Analysis
-
max time kernel
150s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
27-09-2024 20:35
Static task
static1
Behavioral task
behavioral1
Sample
3a19de3ea2110bc6765729cf00cafa4715b0127683cf7065d731f078ed1060f1.exe
Resource
win7-20240903-en
General
-
Target
3a19de3ea2110bc6765729cf00cafa4715b0127683cf7065d731f078ed1060f1.exe
-
Size
349KB
-
MD5
dee0aee65671e5b3f83cf6d59a7a2bd9
-
SHA1
906fdfec56d10a820c0a53e69ebc0528b3cf883c
-
SHA256
3a19de3ea2110bc6765729cf00cafa4715b0127683cf7065d731f078ed1060f1
-
SHA512
1e2d038f27f40b7359544bef2ded1d78d8d49a7e7ce876cec0891349f50243675b43cc97d7ce92aff9e4fff3b209bc0b874db74c092a879ed748d62eab039af1
-
SSDEEP
6144:FB1QKZaOpBjQepew/PjuGyFPr527Uf2u/jGw0qun597/QKjJ8zkjDpyAYpI0:FB1Q6rpr7MrswfLjGwW5xFdRyJp/
Malware Config
Extracted
nanocore
1.2.2.2
bemery2.no-ip.biz:57628
127.0.0.1:57628
997af15f-5576-4030-975c-eb3264fb6789
-
activate_away_mode
true
-
backup_connection_host
127.0.0.1
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2015-04-23T21:31:33.540664436Z
-
bypass_user_account_control
true
- bypass_user_account_control_data
-
clear_access_control
true
-
clear_zone_identifier
true
-
connect_delay
4000
-
connection_port
57628
-
default_group
grace
-
enable_debug_mode
true
-
gc_threshold
1.048576e+08
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+09
-
mutex
997af15f-5576-4030-975c-eb3264fb6789
-
mutex_timeout
5000
-
prevent_system_sleep
true
-
primary_connection_host
bemery2.no-ip.biz
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
false
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.2
-
wan_timeout
8000
Signatures
-
Sets file to hidden 1 TTPs 1 IoCs
Modifies file attributes to stop it showing in Explorer etc.
pid Process 2320 attrib.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation 3a19de3ea2110bc6765729cf00cafa4715b0127683cf7065d731f078ed1060f1.exe -
Adds Run key to start application 2 TTPs 17 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DPI Service = "C:\\Program Files (x86)\\DPI Service\\dpisv.exe" RegAsm.exe Set value (str) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Google Chrome = "C:\\Users\\Admin\\AppData\\Roaming\\subfolder\\chrome.exe.exe" REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Google Chrome = "C:\\Users\\Admin\\AppData\\Roaming\\subfolder\\chrome.exe.exe" REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Google Chrome = "C:\\Users\\Admin\\AppData\\Roaming\\subfolder\\chrome.exe.exe" REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Google Chrome = "C:\\Users\\Admin\\AppData\\Roaming\\subfolder\\chrome.exe.exe" REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Google Chrome = "C:\\Users\\Admin\\AppData\\Roaming\\subfolder\\chrome.exe.exe" REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Google Chrome = "C:\\Users\\Admin\\AppData\\Roaming\\subfolder\\chrome.exe.exe" REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Google Chrome = "C:\\Users\\Admin\\AppData\\Roaming\\subfolder\\chrome.exe.exe" REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Google Chrome = "C:\\Users\\Admin\\AppData\\Roaming\\subfolder\\chrome.exe.exe" REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Google Chrome = "C:\\Users\\Admin\\AppData\\Roaming\\subfolder\\chrome.exe.exe" REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Google Chrome = "C:\\Users\\Admin\\AppData\\Roaming\\subfolder\\chrome.exe.exe" REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Google Chrome = "C:\\Users\\Admin\\AppData\\Roaming\\subfolder\\chrome.exe.exe" REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Google Chrome = "C:\\Users\\Admin\\AppData\\Roaming\\subfolder\\chrome.exe.exe" REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Google Chrome = "C:\\Users\\Admin\\AppData\\Roaming\\subfolder\\chrome.exe.exe" REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Google Chrome = "C:\\Users\\Admin\\AppData\\Roaming\\subfolder\\chrome.exe.exe" REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Google Chrome = "C:\\Users\\Admin\\AppData\\Roaming\\subfolder\\chrome.exe.exe" REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Google Chrome = "C:\\Users\\Admin\\AppData\\Roaming\\subfolder\\chrome.exe.exe" REG.