Analysis
-
max time kernel
146s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
30-11-2024 13:34
Static task
static1
Behavioral task
behavioral1
Sample
332c821af961b47398a1e02396dbf624ecebaba2fc6e92c167d34c45d226eae2.msi
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral2
Sample
332c821af961b47398a1e02396dbf624ecebaba2fc6e92c167d34c45d226eae2.msi
Resource
win10v2004-20241007-en
windows10-2004-x64
General
-
Target
332c821af961b47398a1e02396dbf624ecebaba2fc6e92c167d34c45d226eae2.msi
-
Size
135.7MB
-
MD5
ccf528349a15583c45b5a3adfebbcf82
-
SHA1
5b3232e3267acf8b3ffb4998c526a10eadc695da
-
SHA256
332c821af961b47398a1e02396dbf624ecebaba2fc6e92c167d34c45d226eae2
-
SHA512
7e5bfa1bb4b35cbb840bdf77e7835c37b04f780d21f0f5c09d623a44c2685a21db33e946bbdf663922387b02acf0c5457bdd7329d6dff13a78c22c7cead6e8f5
-
SSDEEP
3145728:CglSw/0KksfWneWVr6/4J3DYgxqmz8CZCLLURLhMkzEgRo:BlSw/7ksOneWVm/CDYddLYdMSY
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral2/memory/960-13125-0x0000000010000000-0x000000001019F000-memory.dmp purplefox_rootkit behavioral2/memory/960-17009-0x0000000000400000-0x0000000001F5C000-memory.dmp purplefox_rootkit behavioral2/memory/6348-26304-0x0000000000400000-0x0000000001F5C000-memory.dmp purplefox_rootkit behavioral2/memory/6348-26306-0x0000000000400000-0x0000000001F5C000-memory.dmp purplefox_rootkit behavioral2/memory/6348-26316-0x0000000000400000-0x0000000001F5C000-memory.dmp purplefox_rootkit behavioral2/memory/3428-39391-0x0000000000400000-0x0000000001F5C000-memory.dmp purplefox_rootkit behavioral2/memory/3428-39407-0x0000000000400000-0x0000000001F5C000-memory.dmp purplefox_rootkit -
Gh0st RAT payload 7 IoCs
Processes:
resource yara_rule behavioral2/memory/960-13125-0x0000000010000000-0x000000001019F000-memory.dmp family_gh0strat behavioral2/memory/960-17009-0x0000000000400000-0x0000000001F5C000-memory.dmp family_gh0strat behavioral2/memory/6348-26304-0x0000000000400000-0x0000000001F5C000-memory.dmp family_gh0strat behavioral2/memory/6348-26306-0x0000000000400000-0x0000000001F5C000-memory.dmp family_gh0strat behavioral2/memory/6348-26316-0x0000000000400000-0x0000000001F5C000-memory.dmp family_gh0strat behavioral2/memory/3428-39391-0x0000000000400000-0x0000000001F5C000-memory.dmp family_gh0strat behavioral2/memory/3428-39407-0x0000000000400000-0x0000000001F5C000-memory.dmp family_gh0strat -
Gh0strat family
-
Purplefox family
-
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
msiexec.exeKbskb.exemsiexec.exedescription ioc Process File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\M: Kbskb.exe File opened (read-only) \??\U: Kbskb.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\X: Kbskb.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\H: Kbskb.exe File opened (read-only) \??\N: Kbskb.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: Kbskb.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\P: Kbskb.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: Kbskb.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: Kbskb.