Analysis Overview
SHA256
c58de5f40be8fd760fc08b1ef7ae5a3f5771dbc214426156e3a21a89bb8303fc
Threat Level: Known bad
The file EKTEDIR.exe was found to be: Known bad.
Malicious Activity Summary
Snake Keylogger
Snake Keylogger payload
Loads dropped DLL
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Accesses Microsoft Outlook profiles
Looks up external IP address via web service
Legitimate hosting services abused for malware hosting/C2
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Suspicious use of NtCreateThreadExHideFromDebugger
Drops file in Program Files directory
Drops file in Windows directory
Unsigned PE
Program crash
Enumerates physical storage devices
NSIS installer
outlook_office_path
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of WriteProcessMemory
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Opens file in notepad (likely ransom note)
Suspicious behavior: MapViewOfSection
outlook_win_path
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-07-09 07:32
Signatures
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
NSIS installer
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Analysis: behavioral10
Detonation Overview
Submitted
2024-07-09 07:32
Reported
2024-07-09 07:35
Platform
win10v2004-20240704-en
Max time kernel
93s
Max time network
98s
Command Line
Signatures
Enumerates physical storage devices
Modifies registry class
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\S-1-5-21-2547232018-1419253926-3356748848-1000_Classes\Local Settings | C:\Windows\system32\cmd.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2547232018-1419253926-3356748848-1000_Classes\Local Settings | C:\Windows\system32\OpenWith.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\OpenWith.exe | N/A |
Processes
C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Hylozoism\Haardhudet.rav
C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 75.159.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 0.205.248.87.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 26.35.223.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 86.23.85.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 198.187.3.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 36.56.20.217.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 81.144.22.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 172.214.232.199.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 13.227.111.52.in-addr.arpa | udp |
Files
Analysis: behavioral12
Detonation Overview
Submitted
2024-07-09 07:32
Reported
2024-07-09 07:35
Platform
win10v2004-20240704-en
Max time kernel
95s
Max time network
102s
Command Line
Signatures
Enumerates physical storage devices
Modifies registry class
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\S-1-5-21-771719357-2485960699-3367710044-1000_Classes\Local Settings | C:\Windows\system32\cmd.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-771719357-2485960699-3367710044-1000_Classes\Local Settings | C:\Windows\system32\OpenWith.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\OpenWith.exe | N/A |
Processes
C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Hylozoism\Herbiest116.vre
C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | g.bing.com | udp |
| US | 13.107.21.237:443 | g.bing.com | tcp |
| US | 8.8.8.8:53 | 8.8.8.8.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 4.159.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 240.221.184.93.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 237.21.107.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 157.123.68.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 206.23.85.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 192.142.123.92.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 30.243.111.52.in-addr.arpa | udp |
Files
Analysis: behavioral17
Detonation Overview
Submitted
2024-07-09 07:32
Reported
2024-07-09 07:35
Platform
win7-20240704-en
Max time kernel
118s
Max time network
120s
Command Line
Signatures
Opens file in notepad (likely ransom note)
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\NOTEPAD.EXE | N/A |
Processes
C:\Windows\system32\NOTEPAD.EXE
C:\Windows\system32\NOTEPAD.EXE C:\Users\Admin\AppData\Local\Temp\Hylozoism\figurally.txt
Network
Files
Analysis: behavioral21
Detonation Overview
Submitted
2024-07-09 07:32
Reported
2024-07-09 07:35
Platform
win7-20240704-en
Max time kernel
117s
Max time network
118s
Command Line
Signatures
Enumerates physical storage devices
Modifies registry class
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\ten_auto_file\shell\Read\command | C:\Windows\system32\rundll32.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\ten_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" | C:\Windows\system32\rundll32.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\ten_auto_file | C:\Windows\system32\rundll32.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\ten_auto_file\ | C:\Windows\system32\rundll32.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\.ten | C:\Windows\system32\rundll32.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\.ten\ = "ten_auto_file" | C:\Windows\system32\rundll32.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\ten_auto_file\shell | C:\Windows\system32\rundll32.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_Classes\Local Settings | C:\Windows\system32\rundll32.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\ten_auto_file\shell\Read | C:\Windows\system32\rundll32.exe | N/A |
Suspicious behavior: GetForegroundWindowSpam
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 2512 wrote to memory of 2692 | N/A | C:\Windows\system32\cmd.exe | C:\Windows\system32\rundll32.exe |
| PID 2512 wrote to memory of 2692 | N/A | C:\Windows\system32\cmd.exe | C:\Windows\system32\rundll32.exe |
| PID 2512 wrote to memory of 2692 | N/A | C:\Windows\system32\cmd.exe | C:\Windows\system32\rundll32.exe |
| PID 2692 wrote to memory of 2592 | N/A | C:\Windows\system32\rundll32.exe | C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe |
| PID 2692 wrote to memory of 2592 | N/A | C:\Windows\system32\rundll32.exe | C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe |
| PID 2692 wrote to memory of 2592 | N/A | C:\Windows\system32\rundll32.exe | C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe |
| PID 2692 wrote to memory of 2592 | N/A | C:\Windows\system32\rundll32.exe | C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe |
Processes
C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Occluding225.ten
C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Occluding225.ten
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Occluding225.ten"
Network
Files
Analysis: behavioral1
Detonation Overview
Submitted
2024-07-09 07:32
Reported
2024-07-09 07:35
Platform
win7-20240704-en
Max time kernel
117s
Max time network
122s
Command Line
Signatures
Snake Keylogger
Snake Keylogger payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Loads dropped DLL
Reads user/profile data of web browsers
Accesses Microsoft Outlook profiles
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\EKTEDIR.exe | N/A |
| Key opened | \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\EKTEDIR.exe | N/A |
| Key opened | \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\EKTEDIR.exe | N/A |
Legitimate hosting services abused for malware hosting/C2
| Description | Indicator | Process | Target |
| N/A | drive.google.com | N/A | N/A |
| N/A | drive.google.com | N/A | N/A |
Looks up external IP address via web service
| Description | Indicator | Process | Target |
| N/A | checkip.dyndns.org | N/A | N/A |
Suspicious use of NtCreateThreadExHideFromDebugger
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\EKTEDIR.exe | N/A |
Suspicious use of NtSetInformationThreadHideFromDebugger
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\EKTEDIR.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\EKTEDIR.exe | N/A |
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 2084 set thread context of 2556 | N/A | C:\Users\Admin\AppData\Local\Temp\EKTEDIR.exe | C:\Users\Admin\AppData\Local\Temp\EKTEDIR.exe |
Drops file in Program Files directory
| Description | Indicator | Process | Target |
| File created | C:\Program Files (x86)\Common Files\rampire.lnk | C:\Users\Admin\AppData\Local\Temp\EKTEDIR.exe | N/A |
| File opened for modification | C:\Program Files (x86)\breplanerne\Pist.ini | C:\Users\Admin\AppData\Local\Temp\EKTEDIR.exe | N/A |
Drops file in Windows directory
| Description | Indicator | Process | Target |
