Analysis
-
max time kernel
173s -
max time network
176s -
platform
windows11-21h2_x64 -
resource
win11-20250210-en -
resource tags
arch:x64arch:x86image:win11-20250210-enlocale:en-usos:windows11-21h2-x64system -
submitted
11-02-2025 18:53
Errors
Reason
Machine shutdown
General
-
Target
250210-b2bg4aynbz_pw_infected.zip
-
Size
1.2MB
-
MD5
ad63686a82a6abde1bc66cd607b38caf
-
SHA1
697ecbee35395a0b670d8f8d485780f31cfd90fa
-
SHA256
183b6dbdf3e274ab79eab06e6cfa3500f173dd53f8e2aedc889ab1751b66ce45
-
SHA512
79f6eb1ab1ff969edcc374d76efb9da554e72e35fd83d0317c392b6aeb02460c25f2eb8d544a2804b56d3cc7eec8a17bcc243229af6fd7dbd2eff50c58936c73
-
SSDEEP
24576:oCKoooX84qwSEGIPjFTLmq/pX/7dv1Y7DwNXTNfOdlPI/:9Koj84KIP1p5v1Y7cNXTZO7w/
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/2528-44-0x0000000010000000-0x00000000101BA000-memory.dmp purplefox_rootkit behavioral1/memory/2528-43-0x0000000010000000-0x00000000101BA000-memory.dmp purplefox_rootkit behavioral1/memory/2028-51-0x0000000010000000-0x00000000101BA000-memory.dmp purplefox_rootkit behavioral1/memory/2028-52-0x0000000010000000-0x00000000101BA000-memory.dmp purplefox_rootkit behavioral1/memory/5032-70-0x0000000010000000-0x00000000101BA000-memory.dmp purplefox_rootkit behavioral1/memory/5032-74-0x0000000010000000-0x00000000101BA000-memory.dmp purplefox_rootkit behavioral1/memory/5032-75-0x0000000010000000-0x00000000101BA000-memory.dmp purplefox_rootkit -
Gh0st RAT payload 8 IoCs
resource yara_rule behavioral1/files/0x001900000002aecf-22.dat family_gh0strat behavioral1/memory/2528-44-0x0000000010000000-0x00000000101BA000-memory.dmp family_gh0strat behavioral1/memory/2528-43-0x0000000010000000-0x00000000101BA000-memory.dmp family_gh0strat behavioral1/memory/2028-51-0x0000000010000000-0x00000000101BA000-memory.dmp family_gh0strat behavioral1/memory/2028-52-0x0000000010000000-0x00000000101BA000-memory.dmp family_gh0strat behavioral1/memory/5032-70-0x0000000010000000-0x00000000101BA000-memory.dmp family_gh0strat behavioral1/memory/5032-74-0x0000000010000000-0x00000000101BA000-memory.dmp family_gh0strat behavioral1/memory/5032-75-0x0000000010000000-0x00000000101BA000-memory.dmp family_gh0strat -
Gh0strat family
-
Purplefox family
-
Downloads MZ/PE file 1 IoCs
flow pid Process 9 2148 Process not Found -
Drops file in Drivers directory 1 IoCs
description ioc Process File created C:\Windows\system32\drivers\QAssist.sys Ghiya.exe -
Server Software Component: Terminal Services DLL 1 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Ö÷¶¯·ÀÓù·þÎñÄ£¿é\Parameters\ServiceDll = "C:\\Windows\\system32\\240712765.txt" AK47.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Ö÷¶¯·ÀÓù·þÎñÄ£¿é\Parameters\ServiceDll = "C:\\Windows\\system32\\240712781.txt" AK47.exe -
Sets service image path in registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys" Ghiya.exe -
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\win.lnk 1a6a108e5247fc7ff545ab8aa62255716ab6d1e07f0766528a335e4be45e4674.exe -
Executes dropped EXE 11 IoCs
pid Process 3876 1a6a108e5247fc7ff545ab8aa62255716ab6d1e07f0766528a335e4be45e4674.exe 4816 AK47.exe 3580 AK47.exe 2528 AK74.exe 2028 Ghiya.exe 5032 Ghiya.exe 1060 Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe 2488 Ghiya.exe 1240 Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe 2656 Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe 3556 Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe -
Loads dropped DLL 9 IoCs
pid Process 3580 AK47.exe 4816 AK47.exe 468 svchost.exe 1060 Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe 2556 svchost.exe 1240 Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe 4856 svchost.exe 2656 Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe 3556 Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe -
resource yara_rule behavioral1/files/0x001900000002aeca-3.dat vmprotect behavioral1/memory/3876-5-0x0000000000400000-0x0000000000760000-memory.dmp vmprotect behavioral1/memory/3876-6-0x0000000000400000-0x0000000000760000-memory.dmp vmprotect behavioral1/files/0x001900000002aed5-60.dat vmprotect behavioral1/memory/3876-96-0x0000000000400000-0x0000000000760000-memory.dmp vmprotect behavioral1/memory/3876-109-0x0000000000400000-0x0000000000760000-memory.dmp vmprotect -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\360safo = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\svchcst.exe" 1a6a108e5247fc7ff545ab8aa62255716ab6d1e07f0766528a335e4be45e4674.exe -
Drops file in System32 directory 10 IoCs
description ioc Process File created C:\Windows\SysWOW64\240712765.txt AK47.exe File created C:\Windows\SysWOW64\240712781.txt AK47.exe File opened for modification C:\Windows\SysWOW64\ini.ini AK47.exe File created C:\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe svchost.exe File created C:\Windows\SysWOW64\Ghiya.exe AK74.exe File created C:\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe svchost.exe File opened for modification C:\Windows\SysWOW64\ini.ini AK47.exe File opened for modification C:\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe svchost.exe File opened for modification C:\Windows\SysWOW64\Ghiya.exe AK74.exe File created C:\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe svchost.exe -
resource yara_rule behavioral1/memory/2528-44-0x0000000010000000-0x00000000101BA000-memory.dmp upx behavioral1/memory/2528-41-0x0000000010000000-0x00000000101BA000-memory.dmp upx behavioral1/memory/2528-43-0x0000000010000000-0x00000000101BA000-memory.dmp upx behavioral1/memory/2028-51-0x0000000010000000-0x00000000101BA000-memory.dmp upx behavioral1/memory/2028-49-0x0000000010000000-0x00000000101BA000-memory.dmp upx behavioral1/memory/2028-52-0x0000000010000000-0x00000000101BA000-memory.dmp upx behavioral1/memory/5032-70-0x0000000010000000-0x00000000101BA000-memory.dmp upx behavioral1/memory/5032-74-0x0000000010000000-0x00000000101BA000-memory.dmp upx behavioral1/memory/5032-75-0x0000000010000000-0x00000000101BA000-memory.dmp upx -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\rescache\_merged\425634766\2383298264.pri LogonUI.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 17 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1a6a108e5247fc7ff545ab8aa62255716ab6d1e07f0766528a335e4be45e4674.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ghiya.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MicrosoftEdgeUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AK74.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AK47.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ghiya.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AK47.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 3 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 864 MicrosoftEdgeUpdate.exe 2332 cmd.exe 3556 PING.EXE -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Modifies data under HKEY_USERS 15 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292114432" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365268" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365268" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "238" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4290799360" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292114432" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1" LogonUI.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00 LogonUI.exe -