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA RegAsm.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 732 set thread context of 1704 732 3a19de3ea2110bc6765729cf00cafa4715b0127683cf7065d731f078ed1060f1.exe 111 -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\DPI Service\dpisv.exe RegAsm.exe File opened for modification C:\Program Files (x86)\DPI Service\dpisv.exe RegAsm.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 39 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3a19de3ea2110bc6765729cf00cafa4715b0127683cf7065d731f078ed1060f1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language attrib.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegAsm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 20 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 2876 ping.exe 2700 ping.exe 2392 ping.exe 2292 ping.exe 4328 ping.exe 4316 ping.exe 972 ping.exe 1968 ping.exe 2152 ping.exe 3964 ping.exe 436 ping.exe 2056 ping.exe 2008 ping.exe 2060 ping.exe 636 ping.exe 4828 ping.exe 4996 ping.exe 468 ping.exe 4492 ping.exe 4448 ping.exe -
Runs ping.exe 1 TTPs 20 IoCs
pid Process 2060 ping.exe 4828 ping.exe 2700 ping.exe 2292 ping.exe 2152 ping.exe 4328 ping.exe 4448 ping.exe 2876 ping.exe 972 ping.exe 2392 ping.exe 436 ping.exe 1968 ping.exe 636 ping.exe 4316 ping.exe 468 ping.exe 4492 ping.exe 2056 ping.exe 2008 ping.exe 3964 ping.exe 4996 ping.exe -
Suspicious behavior: EnumeratesProcesses 33 IoCs
pid Process 1704 RegAsm.exe 1704 RegAsm.exe 1704 RegAsm.exe 732 3a19de3ea2110bc6765729cf00cafa4715b0127683cf7065d731f078ed1060f1.exe 732 3a19de3ea2110bc6765729cf00cafa4715b0127683cf7065d731f078ed1060f1.exe 732 3a19de3ea2110bc6765729cf00cafa4715b0127683cf7065d731f078ed1060f1.exe 732 3a19de3ea2110bc6765729cf00cafa4715b0127683cf7065d731f078ed1060f1.exe 732 3a19de3ea2110bc6765729cf00cafa4715b0127683cf7065d731f078ed1060f1.exe 732 3a19de3ea2110bc6765729cf00cafa4715b0127683cf7065d731f078ed1060f1.exe 732 3a19de3ea2110bc6765729cf00cafa4715b0127683cf7065d731f078ed1060f1.exe 732 3a19de3ea2110bc6765729cf00cafa4715b0127683cf7065d731f078ed1060f1.exe 732 3a19de3ea2110bc6765729cf00cafa4715b0127683cf7065d731f078ed1060f1.exe 732 3a19de3ea2110bc6765729cf00cafa4715b0127683cf7065d731f078ed1060f1.exe 732 3a19de3ea2110bc6765729cf00cafa4715b0127683cf7065d731f078ed1060f1.exe 732 3a19de3ea2110bc6765729cf00cafa4715b0127683cf7065d731f078ed1060f1.exe 732 3a19de3ea2110bc6765729cf00cafa4715b0127683cf7065d731f078ed1060f1.exe 732 3a19de3ea2110bc6765729cf00cafa4715b0127683cf7065d731f078ed1060f1.exe 732 3a19de3ea2110bc6765729cf00cafa4715b0127683cf7065d731f078ed1060f1.exe 732 3a19de3ea2110bc6765729cf00cafa4715b0127683cf7065d731f078ed1060f1.exe 732 3a19de3ea2110bc6765729cf00cafa4715b0127683cf7065d731f078ed1060f1.exe 732 3a19de3ea2110bc6765729cf00cafa4715b0127683cf7065d731f078ed1060f1.exe 732 3a19de3ea2110bc6765729cf00cafa4715b0127683cf7065d731f078ed1060f1.exe 732 3a19de3ea2110bc6765729cf00cafa4715b0127683cf7065d731f078ed1060f1.exe 732 3a19de3ea2110bc6765729cf00cafa4715b0127683cf7065d731f078ed1060f1.exe 732 3a19de3ea2110bc6765729cf00cafa4715b0127683cf7065d731f078ed1060f1.exe 732 3a19de3ea2110bc6765729cf00cafa4715b0127683cf7065d731f078ed1060f1.exe 732 3a19de3ea2110bc6765729cf00cafa4715b0127683cf7065d731f078ed1060f1.exe 732 3a19de3ea2110bc6765729cf00cafa4715b0127683cf7065d731f078ed1060f1.exe 732 3a19de3ea2110bc6765729cf00cafa4715b0127683cf7065d731f078ed1060f1.exe 732 3a19de3ea2110bc6765729cf00cafa4715b0127683cf7065d731f078ed1060f1.exe 732 3a19de3ea2110bc6765729cf00cafa4715b0127683cf7065d731f078ed1060f1.exe 732 3a19de3ea2110bc6765729cf00cafa4715b0127683cf7065d731f078ed1060f1.exe 732 3a19de3ea2110bc6765729cf00cafa4715b0127683cf7065d731f078ed1060f1.