Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
15-12-2024 08:15
Behavioral task
behavioral1
Sample
20e134cef5baf4c883e4471e2c98976b.exe
Resource
win7-20240903-en
windows7-x64
25 signatures
150 seconds
General
-
Target
20e134cef5baf4c883e4471e2c98976b.exe
-
Size
611KB
-
MD5
20e134cef5baf4c883e4471e2c98976b
-
SHA1
bb8a8eb0c5d5ae0dce8ca5b24257a12ca1783468
-
SHA256
bef42fdae71eff14767b54c660a42d7ab6fedf56ce74f8faa304a0e1b526fe4a
-
SHA512
a8a4fad73071b5d7e81076deaaed38f33ed2b59571d14d0a6ed1b66713b31459fed0113c87258919575aea32970c7b30f0b82d709bde0569b0768b3ab97ac8aa
-
SSDEEP
12288:/FpuzZSkcBNrl5mTEUkDaSdJfpSaoNRVBUyMCe8VMM80B7qrI3iK1XBwZQ:/FmShDrngEUkDaiJfpSaoNRpMCe8CM8T
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/828-1-0x0000000010000000-0x000000001019F000-memory.dmp purplefox_rootkit behavioral1/memory/828-21-0x0000000000400000-0x0000000000585000-memory.dmp purplefox_rootkit behavioral1/memory/2480-19-0x0000000001150000-0x00000000012D5000-memory.dmp purplefox_rootkit behavioral1/memory/2480-24-0x0000000000400000-0x0000000000585000-memory.dmp purplefox_rootkit behavioral1/memory/2424-40-0x0000000000400000-0x0000000000585000-memory.dmp purplefox_rootkit behavioral1/memory/376-66-0x0000000010000000-0x00000000101D0000-memory.dmp purplefox_rootkit behavioral1/memory/376-67-0x0000000010000000-0x00000000101D0000-memory.dmp purplefox_rootkit behavioral1/memory/376-65-0x0000000010000000-0x00000000101D0000-memory.dmp purplefox_rootkit behavioral1/memory/376-64-0x0000000010000000-0x00000000101D0000-memory.dmp purplefox_rootkit behavioral1/memory/3008-77-0x0000000010000000-0x00000000101D0000-memory.dmp purplefox_rootkit behavioral1/memory/2272-85-0x0000000010000000-0x00000000101D0000-memory.dmp purplefox_rootkit behavioral1/memory/2272-86-0x0000000010000000-0x00000000101D0000-memory.dmp purplefox_rootkit behavioral1/memory/2272-90-0x0000000010000000-0x00000000101D0000-memory.dmp purplefox_rootkit behavioral1/memory/2272-92-0x0000000010000000-0x00000000101D0000-memory.dmp purplefox_rootkit behavioral1/memory/2272-94-0x0000000010000000-0x00000000101D0000-memory.dmp purplefox_rootkit -
Gh0st RAT payload 15 IoCs
resource yara_rule behavioral1/memory/828-1-0x0000000010000000-0x000000001019F000-memory.dmp family_gh0strat behavioral1/memory/828-21-0x0000000000400000-0x0000000000585000-memory.dmp family_gh0strat behavioral1/memory/2480-19-0x0000000001150000-0x00000000012D5000-memory.dmp family_gh0strat behavioral1/memory/2480-24-0x0000000000400000-0x0000000000585000-memory.dmp family_gh0strat behavioral1/memory/2424-40-0x0000000000400000-0x0000000000585000-memory.dmp family_gh0strat behavioral1/memory/376-66-0x0000000010000000-0x00000000101D0000-memory.dmp family_gh0strat behavioral1/memory/376-67-0x0000000010000000-0x00000000101D0000-memory.dmp family_gh0strat behavioral1/memory/376-65-0x0000000010000000-0x00000000101D0000-memory.dmp family_gh0strat behavioral1/memory/376-64-0x0000000010000000-0x00000000101D0000-memory.dmp family_gh0strat behavioral1/memory/3008-77-0x0000000010000000-0x00000000101D0000-memory.dmp family_gh0strat behavioral1/memory/2272-85-0x0000000010000000-0x00000000101D0000-memory.dmp family_gh0strat behavioral1/memory/2272-86-0x0000000010000000-0x00000000101D0000-memory.dmp family_gh0strat behavioral1/memory/2272-90-0x0000000010000000-0x00000000101D0000-memory.dmp family_gh0strat behavioral1/memory/2272-92-0x0000000010000000-0x00000000101D0000-memory.dmp family_gh0strat behavioral1/memory/2272-94-0x0000000010000000-0x00000000101D0000-memory.dmp family_gh0strat -
Gh0strat family
-
Purplefox family
-
Downloads MZ/PE file
-
Drops file in Drivers directory 1 IoCs
description ioc Process File created C:\Windows\system32\drivers\QAssist.sys Mnfvn.exe -
Sets service image path in registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys" Mnfvn.exe -
Deletes itself 1 IoCs
pid Process 2900 cmd.exe -
Executes dropped EXE 5 IoCs
pid Process 2480 Mnfvn.exe 2424 Mnfvn.exe 376 svchot.exe 3008 Skcsk.exe 2272 Skcsk.exe -
Loads dropped DLL 2 IoCs
