metasploit | ced3c02a87991cb0112d9b4a7d73e0f00c9a8791de01da3e36e57e4cbd0644da

Analysis

max time kernel
150s
max time network
123s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
08/07/2024, 22:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ced3c02a87991cb0112d9b4a7d73e0f00c9a8791de01da3e36e57e4cbd0644da.exe
Size

2.6MB
MD5

2ca30af5c55fea6eb038cbb655a1676c
SHA1

a701d9464df02d1467b2a72557160c7b548206d5
SHA256

ced3c02a87991cb0112d9b4a7d73e0f00c9a8791de01da3e36e57e4cbd0644da
SHA512

fd7f6ae26c87724cff8eda2ae1d655fc0ab433a003989d187215bf7e48ebc5343c30a8accd2aa5ed98df0141a1502eb84ce5c04a9df223970fe4297168ee3e1c
SSDEEP

12288:LJKxMQJjOyjk0OpGiGkHnYoLXFgHAVXqlxcXqkQ9Y7otV94QHN72u16MoCWaGTvH:sMCFdeLy4QHZH1jFWhXwM

Score

10^/10

metasploit backdoor evasion trojan

Malware Config

Extracted

Family

metasploit

Version

encoder/fnstenv_mov

Signatures

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit

Modifies security service 2 TTPs 22 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Start = "4"	regedit.exe

Executes dropped EXE 23 IoCs

pid	Process
1276	buftemp1.exe
1296	buftemp2.exe
2788	buftemp1.exe
2872	Winextension.exe
3004	Winextension.exe
1816	Winextension.exe
1852	Winextension.exe
624	Winextension.exe
1896	Winextension.exe
3052	Winextension.exe
2168	Winextension.exe
2056	Winextension.exe
1492	Winextension.exe
764	Winextension.exe
2136	Winextension.exe
2732	Winextension.exe
2648	Winextension.exe
604	Winextension.exe
1136	Winextension.exe
2800	Winextension.exe
2464	Winextension.exe
2376	Winextension.exe
1788	Winextension.exe

Loads dropped DLL 20 IoCs

pid	Process
2788	buftemp1.exe
2788	buftemp1.exe
3004	Winextension.exe
3004	Winextension.exe
1852	Winextension.exe
1852	Winextension.exe
1896	Winextension.exe
1896	Winextension.exe
2168	Winextension.exe
2168	Winextension.exe
1492	Winextension.exe
1492	Winextension.exe
2136	Winextension.exe
2136	Winextension.exe
2648	Winextension.exe
2648	Winextension.exe
1136	Winextension.exe
1136	Winextension.exe
2464	Winextension.exe
2464	Winextension.exe

Drops file in System32 directory 30 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Winextension.exe	Winextension.exe
File created	C:\Windows\SysWOW64\Winextension.exe	Winextension.exe
File opened for modification	C:\Windows\SysWOW64\Winextension.exe	Winextension.exe
File created	C:\Windows\SysWOW64\Winextension.exe	Winextension.exe
File opened for modification	C:\Windows\SysWOW64\Winextension.exe	Winextension.exe
File created	C:\Windows\SysWOW64\Winextension.exe	buftemp1.exe
File opened for modification	C:\Windows\SysWOW64\Winextension.exe	Winextension.exe
File opened for modification	C:\Windows\SysWOW64\Winextension.exe	Winextension.exe
File opened for modification	C:\Windows\SysWOW64\Winextension.exe	Winextension.exe
File opened for modification	C:\Windows\SysWOW64\Winextension.exe	Winextension.exe
File created	C:\Windows\SysWOW64\Winextension.exe	Winextension.exe
File opened for modification	C:\Windows\SysWOW64\Winextension.exe	Winextension.exe
File opened for modification	C:\Windows\SysWOW64\Winextension.exe	buftemp1.exe
File opened for modification	C:\Windows\SysWOW64\Winextension.exe	Winextension.exe
File created	C:\Windows\SysWOW64\Winextension.exe	Winextension.exe
File created	C:\Windows\SysWOW64\Winextension.exe	Winextension.exe
File opened for modification	C:\Windows\SysWOW64\Winextension.exe	Winextension.exe
File opened for modification	C:\Windows\SysWOW64\Winextension.exe	Winextension.exe
File opened for modification	C:\Windows\SysWOW64\Winextension.exe	Winextension.exe
File opened for modification	C:\Windows\SysWOW64\Winextension.exe	Winextension.exe
File created	C:\Windows\SysWOW64\Winextension.exe	Winextension.exe
File opened for modification	C:\Windows\SysWOW64\Winextension.exe	Winextension.exe
File opened for modification	C:\Windows\SysWOW64\Winextension.exe	Winextension.exe
File opened for modification	C:\Windows\SysWOW64\Winextension.exe	Winextension.exe
File opened for modification	C:\Windows\SysWOW64\Winextension.exe	Winextension.exe
File opened for modification	C:\Windows\SysWOW64\Winextension.exe	Winextension.exe
File created	C:\Windows\SysWOW64\Winextension.exe	Winextension.exe
File created	C:\Windows\SysWOW64\Winextension.exe	Winextension.exe
File opened for modification	C:\Windows\SysWOW64\Winextension.exe	Winextension.exe
File created	C:\Windows\SysWOW64\Winextension.exe	Winextension.exe

