Analysis
-
max time kernel
40s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
29-10-2024 03:19
Static task
static1
Behavioral task
behavioral1
Sample
7ba00a7f8bf0f2d0237bd01bb12a825b_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
7ba00a7f8bf0f2d0237bd01bb12a825b_JaffaCakes118.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
setup_installer.exe
Resource
win7-20241010-en
General
-
Target
setup_installer.exe
-
Size
3.3MB
-
MD5
8765c39cc6647adc171220b11942422b
-
SHA1
5a45fd626dcf26b1f933e5a18db138fe1df64444
-
SHA256
f52e34603c58c806081a09fc4ba38eabe1e3f12b7a57a75353ecf593177fa7ef
-
SHA512
8c5bf35e5d6dc7aab1bff4836ef00e44d7e158d4b8d3f9bcf9ebb39a02b21078c5879f061ac926aa52b9a0f9a83752f322db1d98c1a2908a9ec5eed60919fa65
-
SSDEEP
98304:xpeKfE9KlGB9z8qTsF5iOew3qrCvLUBsKxp:x8/9HHoGDQLUCKxp
Malware Config
Extracted
nullmixer
http://znegs.xyz/
Signatures
-
Nullmixer family
-
Vidar family
-
Vidar Stealer 2 IoCs
Processes:
resource yara_rule behavioral3/memory/2756-304-0x0000000000400000-0x0000000002CC2000-memory.dmp family_vidar behavioral3/memory/2756-324-0x0000000000400000-0x0000000002CC2000-memory.dmp family_vidar -
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\7zS4B95B6B6\setup_install.exe aspack_v212_v242 \Users\Admin\AppData\Local\Temp\7zS4B95B6B6\libcurlpp.dll aspack_v212_v242 C:\Users\Admin\AppData\Local\Temp\7zS4B95B6B6\libcurl.dll aspack_v212_v242 C:\Users\Admin\AppData\Local\Temp\7zS4B95B6B6\libstdc++-6.dll aspack_v212_v242 -
Executes dropped EXE 17 IoCs
Processes:
setup_install.exezaiqa_1.exezaiqa_2.exezaiqa_1.exezaiqa_8.exezaiqa_4.exezaiqa_6.exezaiqa_5.exezaiqa_3.exezaiqa_9.exezaiqa_7.exezaiqa_9.exezaiqa_5.exechrome2.exesetup.exewinnetdriv.exeservices64.exepid process 2448 setup_install.exe 2788 zaiqa_1.exe 2716 zaiqa_2.exe 672 zaiqa_1.exe 3052 zaiqa_8.exe 2548 zaiqa_4.exe 3012 zaiqa_6.exe 2920 zaiqa_5.exe 2756 zaiqa_3.exe 1584 zaiqa_9.exe 1084 zaiqa_7.exe 1988 zaiqa_9.exe 2964 zaiqa_5.exe 1484 chrome2.exe 892 setup.exe 1512 winnetdriv.exe 2648 services64.exe -
Loads dropped DLL 42 IoCs
Processes:
setup_installer.exesetup_install.execmd.execmd.exezaiqa_1.exezaiqa_2.exezaiqa_1.execmd.execmd.execmd.exezaiqa_4.execmd.exezaiqa_3.execmd.exezaiqa_7.exesetup.exeWerFault.exechrome2.exepid process 2484 setup_installer.exe 2484 setup_installer.exe 2484 setup_installer.exe 2448 setup_install.exe 2448 setup_install.exe 2448 setup_install.exe 2448 setup_install.exe 2448 setup_install.exe 2448 setup_install.exe 2448 setup_install.exe 2448 setup_install.exe 2688 cmd.exe 2688 cmd.exe 2680 cmd.exe 2680 cmd.exe 2788 zaiqa_1.exe 2788 zaiqa_1.exe 2716 zaiqa_2.exe 2716 zaiqa_2.exe 2788 zaiqa_1.exe 672 zaiqa_1.exe 672 zaiqa_1.exe 3064 cmd.exe 2532 cmd.exe 2504 cmd.exe 2548 zaiqa_4.exe 2548 zaiqa_4.exe 2512 cmd.exe 2512 cmd.exe 2756 zaiqa_3.exe 2756 zaiqa_3.exe 2916 cmd.exe 1084 zaiqa_7.exe 1084 zaiqa_7.exe 2548 zaiqa_4.exe 2548 zaiqa_4.exe 892 setup.exe 1972 WerFault.exe 1972 WerFault.exe 1972 WerFault.exe 1972 WerFault.exe 1484 chrome2.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs
Processes:
flow ioc 35 iplogger.org 36 iplogger.org 37 iplogger.org 50 raw.githubusercontent.com 51 raw.githubusercontent.com -
Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 10 api.db-ip.com 11 api.db-ip.com 5 ipinfo.io 6 ipinfo.io -
Drops file in Windows directory 2 IoCs
Processes:
setup.exedescription ioc process File created C:\Windows\winnetdriv.exe setup.exe File opened for modification C:\Windows\winnetdriv.exe setup.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1972 2448 WerFault.exe setup_install.exe -
System Location Discovery: System Language Discovery 1 TTPs 19 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
setup_install.execmd.execmd.execmd.exezaiqa_3.exesetup_installer.execmd.exezaiqa_1.execmd.exezaiqa_4.exewinnetdriv.exezaiqa_1.exezaiqa_2.execmd.exezaiqa_7.exesetup.execmd.execmd.execmd.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language setup_install.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language zaiqa_3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language setup_installer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language zaiqa_1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language zaiqa_4.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language winnetdriv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language zaiqa_1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language zaiqa_2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language zaiqa_7.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language setup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
zaiqa_3.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString zaiqa_3.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 zaiqa_3.exe -
Processes:
zaiqa_3.exedescription ioc process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e zaiqa_3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 zaiqa_3.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e zaiqa_3.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 2396 schtasks.exe 1036 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
zaiqa_3.exechrome2.exepid process 2756 zaiqa_3.exe 2756 zaiqa_3.exe 2756 zaiqa_3.exe 2756 zaiqa_3.exe 1484 chrome2.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
zaiqa_6.exezaiqa_8.exechrome2.exedescription pid process Token: SeDebugPrivilege 3012 zaiqa_6.exe Token: SeDebugPrivilege 3052 zaiqa_8.exe Token: SeDebugPrivilege 1484 chrome2.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
setup_installer.exesetup_install.execmd.execmd.exezaiqa_1.exedescription pid process target process PID 2484 wrote to memory of 2448 2484 setup_installer.exe setup_install.exe PID 2484 wrote to memory of 2448 2484 setup_installer.exe setup_install.exe PID 2484 wrote to memory of 2448 2484 setup_installer.exe setup_install.exe PID 2484 wrote to memory of 2448 2484 setup_installer.exe setup_install.exe PID 2484 wrote to memory of 2448 2484 setup_installer.exe setup_install.exe PID 2484 wrote to memory of 2448 2484 setup_installer.exe setup_install.exe PID 2484 wrote to memory of 2448 2484 setup_installer.exe setup_install.exe PID 2448 wrote to memory of 2680 2448 setup_install.exe cmd.exe PID 2448 wrote to memory of 2680 2448 setup_install.exe cmd.exe PID 2448 wrote to memory of 2680 2448 setup_install.exe cmd.exe PID 2448 wrote to memory of 2680 