Overview
overview
10Static
static
100a36d74a14...04.exe
windows10-2004-x64
80b8b9525ea...96.exe
windows10-2004-x64
10bcbf39901...03.exe
windows10-2004-x64
100e5e999136...e7.exe
windows10-2004-x64
100fc0de254b...ce.exe
windows10-2004-x64
101a47c4fd5a...a8.exe
windows10-2004-x64
71a6ed538d9...ed.exe
windows10-2004-x64
71ac9b17068...d7.exe
windows10-2004-x64
81be6fdb2df...e9.exe
windows10-2004-x64
102bbbb9b0cd...b2.exe
windows10-2004-x64
102cda90e9e8...33.exe
windows10-2004-x64
32d58b1a373...aa.exe
windows10-2004-x64
52e966d3480...2e.exe
windows10-2004-x64
73a0297561d...1c.exe
windows10-2004-x64
103a90ad3258...8d.exe
windows10-2004-x64
63e76598b80...50.exe
windows10-2004-x64
104a5b5eb5a4...36.exe
windows10-2004-x64
104b482e8492...8c.exe
windows10-2004-x64
64bd46a2850...9c.exe
windows10-2004-x64
104cca8b360d...0a.exe
windows10-2004-x64
104e31114ffd...f7.exe
windows10-2004-x64
105ac2fcc4da...83.exe
windows10-2004-x64
105b25182d96...14.exe
windows10-2004-x64
75ddb366ead...46.exe
windows10-2004-x64
95f1364d246...bc.exe
windows10-2004-x64
106e0c9935ea...65.exe
windows10-2004-x64
16ea27426ff...08.exe
windows10-2004-x64
47dad12bd22...d2.exe
windows10-2004-x64
87db9e09e8b...71.exe
windows10-2004-x64
37e9af10bfe...5a.exe
windows10-2004-x64
10Analysis
-
max time kernel
150s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20250314-en -
resource tags
arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system -
submitted
09/04/2025, 08:25
Behavioral task
behavioral1
Sample
0a36d74a1458e8ca334d0c8169ec320e9d7735853a4c0c74660b578a13ee3104.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral2
Sample
0b8b9525ead4b3ebf6e5ba923057432a809d70b8beecb07df329ad23bf5a0c96.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
0bcbf399011c69a1690f596d2b607eb835ea55e7fc9b4e8a160cd49e0713af03.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral4
Sample
0e5e9991361cc4228bbb1f7c531379f52c2dd8e353af3f27b0d87a2c0d75b4e7.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
0fc0de254bc80e54c708fbd0eb0460c730283508b94108e4b2d1d70525ef3fce.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral6
Sample
1a47c4fd5aa52c954123b3871ed1e6cdacf81b1d18e8281d1b0ab304133ee3a8.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
1a6ed538d9ee30c5d1988968896c7028f99b24f43e5abbae96cc63281bcd8bed.exe
Resource
win10v2004-20250313-en
windows10-2004-x64
Behavioral task
behavioral8
Sample
1ac9b17068a19f093e347bafa92112dc8f1a935ba176aadbf58e57f35e4beed7.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
1be6fdb2df40e128e25bd4959ae3fa83c634ced9f51ab2994c209dcadc9adde9.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral10
Sample
2bbbb9b0cdbb3a1f26ce3357d9119edf008e4894c881351f89989a67d0a192b2.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
2cda90e9e87c9db37ba5015909a7efb45fbe3a351ec9ca7a5359204e801dcb33.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral12
Sample
2d58b1a3735269002d5499c67bd32c3b800fd1c44ca78d19ac3d21df84832faa.exe
Resource
win10v2004-20250313-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
2e966d34801be95eae9a7f1dd5efe3885c234c473d377185f3b7af4dbbb99d2e.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral14
Sample
3a0297561d1cab1471cd84e4c5308f19a9a33606784938235c7ff2eaa85d001c.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
3a90ad325806107cadbd87ed4825ff967c3535e74433ab04fa6ff30b512b818d.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral16
