snakekeylogger | 28c5f7a70f7b7cbd238467322531d8f7bbca1731389dca610711ed17397ea924

Analysis

max time kernel
149s
max time network
135s
platform
windows10-1703_x64
resource
win10-20240404-ja
resource tags

arch:x64arch:x86image:win10-20240404-jalocale:ja-jpos:windows10-1703-x64systemwindows
submitted
16-10-2024 00:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

見積依頼.exe
Size

617KB
MD5

ab710965b2eab728f4fefc66995ca7e2
SHA1

d7279c173f5c08b7bc39916fdaf65f48af41e88e
SHA256

6e3fef37f80b4afe593fcacf78134e27d939866a7f3291bdafac411e2b31abef
SHA512

4330f7017dbec8530c014062e23e5feee606193e5ff7610d7ee8d89c222e7f4d23339444db94155df2183c8ab5a966dcd46e62bc43d2fb128243b12471e45b02
SSDEEP

12288:cLEiJY0wvx4+dSrQo4OnOjkEkGxnXrl8WTG4m:WPJjC4+dSsXOnOj46n9T

Score

10^/10

snakekeylogger collection discovery execution keylogger spyware stealer

Malware Config

Signatures

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger payload 1 IoCs

resource	yara_rule
behavioral1/memory/4876-31-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger

Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2244	powershell.exe
4576	powershell.exe
192	powershell.exe
2580	powershell.exe
3892	powershell.exe
5080	powershell.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Accesses Microsoft Outlook profiles 1 TTPs 9 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	見積依頼.exe
Key opened	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	見積依頼.exe
Key opened	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	見積依頼.exe
Key opened	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	見積依頼.exe
Key opened	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	見積依頼.exe
Key opened	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	見積依頼.exe
Key opened	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	見積依頼.exe
Key opened	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	見積依頼.exe
Key opened	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	見積依頼.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	checkip.dyndns.org

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\taskschd.msc	mmc.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 3232 set thread context of 4876	3232	見積依頼.exe	81
PID 2316 set thread context of 4804	2316	見積依頼.exe	96
PID 4248 set thread context of 4452	4248	見積依頼.exe	103

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 15 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	見積依頼.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	見積依頼.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	見積依頼.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	見積依頼.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	見積依頼.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	見積依頼.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4396	schtasks.exe
4712	schtasks.exe
4148	schtasks.exe

