Analysis
-
max time kernel
150s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
01-11-2024 01:09
Static task
static1
Behavioral task
behavioral1
Sample
24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93c.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93c.exe
Resource
win10v2004-20241007-en
General
-
Target
24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93c.exe
-
Size
349KB
-
MD5
0cf9394290c86066be37f994f0216970
-
SHA1
9c635196722a2b0060078df98509f9dd9ef15330
-
SHA256
24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93c
-
SHA512
a5b586de5bdd56a0969c5d77a0cfd57576d71feea4659e6db65cf3b3844862a7b93ce600bccfaa8f7604f7845b92527b156834e20f4a8e2e0a225323d57faba8
-
SSDEEP
6144:FB1QKZaOpBjQepew/PjuGyFPr527Uf2u/jGw0qun597/QKjJ8zkjDpyAYpIK:FB1Q6rpr7MrswfLjGwW5xFdRyJpL
Malware Config
Extracted
nanocore
1.2.2.2
bemery2.no-ip.biz:57628
127.0.0.1:57628
997af15f-5576-4030-975c-eb3264fb6789
-
activate_away_mode
true
-
backup_connection_host
127.0.0.1
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2015-04-23T21:31:33.540664436Z
-
bypass_user_account_control
true
- bypass_user_account_control_data
-
clear_access_control
true
-
clear_zone_identifier
true
-
connect_delay
4000
-
connection_port
57628
-
default_group
grace
-
enable_debug_mode
true
-
gc_threshold
1.048576e+08
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+09
-
mutex
997af15f-5576-4030-975c-eb3264fb6789
-
mutex_timeout
5000
-
prevent_system_sleep
true
-
primary_connection_host
bemery2.no-ip.biz
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
false
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.2
-
wan_timeout
8000
Signatures
-
Nanocore family
-
Sets file to hidden 1 TTPs 1 IoCs
Modifies file attributes to stop it showing in Explorer etc.
pid Process 480 attrib.exe -
Adds Run key to start application 2 TTPs 20 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\Google Chrome = "C:\\Users\\Admin\\AppData\\Roaming\\subfolder\\chrome.exe.exe" REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\Google Chrome = "C:\\Users\\Admin\\AppData\\Roaming\\subfolder\\chrome.exe.exe" REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\Google Chrome = "C:\\Users\\Admin\\AppData\\Roaming\\subfolder\\chrome.exe.exe" REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\Google Chrome = "C:\\Users\\Admin\\AppData\\Roaming\\subfolder\\chrome.exe.exe" REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\Google Chrome = "C:\\Users\\Admin\\AppData\\Roaming\\subfolder\\chrome.exe.exe" REG.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\DHCP Manager = "C:\\Program Files (x86)\\DHCP Manager\\dhcpmgr.exe" RegAsm.exe Set value (str) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\Google Chrome = "C:\\Users\\Admin\\AppData\\Roaming\\subfolder\\chrome.exe.exe" REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\Google Chrome = "C:\\Users\\Admin\\AppData\\Roaming\\subfolder\\chrome.exe.exe" REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\Google Chrome = "C:\\Users\\Admin\\AppData\\Roaming\\subfolder\\chrome.exe.exe" REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\Google Chrome = "C:\\Users\\Admin\\AppData\\Roaming\\subfolder\\chrome.exe.exe" REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\Google Chrome = "C:\\Users\\Admin\\AppData\\Roaming\\subfolder\\chrome.exe.exe" REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\Google Chrome = "C:\\Users\\Admin\\AppData\\Roaming\\subfolder\\chrome.exe.exe" REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\Google Chrome = "C:\\Users\\Admin\\AppData\\Roaming\\subfolder\\chrome.exe.exe" REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\Google Chrome = "C:\\Users\\Admin\\AppData\\Roaming\\subfolder\\chrome.exe.exe" REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\Google Chrome = "C:\\Users\\Admin\\AppData\\Roaming\\subfolder\\chrome.exe.exe" REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\Google Chrome = "C:\\Users\\Admin\\AppData\\Roaming\\subfolder\\chrome.exe.exe" REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\Google Chrome = "C:\\Users\\Admin\\AppData\\Roaming\\subfolder\\chrome.exe.exe" REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\Google Chrome = "C:\\Users\\Admin\\AppData\\Roaming\\subfolder\\chrome.exe.exe" REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\Google Chrome = "C:\\Users\\Admin\\AppData\\Roaming\\subfolder\\chrome.exe.exe" REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\Google Chrome = "C:\\Users\\Admin\\AppData\\Roaming\\subfolder\\chrome.exe.exe" REG.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA RegAsm.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2444 set thread context of 1812 2444 24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93c.exe 51 -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\DHCP Manager\dhcpmgr.exe RegAsm.exe File opened for modification C:\Program Files (x86)\DHCP Manager\dhcpmgr.exe RegAsm.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 43 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegAsm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language attrib.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93c.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DllHost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 20 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 840 ping.exe 2964 ping.exe 2752 ping.exe 904 ping.exe 2516 ping.exe 1480 ping.exe 2476 ping.exe 1516 ping.exe 1620 ping.exe 1864 ping.exe 1732 ping.exe 1396 ping.exe 2772 ping.exe 2932 ping.exe 692 ping.exe 1996 ping.exe 2220 ping.exe 2500 ping.exe 2248 ping.exe 1452 ping.exe -
Runs ping.exe 1 TTPs 20 IoCs
pid Process 1516 ping.exe 904 ping.exe 692 ping.exe 1452 ping.exe 1996 ping.exe 2500 ping.exe 2248 ping.exe 2772 ping.exe 2516 ping.exe 1732 ping.exe 2964 ping.exe 2752 ping.exe 2476 ping.exe 2932 ping.exe 1480 ping.exe 1864 ping.exe 840 ping.exe 2220 ping.exe 1620 ping.exe 1396 ping.exe -