Sample
3e76598b8086857c38e2016dc729fa4879136e46b6f5962ff0b042ef35666b50.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
4a5b5eb5a4e1ba423df24c110fc43f7b3428d2126e99fd9c170b9dfb2baf7236.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral18
Sample
4b482e8492e8c1943330745899214b29bfd2582000371243400d854838dfb88c.exe
Resource
win10v2004-20250313-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
4bd46a2850788e5697d214dd4409c063b6f9c38c886443211f22fb0ff19bff9c.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral20
Sample
4cca8b360d5053a789ea822ab80261dc6f010c1c72b0d449ca8cdcaffd2e2c0a.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
4e31114ffd1000c0242b7537d6329641dc0457dcd6590c57659326a1785ce2f7.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral22
Sample
5ac2fcc4daab08132ad947ffedcf88286f2af526a260111f3ae00de9ba0a6283.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
5b25182d96ac6fca82ecb8f99198295f45bf8fceea3fb196beb2a4e7bc862714.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral24
Sample
5ddb366eada77b037e23b02034be67099372dad8ab32668381290af66ec4ba46.exe
Resource
win10v2004-20250313-en
windows10-2004-x64
Behavioral task
behavioral25
Sample
5f1364d24646f22acc7127263adfb401a9c3a4655f9ecb085f931ebc9aaf61bc.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral26
Sample
6e0c9935ea61a09f4ced2b9a871b5f21b637a7979b21aa4ccb490a9442182865.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral27
Sample
6ea27426ff47b4abd8a8e53f7d3452c981aa6fe86ca07ef15e45f6f8fcae3108.exe
Resource
win10v2004-20250313-en
windows10-2004-x64
Behavioral task
behavioral28
Sample
7dad12bd22c31f2618cc56cbd738f1cce5afaea128fcfe1deb18f4ac7366c9d2.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral29
Sample
7db9e09e8bdcc45eafbb75b83d57503d11bf54d96c9eaa003fe8e5d518180571.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
General
-
Target
5f1364d24646f22acc7127263adfb401a9c3a4655f9ecb085f931ebc9aaf61bc.exe
-
Size
990KB
-
MD5
88d6b61f9b307ca1ba9aefbe413ca028
-
SHA1
0a67ce5a5f48652547563812911b2d94418a0dcc
-
SHA256
5f1364d24646f22acc7127263adfb401a9c3a4655f9ecb085f931ebc9aaf61bc
-
SHA512
36a0c8038390bae34c05610a2396c47ef575905b205fbc4ca13dc4984a18cc42ee3d9def3664ee67fc2fe4a2f1056c59058211e1b92bdd4d5e8683d74e0a5ccf
-
SSDEEP
12288:DpqiC/2OGAtkCP4cejGSOpRK3CnIiCSsPKplohwrsclnn:Dpo/2+ttPJLfpRK3CnHCSoWuUsE
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe system3_.exe" 5f1364d24646f22acc7127263adfb401a9c3a4655f9ecb085f931ebc9aaf61bc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe system3_.exe" system3_.exe -
Executes dropped EXE 2 IoCs
pid Process 3176 system3_.exe 4648 system3_.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Yahoo Messengger = "C:\\Users\\Admin\\Desktop\\system3_.exe" 5f1364d24646f22acc7127263adfb401a9c3a4655f9ecb085f931ebc9aaf61bc.exe Set value (str) \REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Yahoo Messengger = "C:\\Users\\Admin\\Desktop\\system3_.exe" system3_.exe -