| File opened for modification | C:\Windows\Fonts\sysselstter\Complexer.ini | C:\Users\Admin\AppData\Local\Temp\EKTEDIR.exe | N/A |
| File opened for modification | C:\Windows\resources\0409\Markazes\Sprtter.Dem | C:\Users\Admin\AppData\Local\Temp\EKTEDIR.exe | N/A |
Enumerates physical storage devices
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\EKTEDIR.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\EKTEDIR.exe | N/A |
Suspicious behavior: MapViewOfSection
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\EKTEDIR.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\EKTEDIR.exe | N/A |
Suspicious use of WriteProcessMemory
outlook_office_path
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\EKTEDIR.exe | N/A |
outlook_win_path
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\EKTEDIR.exe | N/A |
Processes
C:\Users\Admin\AppData\Local\Temp\EKTEDIR.exe
"C:\Users\Admin\AppData\Local\Temp\EKTEDIR.exe"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "250^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "244^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "227^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "255^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "244^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "253^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "130^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "131^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "139^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "139^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "242^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "195^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "212^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "208^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "197^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "212^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "247^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "221^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "212^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "240^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "153^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "220^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "195^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "133^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "157^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "201^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "137^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "157^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "157^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "193^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "157^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "133^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "157^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "201^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "137^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "157^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "152^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "159^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "195^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "132^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "141^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "250^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "244^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "227^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "255^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "244^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "253^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "130^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "131^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "139^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "139^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "231^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "195^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "197^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "196^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "208^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "221^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "240^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "221^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "221^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "222^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "210^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "153^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "157^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "133^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "132^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "135^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "128^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "134^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "128^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "132^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "131^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "157^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "201^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "130^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "157^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "201^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "133^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "152^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "193^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "159^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "195^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "128^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "141^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "250^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "244^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "227^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "255^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "244^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "253^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "130^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "131^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "139^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "139^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "226^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "212^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "197^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "247^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "221^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "212^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "225^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "222^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "223^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "197^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "212^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "195^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "153^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "195^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "132^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "157^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "135^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "134^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "134^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "157^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "157^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "152^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "159^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "195^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "130^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "141^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "250^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "244^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "227^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "255^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "244^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "253^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "130^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "131^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "139^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "139^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "227^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "212^