Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
62s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
25/12/2024, 18:14
Static task
static1
Behavioral task
behavioral1
Sample
362bf1701d3e5dfc90f87ffccbc14225618d2c817ed77a44ebffcb7c91ae1113.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
362bf1701d3e5dfc90f87ffccbc14225618d2c817ed77a44ebffcb7c91ae1113.exe
Resource
win10v2004-20241007-en
General
-
Target
362bf1701d3e5dfc90f87ffccbc14225618d2c817ed77a44ebffcb7c91ae1113.exe
-
Size
344KB
-
MD5
36c4f06310842c369f5e649c5f28ab3f
-
SHA1
eeef64413d08d86cc70600fe79d7794024bd3c8e
-
SHA256
362bf1701d3e5dfc90f87ffccbc14225618d2c817ed77a44ebffcb7c91ae1113
-
SHA512
82b7910864aeb226d5d0d3f6ae6ff981d92263fac1b921b3ed2ee9b05a3c9c6b1f075af6410941f0dd3d75c6419d8cfd7fc2d83f9ae4630528317fd38bd61fa7
-
SSDEEP
6144:km1+IhWCpX2/mnbzvdLaD6OkPgl6bmIjlQF1:klxCpXImbzQD6OkPgl6bmIjK1
Malware Config
Extracted
berbew
http://tat-neftbank.ru/kkq.php
http://tat-neftbank.ru/wcmd.htm
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 24 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Kpgionie.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jcqlkjae.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jfohgepi.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jlqjkk32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Klcgpkhh.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kdnkdmec.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Khldkllj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jlqjkk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Klcgpkhh.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kablnadm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Khldkllj.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kpgionie.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Kkojbf32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kkojbf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" 362bf1701d3e5dfc90f87ffccbc14225618d2c817ed77a44ebffcb7c91ae1113.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jikhnaao.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jabponba.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jfohgepi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Kdnkdmec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Kablnadm.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad 362bf1701d3e5dfc90f87ffccbc14225618d2c817ed77a44ebffcb7c91ae1113.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jikhnaao.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jabponba.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jcqlkjae.exe -
Berbew family
-
Executes dropped EXE 12 IoCs
pid Process 2376 Jikhnaao.exe 2776 Jabponba.exe 2708 Jcqlkjae.exe 2868 Jfohgepi.exe 2644 Jlqjkk32.exe 1004 Klcgpkhh.exe 1872 Kdnkdmec.exe 1680 Kablnadm.exe 1932 Khldkllj.exe 448 Kpgionie.exe 2948 Kkojbf32.exe 2136 Lbjofi32.exe -
Loads dropped DLL 28 IoCs
pid Process 2188 362bf1701d3e5dfc90f87ffccbc14225618d2c817ed77a44ebffcb7c91ae1113.exe 2188 362bf1701d3e5dfc90f87ffccbc14225618d2c817ed77a44ebffcb7c91ae1113.exe 2376 Jikhnaao.exe 2376 Jikhnaao.exe 2776 Jabponba.exe 2776 Jabponba.exe 2708 Jcqlkjae.exe 2708 Jcqlkjae.exe 2868 Jfohgepi.exe 2868 Jfohgepi.exe 2644 Jlqjkk32.exe 2644 Jlqjkk32.exe 1004 Klcgpkhh.exe 1004 Klcgpkhh.exe 1872 Kdnkdmec.exe 1872 Kdnkdmec.exe 1680 Kablnadm.exe 1680 Kablnadm.exe 1932 Khldkllj.exe 1932 Khldkllj.exe 448 Kpgionie.exe 448 Kpgionie.exe 2948 Kkojbf32.exe 2948 Kkojbf32.exe 1648 WerFault.exe 1648 WerFault.exe 1648 WerFault.exe 1648 WerFault.exe -
Drops file in System32 directory 36 IoCs
