Analysis
-
max time kernel
271s -
max time network
300s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
15-08-2024 22:37
Static task
static1
Behavioral task
behavioral1
Sample
91dc640360851a1e69261fe72d9fa570a73e6d9465c8ebf971dbe840493b890d.exe
Resource
win7-20240705-en
General
-
Target
91dc640360851a1e69261fe72d9fa570a73e6d9465c8ebf971dbe840493b890d.exe
-
Size
384KB
-
MD5
27aa8ad8930fa0d076510cfb6573ce74
-
SHA1
26da6ec9efcd8b95c2d744373532afd12d26bf8f
-
SHA256
91dc640360851a1e69261fe72d9fa570a73e6d9465c8ebf971dbe840493b890d
-
SHA512
bb1af7c9caf9d05e6bf2ebf3ff8fbada74c0e4fbac04759428da3766110b66a8966081b22c0ffc4dc3a141a0914e552a6fc0a766c037c438546e8d4124f5922f
-
SSDEEP
6144:6JHf/OboJwboxHcE2Heo6e+qFCKs7cDZGrBKdt7cWZGbpYByPT7lyvIcbSIvF68U:c3VwboxHc8o6epUVKd9cWvByPHly5WIl
Malware Config
Extracted
nanocore
1.2.2.0
blackangel.hopto.org:54984
f71cda30-fa3d-4402-acaf-cf2c8c816f12
-
activate_away_mode
true
-
backup_connection_host
blackangel.hopto.org
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2024-04-20T19:45:18.703376436Z
-
bypass_user_account_control
true
- bypass_user_account_control_data
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
54984
-
default_group
Default
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
f71cda30-fa3d-4402-acaf-cf2c8c816f12
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
blackangel.hopto.org
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
false
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
Executes dropped EXE 10 IoCs
Processes:
microsoft.exemicrosoft.exemicrosoft.exemicrosoft.exemicrosoft.exemicrosoft.exemicrosoft.exemicrosoft.exemicrosoft.exemicrosoft.exepid process 1108 microsoft.exe 2972 microsoft.exe 1228 microsoft.exe 1644 microsoft.exe 1320 microsoft.exe 1660 microsoft.exe 1848 microsoft.exe 2672 microsoft.exe 1728 microsoft.exe 2184 microsoft.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
91dc640360851a1e69261fe72d9fa570a73e6d9465c8ebf971dbe840493b890d.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\UDP Monitor = "C:\\Program Files (x86)\\UDP Monitor\\udpmon.exe" 91dc640360851a1e69261fe72d9fa570a73e6d9465c8ebf971dbe840493b890d.exe -
Processes:
91dc640360851a1e69261fe72d9fa570a73e6d9465c8ebf971dbe840493b890d.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 91dc640360851a1e69261fe72d9fa570a73e6d9465c8ebf971dbe840493b890d.exe -
Suspicious use of SetThreadContext 6 IoCs
Processes:
91dc640360851a1e69261fe72d9fa570a73e6d9465c8ebf971dbe840493b890d.exemicrosoft.exemicrosoft.exemicrosoft.exemicrosoft.exemicrosoft.exedescription pid process target process PID 1744 set thread context of 2968 1744 91dc640360851a1e69261fe72d9fa570a73e6d9465c8ebf971dbe840493b890d.exe 91dc640360851a1e69261fe72d9fa570a73e6d9465c8ebf971dbe840493b890d.exe PID 1108 set thread context of 2972 1108 microsoft.exe microsoft.exe PID 1228 set thread context of 1644 1228 microsoft.exe microsoft.exe PID 1320 set thread context of 1660 1320 microsoft.exe microsoft.exe PID 1848 set thread context of 2672 1848 microsoft.exe microsoft.exe PID 1728 set thread context of 2184 1728 microsoft.exe microsoft.exe -
Drops file in Program Files directory 2 IoCs
Processes:
91dc640360851a1e69261fe72d9fa570a73e6d9465c8ebf971dbe840493b890d.exedescription ioc process File created C:\Program Files (x86)\UDP Monitor\udpmon.exe 91dc640360851a1e69261fe72d9fa570a73e6d9465c8ebf971dbe840493b890d.exe File opened for modification C:\Program Files (x86)\UDP Monitor\udpmon.exe 91dc640360851a1e69261fe72d9fa570a73e6d9465c8ebf971dbe840493b890d.exe -
System Location Discovery: System Language Discovery 1 TTPs 36 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