Suspicious behavior: EnumeratesProcesses 36 IoCs

pid	Process
3232	見積依頼.exe
192	powershell.exe
4576	powershell.exe
3232	見積依頼.exe
4576	powershell.exe
4876	見積依頼.exe
192	powershell.exe
4576	powershell.exe
192	powershell.exe
4876	見積依頼.exe
2316	見積依頼.exe
3892	powershell.exe
3892	powershell.exe
2580	powershell.exe
2580	powershell.exe
2316	見積依頼.exe
2316	見積依頼.exe
4804	見積依頼.exe
3892	powershell.exe
2580	powershell.exe
3892	powershell.exe
2580	powershell.exe
4248	見積依頼.exe
4804	見積依頼.exe
5080	powershell.exe
4248	見積依頼.exe
4248	見積依頼.exe
2244	powershell.exe
4452	見積依頼.exe
5080	powershell.exe
2244	powershell.exe
5080	powershell.exe
5080	powershell.exe
2244	powershell.exe
2244	powershell.exe
4452	見積依頼.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1872	mmc.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3232	見積依頼.exe
Token: SeDebugPrivilege	4576	powershell.exe
Token: SeDebugPrivilege	192	powershell.exe
Token: SeDebugPrivilege	4876	見積依頼.exe
Token: SeDebugPrivilege	2316	見積依頼.exe
Token: SeDebugPrivilege	3892	powershell.exe
Token: SeDebugPrivilege	2580	powershell.exe
Token: SeDebugPrivilege	4804	見積依頼.exe
Token: SeDebugPrivilege	4248	見積依頼.exe
Token: SeDebugPrivilege	5080	powershell.exe
Token: SeDebugPrivilege	2244	powershell.exe
Token: SeDebugPrivilege	4452	見積依頼.exe
Token: 33	1872	mmc.exe
Token: SeIncBasePriorityPrivilege	1872	mmc.exe
Token: 33	1872	mmc.exe
Token: SeIncBasePriorityPrivilege	1872	mmc.exe
Token: 33	1872	mmc.exe
Token: SeIncBasePriorityPrivilege	1872	mmc.exe
Token: 33	1872	mmc.exe
Token: SeIncBasePriorityPrivilege	1872	mmc.exe
Token: 33	1872	mmc.exe
Token: SeIncBasePriorityPrivilege	1872	mmc.exe
Token: 33	1872	mmc.exe
Token: SeIncBasePriorityPrivilege	1872	mmc.exe
Token: 33	1872	mmc.exe
Token: SeIncBasePriorityPrivilege	1872	mmc.exe
Token: 33	1872	mmc.exe
Token: SeIncBasePriorityPrivilege	1872	mmc.exe
Token: 33	1872	mmc.exe
Token: SeIncBasePriorityPrivilege	1872	mmc.exe
Token: 33	1872	mmc.exe
Token: SeIncBasePriorityPrivilege	1872	mmc.exe
Token: 33	1872	mmc.exe
Token: SeIncBasePriorityPrivilege	1872	mmc.exe
Token: 33	1872	mmc.exe
Token: SeIncBasePriorityPrivilege	1872	mmc.exe
Token: 33	1872	mmc.exe
Token: SeIncBasePriorityPrivilege	1872	mmc.exe
Token: 33	1872	mmc.exe
Token: SeIncBasePriorityPrivilege	1872	mmc.exe
Token: 33	1872	mmc.exe
Token: SeIncBasePriorityPrivilege	1872	mmc.exe
Token: 33	1872	mmc.exe
Token: SeIncBasePriorityPrivilege	1872	mmc.exe
Token: 33	1872	mmc.exe
Token: SeIncBasePriorityPrivilege	1872	mmc.exe
Token: 33	1872	mmc.exe
Token: SeIncBasePriorityPrivilege	1872	mmc.exe
Token: 33	1872	mmc.exe
Token: SeIncBasePriorityPrivilege	1872	mmc.exe
Token: 33	1872	mmc.exe
Token: SeIncBasePriorityPrivilege	1872	mmc.exe
Token: 33	1872	mmc.exe
Token: SeIncBasePriorityPrivilege	1872	mmc.exe
Token: 33	1872	mmc.exe
Token: SeIncBasePriorityPrivilege	1872	mmc.exe
Token: 33	1872	mmc.exe
Token: SeIncBasePriorityPrivilege	1872	mmc.exe
Token: 33	1872	mmc.exe
Token: SeIncBasePriorityPrivilege	1872	mmc.exe
Token: 33	1872	mmc.exe
Token: SeIncBasePriorityPrivilege	1872	mmc.exe
Token: 33	1872	mmc.exe
Token: SeIncBasePriorityPrivilege	1872	mmc.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1872	mmc.exe
1872	mmc.exe

Suspicious use of WriteProcessMemory 51 IoCs

description	pid	Process	procid_target
PID 3232 wrote to memory of 4576	3232	見積依頼.exe	75
PID 3232 wrote to memory of 4576	3232	見積依頼.exe	75
PID 3232 wrote to memory of 4576	3232	見積依頼.exe	75
PID 3232 wrote to memory of 192	3232	見積依頼.exe	77
PID 3232 wrote to memory of 192	3232	見積依頼.exe	77
PID 3232 wrote to memory of 192	3232	見積依頼.exe	77
PID 3232 wrote to memory of 4396	3232	見積依頼.exe	78
PID 3232 wrote to memory of 4396	3232	見積依頼.exe	78
PID 3232 wrote to memory of 4396	3232	見積依頼.exe	78
PID 3232 wrote to memory of 4876	3232	見積依頼.exe	81
PID 3232 wrote to memory of 4876	3232	見積依頼.exe	81
PID 3232 wrote to memory of 4876	3232	見積依頼.exe	81
PID 3232 wrote to memory of 4876	3232	見積依頼.exe	81
PID 3232 wrote to memory of 4876	3232	見積依頼.exe	81
PID 3232 wrote to memory of 4876	3232	見積依頼.exe	81
PID 3232 wrote to memory of 4876	3232	見積依頼.exe	81
PID 3232 wrote to memory of 4876	3232	見積依頼.exe	81
PID 2316 wrote to memory of 2580	2316	見積依頼.exe	90
PID 2316 wrote to memory of 2580	2316	見積依頼.exe	90
PID 2316 wrote to memory of 2580	2316	見積依頼.exe	90
PID 2316 wrote to memory of 3892	2316	見積依頼.exe	91
PID 2316 wrote to memory of 3892	2316	見積依頼.exe	91
PID 2316 wrote to memory of 3892	2316	見積依頼.exe	91
PID 2316 wrote to memory of 4712	2316	見積依頼.exe	94
PID 2316 wrote to memory of 4712	2316	見積依頼.exe	94
PID 2316 wrote to memory of 4712	2316	見積依頼.exe	94
PID 2316 wrote to memory of 4804	2316	見積依頼.exe	96
PID 2316 wrote to memory of 4804	2316	見積依頼.exe	96
PID 2316 wrote to memory of 4804	2316	見積依頼.exe	96
PID 2316 wrote to memory of 4804	2316	見積依頼.exe	96
PID 2316 wrote to memory of 4804	2316	見積依頼.exe	96
PID 2316 wrote to memory of 4804	2316	見積依頼.exe	96
PID 2316 wrote to memory of 4804	2316	見積依頼.exe	96
PID 2316 wrote to memory of 4804	2316	見積依頼.exe	96
PID 4248 wrote to memory of 5080	4248	見積依頼.exe	97
PID 4248 wrote to memory of 5080	4248	見積依頼.exe	97
PID 4248 wrote to memory of 5080	4248	見積依頼.exe	97
PID 4248 wrote to memory of 2244	4248	見積依頼.exe	98
PID 4248 wrote to memory of 2244	4248	見積依頼.exe	98
PID 4248 wrote to memory of 2244	4248	見積依頼.exe	98
PID 4248 wrote to memory of 4148	4248	見積依頼.exe	99
PID 4248 wrote to memory of 4148	4248	見積依頼.exe	99
PID 4248 wrote to memory of 4148	4248	見積依頼.exe	99
PID 4248 wrote to memory of 4452	4248	見積依頼.exe	103
PID 4248 wrote to memory of 4452	4248	見積依頼.exe	103
PID 4248 wrote to memory of 4452	4248	見積依頼.exe	103
PID 4248 wrote to memory of 4452	4248	見積依頼.exe	103
PID 4248 wrote to memory of 4452	4248	見積依頼.exe	103
PID 4248 wrote to memory of 4452	4248	見積依頼.exe	103
PID 4248 wrote to memory of 4452	4248	見積依頼.exe	103
PID 4248 wrote to memory of 4452	4248	見積依頼.exe	103