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\W: Kbskb.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\K: Kbskb.exe File opened (read-only) \??\Y: Kbskb.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\E: Kbskb.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\G: Kbskb.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\I: Kbskb.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\B: Kbskb.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\S: Kbskb.exe File opened (read-only) \??\V: Kbskb.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\J: Kbskb.exe File opened (read-only) \??\L: Kbskb.exe -
Drops file in System32 directory 2 IoCs
Processes:
SoftUpdate.exedescription ioc Process File created C:\Windows\SysWOW64\Kbskb.exe SoftUpdate.exe File opened for modification C:\Windows\SysWOW64\Kbskb.exe SoftUpdate.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 37 IoCs
Processes:
SoftUpdate.exeKbskb.exeKbskb.exepid Process 960 SoftUpdate.exe 960 SoftUpdate.exe 960 SoftUpdate.exe 6348 Kbskb.exe 960 SoftUpdate.exe 6348 Kbskb.exe 960 SoftUpdate.exe 6348 Kbskb.exe 3428 Kbskb.exe 3428 Kbskb.exe 3428 Kbskb.exe 3428 Kbskb.exe 3428 Kbskb.exe 3428 Kbskb.exe 3428 Kbskb.exe 3428 Kbskb.exe 3428 Kbskb.exe 3428 Kbskb.exe 3428 Kbskb.exe 3428 Kbskb.exe 3428 Kbskb.exe 3428 Kbskb.exe 3428 Kbskb.exe 3428 Kbskb.exe 3428 Kbskb.exe 3428 Kbskb.exe 3428 Kbskb.exe 3428 Kbskb.exe 3428 Kbskb.exe 3428 Kbskb.exe 3428 Kbskb.exe 3428 Kbskb.exe 3428 Kbskb.exe 3428 Kbskb.exe 3428 Kbskb.exe 3428 Kbskb.exe 3428 Kbskb.exe -
Drops file in Windows directory 14 IoCs
Processes:
msiexec.exedescription ioc Process File opened for modification C:\Windows\Installer\MSI95C9.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\SourceHash{A3CE6828-13C4-4A4D-AE47-6BA43E771F33} msiexec.exe File opened for modification C:\Windows\Installer\MSI9B5B.tmp msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSI93F3.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI9647.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI99E3.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI9B9B.tmp msiexec.exe File created C:\Windows\Installer\e5792ab.msi msiexec.exe File opened for modification C:\Windows\Installer\e5792ab.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI9696.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI9723.tmp msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe -
Executes dropped EXE 6 IoCs
Processes:
MSI9B5B.tmpMSI9B9B.tmpSoftUpdate.exeYoudaoDict_fanyiweb_navigation.exeKbskb.exeKbskb.exepid Process 5012 MSI9B5B.tmp 2296 MSI9B9B.tmp 960 SoftUpdate.exe 4484 YoudaoDict_fanyiweb_navigation.exe 6348 Kbskb.exe 3428 Kbskb.exe -
Loads dropped DLL 11 IoCs
Processes:
MsiExec.exeYoudaoDict_fanyiweb_navigation.exepid Process 2740 MsiExec.exe 2740 MsiExec.exe 2740 MsiExec.exe 2740 MsiExec.exe 2740 MsiExec.exe 4484 YoudaoDict_fanyiweb_navigation.exe 4484 YoudaoDict_fanyiweb_navigation.exe 4484 YoudaoDict_fanyiweb_navigation.exe 4484 YoudaoDict_fanyiweb_navigation.exe 4484 YoudaoDict_fanyiweb_navigation.exe 4484 YoudaoDict_fanyiweb_navigation.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