cmd.exe91dc640360851a1e69261fe72d9fa570a73e6d9465c8ebf971dbe840493b890d.exeschtasks.exemicrosoft.execmd.execmd.exemicrosoft.exemicrosoft.exeschtasks.exemicrosoft.execmd.execmd.exeschtasks.execmd.execmd.execmd.exeschtasks.execmd.execmd.exemicrosoft.exemicrosoft.execmd.exeschtasks.exeschtasks.execmd.execmd.exemicrosoft.execmd.exemicrosoft.execmd.exemicrosoft.execmd.exemicrosoft.execmd.exe91dc640360851a1e69261fe72d9fa570a73e6d9465c8ebf971dbe840493b890d.execmd.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 91dc640360851a1e69261fe72d9fa570a73e6d9465c8ebf971dbe840493b890d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language microsoft.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language microsoft.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language microsoft.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language microsoft.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language microsoft.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language microsoft.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language microsoft.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language microsoft.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language microsoft.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language microsoft.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 91dc640360851a1e69261fe72d9fa570a73e6d9465c8ebf971dbe840493b890d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 6 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exepid process 2252 schtasks.exe 1284 schtasks.exe 2752 schtasks.exe 3044 schtasks.exe 2288 schtasks.exe 2768 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
91dc640360851a1e69261fe72d9fa570a73e6d9465c8ebf971dbe840493b890d.exepid process 2968 91dc640360851a1e69261fe72d9fa570a73e6d9465c8ebf971dbe840493b890d.exe 2968 91dc640360851a1e69261fe72d9fa570a73e6d9465c8ebf971dbe840493b890d.exe 2968 91dc640360851a1e69261fe72d9fa570a73e6d9465c8ebf971dbe840493b890d.exe 2968 91dc640360851a1e69261fe72d9fa570a73e6d9465c8ebf971dbe840493b890d.exe 2968 91dc640360851a1e69261fe72d9fa570a73e6d9465c8ebf971dbe840493b890d.exe 2968 91dc640360851a1e69261fe72d9fa570a73e6d9465c8ebf971dbe840493b890d.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
91dc640360851a1e69261fe72d9fa570a73e6d9465c8ebf971dbe840493b890d.exepid process 2968 91dc640360851a1e69261fe72d9fa570a73e6d9465c8ebf971dbe840493b890d.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
91dc640360851a1e69261fe72d9fa570a73e6d9465c8ebf971dbe840493b890d.exedescription pid process Token: SeDebugPrivilege 2968 91dc640360851a1e69261fe72d9fa570a73e6d9465c8ebf971dbe840493b890d.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
91dc640360851a1e69261fe72d9fa570a73e6d9465c8ebf971dbe840493b890d.execmd.exetaskeng.exemicrosoft.execmd.exemicrosoft.exedescription pid process target process PID 1744 wrote to memory of 2968 1744 91dc640360851a1e69261fe72d9fa570a73e6d9465c8ebf971dbe840493b890d.exe 91dc640360851a1e69261fe72d9fa570a73e6d9465c8ebf971dbe840493b890d.exe PID 1744 wrote to memory of 2968 1744 91dc640360851a1e69261fe72d9fa570a73e6d9465c8ebf971dbe840493b890d.exe 91dc640360851a1e69261fe72d9fa570a73e6d9465c8ebf971dbe840493b890d.exe PID 1744 wrote to memory of 2968 1744 91dc640360851a1e69261fe72d9fa570a73e6d9465c8ebf971dbe840493b890d.exe 91dc640360851a1e69261fe72d9fa570a73e6d9465c8ebf971dbe840493b890d.exe PID 1744 wrote to memory of 2968 1744 91dc640360851a1e69261fe72d9fa570a73e6d9465c8ebf971dbe840493b890d.exe 91dc640360851a1e69261fe72d9fa570a73e6d9465c8ebf971dbe840493b890d.exe PID 1744 wrote to memory of 2968 1744 91dc640360851a1e69261fe72d9fa570a73e6d9465c8ebf971dbe840493b890d.exe 91dc640360851a1e69261fe72d9fa570a73e6d9465c8ebf971dbe840493b890d.exe PID 1744 wrote to memory of 2968 1744 91dc640360851a1e69261fe72d9fa570a73e6d9465c8ebf971dbe840493b890d.exe 91dc640360851a1e69261fe72d9fa570a73e6d9465c8ebf971dbe840493b890d.exe PID 1744 wrote to memory of 2968 1744 91dc640360851a1e69261fe72d9fa570a73e6d9465c8ebf971dbe840493b890d.exe 