Analysis Overview
SHA256
4ee9ec984e9b67d700a144ce7fdfe785f2b8cc2907ff9ee3b4fc4e7fb7fe0f55
Threat Level: Known bad
The file 4ee9ec984e9b67d700a144ce7fdfe785f2b8cc2907ff9ee3b4fc4e7fb7fe0f55N was found to be: Known bad.
Malicious Activity Summary
Windows security bypass
Boot or Logon Autostart Execution: Active Setup
Event Triggered Execution: Image File Execution Options Injection
Drops file in Drivers directory
Executes dropped EXE
Loads dropped DLL
Windows security modification
Modifies WinLogon
Indicator Removal: Clear Persistence
Drops file in System32 directory
Drops file in Program Files directory
System Location Discovery: System Language Discovery
Unsigned PE
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-10-30 14:53
Signatures
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2024-10-30 14:53
Reported
2024-10-30 14:55
Platform
win7-20240903-en
Max time kernel
149s
Max time network
123s
Command Line
Signatures
Windows security bypass
| Description | Indicator | Process | Target |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "5120" | C:\Windows\SysWOW64\rmass.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "5120" | C:\Windows\SysWOW64\rmass.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "5120" | C:\Windows\SysWOW64\rmass.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "5120" | C:\Windows\SysWOW64\rmass.exe | N/A |
Boot or Logon Autostart Execution: Active Setup
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5850414A-4f54-4959-5850-414A4F544959}\StubPath = "C:\\Windows\\system32\\ahuy.exe" | C:\Windows\SysWOW64\rmass.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5850414A-4f54-4959-5850-414A4F544959} | C:\Windows\SysWOW64\rmass.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5850414A-4f54-4959-5850-414A4F544959}\01234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123 = "a" | C:\Windows\SysWOW64\rmass.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5850414A-4f54-4959-5850-414A4F544959}\IsInstalled = "1" | C:\Windows\SysWOW64\rmass.exe | N/A |
Drops file in Drivers directory
| Description | Indicator | Process | Target |
| File opened for modification | C:\Windows\system32\drivers\etc\hosts | C:\Windows\SysWOW64\rmass.exe | N/A |
Event Triggered Execution: Image File Execution Options Injection
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger = "C:\\Windows\\system32\\ntdbg.exe" | C:\Windows\SysWOW64\rmass.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe | C:\Windows\SysWOW64\rmass.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890 = "a" | C:\Windows\SysWOW64\rmass.exe | N/A |
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\rmass.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\rmass.exe | N/A |
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\4ee9ec984e9b67d700a144ce7fdfe785f2b8cc2907ff9ee3b4fc4e7fb7fe0f55N.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\4ee9ec984e9b67d700a144ce7fdfe785f2b8cc2907ff9ee3b4fc4e7fb7fe0f55N.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\rmass.exe | N/A |
Windows security modification
| Description | Indicator | Process | Target |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "5120" | C:\Windows\SysWOW64\rmass.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "5120" | C:\Windows\SysWOW64\rmass.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "5120" | C:\Windows\SysWOW64\rmass.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "5120" | C:\Windows\SysWOW64\rmass.exe | N/A |
Indicator Removal: Clear Persistence
| Description | Indicator | Process | Target |
| Delete value | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger | C:\Windows\SysWOW64\rmass.exe | N/A |
Modifies WinLogon