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1704 RegAsm.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 732 3a19de3ea2110bc6765729cf00cafa4715b0127683cf7065d731f078ed1060f1.exe Token: SeDebugPrivilege 1704 RegAsm.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 732 wrote to memory of 4316 732 3a19de3ea2110bc6765729cf00cafa4715b0127683cf7065d731f078ed1060f1.exe 82 PID 732 wrote to memory of 4316 732 3a19de3ea2110bc6765729cf00cafa4715b0127683cf7065d731f078ed1060f1.exe 82 PID 732 wrote to memory of 4316 732 3a19de3ea2110bc6765729cf00cafa4715b0127683cf7065d731f078ed1060f1.exe 82 PID 732 wrote to memory of 4828 732 3a19de3ea2110bc6765729cf00cafa4715b0127683cf7065d731f078ed1060f1.exe 84 PID 732 wrote to memory of 4828 732 3a19de3ea2110bc6765729cf00cafa4715b0127683cf7065d731f078ed1060f1.exe 84 PID 732 wrote to memory of 4828 732 3a19de3ea2110bc6765729cf00cafa4715b0127683cf7065d731f078ed1060f1.exe 84 PID 732 wrote to memory of 2876 732 3a19de3ea2110bc6765729cf00cafa4715b0127683cf7065d731f078ed1060f1.exe 90 PID 732 wrote to memory of 2876 732 3a19de3ea2110bc6765729cf00cafa4715b0127683cf7065d731f078ed1060f1.exe 90 PID 732 wrote to memory of 2876 732 3a19de3ea2110bc6765729cf00cafa4715b0127683cf7065d731f078ed1060f1.exe 90 PID 732 wrote to memory of 4996 732 3a19de3ea2110bc6765729cf00cafa4715b0127683cf7065d731f078ed1060f1.exe 93 PID 732 wrote to memory of 4996 732 3a19de3ea2110bc6765729cf00cafa4715b0127683cf7065d731f078ed1060f1.exe 93 PID 732 wrote to memory of 4996 732 3a19de3ea2110bc6765729cf00cafa4715b0127683cf7065d731f078ed1060f1.exe 93 PID 732 wrote to memory of 2700 732 3a19de3ea2110bc6765729cf00cafa4715b0127683cf7065d731f078ed1060f1.exe 97 PID 732 wrote to memory of 2700 732 3a19de3ea2110bc6765729cf00cafa4715b0127683cf7065d731f078ed1060f1.exe 97 PID 732 wrote to memory of 2700 732 3a19de3ea2110bc6765729cf00cafa4715b0127683cf7065d731f078ed1060f1.exe 97 PID 732 wrote to memory of 972 732 3a19de3ea2110bc6765729cf00cafa4715b0127683cf7065d731f078ed1060f1.exe 99 PID 732 wrote to memory of 972 732 3a19de3ea2110bc6765729cf00cafa4715b0127683cf7065d731f078ed1060f1.exe 99 PID 732 wrote to memory of 972 732 3a19de3ea2110bc6765729cf00cafa4715b0127683cf7065d731f078ed1060f1.exe 99 PID 732 wrote to memory of 2392 732 3a19de3ea2110bc6765729cf00cafa4715b0127683cf7065d731f078ed1060f1.exe 101 PID 732 wrote to memory of 2392 732 3a19de3ea2110bc6765729cf00cafa4715b0127683cf7065d731f078ed1060f1.exe 101 PID 732 wrote to memory of 2392 732 3a19de3ea2110bc6765729cf00cafa4715b0127683cf7065d731f078ed1060f1.exe 101 PID 732 wrote to memory of 436 732 3a19de3ea2110bc6765729cf00cafa4715b0127683cf7065d731f078ed1060f1.exe 103 PID 732 wrote to memory of 436 732 3a19de3ea2110bc6765729cf00cafa4715b0127683cf7065d731f078ed1060f1.exe 103 PID 732 wrote to memory of 436 732 3a19de3ea2110bc6765729cf00cafa4715b0127683cf7065d731f078ed1060f1.exe 103 PID 732 wrote to memory of 1968 732 3a19de3ea2110bc6765729cf00cafa4715b0127683cf7065d731f078ed1060f1.exe 107 PID 732 wrote to memory of 1968 732 3a19de3ea2110bc6765729cf00cafa4715b0127683cf7065d731f078ed1060f1.exe 107 PID 732 wrote to memory of 1968 732 3a19de3ea2110bc6765729cf00cafa4715b0127683cf7065d731f078ed1060f1.exe 