2448 setup_install.exe cmd.exe PID 2448 wrote to memory of 2680 2448 setup_install.exe cmd.exe PID 2448 wrote to memory of 2680 2448 setup_install.exe cmd.exe PID 2448 wrote to memory of 2680 2448 setup_install.exe cmd.exe PID 2448 wrote to memory of 2688 2448 setup_install.exe cmd.exe PID 2448 wrote to memory of 2688 2448 setup_install.exe cmd.exe PID 2448 wrote to memory of 2688 2448 setup_install.exe cmd.exe PID 2448 wrote to memory of 2688 2448 setup_install.exe cmd.exe PID 2448 wrote to memory of 2688 2448 setup_install.exe cmd.exe PID 2448 wrote to memory of 2688 2448 setup_install.exe cmd.exe PID 2448 wrote to memory of 2688 2448 setup_install.exe cmd.exe PID 2688 wrote to memory of 2716 2688 cmd.exe zaiqa_2.exe PID 2688 wrote to memory of 2716 2688 cmd.exe zaiqa_2.exe PID 2688 wrote to memory of 2716 2688 cmd.exe zaiqa_2.exe PID 2688 wrote to memory of 2716 2688 cmd.exe zaiqa_2.exe PID 2688 wrote to memory of 2716 2688 cmd.exe zaiqa_2.exe PID 2688 wrote to memory of 2716 2688 cmd.exe zaiqa_2.exe PID 2688 wrote to memory of 2716 2688 cmd.exe zaiqa_2.exe PID 2680 wrote to memory of 2788 2680 cmd.exe zaiqa_1.exe PID 2680 wrote to memory of 2788 2680 cmd.exe zaiqa_1.exe PID 2680 wrote to memory of 2788 2680 cmd.exe zaiqa_1.exe PID 2680 wrote to memory of 2788 2680 cmd.exe zaiqa_1.exe PID 2680 wrote to memory of 2788 2680 cmd.exe zaiqa_1.exe PID 2680 wrote to memory of 2788 2680 cmd.exe zaiqa_1.exe PID 2680 wrote to memory of 2788 2680 cmd.exe zaiqa_1.exe PID 2788 wrote to memory of 672 2788 zaiqa_1.exe zaiqa_1.exe PID 2788 wrote to memory of 672 2788 zaiqa_1.exe zaiqa_1.exe PID 2788 wrote to memory of 672 2788 zaiqa_1.exe zaiqa_1.exe PID 2788 wrote to memory of 672 2788 zaiqa_1.exe zaiqa_1.exe PID 2788 wrote to memory of 672 2788 zaiqa_1.exe zaiqa_1.exe PID 2788 wrote to memory of 672 2788 zaiqa_1.exe zaiqa_1.exe PID 2788 wrote to memory of 672 2788 zaiqa_1.exe zaiqa_1.exe PID 2448 wrote to memory of 2512 2448 setup_install.exe cmd.exe PID 2448 wrote to memory of 2512 2448 setup_install.exe cmd.exe PID 2448 wrote to memory of 2512 2448 setup_install.exe cmd.exe PID 2448 wrote to memory of 2512 2448 setup_install.exe cmd.exe PID 2448 wrote to memory of 2512 2448 setup_install.exe cmd.exe PID 2448 wrote to memory of 2512 2448 setup_install.exe cmd.exe PID 2448 wrote to memory of 2512 2448 setup_install.exe cmd.exe PID 2448 wrote to memory of 2504 2448 setup_install.exe cmd.exe PID 2448 wrote to memory of 2504 2448 setup_install.exe cmd.exe PID 2448 wrote to memory of 2504 2448 setup_install.exe cmd.exe PID 2448 wrote to memory of 2504 2448 setup_install.exe cmd.exe PID 2448 wrote to memory of 2504 2448 setup_install.exe cmd.exe PID 2448 wrote to memory of 2504 2448 setup_install.exe cmd.exe PID 2448 wrote to memory of 2504 2448 setup_install.exe cmd.exe PID 2448 wrote to memory of 2852 2448 setup_install.exe cmd.exe PID 2448 wrote to memory of 2852 2448 setup_install.exe cmd.exe PID 2448 wrote to memory of 2852 2448 setup_install.exe cmd.exe PID 2448 wrote to memory of 2852 2448 setup_install.exe cmd.exe PID 2448 wrote to memory of 2852 2448 setup_install.exe cmd.exe PID 2448 wrote to memory of 2852 2448 setup_install.exe cmd.exe PID 2448 wrote to memory of 2852 2448 setup_install.exe cmd.exe PID 2448 wrote to memory of 2532 2448 setup_install.exe cmd.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2484 -