Suspicious use of SetThreadContext 11 IoCs

description	pid	Process	procid_target
PID 1276 set thread context of 2788	1276	buftemp1.exe	32
PID 2872 set thread context of 3004	2872	Winextension.exe	36
PID 1816 set thread context of 1852	1816	Winextension.exe	41
PID 624 set thread context of 1896	624	Winextension.exe	45
PID 3052 set thread context of 2168	3052	Winextension.exe	49
PID 2056 set thread context of 1492	2056	Winextension.exe	53
PID 764 set thread context of 2136	764	Winextension.exe	57
PID 2732 set thread context of 2648	2732	Winextension.exe	61
PID 604 set thread context of 1136	604	Winextension.exe	65
PID 2800 set thread context of 2464	2800	Winextension.exe	69
PID 2376 set thread context of 1788	2376	Winextension.exe	73

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\buftemp1.exe	ced3c02a87991cb0112d9b4a7d73e0f00c9a8791de01da3e36e57e4cbd0644da.exe
File opened for modification	C:\Windows\buftemp2.exe	ced3c02a87991cb0112d9b4a7d73e0f00c9a8791de01da3e36e57e4cbd0644da.exe
File opened for modification	C:\Windows\buftemp3.exe	ced3c02a87991cb0112d9b4a7d73e0f00c9a8791de01da3e36e57e4cbd0644da.exe
File opened for modification	C:\Windows\buftemp1.exe	buftemp1.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Runs .reg file with regedit 11 IoCs

pid	Process
940	regedit.exe
1736	regedit.exe
2888	regedit.exe
3048	regedit.exe
2800	regedit.exe
2532	regedit.exe
1752	regedit.exe
1128	regedit.exe
796	regedit.exe
332	regedit.exe
2560	regedit.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2788	buftemp1.exe
2788	buftemp1.exe
2788	buftemp1.exe
3004	Winextension.exe
3004	Winextension.exe
3004	Winextension.exe
3004	Winextension.exe
3004	Winextension.exe
3004	Winextension.exe
3004	Winextension.exe
3004	Winextension.exe
3004	Winextension.exe
3004	Winextension.exe
3004	Winextension.exe
3004	Winextension.exe
3004	Winextension.exe
3004	Winextension.exe
3004	Winextension.exe
3004	Winextension.exe
3004	Winextension.exe
3004	Winextension.exe
3004	Winextension.exe
3004	Winextension.exe
3004	Winextension.exe
3004	Winextension.exe
3004	Winextension.exe
3004	Winextension.exe
3004	Winextension.exe
3004	Winextension.exe
3004	Winextension.exe
3004	Winextension.exe
3004	Winextension.exe
3004	Winextension.exe
3004	Winextension.exe
3004	Winextension.exe
3004	Winextension.exe
3004	Winextension.exe
3004	Winextension.exe
3004	Winextension.exe
3004	Winextension.exe
3004	Winextension.exe
3004	Winextension.exe
3004	Winextension.exe
3004	Winextension.exe
3004	Winextension.exe
3004	Winextension.exe
3004	Winextension.exe
3004	Winextension.exe
3004	Winextension.exe
3004	Winextension.exe
3004	Winextension.exe
3004	Winextension.exe
3004	Winextension.exe
3004	Winextension.exe
3004	Winextension.exe
3004	Winextension.exe
3004	Winextension.exe
3004	Winextension.exe
3004	Winextension.exe
3004	Winextension.exe
3004	Winextension.exe
3004	Winextension.exe
3004	Winextension.exe
3004	Winextension.exe