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "208^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "213^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "247^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "221^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "212^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "153^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "195^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "132^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "157^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "195^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "128^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "157^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "133^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "132^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "135^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "128^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "134^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "128^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "132^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "131^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "157^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "155^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "157^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "152^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "159^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "195^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "130^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "141^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "196^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "194^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "212^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "195^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "130^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "131^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "139^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "139^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "242^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "208^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "221^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "221^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "230^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "223^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "213^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "222^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "198^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "225^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "195^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "222^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "210^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "240^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "153^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "195^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "128^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "157^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "157^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "157^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "157^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "152^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "141^177"
C:\Users\Admin\AppData\Local\Temp\EKTEDIR.exe
"C:\Users\Admin\AppData\Local\Temp\EKTEDIR.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | drive.google.com | udp |
| GB | 172.217.16.238:443 | drive.google.com | tcp |
| US | 8.8.8.8:53 | c.pki.goog | udp |
| GB | 216.58.201.99:80 | c.pki.goog | tcp |
| US | 8.8.8.8:53 | o.pki.goog | udp |
| GB | 216.58.201.99:80 | o.pki.goog | tcp |
| US | 8.8.8.8:53 | drive.usercontent.google.com | udp |
| GB | 216.58.201.97:443 | drive.usercontent.google.com | tcp |
| US | 8.8.8.8:53 | checkip.dyndns.org | udp |
| BR | 132.226.247.73:80 | checkip.dyndns.org | tcp |
| US | 8.8.8.8:53 | reallyfreegeoip.org | udp |
| US | 172.67.177.134:443 | reallyfreegeoip.org | tcp |
Files
\Users\Admin\AppData\Local\Temp\nso8289.tmp\System.dll
| MD5 | 4d3b19a81bd51f8ce44b93643a4e3a99 |
| SHA1 | 35f8b00e85577b014080df98bd2c378351d9b3e9 |
| SHA256 | fda0018ab182ac6025d2fc9a2efcce3745d1da21ce5141859f8286cf319a52ce |
| SHA512 | b2ba9c961c0e1617f802990587a9000979ab5cc493ae2f8ca852eb43eeaf24916b0b29057dbff7d41a1797dfb2dce3db41990e8639b8f205771dbec3fd80f622 |
\Users\Admin\AppData\Local\Temp\nso8289.tmp\nsExec.dll
| MD5 | 3eb4cd50dcb9f5981f5408578cb7fb70 |
| SHA1 | 13b38cc104ba6ee22dc4dfa6e480e36587f4bc71 |
| SHA256 | 1c2f19e57dc72587aa00800a498c5f581b7d6761dc13b24bcf287ea7bd5ca2bf |
| SHA512 | 5a0c9d28df7a77e157046dce876282c48f434a441ee34e12b88f55be31be536eff676f580adbe4586da3f1519f94b5793ccbb3068b4b009eee286c0c5135d324 |
memory/2084-965-0x0000000010004000-0x0000000010005000-memory.dmp
memory/2556-966-0x00000000004A0000-0x0000000001502000-memory.dmp
memory/2556-988-0x00000000004A0000-0x0000000001502000-memory.dmp
memory/2556-989-0x00000000004A0000-0x00000000004C6000-memory.dmp
Analysis: behavioral2
Detonation Overview
Submitted
2024-07-09 07:32
Reported
2024-07-09 07:35
Platform
win10v2004-20240704-en
Max time kernel
146s
Max time network
132s
Command Line
Signatures
Snake Keylogger
Snake Keylogger payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Loads dropped DLL
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Accesses Microsoft Outlook profiles
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\USER\S-1-5-21-661257284-3186977026-4220467887-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\EKTEDIR.exe | N/A |
| Key opened | \REGISTRY\USER\S-1-5-21-661257284-3186977026-4220467887-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\EKTEDIR.exe | N/A |
| Key opened | \REGISTRY\USER\S-1-5-21-661257284-3186977026-4220467887-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\EKTEDIR.exe | N/A |
Legitimate hosting services abused for malware hosting/C2
| Description | Indicator | Process | Target |
| N/A | drive.google.com | N/A | N/A |
| N/A | drive.google.com | N/A | N/A |
Looks up external IP address via web service
| Description | Indicator | Process | Target |
| N/A | checkip.dyndns.org | N/A | N/A |
Suspicious use of NtCreateThreadExHideFromDebugger
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\EKTEDIR.exe | N/A |
Suspicious use of NtSetInformationThreadHideFromDebugger
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\EKTEDIR.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\EKTEDIR.exe | N/A |
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 2392 set thread context of 2124 | N/A | C:\Users\Admin\AppData\Local\Temp\EKTEDIR.exe | C:\Users\Admin\AppData\Local\Temp\EKTEDIR.exe |
Drops file in Program Files directory
| Description | Indicator | Process | Target |
| File created | C:\Program Files (x86)\Common Files\rampire.lnk | C:\Users\Admin\AppData\Local\Temp\EKTEDIR.exe | N/A |
| File opened for modification | C:\Program Files (x86)\breplanerne\Pist.ini | C:\Users\Admin\AppData\Local\Temp\EKTEDIR.exe | N/A |
Drops file in Windows directory
| Description | Indicator | Process | Target |
| File opened for modification | C:\Windows\Fonts\sysselstter\Complexer.ini | C:\Users\Admin\AppData\Local\Temp\EKTEDIR.exe | N/A |
| File opened for modification | C:\Windows\resources\0409\Markazes\Sprtter.Dem | C:\Users\Admin\AppData\Local\Temp\EKTEDIR.exe | N/A |
Enumerates physical storage devices
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\EKTEDIR.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\EKTEDIR.exe | N/A |
Suspicious behavior: MapViewOfSection
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\EKTEDIR.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\EKTEDIR.exe | N/A |
Suspicious use of WriteProcessMemory
outlook_office_path
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\USER\S-1-5-21-661257284-3186977026-4220467887-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\EKTEDIR.exe | N/A |
outlook_win_path
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\USER\S-1-5-21-661257284-3186977026-4220467887-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\EKTEDIR.exe | N/A |
Processes
C:\Users\Admin\AppData\Local\Temp\EKTEDIR.exe