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\j: 5f1364d24646f22acc7127263adfb401a9c3a4655f9ecb085f931ebc9aaf61bc.exe File opened (read-only) \??\m: 5f1364d24646f22acc7127263adfb401a9c3a4655f9ecb085f931ebc9aaf61bc.exe File opened (read-only) \??\u: 5f1364d24646f22acc7127263adfb401a9c3a4655f9ecb085f931ebc9aaf61bc.exe File opened (read-only) \??\x: 5f1364d24646f22acc7127263adfb401a9c3a4655f9ecb085f931ebc9aaf61bc.exe File opened (read-only) \??\i: system3_.exe File opened (read-only) \??\l: system3_.exe File opened (read-only) \??\b: 5f1364d24646f22acc7127263adfb401a9c3a4655f9ecb085f931ebc9aaf61bc.exe File opened (read-only) \??\i: 5f1364d24646f22acc7127263adfb401a9c3a4655f9ecb085f931ebc9aaf61bc.exe File opened (read-only) \??\n: 5f1364d24646f22acc7127263adfb401a9c3a4655f9ecb085f931ebc9aaf61bc.exe File opened (read-only) \??\z: 5f1364d24646f22acc7127263adfb401a9c3a4655f9ecb085f931ebc9aaf61bc.exe File opened (read-only) \??\k: system3_.exe File opened (read-only) \??\r: system3_.exe File opened (read-only) \??\o: 5f1364d24646f22acc7127263adfb401a9c3a4655f9ecb085f931ebc9aaf61bc.exe File opened (read-only) \??\p: 5f1364d24646f22acc7127263adfb401a9c3a4655f9ecb085f931ebc9aaf61bc.exe File opened (read-only) \??\v: 5f1364d24646f22acc7127263adfb401a9c3a4655f9ecb085f931ebc9aaf61bc.exe File opened (read-only) \??\m: system3_.exe File opened (read-only) \??\p: system3_.exe File opened (read-only) \??\q: system3_.exe File opened (read-only) \??\s: system3_.exe File opened (read-only) \??\z: system3_.exe File opened (read-only) \??\g: 5f1364d24646f22acc7127263adfb401a9c3a4655f9ecb085f931ebc9aaf61bc.exe File opened (read-only) \??\g: system3_.exe File opened (read-only) \??\h: system3_.exe File opened (read-only) \??\j: system3_.exe File opened (read-only) \??\n: system3_.exe File opened (read-only) \??\u: system3_.exe File opened (read-only) \??\a: 5f1364d24646f22acc7127263adfb401a9c3a4655f9ecb085f931ebc9aaf61bc.exe File opened (read-only) \??\s: 5f1364d24646f22acc7127263adfb401a9c3a4655f9ecb085f931ebc9aaf61bc.exe File opened (read-only) \??\w: 5f1364d24646f22acc7127263adfb401a9c3a4655f9ecb085f931ebc9aaf61bc.exe File opened (read-only) \??\y: 5f1364d24646f22acc7127263adfb401a9c3a4655f9ecb085f931ebc9aaf61bc.exe File opened (read-only) \??\o: system3_.exe File opened (read-only) \??\t: system3_.exe File opened (read-only) \??\e: 5f1364d24646f22acc7127263adfb401a9c3a4655f9ecb085f931ebc9aaf61bc.exe File opened (read-only) \??\l: 5f1364d24646f22acc7127263adfb401a9c3a4655f9ecb085f931ebc9aaf61bc.exe File opened (read-only) \??\r: 5f1364d24646f22acc7127263adfb401a9c3a4655f9ecb085f931ebc9aaf61bc.exe File opened (read-only) \??\e: system3_.exe File opened (read-only) \??\x: system3_.exe File opened (read-only) \??\q: 5f1364d24646f22acc7127263adfb401a9c3a4655f9ecb085f931ebc9aaf61bc.exe File opened (read-only) \??\b: system3_.exe File opened (read-only) \??\w: system3_.exe File opened (read-only) \??\y: system3_.exe File opened (read-only) \??\h: 5f1364d24646f22acc7127263adfb401a9c3a4655f9ecb085f931ebc9aaf61bc.exe File opened (read-only) \??\k: 5f1364d24646f22acc7127263adfb401a9c3a4655f9ecb085f931ebc9aaf61bc.exe File opened (read-only) \??\t: 5f1364d24646f22acc7127263adfb401a9c3a4655f9ecb085f931ebc9aaf61bc.exe File opened (read-only) \??\a: system3_.exe File opened (read-only) \??\v: system3_.exe -
AutoIT Executable 5 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral25/memory/1744-0-0x0000000000400000-0x00000000004D7000-memory.dmp autoit_exe behavioral25/files/0x0009000000021e27-5.dat autoit_exe behavioral25/memory/4648-13-0x0000000000400000-0x00000000004D7000-memory.dmp autoit_exe behavioral25/memory/1744-92-0x0000000000400000-0x00000000004D7000-memory.dmp autoit_exe behavioral25/memory/3176-93-0x0000000000400000-0x00000000004D7000-memory.dmp autoit_exe -
