf697ab46ca0795375dfa8684f2.exe File opened for modification \??\c:\Program Files (x86)\Common Files\microsoft shared\DW\DW20.EXE 0a93aa809b1434993902d22c9b7c251df74afbf697ab46ca0795375dfa8684f2.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\CLVIEW.EXE 0a93aa809b1434993902d22c9b7c251df74afbf697ab46ca0795375dfa8684f2.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\keytool.exe 0a93aa809b1434993902d22c9b7c251df74afbf697ab46ca0795375dfa8684f2.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\tnameserv.exe 0a93aa809b1434993902d22c9b7c251df74afbf697ab46ca0795375dfa8684f2.exe File opened for modification \??\c:\Program Files\Java\jre7\bin\tnameserv.exe 0a93aa809b1434993902d22c9b7c251df74afbf697ab46ca0795375dfa8684f2.exe File opened for modification \??\c:\Program Files\Windows Media Player\wmprph.exe 0a93aa809b1434993902d22c9b7c251df74afbf697ab46ca0795375dfa8684f2.exe File opened for modification \??\c:\Program Files\Windows Sidebar\sidebar.exe 0a93aa809b1434993902d22c9b7c251df74afbf697ab46ca0795375dfa8684f2.exe File opened for modification \??\c:\Program Files\7-Zip\7zFM.exe 0a93aa809b1434993902d22c9b7c251df74afbf697ab46ca0795375dfa8684f2.exe File opened for modification \??\c:\Program Files\Common Files\Microsoft Shared\ink\FlickLearningWizard.exe 0a93aa809b1434993902d22c9b7c251df74afbf697ab46ca0795375dfa8684f2.exe File opened for modification \??\c:\Program Files\Java\jre7\bin\policytool.exe 0a93aa809b1434993902d22c9b7c251df74afbf697ab46ca0795375dfa8684f2.exe File opened for modification \??\c:\Program Files (x86)\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe 0a93aa809b1434993902d22c9b7c251df74afbf697ab46ca0795375dfa8684f2.exe File opened for modification \??\c:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdate.exe 0a93aa809b1434993902d22c9b7c251df74afbf697ab46ca0795375dfa8684f2.exe File opened for modification \??\c:\Program Files\Java\jre7\bin\rmiregistry.exe 0a93aa809b1434993902d22c9b7c251df74afbf697ab46ca0795375dfa8684f2.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\SC_Reader.exe 0a93aa809b1434993902d22c9b7c251df74afbf697ab46ca0795375dfa8684f2.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\INFOPATH.EXE 0a93aa809b1434993902d22c9b7c251df74afbf697ab46ca0795375dfa8684f2.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\SELFCERT.EXE 0a93aa809b1434993902d22c9b7c251df74afbf697ab46ca0795375dfa8684f2.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\WORDICON.EXE 0a93aa809b1434993902d22c9b7c251df74afbf697ab46ca0795375dfa8684f2.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\wsgen.exe 0a93aa809b1434993902d22c9b7c251df74afbf697ab46ca0795375dfa8684f2.exe File opened for modification \??\c:\Program Files\Mozilla Firefox\private_browsing.exe 0a93aa809b1434993902d22c9b7c251df74afbf697ab46ca0795375dfa8684f2.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32Info.exe 0a93aa809b1434993902d22c9b7c251df74afbf697ab46ca0795375dfa8684f2.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\chrome_proxy.exe 0a93aa809b1434993902d22c9b7c251df74afbf697ab46ca0795375dfa8684f2.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Reader 9.0\Reader\Eula.exe 0a93aa809b1434993902d22c9b7c251df74afbf697ab46ca0795375dfa8684f2.