"C:\Users\Admin\AppData\Local\Temp\EKTEDIR.exe"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "250^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "244^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "227^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "255^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "244^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "253^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "130^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "131^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "139^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "139^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "242^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "195^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "212^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "208^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "197^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "212^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "247^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "221^177"
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=3060,i,7252135083366563450,1411796122645726339,262144 --variations-seed-version --mojo-platform-channel-handle=4604 /prefetch:8
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "212^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "240^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "153^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "220^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "195^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "133^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "157^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "201^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "137^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "157^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "157^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "193^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "157^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "133^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "157^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "201^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "137^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "157^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "152^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "159^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "195^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "132^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "141^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "250^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "244^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "227^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "255^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "244^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "253^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "130^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "131^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "139^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "139^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "231^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "195^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "197^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "196^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "208^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "221^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "240^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "221^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "221^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "222^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "210^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "153^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "157^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "133^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "132^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "135^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "128^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "134^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "128^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "132^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "131^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "157^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "201^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "130^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "157^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "201^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "133^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "152^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "193^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "159^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "195^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "128^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "141^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "250^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "244^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "227^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "255^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "244^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "253^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "130^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "131^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "139^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "139^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "226^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "212^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "197^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "247^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "221^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "212^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "225^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "222^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "223^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "197^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "212^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "195^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "153^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "195^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "132^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "157^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "135^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "134^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "134^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "157^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "157^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "152^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "159^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "195^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "130^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "141^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "250^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "244^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "227^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "255^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "244^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "253^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "130^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "131^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "139^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "139^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "227^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "212^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "208^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "213^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "247^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "221^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "212^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "153^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "195^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "132^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "157^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "195^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "128^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "157^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "133^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "132^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "135^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "128^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "134^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "128^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "132^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "131^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "157^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "155^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "157^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "152^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "159^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "195^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "130^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "141^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "196^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "194^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "212^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "195^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "130^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "131^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "139^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "139^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "242^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "208^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "221^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "221^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "230^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "223^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "213^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "222^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "198^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "225^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "195^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "222^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "210^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "240^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "153^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "195^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "128^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "157^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "157^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "157^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "157^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "216^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "145^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "129^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "152^177"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c set /a "141^177"
C:\Users\Admin\AppData\Local\Temp\EKTEDIR.exe
"C:\Users\Admin\AppData\Local\Temp\EKTEDIR.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | g.bing.com | udp |
| US | 204.79.197.237:443 | g.bing.com | tcp |
| US | 8.8.8.8:53 | 8.8.8.8.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 134.32.126.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 237.197.79.204.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 43.58.199.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 0.204.248.87.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 86.23.85.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 81.144.22.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 15.164.165.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 147.142.123.92.in-addr.arpa | udp |
| US | 8.8.8.8:53 | drive.google.com | udp |
| GB | 172.217.16.238:443 | drive.google.com | tcp |
| US | 8.8.8.8:53 | c.pki.goog | udp |
| GB | 216.58.201.99:80 | c.pki.goog | tcp |
| US | 8.8.8.8:53 | o.pki.goog | udp |
| GB | 216.58.201.99:80 | o.pki.goog | tcp |
| US | 8.8.8.8:53 | 99.201.58.216.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 29.243.111.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 238.16.217.172.in-addr.arpa | udp |
| US | 8.8.8.8:53 | drive.usercontent.google.com | udp |
| GB | 216.58.201.97:443 | drive.usercontent.google.com | tcp |
| US | 8.8.8.8:53 | 97.201.58.216.in-addr.arpa | udp |
| US | 8.8.8.8:53 | checkip.dyndns.org | udp |
| JP | 132.226.8.169:80 | checkip.dyndns.org | tcp |
| US | 8.8.8.8:53 | reallyfreegeoip.org | udp |
| US | 104.21.67.152:443 | reallyfreegeoip.org | tcp |
| US | 8.8.8.8:53 | 169.8.226.132.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 152.67.21.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 73.144.22.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 240.221.184.93.in-addr.arpa | udp |
Files
C:\Users\Admin\AppData\Local\Temp\nsu5D3F.tmp\System.dll
| MD5 | 4d3b19a81bd51f8ce44b93643a4e3a99 |
| SHA1 | 35f8b00e85577b014080df98bd2c378351d9b3e9 |
| SHA256 | fda0018ab182ac6025d2fc9a2efcce3745d1da21ce5141859f8286cf319a52ce |
| SHA512 | b2ba9c961c0e1617f802990587a9000979ab5cc493ae2f8ca852eb43eeaf24916b0b29057dbff7d41a1797dfb2dce3db41990e8639b8f205771dbec3fd80f622 |
C:\Users\Admin\AppData\Local\Temp\nsu5D3F.tmp\nsExec.dll
| MD5 | 3eb4cd50dcb9f5981f5408578cb7fb70 |
| SHA1 | 13b38cc104ba6ee22dc4dfa6e480e36587f4bc71 |
| SHA256 | 1c2f19e57dc72587aa00800a498c5f581b7d6761dc13b24bcf287ea7bd5ca2bf |
| SHA512 | 5a0c9d28df7a77e157046dce876282c48f434a441ee34e12b88f55be31be536eff676f580adbe4586da3f1519f94b5793ccbb3068b4b009eee286c0c5135d324 |
memory/2392-961-0x0000000010004000-0x0000000010005000-memory.dmp
memory/2124-974-0x00000000004A0000-0x00000000016F4000-memory.dmp
memory/2124-975-0x00000000004A0000-0x00000000004C6000-memory.dmp
memory/2124-976-0x0000000037090000-0x0000000037634000-memory.dmp
memory/2124-977-0x0000000037640000-0x00000000376DC000-memory.dmp
memory/2124-979-0x0000000037C20000-0x0000000037C70000-memory.dmp
memory/2124-980-0x0000000037C70000-0x0000000037E32000-memory.dmp
memory/2124-981-0x0000000037E40000-0x0000000037ED2000-memory.dmp
memory/2124-982-0x0000000037F20000-0x0000000037F2A000-memory.dmp
Analysis: behavioral3
Detonation Overview
Submitted
2024-07-09 07:32
Reported
2024-07-09 07:35
Platform
win7-20240704-en
Max time kernel
118s
Max time network
119s
Command Line
Signatures
Program crash
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\WerFault.exe | C:\Windows\SysWOW64\rundll32.exe |
Suspicious use of WriteProcessMemory
Processes
C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1
C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1316 -s 224
Network
Files
Analysis: behavioral11
Detonation Overview
Submitted
2024-07-09 07:32
Reported
2024-07-09 07:35
Platform
win7-20240708-en
Max time kernel
118s
Max time network
119s
Command Line
Signatures
Enumerates physical storage devices
Modifies registry class
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_Classes\Local Settings | C:\Windows\system32\rundll32.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\vre_auto_file\ | C:\Windows\system32\rundll32.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\.vre\ = "vre_auto_file" | C:\Windows\system32\rundll32.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\vre_auto_file\shell\Read\command | C:\Windows\system32\rundll32.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\vre_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" | C:\Windows\system32\rundll32.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\vre_auto_file | C:\Windows\system32\rundll32.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\.vre | C:\Windows\system32\rundll32.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\vre_auto_file\shell\Read | C:\Windows\system32\rundll32.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\vre_auto_file\shell | C:\Windows\system32\rundll32.exe | N/A |
Suspicious behavior: GetForegroundWindowSpam
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 1484 wrote to memory of 2760 | N/A | C:\Windows\system32\cmd.exe | C:\Windows\system32\rundll32.exe |
| PID 1484 wrote to memory of 2760 | N/A | C:\Windows\system32\cmd.exe | C:\Windows\system32\rundll32.exe |
| PID 1484 wrote to memory of 2760 | N/A | C:\Windows\system32\cmd.exe | C:\Windows\system32\rundll32.exe |
| PID 2760 wrote to memory of 2784 | N/A | C:\Windows\system32\rundll32.exe | C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe |
| PID 2760 wrote to memory of 2784 | N/A | C:\Windows\system32\rundll32.exe | C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe |
| PID 2760 wrote to memory of 2784 | N/A | C:\Windows\system32\rundll32.exe | C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe |
| PID 2760 wrote to memory of 2784 | N/A | C:\Windows\system32\rundll32.exe | C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe |
Processes
C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Hylozoism\Herbiest116.vre
