Overview

overview

8

Static

static

3

a3b988601f...0N.exe

windows7-x64

8

a3b988601f...0N.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    119s
  • max time network
    105s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20-08-2024 00:18

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    a3b988601ff177c9e4249033afe554d0N.exe

  • Size

    824KB

  • MD5

    a3b988601ff177c9e4249033afe554d0

  • SHA1

    5bfa70d73d1ce57fbdc4813b3da3888c27b355c1

  • SHA256

    3b57166a2a67752c4f1f3adeea25470915cefbbb19cc515bcf7b0a5f6b48ed19

  • SHA512

    142333f75a47b1f57143c100cece090a726aef06e643c7c5332e91898defbe5df3b74de611dbdae4c866d44325d60343884b37ccbd256729b12e4d1ffae96640

  • SSDEEP

    6144:z4sZBOZdjEYTPXMhaMP/kFTA7OA6BOZdjEYTPXMhaMP/a:znANL8oq/kFTsO6NL8oq/a

Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 5 IoCs
  • Checks computer location settings 2 TTPs 5 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 64 IoCs
  • Adds Run key to start application 2 TTPs 18 IoCs
    persistence
  • Drops file in System32 directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a3b988601ff177c9e4249033afe554d0N.exe
    "C:\Users\Admin\AppData\Local\Temp\a3b988601ff177c9e4249033afe554d0N.exe"
    1⤵
    • Drops file in Drivers directory
    • Checks computer location settings
    • Adds Run key to start application
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1416
    • C:\windows\system\dmnko.exe
      "C:\windows\system\dmnko.exe" "C:\Users\Admin\AppData\Local\Temp\a3b988601ff177c9e4249033afe554d0N.exe"
      2⤵
      • Drops file in Drivers directory
      • Checks computer location settings
      • Deletes itself
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:8
      • C:\windows\SysWOW64\ozfjw.exe
        "C:\windows\system32\ozfjw.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:1492
      • C:\windows\SysWOW64\ozfjw.exe
        "C:\windows\system32\ozfjw.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:2160
      • C:\windows\SysWOW64\ozfjw.exe
        "C:\windows\system32\ozfjw.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:1616
      • C:\windows\SysWOW64\ozfjw.exe
        "C:\windows\system32\ozfjw.exe"
        3⤵
        • Executes dropped EXE
        PID:3404
      • C:\windows\SysWOW64\ozfjw.exe
        "C:\windows\system32\ozfjw.exe"
        3⤵
        • Executes dropped EXE
        PID:3128
      • C:\windows\SysWOW64\ozfjw.exe
        "C:\windows\system32\ozfjw.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:4536
      • C:\windows\SysWOW64\ozfjw.exe
        "C:\windows\system32\ozfjw.exe"
        3⤵
        • Executes dropped EXE
        PID:3612
      • C:\windows\SysWOW64\ozfjw.exe
        "C:\windows\system32\ozfjw.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:1308
      • C:\windows\SysWOW64\ozfjw.exe
        "C:\windows\system32\ozfjw.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:4956
      • C:\windows\SysWOW64\ozfjw.exe
        "C:\windows\system32\ozfjw.exe"
        3⤵
        • Executes dropped EXE
        PID:4288
      • C:\windows\SysWOW64\ozfjw.exe
        "C:\windows\system32\ozfjw.exe"
        3⤵
        • Executes dropped EXE
        PID:3932
      • C:\windows\SysWOW64\ozfjw.exe
        "C:\windows\system32\ozfjw.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:4188
      • C:\windows\SysWOW64\ozfjw.exe
        "C:\windows\system32\ozfjw.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:2928
      • C:\windows\SysWOW64\ozfjw.exe
        "C:\windows\system32\ozfjw.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:4592
      • C:\windows\SysWOW64\ozfjw.exe
        "C:\windows\system32\ozfjw.exe"
        3⤵
        • Executes dropped EXE
        PID:3776
      • C:\windows\SysWOW64\ozfjw.exe
        "C:\windows\system32\ozfjw.exe"
        3⤵
        • Executes dropped EXE
        PID:676
      • C:\windows\SysWOW64\ozfjw.exe
        "C:\windows\system32\ozfjw.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:1528
      • C:\windows\SysWOW64\ozfjw.exe
        "C:\windows\system32\ozfjw.exe"
        3⤵
        • Executes dropped EXE
        PID:1940
      • C:\windows\SysWOW64\ozfjw.exe
        "C:\windows\system32\ozfjw.exe"
        3⤵
        • Executes dropped EXE
        PID:2412
      • C:\windows\SysWOW64\ozfjw.exe
        "C:\windows\system32\ozfjw.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:4504
      • C:\windows\SysWOW64\ozfjw.exe
        "C:\windows\system32\ozfjw.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:1032
      • C:\windows\SysWOW64\ozfjw.exe
        "C:\windows\system32\ozfjw.exe"
        3⤵
          PID:2732
        • C:\windows\SysWOW64\ozfjw.exe
          "C:\windows\system32\ozfjw.exe"
          3⤵
          • System Location Discovery: System Language Discovery
          PID:4036
        • C:\windows\SysWOW64\ozfjw.exe
          "C:\windows\system32\ozfjw.exe"
          3⤵
          • System Location Discovery: System Language Discovery
          PID:776
        • C:\windows\SysWOW64\ozfjw.exe
          "C:\windows\system32\ozfjw.exe"
          3⤵
            PID:2728
          • C:\windows\SysWOW64\ozfjw.exe
            "C:\windows\system32\ozfjw.exe"
            3⤵
            • System Location Discovery: System Language Discovery
            PID:2932
          • C:\windows\SysWOW64\ozfjw.exe
            "C:\windows\system32\ozfjw.exe"
            3⤵
            • System Location Discovery: System Language Discovery
            PID:2264
          • C:\windows\SysWOW64\ozfjw.exe
            "C:\windows\system32\ozfjw.exe"
            3⤵
              PID:3104
            • C:\windows\SysWOW64\ozfjw.exe
              "C:\windows\system32\ozfjw.exe"
              3⤵