pid Process 2480 Mnfvn.exe 2424 Mnfvn.exe -
Enumerates connected drives 3 TTPs 44 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\N: Mnfvn.exe File opened (read-only) \??\T: Mnfvn.exe File opened (read-only) \??\R: Skcsk.exe File opened (read-only) \??\U: Skcsk.exe File opened (read-only) \??\G: Mnfvn.exe File opened (read-only) \??\L: Mnfvn.exe File opened (read-only) \??\S: Mnfvn.exe File opened (read-only) \??\B: Skcsk.exe File opened (read-only) \??\G: Skcsk.exe File opened (read-only) \??\P: Skcsk.exe File opened (read-only) \??\S: Skcsk.exe File opened (read-only) \??\I: Mnfvn.exe File opened (read-only) \??\M: Mnfvn.exe File opened (read-only) \??\Q: Mnfvn.exe File opened (read-only) \??\W: Mnfvn.exe File opened (read-only) \??\K: Skcsk.exe File opened (read-only) \??\O: Skcsk.exe File opened (read-only) \??\V: Skcsk.exe File opened (read-only) \??\N: Skcsk.exe File opened (read-only) \??\H: Mnfvn.exe File opened (read-only) \??\P: Mnfvn.exe File opened (read-only) \??\R: Mnfvn.exe File opened (read-only) \??\V: Mnfvn.exe File opened (read-only) \??\Y: Mnfvn.exe File opened (read-only) \??\J: Skcsk.exe File opened (read-only) \??\M: Skcsk.exe File opened (read-only) \??\E: Mnfvn.exe File opened (read-only) \??\X: Mnfvn.exe File opened (read-only) \??\Z: Mnfvn.exe File opened (read-only) \??\L: Skcsk.exe File opened (read-only) \??\X: Skcsk.exe File opened (read-only) \??\B: Mnfvn.exe File opened (read-only) \??\J: Mnfvn.exe File opened (read-only) \??\K: Mnfvn.exe File opened (read-only) \??\U: Mnfvn.exe File opened (read-only) \??\I: Skcsk.exe File opened (read-only) \??\E: Skcsk.exe File opened (read-only) \??\Q: Skcsk.exe File opened (read-only) \??\T: Skcsk.exe File opened (read-only) \??\Z: Skcsk.exe File opened (read-only) \??\O: Mnfvn.exe File opened (read-only) \??\H: Skcsk.exe File opened (read-only) \??\W: Skcsk.exe File opened (read-only) \??\Y: Skcsk.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\Mnfvn.exe 20e134cef5baf4c883e4471e2c98976b.exe File opened for modification C:\Windows\SysWOW64\Mnfvn.exe 20e134cef5baf4c883e4471e2c98976b.exe -
resource yara_rule behavioral1/memory/828-0-0x0000000000400000-0x0000000000585000-memory.dmp upx behavioral1/files/0x000b000000012263-9.dat upx behavioral1/memory/828-21-0x0000000000400000-0x0000000000585000-memory.dmp upx behavioral1/memory/2480-24-0x0000000000400000-0x0000000000585000-memory.dmp upx behavioral1/memory/2424-40-0x0000000000400000-0x0000000000585000-memory.dmp upx behavioral1/memory/376-66-0x0000000010000000-0x00000000101D0000-memory.dmp upx behavioral1/memory/376-67-0x0000000010000000-0x00000000101D0000-memory.dmp upx behavioral1/memory/376-65-0x0000000010000000-0x00000000101D0000-memory.dmp upx behavioral1/memory/376-64-0x0000000010000000-0x00000000101D0000-memory.dmp upx behavioral1/memory/376-62-0x0000000010000000-0x00000000101D0000-memory.dmp upx behavioral1/memory/3008-77-0x0000000010000000-0x00000000101D0000-memory.dmp upx behavioral1/memory/2272-85-0x0000000010000000-0x00000000101D0000-memory.dmp upx behavioral1/memory/2272-86-0x0000000010000000-0x00000000101D0000-memory.dmp upx behavioral1/memory/2272-90-0x0000000010000000-0x00000000101D0000-memory.dmp upx behavioral1/memory/2272-92-0x0000000010000000-0x00000000101D0000-memory.dmp upx behavioral1/memory/2272-94-0x0000000010000000-0x00000000101D0000-memory.dmp upx -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files\Skcsk.exe svchot.exe File opened for modification C:\Program Files\Skcsk.exe svchot.exe -
System Location Discovery: System Language Discovery 1 TTPs 10 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 20e134cef5baf4c883e4471e2c98976b.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mnfvn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Skcsk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mnfvn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchot.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Skcsk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 4 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 832 cmd.exe 2136 PING.EXE 2900 cmd.exe 2824 PING.EXE -
Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz Mnfvn.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Skcsk.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz Skcsk.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Mnfvn.exe -
Modifies data under HKEY_USERS 31 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum Mnfvn.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\ActiveMovie\devenum Mnfvn.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 Mnfvn.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" Mnfvn.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{6D5B2E2E-025E-4641-932A-3A05614DE0B5}\WpadNetworkName = "Network 3" Mnfvn.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\ActiveMovie\devenum\Version = "7" Mnfvn.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ea-e3-b1-bc-a8-e0 Mnfvn.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{6D5B2E2E-025E-4641-932A-3A05614DE0B5}\ea-e3-b1-bc-a8-e0 Mnfvn.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" Mnfvn.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{6D5B2E2E-025E-4641-932A-3A05614DE0B5} Mnfvn.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{6D5B2E2E-025E-4641-932A-3A05614DE0B5}\WpadDecisionTime = c054c0c6c94edb01 Mnfvn.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{6D5B2E2E-025E-4641-932A-3A05614DE0B5}\WpadDecision = "0" Mnfvn.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 Mnfvn.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ Mnfvn.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{6D5B2E2E-025E-4641-932A-3A05614DE0B5}\WpadDecisionReason = "1" Mnfvn.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ea-e3-b1-bc-a8-e0\WpadDecision = "0" Mnfvn.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix Mnfvn.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft Mnfvn.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad Mnfvn.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections Mnfvn.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings Mnfvn.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0070000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 Mnfvn.exe Key created \REGISTRY\USER\.DEFAULT\Software Mnfvn.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\ActiveMovie Mnfvn.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" Mnfvn.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ea-e3-b1-bc-a8-e0\WpadDecisionTime = c054c0c6c94edb01 Mnfvn.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" Mnfvn.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings Mnfvn.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" Mnfvn.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ea-e3-b1-bc-a8-e0\WpadDecisionReason = "1" Mnfvn.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\DWM\SuppressDisableCompositionUI = "1" Skcsk.exe -
Runs ping.exe 1 TTPs 2 IoCs
pid Process 2824 PING.EXE 2136 PING.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2424 Mnfvn.exe 2424 Mnfvn.exe 2424 Mnfvn.exe 2424 Mnfvn.exe 2424 Mnfvn.exe 2424 Mnfvn.exe 2424 Mnfvn.exe 2424 Mnfvn.exe 2424 Mnfvn.exe 2424 Mnfvn.exe 2424 Mnfvn.exe 2424 Mnfvn.exe 2424 Mnfvn.exe 2424 Mnfvn.exe 2424 Mnfvn.exe 2424 Mnfvn.exe 2424 Mnfvn.exe 2424 Mnfvn.exe 2424 Mnfvn.exe 2424 Mnfvn.exe 2424 Mnfvn.exe 2424 Mnfvn.exe 2424 Mnfvn.exe 2424 Mnfvn.exe 2424 Mnfvn.exe 2424 Mnfvn.exe 2424 Mnfvn.exe 2424 Mnfvn.exe 2424 Mnfvn.exe 2424 Mnfvn.exe 2424 Mnfvn.exe 2424 Mnfvn.exe 2424 Mnfvn.exe 2272 Skcsk.exe 2272 Skcsk.exe 2272 Skcsk.exe 2272 Skcsk.exe 2272 Skcsk.exe 2272 Skcsk.exe 2272 Skcsk.exe 2272 Skcsk.exe 2272 Skcsk.exe 2272 Skcsk.exe 2272 Skcsk.exe 2272 Skcsk.exe 2272 Skcsk.exe 2272 Skcsk.exe 2272 Skcsk.exe 2272 Skcsk.exe 2272 Skcsk.exe 2272 Skcsk.exe 2272 Skcsk.exe 2272 Skcsk.exe 2272 Skcsk.exe 2272 Skcsk.exe 2272 Skcsk.exe 2272 Skcsk.exe 2272 Skcsk.exe 2272 Skcsk.exe 2272 Skcsk.exe 2272 Skcsk.exe 2272 Skcsk.exe 2272 Skcsk.exe 2272 Skcsk.exe -