107 PID 732 wrote to memory of 468 732 3a19de3ea2110bc6765729cf00cafa4715b0127683cf7065d731f078ed1060f1.exe 109 PID 732 wrote to memory of 468 732 3a19de3ea2110bc6765729cf00cafa4715b0127683cf7065d731f078ed1060f1.exe 109 PID 732 wrote to memory of 468 732 3a19de3ea2110bc6765729cf00cafa4715b0127683cf7065d731f078ed1060f1.exe 109 PID 732 wrote to memory of 1704 732 3a19de3ea2110bc6765729cf00cafa4715b0127683cf7065d731f078ed1060f1.exe 111 PID 732 wrote to memory of 1704 732 3a19de3ea2110bc6765729cf00cafa4715b0127683cf7065d731f078ed1060f1.exe 111 PID 732 wrote to memory of 1704 732 3a19de3ea2110bc6765729cf00cafa4715b0127683cf7065d731f078ed1060f1.exe 111 PID 732 wrote to memory of 1704 732 3a19de3ea2110bc6765729cf00cafa4715b0127683cf7065d731f078ed1060f1.exe 111 PID 732 wrote to memory of 1704 732 3a19de3ea2110bc6765729cf00cafa4715b0127683cf7065d731f078ed1060f1.exe 111 PID 732 wrote to memory of 1704 732 3a19de3ea2110bc6765729cf00cafa4715b0127683cf7065d731f078ed1060f1.exe 111 PID 732 wrote to memory of 1704 732 3a19de3ea2110bc6765729cf00cafa4715b0127683cf7065d731f078ed1060f1.exe 111 PID 732 wrote to memory of 1704 732 3a19de3ea2110bc6765729cf00cafa4715b0127683cf7065d731f078ed1060f1.exe 111 PID 732 wrote to memory of 2320 732 3a19de3ea2110bc6765729cf00cafa4715b0127683cf7065d731f078ed1060f1.exe 112 PID 732 wrote to memory of 2320 732 3a19de3ea2110bc6765729cf00cafa4715b0127683cf7065d731f078ed1060f1.exe 112 PID 732 wrote to memory of 2320 732 3a19de3ea2110bc6765729cf00cafa4715b0127683cf7065d731f078ed1060f1.exe 112 PID 732 wrote to memory of 2292 732 3a19de3ea2110bc6765729cf00cafa4715b0127683cf7065d731f078ed1060f1.exe 114 PID 732 wrote to memory of 2292 732 3a19de3ea2110bc6765729cf00cafa4715b0127683cf7065d731f078ed1060f1.exe 114 PID 732 wrote to memory of 2292 732 3a19de3ea2110bc6765729cf00cafa4715b0127683cf7065d731f078ed1060f1.exe 114 PID 732 wrote to memory of 4492 732 3a19de3ea2110bc6765729cf00cafa4715b0127683cf7065d731f078ed1060f1.exe 116 PID 732 wrote to memory of 4492 732 3a19de3ea2110bc6765729cf00cafa4715b0127683cf7065d731f078ed1060f1.exe 116 PID 732 wrote to memory of 4492 732 3a19de3ea2110bc6765729cf00cafa4715b0127683cf7065d731f078ed1060f1.exe 116 PID 732 wrote to memory of 2152 732 3a19de3ea2110bc6765729cf00cafa4715b0127683cf7065d731f078ed1060f1.exe 118 PID 732 wrote to memory of 2152 732 3a19de3ea2110bc6765729cf00cafa4715b0127683cf7065d731f078ed1060f1.exe 118 PID 732 wrote to memory of 2152 732 3a19de3ea2110bc6765729cf00cafa4715b0127683cf7065d731f078ed1060f1.exe 118 PID 732 wrote to memory of 2056 732 3a19de3ea2110bc6765729cf00cafa4715b0127683cf7065d731f078ed1060f1.exe 120 PID 732 wrote to memory of 2056 732 3a19de3ea2110bc6765729cf00cafa4715b0127683cf7065d731f078ed1060f1.exe 120 PID 732 wrote to memory of 2056 732 3a19de3ea2110bc6765729cf00cafa4715b0127683cf7065d731f078ed1060f1.exe 120 PID 732 wrote to memory of 4328 732 3a19de3ea2110bc6765729cf00cafa4715b0127683cf7065d731f078ed1060f1.exe 122 PID 732 wrote to memory of 4328 732 3a19de3ea2110bc6765729cf00cafa4715b0127683cf7065d731f078ed1060f1.exe 122 PID 732 wrote to memory of 4328 732 3a19de3ea2110bc6765729cf00cafa4715b0127683cf7065d731f078ed1060f1.exe 122 PID 732 wrote to memory of 4448 732 3a19de3ea2110bc6765729cf00cafa4715b0127683cf7065d731f078ed1060f1.exe 124 PID 732 wrote to memory of 4448 732 3a19de3ea2110bc6765729cf00cafa4715b0127683cf7065d731f078ed1060f1.exe 124 PID 732 wrote to memory of 4448 732 3a19de3ea2110bc6765729cf00cafa4715b0127683cf7065d731f078ed1060f1.exe 124 PID 732 wrote to memory of 2008 732 3a19de3ea2110bc6765729cf00cafa4715b0127683cf7065d731f078ed1060f1.exe 126 PID 732 wrote to memory of 2008 732 3a19de3ea2110bc6765729cf00cafa4715b0127683cf7065d731f078ed1060f1.exe 126 PID 732 wrote to memory of 2008 732 3a19de3ea2110bc6765729cf00cafa4715b0127683cf7065d731f078ed1060f1.exe 126 PID 732 wrote to memory of 2060 732 3a19de3ea2110bc6765729cf00cafa4715b0127683cf7065d731f078ed1060f1.exe 128 PID 732 wrote to memory of 2060 732 3a19de3ea2110bc6765729cf00cafa4715b0127683cf7065d731f078ed1060f1.exe 128 -