91dc640360851a1e69261fe72d9fa570a73e6d9465c8ebf971dbe840493b890d.exe PID 1744 wrote to memory of 2968 1744 91dc640360851a1e69261fe72d9fa570a73e6d9465c8ebf971dbe840493b890d.exe 91dc640360851a1e69261fe72d9fa570a73e6d9465c8ebf971dbe840493b890d.exe PID 1744 wrote to memory of 2968 1744 91dc640360851a1e69261fe72d9fa570a73e6d9465c8ebf971dbe840493b890d.exe 91dc640360851a1e69261fe72d9fa570a73e6d9465c8ebf971dbe840493b890d.exe PID 1744 wrote to memory of 2864 1744 91dc640360851a1e69261fe72d9fa570a73e6d9465c8ebf971dbe840493b890d.exe cmd.exe PID 1744 wrote to memory of 2864 1744 91dc640360851a1e69261fe72d9fa570a73e6d9465c8ebf971dbe840493b890d.exe cmd.exe PID 1744 wrote to memory of 2864 1744 91dc640360851a1e69261fe72d9fa570a73e6d9465c8ebf971dbe840493b890d.exe cmd.exe PID 1744 wrote to memory of 2864 1744 91dc640360851a1e69261fe72d9fa570a73e6d9465c8ebf971dbe840493b890d.exe cmd.exe PID 1744 wrote to memory of 2940 1744 91dc640360851a1e69261fe72d9fa570a73e6d9465c8ebf971dbe840493b890d.exe cmd.exe PID 1744 wrote to memory of 2940 1744 91dc640360851a1e69261fe72d9fa570a73e6d9465c8ebf971dbe840493b890d.exe cmd.exe PID 1744 wrote to memory of 2940 1744 91dc640360851a1e69261fe72d9fa570a73e6d9465c8ebf971dbe840493b890d.exe cmd.exe PID 1744 wrote to memory of 2940 1744 91dc640360851a1e69261fe72d9fa570a73e6d9465c8ebf971dbe840493b890d.exe cmd.exe PID 2940 wrote to memory of 2768 2940 cmd.exe schtasks.exe PID 2940 wrote to memory of 2768 2940 cmd.exe schtasks.exe PID 2940 wrote to memory of 2768 2940 cmd.exe schtasks.exe PID 2940 wrote to memory of 2768 2940 cmd.exe schtasks.exe PID 1744 wrote to memory of 3068 1744 91dc640360851a1e69261fe72d9fa570a73e6d9465c8ebf971dbe840493b890d.exe cmd.exe PID 1744 wrote to memory of 3068 1744 91dc640360851a1e69261fe72d9fa570a73e6d9465c8ebf971dbe840493b890d.exe cmd.exe PID 1744 wrote to memory of 3068 1744 91dc640360851a1e69261fe72d9fa570a73e6d9465c8ebf971dbe840493b890d.exe cmd.exe PID 1744 wrote to memory of 3068 1744 91dc640360851a1e69261fe72d9fa570a73e6d9465c8ebf971dbe840493b890d.exe cmd.exe PID 2428 wrote to memory of 1108 2428 taskeng.exe microsoft.exe PID 2428 wrote to memory of 1108 2428 taskeng.exe microsoft.exe PID 2428 wrote to memory of 1108 2428 taskeng.exe microsoft.exe PID 2428 wrote to memory of 1108 2428 taskeng.exe microsoft.exe PID 1108 wrote to memory of 2972 1108 microsoft.exe microsoft.exe PID 1108 wrote to memory of 2972 1108 microsoft.exe microsoft.exe PID 1108 wrote to memory of 2972 1108 microsoft.exe microsoft.exe PID 1108 wrote to memory of 2972 1108 microsoft.exe microsoft.exe PID 1108 wrote to memory of 2972 1108 microsoft.exe microsoft.exe PID 1108 wrote to memory of 2972 1108 microsoft.exe microsoft.exe PID 1108 wrote to memory of 2972 1108 microsoft.exe microsoft.exe PID 1108 wrote to memory of 2972 1108 microsoft.exe microsoft.exe PID 1108 wrote to memory of 2972 1108 microsoft.exe microsoft.exe PID 1108 wrote to memory of 2116 1108 microsoft.exe cmd.exe PID 1108 wrote to memory of 2116 1108 microsoft.exe cmd.exe PID 1108 wrote to memory of 2116 1108 microsoft.exe cmd.exe PID 1108 wrote to memory of 2116 1108 microsoft.exe cmd.exe PID 1108 wrote to memory of 2040 1108 microsoft.exe cmd.exe PID 1108 wrote to memory of 2040 1108 microsoft.exe cmd.exe PID 1108 wrote to memory of 2040 1108 microsoft.exe cmd.exe PID 1108 wrote to memory of 2040 1108 microsoft.exe cmd.exe PID 2040 wrote to memory of 2252 2040 cmd.exe schtasks.exe PID 2040 wrote to memory of 2252 2040 cmd.exe schtasks.exe PID 2040 wrote to memory of 2252 2040 cmd.exe schtasks.exe PID 2040 wrote to memory of 2252 2040 cmd.exe schtasks.exe PID 1108 wrote to memory of 2476 1108 microsoft.exe cmd.exe PID 1108 wrote to memory of 2476 1108 microsoft.exe cmd.exe PID 1108 wrote to memory of 2476 1108 microsoft.exe cmd.exe PID 1108 wrote to memory