C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Hylozoism\Herbiest116.vre
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Hylozoism\Herbiest116.vre"
Network
Files
C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents
| MD5 | 0298e57511045705b2750f1b35b9913f |
| SHA1 | b9b265fa998748cb430d98547c37af2fe0f138e2 |
| SHA256 | d0aae394e9679bf0561f6af1b892a34c15b6b8ebf54c780facd753e5b31b6cdd |
| SHA512 | 7010203afd911c0c574fe29d9004cc87f360c2058cdbff4c4df69496c5cf3a78c286bd064c52b616a9be9f2621531c94971aece96050640556011f8092c081e5 |
Analysis: behavioral14
Detonation Overview
Submitted
2024-07-09 07:32
Reported
2024-07-09 07:35
Platform
win10v2004-20240704-en
Max time kernel
125s
Max time network
129s
Command Line
Signatures
Enumerates physical storage devices
Modifies registry class
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\S-1-5-21-661257284-3186977026-4220467887-1000_Classes\Local Settings | C:\Windows\system32\cmd.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-661257284-3186977026-4220467887-1000_Classes\Local Settings | C:\Windows\system32\OpenWith.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\OpenWith.exe | N/A |
Processes
C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Hylozoism\Unfrail.nay
C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4436,i,4226873509039249198,15952596839998010243,262144 --variations-seed-version --mojo-platform-channel-handle=2740 /prefetch:8
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 8.8.8.8.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 74.32.126.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 0.205.248.87.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 26.35.223.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 86.23.85.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 18.31.95.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 147.142.123.92.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 21.236.111.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 81.144.22.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 73.144.22.2.in-addr.arpa | udp |
Files
Analysis: behavioral4
Detonation Overview
Submitted
2024-07-09 07:32
Reported
2024-07-09 07:35
Platform
win10v2004-20240704-en
Max time kernel
94s
Max time network
96s
Command Line
Signatures
Program crash
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\WerFault.exe | C:\Windows\SysWOW64\rundll32.exe |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 1848 wrote to memory of 2212 | N/A | C:\Windows\system32\rundll32.exe | C:\Windows\SysWOW64\rundll32.exe |
| PID 1848 wrote to memory of 2212 | N/A | C:\Windows\system32\rundll32.exe | C:\Windows\SysWOW64\rundll32.exe |
| PID 1848 wrote to memory of 2212 | N/A | C:\Windows\system32\rundll32.exe | C:\Windows\SysWOW64\rundll32.exe |
Processes
C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1
C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2212 -ip 2212
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2212 -s 612
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | g.bing.com | udp |
| US | 204.79.197.237:443 | g.bing.com | tcp |
| US | 8.8.8.8:53 | 237.197.79.204.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 14.160.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 73.144.22.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 26.35.223.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 26.165.165.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 0.205.248.87.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 171.39.242.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 21.236.111.52.in-addr.arpa | udp |
Files
Analysis: behavioral6
Detonation Overview
Submitted
2024-07-09 07:32
Reported
2024-07-09 07:35
Platform
win10v2004-20240704-en
Max time kernel
149s
Max time network
153s
Command Line
Signatures
Program crash
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\WerFault.exe | C:\Windows\SysWOW64\rundll32.exe |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 2700 wrote to memory of 4432 | N/A | C:\Windows\system32\rundll32.exe | C:\Windows\SysWOW64\rundll32.exe |
| PID 2700 wrote to memory of 4432 | N/A | C:\Windows\system32\rundll32.exe | C:\Windows\SysWOW64\rundll32.exe |
| PID 2700 wrote to memory of 4432 | N/A | C:\Windows\system32\rundll32.exe | C:\Windows\SysWOW64\rundll32.exe |
Processes
C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsExec.dll,#1
C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsExec.dll,#1
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4432 -ip 4432
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4432 -s 612
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 0.204.248.87.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 205.47.74.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 157.123.68.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 18.31.95.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 192.142.123.92.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 81.144.22.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 17.173.189.20.in-addr.arpa | udp |
Files
Analysis: behavioral9
Detonation Overview
Submitted
2024-07-09 07:32
Reported
2024-07-09 07:35
Platform
win7-20240705-en
Max time kernel
102s
Max time network
16s
Command Line
Signatures
Enumerates physical storage devices
Modifies registry class
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\rav_auto_file\shell\Read | C:\Windows\system32\rundll32.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\rav_auto_file\shell | C:\Windows\system32\rundll32.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\rav_auto_file\shell\Read\command | C:\Windows\system32\rundll32.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\rav_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" | C:\Windows\system32\rundll32.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_Classes\Local Settings | C:\Windows\system32\rundll32.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\rav_auto_file | C:\Windows\system32\rundll32.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\rav_auto_file\ | C:\Windows\system32\rundll32.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\.rav | C:\Windows\system32\rundll32.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\.rav\ = "rav_auto_file" | C:\Windows\system32\rundll32.exe | N/A |
Suspicious behavior: GetForegroundWindowSpam
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 2256 wrote to memory of 2408 | N/A | C:\Windows\system32\cmd.exe | C:\Windows\system32\rundll32.exe |
| PID 2256 wrote to memory of 2408 | N/A | C:\Windows\system32\cmd.exe | C:\Windows\system32\rundll32.exe |
| PID 2256 wrote to memory of 2408 | N/A | C:\Windows\system32\cmd.exe | C:\Windows\system32\rundll32.exe |
| PID 2408 wrote to memory of 2836 | N/A | C:\Windows\system32\rundll32.exe | C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe |
| PID 2408 wrote to memory of 2836 | N/A | C:\Windows\system32\rundll32.exe | C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe |
| PID 2408 wrote to memory of 2836 | N/A | C:\Windows\system32\rundll32.exe | C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe |
| PID 2408 wrote to memory of 2836 | N/A | C:\Windows\system32\rundll32.exe | C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe |
Processes
C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Hylozoism\Haardhudet.rav
C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Hylozoism\Haardhudet.rav
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Hylozoism\Haardhudet.rav"
Network
Files
C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents
| MD5 | 4c0d9d84ffe7a63932b21e5119f97a91 |
| SHA1 | da47f4ad51b3d740b9d5e18826ae65827b8eab93 |
| SHA256 | 580bc7c8983b5dd021a4d3b3926d8389b0f379bee8d1747055da76ee697295e3 |
| SHA512 | 576528ca23de4adfd4e5a1b353651fa16ed5d531f48cec0b4a21e23a778a98d0b54795670d1594ad279e708a4b784fbe0399dae470a21468cc59ffabf93c44aa |
Analysis: behavioral15
Detonation Overview
Submitted
2024-07-09 07:32
Reported
2024-07-09 07:35
Platform
win7-20240708-en
Max time kernel
118s
Max time network
119s
Command Line
Signatures
Enumerates physical storage devices
Modifies registry class