Views/modifies file attributes 1 TTPs 1 IoCs
pid Process 2320 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3a19de3ea2110bc6765729cf00cafa4715b0127683cf7065d731f078ed1060f1.exe"C:\Users\Admin\AppData\Local\Temp\3a19de3ea2110bc6765729cf00cafa4715b0127683cf7065d731f078ed1060f1.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:732 -
C:\Windows\SysWOW64\ping.exeC:\Windows\System32\ping.exe google.com2⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:4316
-
-
C:\Windows\SysWOW64\ping.exeC:\Windows\System32\ping.exe google.com2⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:4828
-
-
C:\Windows\SysWOW64\ping.exeC:\Windows\System32\ping.exe google.com2⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:2876
-
-
C:\Windows\SysWOW64\ping.exeC:\Windows\System32\ping.exe google.com2⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:4996
-
-
C:\Windows\SysWOW64\ping.exeC:\Windows\System32\ping.exe google.com2⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:2700
-
-
C:\Windows\SysWOW64\ping.exeC:\Windows\System32\ping.exe google.com2⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:972
-
-
C:\Windows\SysWOW64\ping.exeC:\Windows\System32\ping.exe google.com2⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:2392
-
-
C:\Windows\SysWOW64\ping.exeC:\Windows\System32\ping.exe google.com2⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:436
-
-
C:\Windows\SysWOW64\ping.exeC:\Windows\System32\ping.exe google.com2⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:1968
-
-
C:\Windows\SysWOW64\ping.exeC:\Windows\System32\ping.exe google.com2⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:468
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"2⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:1704
-
-
C:\Windows\SysWOW64\attrib.exe"C:\Windows\System32\attrib.exe" +s +h C:\Users\Admin\AppData\Local\Temp\3a19de3ea2110bc6765729cf00cafa4715b0127683cf7065d731f078ed1060f1.exe2⤵
- Sets file to hidden
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
PID:2320
-
-
C:\Windows\SysWOW64\ping.exeC:\Windows\System32\ping.exe google.com2⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:2292
-
-
C:\Windows\SysWOW64\ping.exeC:\Windows\System32\ping.exe google.com2⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:4492
-
-
C:\Windows\SysWOW64\ping.exeC:\Windows\System32\ping.exe google.com2⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:2152
-
-
C:\Windows\SysWOW64\ping.exeC:\Windows\System32\ping.exe google.com2⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:2056
-
-
C:\Windows\SysWOW64\ping.exeC:\Windows\System32\ping.exe google.com2⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:4328
-
-
C:\Windows\SysWOW64\ping.exeC:\Windows\System32\ping.exe google.com2⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:4448
-
-
C:\Windows\SysWOW64\ping.exeC:\Windows\System32\ping.exe google.com2⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:2008
-
-
C:\Windows\SysWOW64\ping.exeC:\Windows\System32\ping.exe google.com2⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:2060
-
-
C:\Windows\SysWOW64\ping.exeC:\Windows\System32\ping.exe google.com2⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:3964
-
-
C:\Windows\SysWOW64\ping.exeC:\Windows\System32\ping.exe google.com2⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:636