Drops autorun.inf file 1 TTPs 5 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File created \??\d:\autorun.inf 5f1364d24646f22acc7127263adfb401a9c3a4655f9ecb085f931ebc9aaf61bc.exe File created \??\f:\autorun.inf 5f1364d24646f22acc7127263adfb401a9c3a4655f9ecb085f931ebc9aaf61bc.exe File opened for modification F:\\autorun.inf 5f1364d24646f22acc7127263adfb401a9c3a4655f9ecb085f931ebc9aaf61bc.exe File created \??\d:\autorun.inf system3_.exe File opened for modification F:\\autorun.inf system3_.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 19 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language at.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5f1364d24646f22acc7127263adfb401a9c3a4655f9ecb085f931ebc9aaf61bc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language at.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cacls.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cacls.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cacls.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system3_.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language at.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system3_.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language at.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cacls.exe -
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Default_Search_URL = "http://www.mydreamworld.50webs.com" 5f1364d24646f22acc7127263adfb401a9c3a4655f9ecb085f931ebc9aaf61bc.exe Key created \REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000\Software\Microsoft\Internet Explorer\Main 5f1364d24646f22acc7127263adfb401a9c3a4655f9ecb085f931ebc9aaf61bc.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main system3_.exe Key created \REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000\Software\Microsoft\Internet Explorer\Main system3_.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main 5f1364d24646f22acc7127263adfb401a9c3a4655f9ecb085f931ebc9aaf61bc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Default_Page_URL = "http://www.mydreamworld.50webs.com" 5f1364d24646f22acc7127263adfb401a9c3a4655f9ecb085f931ebc9aaf61bc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Search Page = "http://www.mydreamworld.50webs.com" 5f1364d24646f22acc7127263adfb401a9c3a4655f9ecb085f931ebc9aaf61bc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Default_Page_URL = "http://www.mydreamworld.50webs.com" system3_.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Default_Search_URL = "http://www.mydreamworld.50webs.com" system3_.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Search Page = "http://www.mydreamworld.50webs.com" system3_.exe -
Modifies Internet Explorer start page 1 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://www.mydreamworld.50webs.com" system3_.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Start Page = "http://www.mydreamworld.50webs.com" 5f1364d24646f22acc7127263adfb401a9c3a4655f9ecb085f931ebc9aaf61bc.exe Set value (str) \REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://www.mydreamworld.50webs.com" 5f1364d24646f22acc7127263adfb401a9c3a4655f9ecb085f931ebc9aaf61bc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Start Page = "http://www.mydreamworld.50webs.com" system3_.