of 2476 1108 microsoft.exe cmd.exe PID 2428 wrote to memory of 1228 2428 taskeng.exe microsoft.exe PID 2428 wrote to memory of 1228 2428 taskeng.exe microsoft.exe PID 2428 wrote to memory of 1228 2428 taskeng.exe microsoft.exe PID 2428 wrote to memory of 1228 2428 taskeng.exe microsoft.exe PID 1228 wrote to memory of 1644 1228 microsoft.exe microsoft.exe PID 1228 wrote to memory of 1644 1228 microsoft.exe microsoft.exe PID 1228 wrote to memory of 1644 1228 microsoft.exe microsoft.exe PID 1228 wrote to memory of 1644 1228 microsoft.exe microsoft.exe PID 1228 wrote to memory of 1644 1228 microsoft.exe microsoft.exe PID 1228 wrote to memory of 1644 1228 microsoft.exe microsoft.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\91dc640360851a1e69261fe72d9fa570a73e6d9465c8ebf971dbe840493b890d.exe"C:\Users\Admin\AppData\Local\Temp\91dc640360851a1e69261fe72d9fa570a73e6d9465c8ebf971dbe840493b890d.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1744 -
C:\Users\Admin\AppData\Local\Temp\91dc640360851a1e69261fe72d9fa570a73e6d9465c8ebf971dbe840493b890d.exe"C:\Users\Admin\AppData\Local\Temp\91dc640360851a1e69261fe72d9fa570a73e6d9465c8ebf971dbe840493b890d.exe"2⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:2968 -
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C mkdir "C:\Users\Admin\AppData\Roaming\microsoft"2⤵
- System Location Discovery: System Language Discovery
PID:2864 -
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\microsoft\microsoft.exe'" /f2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2940 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\microsoft\microsoft.exe'" /f3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2768 -
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C copy "C:\Users\Admin\AppData\Local\Temp\91dc640360851a1e69261fe72d9fa570a73e6d9465c8ebf971dbe840493b890d.exe" "C:\Users\Admin\AppData\Roaming\microsoft\microsoft.exe"2⤵
- System Location Discovery: System Language Discovery
PID:3068
-
C:\Windows\system32\taskeng.exetaskeng.exe {01893FF5-E8D4-4E74-8B90-71F125C8C765} S-1-5-21-2172136094-3310281978-782691160-1000:EXCFTDUU\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
PID:2428 -
C:\Users\Admin\AppData\Roaming\microsoft\microsoft.exeC:\Users\Admin\AppData\Roaming\microsoft\microsoft.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1108 -
C:\Users\Admin\AppData\Roaming\microsoft\microsoft.exe"C:\Users\Admin\AppData\Roaming\microsoft\microsoft.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2972 -
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C mkdir "C:\Users\Admin\AppData\Roaming\microsoft"3⤵
- System Location Discovery: System Language Discovery
PID:2116 -
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\microsoft\microsoft.exe'" /f3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\microsoft\microsoft.exe'" /f4⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2252 -
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C copy "C:\Users\Admin\AppData\Roaming\microsoft\microsoft.exe" "C:\Users\Admin\AppData\Roaming\microsoft\microsoft.exe"3⤵
- System Location Discovery: System Language Discovery
PID:2476 -
C:\Users\Admin\AppData\Roaming\microsoft\microsoft.exeC:\Users\Admin\AppData\Roaming\microsoft\microsoft.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1228 -
C:\Users\Admin\AppData\Roaming\microsoft\microsoft.exe"C:\Users\Admin\AppData\Roaming\microsoft\microsoft.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1644 -
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C mkdir "C:\Users\Admin\AppData\Roaming\microsoft"3⤵
- System Location Discovery: System Language Discovery
PID:2556 -
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\microsoft\microsoft.exe'" /f3⤵
- System Location Discovery: System Language Discovery