C:\Users\Admin\AppData\Local\Temp\7zS4B95B6B6\setup_install.exe"C:\Users\Admin\AppData\Local\Temp\7zS4B95B6B6\setup_install.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2448 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c zaiqa_1.exe3⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2680 -
C:\Users\Admin\AppData\Local\Temp\7zS4B95B6B6\zaiqa_1.exezaiqa_1.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2788 -
C:\Users\Admin\AppData\Local\Temp\7zS4B95B6B6\zaiqa_1.exe"C:\Users\Admin\AppData\Local\Temp\7zS4B95B6B6\zaiqa_1.exe" -a5⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:672 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c zaiqa_2.exe3⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2688 -
C:\Users\Admin\AppData\Local\Temp\7zS4B95B6B6\zaiqa_2.exezaiqa_2.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2716 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c zaiqa_3.exe3⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2512 -
C:\Users\Admin\AppData\Local\Temp\7zS4B95B6B6\zaiqa_3.exezaiqa_3.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
PID:2756 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c zaiqa_4.exe3⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2504 -
C:\Users\Admin\AppData\Local\Temp\7zS4B95B6B6\zaiqa_4.exezaiqa_4.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2548 -
C:\Users\Admin\AppData\Local\Temp\chrome2.exe"C:\Users\Admin\AppData\Local\Temp\chrome2.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1484 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit6⤵PID:1844
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'7⤵
- Scheduled Task/Job: Scheduled Task
PID:2396 -
C:\Users\Admin\AppData\Roaming\services64.exe"C:\Users\Admin\AppData\Roaming\services64.exe"6⤵
- Executes dropped EXE
PID:2648 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit7⤵PID:1688
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'8⤵
- Scheduled Task/Job: Scheduled Task
PID:1036 -
C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"7⤵PID:2480
-
C:\Users\Admin\AppData\Local\Temp\setup.exe"C:\Users\Admin\AppData\Local\Temp\setup.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:892 -
C:\Windows\winnetdriv.exe"C:\Users\Admin\AppData\Local\Temp\setup.exe" 1730171959 06⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1512 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c zaiqa_5.exe3⤵
- System Location Discovery: System Language Discovery
PID:2852 -
C:\Users\Admin\AppData\Local\Temp\7zS4B95B6B6\zaiqa_5.exezaiqa_5.exe4⤵
- Executes dropped EXE
PID:2920 -
C:\Users\Admin\AppData\Local\Temp\7zS4B95B6B6\zaiqa_5.exe"C:\Users\Admin\AppData\Local\Temp\7zS4B95B6B6\zaiqa_5.exe"4⤵
- Executes dropped EXE
PID:2964 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c zaiqa_6.exe3⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2532 -
C:\Users\Admin\AppData\Local\Temp\7zS4B95B6B6\zaiqa_6.exezaiqa_6.exe4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3012 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c zaiqa_7.exe3⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2916 -