SoftUpdate.exeYoudaoDict_fanyiweb_navigation.exeKbskb.exeMsiExec.exeMSI9B5B.tmpMSI9B9B.tmpKbskb.execmd.exePING.EXEdescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SoftUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YoudaoDict_fanyiweb_navigation.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kbskb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MSI9B5B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MSI9B9B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kbskb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
Processes:
cmd.exePING.EXEpid Process 7380 cmd.exe 6740 PING.EXE -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
Kbskb.exedescription ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Kbskb.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz Kbskb.exe -
Modifies data under HKEY_USERS 5 IoCs
Processes:
Kbskb.exedescription ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum\Version = "7" Kbskb.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum Kbskb.exe Key created \REGISTRY\USER\.DEFAULT\Software Kbskb.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft Kbskb.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie Kbskb.exe -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
msiexec.exeKbskb.exepid Process 4460 msiexec.exe 4460 msiexec.exe 3428 Kbskb.exe 3428 Kbskb.exe 3428 Kbskb.exe 3428 Kbskb.exe 3428 Kbskb.exe 3428 Kbskb.exe 3428 Kbskb.exe 3428 Kbskb.exe 3428 Kbskb.exe 3428 Kbskb.exe 3428 Kbskb.exe 3428 Kbskb.exe 3428 Kbskb.exe 3428 Kbskb.exe 3428 Kbskb.exe 3428 Kbskb.exe 3428 Kbskb.exe 3428 Kbskb.exe 3428 Kbskb.exe 3428 Kbskb.exe 3428 Kbskb.exe 3428 Kbskb.exe 3428 Kbskb.exe 3428 Kbskb.exe 3428 Kbskb.exe 3428 Kbskb.exe 3428 Kbskb.exe 3428 Kbskb.exe 3428 Kbskb.exe 3428 Kbskb.exe 3428 Kbskb.exe 3428 Kbskb.exe 3428 Kbskb.exe 3428 Kbskb.exe 3428 Kbskb.exe 3428 Kbskb.exe 3428 Kbskb.exe 3428 Kbskb.exe 3428 Kbskb.exe 3428 Kbskb.exe 3428 Kbskb.exe 3428 Kbskb.exe 3428 Kbskb.exe 3428 Kbskb.exe 3428 Kbskb.exe 3428 Kbskb.exe 3428 Kbskb.exe 3428 Kbskb.exe 3428 Kbskb.exe 3428 Kbskb.exe 3428 Kbskb.exe 3428 Kbskb.exe 3428 Kbskb.exe 3428 Kbskb.exe 3428 Kbskb.exe 3428 Kbskb.exe 3428 Kbskb.exe 3428 Kbskb.exe 3428 Kbskb.exe 3428 Kbskb.exe 3428 Kbskb.exe 3428 Kbskb.exe -
Suspicious use of AdjustPrivilegeToken 57 IoCs
Processes:
msiexec.exemsiexec.exeSoftUpdate.exeKbskb.exedescription pid Process Token: SeShutdownPrivilege 208 msiexec.exe Token: SeIncreaseQuotaPrivilege 208 msiexec.exe Token: SeSecurityPrivilege 4460 msiexec.exe Token: SeCreateTokenPrivilege 208 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 208 msiexec.exe Token: SeLockMemoryPrivilege 208 msiexec.exe Token: SeIncreaseQuotaPrivilege 208 msiexec.exe Token: SeMachineAccountPrivilege 208 msiexec.exe Token: SeTcbPrivilege 208 msiexec.exe Token: SeSecurityPrivilege 