Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
19/09/2024, 05:40
Behavioral task
behavioral1
Sample
948c936ec068cb31bfc96159784d2799aae0a46a7a8d4f047cfffae0595f65aeN.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
948c936ec068cb31bfc96159784d2799aae0a46a7a8d4f047cfffae0595f65aeN.exe
Resource
win10v2004-20240802-en
General
-
Target
948c936ec068cb31bfc96159784d2799aae0a46a7a8d4f047cfffae0595f65aeN.exe
-
Size
232KB
-
MD5
d410e228f5c3decc42f498db4acc60b0
-
SHA1
1791a7ae32a3ef2cb990c96000057e008efa18f8
-
SHA256
948c936ec068cb31bfc96159784d2799aae0a46a7a8d4f047cfffae0595f65ae
-
SHA512
17dd5c3de073c8456f46b5ffa638c98f388c7c26177c74c31f1a185b89ce9ab7490824814609d88a5642af6e9139c608a6b12b9970ec335c6e2ab3e5a5ae12d3
-
SSDEEP
3072:rFKcMgu5HGYZq47usluTXp6UF5wzec+tZOnU1/s5HH0AU/yRvS3u121TzlbNRfz/:rkH4YZq46s21L7/s50z/Wa3/PNlPX
Malware Config
Extracted
berbew
http://tat-neftbank.ru/kkq.php
http://tat-neftbank.ru/wcmd.htm
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 24 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ainmlomf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ahfgbkpl.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Clfhml32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad 948c936ec068cb31bfc96159784d2799aae0a46a7a8d4f047cfffae0595f65aeN.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" 948c936ec068cb31bfc96159784d2799aae0a46a7a8d4f047cfffae0595f65aeN.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Qgfkchmp.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Qmepanje.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Aiqjao32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Aiqjao32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pjpmdd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Pjpmdd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Qgfkchmp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ainmlomf.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ccnddg32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ahfgbkpl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Bjiljf32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cbkgog32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Cbkgog32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ccnddg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Clfhml32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pfnhkq32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Pfnhkq32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Qmepanje.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bjiljf32.exe -
Executes dropped EXE 12 IoCs
pid Process 2156 Pfnhkq32.exe 2768 Pjpmdd32.exe 2776 Qgfkchmp.exe 2852 Qmepanje.exe 2644 Ainmlomf.exe 1052 Aiqjao32.exe 2400 Ahfgbkpl.exe 2052 Bjiljf32.exe 1696 Cbkgog32.exe 2020 Ccnddg32.exe 2892 Clfhml32.exe 2168 Coindgbi.exe -
Loads dropped DLL 24 IoCs
pid Process 2236 948c936ec068cb31bfc96159784d2799aae0a46a7a8d4f047cfffae0595f65aeN.exe 2236 948c936ec068cb31bfc96159784d2799aae0a46a7a8d4f047cfffae0595f65aeN.exe 2156 Pfnhkq32.exe 2156 Pfnhkq32.exe 2768 Pjpmdd32.exe 2768 Pjpmdd32.exe 2776 Qgfkchmp.exe 2776 Qgfkchmp.exe 2852 Qmepanje.exe 2852 Qmepanje.exe 2644 Ainmlomf.exe 2644 Ainmlomf.exe 1052 Aiqjao32.exe 1052 Aiqjao32.exe 2400 Ahfgbkpl.exe 2400 Ahfgbkpl.exe 2052 Bjiljf32.exe 2052 Bjiljf32.exe 1696 Cbkgog32.exe 1696 Cbkgog32.exe 2020 Ccnddg32.exe 2020 Ccnddg32.exe 2892 Clfhml32.exe 2892 Clfhml32.exe -