Suspicious use of SetWindowsHookEx 13 IoCs

pid	Process
1792	ced3c02a87991cb0112d9b4a7d73e0f00c9a8791de01da3e36e57e4cbd0644da.exe
1276	buftemp1.exe
1296	buftemp2.exe
2872	Winextension.exe
1816	Winextension.exe
624	Winextension.exe
3052	Winextension.exe
2056	Winextension.exe
764	Winextension.exe
2732	Winextension.exe
604	Winextension.exe
2800	Winextension.exe
2376	Winextension.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1792 wrote to memory of 1276	1792	ced3c02a87991cb0112d9b4a7d73e0f00c9a8791de01da3e36e57e4cbd0644da.exe	30
PID 1792 wrote to memory of 1276	1792	ced3c02a87991cb0112d9b4a7d73e0f00c9a8791de01da3e36e57e4cbd0644da.exe	30
PID 1792 wrote to memory of 1276	1792	ced3c02a87991cb0112d9b4a7d73e0f00c9a8791de01da3e36e57e4cbd0644da.exe	30
PID 1792 wrote to memory of 1276	1792	ced3c02a87991cb0112d9b4a7d73e0f00c9a8791de01da3e36e57e4cbd0644da.exe	30
PID 1792 wrote to memory of 1296	1792	ced3c02a87991cb0112d9b4a7d73e0f00c9a8791de01da3e36e57e4cbd0644da.exe	31
PID 1792 wrote to memory of 1296	1792	ced3c02a87991cb0112d9b4a7d73e0f00c9a8791de01da3e36e57e4cbd0644da.exe	31
PID 1792 wrote to memory of 1296	1792	ced3c02a87991cb0112d9b4a7d73e0f00c9a8791de01da3e36e57e4cbd0644da.exe	31
PID 1792 wrote to memory of 1296	1792	ced3c02a87991cb0112d9b4a7d73e0f00c9a8791de01da3e36e57e4cbd0644da.exe	31
PID 1276 wrote to memory of 2788	1276	buftemp1.exe	32
PID 1276 wrote to memory of 2788	1276	buftemp1.exe	32
PID 1276 wrote to memory of 2788	1276	buftemp1.exe	32
PID 1276 wrote to memory of 2788	1276	buftemp1.exe	32
PID 1276 wrote to memory of 2788	1276	buftemp1.exe	32
PID 1276 wrote to memory of 2788	1276	buftemp1.exe	32
PID 1276 wrote to memory of 2788	1276	buftemp1.exe	32
PID 1276 wrote to memory of 2788	1276	buftemp1.exe	32
PID 1276 wrote to memory of 2788	1276	buftemp1.exe	32
PID 1276 wrote to memory of 2788	1276	buftemp1.exe	32
PID 1276 wrote to memory of 2788	1276	buftemp1.exe	32
PID 2788 wrote to memory of 2884	2788	buftemp1.exe	33
PID 2788 wrote to memory of 2884	2788	buftemp1.exe	33
PID 2788 wrote to memory of 2884	2788	buftemp1.exe	33
PID 2788 wrote to memory of 2884	2788	buftemp1.exe	33
PID 2884 wrote to memory of 1128	2884	cmd.exe	34
PID 2884 wrote to memory of 1128	2884	cmd.exe	34
PID 2884 wrote to memory of 1128	2884	cmd.exe	34
PID 2884 wrote to memory of 1128	2884	cmd.exe	34
PID 2788 wrote to memory of 2872	2788	buftemp1.exe	35
PID 2788 wrote to memory of 2872	2788	buftemp1.exe	35
PID 2788 wrote to memory of 2872	2788	buftemp1.exe	35
PID 2788 wrote to memory of 2872	2788	buftemp1.exe	35
PID 2872 wrote to memory of 3004	2872	Winextension.exe	36
PID 2872 wrote to memory of 3004	2872	Winextension.exe	36
PID 2872 wrote to memory of 3004	2872	Winextension.exe	36
PID 2872 wrote to memory of 3004	2872	Winextension.exe	36
PID 2872 wrote to memory of 3004	2872	Winextension.exe	36
PID 2872 wrote to memory of 3004	2872	Winextension.exe	36
PID 2872 wrote to memory of 3004	2872	Winextension.exe	36
PID 2872 wrote to memory of 3004	2872	Winextension.exe	36
PID 2872 wrote to memory of 3004	2872	Winextension.exe	36
PID 2872 wrote to memory of 3004	2872	Winextension.exe	36
PID 2872 wrote to memory of 3004	2872	Winextension.exe	36
PID 3004 wrote to memory of 2400	3004	Winextension.exe	37
PID 3004 wrote to memory of 2400	3004	Winextension.exe	37
PID 3004 wrote to memory of 2400	3004	Winextension.exe	37
PID 3004 wrote to memory of 2400	3004	Winextension.exe	37
PID 2400 wrote to memory of 796	2400	cmd.exe	38
PID 2400 wrote to memory of 796	2400	cmd.exe	38
PID 2400 wrote to memory of 796	2400	cmd.exe	38
PID 2400 wrote to memory of 796	2400	cmd.exe	38
PID 3004 wrote to memory of 1816	3004	Winextension.exe	40
PID 3004 wrote to memory of 1816	3004	Winextension.exe	40
PID 3004 wrote to memory of 1816	3004	Winextension.exe	40
PID 3004 wrote to memory of 1816	3004	Winextension.exe	40
PID 1816 wrote to memory of 1852	1816	Winextension.exe	41
PID 1816 wrote to memory of 1852	1816	Winextension.exe	41
PID 1816 wrote to memory of 1852	1816	Winextension.exe	41
PID 1816 wrote to memory of 1852	1816	Winextension.exe	41
PID 1816 wrote to memory of 1852	1816	Winextension.exe	41
PID 1816 wrote to memory of 1852	1816	Winextension.exe	41
PID 1816 wrote to memory of 1852	1816	Winextension.exe	41
PID 1816 wrote to memory of 1852	1816	Winextension.exe	41
PID 1816 wrote to memory of 1852	1816	Winextension.exe	41
PID 1816 wrote to memory of 1852	1816	Winextension.exe	41