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Reader 9.0\Reader\reader_sl.exe 0a93aa809b1434993902d22c9b7c251df74afbf697ab46ca0795375dfa8684f2.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\idlj.exe 0a93aa809b1434993902d22c9b7c251df74afbf697ab46ca0795375dfa8684f2.exe File opened for modification \??\c:\Program Files\Windows Media Player\wmpnetwk.exe 0a93aa809b1434993902d22c9b7c251df74afbf697ab46ca0795375dfa8684f2.exe File opened for modification \??\c:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MSOICONS.EXE 0a93aa809b1434993902d22c9b7c251df74afbf697ab46ca0795375dfa8684f2.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\jre\bin\javaw.exe 0a93aa809b1434993902d22c9b7c251df74afbf697ab46ca0795375dfa8684f2.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\jre\lib\launcher.exe 0a93aa809b1434993902d22c9b7c251df74afbf697ab46ca0795375dfa8684f2.exe File opened for modification \??\c:\Program Files\Microsoft Games\Minesweeper\MineSweeper.exe 0a93aa809b1434993902d22c9b7c251df74afbf697ab46ca0795375dfa8684f2.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Reader 9.0\Reader\A3DUtility.exe 0a93aa809b1434993902d22c9b7c251df74afbf697ab46ca0795375dfa8684f2.exe File opened for modification \??\c:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\FLTLDR.EXE 0a93aa809b1434993902d22c9b7c251df74afbf697ab46ca0795375dfa8684f2.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\kinit.exe 0a93aa809b1434993902d22c9b7c251df74afbf697ab46ca0795375dfa8684f2.exe File opened for modification \??\c:\Program Files (x86)\Common Files\microsoft shared\MSInfo\msinfo32.exe 0a93aa809b1434993902d22c9b7c251df74afbf697ab46ca0795375dfa8684f2.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\excelcnv.exe 0a93aa809b1434993902d22c9b7c251df74afbf697ab46ca0795375dfa8684f2.exe File opened for modification \??\c:\Program Files (x86)\Windows Media Player\setup_wm.exe 0a93aa809b1434993902d22c9b7c251df74afbf697ab46ca0795375dfa8684f2.exe File opened for modification \??\c:\Program Files\7-Zip\Uninstall.exe 0a93aa809b1434993902d22c9b7c251df74afbf697ab46ca0795375dfa8684f2.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\jre\bin\policytool.exe 0a93aa809b1434993902d22c9b7c251df74afbf697ab46ca0795375dfa8684f2.exe File opened for modification \??\c:\Program Files\Windows Media Player\WMPSideShowGadget.exe 0a93aa809b1434993902d22c9b7c251df74afbf697ab46ca0795375dfa8684f2.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\Setup.exe 0a93aa809b1434993902d22c9b7c251df74afbf697ab46ca0795375dfa8684f2.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE 0a93aa809b1434993902d22c9b7c251df74afbf697ab46ca0795375dfa8684f2.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\jre\bin\java-rmi.exe 0a93aa809b1434993902d22c9b7c251df74afbf697ab46ca0795375dfa8684f2.exe File opened for modification \??\c:\Program Files\Microsoft Games\Mahjong\Mahjong.exe 0a93aa809b1434993902d22c9b7c251df74afbf697ab46ca0795375dfa8684f2.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\IEContentService.exe 0a93aa809b1434993902d22c9b7c251df74afbf697ab46ca0795375dfa8684f2.exe File opened for modification \??\c:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe 0a93aa809b1434993902d22c9b7c251df74afbf697ab46ca0795375dfa8684f2.exe File opened for modification \??\c:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe 0a93aa809b1434993902d22c9b7c251df74afbf697ab46ca0795375dfa8684f2.exe -