C:\Users\Admin\AppData\Local\Temp\7zS4B95B6B6\zaiqa_7.exezaiqa_7.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1084 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c zaiqa_8.exe3⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3064 -
C:\Users\Admin\AppData\Local\Temp\7zS4B95B6B6\zaiqa_8.exezaiqa_8.exe4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3052 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c zaiqa_9.exe3⤵
- System Location Discovery: System Language Discovery
PID:3056 -
C:\Users\Admin\AppData\Local\Temp\7zS4B95B6B6\zaiqa_9.exezaiqa_9.exe4⤵
- Executes dropped EXE
PID:1584 -
C:\Users\Admin\AppData\Local\Temp\7zS4B95B6B6\zaiqa_9.exe"C:\Users\Admin\AppData\Local\Temp\7zS4B95B6B6\zaiqa_9.exe"4⤵
- Executes dropped EXE
PID:1988 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2448 -s 4243⤵
- Loads dropped DLL
- Program crash
PID:1972
Network
MITRE ATT&CK Enterprise v15
Defense Evasion
Modify Registry
1Subvert Trust Controls
1Install Root Certificate
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
2Credentials In Files
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
275B
MD5a378c450e6ad9f1e0356ed46da190990
SHA1d457a2c162391d2ea30ec2dc62c8fb3b973f6a66
SHA256b745b0c0db87a89de5e542e9ae0a06f585793ac3f4240bff3524e7dbdba79978
SHA512e6cdc8f570af97e48b1d8968730db0afc46f9dd6ad7366a936a5518801debb61c86cc61526e5e26e7ad3b3daeb76a19b32d7c0da33140597f6d19163683c12b5
-
Filesize
218KB
MD5d09be1f47fd6b827c81a4812b4f7296f
SHA1028ae3596c0790e6d7f9f2f3c8e9591527d267f7
SHA2560de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e
SHA512857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595
-
Filesize
113KB
MD59aec524b616618b0d3d00b27b6f51da1
SHA164264300801a353db324d11738ffed876550e1d3
SHA25659a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e
SHA5120648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0
-
Filesize
647KB
MD55e279950775baae5fea04d2cc4526bcc
SHA18aef1e10031c3629512c43dd8b0b5d9060878453
SHA25697de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87
SHA512666325e9ed71da4955058aea31b91e2e848be43211e511865f393b7f537c208c6b31c182f7d728c2704e9fc87e7d1be3f98f5fee4d34f11c56764e1c599afd02
-
Filesize
69KB
MD51e0d62c34ff2e649ebc5c372065732ee
SHA1fcfaa36ba456159b26140a43e80fbd7e9d9af2de
SHA256509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723
SHA5123653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61
-
Filesize
56KB
MD53263859df4866bf393d46f06f331a08f
SHA15b4665de13c9727a502f4d11afb800b075929d6c
SHA2569dcacda3913e30cafd92c909648b5bffde14b8e39e6adbfb15628006c0d4d3c2
SHA51258205110a017f5d73dd131fefb1e3bbbcc670ed0c645aeefebe5281579c7b1dceffa56671cd7b186554bdb81710e21018ed0d7088a27517dfc5e48d6d3578cf6
-
Filesize
923KB
MD513a289feeb15827860a55bbc5e5d498f
SHA1e1f0a544fcc5b3bc0ab6a788343185ad1ad077ad
SHA256c5483b2acbb352dc5c9a811d9616c4519f0e07c13905552be5ec869613ada775
SHA51200c225fb1d88920c5df7bb853d32213a91254fb8c57169c58c8b0ffab4501486e24d87e3d8f5665b16e366362cb81deec535d833ed42434fdc31f0400ee7ffa7
-
Filesize
900KB
MD58cad9c4c58553ec0ca5fd50aec791b8a
SHA1a2a4385cb2df58455764eb879b5d6aaf5e3585ac