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345 = "a" | C:\Windows\SysWOW64\rmass.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\DLLName = "C:\\Windows\\system32\\RECOVER32.DLL" | C:\Windows\SysWOW64\rmass.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\Startup = "Startup" | C:\Windows\SysWOW64\rmass.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B} | C:\Windows\SysWOW64\rmass.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify | C:\Windows\SysWOW64\rmass.exe | N/A |
Drops file in System32 directory
| Description | Indicator | Process | Target |
| File opened for modification | C:\Windows\SysWOW64\rmass.exe | C:\Users\Admin\AppData\Local\Temp\4ee9ec984e9b67d700a144ce7fdfe785f2b8cc2907ff9ee3b4fc4e7fb7fe0f55N.exe | N/A |
| File created | C:\Windows\SysWOW64\ntdbg.exe | C:\Windows\SysWOW64\rmass.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\ahuy.exe | C:\Windows\SysWOW64\rmass.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\RECOVER32.DLL | C:\Windows\SysWOW64\rmass.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\winrnt.exe | C:\Windows\SysWOW64\rmass.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\aset32.exe | C:\Windows\SysWOW64\rmass.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\idbg32.exe | C:\Windows\SysWOW64\rmass.exe | N/A |
| File created | C:\Windows\SysWOW64\rmass.exe | C:\Users\Admin\AppData\Local\Temp\4ee9ec984e9b67d700a144ce7fdfe785f2b8cc2907ff9ee3b4fc4e7fb7fe0f55N.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\ntdbg.exe | C:\Windows\SysWOW64\rmass.exe | N/A |
| File created | C:\Windows\SysWOW64\ahuy.exe | C:\Windows\SysWOW64\rmass.exe | N/A |
| File created | C:\Windows\SysWOW64\RECOVER32.DLL | C:\Windows\SysWOW64\rmass.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\rmass.exe | C:\Windows\SysWOW64\rmass.exe | N/A |
Drops file in Program Files directory
| Description | Indicator | Process | Target |
| File opened for modification | C:\Program Files (x86)\Common Files\System\winrnt.exe | C:\Windows\SysWOW64\rmass.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Common Files\System\aset32.exe | C:\Windows\SysWOW64\rmass.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Common Files\System\idbg32.exe | C:\Windows\SysWOW64\rmass.exe | N/A |
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\4ee9ec984e9b67d700a144ce7fdfe785f2b8cc2907ff9ee3b4fc4e7fb7fe0f55N.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\rmass.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\rmass.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\rmass.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\rmass.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\rmass.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\rmass.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Windows\system32\winlogon.exe
winlogon.exe
C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
C:\Users\Admin\AppData\Local\Temp\4ee9ec984e9b67d700a144ce7fdfe785f2b8cc2907ff9ee3b4fc4e7fb7fe0f55N.exe
"C:\Users\Admin\AppData\Local\Temp\4ee9ec984e9b67d700a144ce7fdfe785f2b8cc2907ff9ee3b4fc4e7fb7fe0f55N.exe"
C:\Windows\SysWOW64\rmass.exe
"C:\Windows\SysWOW64\rmass.exe"
C:\Windows\SysWOW64\rmass.exe
--k33p
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | viukyoyrnuyty.museum | udp |
| US | 8.8.8.8:53 | viukyoyrnuyty.museum | udp |
Files
\Windows\SysWOW64\rmass.exe
| MD5 | 560ad83daaedd76f2e111a3e0fcfcb05 |
| SHA1 | 1cb9082ecf83c06ea04a40d8233f5b4e209f78b8 |
| SHA256 | f3984e23d9b498dfc7bed2ea9c6c07b1b7eee2e796307422368ee1586b60c130 |
| SHA512 | dae737f0fd6182b66f1d740710b96686e8208fb048e215e6bf990991aafa0faa154c24966e57f9f3d5136c58e51cf1956a4c2dcf3c3817361fde3d3f7e45ca35 |
memory/2232-7-0x0000000000400000-0x0000000000403000-memory.dmp
C:\Windows\SysWOW64\RECOVER32.DLL
