Overview

overview

10

Static

static

3

7c22f4061c...1f.exe

windows7-x64

10

7c22f4061c...1f.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    148s
  • max time network
    151s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    03/12/2024, 16:26

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    7c22f4061c00377c6e54ab94e1f5b7876df986f6e7cdcb1d1ed5bed17f06e91f.exe

  • Size

    124KB

  • MD5

    ef65a75d19fa8016413c0515c66e12d9

  • SHA1

    fab426294b85631970932ab3ed8cf1d9793c6958

  • SHA256

    7c22f4061c00377c6e54ab94e1f5b7876df986f6e7cdcb1d1ed5bed17f06e91f

  • SHA512

    7e1eeebd32edfb8f7b318626e0df9d4efaabc17a36bf20e819574bc9bb757bde7a55c04cecc24b24eace5a744b52cc619a7e1e149deaaff5ffa14dc96505e8d8

  • SSDEEP

    1536:Nlszi5YjhRO/N69BH3OoGa+FLHjKceRgrkOSoINeGUmc:3GQYjhkFoN3Oo1+FvfSS

Score
10/10
discoveryevasionpersistence

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 46 IoCs
    evasion
  • Executes dropped EXE 46 IoCs
  • Loads dropped DLL 64 IoCs
  • Adds Run key to start application 2 TTPs 46 IoCs
    persistence
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 47 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 46 IoCs
  • Suspicious use of SetWindowsHookEx 47 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7c22f4061c00377c6e54ab94e1f5b7876df986f6e7cdcb1d1ed5bed17f06e91f.exe
    "C:\Users\Admin\AppData\Local\Temp\7c22f4061c00377c6e54ab94e1f5b7876df986f6e7cdcb1d1ed5bed17f06e91f.exe"
    1⤵
    • Modifies visiblity of hidden/system files in Explorer
    • Loads dropped DLL
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1128
    • C:\Users\Admin\qvpuz.exe
      "C:\Users\Admin\qvpuz.exe"
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1936
      • C:\Users\Admin\faepie.exe
        "C:\Users\Admin\faepie.exe"
        3⤵
        • Modifies visiblity of hidden/system files in Explorer
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2844
        • C:\Users\Admin\zrnoev.exe
          "C:\Users\Admin\zrnoev.exe"
          4⤵
          • Modifies visiblity of hidden/system files in Explorer
          • Executes dropped EXE
          • Loads dropped DLL
          • Adds Run key to start application
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:2920
          • C:\Users\Admin\hooaqe.exe
            "C:\Users\Admin\hooaqe.exe"
            5⤵
            • Modifies visiblity of hidden/system files in Explorer
            • Executes dropped EXE
            • Loads dropped DLL
            • Adds Run key to start application
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:2040
            • C:\Users\Admin\gemik.exe
              "C:\Users\Admin\gemik.exe"
              6⤵
              • Modifies visiblity of hidden/system files in Explorer
              • Executes dropped EXE
              • Loads dropped DLL
              • Adds Run key to start application
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:1700
              • C:\Users\Admin\riasa.exe
                "C:\Users\Admin\riasa.exe"
                7⤵
                • Modifies visiblity of hidden/system files in Explorer
                • Executes dropped EXE
                • Loads dropped DLL
                • Adds Run key to start application
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of SetWindowsHookEx
                • Suspicious use of WriteProcessMemory
                PID:1252
                • C:\Users\Admin\vumuq.exe
                  "C:\Users\Admin\vumuq.exe"
                  8⤵
                  • Modifies visiblity of hidden/system files in Explorer
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Adds Run key to start application
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of SetWindowsHookEx
                  • Suspicious use of WriteProcessMemory
                  PID:2820
                  • C:\Users\Admin\koibal.exe
                    "C:\Users\Admin\koibal.exe"
                    9⤵
                    • Modifies visiblity of hidden/system files in Explorer
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • Adds Run key to start application
                    • System Location Discovery: System Language Discovery
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of SetWindowsHookEx
                    • Suspicious use of WriteProcessMemory
                    PID:2956
                    • C:\Users\Admin\xooadu.exe
                      "C:\Users\Admin\xooadu.exe"
                      10⤵
                      • Modifies visiblity of hidden/system files in Explorer
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Adds Run key to start application
                      • System Location Discovery: System Language Discovery
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of SetWindowsHookEx
                      • Suspicious use of WriteProcessMemory
                      PID:2300
                      • C:\Users\Admin\caiqia.exe
                        "C:\Users\Admin\caiqia.exe"
                        11⤵
                        • Modifies visiblity of hidden/system files in Explorer
                        • Executes dropped EXE
                        • Loads dropped DLL
                        • Adds Run key to start application
                        • System Location Discovery: System Language Discovery
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of SetWindowsHookEx
                        • Suspicious use of WriteProcessMemory
                        PID:3012
                        • C:\Users\Admin\muiqeo.exe
                          "C:\Users\Admin\muiqeo.exe"
                          12⤵
                          • Modifies visiblity of hidden/system files in Explorer
                          • Executes dropped EXE
                          • Loads dropped DLL
                          • Adds Run key to start application
                          • System Location Discovery: System Language Discovery
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of SetWindowsHookEx
                          • Suspicious use of WriteProcessMemory
                          PID:1344
                          • C:\Users\Admin\wzbuc.exe
                            "C:\Users\Admin\wzbuc.exe"
                            13⤵
                            • Modifies visiblity of hidden/system files in Explorer
                            • Executes dropped EXE
                            • Loads dropped DLL
                            • Adds Run key to start application
                            • System Location Discovery: System Language Discovery
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of SetWindowsHookEx
                            • Suspicious use of WriteProcessMemory
                            PID:1972
                            • C:\Users\Admin\ttvuov.exe
                              "C:\Users\Admin\ttvuov.exe"
                              14⤵
                              • Modifies visiblity of hidden/system files in Explorer
                              • Executes dropped EXE
                              • Loads dropped DLL
                              • Adds Run key to start application
                              • System Location Discovery: System Language Discovery