C:\Users\Admin\AppData\Local\Temp\ced3c02a87991cb0112d9b4a7d73e0f00c9a8791de01da3e36e57e4cbd0644da.exe
"C:\Users\Admin\AppData\Local\Temp\ced3c02a87991cb0112d9b4a7d73e0f00c9a8791de01da3e36e57e4cbd0644da.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1792
- C:\Windows\buftemp1.exe
  "C:\Windows\buftemp1.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Drops file in Windows directory
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1276
- - C:\Windows\buftemp1.exe
    C:\Windows\buftemp1.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in System32 directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2788
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c c:\a.bat
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2884
    - - C:\Windows\SysWOW64\regedit.exe
        
        REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
        5⤵
        Modifies security service
        Runs .reg file with regedit
        
        PID:1128
  - - C:\Windows\SysWOW64\Winextension.exe
      C:\Windows\system32\Winextension.exe 480 "C:\Windows\buftemp1.exe"
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious use of SetThreadContext
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2872
    - - C:\Windows\SysWOW64\Winextension.exe
        
        C:\Windows\SysWOW64\Winextension.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:3004
      - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c c:\a.bat
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:2400
        
        C:\Windows\SysWOW64\regedit.exe
        
        REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
        7⤵
        Modifies security service
        Runs .reg file with regedit
        
        PID:796
      - C:\Windows\SysWOW64\Winextension.exe
        
        C:\Windows\system32\Winextension.exe 1104 "C:\Windows\SysWOW64\Winextension.exe"
        6⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1816
        
        C:\Windows\SysWOW64\Winextension.exe
        
        C:\Windows\SysWOW64\Winextension.exe
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        
        PID:1852
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c c:\a.bat
        8⤵
        
        PID:1808
        
        C:\Windows\SysWOW64\regedit.exe
        
        REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
        9⤵
        Modifies security service
        Runs .reg file with regedit
        
        PID:332
        
        C:\Windows\SysWOW64\Winextension.exe
        
        C:\Windows\system32\Winextension.exe 1104 "C:\Windows\SysWOW64\Winextension.exe"
        8⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:624
        
        C:\Windows\SysWOW64\Winextension.exe
        
        C:\Windows\SysWOW64\Winextension.exe
        9⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        
        PID:1896
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c c:\a.bat
        10⤵
        
        PID:1708
        
        C:\Windows\SysWOW64\regedit.exe
        
        REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
        11⤵
        Modifies security service
        Runs .reg file with regedit
        
        PID:1736
        
        C:\Windows\SysWOW64\Winextension.exe
        
        C:\Windows\system32\Winextension.exe 1104 "C:\Windows\SysWOW64\Winextension.exe"
        10⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:3052
        