              • System Location Discovery: System Language Discovery
              PID:4868
            • C:\windows\SysWOW64\ozfjw.exe
              "C:\windows\system32\ozfjw.exe"
              3⤵
                PID:5080
              • C:\windows\SysWOW64\ozfjw.exe
                "C:\windows\system32\ozfjw.exe"
                3⤵
                • System Location Discovery: System Language Discovery
                PID:5084
              • C:\windows\SysWOW64\ozfjw.exe
                "C:\windows\system32\ozfjw.exe"
                3⤵
                  PID:1336
                • C:\windows\SysWOW64\ozfjw.exe
                  "C:\windows\system32\ozfjw.exe"
                  3⤵
                  • System Location Discovery: System Language Discovery
                  PID:2276
                • C:\windows\SysWOW64\ozfjw.exe
                  "C:\windows\system32\ozfjw.exe" "C:\windows\system\dmnko.exe"
                  3⤵
                    PID:1128
                • C:\windows\SysWOW64\ozfjw.exe
                  "C:\windows\system32\ozfjw.exe" "C:\Users\Admin\AppData\Local\Temp\a3b988601ff177c9e4249033afe554d0N.exe"
                  2⤵
                  • Drops file in Drivers directory
                  • Checks computer location settings
                  • Executes dropped EXE
                  • Adds Run key to start application
                  • Drops file in System32 directory
                  • Drops file in Windows directory
                  • Modifies registry class
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of WriteProcessMemory
                  PID:1480
                  • C:\windows\SysWOW64\ozfjw.exe
                    "C:\windows\system32\ozfjw.exe"
                    3⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    PID:2476
                  • C:\windows\SysWOW64\ozfjw.exe
                    "C:\windows\system32\ozfjw.exe"
                    3⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    PID:2928
                  • C:\windows\SysWOW64\ozfjw.exe
                    "C:\windows\system32\ozfjw.exe"
                    3⤵
                    • Executes dropped EXE
                    PID:4560
                  • C:\windows\SysWOW64\ozfjw.exe
                    "C:\windows\system32\ozfjw.exe"
                    3⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    PID:3044
                  • C:\windows\SysWOW64\ozfjw.exe
                    "C:\windows\system32\ozfjw.exe"
                    3⤵
                    • Executes dropped EXE
                    PID:4108
                  • C:\windows\SysWOW64\ozfjw.exe
                    "C:\windows\system32\ozfjw.exe"
                    3⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    PID:1820
                  • C:\windows\SysWOW64\ozfjw.exe
                    "C:\windows\system32\ozfjw.exe"
                    3⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    PID:4032
                  • C:\windows\SysWOW64\ozfjw.exe
                    "C:\windows\system32\ozfjw.exe"
                    3⤵
                    • Executes dropped EXE
                    PID:1688
                  • C:\windows\SysWOW64\ozfjw.exe
                    "C:\windows\system32\ozfjw.exe"
                    3⤵
                    • Executes dropped EXE
                    PID:2592
                  • C:\windows\SysWOW64\ozfjw.exe
                    "C:\windows\system32\ozfjw.exe"
                    3⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    PID:1044
                  • C:\windows\SysWOW64\ozfjw.exe
                    "C:\windows\system32\ozfjw.exe"
                    3⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    PID:3444
                  • C:\windows\SysWOW64\ozfjw.exe
                    "C:\windows\system32\ozfjw.exe"
                    3⤵
                    • Executes dropped EXE
                    PID:1592
                  • C:\windows\SysWOW64\ozfjw.exe
                    "C:\windows\system32\ozfjw.exe"
                    3⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    PID:1204
                  • C:\windows\SysWOW64\ozfjw.exe
                    "C:\windows\system32\ozfjw.exe"
                    3⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    PID:5104
                  • C:\windows\SysWOW64\ozfjw.exe
                    "C:\windows\system32\ozfjw.exe"
                    3⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    PID:3536
                  • C:\windows\SysWOW64\ozfjw.exe
                    "C:\windows\system32\ozfjw.exe"
                    3⤵
                    • Executes dropped EXE
                    PID:4836
                  • C:\windows\SysWOW64\ozfjw.exe
                    "C:\windows\system32\ozfjw.exe"
                    3⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    PID:4108
                  • C:\windows\SysWOW64\ozfjw.exe
                    "C:\windows\system32\ozfjw.exe"
                    3⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    PID:1820
                  • C:\windows\SysWOW64\ozfjw.exe
                    "C:\windows\system32\ozfjw.exe"
                    3⤵
                    • Executes dropped EXE
                    PID:2036
                  • C:\windows\SysWOW64\ozfjw.exe
                    "C:\windows\system32\ozfjw.exe"
                    3⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    PID:3860
                  • C:\windows\SysWOW64\ozfjw.exe
                    "C:\windows\system32\ozfjw.exe"
                    3⤵
                    • System Location Discovery: System Language Discovery
                    PID:3980
                  • C:\windows\SysWOW64\ozfjw.exe