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of SetWindowsHookEx
                              • Suspicious use of WriteProcessMemory
                              PID:760
                              • C:\Users\Admin\jeucie.exe
                                "C:\Users\Admin\jeucie.exe"
                                15⤵
                                • Modifies visiblity of hidden/system files in Explorer
                                • Executes dropped EXE
                                • Loads dropped DLL
                                • Adds Run key to start application
                                • System Location Discovery: System Language Discovery
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious use of SetWindowsHookEx
                                • Suspicious use of WriteProcessMemory
                                PID:1872
                                • C:\Users\Admin\taiefi.exe
                                  "C:\Users\Admin\taiefi.exe"
                                  16⤵
                                  • Modifies visiblity of hidden/system files in Explorer
                                  • Executes dropped EXE
                                  • Loads dropped DLL
                                  • Adds Run key to start application
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious behavior: EnumeratesProcesses
                                  • Suspicious use of SetWindowsHookEx
                                  • Suspicious use of WriteProcessMemory
                                  PID:2276
                                  • C:\Users\Admin\juhes.exe
                                    "C:\Users\Admin\juhes.exe"
                                    17⤵
                                    • Modifies visiblity of hidden/system files in Explorer
                                    • Executes dropped EXE
                                    • Loads dropped DLL
                                    • Adds Run key to start application
                                    • System Location Discovery: System Language Discovery
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious use of SetWindowsHookEx
                                    PID:2016
                                    • C:\Users\Admin\paivon.exe
                                      "C:\Users\Admin\paivon.exe"
                                      18⤵
                                      • Modifies visiblity of hidden/system files in Explorer
                                      • Executes dropped EXE
                                      • Loads dropped DLL
                                      • Adds Run key to start application
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious behavior: EnumeratesProcesses
                                      • Suspicious use of SetWindowsHookEx
                                      PID:2988
                                      • C:\Users\Admin\vzmaw.exe
                                        "C:\Users\Admin\vzmaw.exe"
                                        19⤵
                                        • Modifies visiblity of hidden/system files in Explorer
                                        • Executes dropped EXE
                                        • Loads dropped DLL
                                        • Adds Run key to start application
                                        • System Location Discovery: System Language Discovery
                                        • Suspicious behavior: EnumeratesProcesses
                                        • Suspicious use of SetWindowsHookEx
                                        PID:2680
                                        • C:\Users\Admin\qeeaxu.exe
                                          "C:\Users\Admin\qeeaxu.exe"
                                          20⤵
                                          • Modifies visiblity of hidden/system files in Explorer
                                          • Executes dropped EXE
                                          • Loads dropped DLL
                                          • Adds Run key to start application
                                          • System Location Discovery: System Language Discovery
                                          • Suspicious behavior: EnumeratesProcesses
                                          • Suspicious use of SetWindowsHookEx
                                          PID:1652
                                          • C:\Users\Admin\woaibo.exe
                                            "C:\Users\Admin\woaibo.exe"
                                            21⤵
                                            • Modifies visiblity of hidden/system files in Explorer
                                            • Executes dropped EXE
                                            • Loads dropped DLL
                                            • Adds Run key to start application
                                            • System Location Discovery: System Language Discovery
                                            • Suspicious behavior: EnumeratesProcesses
                                            • Suspicious use of SetWindowsHookEx
                                            PID:1744
                                            • C:\Users\Admin\xuaira.exe
                                              "C:\Users\Admin\xuaira.exe"
                                              22⤵
                                              • Modifies visiblity of hidden/system files in Explorer
                                              • Executes dropped EXE
                                              • Loads dropped DLL
                                              • Adds Run key to start application
                                              • System Location Discovery: System Language Discovery
                                              • Suspicious behavior: EnumeratesProcesses
                                              • Suspicious use of SetWindowsHookEx
                                              PID:328
                                              • C:\Users\Admin\gookue.exe
                                                "C:\Users\Admin\gookue.exe"
                                                23⤵
                                                • Modifies visiblity of hidden/system files in Explorer
                                                • Executes dropped EXE
                                                • Loads dropped DLL
                                                • Adds Run key to start application
                                                • System Location Discovery: System Language Discovery
                                                • Suspicious behavior: EnumeratesProcesses
                                                • Suspicious use of SetWindowsHookEx
                                                PID:2144
                                                • C:\Users\Admin\mnxor.exe
                                                  "C:\Users\Admin\mnxor.exe"
                                                  24⤵