208 msiexec.exe Token: SeTakeOwnershipPrivilege 208 msiexec.exe Token: SeLoadDriverPrivilege 208 msiexec.exe Token: SeSystemProfilePrivilege 208 msiexec.exe Token: SeSystemtimePrivilege 208 msiexec.exe Token: SeProfSingleProcessPrivilege 208 msiexec.exe Token: SeIncBasePriorityPrivilege 208 msiexec.exe Token: SeCreatePagefilePrivilege 208 msiexec.exe Token: SeCreatePermanentPrivilege 208 msiexec.exe Token: SeBackupPrivilege 208 msiexec.exe Token: SeRestorePrivilege 208 msiexec.exe Token: SeShutdownPrivilege 208 msiexec.exe Token: SeDebugPrivilege 208 msiexec.exe Token: SeAuditPrivilege 208 msiexec.exe Token: SeSystemEnvironmentPrivilege 208 msiexec.exe Token: SeChangeNotifyPrivilege 208 msiexec.exe Token: SeRemoteShutdownPrivilege 208 msiexec.exe Token: SeUndockPrivilege 208 msiexec.exe Token: SeSyncAgentPrivilege 208 msiexec.exe Token: SeEnableDelegationPrivilege 208 msiexec.exe Token: SeManageVolumePrivilege 208 msiexec.exe Token: SeImpersonatePrivilege 208 msiexec.exe Token: SeCreateGlobalPrivilege 208 msiexec.exe Token: SeRestorePrivilege 4460 msiexec.exe Token: SeTakeOwnershipPrivilege 4460 msiexec.exe Token: SeRestorePrivilege 4460 msiexec.exe Token: SeTakeOwnershipPrivilege 4460 msiexec.exe Token: SeRestorePrivilege 4460 msiexec.exe Token: SeTakeOwnershipPrivilege 4460 msiexec.exe Token: SeRestorePrivilege 4460 msiexec.exe Token: SeTakeOwnershipPrivilege 4460 msiexec.exe Token: SeRestorePrivilege 4460 msiexec.exe Token: SeTakeOwnershipPrivilege 4460 msiexec.exe Token: SeRestorePrivilege 4460 msiexec.exe Token: SeTakeOwnershipPrivilege 4460 msiexec.exe Token: SeRestorePrivilege 4460 msiexec.exe Token: SeTakeOwnershipPrivilege 4460 msiexec.exe Token: SeRestorePrivilege 4460 msiexec.exe Token: SeTakeOwnershipPrivilege 4460 msiexec.exe Token: SeRestorePrivilege 4460 msiexec.exe Token: SeTakeOwnershipPrivilege 4460 msiexec.exe Token: SeRestorePrivilege 4460 msiexec.exe Token: SeTakeOwnershipPrivilege 4460 msiexec.exe Token: SeRestorePrivilege 4460 msiexec.exe Token: SeTakeOwnershipPrivilege 4460 msiexec.exe Token: SeIncBasePriorityPrivilege 960 SoftUpdate.exe Token: 33 3428 Kbskb.exe Token: SeIncBasePriorityPrivilege 3428 Kbskb.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
msiexec.exepid Process 208 msiexec.exe 208 msiexec.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
msiexec.exeSoftUpdate.exeKbskb.execmd.exedescription pid Process procid_target PID 4460 wrote to memory of 2740 4460 msiexec.exe 85 PID 4460 wrote to memory of 2740 4460 msiexec.exe 85 PID 4460 wrote to memory of 2740 4460 msiexec.exe 85 PID 4460 wrote to memory of 5012 4460 msiexec.exe 86 PID 4460 wrote to memory of 5012 4460 msiexec.exe 86 PID 4460 wrote to memory of 5012 4460 msiexec.exe 86 PID 4460 wrote to memory of 2296 4460 msiexec.exe 87 PID 4460 wrote to memory of 2296 4460 msiexec.exe 87 PID 4460 wrote to memory of 2296 4460 msiexec.exe 87 PID 960 wrote to memory of 7380 960 SoftUpdate.exe 94 PID 960 wrote to memory of 7380 960 SoftUpdate.exe 94 PID 960 wrote to memory of 7380 960 SoftUpdate.exe 94 PID 6348 wrote to memory of 3428 6348 Kbskb.exe 95 PID 6348 wrote to memory of 3428 6348 Kbskb.exe 95 PID 6348 wrote to memory of 3428 6348 Kbskb.exe 95 PID 7380 wrote to memory of 6740 7380 cmd.exe 98 PID 7380 wrote to memory of 6740 7380 cmd.exe 98 PID 7380 wrote to memory of 6740 7380 cmd.exe 98