Suspicious behavior: EnumeratesProcesses 39 IoCs
pid Process 1812 RegAsm.exe 1812 RegAsm.exe 1812 RegAsm.exe 2444 24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93c.exe 2444 24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93c.exe 2444 24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93c.exe 2444 24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93c.exe 2444 24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93c.exe 2444 24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93c.exe 2444 24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93c.exe 2444 24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93c.exe 2444 24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93c.exe 2444 24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93c.exe 2444 24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93c.exe 2444 24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93c.exe 2444 24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93c.exe 2444 24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93c.exe 2444 24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93c.exe 2444 24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93c.exe 2444 24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93c.exe 2444 24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93c.exe 2444 24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93c.exe 2444 24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93c.exe 2444 24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93c.exe 2444 24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93c.exe 2444 24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93c.exe 2444 24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93c.exe 2444 24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93c.exe 2444 24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93c.exe 2444 24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93c.exe 2444 24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93c.exe 2444 24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93c.exe 2444 24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93c.exe 2444 24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93c.exe 2444 24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93c.exe 2444 24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93c.exe 2444 24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93c.exe 2444 24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93c.exe 2444 24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93c.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1812 RegAsm.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2444 24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93c.exe Token: SeDebugPrivilege 1812 RegAsm.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2164 DllHost.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2164 DllHost.exe 2164 DllHost.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2444 wrote to memory of 1996 2444 24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93c.exe 29 PID 2444 wrote to memory of 1996 2444 24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93c.exe 29 PID 2444 wrote to memory of 1996 2444 24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93c.exe 29 PID 2444 wrote to memory of 1996 2444 24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93c.exe 29 PID 2444 wrote to memory of 2964 2444 24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93c.exe 31 PID 2444 wrote to memory of 2964 2444 24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93c.exe 31 PID 2444 wrote to memory of 2964 2444 24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93c.exe 31 PID 2444 wrote to memory of 2964 2444 24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93c.exe 31 PID 2444 wrote to memory of 2220 2444 24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93c.exe 33 PID 2444 wrote to memory of 2220 2444 24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93c.exe 33 PID 2444 wrote to memory of 2220 2444 24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93c.exe 33 PID 2444 wrote to memory of 2220 2444 24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93c.exe 33 PID 2444 wrote to memory of 2752 2444 24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93c.exe 35 PID 2444 wrote to memory of 2752 2444 24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93c.exe 35 PID 2444 wrote to memory of 2752 2444 24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93c.exe 35 PID 2444 wrote to memory of 2752 2444 24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93c.exe 35 PID 2444 wrote to memory of 2500 2444 24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93c.exe 39 PID 2444 wrote to memory of 2500 2444 24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93c.exe 39 PID 2444 wrote to memory of 2500 2444 24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93c.exe 39 PID 2444 wrote to memory of 2500 2444 24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93c.exe 39 PID 2444 wrote to memory of 2476 2444 24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93c.exe 41 PID 2444 wrote to memory of 2476 2444 24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93c.exe 41 PID 2444 wrote to memory of 2476 2444 24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93c.exe 41 PID 2444 wrote to memory of 2476 2444 24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93c.exe 41 PID 2444 wrote to memory of 2248 2444 24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93c.exe 43 PID 2444 wrote to memory of 2248 2444 24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93c.exe 43 PID 2444 wrote to memory of 2248 2444 24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93c.exe 