        C:\Windows\SysWOW64\Winextension.exe
        
        C:\Windows\SysWOW64\Winextension.exe
        11⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        
        PID:2168
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c c:\a.bat
        12⤵
        
        PID:2352
        
        C:\Windows\SysWOW64\regedit.exe
        
        REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
        13⤵
        Modifies security service
        Runs .reg file with regedit
        
        PID:2888
        
        C:\Windows\SysWOW64\Winextension.exe
        
        C:\Windows\system32\Winextension.exe 1104 "C:\Windows\SysWOW64\Winextension.exe"
        12⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:2056
        
        C:\Windows\SysWOW64\Winextension.exe
        
        C:\Windows\SysWOW64\Winextension.exe
        13⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        
        PID:1492
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c c:\a.bat
        14⤵
        
        PID:588
        
        C:\Windows\SysWOW64\regedit.exe
        
        REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
        15⤵
        Modifies security service
        Runs .reg file with regedit
        
        PID:3048
        
        C:\Windows\SysWOW64\Winextension.exe
        
        C:\Windows\system32\Winextension.exe 1104 "C:\Windows\SysWOW64\Winextension.exe"
        14⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:764
        
        C:\Windows\SysWOW64\Winextension.exe
        
        C:\Windows\SysWOW64\Winextension.exe
        15⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        
        PID:2136
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c c:\a.bat
        16⤵
        
        PID:2204
        
        C:\Windows\SysWOW64\regedit.exe
        
        REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
        17⤵
        Modifies security service
        Runs .reg file with regedit
        
        PID:2800
        
        C:\Windows\SysWOW64\Winextension.exe
        
        C:\Windows\system32\Winextension.exe 1104 "C:\Windows\SysWOW64\Winextension.exe"
        16⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:2732
        
        C:\Windows\SysWOW64\Winextension.exe
        
        C:\Windows\SysWOW64\Winextension.exe
        17⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        
        PID:2648
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c c:\a.bat
        18⤵
        
        PID:2188
        
        C:\Windows\SysWOW64\regedit.exe
        
        REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
        19⤵
        Modifies security service
        Runs .reg file with regedit
        
        PID:2560
        
        C:\Windows\SysWOW64\Winextension.exe
        
        C:\Windows\system32\Winextension.exe 1104 "C:\Windows\SysWOW64\Winextension.exe"
        18⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:604
        
        C:\Windows\SysWOW64\Winextension.exe
        
        C:\Windows\SysWOW64\Winextension.exe
        19⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        
        PID:1136
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c c:\a.bat
        20⤵
        
        PID:340
        
        C:\Windows\SysWOW64\regedit.exe
        
        REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
        21⤵
        Modifies security service
        Runs .reg file with regedit
        
        PID:2532
        
        C:\Windows\SysWOW64\Winextension.exe
        
        C:\Windows\system32\Winextension.exe 1100 "C:\Windows\SysWOW64\Winextension.exe"
        20⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:2800
        
        C:\Windows\SysWOW64\Winextension.exe
        
        C:\Windows\SysWOW64\Winextension.exe
        21⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2464
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c c:\a.bat
        22⤵
        
        PID:2456
        
        C:\Windows\SysWOW64\regedit.exe
        
        REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
        23⤵
        Modifies security service
        Runs .reg file with regedit
        
        PID:940
        
        C:\Windows\SysWOW64\Winextension.exe
        
        C:\Windows\system32\Winextension.exe 1104 "C:\Windows\SysWOW64\Winextension.exe"
        22⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:2376
        
        C:\Windows\SysWOW64\Winextension.exe
        
        C:\Windows\SysWOW64\Winextension.exe
        23⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1788
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c c:\a.bat
        24⤵
        
        PID:2232
        
        C:\Windows\SysWOW64\regedit.exe
        
        REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
        25⤵
        Modifies security service
        Runs .reg file with regedit
        
        PID:1752
- C:\Windows\buftemp2.exe
  "C:\Windows\buftemp2.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1296

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\1.reg

Filesize
3KB

MD5
5e073629d751540b3512a229a7c56baf

SHA1
8d384f06bf3fe00d178514990ae39fc54d4e3941

SHA256
2039732d26af5a0d4db7bda4a781967a0e0e4543dea9838690219e3cb688449e

SHA512
84fc0d818ecd5706904b5918170436820ffc78c894cbe549a4f5b04b5c9832e3d709c98d56c8522b55a98cd9db8ec04aeaa020e9162e8a35503597ca580126fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\1.reg