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\332c821af961b47398a1e02396dbf624ecebaba2fc6e92c167d34c45d226eae2.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:208
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4460 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 8A7E0074C53BC8449CD7A343F4854B0E2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2740
-
-
C:\Windows\Installer\MSI9B5B.tmp"C:\Windows\Installer\MSI9B5B.tmp" /DontWait "C:\Users\Admin\AppData\Local\Temp\YoudaoDict_fanyiweb_navigation.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5012
-
-
C:\Windows\Installer\MSI9B9B.tmp"C:\Windows\Installer\MSI9B9B.tmp" /DontWait "C:\Users\Admin\AppData\Local\Temp\SoftUpdate.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2296
-
-
C:\Users\Admin\AppData\Local\Temp\SoftUpdate.exe"C:\Users\Admin\AppData\Local\Temp\SoftUpdate.exe"1⤵
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:960 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\SOFTUP~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
PID:7380 -
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.13⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:6740
-
-
-
C:\Users\Admin\AppData\Local\Temp\YoudaoDict_fanyiweb_navigation.exe"C:\Users\Admin\AppData\Local\Temp\YoudaoDict_fanyiweb_navigation.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4484
-
C:\Windows\SysWOW64\Kbskb.exeC:\Windows\SysWOW64\Kbskb.exe -auto1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6348 -
C:\Windows\SysWOW64\Kbskb.exeC:\Windows\SysWOW64\Kbskb.exe -acsi2⤵
- Enumerates connected drives
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3428
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
420KB
MD52b1fb870cb6f4197cd146e0415e7b485
SHA125ef84e478787145a35b3df1a8c57a11d2259891
SHA256586e7c725f1b5a977e768ea18b14a062c3b0fea93db2bc51d8c3bb7c0baae3e5
SHA5121fcec8fd82033261075f4b05250592c643e563b06c47f2ae7f40ab9673fa041d43ecb836779aa61c6f7f413b94323519f6fa3d04dd7c9a331cb1dbc0fc6c80d4
-
Filesize
27.4MB
MD5f86698c77feaa537e043c6b7cd196367
SHA10e0b994ad8015f913347d2777f56d0de756c2563
SHA256fe8c3aa2b4383bc06e24fb05795e171963da0f1160369ab0feb400be177bbfca
SHA512236e482845313044259064de02a7509c7d53581ac234225b043574e0586d96782e21c01675cefae33b389aba188dfb4760c4b2622085e44bd45797ff3bcb4fb0
-
Filesize
95KB
MD55a94bf8916a11b5fe94aca44886c9393
SHA1820d9c5e3365e323d6f43d3cce26fd9d2ea48b93
SHA2560b1e46044b580121f30bedb2b5412d3170c6afaa7800d702ee71f7666904236d
SHA51279cba3dcb249d88a6a6cfb4efcb65cc42a240af4edb14bcc7546d9c701a7b642362f9fe0488691a8906607ecc76f7b5ee5a4282fa057053b258eea143ac90c20
-
Filesize
48KB
