Analysis
-
max time kernel
119s -
max time network
41s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
22/07/2024, 02:16
Behavioral task
behavioral1
Sample
46adffea9cb7a590bd96698eb72b5da0N.exe
Resource
win7-20240708-en
windows7-x64
10 signatures
120 seconds
Behavioral task
behavioral2
Sample
46adffea9cb7a590bd96698eb72b5da0N.exe
Resource
win10v2004-20240704-en
windows10-2004-x64
9 signatures
120 seconds
General
-
Target
46adffea9cb7a590bd96698eb72b5da0N.exe
-
Size
200KB
-
MD5
46adffea9cb7a590bd96698eb72b5da0
-
SHA1
bd17108e7801cf96cdfd1ee1af3c6f8f9a6c4f03
-
SHA256
fe805bf541b858dc41d725aae63c21e01fc6826fd7a85c41e3a1931e2ae198c5
-
SHA512
d7f932d6ce49766fbcf17e4a522ca0f9110e4a1903782730e939224a9e5aafc62d44b8ac1d5fbef130f7fb9dbf31fd1e09803fd1f20a7ca6381e03074fb0fa90
-
SSDEEP
1536:KChrVkT1hoxJTxRcTGJNOJh1n/O+yCx9Fs/i7sUtnR/J:5B2Tna3bq1n99K/i7tR
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 4 IoCs
pid Process 2472 explorer.exe 2068 explorer.exe 264 explorer.exe 588 explorer.exe -
Loads dropped DLL 7 IoCs
pid Process 2916 46adffea9cb7a590bd96698eb72b5da0N.exe 2916 46adffea9cb7a590bd96698eb72b5da0N.exe 2916 46adffea9cb7a590bd96698eb72b5da0N.exe 2916 46adffea9cb7a590bd96698eb72b5da0N.exe 2916 46adffea9cb7a590bd96698eb72b5da0N.exe 2472 explorer.exe 2472 explorer.exe -
resource yara_rule behavioral1/memory/1080-0-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral1/memory/1080-140-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral1/memory/1080-431-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral1/memory/2916-434-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/files/0x0032000000015dab-471.dat upx behavioral1/memory/2472-480-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral1/memory/2472-850-0x0000000002A50000-0x0000000002A82000-memory.dmp upx behavioral1/memory/2472-1005-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral1/memory/2916-1008-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/2068-1002-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/2068-1162-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\Run\Video Driver = "C:\\Users\\Admin\\AppData\\Roaming\\config\\explorer.exe" reg.exe -
Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 1080 set thread context of 2916 1080 46adffea9cb7a590bd96698eb72b5da0N.exe 30 PID 2472 set thread context of 2068 2472 explorer.exe 35 PID 2472 set thread context of 264 2472 explorer.exe 36 PID 264 set thread context of 588 264 explorer.exe 37 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 190000000100000010000000fd960962ac6938e0d4b0769aa1a64e26030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a1d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e709000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030353000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f00720069007400790000000f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6502000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794 explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6 explorer.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6\Blob = 0f000000010000001400000007eeabaf80a9ef4ae1b2cb9b4b5fc70d0428e6a953000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000002e00000053007400610072006600690065006c006400200054006500630068006e006f006c006f0067006900650073000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000a848b4242fc6ea24a0d78e3cb93c5c78d79833e41d00000001000000100000005959ddbc9c7632ba0a05f06316846fe6030000000100000014000000317a2ad07f2b335ef5a1c34e4b57e8b7d8f1fca62000000001000000eb020000308202e730820250020101300d06092a864886f70d01010505003081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d301e170d3939303632363030313935345a170d3139303632363030313935345a3081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100ce3a71cae5abc8599255d7abd8740ef9eed9f655475965470e0555dceb98363c5c535dd330cf38ecbd4189ed254209246b0a5eb37cdd522d4ce6d4d67d5a59a965d449132d244d1c506fb5c185543bfe71e4d35c42f980e0911a0a5b393667f33f557c1b3fb45f647334e3b412bf8764f8da12ff3727c1b343bbef7b6e2e69f70203010001300d06092a864886f70d0101050500038181003b7f506f6f509499496238381f4bf8a5c83ea78281f62bc7e8c5cee83a1082cb18008e4dbda8587fa17900b5bbe98daf41d90f34ee218119a0324928f4c48e56d55233fd50d57e996c03e4c94cfccb6cab66b34a218ce5b50c323e10b2cc6ca1dc9a984c025bf3ceb99ea5720e4ab73f3ce61668f8beed744cbc5bd5621f43dd explorer.