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1744 5f1364d24646f22acc7127263adfb401a9c3a4655f9ecb085f931ebc9aaf61bc.exe 1744 5f1364d24646f22acc7127263adfb401a9c3a4655f9ecb085f931ebc9aaf61bc.exe 3176 system3_.exe 3176 system3_.exe 4648 system3_.exe 4648 system3_.exe 1744 5f1364d24646f22acc7127263adfb401a9c3a4655f9ecb085f931ebc9aaf61bc.exe 1744 5f1364d24646f22acc7127263adfb401a9c3a4655f9ecb085f931ebc9aaf61bc.exe 1744 5f1364d24646f22acc7127263adfb401a9c3a4655f9ecb085f931ebc9aaf61bc.exe 1744 5f1364d24646f22acc7127263adfb401a9c3a4655f9ecb085f931ebc9aaf61bc.exe 1744 5f1364d24646f22acc7127263adfb401a9c3a4655f9ecb085f931ebc9aaf61bc.exe 1744 5f1364d24646f22acc7127263adfb401a9c3a4655f9ecb085f931ebc9aaf61bc.exe 1744 5f1364d24646f22acc7127263adfb401a9c3a4655f9ecb085f931ebc9aaf61bc.exe 1744 5f1364d24646f22acc7127263adfb401a9c3a4655f9ecb085f931ebc9aaf61bc.exe 1744 5f1364d24646f22acc7127263adfb401a9c3a4655f9ecb085f931ebc9aaf61bc.exe 1744 5f1364d24646f22acc7127263adfb401a9c3a4655f9ecb085f931ebc9aaf61bc.exe 1744 5f1364d24646f22acc7127263adfb401a9c3a4655f9ecb085f931ebc9aaf61bc.exe 1744 5f1364d24646f22acc7127263adfb401a9c3a4655f9ecb085f931ebc9aaf61bc.exe 1744 5f1364d24646f22acc7127263adfb401a9c3a4655f9ecb085f931ebc9aaf61bc.exe 1744 5f1364d24646f22acc7127263adfb401a9c3a4655f9ecb085f931ebc9aaf61bc.exe 1744 5f1364d24646f22acc7127263adfb401a9c3a4655f9ecb085f931ebc9aaf61bc.exe 1744 5f1364d24646f22acc7127263adfb401a9c3a4655f9ecb085f931ebc9aaf61bc.exe 1744 5f1364d24646f22acc7127263adfb401a9c3a4655f9ecb085f931ebc9aaf61bc.exe 1744 5f1364d24646f22acc7127263adfb401a9c3a4655f9ecb085f931ebc9aaf61bc.exe 1744 5f1364d24646f22acc7127263adfb401a9c3a4655f9ecb085f931ebc9aaf61bc.exe 1744 5f1364d24646f22acc7127263adfb401a9c3a4655f9ecb085f931ebc9aaf61bc.exe 1744 5f1364d24646f22acc7127263adfb401a9c3a4655f9ecb085f931ebc9aaf61bc.exe 1744 5f1364d24646f22acc7127263adfb401a9c3a4655f9ecb085f931ebc9aaf61bc.exe 1744 5f1364d24646f22acc7127263adfb401a9c3a4655f9ecb085f931ebc9aaf61bc.exe 1744 5f1364d24646f22acc7127263adfb401a9c3a4655f9ecb085f931ebc9aaf61bc.exe 1744 5f1364d24646f22acc7127263adfb401a9c3a4655f9ecb085f931ebc9aaf61bc.exe 1744 5f1364d24646f22acc7127263adfb401a9c3a4655f9ecb085f931ebc9aaf61bc.exe 1744 5f1364d24646f22acc7127263adfb401a9c3a4655f9ecb085f931ebc9aaf61bc.exe 1744 5f1364d24646f22acc7127263adfb401a9c3a4655f9ecb085f931ebc9aaf61bc.exe 1744 5f1364d24646f22acc7127263adfb401a9c3a4655f9ecb085f931ebc9aaf61bc.exe 1744 5f1364d24646f22acc7127263adfb401a9c3a4655f9ecb085f931ebc9aaf61bc.exe 1744 5f1364d24646f22acc7127263adfb401a9c3a4655f9ecb085f931ebc9aaf61bc.exe 1744 5f1364d24646f22acc7127263adfb401a9c3a4655f9ecb085f931ebc9aaf61bc.exe 1744 5f1364d24646f22acc7127263adfb401a9c3a4655f9ecb085f931ebc9aaf61bc.exe 1744 5f1364d24646f22acc7127263adfb401a9c3a4655f9ecb085f931ebc9aaf61bc.exe 1744 5f1364d24646f22acc7127263adfb401a9c3a4655f9ecb085f931ebc9aaf61bc.exe 1744 5f1364d24646f22acc7127263adfb401a9c3a4655f9ecb085f931ebc9aaf61bc.exe 1744 5f1364d24646f22acc7127263adfb401a9c3a4655f9ecb085f931ebc9aaf61bc.exe 1744 5f1364d24646f22acc7127263adfb401a9c3a4655f9ecb085f931ebc9aaf61bc.exe 1744 5f1364d24646f22acc7127263adfb401a9c3a4655f9ecb085f931ebc9aaf61bc.exe 1744 5f1364d24646f22acc7127263adfb401a9c3a4655f9ecb085f931ebc9aaf61bc.exe 1744 5f1364d24646f22acc7127263adfb401a9c3a4655f9ecb085f931ebc9aaf61bc.exe 1744 5f1364d24646f22acc7127263adfb401a9c3a4655f9ecb085f931ebc9aaf61bc.exe 1744 5f1364d24646f22acc7127263adfb401a9c3a4655f9ecb085f931ebc9aaf61bc.exe 1744 5f1364d24646f22acc7127263adfb401a9c3a4655f9ecb085f931ebc9aaf61bc.exe 1744 5f1364d24646f22acc7127263adfb401a9c3a4655f9ecb085f931ebc9aaf61bc.exe 