Filesize
3KB

MD5
9e5db93bd3302c217b15561d8f1e299d

SHA1
95a5579b336d16213909beda75589fd0a2091f30

SHA256
f360fb5740172b6b4dd59c1ac30b480511665ae991196f833167e275d91f943e

SHA512
b5547e5047a3c43397ee846ff9d5979cba45ba44671db5c5df5536d9dc26262e27a8645a08e0cf35960a3601dc0f6f5fe8d47ae232c9ca44d6899e97d36fb25a

Download Submit
C:\Users\Admin\AppData\Local\Temp\1.reg

Filesize
3KB

MD5
117efa689c5631c1a1ee316f123182bd

SHA1
f477bf1e9f4db8452bd9fe314cd18715f7045689

SHA256
79ed2f9f9de900b4f0a4869fc5dd40f1dcfb11a3f50bd7a5f362b30fe51b52e7

SHA512
abe34afa94cca236205e9ea954b95a78c986612cebd847f5146f792c00a5c58ca1fdc55be2befd974b5be77b1b117e28d8c4996f34b41c78b653725f21da4671

Download Submit
C:\Windows\buftemp1.exe

Filesize
1.8MB

MD5
6170bb1a8eb70f2c2f9a1473c004d6af

SHA1
b329b644d02c4a350a3ce600b91cf568e33631d7

SHA256
8cb592d6617e6065f53413f4e2270b2be619083c2365d0b73467550cb23a4421

SHA512
9193130c53adda78c144687308c9e08ef6cd8933c940d96591212173a681d8103751332da8e5c9801760aabce29c1780498f08552892273f33e54d1ca1e4cd89

Download Submit
C:\Windows\buftemp2.exe

Filesize
36KB

MD5
ef835a7dbc2f8c2358e772d4430f5210

SHA1
f0af82f4271abf37ba45ad69c73f8109e4e03a38

SHA256
76dbfc96d9ea63bfa7f716bb599fb8ae4fe9541a2c72f55bf2db7bea450e240f

SHA512
5c141bf6bf29953dfaeb4d67a1efe42894518ba0812dd2422e3b2ce78cfe6d596e001d5c35691f4d352b7d5eca1b49386f9c79cf541f782c72c8da3ddb0fbaff

Download Submit
C:\a.bat

Filesize
5KB

MD5
0019a0451cc6b9659762c3e274bc04fb

SHA1
5259e256cc0908f2846e532161b989f1295f479b

SHA256
ce4674afd978d1401596d22a0961f90c8fb53c5bd55649684e1a999c8cf77876

SHA512
314c23ec37cb0cd4443213c019c4541df968447353b422ef6fff1e7ddf6c983c80778787408b7ca9b81e580a6a7f1589ca7f43c022e6fc16182973580ed4d904

Download Submit
memory/1852-431-0x0000000000400000-0x000000000049F000-memory.dmp

Filesize
636KB

Download
memory/1896-567-0x0000000000400000-0x000000000049F000-memory.dmp

Filesize
636KB

Download
memory/2788-23-0x0000000000400000-0x000000000049F000-memory.dmp

Filesize
636KB

Download
memory/2788-25-0x0000000000400000-0x000000000049F000-memory.dmp

Filesize
636KB

Download
memory/2788-27-0x0000000000400000-0x000000000049F000-memory.dmp

Filesize
636KB

Download
memory/2788-38-0x0000000000400000-0x000000000049F000-memory.dmp

Filesize
636KB

Download
memory/2788-29-0x0000000000400000-0x000000000049F000-memory.dmp

Filesize
636KB

Download
memory/2788-30-0x0000000000400000-0x000000000049F000-memory.dmp

Filesize
636KB

Download
memory/2788-31-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2788-152-0x0000000000400000-0x000000000049F000-memory.dmp

Filesize
636KB

Download
memory/2788-36-0x0000000000400000-0x000000000049F000-memory.dmp

Filesize
636KB

Download
memory/2788-33-0x0000000000400000-0x000000000049F000-memory.dmp

Filesize
636KB

Download
memory/2788-21-0x0000000000400000-0x000000000049F000-memory.dmp

Filesize
636KB

Download
memory/3004-295-0x0000000000400000-0x000000000049F000-memory.dmp

Filesize
636KB

Download