| MD5 | 12ff80c93916ec18553163d151a58a22 |
| SHA1 | 42b06ecc5e03b767770f3ed0a12953326d0eede3 |
| SHA256 | 144c5d2d4d938ad383d96c96163254b5e757ddb049d30445776f4077580668de |
| SHA512 | 50c29b2d567c75aa9b1bb2d4966d630a9747cdc50fc0843492a242068d67dc1c4fe418accb3acf6ce17e4831358d9acdab070aa81f673be086c589db6e5b7f67 |
C:\Windows\SysWOW64\ntdbg.exe
| MD5 | 4c46f2fab10ddeec17ffd7e34ed9ab0c |
| SHA1 | 80a5ca627b92b0772936462dba953472097dba5b |
| SHA256 | c468de351ff15460bf4e92df78508dad06e9ec01426a36d1ccc57f102cabb269 |
| SHA512 | 84142f5ac642768771f63dfb45b10265f8e8af82ddd5b0eb0d85d8f274fc887b76c57bcf36451ad7b0ec88a04ad212119067d1517f360c37994e43fb6f103c9f |
C:\Windows\SysWOW64\ahuy.exe
| MD5 | 938771b91bbd3ba7b25bdc8b518e21b5 |
| SHA1 | 7e0466c609401a18d38d3bc2e8d1ceb0e165ef58 |
| SHA256 | 14b1cf610aff17f46287ef18746b3e9c4b9606aa185b23e9519ea9fc446ecd85 |
| SHA512 | 583518cda86bf1b4af285b657fd74dd1eaf255c00a3a3f3849b46767a663d140cf99ba17dba2e08a21205e13fcd99fc35b9e0d37b7846634d3c827408aa4ea7d |
memory/2448-50-0x0000000000400000-0x000000000040E000-memory.dmp
memory/2796-51-0x0000000000400000-0x000000000040E000-memory.dmp
C:\Windows\System32\drivers\etc\hosts
| MD5 | b10b13206b0f2cf3968050072f6979bf |
| SHA1 | 699db21ba9cecf3f13ac3d76e22cfa41aa94da80 |
| SHA256 | 0eef3217095cb97b695c434e74d6314bf9e869a013d6e9c88e58c34576a276b4 |
| SHA512 | d33bfd931be6676539507a69101d99fa4c5ef36b12422bd11f063b9b6a47b7444f6c4ad5f35e044714fdb872e96cd9fddf049e8329af1219483887f6ac5f4a5d |
Analysis: behavioral2
Detonation Overview
Submitted
2024-10-30 14:53
Reported
2024-10-30 14:55
Platform
win10v2004-20241007-en
Max time kernel
149s
Max time network
151s
Command Line
Signatures
Windows security bypass
| Description | Indicator | Process | Target |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "5120" | C:\Windows\SysWOW64\rmass.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "5120" | C:\Windows\SysWOW64\rmass.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "5120" | C:\Windows\SysWOW64\rmass.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "5120" | C:\Windows\SysWOW64\rmass.exe | N/A |
Boot or Logon Autostart Execution: Active Setup
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{47554D4C-4e4c-4645-4755-4D4C4E4C4645} | C:\Windows\SysWOW64\rmass.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{47554D4C-4e4c-4645-4755-4D4C4E4C4645}\01234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123 = "a" | C:\Windows\SysWOW64\rmass.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{47554D4C-4e4c-4645-4755-4D4C4E4C4645}\IsInstalled = "1" | C:\Windows\SysWOW64\rmass.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{47554D4C-4e4c-4645-4755-4D4C4E4C4645}\StubPath = "C:\\Windows\\system32\\ahuy.exe" | C:\Windows\SysWOW64\rmass.exe | N/A |
Drops file in Drivers directory
| Description | Indicator | Process | Target |
| File opened for modification | C:\Windows\system32\drivers\etc\hosts | C:\Windows\SysWOW64\rmass.exe | N/A |
Event Triggered Execution: Image File Execution Options Injection
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe | C:\Windows\SysWOW64\rmass.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890 = "a" | C:\Windows\SysWOW64\rmass.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger = "C:\\Windows\\system32\\ntdbg.exe" | C:\Windows\SysWOW64\rmass.exe | N/A |
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\rmass.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\rmass.exe | N/A |
Windows security modification
| Description | Indicator | Process | Target |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "5120" | C:\Windows\SysWOW64\rmass.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "5120" | C:\Windows\SysWOW64\rmass.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "5120" | C:\Windows\SysWOW64\rmass.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "5120" | C:\Windows\SysWOW64\rmass.exe | N/A |