1744 5f1364d24646f22acc7127263adfb401a9c3a4655f9ecb085f931ebc9aaf61bc.exe 1744 5f1364d24646f22acc7127263adfb401a9c3a4655f9ecb085f931ebc9aaf61bc.exe 1744 5f1364d24646f22acc7127263adfb401a9c3a4655f9ecb085f931ebc9aaf61bc.exe 1744 5f1364d24646f22acc7127263adfb401a9c3a4655f9ecb085f931ebc9aaf61bc.exe 1744 5f1364d24646f22acc7127263adfb401a9c3a4655f9ecb085f931ebc9aaf61bc.exe 1744 5f1364d24646f22acc7127263adfb401a9c3a4655f9ecb085f931ebc9aaf61bc.exe 1744 5f1364d24646f22acc7127263adfb401a9c3a4655f9ecb085f931ebc9aaf61bc.exe 1744 5f1364d24646f22acc7127263adfb401a9c3a4655f9ecb085f931ebc9aaf61bc.exe 1744 5f1364d24646f22acc7127263adfb401a9c3a4655f9ecb085f931ebc9aaf61bc.exe 1744 5f1364d24646f22acc7127263adfb401a9c3a4655f9ecb085f931ebc9aaf61bc.exe 1744 5f1364d24646f22acc7127263adfb401a9c3a4655f9ecb085f931ebc9aaf61bc.exe 1744 5f1364d24646f22acc7127263adfb401a9c3a4655f9ecb085f931ebc9aaf61bc.exe 1744 5f1364d24646f22acc7127263adfb401a9c3a4655f9ecb085f931ebc9aaf61bc.exe -
Suspicious use of WriteProcessMemory 54 IoCs
description pid Process procid_target PID 1744 wrote to memory of 2832 1744 5f1364d24646f22acc7127263adfb401a9c3a4655f9ecb085f931ebc9aaf61bc.exe 90 PID 1744 wrote to memory of 2832 1744 5f1364d24646f22acc7127263adfb401a9c3a4655f9ecb085f931ebc9aaf61bc.exe 90 PID 1744 wrote to memory of 2832 1744 5f1364d24646f22acc7127263adfb401a9c3a4655f9ecb085f931ebc9aaf61bc.exe 90 PID 2832 wrote to memory of 2936 2832 cmd.exe 92 PID 2832 wrote to memory of 2936 2832 cmd.exe 92 PID 2832 wrote to memory of 2936 2832 cmd.exe 92 PID 2184 wrote to memory of 3176 2184 cmd.exe 93 PID 2184 wrote to memory of 3176 2184 cmd.exe 93 PID 2184 wrote to memory of 3176 2184 cmd.exe 93 PID 1744 wrote to memory of 2952 1744 5f1364d24646f22acc7127263adfb401a9c3a4655f9ecb085f931ebc9aaf61bc.exe 94 PID 1744 wrote to memory of 2952 1744 5f1364d24646f22acc7127263adfb401a9c3a4655f9ecb085f931ebc9aaf61bc.exe 94 PID 1744 wrote to memory of 2952 1744 5f1364d24646f22acc7127263adfb401a9c3a4655f9ecb085f931ebc9aaf61bc.exe 94 PID 3176 wrote to memory of 4856 3176 system3_.exe 97 PID 3176 wrote to memory of 4856 3176 system3_.exe 97 PID 3176 wrote to memory of 4856 3176 system3_.exe 97 PID 2952 wrote to memory of 4548 2952 cmd.exe 100 PID 2952 wrote to memory of 4548 2952 cmd.exe 100 PID 2952 wrote to memory of 4548 2952 cmd.exe 100 PID 4856 wrote to memory of 4636 4856 cmd.exe 101 PID 4856 wrote to memory of 4636 4856 cmd.exe 101 PID 4856 wrote to memory of 4636 4856 cmd.exe 101 PID 5792 wrote to memory of 4648 5792 cmd.exe 102 PID 5792 wrote to memory of 4648 5792 cmd.exe 102 PID 5792 wrote to memory of 4648 5792 cmd.exe 102 PID 3176 wrote to memory of 4644 3176 system3_.exe 103 PID 3176 wrote to memory of 4644 3176 system3_.exe 103 PID 3176 wrote to memory of 4644 3176 system3_.exe 103 PID 4644 wrote to memory of 2308 4644 cmd.exe 105 PID 4644 wrote to memory of 2308 4644 cmd.exe 105 PID 4644 wrote to memory of 2308 4644 cmd.exe 105 PID 1744 wrote to memory of 2968 1744 5f1364d24646f22acc7127263adfb401a9c3a4655f9ecb085f931ebc9aaf61bc.exe 114 PID 1744 wrote to memory of 2968 1744 5f1364d24646f22acc7127263adfb401a9c3a4655f9ecb085f931ebc9aaf61bc.exe 114 PID 1744 wrote to memory of 2968 1744 5f1364d24646f22acc7127263adfb401a9c3a4655f9ecb085f931ebc9aaf61bc.exe 114 PID 2968 wrote to memory of 820 2968 cmd.exe 116 PID 2968 wrote to memory of 820 2968 cmd.exe 116 PID 2968 wrote to memory