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_Classes\Local Settings | C:\Windows\system32\rundll32.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\stj_auto_file\ | C:\Windows\system32\rundll32.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\stj_auto_file\shell\Read | C:\Windows\system32\rundll32.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\stj_auto_file\shell | C:\Windows\system32\rundll32.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\stj_auto_file\shell\Read\command | C:\Windows\system32\rundll32.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\stj_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" | C:\Windows\system32\rundll32.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\stj_auto_file | C:\Windows\system32\rundll32.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\.stj | C:\Windows\system32\rundll32.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\.stj\ = "stj_auto_file" | C:\Windows\system32\rundll32.exe | N/A |
Suspicious behavior: GetForegroundWindowSpam
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 2280 wrote to memory of 2432 | N/A | C:\Windows\system32\cmd.exe | C:\Windows\system32\rundll32.exe |
| PID 2280 wrote to memory of 2432 | N/A | C:\Windows\system32\cmd.exe | C:\Windows\system32\rundll32.exe |
| PID 2280 wrote to memory of 2432 | N/A | C:\Windows\system32\cmd.exe | C:\Windows\system32\rundll32.exe |
| PID 2432 wrote to memory of 1704 | N/A | C:\Windows\system32\rundll32.exe | C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe |
| PID 2432 wrote to memory of 1704 | N/A | C:\Windows\system32\rundll32.exe | C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe |
| PID 2432 wrote to memory of 1704 | N/A | C:\Windows\system32\rundll32.exe | C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe |
| PID 2432 wrote to memory of 1704 | N/A | C:\Windows\system32\rundll32.exe | C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe |
Processes
C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Hylozoism\afrettelsers.stj
C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Hylozoism\afrettelsers.stj
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Hylozoism\afrettelsers.stj"
Network
Files
C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents
| MD5 | ec10a34512b9f4b9fd58238330e5db98 |
| SHA1 | de5165532b20380037775a4bbdc5ce57e7e1ea35 |
| SHA256 | ea926df1e3890322c4e9ed144819d951f7311967e92cdbfced5896ce288e571c |
| SHA512 | 1ce10d3d8b92d84417df86000319a57b6ff37639e10e974f35d4265bb734faab3853d561bcab654a1d248ac638315e475efbd2df75b31c536f6780504a9d8729 |
Analysis: behavioral18
Detonation Overview
Submitted
2024-07-09 07:32
Reported
2024-07-09 07:35
Platform
win10v2004-20240704-en
Max time kernel
93s
Max time network
96s
Command Line
Signatures
Opens file in notepad (likely ransom note)
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\NOTEPAD.EXE | N/A |
Processes
C:\Windows\system32\NOTEPAD.EXE
C:\Windows\system32\NOTEPAD.EXE C:\Users\Admin\AppData\Local\Temp\Hylozoism\figurally.txt
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 71.159.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 8.8.8.8.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 0.205.248.87.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 26.35.223.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 86.23.85.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 15.164.165.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 147.142.123.92.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 73.144.22.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 172.214.232.199.in-addr.arpa | udp |
Files
Analysis: behavioral19
Detonation Overview
Submitted
2024-07-09 07:32
Reported
2024-07-09 07:36
Platform
win7-20240704-en
Max time kernel
103s
Max time network
19s
Command Line
Signatures
Enumerates physical storage devices
Modifies registry class
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\yde_auto_file\ | C:\Windows\system32\rundll32.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\.yde | C:\Windows\system32\rundll32.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\.yde\ = "yde_auto_file" | C:\Windows\system32\rundll32.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_Classes\Local Settings | C:\Windows\system32\rundll32.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\yde_auto_file | C:\Windows\system32\rundll32.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\yde_auto_file\shell\Read\command | C:\Windows\system32\rundll32.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\yde_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" | C:\Windows\system32\rundll32.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\yde_auto_file\shell\Read | C:\Windows\system32\rundll32.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\yde_auto_file\shell | C:\Windows\system32\rundll32.exe | N/A |
Suspicious behavior: GetForegroundWindowSpam
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 560 wrote to memory of 3056 | N/A | C:\Windows\system32\cmd.exe | C:\Windows\system32\rundll32.exe |
| PID 560 wrote to memory of 3056 | N/A | C:\Windows\system32\cmd.exe | C:\Windows\system32\rundll32.exe |
| PID 560 wrote to memory of 3056 | N/A | C:\Windows\system32\cmd.exe | C:\Windows\system32\rundll32.exe |
| PID 3056 wrote to memory of 2792 | N/A | C:\Windows\system32\rundll32.exe | C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe |
| PID 3056 wrote to memory of 2792 | N/A | C:\Windows\system32\rundll32.exe | C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe |
| PID 3056 wrote to memory of 2792 | N/A | C:\Windows\system32\rundll32.exe | C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe |
| PID 3056 wrote to memory of 2792 | N/A | C:\Windows\system32\rundll32.exe | C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe |
Processes
C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Hylozoism\smudses.yde
C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Hylozoism\smudses.yde
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Hylozoism\smudses.yde"
Network
Files
C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents
| MD5 | 35fc6fa357924efa5ebf7435afac7db4 |
| SHA1 | 6a6d83e06176552165959d38533b53499f410c02 |
| SHA256 | c141667fb99281c1a17311b7ba1c6f1898788944f5a5fe893fb3a8638d79fc0b |
| SHA512 | cd6ae66c2b4b4d9d6d7cf97c1ca5ae99779d58b5d19c37341e5f8950442a221b60bad43a25e8a6ee9e198fc92e0216e23dcfebea9fad288d716fd75a247d53ce |
Analysis: behavioral20
Detonation Overview
Submitted
2024-07-09 07:32
Reported
2024-07-09 07:35
Platform
win10v2004-20240704-en
Max time kernel
92s
Max time network
126s
Command Line
Signatures
Enumerates physical storage devices
Modifies registry class
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\S-1-5-21-2753856825-3907105642-1818461144-1000_Classes\Local Settings | C:\Windows\system32\cmd.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2753856825-3907105642-1818461144-1000_Classes\Local Settings | C:\Windows\system32\OpenWith.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\OpenWith.exe | N/A |
Processes
C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Hylozoism\smudses.yde
C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 8.8.8.8.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 0.159.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 172.210.232.199.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 55.36.223.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 157.123.68.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 15.164.165.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 192.142.123.92.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 0.204.248.87.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 0.205.248.87.in-addr.arpa | udp |
Files
Analysis: behavioral7
Detonation Overview
Submitted
2024-07-09 07:32
Reported
2024-07-09 07:35
Platform
win7-20240704-en
Max time kernel
122s
Max time network
124s
Command Line
Signatures
Enumerates physical storage devices
Modifies registry class
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\.gen | C:\Windows\system32\rundll32.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\.gen\ = "gen_auto_file" | C:\Windows\system32\rundll32.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\gen_auto_file\shell | C:\Windows\system32\rundll32.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\gen_auto_file\shell\Read\command | C:\Windows\system32\rundll32.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_Classes\Local Settings | C:\Windows\system32\rundll32.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\gen_auto_file | C:\Windows\system32\rundll32.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\gen_auto_file\ | C:\Windows\system32\rundll32.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\gen_auto_file\shell\Read | C:\Windows\system32\rundll32.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\gen_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" | C:\Windows\system32\rundll32.exe | N/A |