Indicator Removal: Clear Persistence
| Description | Indicator | Process | Target |
| Delete value | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger | C:\Windows\SysWOW64\rmass.exe | N/A |
Modifies WinLogon
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify | C:\Windows\SysWOW64\rmass.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345 = "a" | C:\Windows\SysWOW64\rmass.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\DLLName = "C:\\Windows\\system32\\RECOVER32.DLL" | C:\Windows\SysWOW64\rmass.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\Startup = "Startup" | C:\Windows\SysWOW64\rmass.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B} | C:\Windows\SysWOW64\rmass.exe | N/A |
Drops file in System32 directory
| Description | Indicator | Process | Target |
| File opened for modification | C:\Windows\SysWOW64\rmass.exe | C:\Users\Admin\AppData\Local\Temp\4ee9ec984e9b67d700a144ce7fdfe785f2b8cc2907ff9ee3b4fc4e7fb7fe0f55N.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\winrnt.exe | C:\Windows\SysWOW64\rmass.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\idbg32.exe | C:\Windows\SysWOW64\rmass.exe | N/A |
| File created | C:\Windows\SysWOW64\rmass.exe | C:\Users\Admin\AppData\Local\Temp\4ee9ec984e9b67d700a144ce7fdfe785f2b8cc2907ff9ee3b4fc4e7fb7fe0f55N.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\ntdbg.exe | C:\Windows\SysWOW64\rmass.exe | N/A |
| File created | C:\Windows\SysWOW64\ntdbg.exe | C:\Windows\SysWOW64\rmass.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\ahuy.exe | C:\Windows\SysWOW64\rmass.exe | N/A |
| File created | C:\Windows\SysWOW64\ahuy.exe | C:\Windows\SysWOW64\rmass.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\RECOVER32.DLL | C:\Windows\SysWOW64\rmass.exe | N/A |
| File created | C:\Windows\SysWOW64\RECOVER32.DLL | C:\Windows\SysWOW64\rmass.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\aset32.exe | C:\Windows\SysWOW64\rmass.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\rmass.exe | C:\Windows\SysWOW64\rmass.exe | N/A |
Drops file in Program Files directory
| Description | Indicator | Process | Target |
| File opened for modification | C:\Program Files (x86)\Common Files\System\idbg32.exe | C:\Windows\SysWOW64\rmass.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Common Files\System\winrnt.exe | C:\Windows\SysWOW64\rmass.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Common Files\System\aset32.exe | C:\Windows\SysWOW64\rmass.exe | N/A |
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\4ee9ec984e9b67d700a144ce7fdfe785f2b8cc2907ff9ee3b4fc4e7fb7fe0f55N.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\rmass.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\rmass.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\rmass.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\rmass.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\rmass.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\rmass.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\rmass.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\rmass.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\rmass.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\rmass.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Windows\system32\winlogon.exe
winlogon.exe
C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
C:\Users\Admin\AppData\Local\Temp\4ee9ec984e9b67d700a144ce7fdfe785f2b8cc2907ff9ee3b4fc4e7fb7fe0f55N.exe
"C:\Users\Admin\AppData\Local\Temp\4ee9ec984e9b67d700a144ce7fdfe785f2b8cc2907ff9ee3b4fc4e7fb7fe0f55N.exe"