of 820 2968 cmd.exe 116 PID 1744 wrote to memory of 5988 1744 5f1364d24646f22acc7127263adfb401a9c3a4655f9ecb085f931ebc9aaf61bc.exe 117 PID 1744 wrote to memory of 5988 1744 5f1364d24646f22acc7127263adfb401a9c3a4655f9ecb085f931ebc9aaf61bc.exe 117 PID 1744 wrote to memory of 5988 1744 5f1364d24646f22acc7127263adfb401a9c3a4655f9ecb085f931ebc9aaf61bc.exe 117 PID 5988 wrote to memory of 4008 5988 cmd.exe 119 PID 5988 wrote to memory of 4008 5988 cmd.exe 119 PID 5988 wrote to memory of 4008 5988 cmd.exe 119 PID 3176 wrote to memory of 4488 3176 system3_.exe 120 PID 3176 wrote to memory of 4488 3176 system3_.exe 120 PID 3176 wrote to memory of 4488 3176 system3_.exe 120 PID 4488 wrote to memory of 5300 4488 cmd.exe 122 PID 4488 wrote to memory of 5300 4488 cmd.exe 122 PID 4488 wrote to memory of 5300 4488 cmd.exe 122 PID 3176 wrote to memory of 816 3176 system3_.exe 123 PID 3176 wrote to memory of 816 3176 system3_.exe 123 PID 3176 wrote to memory of 816 3176 system3_.exe 123 PID 816 wrote to memory of 5576 816 cmd.exe 125 PID 816 wrote to memory of 5576 816 cmd.exe 125 PID 816 wrote to memory of 5576 816 cmd.exe 125
Processes
-
C:\Users\Admin\AppData\Local\Temp\5f1364d24646f22acc7127263adfb401a9c3a4655f9ecb085f931ebc9aaf61bc.exe"C:\Users\Admin\AppData\Local\Temp\5f1364d24646f22acc7127263adfb401a9c3a4655f9ecb085f931ebc9aaf61bc.exe"1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Enumerates connected drives
- Drops autorun.inf file
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1744 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C AT /delete /yes2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2832 -
C:\Windows\SysWOW64\at.exeAT /delete /yes3⤵
- System Location Discovery: System Language Discovery
PID:2936
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Users\Admin\Desktop\system3_.exe2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2952 -
C:\Windows\SysWOW64\at.exeAT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Users\Admin\Desktop\system3_.exe3⤵
- System Location Discovery: System Language Discovery
PID:4548
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C cacls "C:\system volume information" /e /g "Admin":f2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2968 -
C:\Windows\SysWOW64\cacls.execacls "C:\system volume information" /e /g "Admin":f3⤵
- System Location Discovery: System Language Discovery
PID:820
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C cacls "C:\system volume information" /e /g "Admin":f2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5988 -
C:\Windows\SysWOW64\cacls.execacls "C:\system volume information" /e /g "Admin":f3⤵
- System Location Discovery: System Language Discovery
PID:4008
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\Desktop\system3_.exe1⤵
- Suspicious use of WriteProcessMemory
PID:2184 -
C:\Users\Admin\Desktop\system3_.exeC:\Users\Admin\Desktop\system3_.exe2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Adds Run key to start application
- Enumerates connected drives
- Drops autorun.inf file
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3176 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C AT /delete /yes3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4856 -
C:\Windows\SysWOW64\at.exeAT /delete /yes4⤵
- System Location Discovery: System Language Discovery
PID:4636