Drops file in Windows directory 12 IoCs
description ioc Process File opened for modification \??\c:\Windows\explorer.exe 0a93aa809b1434993902d22c9b7c251df74afbf697ab46ca0795375dfa8684f2.exe File opened for modification \??\c:\Windows\fveupdate.exe 0a93aa809b1434993902d22c9b7c251df74afbf697ab46ca0795375dfa8684f2.exe File opened for modification \??\c:\Windows\HelpPane.exe 0a93aa809b1434993902d22c9b7c251df74afbf697ab46ca0795375dfa8684f2.exe File opened for modification \??\c:\Windows\splwow64.exe 0a93aa809b1434993902d22c9b7c251df74afbf697ab46ca0795375dfa8684f2.exe File opened for modification \??\c:\Windows\twunk_32.exe 0a93aa809b1434993902d22c9b7c251df74afbf697ab46ca0795375dfa8684f2.exe File opened for modification \??\c:\Windows\winhlp32.exe 0a93aa809b1434993902d22c9b7c251df74afbf697ab46ca0795375dfa8684f2.exe File opened for modification \??\c:\Windows\write.exe 0a93aa809b1434993902d22c9b7c251df74afbf697ab46ca0795375dfa8684f2.exe File opened for modification \??\c:\Windows\bfsvc.exe 0a93aa809b1434993902d22c9b7c251df74afbf697ab46ca0795375dfa8684f2.exe File opened for modification \??\c:\Windows\hh.exe 0a93aa809b1434993902d22c9b7c251df74afbf697ab46ca0795375dfa8684f2.exe File opened for modification \??\c:\Windows\notepad.exe 0a93aa809b1434993902d22c9b7c251df74afbf697ab46ca0795375dfa8684f2.exe File opened for modification \??\c:\Windows\twunk_16.exe 0a93aa809b1434993902d22c9b7c251df74afbf697ab46ca0795375dfa8684f2.exe File opened for modification \??\c:\Windows\Boot\PCAT\memtest.exe 0a93aa809b1434993902d22c9b7c251df74afbf697ab46ca0795375dfa8684f2.exe -
Modifies registry class 14 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\jpgfile\Shell\Open\Command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\0a93aa809b1434993902d22c9b7c251df74afbf697ab46ca0795375dfa8684f2.exe " cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\zipfile cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\zipfile\Shell cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\zipfile\Shell\Open cmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\0a93aa809b1434993902d22c9b7c251df74afbf697ab46ca0795375dfa8684f2.exe " cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\jpgfile cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\zipfile\Shell\Open\Command cmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\zipfile\Shell\Open\Command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\0a93aa809b1434993902d22c9b7c251df74afbf697ab46ca0795375dfa8684f2.exe " cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\jpgfile\Shell\Open cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\jpgfile\Shell\Open\Command cmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\0a93aa809b1434993902d22c9b7c251df74afbf697ab46ca0795375dfa8684f2.exe " cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\jpgfile\Shell cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.txt cmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.txt \ = " exefile" cmd.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1764 0a93aa809b1434993902d22c9b7c251df74afbf697ab46ca0795375dfa8684f2.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1764 0a93aa809b1434993902d22c9b7c251df74afbf697ab46ca0795375dfa8684f2.exe -