-
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Google Chrome" /t REG_SZ /F /D "C:\Users\Admin\AppData\Roaming\subfolder\chrome.exe.exe2⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:2028
-
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Google Chrome" /t REG_SZ /F /D "C:\Users\Admin\AppData\Roaming\subfolder\chrome.exe.exe2⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:3464
-
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Google Chrome" /t REG_SZ /F /D "C:\Users\Admin\AppData\Roaming\subfolder\chrome.exe.exe2⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:3412
-
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Google Chrome" /t REG_SZ /F /D "C:\Users\Admin\AppData\Roaming\subfolder\chrome.exe.exe2⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:4000
-
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Google Chrome" /t REG_SZ /F /D "C:\Users\Admin\AppData\Roaming\subfolder\chrome.exe.exe2⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:4824
-
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Google Chrome" /t REG_SZ /F /D "C:\Users\Admin\AppData\Roaming\subfolder\chrome.exe.exe2⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:1060
-
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Google Chrome" /t REG_SZ /F /D "C:\Users\Admin\AppData\Roaming\subfolder\chrome.exe.exe2⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:3108
-
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Google Chrome" /t REG_SZ /F /D "C:\Users\Admin\AppData\Roaming\subfolder\chrome.exe.exe2⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:1464
-
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Google Chrome" /t REG_SZ /F /D "C:\Users\Admin\AppData\Roaming\subfolder\chrome.exe.exe2⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:4768
-
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Google Chrome" /t REG_SZ /F /D "C:\Users\Admin\AppData\Roaming\subfolder\chrome.exe.exe2⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:1224
-
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Google Chrome" /t REG_SZ /F /D "C:\Users\Admin\AppData\Roaming\subfolder\chrome.exe.exe2⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:3848
-
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Google Chrome" /t REG_SZ /F /D "C:\Users\Admin\AppData\Roaming\subfolder\chrome.exe.exe2⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:3252
-
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Google Chrome" /t REG_SZ /F /D "C:\Users\Admin\AppData\Roaming\subfolder\chrome.exe.exe2⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:612
-
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Google Chrome" /t REG_SZ /F /D "C:\Users\Admin\AppData\Roaming\subfolder\chrome.exe.exe2⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:212
-
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Google Chrome" /t REG_SZ /F /D "C:\Users\Admin\AppData\Roaming\subfolder\chrome.exe.exe2⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:1684
-
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Google Chrome" /t REG_SZ /F /D "C:\Users\Admin\AppData\Roaming\subfolder\chrome.exe.exe2⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:2676
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Modify Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
349KB
MD5433dbfb17d31fdae0ce83b27065b832f
SHA12d3ccdec17f47edb1f51c88ce6398d3c0f397e9a
SHA25674b66927dda64c1650799f4df9733d1bc7bdfe429c44e1e193fee4ae4b5c7c28
SHA512bb6cbaa6fb7394be939efaaf4bcf0f44f198c25ce0709c0e02d35681ad83cfe8d9f2c4fa41d7d9adec87dd52b45cba6e1414d77cae1707b5d2d45a78da3852b6