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6\Blob = 19000000010000001000000044ba5fd9039fc9b56fd8aadccd597ca6030000000100000014000000317a2ad07f2b335ef5a1c34e4b57e8b7d8f1fca61d00000001000000100000005959ddbc9c7632ba0a05f06316846fe6140000000100000014000000a848b4242fc6ea24a0d78e3cb93c5c78d79833e4090000000100000016000000301406082b0601050507030406082b060105050703010b000000010000002e00000053007400610072006600690065006c006400200054006500630068006e006f006c006f006700690065007300000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00f000000010000001400000007eeabaf80a9ef4ae1b2cb9b4b5fc70d0428e6a92000000001000000eb020000308202e730820250020101300d06092a864886f70d01010505003081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d301e170d3939303632363030313935345a170d3139303632363030313935345a3081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100ce3a71cae5abc8599255d7abd8740ef9eed9f655475965470e0555dceb98363c5c535dd330cf38ecbd4189ed254209246b0a5eb37cdd522d4ce6d4d67d5a59a965d449132d244d1c506fb5c185543bfe71e4d35c42f980e0911a0a5b393667f33f557c1b3fb45f647334e3b412bf8764f8da12ff3727c1b343bbef7b6e2e69f70203010001300d06092a864886f70d0101050500038181003b7f506f6f509499496238381f4bf8a5c83ea78281f62bc7e8c5cee83a1082cb18008e4dbda8587fa17900b5bbe98daf41d90f34ee218119a0324928f4c48e56d55233fd50d57e996c03e4c94cfccb6cab66b34a218ce5b50c323e10b2cc6ca1dc9a984c025bf3ceb99ea5720e4ab73f3ce61668f8beed744cbc5bd5621f43dd explorer.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6\Blob = 040000000100000010000000a923759bba49366e31c2dbf2e766ba870f000000010000001400000007eeabaf80a9ef4ae1b2cb9b4b5fc70d0428e6a953000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000002e00000053007400610072006600690065006c006400200054006500630068006e006f006c006f0067006900650073000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000a848b4242fc6ea24a0d78e3cb93c5c78d79833e41d00000001000000100000005959ddbc9c7632ba0a05f06316846fe6030000000100000014000000317a2ad07f2b335ef5a1c34e4b57e8b7d8f1fca619000000010000001000000044ba5fd9039fc9b56fd8aadccd597ca62000000001000000eb020000308202e730820250020101300d06092a864886f70d01010505003081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d301e170d3939303632363030313935345a170d3139303632363030313935345a3081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100ce3a71cae5abc8599255d7abd8740ef9eed9f655475965470e0555dceb98363c5c535dd330cf38ecbd4189ed254209246b0a5eb37cdd522d4ce6d4d67d5a59a965d449132d244d1c506fb5c185543bfe71e4d35c42f980e0911a0a5b393667f33f557c1b3fb45f647334e3b412bf8764f8da12ff3727c1b343bbef7b6e2e69f70203010001300d06092a864886f70d0101050500038181003b7f506f6f509499496238381f4bf8a5c83ea78281f62bc7e8c5cee83a1082cb18008e4dbda8587fa17900b5bbe98daf41d90f34ee218119a0324928f4c48e56d55233fd50d57e996c03e4c94cfccb6cab66b34a218ce5b50c323e10b2cc6ca1dc9a984c025bf3ceb99ea5720e4ab73f3ce61668f8beed744cbc5bd5621f43dd explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A explorer.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 0f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6500b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b06010505070303140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e71d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a2000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794 explorer.