Modifies registry class 3 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1505343591-821288467-4101320450-1000_Classes\Local Settings 1a6a108e5247fc7ff545ab8aa62255716ab6d1e07f0766528a335e4be45e4674.exe Key created \REGISTRY\USER\S-1-5-21-1505343591-821288467-4101320450-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.WindowsTerminal_8wekyb3d8bbwe\StartTerminalOnLoginTask taskmgr.exe Key created \REGISTRY\USER\S-1-5-21-1505343591-821288467-4101320450-1000_Classes\Local Settings taskmgr.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 3556 PING.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3876 1a6a108e5247fc7ff545ab8aa62255716ab6d1e07f0766528a335e4be45e4674.exe 3876 1a6a108e5247fc7ff545ab8aa62255716ab6d1e07f0766528a335e4be45e4674.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3876 1a6a108e5247fc7ff545ab8aa62255716ab6d1e07f0766528a335e4be45e4674.exe 3876 1a6a108e5247fc7ff545ab8aa62255716ab6d1e07f0766528a335e4be45e4674.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe -
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 5032 Ghiya.exe -
Suspicious use of AdjustPrivilegeToken 9 IoCs
description pid Process Token: SeRestorePrivilege 3412 7zG.exe Token: 35 3412 7zG.exe Token: SeSecurityPrivilege 3412 7zG.exe Token: SeSecurityPrivilege 3412 7zG.exe Token: SeIncBasePriorityPrivilege 2528 AK74.exe Token: SeLoadDriverPrivilege 5032 Ghiya.exe Token: SeDebugPrivilege 3800 taskmgr.exe Token: SeSystemProfilePrivilege 3800 taskmgr.exe Token: SeCreateGlobalPrivilege 3800 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 3412 7zG.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe 3800 taskmgr.exe -
Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 3876 1a6a108e5247fc7ff545ab8aa62255716ab6d1e07f0766528a335e4be45e4674.exe 3876 1a6a108e5247fc7ff545ab8aa62255716ab6d1e07f0766528a335e4be45e4674.exe 3876 1a6a108e5247fc7ff545ab8aa62255716ab6d1e07f0766528a335e4be45e4674.exe 3580 AK47.exe 4816 AK47.exe 2116 LogonUI.exe 2116 LogonUI.exe -
Suspicious use of WriteProcessMemory 33 IoCs
description pid Process procid_target PID 3876 wrote to memory of 4816 3876 1a6a108e5247fc7ff545ab8aa62255716ab6d1e07f0766528a335e4be45e4674.exe 99 PID 3876 wrote to memory of 4816 3876 1a6a108e5247fc7ff545ab8aa62255716ab6d1e07f0766528a335e4be45e4674.exe 99 PID 3876 wrote to memory of 4816 3876 1a6a108e5247fc7ff545ab8aa62255716ab6d1e07f0766528a335e4be45e4674.exe 99 PID 3876 wrote to memory of 3580 3876 1a6a108e5247fc7ff545ab8aa62255716ab6d1e07f0766528a335e4be45e4674.exe 100 PID 3876 wrote to memory of 3580 3876 1a6a108e5247fc7ff545ab8aa62255716ab6d1e07f0766528a335e4be45e4674.exe 100 PID 3876 wrote to memory of 3580 3876 1a6a108e5247fc7ff545ab8aa62255716ab6d1e07f0766528a335e4be45e4674.exe 100 PID 3876 wrote to memory of 2528 3876 1a6a108e5247fc7ff545ab8aa62255716ab6d1e07f0766528a335e4be45e4674.exe 102 PID 3876 wrote to memory of 2528 3876 1a6a108e5247fc7ff545ab8aa62255716ab6d1e07f0766528a335e4be45e4674.exe 102 PID 3876 wrote to memory of 2528 3876 1a6a108e5247fc7ff545ab8aa62255716ab6d1e07f0766528a335e4be45e4674.exe 102 PID 2528 wrote to memory of 2332 2528 AK74.exe 104 PID 2528 wrote to memory of 2332 2528 AK74.exe 104 PID 2528 wrote to memory of 2332 2528 AK74.exe 104 PID 2028 wrote to memory of 5032 2028 Ghiya.exe 105 PID 2028 wrote to memory of 5032 2028 Ghiya.exe 105 PID 2028 wrote to memory of 5032 2028 Ghiya.exe 105 PID 3876 wrote to memory of 1172 3876 1a6a108e5247fc7ff545ab8aa62255716ab6d1e07f0766528a335e4be45e4674.exe 107 PID 3876 wrote to memory of 1172 3876 1a6a108e5247fc7ff545ab8aa62255716ab6d1e07f0766528a335e4be45e4674.exe 107 PID 3876 wrote to memory of 1172 3876 1a6a108e5247fc7ff545ab8aa62255716ab6d1e07f0766528a335e4be45e4674.exe 107 PID 2332 wrote to memory of 3556 2332 cmd.exe 108 PID 2332 wrote to memory of 3556 2332 cmd.exe 108 PID 2332 wrote to memory of 3556 2332 cmd.exe 108 PID 468 wrote to memory of 1060 468 svchost.exe 111 PID 468 wrote to memory of 1060 468 svchost.exe 111 PID 468 wrote to memory of 1060 468 svchost.exe 111 PID 2556 wrote to memory of 1240 2556 svchost.exe 115 PID 2556 wrote to memory of 1240 2556 svchost.exe 115 PID 2556 wrote to memory of 1240 2556 svchost.exe 115 PID 4856 wrote to memory of 2656 4856 svchost.exe 117 PID 4856 wrote to memory of 2656 4856 svchost.exe 117 PID 4856 wrote to memory of 2656 4856 svchost.exe 117 PID 4856 wrote to memory of 3556 4856 svchost.exe 120 PID 4856 wrote to memory of 3556 4856 svchost.exe 120 PID 4856 wrote to memory of 3556 4856 svchost.exe 120