Drops file in System32 directory 36 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\Pfnhkq32.exe 948c936ec068cb31bfc96159784d2799aae0a46a7a8d4f047cfffae0595f65aeN.exe File opened for modification C:\Windows\SysWOW64\Pjpmdd32.exe Pfnhkq32.exe File created C:\Windows\SysWOW64\Qmepanje.exe Qgfkchmp.exe File created C:\Windows\SysWOW64\Dafikqcd.dll Aiqjao32.exe File created C:\Windows\SysWOW64\Coindgbi.exe Clfhml32.exe File created C:\Windows\SysWOW64\Ahfgbkpl.exe Aiqjao32.exe File created C:\Windows\SysWOW64\Bjiljf32.exe Ahfgbkpl.exe File created C:\Windows\SysWOW64\Ccnddg32.exe Cbkgog32.exe File opened for modification C:\Windows\SysWOW64\Ccnddg32.exe Cbkgog32.exe File created C:\Windows\SysWOW64\Pjpmdd32.exe Pfnhkq32.exe File opened for modification C:\Windows\SysWOW64\Qmepanje.exe Qgfkchmp.exe File created C:\Windows\SysWOW64\Fgielf32.dll Qgfkchmp.exe File opened for modification C:\Windows\SysWOW64\Ainmlomf.exe Qmepanje.exe File created C:\Windows\SysWOW64\Pohoplja.dll Qmepanje.exe File created C:\Windows\SysWOW64\Aiffeloi.dll Pjpmdd32.exe File created C:\Windows\SysWOW64\Aiqjao32.exe Ainmlomf.exe File created C:\Windows\SysWOW64\Kdgfnh32.dll Ainmlomf.exe File opened for modification C:\Windows\SysWOW64\Ahfgbkpl.exe Aiqjao32.exe File opened for modification C:\Windows\SysWOW64\Clfhml32.exe Ccnddg32.exe File created C:\Windows\SysWOW64\Ohodgb32.dll Clfhml32.exe File created C:\Windows\SysWOW64\Cbkgog32.exe Bjiljf32.exe File opened for modification C:\Windows\SysWOW64\Cbkgog32.exe Bjiljf32.exe File created C:\Windows\SysWOW64\Pfnhkq32.exe 948c936ec068cb31bfc96159784d2799aae0a46a7a8d4f047cfffae0595f65aeN.exe File created C:\Windows\SysWOW64\Jcfddmhe.dll 948c936ec068cb31bfc96159784d2799aae0a46a7a8d4f047cfffae0595f65aeN.exe File created C:\Windows\SysWOW64\Nohefjhb.dll Pfnhkq32.exe File created C:\Windows\SysWOW64\Qgfkchmp.exe Pjpmdd32.exe File opened for modification C:\Windows\SysWOW64\Qgfkchmp.exe Pjpmdd32.exe File created C:\Windows\SysWOW64\Ainmlomf.exe Qmepanje.exe File opened for modification C:\Windows\SysWOW64\Coindgbi.exe Clfhml32.exe File opened for modification C:\Windows\SysWOW64\Aiqjao32.exe Ainmlomf.exe File created C:\Windows\SysWOW64\Kipdmjne.dll Ahfgbkpl.exe File created C:\Windows\SysWOW64\Hjlkkhne.dll Ccnddg32.exe File opened for modification C:\Windows\SysWOW64\Bjiljf32.exe Ahfgbkpl.exe File created C:\Windows\SysWOW64\Clfhml32.exe Ccnddg32.exe File created C:\Windows\SysWOW64\Jlmhimhb.dll Bjiljf32.exe File created C:\Windows\SysWOW64\Madcho32.dll Cbkgog32.exe -
System Location Discovery: System Language Discovery 1 TTPs 13 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cbkgog32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pfnhkq32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pjpmdd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Qgfkchmp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Qmepanje.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Aiqjao32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ccnddg32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Clfhml32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 948c936ec068cb31bfc96159784d2799aae0a46a7a8d4f047cfffae0595f65aeN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ainmlomf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ahfgbkpl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bjiljf32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Coindgbi.exe -