                    "C:\windows\system32\ozfjw.exe"
                    3⤵
                      PID:1536
                    • C:\windows\SysWOW64\ozfjw.exe
                      "C:\windows\system32\ozfjw.exe"
                      3⤵
                      • System Location Discovery: System Language Discovery
                      PID:4216
                    • C:\windows\SysWOW64\ozfjw.exe
                      "C:\windows\system32\ozfjw.exe"
                      3⤵
                        PID:5016
                      • C:\windows\SysWOW64\ozfjw.exe
                        "C:\windows\system32\ozfjw.exe"
                        3⤵
                          PID:1568
                        • C:\windows\SysWOW64\ozfjw.exe
                          "C:\windows\system32\ozfjw.exe"
                          3⤵
                          • System Location Discovery: System Language Discovery
                          PID:1496
                        • C:\windows\SysWOW64\ozfjw.exe
                          "C:\windows\system32\ozfjw.exe"
                          3⤵
                          • System Location Discovery: System Language Discovery
                          PID:4976
                        • C:\windows\SysWOW64\ozfjw.exe
                          "C:\windows\system32\ozfjw.exe"
                          3⤵
                          • System Location Discovery: System Language Discovery
                          PID:3100
                        • C:\windows\SysWOW64\ozfjw.exe
                          "C:\windows\system32\ozfjw.exe"
                          3⤵
                          • System Location Discovery: System Language Discovery
                          PID:4020
                        • C:\windows\SysWOW64\ozfjw.exe
                          "C:\windows\system32\ozfjw.exe"
                          3⤵
                          • System Location Discovery: System Language Discovery
                          PID:4600
                        • C:\windows\SysWOW64\ozfjw.exe
                          "C:\windows\system32\ozfjw.exe"
                          3⤵
                          • System Location Discovery: System Language Discovery
                          PID:1760
                        • C:\windows\system\pqneghsj.exe
                          "C:\windows\system\pqneghsj.exe"
                          3⤵
                          • Drops file in Drivers directory
                          • Checks computer location settings
                          • Adds Run key to start application
                          • Drops file in System32 directory
                          • Drops file in Windows directory
                          • Modifies registry class
                          PID:4188
                          • C:\windows\SysWOW64\ozfjw.exe
                            "C:\windows\system32\ozfjw.exe"
                            4⤵
                              PID:4416
                            • C:\windows\SysWOW64\ozfjw.exe
                              "C:\windows\system32\ozfjw.exe"
                              4⤵
                              • System Location Discovery: System Language Discovery
                              PID:5104
                            • C:\windows\SysWOW64\ozfjw.exe
                              "C:\windows\system32\ozfjw.exe"
                              4⤵
                              • System Location Discovery: System Language Discovery
                              PID:5084
                            • C:\windows\SysWOW64\ozfjw.exe
                              "C:\windows\system32\ozfjw.exe"
                              4⤵
                                PID:2604
                            • C:\windows\SysWOW64\ozfjw.exe
                              "C:\windows\system32\ozfjw.exe"
                              3⤵
                              • System Location Discovery: System Language Discovery
                              PID:4944
                            • C:\windows\SysWOW64\ozfjw.exe
                              "C:\windows\system32\ozfjw.exe"
                              3⤵
                              • System Location Discovery: System Language Discovery
                              PID:5080
                            • C:\windows\SysWOW64\ozfjw.exe
                              "C:\windows\system32\ozfjw.exe"
                              3⤵
                                PID:4020
                              • C:\windows\SysWOW64\ozfjw.exe
                                "C:\windows\system32\ozfjw.exe"
                                3⤵
                                  PID:2684
                                • C:\windows\SysWOW64\ozfjw.exe
                                  "C:\windows\system32\ozfjw.exe"
                                  3⤵
                                  • System Location Discovery: System Language Discovery
                                  PID:4136
                              • C:\windows\jcorgtn.exe
                                "C:\windows\jcorgtn.exe" "C:\Users\Admin\AppData\Local\Temp\a3b988601ff177c9e4249033afe554d0N.exe"
                                2⤵
                                • Drops file in Drivers directory
                                • Checks computer location settings
                                • Executes dropped EXE
                                • Adds Run key to start application
                                • Drops file in System32 directory
                                • Drops file in Windows directory
                                • System Location Discovery: System Language Discovery
                                • Modifies registry class