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	見積依頼.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	見積依頼.exe

C:\Users\Admin\AppData\Local\Temp\見積依頼.exe
"C:\Users\Admin\AppData\Local\Temp\見積依頼.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3232
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\見積依頼.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4576
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\TpQmYD.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:192
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\TpQmYD" /XML "C:\Users\Admin\AppData\Local\Temp\tmpBAE4.tmp"
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:4396
- C:\Users\Admin\AppData\Local\Temp\見積依頼.exe
  "C:\Users\Admin\AppData\Local\Temp\見積依頼.exe"
  2⤵
  - Accesses Microsoft Outlook profiles
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4876

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3148

C:\Windows\System32\IME\SHARED\imebroker.exe
C:\Windows\System32\IME\SHARED\imebroker.exe -Embedding
1⤵
PID:3492

C:\Users\Admin\AppData\Local\Temp\見積依頼.exe
"C:\Users\Admin\AppData\Local\Temp\見積依頼.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2316
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\見積依頼.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2580
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\TpQmYD.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3892
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\TpQmYD" /XML "C:\Users\Admin\AppData\Local\Temp\tmpC704.tmp"
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:4712
- C:\Users\Admin\AppData\Local\Temp\見積依頼.exe
  "C:\Users\Admin\AppData\Local\Temp\見積依頼.exe"
  2⤵
  - Accesses Microsoft Outlook profiles
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4804

C:\Users\Admin\AppData\Local\Temp\見積依頼.exe
"C:\Users\Admin\AppData\Local\Temp\見積依頼.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4248
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\見積依頼.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5080
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\TpQmYD.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2244
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\TpQmYD" /XML "C:\Users\Admin\AppData\Local\Temp\tmpDD5B.tmp"
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:4148
- C:\Users\Admin\AppData\Local\Temp\見積依頼.exe
  "C:\Users\Admin\AppData\Local\Temp\見積依頼.exe"
  2⤵
  - Accesses Microsoft Outlook profiles
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - outlook_office_path
  - outlook_win_path
  PID:4452

C:\Windows\system32\mmc.exe
"C:\Windows\system32\mmc.exe" "C:\Windows\System32\taskschd.msc"
1⤵
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1872

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
1c19c16e21c97ed42d5beabc93391fc5

SHA1
8ad83f8e0b3acf8dfbbf87931e41f0d664c4df68

SHA256
1bcd97396c83babfe6c5068ba590d7a3f8b70e72955a9d1e4070648e404cbf05

SHA512
7d18776d8f649b3d29c182ff03efc6cea8b527542ee55304980f24577aae8b64e37044407776e220984346c3998ace5f8853afa58c8b38407482a728e9495e0c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\見積依頼.exe.log