description ioc Process File created C:\Windows\SysWOW64\Jabponba.exe Jikhnaao.exe File opened for modification C:\Windows\SysWOW64\Jabponba.exe Jikhnaao.exe File created C:\Windows\SysWOW64\Jcqlkjae.exe Jabponba.exe File created C:\Windows\SysWOW64\Qmeedp32.dll 362bf1701d3e5dfc90f87ffccbc14225618d2c817ed77a44ebffcb7c91ae1113.exe File opened for modification C:\Windows\SysWOW64\Jcqlkjae.exe Jabponba.exe File created C:\Windows\SysWOW64\Cmojeo32.dll Jabponba.exe File created C:\Windows\SysWOW64\Qmgaio32.dll Jcqlkjae.exe File opened for modification C:\Windows\SysWOW64\Jlqjkk32.exe Jfohgepi.exe File opened for modification C:\Windows\SysWOW64\Khldkllj.exe Kablnadm.exe File created C:\Windows\SysWOW64\Eghoka32.dll Kablnadm.exe File created C:\Windows\SysWOW64\Kpgionie.exe Khldkllj.exe File created C:\Windows\SysWOW64\Ipafocdg.dll Kkojbf32.exe File created C:\Windows\SysWOW64\Jikhnaao.exe 362bf1701d3e5dfc90f87ffccbc14225618d2c817ed77a44ebffcb7c91ae1113.exe File created C:\Windows\SysWOW64\Lbjofi32.exe Kkojbf32.exe File created C:\Windows\SysWOW64\Jfohgepi.exe Jcqlkjae.exe File opened for modification C:\Windows\SysWOW64\Lbjofi32.exe Kkojbf32.exe File opened for modification C:\Windows\SysWOW64\Jikhnaao.exe 362bf1701d3e5dfc90f87ffccbc14225618d2c817ed77a44ebffcb7c91ae1113.exe File created C:\Windows\SysWOW64\Khldkllj.exe Kablnadm.exe File created C:\Windows\SysWOW64\Jbdhhp32.dll Khldkllj.exe File created C:\Windows\SysWOW64\Kkojbf32.exe Kpgionie.exe File created C:\Windows\SysWOW64\Klcgpkhh.exe Jlqjkk32.exe File created C:\Windows\SysWOW64\Jlqjkk32.exe Jfohgepi.exe File created C:\Windows\SysWOW64\Biklma32.dll Jfohgepi.exe File opened for modification C:\Windows\SysWOW64\Klcgpkhh.exe Jlqjkk32.exe File created C:\Windows\SysWOW64\Mmofpf32.dll Jlqjkk32.exe File created C:\Windows\SysWOW64\Kdnkdmec.exe Klcgpkhh.exe File created C:\Windows\SysWOW64\Caefjg32.dll Klcgpkhh.exe File created C:\Windows\SysWOW64\Kablnadm.exe Kdnkdmec.exe File created C:\Windows\SysWOW64\Oiahkhpo.dll Jikhnaao.exe File opened for modification C:\Windows\SysWOW64\Kpgionie.exe Khldkllj.exe File created C:\Windows\SysWOW64\Gffdobll.dll Kpgionie.exe File created C:\Windows\SysWOW64\Kjpndcho.dll Kdnkdmec.exe File opened for modification C:\Windows\SysWOW64\Kdnkdmec.exe Klcgpkhh.exe File opened for modification C:\Windows\SysWOW64\Kablnadm.exe Kdnkdmec.exe File opened for modification C:\Windows\SysWOW64\Kkojbf32.exe Kpgionie.exe File opened for modification C:\Windows\SysWOW64\Jfohgepi.exe Jcqlkjae.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 1648 2136 WerFault.exe 41 -
System Location Discovery: System Language Discovery 1 TTPs 13 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Khldkllj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kkojbf32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lbjofi32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 362bf1701d3e5dfc90f87ffccbc14225618d2c817ed77a44ebffcb7c91ae1113.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jabponba.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jlqjkk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Klcgpkhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kablnadm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kpgionie.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jikhnaao.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jcqlkjae.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jfohgepi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kdnkdmec.exe -