Modifies registry class 39 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ahfgbkpl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node 948c936ec068cb31bfc96159784d2799aae0a46a7a8d4f047cfffae0595f65aeN.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738} 948c936ec068cb31bfc96159784d2799aae0a46a7a8d4f047cfffae0595f65aeN.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aiffeloi.dll" Pjpmdd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kdgfnh32.dll" Ainmlomf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Aiqjao32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Pfnhkq32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nohefjhb.dll" Pfnhkq32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fgielf32.dll" Qgfkchmp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ccnddg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ohodgb32.dll" Clfhml32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" 948c936ec068cb31bfc96159784d2799aae0a46a7a8d4f047cfffae0595f65aeN.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Pjpmdd32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Aiqjao32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kipdmjne.dll" Ahfgbkpl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Bjiljf32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ccnddg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Clfhml32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Qmepanje.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pohoplja.dll" Qmepanje.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dafikqcd.dll" Aiqjao32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ahfgbkpl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jlmhimhb.dll" Bjiljf32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Cbkgog32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Madcho32.dll" Cbkgog32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Clfhml32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID 948c936ec068cb31bfc96159784d2799aae0a46a7a8d4f047cfffae0595f65aeN.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Qgfkchmp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ainmlomf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Pfnhkq32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ainmlomf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Bjiljf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Cbkgog32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 948c936ec068cb31bfc96159784d2799aae0a46a7a8d4f047cfffae0595f65aeN.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Qgfkchmp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Qmepanje.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jcfddmhe.dll" 948c936ec068cb31bfc96159784d2799aae0a46a7a8d4f047cfffae0595f65aeN.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Pjpmdd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hjlkkhne.dll" Ccnddg32.exe -
Suspicious use of WriteProcessMemory 48 IoCs
description pid Process procid_target PID 2236 wrote to memory of 2156 2236 948c936ec068cb31bfc96159784d2799aae0a46a7a8d4f047cfffae0595f65aeN.exe 30 PID 2236 wrote to memory of 2156 2236 948c936ec068cb31bfc96159784d2799aae0a46a7a8d4f047cfffae0595f65aeN.exe 30 PID 2236 wrote to memory of 2156 2236 948c936ec068cb31bfc96159784d2799aae0a46a7a8d4f047cfffae0595f65aeN.exe 30 PID 2236 wrote to memory of 2156 2236 948c936ec068cb31bfc96159784d2799aae0a46a7a8d4f047cfffae0595f65aeN.exe 30 PID 2156 wrote to memory of 2768 2156 Pfnhkq32.exe 31 PID 2156 wrote to memory of 2768 2156 Pfnhkq32.exe 31 PID 2156 wrote to memory of 2768 2156 Pfnhkq32.exe 31 PID 2156 wrote to memory of 2768 2156 Pfnhkq32.exe 31 PID 2768 wrote to memory of 2776 2768 Pjpmdd32.exe 32 PID 2768 wrote to memory of 2776 2768 Pjpmdd32.exe 32 PID 2768 wrote to memory of 2776 2768 Pjpmdd32.exe 32 PID 2768 wrote to memory of 2776 2768 Pjpmdd32.exe 32 PID 2776 wrote to memory of 2852 2776 Qgfkchmp.exe 33 PID 2776 wrote to memory of 2852 2776 Qgfkchmp.exe 33 PID 2776 wrote to memory of 2852 2776 