Filesize
1KB

MD5
0c2899d7c6746f42d5bbe088c777f94c

SHA1
622f66c5f7a3c91b28a9f43ce7c6cabadbf514f1

SHA256
5b0b99740cadaeff7b9891136644b396941547e20cc7eea646560d0dad5a5458

SHA512
ab7a3409ed4b6ca00358330a3aa4ef6de7d81eb21a5e24bb629ef6a7c7c4e2a70ca3accfbc989ed6e495fdb8eb6203a26d6f2a37b2a5809af4276af375b49078

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
75820be786f94d56d69c78a65397bec2

SHA1
018150e98208af3ac8188c25aa4176fd1661f3a6

SHA256
fc5d8c2d3735989f5529735bed061e565da2b7cb3dfd31ec6b1b79f8b7638a71

SHA512
0f7c9b473f3a0e84f1e3fb3b271a2e4dc7ee9187697e352cb363fc33a41a05aa42e8b7cd5e262ed5191b43c140571e424ac9f708f3552dcbe0f7839a5dec9f73

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
6562f8e861f3d925d2d96d5d728b33bf

SHA1
149ed444dd5d84cbef85b89e5cb0eaafcdfa1f7a

SHA256
6197f4829f606c96b010be830f21988ca453d7a5bf511d42258ec7b5d85e7540

SHA512
961d7c149001de9c0c0c86478b8c90708a2a8e61a298ef828d386d55683a60cc8b728d50efdc09118494a2f176f208aad3775b0581b46d8f8d7d790cea136ab9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
04561b176faa8523aa07fa4bb2969861

SHA1
4aecba39382a84d00c036ae622649650740d38e0

SHA256
c8acaeb6a1bf5aa29950b92a465f0cdf3ee983b32206255ec5ae4d84e312892f

SHA512
e1b90a44ead304e8a1db297444d3f7be580b87e347008ab52fc59f4621903098416e17541e19506685495ac4fdbcd60ede8082d8eacc9e5b73c3573191ab6cc4

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_pj1ewxlf.4yd.ps1

Filesize
1B

MD5
c4ca4238a0b923820dcc509a6f75849b

SHA1
356a192b7913b04c54574d18c28d46e6395428ab

SHA256
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

SHA512
4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpBAE4.tmp

Filesize
1KB

MD5
70237ab982a2fb4da5fd9315ead93b87

SHA1
da28835ac58379123c69ea9bc8f21b51fbf7ee99

SHA256
746c051d3826bb4421269fecdd3a946cfbb37e9a67b58df4a6b3cdfb5391d10a

SHA512
80471c6c75743c4838111f39294ef51546e3c26dff609b83ac790721348a047a5be1eccabbc0d5e3e68ea86fd174f5f0e461bd3714709b62d1c513ebb39aff91