                                                  • Modifies visiblity of hidden/system files in Explorer
                                                  • Executes dropped EXE
                                                  • Loads dropped DLL
                                                  • Adds Run key to start application
                                                  • System Location Discovery: System Language Discovery
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  • Suspicious use of SetWindowsHookEx
                                                  PID:3016
                                                  • C:\Users\Admin\noegas.exe
                                                    "C:\Users\Admin\noegas.exe"
                                                    25⤵
                                                    • Modifies visiblity of hidden/system files in Explorer
                                                    • Executes dropped EXE
                                                    • Loads dropped DLL
                                                    • Adds Run key to start application
                                                    • System Location Discovery: System Language Discovery
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    • Suspicious use of SetWindowsHookEx
                                                    PID:1532
                                                    • C:\Users\Admin\naemai.exe
                                                      "C:\Users\Admin\naemai.exe"
                                                      26⤵
                                                      • Modifies visiblity of hidden/system files in Explorer
                                                      • Executes dropped EXE
                                                      • Loads dropped DLL
                                                      • Adds Run key to start application
                                                      • System Location Discovery: System Language Discovery
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      • Suspicious use of SetWindowsHookEx
                                                      PID:112
                                                      • C:\Users\Admin\wysiy.exe
                                                        "C:\Users\Admin\wysiy.exe"
                                                        27⤵
                                                        • Modifies visiblity of hidden/system files in Explorer
                                                        • Executes dropped EXE
                                                        • Loads dropped DLL
                                                        • Adds Run key to start application
                                                        • System Location Discovery: System Language Discovery
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        • Suspicious use of SetWindowsHookEx
                                                        PID:2548
                                                        • C:\Users\Admin\zeuew.exe
                                                          "C:\Users\Admin\zeuew.exe"
                                                          28⤵
                                                          • Modifies visiblity of hidden/system files in Explorer
                                                          • Executes dropped EXE
                                                          • Loads dropped DLL
                                                          • Adds Run key to start application
                                                          • System Location Discovery: System Language Discovery
                                                          • Suspicious behavior: EnumeratesProcesses
                                                          • Suspicious use of SetWindowsHookEx
                                                          PID:1612
                                                          • C:\Users\Admin\nouto.exe
                                                            "C:\Users\Admin\nouto.exe"
                                                            29⤵
                                                            • Modifies visiblity of hidden/system files in Explorer
                                                            • Executes dropped EXE
                                                            • Loads dropped DLL
                                                            • Adds Run key to start application
                                                            • System Location Discovery: System Language Discovery
                                                            • Suspicious behavior: EnumeratesProcesses
                                                            • Suspicious use of SetWindowsHookEx
                                                            PID:2440
                                                            • C:\Users\Admin\bfkus.exe
                                                              "C:\Users\Admin\bfkus.exe"
                                                              30⤵
                                                              • Modifies visiblity of hidden/system files in Explorer
                                                              • Executes dropped EXE
                                                              • Loads dropped DLL
                                                              • Adds Run key to start application
                                                              • System Location Discovery: System Language Discovery
                                                              • Suspicious behavior: EnumeratesProcesses
                                                              • Suspicious use of SetWindowsHookEx
                                                              PID:2100
                                                              • C:\Users\Admin\xalud.exe
                                                                "C:\Users\Admin\xalud.exe"
                                                                31⤵
                                                                • Modifies visiblity of hidden/system files in Explorer
                                                                • Executes dropped EXE
                                                                • Loads dropped DLL
                                                                • Adds Run key to start application
                                                                • System Location Discovery: System Language Discovery
                                                                • Suspicious behavior: EnumeratesProcesses
                                                                • Suspicious use of SetWindowsHookEx
                                                                PID:1940
                                                                • C:\Users\Admin\buuive.exe
                                                                  "C:\Users\Admin\buuive.exe"