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Users\Admin\Desktop\system3_.exe3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4644 -
C:\Windows\SysWOW64\at.exeAT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Users\Admin\Desktop\system3_.exe4⤵
- System Location Discovery: System Language Discovery
PID:2308
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C cacls "C:\system volume information" /e /g "Admin":f3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4488 -
C:\Windows\SysWOW64\cacls.execacls "C:\system volume information" /e /g "Admin":f4⤵
- System Location Discovery: System Language Discovery
PID:5300
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C cacls "C:\system volume information" /e /g "Admin":f3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:816 -
C:\Windows\SysWOW64\cacls.execacls "C:\system volume information" /e /g "Admin":f4⤵
- System Location Discovery: System Language Discovery
PID:5576
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\Desktop\system3_.exe1⤵
- Suspicious use of WriteProcessMemory
PID:5792 -
C:\Users\Admin\Desktop\system3_.exeC:\Users\Admin\Desktop\system3_.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4648
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD54a90329071ae30b759d279cca342b0a6
SHA10ac7c4f3357ce87f37a3a112d6878051c875eda5
SHA256fb6a7c3edcd7b97fabc18855102a39fc4d6d3f82c0fdd39b1667807b71b9c49b
SHA512f0e206053d4369437c2c0f1f90f0fd03d631e4b9859d807049b41efde823d64cf4d75c28316d932360f7c03bd409e923c8bc2d4f5959361feacecfcf101ae823
-
Filesize
530B
MD51fbb37f79b317a9a248e7c4ce4f5bac5
SHA10ff4d709ebf17be0c28e66dc8bf74672ca28362a
SHA2566fb1b8e593cb0388f67ead35313a230f524657317ea86271b3a97362e5ec6ad9
SHA512287e1d62c9ceb660965c266f677c467fbb997c2f5dcd1d63e185e266488aafc3489ac1d3feec81d10f01ce4a72e61a8bc4e124f137ce8675a220aa7797002e74
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12
Filesize174B
MD57bfb324785efda7b72fe68e776ffbf01
SHA10ce7fd5e0c43a30e6ab0c569eae1db63d64bd769
SHA25662ca49e542916005953f57ce42fbf822e6c48b789ab7b0c6e21e5a5eec90f99a
SHA51207a3badd8c9e2e70dc55631b7fe28ffd22ba416388242c91b076befe96b9cc5ba6a7af37f866143b8eb0a58fd414b31bd790720b5eea448c6e06464e947cbc4b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8
Filesize170B
MD53b402cadecc74e66fab3979ed1e94c16
SHA18bbe374482ccc69adf9b0c973483869177ff1bd5
SHA25684a08ede3bb024ea43de720e78be7fcdee4bbddb7c9a78f5f55067d5d462f7ff
SHA51245667f912348f36ea92c1faf47889e2235dac499c91019ae38d84cef792553cee2baa2c6d61b9b8796811135d8826149bbb6a4899114fc6867d12da33580bf74
-
Filesize
167B
MD50104c301c5e02bd6148b8703d19b3a73
SHA17436e0b4b1f8c222c38069890b75fa2baf9ca620
SHA256446a6087825fa73eadb045e5a2e9e2adf7df241b571228187728191d961dda1f
SHA51284427b656a6234a651a6d8285c103645b861a18a6c5af4abb5cb4f3beb5a4f0df4a74603a0896c7608790fbb886dc40508e92d5709f44dca05dd46c8316d15bf
-
Filesize
102B
MD5948c74cd98911b420ff89dac13399bcb
SHA176dfc73518f003953923b1b4f2b973f4bb56a411
SHA25694a1ac3d574425ec8a3cc01675e4d787373d2a190dddd4f8ba507c49ca3fd42a
SHA512b31d82ede9d48e390a50a9dcf5c4c607c62638e8bc56f473250f9a56b7967d5de948abed69bbb2c35eb0112288faa5c438316b06ccbb36d289e93952b30e2ede
-
Filesize
990KB
MD588d6b61f9b307ca1ba9aefbe413ca028
SHA10a67ce5a5f48652547563812911b2d94418a0dcc
SHA2565f1364d24646f22acc7127263adfb401a9c3a4655f9ecb085f931ebc9aaf61bc
SHA51236a0c8038390bae34c05610a2396c47ef575905b205fbc4ca13dc4984a18cc42ee3d9def3664ee67fc2fe4a2f1056c59058211e1b92bdd4d5e8683d74e0a5ccf