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2068 explorer.exe Token: SeDebugPrivilege 2068 explorer.exe Token: SeDebugPrivilege 2068 explorer.exe Token: SeDebugPrivilege 2068 explorer.exe Token: SeDebugPrivilege 2068 explorer.exe Token: SeDebugPrivilege 2068 explorer.exe Token: SeDebugPrivilege 2068 explorer.exe Token: SeDebugPrivilege 2068 explorer.exe Token: SeDebugPrivilege 2068 explorer.exe Token: SeDebugPrivilege 2068 explorer.exe Token: SeDebugPrivilege 2068 explorer.exe Token: SeDebugPrivilege 2068 explorer.exe Token: SeDebugPrivilege 2068 explorer.exe Token: SeDebugPrivilege 2068 explorer.exe Token: SeDebugPrivilege 2068 explorer.exe Token: SeDebugPrivilege 2068 explorer.exe Token: SeDebugPrivilege 2068 explorer.exe Token: SeDebugPrivilege 2068 explorer.exe Token: SeDebugPrivilege 2068 explorer.exe Token: SeDebugPrivilege 2068 explorer.exe Token: SeDebugPrivilege 2068 explorer.exe Token: SeDebugPrivilege 2068 explorer.exe Token: SeDebugPrivilege 2068 explorer.exe Token: SeDebugPrivilege 2068 explorer.exe Token: SeDebugPrivilege 2068 explorer.exe Token: SeDebugPrivilege 2068 explorer.exe Token: SeDebugPrivilege 2068 explorer.exe Token: SeDebugPrivilege 2068 explorer.exe Token: SeDebugPrivilege 2068 explorer.exe Token: SeDebugPrivilege 2068 explorer.exe Token: SeDebugPrivilege 2068 explorer.exe Token: SeDebugPrivilege 2068 explorer.exe Token: SeDebugPrivilege 2068 explorer.exe Token: SeDebugPrivilege 2068 explorer.exe Token: SeDebugPrivilege 2068 explorer.exe Token: SeDebugPrivilege 2068 explorer.exe Token: SeDebugPrivilege 2068 explorer.exe Token: SeDebugPrivilege 2068 explorer.exe Token: SeDebugPrivilege 2068 explorer.exe Token: SeDebugPrivilege 2068 explorer.exe Token: SeDebugPrivilege 2068 explorer.exe Token: SeDebugPrivilege 2068 explorer.exe Token: SeDebugPrivilege 2068 explorer.exe Token: SeDebugPrivilege 2068 explorer.exe Token: SeDebugPrivilege 2068 explorer.exe Token: SeDebugPrivilege 2068 explorer.exe Token: SeDebugPrivilege 2068 explorer.exe Token: SeDebugPrivilege 2068 explorer.exe Token: SeDebugPrivilege 2068 explorer.exe Token: SeDebugPrivilege 2068 explorer.exe Token: SeDebugPrivilege 2068 explorer.exe Token: SeDebugPrivilege 2068 explorer.exe Token: SeDebugPrivilege 2068 explorer.exe Token: SeDebugPrivilege 2068 explorer.exe Token: SeDebugPrivilege 2068 explorer.exe Token: SeDebugPrivilege 2068 explorer.exe Token: SeDebugPrivilege 2068 explorer.exe Token: SeDebugPrivilege 2068 explorer.exe Token: SeDebugPrivilege 2068 explorer.exe Token: SeDebugPrivilege 2068 explorer.exe Token: SeDebugPrivilege 2068 explorer.exe Token: SeDebugPrivilege 2068 explorer.exe Token: SeDebugPrivilege 2068 explorer.exe Token: SeDebugPrivilege 2068 explorer.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 1080 46adffea9cb7a590bd96698eb72b5da0N.exe 2916 46adffea9cb7a590bd96698eb72b5da0N.exe 2472 explorer.exe 2068 explorer.exe -
Suspicious use of WriteProcessMemory 44 IoCs
description pid Process procid_target PID 1080 wrote to memory of 2916 1080 46adffea9cb7a590bd96698eb72b5da0N.exe 30 PID 1080 wrote to memory of 2916 1080 46adffea9cb7a590bd96698eb72b5da0N.exe 30 PID 1080 wrote to memory of 2916 1080 46adffea9cb7a590bd96698eb72b5da0N.exe 30 PID 1080 wrote to memory of 2916 1080 46adffea9cb7a590bd96698eb72b5da0N.exe 30 PID 1080 wrote to memory of 2916 1080 46adffea9cb7a590bd96698eb72b5da0N.exe 30 PID 1080 wrote to memory of 2916 1080 46adffea9cb7a590bd96698eb72b5da0N.exe 30 PID 1080 wrote to memory of 2916 1080 46adffea9cb7a590bd96698eb72b5da0N.exe 30 PID 1080 wrote to memory of 2916 1080 46adffea9cb7a590bd96698eb72b5da0N.exe 30 PID 2916 wrote to memory of 2884 2916 46adffea9cb7a590bd96698eb72b5da0N.exe 31 PID 2916 wrote to memory of 2884 2916 46adffea9cb7a590bd96698eb72b5da0N.exe 31 PID 2916 wrote to memory of 2884 2916 46adffea9cb7a590bd96698eb72b5da0N.exe 31 PID 2916 wrote to memory of 2884 2916 46adffea9cb7a590bd96698eb72b5da0N.exe 31 PID 2884 wrote to memory of 2740 2884 cmd.exe 33 PID 2884 wrote to memory of 2740 2884 cmd.exe 33 PID 2884 wrote to memory of 2740 2884 cmd.exe 33 PID 2884 wrote to memory of 2740 2884 cmd.exe 33 PID 2916 wrote to memory of 2472 2916 