Download Submit
memory/192-72-0x00000000098C0000-0x00000000098DE000-memory.dmp

Filesize
120KB

Download
memory/192-82-0x00000000099C0000-0x0000000009A65000-memory.dmp

Filesize
660KB

Download
memory/192-510-0x0000000073970000-0x000000007405E000-memory.dmp

Filesize
6.9MB

Download
memory/192-468-0x0000000009BA0000-0x0000000009BBA000-memory.dmp

Filesize
104KB

Download
memory/192-70-0x00000000098E0000-0x0000000009913000-memory.dmp

Filesize
204KB

Download
memory/192-71-0x00000000708F0000-0x000000007093B000-memory.dmp

Filesize
300KB

Download
memory/192-36-0x0000000008570000-0x00000000085BB000-memory.dmp

Filesize
300KB

Download
memory/192-22-0x00000000075D0000-0x0000000007BF8000-memory.dmp

Filesize
6.2MB

Download
memory/192-35-0x0000000007F60000-0x0000000007F7C000-memory.dmp

Filesize
112KB

Download
memory/192-24-0x0000000073970000-0x000000007405E000-memory.dmp

Filesize
6.9MB

Download
memory/192-33-0x0000000008000000-0x0000000008350000-memory.dmp

Filesize
3.3MB

Download
memory/192-28-0x0000000007CB0000-0x0000000007D16000-memory.dmp

Filesize
408KB

Download
memory/192-30-0x0000000007380000-0x0000000007390000-memory.dmp

Filesize
64KB

Download
memory/192-29-0x0000000007EF0000-0x0000000007F56000-memory.dmp

Filesize
408KB

Download
memory/1872-1512-0x000000001E2B0000-0x000000001E2D2000-memory.dmp

Filesize
136KB

Download
memory/1872-1507-0x000000001E4B0000-0x000000001E656000-memory.dmp

Filesize
1.6MB

Download
memory/1872-1493-0x000000001CDB0000-0x000000001CDBE000-memory.dmp

Filesize
56KB

Download
memory/1872-1478-0x000000001DE70000-0x000000001DF7E000-memory.dmp

Filesize
1.1MB

Download
memory/2244-1036-0x00000000703A0000-0x00000000703EB000-memory.dmp

Filesize
300KB

Download
memory/2580-562-0x0000000070060000-0x00000000700AB000-memory.dmp

Filesize
300KB

Download
memory/3232-2-0x0000000004F10000-0x000000000540E000-memory.dmp

Filesize
5.0MB

Download
memory/3232-9-0x0000000073970000-0x000000007405E000-memory.dmp

Filesize
6.9MB

Download
memory/3232-6-0x0000000004BB0000-0x0000000004C4C000-memory.dmp

Filesize
624KB

Download
memory/3232-1-0x0000000000040000-0x00000000000E0000-memory.dmp

Filesize
640KB

Download
memory/3232-0-0x000000007397E000-0x000000007397F000-memory.dmp

Filesize
4KB

Download
memory/3232-34-0x0000000073970000-0x000000007405E000-memory.dmp

Filesize
6.9MB

Download
memory/3232-11-0x0000000009EC0000-0x0000000009FCE000-memory.dmp

Filesize
1.1MB

Download
memory/3232-8-0x000000007397E000-0x000000007397F000-memory.dmp

Filesize
4KB

Download
memory/3232-7-0x00000000060D0000-0x00000000060EA000-memory.dmp

Filesize
104KB

Download
memory/3232-3-0x0000000004900000-0x0000000004992000-memory.dmp

Filesize
584KB

Download
memory/3232-10-0x0000000007270000-0x00000000072D8000-memory.dmp

Filesize
416KB

Download
memory/3232-4-0x00000000049C0000-0x00000000049CA000-memory.dmp

Filesize
40KB

Download
memory/3232-5-0x0000000073970000-0x000000007405E000-memory.dmp

Filesize
6.9MB

Download
memory/3892-559-0x0000000009840000-0x00000000098E5000-memory.dmp

Filesize
660KB

Download
memory/3892-523-0x0000000008840000-0x000000000888B000-memory.dmp

Filesize
300KB

Download
memory/3892-520-0x0000000007B80000-0x0000000007ED0000-memory.dmp

Filesize
3.3MB

Download
memory/3892-552-0x0000000070060000-0x00000000700AB000-memory.dmp

Filesize
300KB

Download
memory/4576-37-0x00000000087B0000-0x0000000008826000-memory.dmp

Filesize
472KB

Download
memory/4576-84-0x0000000009B90000-0x0000000009C24000-memory.dmp

Filesize
592KB

Download
memory/4576-509-0x0000000073970000-0x000000007405E000-memory.dmp

Filesize
6.9MB

Download
memory/4576-27-0x0000000007BD0000-0x0000000007BF2000-memory.dmp

Filesize
136KB

Download
memory/4576-477-0x0000000009A90000-0x0000000009A98000-memory.dmp

Filesize
32KB

Download
memory/4576-23-0x0000000073970000-0x000000007405E000-memory.dmp

Filesize
6.9MB

Download
memory/4576-21-0x0000000073970000-0x000000007405E000-memory.dmp

Filesize
6.9MB

Download
memory/4576-83-0x0000000009AA0000-0x0000000009AF0000-memory.dmp

Filesize
320KB

Download
memory/4576-25-0x00000000072F0000-0x0000000007382000-memory.dmp

Filesize
584KB

Download
memory/4576-18-0x0000000004A60000-0x0000000004A96000-memory.dmp

Filesize
216KB

Download
memory/4576-73-0x00000000708F0000-0x000000007093B000-memory.dmp

Filesize
300KB

Download
memory/4876-512-0x00000000065B0000-0x0000000006772000-memory.dmp

Filesize
1.8MB

Download
memory/4876-511-0x0000000005450000-0x0000000005464000-memory.dmp

Filesize
80KB

Download
memory/4876-31-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/5080-1033-0x00000000092F0000-0x0000000009395000-memory.dmp

Filesize
660KB

Download
memory/5080-1026-0x00000000703A0000-0x00000000703EB000-memory.dmp

Filesize
300KB

Download
memory/5080-997-0x0000000007E10000-0x0000000007E5B000-memory.dmp

Filesize
300KB

Download
memory/5080-995-0x0000000007830000-0x0000000007B80000-memory.dmp

Filesize
3.3MB

Download