Suspicious use of WriteProcessMemory 40 IoCs
description pid Process procid_target PID 1764 wrote to memory of 2896 1764 0a93aa809b1434993902d22c9b7c251df74afbf697ab46ca0795375dfa8684f2.exe 28 PID 1764 wrote to memory of 2896 1764 0a93aa809b1434993902d22c9b7c251df74afbf697ab46ca0795375dfa8684f2.exe 28 PID 1764 wrote to memory of 2896 1764 0a93aa809b1434993902d22c9b7c251df74afbf697ab46ca0795375dfa8684f2.exe 28 PID 1764 wrote to memory of 2896 1764 0a93aa809b1434993902d22c9b7c251df74afbf697ab46ca0795375dfa8684f2.exe 28 PID 1764 wrote to memory of 1820 1764 0a93aa809b1434993902d22c9b7c251df74afbf697ab46ca0795375dfa8684f2.exe 30 PID 1764 wrote to memory of 1820 1764 0a93aa809b1434993902d22c9b7c251df74afbf697ab46ca0795375dfa8684f2.exe 30 PID 1764 wrote to memory of 1820 1764 0a93aa809b1434993902d22c9b7c251df74afbf697ab46ca0795375dfa8684f2.exe 30 PID 1764 wrote to memory of 1820 1764 0a93aa809b1434993902d22c9b7c251df74afbf697ab46ca0795375dfa8684f2.exe 30 PID 1764 wrote to memory of 1616 1764 0a93aa809b1434993902d22c9b7c251df74afbf697ab46ca0795375dfa8684f2.exe 31 PID 1764 wrote to memory of 1616 1764 0a93aa809b1434993902d22c9b7c251df74afbf697ab46ca0795375dfa8684f2.exe 31 PID 1764 wrote to memory of 1616 1764 0a93aa809b1434993902d22c9b7c251df74afbf697ab46ca0795375dfa8684f2.exe 31 PID 1764 wrote to memory of 1616 1764 0a93aa809b1434993902d22c9b7c251df74afbf697ab46ca0795375dfa8684f2.exe 31 PID 1764 wrote to memory of 1080 1764 0a93aa809b1434993902d22c9b7c251df74afbf697ab46ca0795375dfa8684f2.exe 33 PID 1764 wrote to memory of 1080 1764 0a93aa809b1434993902d22c9b7c251df74afbf697ab46ca0795375dfa8684f2.exe 33 PID 1764 wrote to memory of 1080 1764 0a93aa809b1434993902d22c9b7c251df74afbf697ab46ca0795375dfa8684f2.exe 33 PID 1764 wrote to memory of 1080 1764 0a93aa809b1434993902d22c9b7c251df74afbf697ab46ca0795375dfa8684f2.exe 33 PID 1764 wrote to memory of 1816 1764 0a93aa809b1434993902d22c9b7c251df74afbf697ab46ca0795375dfa8684f2.exe 34 PID 1764 wrote to memory of 1816 1764 0a93aa809b1434993902d22c9b7c251df74afbf697ab46ca0795375dfa8684f2.exe 34 PID 1764 wrote to memory of 1816 1764 0a93aa809b1434993902d22c9b7c251df74afbf697ab46ca0795375dfa8684f2.exe 34 PID 1764 wrote to memory of 1816 1764 0a93aa809b1434993902d22c9b7c251df74afbf697ab46ca0795375dfa8684f2.exe 34 PID 1764 wrote to memory of 344 1764 0a93aa809b1434993902d22c9b7c251df74afbf697ab46ca0795375dfa8684f2.exe 37 PID 1764 wrote to memory of 344 1764 0a93aa809b1434993902d22c9b7c251df74afbf697ab46ca0795375dfa8684f2.exe 37 PID 1764 wrote to memory of 344 1764 0a93aa809b1434993902d22c9b7c251df74afbf697ab46ca0795375dfa8684f2.exe 37 PID 1764 wrote to memory of 344 1764 0a93aa809b1434993902d22c9b7c251df74afbf697ab46ca0795375dfa8684f2.exe 37 PID 1764 wrote to memory of 1756 1764 0a93aa809b1434993902d22c9b7c251df74afbf697ab46ca0795375dfa8684f2.exe 39 PID 1764 wrote to memory of 1756 1764 0a93aa809b1434993902d22c9b7c251df74afbf697ab46ca0795375dfa8684f2.exe 39 PID 1764 wrote to memory of 1756 1764 0a93aa809b1434993902d22c9b7c251df74afbf697ab46ca0795375dfa8684f2.exe 39 PID 1764 wrote to memory of 1756 1764 0a93aa809b1434993902d22c9b7c251df74afbf697ab46ca0795375dfa8684f2.exe 39 PID 1820 wrote to memory of 2272 1820 cmd.exe 42 PID 1820 