SHA256f092024f873461b61234b97fcb07c8589dcc9a801cf8a0a6e302dbd746bab294
SHA5121eeac808dd992a7b99448d8a1c5470a2964b14705b4e987d9cb2e227a8142122faa17bf8a9acba6db4e80a42b50b58536e748a3231736b9b705d630f941159a3
-
Filesize
186KB
MD528e40b1adae683f70b178d025ea7bf64
SHA124851934bbb9a67c6d07e48503e6296c91fff502
SHA2561cde227af526781ff9553ffef5d3eb52bc5e78240150d8bddd20644f4bf80af5
SHA512f02b499b6e10411affba70caf96694f6297f6b754c00b6a179421f5aa21a21bb8f8863d87fea358a280979dfede22a06188abc695e5be4ed578bb60d73aada57
-
Filesize
1.7MB
MD5fdaa4ceadfc95047aa93dbd903669f25
SHA197549c52142d192383e8f2018141901a1a0ec112
SHA25622af1522526444b485228e2021f039523e03003bd1ab68b6da275b69c96b018b
SHA512598e77c39f5e443228a7f1926540ad3ffa6eaf8bb9b7f10be9e24fd49f96446511166f0750deebe708a7dbb2d8bb98adcdd330132a24fd932f75068f6524c696
-
Filesize
8KB
MD5c85639691074f9d98ec530901c153d2b
SHA1cac948e5b1f9d7417e7c5ead543fda1108f0e9ed
SHA25655701c6e51fb6a9820d8f9d2ae9db412b60f51c80d288e8baf0ea50e2d03cce4
SHA5124911ce27e56bac29b247840e6c9de78e875210fd0588d11d9e3a3eae39764bfdd14b56de5de4cf535674a2ba0810c9d823f42b339f650dedb7af42f8b3fd4c6d
-
Filesize
900KB
MD55c2e28dedae0e088fc1f9b50d7d28c12
SHA1f521d9d8ae7381e3953ae5cf33b4b1b37f67a193
SHA2562261a3d740572f9d0ee42faad5b0d405df16506e104bd912e7c7b24d7fddcc5f
SHA512f6f100508acb77af5b3442673c9d01a6a16cc39521b618eebccd482bf9f50b3991109f82b97e48e8c3cc0221f0be9e164867ba79ac2f2bc4e25cbdb5f7daa15f
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
43KB
MD5ad0aca1934f02768fd5fedaf4d9762a3
SHA10e5b8372015d81200c4eff22823e854d0030f305
SHA256dc10f50f9761f6fbafe665e75a331b2048a285b1857ad95e0611ace825cba388
SHA5122fba342010ba85440784190245f74ea9e7c70974df12c241ccb6b72a6e1006a72bd1fa2e657f434d7479758f9508edb315398f6e95d167a78b788cea732be3b7
-
Filesize
869KB
MD501ad10e59fa396af2d5443c5a14c1b21
SHA1f209a4f0bb2a96e3ee6a55689e7f00e79c04f722
SHA256bef1cffaba8186ce62265e0b322ca9fd9326a8929591df569a4953456c752137
SHA5121e067ade999ff933a644fde66c6ab9abb8a960ce1c8064368adcde4c09d924bd22d1b43c68b7c968e982fc75937969a2876e9e2a024f72e693f9ba397d449e02
-
Filesize
54KB
MD5e6e578373c2e416289a8da55f1dc5e8e
SHA1b601a229b66ec3d19c2369b36216c6f6eb1c063e
SHA25643e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f
SHA5129df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89
-
Filesize
287KB
MD5a52a590e1f8f93cd1d4108293415975c
SHA149db2a15b6f32c6189f24a8ae6e4bb33d0485f05
SHA25612d2f007dcc8cb316493fe0f61fd330fdec70f872ae81693e12f9fcc47590149
SHA51247893f8117466821b89b29836e638bc76d2ee93e57179ba49d2242eb066fa01ff4e0033f194099065e29278b4d4ba653cca00e270f85ccd6cb91b7d3285d6161
-
Filesize
188KB
MD544dc205a5701b53f391a3a750c2c4712
SHA114e82b1f6bb987d8f2783db2ab5f82dd9ab8eacc
SHA256508c41442ba856a3266b3e58a31fe8c4b0ad7491e04dfead265daaa028efd768
SHA51202890434c81867499e0911e8062797bf7fc184e05b6de2ab14ffa6f95c48f88e07250b4e5a7ff565bbf45d66d8d7cb5c1009b85085ee3a6bbdac218f356c5749
-
Filesize
555KB
MD58595f5515fac09b73ff463056cb07a15
SHA180f39da9a52cffb70edaa4d7de82f543ba4d417e
SHA2568223619e305ec5063e9e2c1490fa25f6e924c317b08fd5eed938bb5de2e57de1
SHA51226f0a15484a8780fedcea91f9d90ab4b81a91598fad4cad54f45fd18eccf73914215851909bf8acadeafc7b89c656c98ec988a46aa43e17a364b39b5d8ac477a