MD5765cf74fc709fb3450fa71aac44e7f53
SHA1b423271b4faac68f88fef15fa4697cf0149bad85
SHA256cc46ab0bf6b19a2601cd002b06769ad08baf4ed0b14e8728973f8af96bdee57e
SHA5120c347d9a2960a17f8ec9b78ede972bf3cf6567fd079a6aa5a6ac262ac227bfd36acc53a7a127fd7f387dec9f4509f4f3f754b10853a213e993ea1573e74ed7e6
-
Filesize
4KB
MD529818862640ac659ce520c9c64e63e9e
SHA1485e1e6cc552fa4f05fb767043b1e7c9eb80be64
SHA256e96afa894a995a6097a405df76155a7a39962ff6cae7a59d89a25e5a34ab9eeb
SHA512ebb94eb21e060fb90ec9c86787eada42c7c9e1e7628ea4b16d3c7b414f554a94d5e4f4abe0e4ee30fddf4f904fd3002770a9b967fbd0feeca353e21079777057
-
Filesize
11KB
MD5bf712f32249029466fa86756f5546950
SHA175ac4dc4808ac148ddd78f6b89a51afbd4091c2e
SHA2567851cb12fa4131f1fee5de390d650ef65cac561279f1cfe70ad16cc9780210af
SHA51213f69959b28416e0b8811c962a49309dca3f048a165457051a28a3eb51377dcaf99a15e86d7eee8f867a9e25ecf8c44da370ac8f530eeae7b5252eaba64b96f4
-
Filesize
38KB
MD5dab018047c171165c18329d5c59b617e
SHA188848ac4aceb7358f13d225de6d4fd0a5696517a
SHA2561cf0d9e908c3134ffce859483504420578ee8ccda399c20ecc035d1e4da93734
SHA5121f6c50885290a3b983b7b8ac4bfec546d74acf2c50bfd0d245164a5ee149fa28a2871d545286108345c055c4f86f2b115509fcf74a6b60bc3f814c1c1635162d
-
Filesize
38KB
MD55f7b90c87ea0517771862fae5f11ce94
SHA1fc9f195e888d960139278c04a0e78996c6442d5b
SHA256f906101e512c3119e71b6949d68ac01c8fdb5ef06f4c73eaef9a3f0bd6021ce2
SHA512dc08461f1e823d898f5ba42c9d1a131f599adbcb0af28c5de950a01ec74015d3da933e675986b71dde09cc74e00689ebe5f5f6cff857d335322f18d3f385edf0
-
Filesize
3KB
MD55754c67775c3f4f50a4780b3bca026b1
SHA13e95c72c13d6175ef275280fe270d678acee46e9
SHA2562a5d67757f61ca00227e9b482a7b15365ba836c11f5b7d723b650e6d4108e739
SHA512df6744556a24d4f6b907fc6126035adca4d3ce8aba52b26112e59b24ebfc5c4e079ee8ed74df3f28fc62cc3e207041cf8fb6b6a84ec58125122c214924e0a97f
-
Filesize
9KB
MD54ccc4a742d4423f2f0ed744fd9c81f63
SHA1704f00a1acc327fd879cf75fc90d0b8f927c36bc
SHA256416133dd86c0dff6b0fcaf1f46dfe97fdc85b37f90effb2d369164a8f7e13ae6
SHA512790c5eb1f8b297e45054c855b66dfc18e9f3f1b1870559014dbefa3b9d5b6d33a993a9e089202e70f51a55d859b74e8605c6f633386fd9189b6f78941bf1bfdb
-
Filesize
908KB
MD53d3ec6392cf9a8b408569a3dd4cd3ce8
SHA195ff4346eb20d9239c37e6538bb8df8542d3300a
SHA256818f2cdb763f5af1884485cffef51f192bc895132a4fdff5009935e8348f8371
SHA512e017cfd88c50c496ac86084a43a80eb3f1ec61c6397a67da2978cbb1867a4b30f563f1b4f319d00742b84df486e841804b82949e3131c7d77b7f63975dece505
-
Filesize
587KB
MD5c7fbd5ee98e32a77edf1156db3fca622
SHA13e534fc55882e9fb940c9ae81e6f8a92a07125a0
SHA256e140990b509dd6884a5742bde64f2cdaa10012d472b0b32de43ebecbc83242b6
SHA5128691ac8b214cc1e4f34a3ab2bbc0c2391f7f11ebbe5db0dc82825195b5fe5a05310ed1e14d253a9b74a64050d2f2a6623dd2fcd912f80fef51e51845ef1e3a1a
-
Filesize
419KB
MD5cac0eaeb267d81cf3fa968ee23a6af9d
SHA1cf6ae8e44fb4949d5f0b01b110eaba49d39270a2
SHA256f1dd0dd1e83b28ffa2ed30f46f98e94a4919ec1f4e9d33720354288b77153774
SHA5128edf9f733dda9000a6e2b70da61912dbc15f74c836d738391ceddcdff20f5b420a678450523cf331aa9bce90217aa92ac6e73d1880ae15c9842ccc7d3296f95b