wrote to memory of 2272 1820 cmd.exe 42 PID 1820 wrote to memory of 2272 1820 cmd.exe 42 PID 1820 wrote to memory of 2272 1820 cmd.exe 42 PID 1820 wrote to memory of 2188 1820 cmd.exe 43 PID 1820 wrote to memory of 2188 1820 cmd.exe 43 PID 1820 wrote to memory of 2188 1820 cmd.exe 43 PID 1820 wrote to memory of 2188 1820 cmd.exe 43 PID 1820 wrote to memory of 3024 1820 cmd.exe 44 PID 1820 wrote to memory of 3024 1820 cmd.exe 44 PID 1820 wrote to memory of 3024 1820 cmd.exe 44 PID 1820 wrote to memory of 3024 1820 cmd.exe 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\0a93aa809b1434993902d22c9b7c251df74afbf697ab46ca0795375dfa8684f2.exe"C:\Users\Admin\AppData\Local\Temp\0a93aa809b1434993902d22c9b7c251df74afbf697ab46ca0795375dfa8684f2.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1764 -
C:\Windows\SysWOW64\cmd.execmd.exe2⤵PID:2896
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\123.bat2⤵
- Suspicious use of WriteProcessMemory
PID:1820 -
C:\Windows\SysWOW64\reg.exereg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\ZhuDongFangYu.exe" /v debugger /t reg_sz /d "ntsd -d" /f3⤵
- Event Triggered Execution: Image File Execution Options Injection
PID:2272
-
-
C:\Windows\SysWOW64\reg.exereg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\360tray.exe" /v debugger /t reg_sz /d "ntsd -d" /f3⤵
- Event Triggered Execution: Image File Execution Options Injection
PID:2188
-
-
C:\Windows\SysWOW64\reg.exereg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\taskmgr.exe" /v debugger /t reg_sz /d "ntsd -d" /f3⤵
- Event Triggered Execution: Image File Execution Options Injection
PID:3024
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c assoc .txt = exefile2⤵
- Modifies registry class
PID:1616
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c ftype comfile=C:\Users\Admin\AppData\Local\Temp\0a93aa809b1434993902d22c9b7c251df74afbf697ab46ca0795375dfa8684f2.exe2⤵
- Modifies system executable filetype association
- Modifies registry class
PID:1080
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c ftype zipfile=C:\Users\Admin\AppData\Local\Temp\0a93aa809b1434993902d22c9b7c251df74afbf697ab46ca0795375dfa8684f2.exe2⤵
- Modifies registry class
PID:1816
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c ftype jpgfile=C:\Users\Admin\AppData\Local\Temp\0a93aa809b1434993902d22c9b7c251df74afbf697ab46ca0795375dfa8684f2.exe2⤵
- Modifies registry class
PID:344
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c ftype txtfile=C:\Users\Admin\AppData\Local\Temp\0a93aa809b1434993902d22c9b7c251df74afbf697ab46ca0795375dfa8684f2.exe2⤵
- Modifies registry class
PID:1756
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
443B
MD570170ba16a737a438223b88279dc6c85
SHA1cc066efa0fca9bc9f44013660dea6b28ddfd6a24
SHA256d3674f4b34a8ca8167160519aa5c66b6024eb09f4cb0c9278bc44370b0efec6a
SHA51237cc8c954544374d0a1ca4d012c9bd0b47781bc9bb8d0c15a8a95b9934893db3bedee867b984c20edabe54c39574abf7250de433aade6c0d544b8dd2c972c6da
-
Filesize
45KB
MD579e32d64061acfaa33995206746530ec
SHA14aba6e460ea0442e2dcd60a25259f984ce9c93ef
SHA256be9a96a2a7dda6dacb43715c30ba02e194368a17db4fa8579576d60076716fcc
SHA5127d7786b6c54795d12fb16845c4e28b062db5236e37927acb0fe8e4a7d143f036664d7463c2cd1cb71adc9410a2a5aba9feda60a8bc6c4fc38700d78b3e5e6ca3