Modifies registry class 39 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Kpgionie.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Kpgionie.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738} 362bf1701d3e5dfc90f87ffccbc14225618d2c817ed77a44ebffcb7c91ae1113.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Jfohgepi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Jlqjkk32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node 362bf1701d3e5dfc90f87ffccbc14225618d2c817ed77a44ebffcb7c91ae1113.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Jfohgepi.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Kdnkdmec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Jabponba.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qmgaio32.dll" Jcqlkjae.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kjpndcho.dll" Kdnkdmec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Kablnadm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jbdhhp32.dll" Khldkllj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 362bf1701d3e5dfc90f87ffccbc14225618d2c817ed77a44ebffcb7c91ae1113.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID 362bf1701d3e5dfc90f87ffccbc14225618d2c817ed77a44ebffcb7c91ae1113.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oiahkhpo.dll" Jikhnaao.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Jikhnaao.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Jabponba.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gffdobll.dll" Kpgionie.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Kkojbf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" 362bf1701d3e5dfc90f87ffccbc14225618d2c817ed77a44ebffcb7c91ae1113.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Caefjg32.dll" Klcgpkhh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Khldkllj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Klcgpkhh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Kdnkdmec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Khldkllj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Jcqlkjae.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Biklma32.dll" Jfohgepi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mmofpf32.dll" Jlqjkk32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Jcqlkjae.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Jlqjkk32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Klcgpkhh.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Kablnadm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eghoka32.dll" Kablnadm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qmeedp32.dll" 362bf1701d3e5dfc90f87ffccbc14225618d2c817ed77a44ebffcb7c91ae1113.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Jikhnaao.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cmojeo32.dll" Jabponba.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Kkojbf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ipafocdg.dll" Kkojbf32.exe -
Suspicious use of WriteProcessMemory 52 IoCs
description pid Process procid_target PID 2188 wrote to memory of 2376 2188 362bf1701d3e5dfc90f87ffccbc14225618d2c817ed77a44ebffcb7c91ae1113.exe 30 PID 2188 wrote to memory of 2376 2188 362bf1701d3e5dfc90f87ffccbc14225618d2c817ed77a44ebffcb7c91ae1113.exe 30 PID 2188 wrote to memory of 2376 2188 362bf1701d3e5dfc90f87ffccbc14225618d2c817ed77a44ebffcb7c91ae1113.exe 30 PID 2188 wrote to memory of 2376 2188 362bf1701d3e5dfc90f87ffccbc14225618d2c817ed77a44ebffcb7c91ae1113.exe 30 PID 2376 wrote to memory of 2776 2376 Jikhnaao.exe 31 PID 2376 wrote to memory of 2776 2376 Jikhnaao.exe 31 PID 2376 wrote to memory of 2776 2376 Jikhnaao.exe 31 PID 2376 wrote to memory of 2776 2376 Jikhnaao.exe 31 PID 2776 wrote to memory of 2708 2776 Jabponba.exe 32 PID 2776 wrote to memory of 2708 2776 Jabponba.exe 32 PID 2776 wrote to memory of 2708 2776 Jabponba.exe 32 PID 2776 wrote to memory of 2708 2776 Jabponba.exe 32 PID 2708 wrote to memory of 2868 2708 Jcqlkjae.exe 33 PID 2708 wrote to memory of 2868 2708 Jcqlkjae.exe 33 PID 2708 wrote to memory of 2868 2708 Jcqlkjae.exe 33 PID 2708 wrote to memory of 2868 2708 Jcqlkjae.exe 33 PID 2868 wrote to