46adffea9cb7a590bd96698eb72b5da0N.exe 34 PID 2916 wrote to memory of 2472 2916 46adffea9cb7a590bd96698eb72b5da0N.exe 34 PID 2916 wrote to memory of 2472 2916 46adffea9cb7a590bd96698eb72b5da0N.exe 34 PID 2916 wrote to memory of 2472 2916 46adffea9cb7a590bd96698eb72b5da0N.exe 34 PID 2472 wrote to memory of 2068 2472 explorer.exe 35 PID 2472 wrote to memory of 2068 2472 explorer.exe 35 PID 2472 wrote to memory of 2068 2472 explorer.exe 35 PID 2472 wrote to memory of 2068 2472 explorer.exe 35 PID 2472 wrote to memory of 2068 2472 explorer.exe 35 PID 2472 wrote to memory of 2068 2472 explorer.exe 35 PID 2472 wrote to memory of 2068 2472 explorer.exe 35 PID 2472 wrote to memory of 2068 2472 explorer.exe 35 PID 2472 wrote to memory of 264 2472 explorer.exe 36 PID 2472 wrote to memory of 264 2472 explorer.exe 36 PID 2472 wrote to memory of 264 2472 explorer.exe 36 PID 2472 wrote to memory of 264 2472 explorer.exe 36 PID 2472 wrote to memory of 264 2472 explorer.exe 36 PID 2472 wrote to memory of 264 2472 explorer.exe 36 PID 2472 wrote to memory of 264 2472 explorer.exe 36 PID 2472 wrote to memory of 264 2472 explorer.exe 36 PID 264 wrote to memory of 588 264 explorer.exe 37 PID 264 wrote to memory of 588 264 explorer.exe 37 PID 264 wrote to memory of 588 264 explorer.exe 37 PID 264 wrote to memory of 588 264 explorer.exe 37 PID 264 wrote to memory of 588 264 explorer.exe 37 PID 264 wrote to memory of 588 264 explorer.exe 37 PID 264 wrote to memory of 588 264 explorer.exe 37 PID 264 wrote to memory of 588 264 explorer.exe 37
Processes
-
C:\Users\Admin\AppData\Local\Temp\46adffea9cb7a590bd96698eb72b5da0N.exe"C:\Users\Admin\AppData\Local\Temp\46adffea9cb7a590bd96698eb72b5da0N.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1080 -
C:\Users\Admin\AppData\Local\Temp\46adffea9cb7a590bd96698eb72b5da0N.exe"C:\Users\Admin\AppData\Local\Temp\46adffea9cb7a590bd96698eb72b5da0N.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2916 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\JQUGE.bat" "3⤵
- Suspicious use of WriteProcessMemory
PID:2884 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Video Driver" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\config\explorer.exe" /f4⤵
- Adds Run key to start application
PID:2740
-
-
-
C:\Users\Admin\AppData\Roaming\config\explorer.exe"C:\Users\Admin\AppData\Roaming\config\explorer.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2472 -
C:\Users\Admin\AppData\Roaming\config\explorer.exe"C:\Users\Admin\AppData\Roaming\config\explorer.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2068
-
-
C:\Users\Admin\AppData\Roaming\config\explorer.exe"C:\Users\Admin\AppData\Roaming\config\explorer.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:264 -
C:\Users\Admin\AppData\Roaming\config\explorer.exe"C:\Users\Admin\AppData\Roaming\config\explorer.exe"5⤵
- Executes dropped EXE
- Modifies system certificate store
PID:588
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cd6da0a81880a55d14300d35ee6f7bb0
SHA193c3cb219c48e3086d2b76119f2e78495a00380c
SHA2562b284895880714d8a529e3444cb85364900e6146d85a90429da7574eeb7839ea
SHA51251f5b78e53bbcc9551b05db62bdeaaf32a8ae755b4cd330736e452fd867a3b4349241332ca399f8b8f3011081b25377ceeed596c676f14c61dc28a5273416dcd
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
149B
MD5fc1798b7c7938454220fda837a76f354
SHA1b232912930b2bc24ff18bf7ecd58f872bbe01ea0
SHA2567f0a5917b5aca9c5beb153aad0ef95bf0aeafb83768da5b086c3f029ba42d7c8
SHA512d1abdd45a8e5d33893b9d19424174a07feed145d2e6b4be318ab5fde503f850579a4a101a010f30e16ecde2c7123f45357a8341214655321ee0f0097ca911331
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
200KB
MD5f9304f87a3d337a2e625a30a61e20271
SHA1d53435a29fa5820964f261a867c149158aee7fba
SHA256c492e4c705450059b81d08222107c2251df5f1b1e8b6c4e64039d3b69c5c8bf4
SHA512979b0d3a64d2cd37bd292273e04fb3f5bb4e4c944d67a66117590a1d1baeb230e99b9c71e4dc6c2b0817b259fa2b54f15a3ee92fe9e3d912eac648b1dfc193f7