Processes
-
C:\Windows\Explorer.exeC:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\250210-b2bg4aynbz_pw_infected.zip1⤵PID:1140
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NURGN0ZGRDMtNEE4OS00QzZFLTg2QkUtQTUzMTkxQUMxNDU1fSIgdXNlcmlkPSJ7NDMzMDg2NjUtNzE4RS00OUUyLUFGNUItMDQ2NzE5NUM5RjZBfSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7QzkyM0E0QzktMjQ0Qy00Mjk4LUIxQzktM0M3REY0MTIwQUFEfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjIiIHBoeXNtZW1vcnk9IjQiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4yMjAwMC40OTMiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIiBpc19pbl9sb2NrZG93bl9tb2RlPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7RSt4YkF6Nlk2c1UxMjg5YlM2cWw0VlJMYmtqZkJVR1RNSnNqckhyNDRpST0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7OEE2OUQzNDUtRDU2NC00NjNjLUFGRjEtQTY5RDlFNTMwRjk2fSIgdmVyc2lvbj0iMTIzLjAuNjMxMi4xMjMiIG5leHR2ZXJzaW9uPSIiIGxhbmc9ImVuIiBicmFuZD0iR0dMUyIgY2xpZW50PSIiIGluc3RhbGxhZ2U9IjEiIGluc3RhbGxkYXRldGltZT0iMTczOTE4Mzk2NiIgb29iZV9pbnN0YWxsX3RpbWU9IjEzMzgzNjU1NjQwMTY2MDAwMCI-PGV2ZW50IGV2ZW50dHlwZT0iMzEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjIxNzk4NjIiIHN5c3RlbV91cHRpbWVfdGlja3M9IjQ2NDE2NDAxMTUiLz48L2FwcD48L3JlcXVlc3Q-1⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
PID:864
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:2588
-
C:\Program Files\7-Zip\7zG.exe"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\" -an -ai#7zMap21806:116:7zEvent303441⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3412
-
C:\Users\Admin\Desktop\1a6a108e5247fc7ff545ab8aa62255716ab6d1e07f0766528a335e4be45e4674.exe"C:\Users\Admin\Desktop\1a6a108e5247fc7ff545ab8aa62255716ab6d1e07f0766528a335e4be45e4674.exe"1⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3876 -
C:\Users\Admin\AppData\Local\Temp\AK47.exe"C:\Users\Admin\AppData\Local\Temp\AK47.exe"2⤵
- Server Software Component: Terminal Services DLL
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4816
-
-
C:\Users\Admin\AppData\Local\Temp\AK47.exeC:\Users\Admin\AppData\Local\Temp\\AK47.exe2⤵
- Server Software Component: Terminal Services DLL
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3580
-
-
C:\Users\Admin\AppData\Local\Temp\AK74.exeC:\Users\Admin\AppData\Local\Temp\\AK74.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2528 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\AK74.exe > nul3⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
PID:2332 -
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.14⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:3556
-
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"2⤵
- System Location Discovery: System Language Discovery
PID:1172
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "Ö÷¶¯·ÀÓù·þÎñÄ£¿é"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:468 -
C:\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exeC:\Windows\system32\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe "c:\windows\system32\240712781.txt",MainThread2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1060
-
-
C:\Windows\SysWOW64\Ghiya.exeC:\Windows\SysWOW64\Ghiya.exe -auto1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2028 -
C:\Windows\SysWOW64\Ghiya.exeC:\Windows\SysWOW64\Ghiya.exe -acsi2⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Executes dropped EXE
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
PID:5032
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /01⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3800
-
C:\Users\Admin\Desktop\Ghiya.exe"C:\Users\Admin\Desktop\Ghiya.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2488
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "Ö÷¶¯·ÀÓù·þÎñÄ£¿é"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2556 -