memory of 2644 2868 Jfohgepi.exe 34 PID 2868 wrote to memory of 2644 2868 Jfohgepi.exe 34 PID 2868 wrote to memory of 2644 2868 Jfohgepi.exe 34 PID 2868 wrote to memory of 2644 2868 Jfohgepi.exe 34 PID 2644 wrote to memory of 1004 2644 Jlqjkk32.exe 35 PID 2644 wrote to memory of 1004 2644 Jlqjkk32.exe 35 PID 2644 wrote to memory of 1004 2644 Jlqjkk32.exe 35 PID 2644 wrote to memory of 1004 2644 Jlqjkk32.exe 35 PID 1004 wrote to memory of 1872 1004 Klcgpkhh.exe 36 PID 1004 wrote to memory of 1872 1004 Klcgpkhh.exe 36 PID 1004 wrote to memory of 1872 1004 Klcgpkhh.exe 36 PID 1004 wrote to memory of 1872 1004 Klcgpkhh.exe 36 PID 1872 wrote to memory of 1680 1872 Kdnkdmec.exe 37 PID 1872 wrote to memory of 1680 1872 Kdnkdmec.exe 37 PID 1872 wrote to memory of 1680 1872 Kdnkdmec.exe 37 PID 1872 wrote to memory of 1680 1872 Kdnkdmec.exe 37 PID 1680 wrote to memory of 1932 1680 Kablnadm.exe 38 PID 1680 wrote to memory of 1932 1680 Kablnadm.exe 38 PID 1680 wrote to memory of 1932 1680 Kablnadm.exe 38 PID 1680 wrote to memory of 1932 1680 Kablnadm.exe 38 PID 1932 wrote to memory of 448 1932 Khldkllj.exe 39 PID 1932 wrote to memory of 448 1932 Khldkllj.exe 39 PID 1932 wrote to memory of 448 1932 Khldkllj.exe 39 PID 1932 wrote to memory of 448 1932 Khldkllj.exe 39 PID 448 wrote to memory of 2948 448 Kpgionie.exe 40 PID 448 wrote to memory of 2948 448 Kpgionie.exe 40 PID 448 wrote to memory of 2948 448 Kpgionie.exe 40 PID 448 wrote to memory of 2948 448 Kpgionie.exe 40 PID 2948 wrote to memory of 2136 2948 Kkojbf32.exe 41 PID 2948 wrote to memory of 2136 2948 Kkojbf32.exe 41 PID 2948 wrote to memory of 2136 2948 Kkojbf32.exe 41 PID 2948 wrote to memory of 2136 2948 Kkojbf32.exe 41 PID 2136 wrote to memory of 1648 2136 Lbjofi32.exe 42 PID 2136 wrote to memory of 1648 2136 Lbjofi32.exe 42 PID 2136 wrote to memory of 1648 2136 Lbjofi32.exe 42 PID 2136 wrote to memory of 1648 2136 Lbjofi32.exe 42
Processes
-
C:\Users\Admin\AppData\Local\Temp\362bf1701d3e5dfc90f87ffccbc14225618d2c817ed77a44ebffcb7c91ae1113.exe"C:\Users\Admin\AppData\Local\Temp\362bf1701d3e5dfc90f87ffccbc14225618d2c817ed77a44ebffcb7c91ae1113.exe"1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2188 -
C:\Windows\SysWOW64\Jikhnaao.exeC:\Windows\system32\Jikhnaao.exe2⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2376 -
C:\Windows\SysWOW64\Jabponba.exeC:\Windows\system32\Jabponba.exe3⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2776 -
C:\Windows\SysWOW64\Jcqlkjae.exeC:\Windows\system32\Jcqlkjae.exe4⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Windows\SysWOW64\Jfohgepi.exeC:\Windows\system32\Jfohgepi.exe5⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2868 -
C:\Windows\SysWOW64\Jlqjkk32.exeC:\Windows\system32\Jlqjkk32.exe6⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\Windows\SysWOW64\Klcgpkhh.exeC:\Windows\system32\Klcgpkhh.exe7⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1004 -
C:\Windows\SysWOW64\Kdnkdmec.exeC:\Windows\system32\Kdnkdmec.exe8⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1872 -
C:\Windows\SysWOW64\Kablnadm.exeC:\Windows\system32\Kablnadm.exe9⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1680 -
C:\Windows\SysWOW64\Khldkllj.exeC:\Windows\system32\Khldkllj.exe10⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1932 -
C:\Windows\SysWOW64\Kpgionie.exeC:\Windows\system32\Kpgionie.exe11⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:448 -
C:\Windows\SysWOW64\Kkojbf32.exeC:\Windows\system32\Kkojbf32.exe12⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2948 -
C:\Windows\SysWOW64\Lbjofi32.exeC:\Windows\system32\Lbjofi32.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2136 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2136 -s 14014⤵