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious use of WriteProcessMemory
                                PID:732
                                • C:\windows\SysWOW64\ozfjw.exe
                                  "C:\windows\system32\ozfjw.exe"
                                  3⤵
                                  • Executes dropped EXE
                                  • System Location Discovery: System Language Discovery
                                  PID:1440
                                • C:\windows\SysWOW64\ozfjw.exe
                                  "C:\windows\system32\ozfjw.exe"
                                  3⤵
                                  • Executes dropped EXE
                                  PID:3012
                                • C:\windows\SysWOW64\ozfjw.exe
                                  "C:\windows\system32\ozfjw.exe"
                                  3⤵
                                  • Executes dropped EXE
                                  • System Location Discovery: System Language Discovery
                                  PID:4400
                                • C:\windows\SysWOW64\ozfjw.exe
                                  "C:\windows\system32\ozfjw.exe"
                                  3⤵
                                  • Executes dropped EXE
                                  • System Location Discovery: System Language Discovery
                                  PID:3888
                                • C:\windows\SysWOW64\ozfjw.exe
                                  "C:\windows\system32\ozfjw.exe"
                                  3⤵
                                  • Executes dropped EXE
                                  • System Location Discovery: System Language Discovery
                                  PID:1444
                                • C:\windows\SysWOW64\ozfjw.exe
                                  "C:\windows\system32\ozfjw.exe"
                                  3⤵
                                  • Executes dropped EXE
                                  • System Location Discovery: System Language Discovery
                                  PID:4508
                                • C:\windows\SysWOW64\ozfjw.exe
                                  "C:\windows\system32\ozfjw.exe"
                                  3⤵
                                  • Executes dropped EXE
                                  PID:2196
                                • C:\windows\SysWOW64\ozfjw.exe
                                  "C:\windows\system32\ozfjw.exe"
                                  3⤵
                                  • Executes dropped EXE
                                  • System Location Discovery: System Language Discovery
                                  PID:3944
                                • C:\windows\SysWOW64\ozfjw.exe
                                  "C:\windows\system32\ozfjw.exe"
                                  3⤵
                                  • Executes dropped EXE
                                  • System Location Discovery: System Language Discovery
                                  PID:1864
                                • C:\windows\SysWOW64\ozfjw.exe
                                  "C:\windows\system32\ozfjw.exe"
                                  3⤵
                                  • Executes dropped EXE
                                  PID:1536
                                • C:\windows\SysWOW64\ozfjw.exe
                                  "C:\windows\system32\ozfjw.exe"
                                  3⤵
                                  • Executes dropped EXE
                                  PID:1492
                                • C:\windows\SysWOW64\ozfjw.exe
                                  "C:\windows\system32\ozfjw.exe"
                                  3⤵
                                  • Executes dropped EXE
                                  PID:4348
                                • C:\windows\SysWOW64\ozfjw.exe
                                  "C:\windows\system32\ozfjw.exe"
                                  3⤵
                                  • Executes dropped EXE
                                  PID:1392
                                • C:\windows\SysWOW64\ozfjw.exe
                                  "C:\windows\system32\ozfjw.exe"
                                  3⤵
                                  • Executes dropped EXE
                                  PID:1780
                                • C:\windows\SysWOW64\ozfjw.exe
                                  "C:\windows\system32\ozfjw.exe"
                                  3⤵
                                  • Executes dropped EXE
                                  • System Location Discovery: System Language Discovery
                                  PID:232
                                • C:\windows\SysWOW64\ozfjw.exe
                                  "C:\windows\system32\ozfjw.exe"
                                  3⤵
                                  • Executes dropped EXE
                                  • System Location Discovery: System Language Discovery
                                  PID:5024
                                • C:\windows\SysWOW64\ozfjw.exe
                                  "C:\windows\system32\ozfjw.exe"
                                  3⤵
                                  • Executes dropped EXE
                                  • System Location Discovery: System Language Discovery
                                  PID:4316
                                • C:\windows\SysWOW64\ozfjw.exe
                                  "C:\windows\system32\ozfjw.exe"
                                  3⤵