C:\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exeC:\Windows\system32\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe "c:\windows\system32\240712765.txt",MainThread2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1240
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "Ö÷¶¯·ÀÓù·þÎñÄ£¿é"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4856 -
C:\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exeC:\Windows\system32\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe "c:\windows\system32\240712765.txt",MainThread2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2656
-
-
C:\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exeC:\Windows\system32\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe "c:\windows\system32\240712765.txt",MainThread2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3556
-
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa3980055 /state1:0x41c64e6d1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:2116
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Server Software Component
1Terminal Services DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
91KB
MD5423eb994ed553294f8a6813619b8da87
SHA1eca6a16ccd13adcfc27bc1041ddef97ec8081255
SHA256050b4f2d5ae8eaecd414318dc8e222a56f169626da6ca8feb7edd78e8b1f0218
SHA512fab0a9af8031c242c486de373df7277c8b0e39f7a0c9c2ac2e385dbd3ea67be16e91b128287634f76131e5264149ab1b452cd21df4c4895e8c4efc8d8cf99095
-
Filesize
400KB
MD5b0998aa7d5071d33daa5b60b9c3c9735
SHA19365a1ff0c6de244d6f36c8d84072cc916665d3c
SHA2563080b6bb456564899b0d99d4131bd6a0b284d31f7d80ef773e4872d94048d49a
SHA512308c13cda9fea39b980ae686f44afd9090e9cb8970fffc4436320e0d09a31aee5e656914e0121fe888098a14c52749716fa04980396fd6ac70a88c11cbb6b850
-
Filesize
753B
MD56528dcd8222677e739c7f76e262822f1
SHA1a2a04f614c0e642061056ede71a803bca7b7ba25
SHA256f57a1ab18e2286ea8bd94f54ccedc2b0c64eb6574b680e4e946859cf2fbfdc8f
SHA5122c0a171268d07e1dde3518bffb1bf5cf8f6e8429fc7e517a4e0c11ddd0983027fe3321fb2bef3a056f1b01296da9423b3ed4ea15ad033da49ce31b41f0ff3a11
-
Filesize
867B
MD52cc7805a10d19a513a9bf18303821e42
SHA1a3d0ac6f31b2b48b5d05732b04cfc6ce04161490
SHA256fb3c0eb185825222feb14c498389888851eaa07937881c31b6f95b12321467da
SHA512bfab2e90c74113d0e62e087cfeda159da1ada20b4fab955cdb68c4a0ca27739c47719baf5bab24614a3960ef19c720593cba5132df34d186c2de0f1e9afeeabd
-
Filesize
1.2MB
MD5014cb0b04764ccacf12be4f7ea0442ed
SHA1130532a06d7304c8c866f2c2793eb7c27dd1ecc5
SHA25688f3e96f7fdffbbd57f0552c3f90ad2724b546868fcda832fbcc0abda0393af4
SHA5129485343f6598b993912c8cbdfc6b79a0d7f445d1824943ac638bc2c251b2b9247de6e0fe5eb0c9ef1fce2cf11a2f4ff2098541a542a27ecaabe93d57a3799ba9
-
Filesize
1.2MB
MD5d33aaa288698f9e6470ede4085dab7e0
SHA13658cf9af5cde94e19fc008f8404fbffdaa515ef
SHA2561a6a108e5247fc7ff545ab8aa62255716ab6d1e07f0766528a335e4be45e4674
SHA51210de4785f58fbc6f75536961abb143f36c2095c7fde3799f6b1d5eeaafde00a5f04f1bb4c6d56f2038a7f6f8a18b75074d1415c422b582134dce177d2a0cf2ac
-
Filesize
49KB
MD5e9085f6ce42ca08ad82a6953fde98fa0
SHA1a77502e2c626cb9815ffedd48ec6ea6b231fcf88
SHA25686bcdd3a2b4a22fcf8ac489a7a18bc586f0135c030baa153c089d93ebf800f8a
SHA512fc53b7008160434a521ea7c12ac7319bb6aa35cfab196cbee2ba0d59db995fa160cdd0582cec07af2b8a42e05ef0c93258011e3a4021816ccd3eb00564ab3e60
-
Filesize
45B
MD5ba6f19fa6017cdf1577170dc2063cbcf
SHA1d04cdd3273dd8dbbdc531f9ffa0597a609976519
SHA256efa1aebde48bf740ed18082602b54acd133ef6c32195ac8ef79cd673a807d915
SHA5122b4bf09aa547f68b9da6d6cba24ed5e85270e6e8578fe075730213f9bb5b39d67713c76869683aed53b37fbd507270662431ca68dd6e3904a1265803e6846aff
-
Filesize
40KB
MD522bb5bd901d8b25ac5b41edbb7d5053e
SHA18a935dd8d7e104fc553ff7e8b54a404f7b079334
SHA2568dcaeeebef9b9f3d41d295db145ffb3850f309d089c08125c7fa7034db5fd80e
SHA512cc3fb68fd6791a08e4a7d1a8db8d07cfcc8c9b9dceec10b53f0cb7ee86473303a19be4f23e379f84c59e02d0568e7c066e21cd1300f6032dac4ba52f609f62e7