- Loads dropped DLL
- Program crash
PID:1648
-
-
-
-
-
-
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
344KB
MD5e2ef5f7ed740cc0e37f39c144c896aa2
SHA14524a8882f2017c37bc3d835158806bb06265e83
SHA2567fe0bd1807be95b4f898d106c6719ce98449639759b7764390fe86413d445767
SHA512c858a051cfa320192c54fc2c09e8657fd85e5bf5ac253e22b7354e3f8dd6cef1f7854723fa16d807cdb11470ca3537d2c854ae4d382853a88c5b48ee06838474
-
Filesize
344KB
MD5accede4f45ca6392614905202f593a3f
SHA186f31350d33bd660d1ebd2ffdbfd5ce2416b3065
SHA256844110d69851e0b1a9003354517320e6fe3fb2c63d58c045583c27a632ae354b
SHA5123ca1067781e6f611eb438321cb020e42296b2d06ec1c510f18504eea7c2e649570a5528f875a62abecd9dea8421a0157c32d9e1eb4a8e1a44230547cf47698ad
-
Filesize
344KB
MD575f26b0fddb5cd987b215a3af29be795
SHA136b240da20b58b750be2f3ab34fb6b308c672673
SHA2565529721e759482ae6e49fad1285fee90a1be12f258daaa8db78497eff32b9fd5
SHA5120878911e70c70798a1841a01cc709e408b54055cd9cd0ca16dd3ef47910c8743a94d22dd8f2697cce5c6d3dab7c17e47ec7eb06e42f874f7ec0c71126172429a
-
Filesize
344KB
MD59b06e785e7125a98c95f4e973cf23646
SHA1913eaaffdcede39bfbe1e9814d0e5e6c4dcb5c62
SHA2569e3a724e2a5c62c3818ec943e04f2aa4b669a9c9535fce913495943a1abb7e27
SHA5128aa251fd71077f3b0db4e71e99368419eb6b32a6e0a3730c142e6bf1386a9be00d359ea0e4d90b176dcf73ed5c435f4e05f36b0ac060c2c20dcec3b64b34dc46
-
Filesize
344KB
MD51cfb101ec898c9ed3937d02edc969356
SHA1e76c5834ba1a09ab1863beb910433cf4334cf034
SHA256ab514b8e04bdc4d7deabc0a693411a37157d17c8cbc2f0f2d151858162b1147f
SHA512f17442013c07be181fafa691a1d54df4bfb1a465b0364f574190d08e5c7516bb2ffe00b1e25885a3900c8b8df80be5730b83ecdbfe35d0ce11857e65586cf912
-
Filesize
344KB
MD5294d96ff1b078b04566f288f3e28b71f
SHA1e3aaec6d0608e178146d7c3f7d86a0bf757aaf3b
SHA2569494eb00c5398cc5ddb1d6a2d444088fb97fce0c6ce669781d8b12f1d3281150
SHA512275dc7d7f547d161c4bf4f9bbb17723c0ca3c9b72f45df0d4e5463fe3eaeda75ca2cb405135c12f9d5277c8bbb087a8e11f89a678d35037a1f72cef73a25288b
-
Filesize
344KB
MD5103fc9be455194f32a33d18110a4389a
SHA1582f5a8f175f858a0c9c506bfa054ee6231bdabd
SHA256e73b95ead73397e0cc22f6e17f55a05a1533b3daf98f7f90ffcdfd8223d0871a
SHA5129b3cab8655b28135dae1ae0c827ac43a09dfa31502d3b70397e31e7a3512bdd85963b2f58f4ea4d39e83a4b64b187307a52cf612278b8f40c387142a2d753f2f
-
Filesize
344KB
MD552b8e5d8889f5b591f0e265f701283e5
SHA1d4114c79319f0a57427830722f0f0b29776cd719
SHA256e5e96ff32a749454dc1d60b82b37cfa3b7c106b86314ab9f29d31095956bc5bb
SHA5124afea60d0be54e9fde5189b144ff864529ed00805eda5d3cdc4cce29ce237557276673b76b1479d662a7d0c205a6142465a576ca641eb1f956daac2a68447803
-
Filesize
344KB
MD5a12246dce4b07dbec31e8b7e05089af0
SHA1103172fcbd4e8c7f6fbc589fee98c35552ddaa9b
SHA2564b7c0d0025ff372ef07863249dab68d6f2a1846c7fdfcbb67f6c2184ee0e5ad0
SHA51212d747f647cf5b3185bdbda399f50b3ed7b812695704b22f0e40d569b575db9c46a539b5d799e98f3a9782e00a882cf320dbacd86a2faeb95adf4a8583891f05
-
Filesize
344KB
MD5abc9f082b3bc0c69330d34c23d2536dc
SHA176e163a7a7fa80d7ca6d3b679dc383bb471e1bf0
SHA25675bf8688cbe651d7663674b7fc043cbc49d8a29b192bc618fabc2071d8685a7e
SHA512ad47bcf9beaa226aea80c83c8272a7a215f56347a99998a4bcd4d5d083010d06ff7597791c68913fc46a8eebca93a8457875429e06fb5138d2724fa4eaa20e15
-
Filesize
344KB
MD5311cccf7f52212ef172d98562ded0e91
SHA1284c496bcedc0499215ec514439c7322fe2f135b
SHA2560430c915e33be3bb0ecc37b5133d0270d62ea4a649053cb6a2c718c3526c2339
SHA5120c896e22c07ab8bafa4bc42576254b02af6207c611b91d0c52a997f260514749134f3eff1013bcc91aaf2f5d2f71687dbb6b31a924ccf9726b75dfce9cd13e9e
-
Filesize
344KB
MD518ae96f8f5ccfd0111a53e62d0aa95aa
SHA1337f7e29ea330b39330ca9d09a0e10b6a289352e
SHA2563ba2eb9b09ff39f5f54f76880cc26a245ccad05e72e0c2996a6491e3e181a91c
SHA512ae247ad08ecf76afa63a2f722d3e2aa331a89f5874d65490baaa9fa10a68b1c9545738a2b9a7bcfa2656d3f7da7e0d90e386587541fd5cb50eb5012f3ffd8930