                                                                  32⤵
                                                                  • Modifies visiblity of hidden/system files in Explorer
                                                                  • Executes dropped EXE
                                                                  • Loads dropped DLL
                                                                  • Adds Run key to start application
                                                                  • System Location Discovery: System Language Discovery
                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                  • Suspicious use of SetWindowsHookEx
                                                                  PID:1748
                                                                  • C:\Users\Admin\naara.exe
                                                                    "C:\Users\Admin\naara.exe"
                                                                    33⤵
                                                                    • Modifies visiblity of hidden/system files in Explorer
                                                                    • Executes dropped EXE
                                                                    • Adds Run key to start application
                                                                    • System Location Discovery: System Language Discovery
                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                    • Suspicious use of SetWindowsHookEx
                                                                    PID:1780
                                                                    • C:\Users\Admin\zbtuiw.exe
                                                                      "C:\Users\Admin\zbtuiw.exe"
                                                                      34⤵
                                                                      • Modifies visiblity of hidden/system files in Explorer
                                                                      • Executes dropped EXE
                                                                      • Adds Run key to start application
                                                                      • System Location Discovery: System Language Discovery
                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                      • Suspicious use of SetWindowsHookEx
                                                                      PID:408
                                                                      • C:\Users\Admin\xaiomul.exe
                                                                        "C:\Users\Admin\xaiomul.exe"
                                                                        35⤵
                                                                        • Modifies visiblity of hidden/system files in Explorer
                                                                        • Executes dropped EXE
                                                                        • Adds Run key to start application
                                                                        • System Location Discovery: System Language Discovery
                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                        • Suspicious use of SetWindowsHookEx
                                                                        PID:1992
                                                                        • C:\Users\Admin\siiguy.exe
                                                                          "C:\Users\Admin\siiguy.exe"
                                                                          36⤵
                                                                          • Modifies visiblity of hidden/system files in Explorer
                                                                          • Executes dropped EXE
                                                                          • Adds Run key to start application
                                                                          • System Location Discovery: System Language Discovery
                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                          • Suspicious use of SetWindowsHookEx
                                                                          PID:1584
                                                                          • C:\Users\Admin\teuxoz.exe
                                                                            "C:\Users\Admin\teuxoz.exe"
                                                                            37⤵
                                                                            • Modifies visiblity of hidden/system files in Explorer
                                                                            • Executes dropped EXE
                                                                            • Adds Run key to start application
                                                                            • System Location Discovery: System Language Discovery
                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                            • Suspicious use of SetWindowsHookEx
                                                                            PID:3052
                                                                            • C:\Users\Admin\waetid.exe
                                                                              "C:\Users\Admin\waetid.exe"
                                                                              38⤵
                                                                              • Modifies visiblity of hidden/system files in Explorer
                                                                              • Executes dropped EXE
                                                                              • Adds Run key to start application
                                                                              • System Location Discovery: System Language Discovery
                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                              • Suspicious use of SetWindowsHookEx
                                                                              PID:2332
                                                                              • C:\Users\Admin\jaiah.exe
                                                                                "C:\Users\Admin\jaiah.exe"
                                                                                39⤵
                                                                                • Modifies visiblity of hidden/system files in Explorer
                                                                                • Executes dropped EXE
                                                                                • Adds Run key to start application
                                                                                • System Location Discovery: System Language Discovery