Qgfkchmp.exe 33 PID 2776 wrote to memory of 2852 2776 Qgfkchmp.exe 33 PID 2852 wrote to memory of 2644 2852 Qmepanje.exe 34 PID 2852 wrote to memory of 2644 2852 Qmepanje.exe 34 PID 2852 wrote to memory of 2644 2852 Qmepanje.exe 34 PID 2852 wrote to memory of 2644 2852 Qmepanje.exe 34 PID 2644 wrote to memory of 1052 2644 Ainmlomf.exe 35 PID 2644 wrote to memory of 1052 2644 Ainmlomf.exe 35 PID 2644 wrote to memory of 1052 2644 Ainmlomf.exe 35 PID 2644 wrote to memory of 1052 2644 Ainmlomf.exe 35 PID 1052 wrote to memory of 2400 1052 Aiqjao32.exe 36 PID 1052 wrote to memory of 2400 1052 Aiqjao32.exe 36 PID 1052 wrote to memory of 2400 1052 Aiqjao32.exe 36 PID 1052 wrote to memory of 2400 1052 Aiqjao32.exe 36 PID 2400 wrote to memory of 2052 2400 Ahfgbkpl.exe 37 PID 2400 wrote to memory of 2052 2400 Ahfgbkpl.exe 37 PID 2400 wrote to memory of 2052 2400 Ahfgbkpl.exe 37 PID 2400 wrote to memory of 2052 2400 Ahfgbkpl.exe 37 PID 2052 wrote to memory of 1696 2052 Bjiljf32.exe 38 PID 2052 wrote to memory of 1696 2052 Bjiljf32.exe 38 PID 2052 wrote to memory of 1696 2052 Bjiljf32.exe 38 PID 2052 wrote to memory of 1696 2052 Bjiljf32.exe 38 PID 1696 wrote to memory of 2020 1696 Cbkgog32.exe 39 PID 1696 wrote to memory of 2020 1696 Cbkgog32.exe 39 PID 1696 wrote to memory of 2020 1696 Cbkgog32.exe 39 PID 1696 wrote to memory of 2020 1696 Cbkgog32.exe 39 PID 2020 wrote to memory of 2892 2020 Ccnddg32.exe 40 PID 2020 wrote to memory of 2892 2020 Ccnddg32.exe 40 PID 2020 wrote to memory of 2892 2020 Ccnddg32.exe 40 PID 2020 wrote to memory of 2892 2020 Ccnddg32.exe 40 PID 2892 wrote to memory of 2168 2892 Clfhml32.exe 41 PID 2892 wrote to memory of 2168 2892 Clfhml32.exe 41 PID 2892 wrote to memory of 2168 2892 Clfhml32.exe 41 PID 2892 wrote to memory of 2168 2892 Clfhml32.exe 41
Processes
-
C:\Users\Admin\AppData\Local\Temp\948c936ec068cb31bfc96159784d2799aae0a46a7a8d4f047cfffae0595f65aeN.exe"C:\Users\Admin\AppData\Local\Temp\948c936ec068cb31bfc96159784d2799aae0a46a7a8d4f047cfffae0595f65aeN.exe"1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2236 -
C:\Windows\SysWOW64\Pfnhkq32.exeC:\Windows\system32\Pfnhkq32.exe2⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2156 -
C:\Windows\SysWOW64\Pjpmdd32.exeC:\Windows\system32\Pjpmdd32.exe3⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2768 -
C:\Windows\SysWOW64\Qgfkchmp.exeC:\Windows\system32\Qgfkchmp.exe4⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2776 -
C:\Windows\SysWOW64\Qmepanje.exeC:\Windows\system32\Qmepanje.exe5⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2852 -
C:\Windows\SysWOW64\Ainmlomf.exeC:\Windows\system32\Ainmlomf.exe6⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\Windows\SysWOW64\Aiqjao32.exeC:\Windows\system32\Aiqjao32.exe7⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1052 -
C:\Windows\SysWOW64\Ahfgbkpl.exeC:\Windows\system32\Ahfgbkpl.exe8⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2400 -
C:\Windows\SysWOW64\Bjiljf32.exeC:\Windows\system32\Bjiljf32.exe9⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2052 -
C:\Windows\SysWOW64\Cbkgog32.exeC:\Windows\system32\Cbkgog32.exe10⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1696 -
C:\Windows\SysWOW64\Ccnddg32.exeC:\Windows\system32\Ccnddg32.exe11⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2020 -
C:\Windows\SysWOW64\Clfhml32.exeC:\Windows\system32\Clfhml32.exe12⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2892 -
C:\Windows\SysWOW64\Coindgbi.exeC:\Windows\system32\Coindgbi.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2168
-
-
-
-
-
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