PID:2232 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\microsoft\microsoft.exe'" /f4⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:1284 -
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C copy "C:\Users\Admin\AppData\Roaming\microsoft\microsoft.exe" "C:\Users\Admin\AppData\Roaming\microsoft\microsoft.exe"3⤵
- System Location Discovery: System Language Discovery
PID:1432 -
C:\Users\Admin\AppData\Roaming\microsoft\microsoft.exeC:\Users\Admin\AppData\Roaming\microsoft\microsoft.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:1320 -
C:\Users\Admin\AppData\Roaming\microsoft\microsoft.exe"C:\Users\Admin\AppData\Roaming\microsoft\microsoft.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1660 -
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C mkdir "C:\Users\Admin\AppData\Roaming\microsoft"3⤵
- System Location Discovery: System Language Discovery
PID:2488 -
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\microsoft\microsoft.exe'" /f3⤵
- System Location Discovery: System Language Discovery
PID:1832 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\microsoft\microsoft.exe'" /f4⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2752 -
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C copy "C:\Users\Admin\AppData\Roaming\microsoft\microsoft.exe" "C:\Users\Admin\AppData\Roaming\microsoft\microsoft.exe"3⤵
- System Location Discovery: System Language Discovery
PID:2800 -
C:\Users\Admin\AppData\Roaming\microsoft\microsoft.exeC:\Users\Admin\AppData\Roaming\microsoft\microsoft.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:1848 -
C:\Users\Admin\AppData\Roaming\microsoft\microsoft.exe"C:\Users\Admin\AppData\Roaming\microsoft\microsoft.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2672 -
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C mkdir "C:\Users\Admin\AppData\Roaming\microsoft"3⤵
- System Location Discovery: System Language Discovery
PID:1168 -
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\microsoft\microsoft.exe'" /f3⤵
- System Location Discovery: System Language Discovery
PID:2996 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\microsoft\microsoft.exe'" /f4⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:3044 -
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C copy "C:\Users\Admin\AppData\Roaming\microsoft\microsoft.exe" "C:\Users\Admin\AppData\Roaming\microsoft\microsoft.exe"3⤵
- System Location Discovery: System Language Discovery
PID:2696 -
C:\Users\Admin\AppData\Roaming\microsoft\microsoft.exeC:\Users\Admin\AppData\Roaming\microsoft\microsoft.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:1728 -
C:\Users\Admin\AppData\Roaming\microsoft\microsoft.exe"C:\Users\Admin\AppData\Roaming\microsoft\microsoft.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2184 -
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C mkdir "C:\Users\Admin\AppData\Roaming\microsoft"3⤵
- System Location Discovery: System Language Discovery
PID:1652 -
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\microsoft\microsoft.exe'" /f3⤵
- System Location Discovery: System Language Discovery
PID:1684 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\microsoft\microsoft.exe'" /f4⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2288 -
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C copy "C:\Users\Admin\AppData\Roaming\microsoft\microsoft.exe" "C:\Users\Admin\AppData\Roaming\microsoft\microsoft.exe"3⤵
- System Location Discovery: System Language Discovery
PID:2064
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
384KB
MD527aa8ad8930fa0d076510cfb6573ce74
SHA126da6ec9efcd8b95c2d744373532afd12d26bf8f
SHA25691dc640360851a1e69261fe72d9fa570a73e6d9465c8ebf971dbe840493b890d
SHA512bb1af7c9caf9d05e6bf2ebf3ff8fbada74c0e4fbac04759428da3766110b66a8966081b22c0ffc4dc3a141a0914e552a6fc0a766c037c438546e8d4124f5922f