                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                • Suspicious use of SetWindowsHookEx
                                                                                PID:2224
                                                                                • C:\Users\Admin\wouami.exe
                                                                                  "C:\Users\Admin\wouami.exe"
                                                                                  40⤵
                                                                                  • Modifies visiblity of hidden/system files in Explorer
                                                                                  • Executes dropped EXE
                                                                                  • Adds Run key to start application
                                                                                  • System Location Discovery: System Language Discovery
                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                  PID:2996
                                                                                  • C:\Users\Admin\dauud.exe
                                                                                    "C:\Users\Admin\dauud.exe"
                                                                                    41⤵
                                                                                    • Modifies visiblity of hidden/system files in Explorer
                                                                                    • Executes dropped EXE
                                                                                    • Adds Run key to start application
                                                                                    • System Location Discovery: System Language Discovery
                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                    PID:2776
                                                                                    • C:\Users\Admin\touqoah.exe
                                                                                      "C:\Users\Admin\touqoah.exe"
                                                                                      42⤵
                                                                                      • Modifies visiblity of hidden/system files in Explorer
                                                                                      • Executes dropped EXE
                                                                                      • Adds Run key to start application
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                      PID:1788
                                                                                      • C:\Users\Admin\nialud.exe
                                                                                        "C:\Users\Admin\nialud.exe"
                                                                                        43⤵
                                                                                        • Modifies visiblity of hidden/system files in Explorer
                                                                                        • Executes dropped EXE
                                                                                        • Adds Run key to start application
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                        PID:2084
                                                                                        • C:\Users\Admin\reeiwoq.exe
                                                                                          "C:\Users\Admin\reeiwoq.exe"
                                                                                          44⤵
                                                                                          • Modifies visiblity of hidden/system files in Explorer
                                                                                          • Executes dropped EXE
                                                                                          • Adds Run key to start application
                                                                                          • System Location Discovery: System Language Discovery
                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                          PID:2672
                                                                                          • C:\Users\Admin\jiuaf.exe
                                                                                            "C:\Users\Admin\jiuaf.exe"
                                                                                            45⤵
                                                                                            • Modifies visiblity of hidden/system files in Explorer
                                                                                            • Executes dropped EXE
                                                                                            • Adds Run key to start application
                                                                                            • System Location Discovery: System Language Discovery
                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                            PID:2740
                                                                                            • C:\Users\Admin\puiam.exe
                                                                                              "C:\Users\Admin\puiam.exe"
                                                                                              46⤵
                                                                                              • Modifies visiblity of hidden/system files in Explorer
                                                                                              • Executes dropped EXE
                                                                                              • Adds Run key to start application
                                                                                              • System Location Discovery: System Language Discovery
                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                              PID:2648
                                                                                              • C:\Users\Admin\mxsaiz.exe
                                                                                                "C:\Users\Admin\mxsaiz.exe"
                                                                                                47⤵
                                                                                                • Executes dropped EXE
                                                                                                • System Location Discovery: System Language Discovery
                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                PID:1656