232KB
MD522271f902ca26716e31f852eb972fd80
SHA15328d71839a15d6e45954ac9b91c7b2b97aecd19
SHA256b6e913f324f0abc9689447e073b558afa5520772df5fb1c5ab9a7cc11f35c1c3
SHA512813edb51624d2111049c58b0ae21284fe33db07575cdbe86663e2dd50860d6695c76aca56a97593febfb80b254b1943b04ceb34d7cc0aa7dcc977deea8421668
-
Filesize
232KB
MD542631b2bccdd2eefbcdee1b7e5c514e1
SHA1b67e61c73540f4d9c74a57643ab93be990c9a417
SHA256d7915ff0d3e59715baa6be5943b857fb5ceb0bf7d5be4541d208a2dc526f1546
SHA5120b93308ea861fb66d1cc64f31fa7a821442292084a1f73c4849f5281f6ee098b11a6d5e1827da84207fcb5329dbdc0670e47ace21528be6f222521ae8a1ffdba
-
Filesize
232KB
MD555ce06f0bde67997b1b64cd1aac1a543
SHA12ffa5c08e30913ec4552dbd1fe43d8b8999bbf92
SHA256142c48406ee69fcc48e7ac122a94447f3621864ea194be26a037033ffb2255e8
SHA512a2d2e360bfb7db6ba1471a5eda60b7b8657a3ab40c8d88330541952efec0a7c7efa4bab9618aa7f9640c3d00dc5f176b9dd716eb57be15cb92098a9ac9249a18
-
Filesize
232KB
MD5df48448295a5245ab22b7f82050441bd
SHA1f74d32bc902a8be4dbbdc9e4ab0ab8c369e9d8f5
SHA25688efaba31a72382f49d9279ced04666226980eadfbd77f9aad62176f92a1e120
SHA5128414cefbbd18eaade1d2199de599d8bec5f6e88d6261b7e16af0e7bd9c5493fc7d431128e2f9a7ac03f93f57df07b598183cee4153bc1542e19262290543df62
-
Filesize
232KB
MD58c821324727bc59175cdacccb0194909
SHA1b62353d7c090453af8f07a01b9acb9d3fc9bd49e
SHA25657ea2b0b89a966f7e2ed047adfe6b6b1569e7e68f92bdcc10c7f6bc0e122dc5b
SHA512bc66dbcfb4f8883b65785bf34bec042271000e9831736c580c9258e866282c78b6f002cb4f3a9a32009342405ec4fa11f9e859789492c542fc321b02deb81b39
-
Filesize
232KB
MD5cf94fb6054c8e6def17cb8835a2fdd5b
SHA1b8d29834e683fc10826be96526c5300b7d184944
SHA256a12c2e1d83b905bfb54ca5033dbb89aa61a823a3ae4c1af1169c523ea1e8b721
SHA5127c30a89902d5f2113b22ad402d19256ae15940751527dc7ef16ad54a1f90fa62eaebe85150b82e17578072026bd9ff1a1416326064609d2209466dc974c16ccc
-
Filesize
232KB
MD5e373317355aa5a4eaf2b656844fcaf64
SHA1b33c2ff46ba92c00896636883e1272f459c14f5d
SHA25609a45908a4ec9d6194eb7aae74f496965396da3bb1ab0898527462db74370143
SHA512fa14599a2e8a6102b9c9b10b4fd455297ddcac5355dde9c9c590140ef0cd1b54b67ff51ee4903a61fcc86a4598ac33f7790b03603f008250ed9adf4ef4651ae3
-
Filesize
232KB
MD559021a28f5fb37aa1f9002dc714c6d26
SHA147f84f7ee2c3053eac650f8bb8efbc44c5584be7
SHA256932e577855e6e5758f13c1b90f1557c3af50a91eb3282dd9a01f95d0244381e4
SHA512c8046055013a667e8951a0bdd9b710bd4140acbc09d1a96992bca1d65e3f9294411f2b03f0f2a6771841a2054c7dd566ec7026199836352c71d73736b7b8fb65
-
Filesize
232KB
MD57e4b5074ab6f6972681de4806127c925
SHA10cea718428432523101625a27c70267d3d0425ff
SHA25673843273e43e09b8d0d8f75658c7d1e4548a3884164194c03101f80347c2f2ea
SHA512fa1de247f4a02fbbea2ffe58e416335bbc719950dc0bdc204674080dbabb05be9562c0e62452352a767f0c73d59589b5d31df8666aca1ce360b9ee8d5ef9698f
-
Filesize
232KB
MD54dd9e59cd490b2e2069f49c9e6b8255f
SHA1a51f18a1fd3a87aa666d9414eb99d5b4838cd86d
SHA2562f6bd49d945f8483fb0e0f67ce264406e5b9787da2221fba6feec9fe352383af
SHA51299c7b044834e4062158c391ff0acb6d1aec5cf2f2028db707ad829a13c2d2602b76e5bb795e154565baf8f90790a8efb2676479558e4d19a5b858372e81401f6
-
Filesize
232KB
MD5ad142126f73b061bb0085de06ef115c6
SHA17ef650d8ba513e5eecf6fadb67a31a2e290e6128
SHA256aafd85fb430b2c00a5fde9c97749bc34381ff09380410b956af08cb61a1cd5d8
SHA512b989580b01c7cf4f0376bc5b5365f6f00c412142651d754a2ed666926c3b41e4065ff956e3b4ba242e9a317f0bc74075be4a727eedecccdb6e6489d996839370
-
Filesize
232KB
MD57cb913506bd18e97fae22c4911aaa6a7
SHA12bf85b88ac1fc5c095a37c6be2b63b4f5a3d9587
SHA256ae5be8463d9a961085b357d0d3c24558ee09ea10314c8c727f9999f5e4f1a4aa
SHA512045fac77fdd20bd894d8e6ed101f256e0e2cad4d265b7a4770622385ddd76bcc9dae7a278bebbf9bbb461b5d87e857ab2c734ea678e684891d0a8ee9fba2afdb