43 PID 2444 wrote to memory of 2248 2444 24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93c.exe 43 PID 2444 wrote to memory of 1452 2444 24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93c.exe 45 PID 2444 wrote to memory of 1452 2444 24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93c.exe 45 PID 2444 wrote to memory of 1452 2444 24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93c.exe 45 PID 2444 wrote to memory of 1452 2444 24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93c.exe 45 PID 2444 wrote to memory of 1516 2444 24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93c.exe 47 PID 2444 wrote to memory of 1516 2444 24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93c.exe 47 PID 2444 wrote to memory of 1516 2444 24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93c.exe 47 PID 2444 wrote to memory of 1516 2444 24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93c.exe 47 PID 2444 wrote to memory of 1620 2444 24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93c.exe 49 PID 2444 wrote to memory of 1620 2444 24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93c.exe 49 PID 2444 wrote to memory of 1620 2444 24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93c.exe 49 PID 2444 wrote to memory of 1620 2444 24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93c.exe 49 PID 2444 wrote to memory of 1812 2444 24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93c.exe 51 PID 2444 wrote to memory of 1812 2444 24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93c.exe 51 PID 2444 wrote to memory of 1812 2444 24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93c.exe 51 PID 2444 wrote to memory of 1812 2444 24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93c.exe 51 PID 2444 wrote to memory of 1812 2444 24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93c.exe 51 PID 2444 wrote to memory of 1812 2444 24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93c.exe 51 PID 2444 wrote to memory of 1812 2444 24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93c.exe 51 PID 2444 wrote to memory of 1812 2444 24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93c.exe 51 PID 2444 wrote to memory of 1812 2444 24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93c.exe 51 PID 2444 wrote to memory of 1812 2444 24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93c.exe 51 PID 2444 wrote to memory of 1812 2444 24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93c.exe 51 PID 2444 wrote to memory of 1812 2444 24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93c.exe 51 PID 2444 wrote to memory of 480 2444 24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93c.exe 52 PID 2444 wrote to memory of 480 2444 24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93c.exe 52 PID 2444 wrote to memory of 480 2444 24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93c.exe 52 PID 2444 wrote to memory of 480 2444 24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93c.exe 52 PID 2444 wrote to memory of 1396 2444 24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93c.exe 53 PID 2444 wrote to memory of 1396 2444 24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93c.exe 53 PID 2444 wrote to memory of 1396 2444 24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93c.exe 53 PID 2444 wrote to memory of 1396 2444 24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93c.exe 53 PID 2444 wrote to memory of 2772 2444 24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93c.exe 56 PID 2444 wrote to memory of 2772 2444 24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93c.exe 56 PID 2444 wrote to memory of 2772 2444 24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93c.exe 56 PID 2444 wrote to memory of 2772 2444 24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93c.exe 56 -
Views/modifies file attributes 1 TTPs 1 IoCs
pid Process 480 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93c.exe"C:\Users\Admin\AppData\Local\Temp\24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93c.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2444 -
C:\Windows\SysWOW64\ping.exeC:\Windows\System32\ping.exe google.com2⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:1996
-
-
C:\Windows\SysWOW64\ping.exeC:\Windows\System32\ping.exe google.com2⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:2964
-
-
C:\Windows\SysWOW64\ping.exeC:\Windows\System32\ping.exe google.com2⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:2220
-
-
C:\Windows\SysWOW64\ping.exeC:\Windows\System32\ping.exe google.com2⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:2752
-
-
C:\Windows\SysWOW64\ping.exeC:\Windows\System32\ping.exe google.com2⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:2500
-
-
C:\Windows\SysWOW64\ping.exeC:\Windows\System32\ping.exe google.com2⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:2476
-
-
C:\Windows\SysWOW64\ping.exeC:\Windows\System32\ping.exe google.com2⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:2248
-
-
C:\Windows\SysWOW64\ping.exeC:\Windows\System32\ping.exe google.com2⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:1452
-
-
C:\Windows\SysWOW64\ping.exeC:\Windows\System32\ping.exe google.com2⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:1516
-
-
C:\Windows\SysWOW64\ping.exeC:\Windows\System32\ping.exe google.com2⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:1620
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"2⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:1812
-
-
C:\Windows\SysWOW64\attrib.exe"C:\Windows\System32\attrib.exe" +s +h C:\Users\Admin\AppData\Local\Temp\24bb4e18f701b86266d20da5c8f765c8a1c3350119157a5286592ecd1ccef93c.exe2⤵
- Sets file to hidden
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
PID:480
-
-