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\caiqia.exe
    Filesize

    124KB

    MD5

    0fc9f913e92f8a8ae6e8bf2f6d877796

    SHA1

    f7cf01476e23b5a6322e4f4846a2b234169e39cd

    SHA256

    3367645f049ddc72d6bca060c0b81d849e010fa0a441c99fae353cea7e027f14

    SHA512

    a10afca267c3cedfa623e2f5c3a9c2f88f1de26d40f4a85a299c1e49ec6f8ffd9547cb076248ee36fc87f5c6a86f7b9cf77e1bc178211c677ae81e1b921c5655

    Download Submit

  • \Users\Admin\faepie.exe
    Filesize

    124KB

    MD5

    f7d3c6be8ed5e46b269577abeac69e23

    SHA1

    d223cdfd5a2b4d95b0bac8c0e859a84551109896

    SHA256

    b47d81c27f2014d5d91c17afb2ebf7533900a6b6b2e6553b273e72cd35690ef1

    SHA512

    e77ca2e85f0e602e90c53207fa620a4041605e4b96504d83890731f7a872cdb7f772de37f3ed15c388db5336390c8a5d8a0b3e202697d7d3d5639546e272b9ea

    Download Submit

  • \Users\Admin\gemik.exe
    Filesize

    124KB

    MD5

    59e0386dcc033373c00fd676e804280c

    SHA1

    c8c58e00ee192a36366fac8f714937982a8ba282

    SHA256

    7a3c66abf352cf5608c040178f6838716330ec6e343f6a0fcd6e6e9aeb188c9a

    SHA512

    1c3c2d5a1a34138703b22cf67df1963b39fe8a11b8495c4ab624fc755f6d4b71e0514ca267c6084e00306335dc3714ebac649ef6ada3aacca4ef6b8ecae7e859

    Download Submit

  • \Users\Admin\hooaqe.exe
    Filesize

    124KB

    MD5

    9bc5df69e8c2e70e51b92c2fca6904c7

    SHA1

    1ae85d51b8c5b5a8e77ce48d5bbc228535aa6893

    SHA256

    50b782a66931af2fdcdbb26b4ff16f85da1a297a39d2e7db217858cc18ddd4f4

    SHA512

    fb32fc1d449f483d5daf9fc0fc15f410f0ac970816f576b6155d53e377e4de0bff1bc58effe4297a3d50de6c34d23931cd85c33f531f3fa4b346e310471254e7

    Download Submit

  • \Users\Admin\jeucie.exe
    Filesize

    124KB

    MD5

    6b4238d0c833e670476338a980cb74f9

    SHA1

    0baa7ef8021bcb867b99dea7f57ddb23e39aa293

    SHA256

    8e8a95eb2d09a30ebfdded04b960c2718aed89b2357e9eb98006c6e8ed45cb65

    SHA512

    c5bd163b1a30c6c41b2579c91257022db498a53f18b50981608c18261cb3735c4d19137e044d8035cefab0b6c7ff3ed358126cafb837237c52fb5a76a4326385

    Download Submit

  • \Users\Admin\juhes.exe
    Filesize

    124KB

    MD5

    bf417f1e3063a1894ca678b042a2e8ae

    SHA1

    1f3342eb2d521a58b377036f4da5475aa363eb53

    SHA256

    e5009a7d526ae1a9e6eb204b709652720c4c13ed8e5eb906093139a77024ed8d

    SHA512

    9d0b0c4b5b483979222f242a6746bee0129a7f0c44c113889bd052d955c02d472189e9462db0d647324c9b0a2cb2036cc365bba140a498029b99f9162297a551

    Download Submit

  • \Users\Admin\koibal.exe
    Filesize

    124KB

    MD5

    55013be6df37b51a760656938e992585

    SHA1

    62cfe961b05e18f46514f1cb00e315db48a1ec3a

    SHA256

    73d4ab0fd302284d117f185b69e1f17b5b139824009b8e2b3e729efe3fbbe4e8

    SHA512

    dbc9d6406f4907f3c92a49014df125a7a0cf3679b6d40e0ec694f6e8e4fe8370d6e185fcc976699ca2a7e5fff73e1d89724f0e81b721d854aa8a789a0734fb92

    Download Submit

  • \Users\Admin\muiqeo.exe
    Filesize

    124KB

    MD5

    0e19cfe0932ecfeb416119e2b49997bb

    SHA1

    d09d96f1f6407f7460f54690d583665aecef07a2

    SHA256

    01df27b6b9906f30ae9cd65fa134d087e1abca7a14eee3a619a706e1b876fbf4

    SHA512

    0d3d533c2961f55f8f4aec2b6bba7619d06648c06dcadf6a515d98301931af6b2811107c685b2129631a262a10944fa996f0f9962490c9eacebde3a039c1d5e1

    Download Submit

  • \Users\Admin\qvpuz.exe
    Filesize

    124KB

    MD5

    4f1f52f54c03425cb60a78ca759a75c1

    SHA1

    d0bb316337590133c60a9c2b132085baccf29712

    SHA256

    7f1ef963e20194529743f669ec3f00118443ba33fef54a58bc065bf454500431

    SHA512

    33d03193011b7171273f1095392e0ba70d0934d9f41fb8f3537c5f805822197c2c36ebc7e80e202bbbd7c73c2718cf6fb9b2cde197deff6ecf95731df8bca432