C:\Windows\SysWOW64\rmass.exe
"C:\Windows\SysWOW64\rmass.exe"
C:\Windows\SysWOW64\rmass.exe
--k33p
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | cukaihuqr.ws | udp |
| US | 64.70.19.203:80 | cukaihuqr.ws | tcp |
| US | 8.8.8.8:53 | utbidet-ugeas.biz | udp |
| US | 172.234.222.143:80 | utbidet-ugeas.biz | tcp |
| US | 8.8.8.8:53 | utbidet-ugeas.biz | udp |
| US | 172.234.222.138:80 | utbidet-ugeas.biz | tcp |
| US | 8.8.8.8:53 | g.bing.com | udp |
| US | 150.171.27.10:443 | g.bing.com | tcp |
| US | 8.8.8.8:53 | 8.8.8.8.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 203.19.70.64.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 143.222.234.172.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 172.214.232.199.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 228.249.119.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 138.222.234.172.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 0.159.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 104.219.191.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 50.23.12.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 18.31.95.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 73.190.18.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 79.190.18.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 14.227.111.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | tse1.mm.bing.net | udp |
| US | 150.171.28.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.28.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.28.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.28.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.28.10:443 | tse1.mm.bing.net | tcp |
| US | 8.8.8.8:53 | 10.28.171.150.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 18.173.189.20.in-addr.arpa | udp |
Files
C:\Windows\SysWOW64\rmass.exe
| MD5 | 560ad83daaedd76f2e111a3e0fcfcb05 |
| SHA1 | 1cb9082ecf83c06ea04a40d8233f5b4e209f78b8 |
| SHA256 | f3984e23d9b498dfc7bed2ea9c6c07b1b7eee2e796307422368ee1586b60c130 |
| SHA512 | dae737f0fd6182b66f1d740710b96686e8208fb048e215e6bf990991aafa0faa154c24966e57f9f3d5136c58e51cf1956a4c2dcf3c3817361fde3d3f7e45ca35 |
memory/3120-3-0x0000000000400000-0x0000000000403000-memory.dmp
C:\Windows\SysWOW64\ahuy.exe
| MD5 | 6dccfdbfbccc2e501cbd9f1814ad5e4c |
| SHA1 | 373d9e47cc86158283a44300cc7fdf5bcfc9ad7c |
| SHA256 | 0c16a1b0e5ca2851304d6271374277b0750714ae973ae7d5066203ca333685f3 |
| SHA512 | 2013906bf0716fda7059b43a3e9d6576a831ef66b9eb8e7435cbca5dffceacb6fb7b88575bc32f7488d570b1bfa96525cad0fe52143fb50be0deb1f4fb438715 |
C:\Windows\SysWOW64\RECOVER32.DLL
| MD5 | 12ff80c93916ec18553163d151a58a22 |
| SHA1 | 42b06ecc5e03b767770f3ed0a12953326d0eede3 |
| SHA256 | 144c5d2d4d938ad383d96c96163254b5e757ddb049d30445776f4077580668de |
| SHA512 | 50c29b2d567c75aa9b1bb2d4966d630a9747cdc50fc0843492a242068d67dc1c4fe418accb3acf6ce17e4831358d9acdab070aa81f673be086c589db6e5b7f67 |
C:\Windows\SysWOW64\ntdbg.exe
| MD5 | f98b40bb3d35d91cae9de0c16e3ce934 |
| SHA1 | fc00cd1619e532b301b7708c585a47c80e1deafd |
| SHA256 | 35240d3ab1e50e349b4d5951432454fb624cc9260be8737d4afa87279c3e0ce0 |
| SHA512 | fd30abf42379bc10e496ac172ec2f3400af2d9b66e8baa41a3518ca1701365b5caec974825f6f4f72647a2dbbcf1196edfa204fccf86ede28473ecaf7cecaacc |
memory/3532-44-0x0000000000400000-0x000000000040E000-memory.dmp
memory/4348-45-0x0000000000400000-0x000000000040E000-memory.dmp
C:\Windows\System32\drivers\etc\hosts
| MD5 | 6f47b62de25d1745e296a06b3f98ed19 |
| SHA1 | a688bb35a4c8a5cc198985d624a1b5a6ac5b9f6f |
| SHA256 | 15c7218eb9cef5fa0573db657b15ce3a5f0e0609f1166df8098ca7152df505b4 |
| SHA512 | dea26fff8060f44bf20fe4fff2ecbacf428727f10c0f5886fb4813e28fce9cbc3d088337c84edd9857b18514c83f1bb1cf0f51518aaecef09f30e921f4d758d7 |