C:\Windows\SysWOW64\ping.exeC:\Windows\System32\ping.exe google.com2⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:1396
-
-
C:\Windows\SysWOW64\ping.exeC:\Windows\System32\ping.exe google.com2⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:2772
-
-
C:\Windows\SysWOW64\ping.exeC:\Windows\System32\ping.exe google.com2⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:2932
-
-
C:\Windows\SysWOW64\ping.exeC:\Windows\System32\ping.exe google.com2⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:904
-
-
C:\Windows\SysWOW64\ping.exeC:\Windows\System32\ping.exe google.com2⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:2516
-
-
C:\Windows\SysWOW64\ping.exeC:\Windows\System32\ping.exe google.com2⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:1480
-
-
C:\Windows\SysWOW64\ping.exeC:\Windows\System32\ping.exe google.com2⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:1864
-
-
C:\Windows\SysWOW64\ping.exeC:\Windows\System32\ping.exe google.com2⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:840
-
-
C:\Windows\SysWOW64\ping.exeC:\Windows\System32\ping.exe google.com2⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:692
-
-
C:\Windows\SysWOW64\ping.exeC:\Windows\System32\ping.exe google.com2⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:1732
-
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Google Chrome" /t REG_SZ /F /D "C:\Users\Admin\AppData\Roaming\subfolder\chrome.exe.exe2⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:1500
-
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Google Chrome" /t REG_SZ /F /D "C:\Users\Admin\AppData\Roaming\subfolder\chrome.exe.exe2⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:1876
-
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Google Chrome" /t REG_SZ /F /D "C:\Users\Admin\AppData\Roaming\subfolder\chrome.exe.exe2⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:1300
-
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Google Chrome" /t REG_SZ /F /D "C:\Users\Admin\AppData\Roaming\subfolder\chrome.exe.exe2⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:2292
-
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Google Chrome" /t REG_SZ /F /D "C:\Users\Admin\AppData\Roaming\subfolder\chrome.exe.exe2⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:2680
-
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Google Chrome" /t REG_SZ /F /D "C:\Users\Admin\AppData\Roaming\subfolder\chrome.exe.exe2⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:2808
-
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Google Chrome" /t REG_SZ /F /D "C:\Users\Admin\AppData\Roaming\subfolder\chrome.exe.exe2⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:2648
-
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Google Chrome" /t REG_SZ /F /D "C:\Users\Admin\AppData\Roaming\subfolder\chrome.exe.exe2⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:2552
-
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Google Chrome" /t REG_SZ /F /D "C:\Users\Admin\AppData\Roaming\subfolder\chrome.exe.exe2⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:2236
-
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Google Chrome" /t REG_SZ /F /D "C:\Users\Admin\AppData\Roaming\subfolder\chrome.exe.exe2⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:1604
-
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Google Chrome" /t REG_SZ /F /D "C:\Users\Admin\AppData\Roaming\subfolder\chrome.exe.exe2⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:1664
-
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Google Chrome" /t REG_SZ /F /D "C:\Users\Admin\AppData\Roaming\subfolder\chrome.exe.exe2⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:1576
-
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Google Chrome" /t REG_SZ /F /D "C:\Users\Admin\AppData\Roaming\subfolder\chrome.exe.exe2⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:1356
-
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Google Chrome" /t REG_SZ /F /D "C:\Users\Admin\AppData\Roaming\subfolder\chrome.exe.exe2⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:2540
-
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Google Chrome" /t REG_SZ /F /D "C:\Users\Admin\AppData\Roaming\subfolder\chrome.exe.exe2⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:1636
-
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Google Chrome" /t REG_SZ /F /D "C:\Users\Admin\AppData\Roaming\subfolder\chrome.exe.exe2⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:1968
-
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Google Chrome" /t REG_SZ /F /D "C:\Users\Admin\AppData\Roaming\subfolder\chrome.exe.exe2⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:300
-
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Google Chrome" /t REG_SZ /F /D "C:\Users\Admin\AppData\Roaming\subfolder\chrome.exe.exe2⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:2040
-
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Google Chrome" /t REG_SZ /F /D "C:\Users\Admin\AppData\Roaming\subfolder\chrome.exe.exe2⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:2880
-
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2164
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Modify Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
100KB
MD585aa412748cec606260dfc07a2ba0493
SHA1b1604d7f6a3bea2c716137e93c1b3206e4581595
SHA256603e434580ef4df688fa85fa8b0bd552fcc06fa7882c1d2789c8c52bce87752f
SHA51298ffc0676b705619d6fb206459c69cc73de285661971d43311e770898a474c2169749357c3126415f17a19e711badfe0fbbb98f056af8cf99cc6eaad7629a71a
-
Filesize
349KB
MD595c2e874523912d2d794272f3cc3acb3
SHA12dd91001bf7dafa602e7fcdbb316046cae7ae187
SHA256f80f11c74a369116c5641dfab1a6d9e3a1b4d4c3d47c43bed2e260e4308d903d
SHA51241be2196d5306153b96bb69712fedac19f814685b8ba7637f4aaee3264b0942d669948c001dffe80540fd1ae11f2662886d1e36058ecee5f40c126b140466571