Suspicious behavior: GetForegroundWindowSpam
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 3032 wrote to memory of 2664 | N/A | C:\Windows\system32\cmd.exe | C:\Windows\system32\rundll32.exe |
| PID 3032 wrote to memory of 2664 | N/A | C:\Windows\system32\cmd.exe | C:\Windows\system32\rundll32.exe |
| PID 3032 wrote to memory of 2664 | N/A | C:\Windows\system32\cmd.exe | C:\Windows\system32\rundll32.exe |
| PID 2664 wrote to memory of 2012 | N/A | C:\Windows\system32\rundll32.exe | C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe |
| PID 2664 wrote to memory of 2012 | N/A | C:\Windows\system32\rundll32.exe | C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe |
| PID 2664 wrote to memory of 2012 | N/A | C:\Windows\system32\rundll32.exe | C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe |
| PID 2664 wrote to memory of 2012 | N/A | C:\Windows\system32\rundll32.exe | C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe |
Processes
C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Hylozoism\Forbundsformndene237.gen
C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Hylozoism\Forbundsformndene237.gen
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Hylozoism\Forbundsformndene237.gen"
Network
Files
C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents
| MD5 | 1a7f6e6bf03e67b5e3e0dda5fbc0fd0a |
| SHA1 | aba4ecd78f84e8df0ecad594eef4e51154d22f26 |
| SHA256 | f186d27f56cffd3874f94f7b3ec7dc12e98c04386edd6959008fee5ef00d879b |
| SHA512 | 1cfc8d8beaf941503ef5e79de3ef6211c15769365c5d60877e0864325c37aef66a93bcd5217d5145c1d6994eb8546b573c179b7cf43719adf8022e74f3edac9a |
Analysis: behavioral8
Detonation Overview
Submitted
2024-07-09 07:32
Reported
2024-07-09 07:35
Platform
win10v2004-20240704-en
Max time kernel
93s
Max time network
97s
Command Line
Signatures
Enumerates physical storage devices
Modifies registry class
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\S-1-5-21-771719357-2485960699-3367710044-1000_Classes\Local Settings | C:\Windows\system32\cmd.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-771719357-2485960699-3367710044-1000_Classes\Local Settings | C:\Windows\system32\OpenWith.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\OpenWith.exe | N/A |
Processes
C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Hylozoism\Forbundsformndene237.gen
C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 0.159.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 0.204.248.87.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 15.164.165.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 157.123.68.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 147.142.123.92.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 73.144.22.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 172.214.232.199.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 29.243.111.52.in-addr.arpa | udp |
Files
Analysis: behavioral22
Detonation Overview
Submitted
2024-07-09 07:32
Reported
2024-07-09 07:36
Platform
win10v2004-20240704-en
Max time kernel
93s
Max time network
96s
Command Line
Signatures
Enumerates physical storage devices
Modifies registry class
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\S-1-5-21-2480455240-981575606-1030659066-1000_Classes\Local Settings | C:\Windows\system32\cmd.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2480455240-981575606-1030659066-1000_Classes\Local Settings | C:\Windows\system32\OpenWith.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\OpenWith.exe | N/A |
Processes
C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Occluding225.ten
C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 8.8.8.8.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 68.32.126.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 240.221.184.93.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 86.23.85.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 15.164.165.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 172.210.232.199.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 172.214.232.199.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 21.236.111.52.in-addr.arpa | udp |
Files
Analysis: behavioral5
Detonation Overview
Submitted
2024-07-09 07:32
Reported
2024-07-09 07:35
Platform
win7-20240704-en
Max time kernel
16s
Max time network
20s
Command Line
Signatures
Program crash
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\WerFault.exe | C:\Windows\SysWOW64\rundll32.exe |
Suspicious use of WriteProcessMemory
Processes
C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsExec.dll,#1
C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsExec.dll,#1
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2748 -s 224
Network
Files
Analysis: behavioral13
Detonation Overview
Submitted
2024-07-09 07:32
Reported
2024-07-09 07:35
Platform
win7-20240708-en
Max time kernel
122s
Max time network
124s
Command Line
Signatures
Enumerates physical storage devices
Modifies registry class
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_Classes\Local Settings | C:\Windows\system32\rundll32.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\nay_auto_file\ | C:\Windows\system32\rundll32.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\.nay | C:\Windows\system32\rundll32.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\.nay\ = "nay_auto_file" | C:\Windows\system32\rundll32.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\nay_auto_file | C:\Windows\system32\rundll32.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\nay_auto_file\shell\Read | C:\Windows\system32\rundll32.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\nay_auto_file\shell | C:\Windows\system32\rundll32.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\nay_auto_file\shell\Read\command | C:\Windows\system32\rundll32.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000_CLASSES\nay_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" | C:\Windows\system32\rundll32.exe | N/A |
Suspicious behavior: GetForegroundWindowSpam
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 2360 wrote to memory of 2708 | N/A | C:\Windows\system32\cmd.exe | C:\Windows\system32\rundll32.exe |
| PID 2360 wrote to memory of 2708 | N/A | C:\Windows\system32\cmd.exe | C:\Windows\system32\rundll32.exe |
| PID 2360 wrote to memory of 2708 | N/A | C:\Windows\system32\cmd.exe | C:\Windows\system32\rundll32.exe |
| PID 2708 wrote to memory of 2804 | N/A | C:\Windows\system32\rundll32.exe | C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe |
| PID 2708 wrote to memory of 2804 | N/A | C:\Windows\system32\rundll32.exe | C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe |
| PID 2708 wrote to memory of 2804 | N/A | C:\Windows\system32\rundll32.exe | C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe |
| PID 2708 wrote to memory of 2804 | N/A | C:\Windows\system32\rundll32.exe | C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe |
Processes
C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Hylozoism\Unfrail.nay
C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Hylozoism\Unfrail.nay
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Hylozoism\Unfrail.nay"
Network
Files
C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents
| MD5 | 24ba5dc4eedbe438f8d2bdd666fe8f70 |
| SHA1 | 3fd84c065acc397860450c75bf75ff22fe0e04c6 |
| SHA256 | 879268a5621356a78a9b95253a6f6fe77b0911b31be8200e124f26f1ccc8f838 |
| SHA512 | b89e3c911c77b24fb0fd9ede250e01f67802f8cadd9143b2bf126d79d051be4371cc1c313a567226dd84cceaa77db6921df4e896476fe74b917ccacb897c6bc7 |
Analysis: behavioral16
Detonation Overview
Submitted
2024-07-09 07:32
Reported
2024-07-09 07:35
Platform
win10v2004-20240708-en
Max time kernel
94s
Max time network
125s
Command Line
Signatures
Enumerates physical storage devices
Modifies registry class
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\S-1-5-21-3310979990-555183016-1244931625-1000_Classes\Local Settings | C:\Windows\system32\cmd.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3310979990-555183016-1244931625-1000_Classes\Local Settings | C:\Windows\system32\OpenWith.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\OpenWith.exe | N/A |
Processes
C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Hylozoism\afrettelsers.stj
C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 23.159.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 205.47.74.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 29.243.111.52.in-addr.arpa | udp |