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 2424 Mnfvn.exe -
Suspicious use of AdjustPrivilegeToken 7 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 828 20e134cef5baf4c883e4471e2c98976b.exe Token: SeLoadDriverPrivilege 2424 Mnfvn.exe Token: 33 2424 Mnfvn.exe Token: SeIncBasePriorityPrivilege 2424 Mnfvn.exe Token: 33 2424 Mnfvn.exe Token: SeIncBasePriorityPrivilege 2424 Mnfvn.exe Token: SeIncBasePriorityPrivilege 376 svchot.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 2480 wrote to memory of 2424 2480 Mnfvn.exe 33 PID 2480 wrote to memory of 2424 2480 Mnfvn.exe 33 PID 2480 wrote to memory of 2424 2480 Mnfvn.exe 33 PID 2480 wrote to memory of 2424 2480 Mnfvn.exe 33 PID 828 wrote to memory of 2900 828 20e134cef5baf4c883e4471e2c98976b.exe 32 PID 828 wrote to memory of 2900 828 20e134cef5baf4c883e4471e2c98976b.exe 32 PID 828 wrote to memory of 2900 828 20e134cef5baf4c883e4471e2c98976b.exe 32 PID 828 wrote to memory of 2900 828 20e134cef5baf4c883e4471e2c98976b.exe 32 PID 2900 wrote to memory of 2824 2900 cmd.exe 35 PID 2900 wrote to memory of 2824 2900 cmd.exe 35 PID 2900 wrote to memory of 2824 2900 cmd.exe 35 PID 2900 wrote to memory of 2824 2900 cmd.exe 35 PID 2424 wrote to memory of 376 2424 Mnfvn.exe 37 PID 2424 wrote to memory of 376 2424 Mnfvn.exe 37 PID 2424 wrote to memory of 376 2424 Mnfvn.exe 37 PID 2424 wrote to memory of 376 2424 Mnfvn.exe 37 PID 376 wrote to memory of 832 376 svchot.exe 39 PID 376 wrote to memory of 832 376 svchot.exe 39 PID 376 wrote to memory of 832 376 svchot.exe 39 PID 376 wrote to memory of 832 376 svchot.exe 39 PID 3008 wrote to memory of 2272 3008 Skcsk.exe 41 PID 3008 wrote to memory of 2272 3008 Skcsk.exe 41 PID 3008 wrote to memory of 2272 3008 Skcsk.exe 41 PID 3008 wrote to memory of 2272 3008 Skcsk.exe 41 PID 832 wrote to memory of 2136 832 cmd.exe 42 PID 832 wrote to memory of 2136 832 cmd.exe 42 PID 832 wrote to memory of 2136 832 cmd.exe 42 PID 832 wrote to memory of 2136 832 cmd.exe 42
Processes
-
C:\Users\Admin\AppData\Local\Temp\20e134cef5baf4c883e4471e2c98976b.exe"C:\Users\Admin\AppData\Local\Temp\20e134cef5baf4c883e4471e2c98976b.exe"1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:828 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\20E134~1.EXE > nul2⤵
- Deletes itself
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
PID:2900 -
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.13⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:2824
-
-
-
C:\Windows\SysWOW64\Mnfvn.exeC:\Windows\SysWOW64\Mnfvn.exe -auto1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2480 -
C:\Windows\SysWOW64\Mnfvn.exeC:\Windows\SysWOW64\Mnfvn.exe -acsi2⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2424 -
C:\Users\Admin\AppData\Local\Temp\svchot.exeC:\Users\Admin\AppData\Local\Temp\svchot.exe3⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:376 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\svchot.exe > nul4⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
PID:832 -
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.15⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:2136
-
-
-
-
-
C:\Program Files\Skcsk.exe"C:\\Program Files\\Skcsk.exe" -auto1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3008 -
C:\Program Files\Skcsk.exe"C:\Program Files\Skcsk.exe" -acsi2⤵
- Executes dropped EXE
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:2272
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
611KB
MD520e134cef5baf4c883e4471e2c98976b
SHA1bb8a8eb0c5d5ae0dce8ca5b24257a12ca1783468
SHA256bef42fdae71eff14767b54c660a42d7ab6fedf56ce74f8faa304a0e1b526fe4a
SHA512a8a4fad73071b5d7e81076deaaed38f33ed2b59571d14d0a6ed1b66713b31459fed0113c87258919575aea32970c7b30f0b82d709bde0569b0768b3ab97ac8aa
-
Filesize
491KB
MD5e11f7015e74102c6a2abe27434e7b9d7
SHA1485652878fea0efaf7b843dac4707b0f34cb6b68
SHA25601bc8af53338ddf735e744e947c659477b275854a25d3a64edf4fa092b4a5004
SHA512a2f2c47156077c9f8b9ecb63cd333e9254492babccd01315f138a6bb62efd1e8804990e452f187bea25cbde8dd183325c74205839a7705f0505682b78066b7f3