    Download Submit

  • \Users\Admin\riasa.exe
    Filesize

    124KB

    MD5

    fc8dd46caf83045b50fdcab68c7be398

    SHA1

    b26f382324934a5cb609168287cb4c1938140ae3

    SHA256

    36ae581509321a44fd9d5b8a0ca338c2bd8daf9125298ce5fc6613cad2f468c7

    SHA512

    e446e6c314926e5d105548cc8d66550bfd9ea6a868a823185d7a5472d2a56173e2824d810906ea215d66e6a6c14506dc806623815a3921894f045f4ad84300b6

    Download Submit

  • \Users\Admin\taiefi.exe
    Filesize

    124KB

    MD5

    0108dfec0dd253e4bdcb66b44ce8cbca

    SHA1

    cfbdb3fb161b11c519a4fe9b3faf2037b00af2bc

    SHA256

    8c7cb3f9ea2867cbb25d4370063d4b5d041543811d4ddb9df252e5e44f0a7017

    SHA512

    753563551160dd1976ca85551abfb01a54b52cafc6a1f306038e1fcca72dedc67ea9dcb9ce08db5257db7b81c4c4972bed25d572520a0e8cd126692559c30d47

    Download Submit

  • \Users\Admin\ttvuov.exe
    Filesize

    124KB

    MD5

    87dcf07e46b1e298c604a77a9db73370

    SHA1

    8342791d4018ae89e03c73ae2154d538bf6c898d

    SHA256

    7144ce8555dc5950041c24da50e7c9d584c76d4080578b09aefb25e740429b76

    SHA512

    23dc1a6db151c89651b9fb4022e6ea77f6dd5a0ba66d3f7a1c12ec90f2982ecfb4e23641852cd1b300a4adfd7be49fc95fbbd70412cd64dcaf36135c9f226cb0

    Download Submit

  • \Users\Admin\vumuq.exe
    Filesize

    124KB

    MD5

    cad68217366c692356d97e664ef984c8

    SHA1

    6360a3dd2eb3408849fc831ec7d74445f03cb586

    SHA256

    d0306911b6096f1e2399b2917e2355b3eeed4ffb17dc9121fd24c9be456a0451

    SHA512

    4b9751b2e8247ea711a14f7a613bef676163262dcfc2d6dbafddd5625183f9ebdae0101d0e0f581806b6772d0de5f1c4e0a7a3e889558120398e5790eccbca21

    Download Submit

  • \Users\Admin\wzbuc.exe
    Filesize

    124KB

    MD5

    4cbb47ac4bb2c57ba333fd93fc5bc7b1

    SHA1

    dad3a8724c5491bc148a55dfd16c63840be4baf4

    SHA256

    aaf1e3c4cea682d25795a955ef04f8642f98c79bc7771744c39a45bd5ac08a27

    SHA512

    6284d5d21cab89acd959c6d3541a4642a15bee7cd1f94276693e66bfd03f070db0e03acde20e860d8eec1779de94995de5d7cff53152834333bca8331db87798

    Download Submit

  • \Users\Admin\xooadu.exe
    Filesize

    124KB

    MD5

    64b88ff457edf3d274ceab4425ba5475

    SHA1

    2ff9615757a6b391438b23eac506216519286e0e

    SHA256

    c5f370ae903573ed7115ccd8e35ed53c9a2a2663f1f7187540b5478f8eccab69

    SHA512

    bdc06fca1a05af14f7545753c4d089bc90885045d1ef275fc31b44343398e6414645b8c97f17d1890c16b645dc09f44b29dd8c294e3934b70cfc67419ab9ceb2

    Download Submit

  • \Users\Admin\zrnoev.exe
    Filesize

    124KB

    MD5

    a8dbe68ec67c51278b22678a2630d643

    SHA1

    6095235e89484458a598798865637c0008150372

    SHA256

    0410963d580683a04580bbc7d8cc5a7e9513eca20d6114396a6e7a120facca3e

    SHA512

    8744c92da4f47af759b45439651f77c8b4ce47e64831d9347403a5bea731a40d131b0faf94c762b4801ad03bcafdb4cc502114af4e3390a77dc39fc3e8fa6f27

    Download Submit