                                  • Executes dropped EXE
                                  PID:4600
                                • C:\windows\SysWOW64\ozfjw.exe
                                  "C:\windows\system32\ozfjw.exe"
                                  3⤵
                                  • Executes dropped EXE
                                  • System Location Discovery: System Language Discovery
                                  PID:3732
                                • C:\windows\SysWOW64\ozfjw.exe
                                  "C:\windows\system32\ozfjw.exe"
                                  3⤵
                                  • Executes dropped EXE
                                  • System Location Discovery: System Language Discovery
                                  PID:4596
                                • C:\windows\SysWOW64\ozfjw.exe
                                  "C:\windows\system32\ozfjw.exe"
                                  3⤵
                                    PID:1680
                                  • C:\windows\SysWOW64\ozfjw.exe
                                    "C:\windows\system32\ozfjw.exe"
                                    3⤵
                                      PID:4848
                                    • C:\windows\SysWOW64\ozfjw.exe
                                      "C:\windows\system32\ozfjw.exe"
                                      3⤵
                                      • System Location Discovery: System Language Discovery
                                      PID:2660
                                    • C:\windows\SysWOW64\ozfjw.exe
                                      "C:\windows\system32\ozfjw.exe"
                                      3⤵
                                        PID:3216
                                      • C:\windows\SysWOW64\ozfjw.exe
                                        "C:\windows\system32\ozfjw.exe"
                                        3⤵
                                          PID:3076
                                        • C:\windows\SysWOW64\ozfjw.exe
                                          "C:\windows\system32\ozfjw.exe"
                                          3⤵
                                            PID:840
                                          • C:\windows\SysWOW64\ozfjw.exe
                                            "C:\windows\system32\ozfjw.exe"
                                            3⤵
                                              PID:2160
                                            • C:\windows\SysWOW64\ozfjw.exe
                                              "C:\windows\system32\ozfjw.exe"
                                              3⤵
                                              • System Location Discovery: System Language Discovery
                                              PID:5060
                                            • C:\windows\SysWOW64\ozfjw.exe
                                              "C:\windows\system32\ozfjw.exe"
                                              3⤵
                                                PID:1616
                                              • C:\windows\SysWOW64\ozfjw.exe
                                                "C:\windows\system32\ozfjw.exe"
                                                3⤵
                                                • System Location Discovery: System Language Discovery
                                                PID:5104
                                              • C:\windows\SysWOW64\ozfjw.exe
                                                "C:\windows\system32\ozfjw.exe"
                                                3⤵
                                                  PID:832
                                                • C:\windows\SysWOW64\ozfjw.exe
                                                  "C:\windows\system32\ozfjw.exe"
                                                  3⤵
                                                    PID:4884
                                                  • C:\windows\SysWOW64\ozfjw.exe
                                                    "C:\windows\system32\ozfjw.exe"
                                                    3⤵
                                                      PID:4488
                                                    • C:\windows\SysWOW64\ozfjw.exe
                                                      "C:\windows\system32\ozfjw.exe"
                                                      3⤵
                                                      • System Location Discovery: System Language Discovery
                                                      PID:4360
                                                    • C:\windows\SysWOW64\ozfjw.exe
                                                      "C:\windows\system32\ozfjw.exe"
                                                      3⤵
                                                        PID:1864
                                                      • C:\windows\SysWOW64\ozfjw.exe
                                                        "C:\windows\system32\ozfjw.exe"
                                                        3⤵
                                                        • System Location Discovery: System Language Discovery
                                                        PID:4676
                                                      • C:\windows\SysWOW64\ozfjw.exe
                                                        "C:\windows\system32\ozfjw.exe"
                                                        3⤵
                                                          PID:3928

                                                    Network

                                                    MITRE ATT&CK Enterprise v15

                                                    Replay Monitor

                                                    Loading Replay Monitor...

                                                    Downloads

                                                    • C:\Users\Admin\AppData\Local\Temp\a3b988601ff177c9e4249033afe554d0N.exedmnko.exe_
                                                      Filesize

                                                      824KB

                                                      MD5

                                                      a3b988601ff177c9e4249033afe554d0

                                                      SHA1

                                                      5bfa70d73d1ce57fbdc4813b3da3888c27b355c1

                                                      SHA256

                                                      3b57166a2a67752c4f1f3adeea25470915cefbbb19cc515bcf7b0a5f6b48ed19

                                                      SHA512

                                                      142333f75a47b1f57143c100cece090a726aef06e643c7c5332e91898defbe5df3b74de611dbdae4c866d44325d60343884b37ccbd256729b12e4d1ffae96640

                                                      Download Submit

                                                    • C:\Windows\SysWOW64\ozfjw.exe
                                                      Filesize

                                                      678KB

                                                      MD5

                                                      072ed5c7b1f18c383b8ccdb0dd3edb4b

                                                      SHA1

                                                      2ed84152b9ea71e267dd4d1af22df852080a3be4

                                                      SHA256

                                                      b386b5165f88a6301eeb7637786625f8bf3f29030ebf7c827e8096a3e68ec0a0

                                                      SHA512

                                                      df673216c1eaa194adeb28c3008be0248b0e120db2d879bdd707cc680705f419f228dbf052edf7f66f6d26496cc81e0f293885e0081e4ebe696d78b7f15f1c55

                                                      Download Submit

                                                    • C:\Windows\SysWOW64\ozfjw.exepqneghsj.exe_
                                                      Filesize

                                                      532KB

                                                      MD5

                                                      91a28047a2f0ee1660e5b3c54288a58d

                                                      SHA1

                                                      0c291a456c547b00403849abf6d7000da9a9f6ef

                                                      SHA256

                                                      e8a4e44b78a1916b51302b44c2d5d6104596b7f6b7d04613b65ff7450f3c9948

                                                      SHA512

                                                      94fec00c45c5a095f03e9c0241f7f9414b1600db9e6d8fa1f6ab09dcee5e7a2b21ea53ed1e6a0f6a05411ea1bd65a802f1e0ab75cf98051501e46c6a503b9297

                                                      Download Submit

                                                    • C:\Windows\jcorgtn.exe
                                                      Filesize

                                                      727KB

                                                      MD5

                                                      d86fbbb69b1f3b8a5be4ceb3ee17759c

                                                      SHA1

                                                      fc409cfcb3e8257494d70be0c175aac38ccc556f

                                                      SHA256

                                                      8090a85de17923fb19d011be7c39edad71c694146481d808a074c2a77bc63e4a

                                                      SHA512

                                                      d5a0872ff7b76cc10d679c4cb374c8e1be3d3f51c4c2a14e0cbd3fc1c7bcd1ef89b320617e60c3e54b5752badf7b0e91b8f1f19d8f9267c7817f5f6e1a139e8c

                                                      Download Submit