Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
Open.EXE
|
PE32+ executable (GUI) x86-64, for MS Windows
|
initial sample
|
||
|
C:\Users\user\AppData\Local\Temp\IXP000.TMP\Open.cmd
|
ASCII text, with no line terminators
|
dropped
|
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Windows\System32\cmd.exe
|
cmd /c \\fada-planner\Other\RevitTool\01_ToolList\files\3_PLC\exe\3\Open.cmd
|
 |
|
|
C:\Users\user\Desktop\Open.EXE
|
"C:\Users\user\Desktop\Open.EXE"
|
||
|
C:\Windows\System32\conhost.exe
|
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
|
||
|
C:\Windows\System32\rundll32.exe
|
"C:\Windows\system32\rundll32.exe" C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\user\AppData\Local\Temp\IXP000.TMP\"
|
Registry
|
Path
|
Value
|
Malicious
|
|
|---|---|---|---|
|
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
|
wextract_cleanup0
|
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
28C076E5000
|
heap
|
page read and write
|
||
|
28C07640000
|
heap
|
page read and write
|
||
|
28C0767B000
|
heap
|
page read and write
|
||
|
7FF73F98E000
|
unkown
|
page readonly
|
||
|
2A5BE4D0000
|
heap
|
page read and write
|
||
|
2A5BE8C0000
|
heap
|
page read and write
|
||
|
7FF73F98C000
|
unkown
|
page write copy
|
||
|
28C0767B000
|
heap
|
page read and write
|
||
|
28C07670000
|
heap
|
page read and write
|
||
|
7FF73F98C000
|
unkown
|
page read and write
|
||
|
2A5BE6E0000
|
heap
|
page read and write
|
||
|
28C0764D000
|
heap
|
page read and write
|
||
|
2A5BE6C0000
|
heap
|
page read and write
|
||
|
28C076BE000
|
heap
|
page read and write
|
||
|
28C07855000
|
heap
|
page read and write
|
||
|
28C0767B000
|
heap
|
page read and write
|
||
|
28C074C0000
|
heap
|
page read and write
|
||
|
28C076E6000
|
heap
|
page read and write
|
||
|
28C076E6000
|
heap
|
page read and write
|
||
|
28C07620000
|
heap
|
page read and write
|
||
|
28C07730000
|
heap
|
page read and write
|
||
|
7FF73F989000
|
unkown
|
page readonly
|
||
|
28C07850000
|
heap
|
page read and write
|
||
|
7FF73F989000
|
unkown
|
page readonly
|
||
|
7FF73F981000
|
unkown
|
page execute read
|
||
|
9C5251D000
|
stack
|
page read and write
|
||
|
28C07670000
|
heap
|
page read and write
|
||
|
28C076BB000
|
heap
|
page read and write
|
||
|
28C076E6000
|
heap
|
page read and write
|
||
|
2A5BE4F8000
|
heap
|
page read and write
|
||
|
7FF73F980000
|
unkown
|
page readonly
|
||
|
C4626FC000
|
stack
|
page read and write
|
||
|
28C07648000
|
heap
|
page read and write
|
||
|
9C528FF000
|
stack
|
page read and write
|
||
|
28C076E5000
|
heap
|
page read and write
|
||
|
7FF73F98E000
|
unkown
|
page readonly
|
||
|
28C0764D000
|
heap
|
page read and write
|
||
|
7FF73F981000
|
unkown
|
page execute read
|
||
|
28C0767B000
|
heap
|
page read and write
|
||
|
28C077A3000
|
heap
|
page read and write
|
||
|
7FF73F980000
|
unkown
|
page readonly
|
||
|
9C5287E000
|
stack
|
page read and write
|
||
|
2A5BFF50000
|
heap
|
page read and write
|
||
|
C46277E000
|
stack
|
page read and write
|
||
|
2A5BE4F0000
|
heap
|
page read and write
|
||
|
C4627FE000
|
stack
|
page read and write
|
||
|
28C0767B000
|
heap
|
page read and write
|
||
|
28C07628000
|
heap
|
page read and write
|
||
|
28C0785A000
|
heap
|
page read and write
|
||
|
9C5259E000
|
stack
|
page read and write
|
||
|
28C09E3A000
|
heap
|
page read and write
|
||
|
28C076CD000
|
heap
|
page read and write
|
||
|
28C0767D000
|
heap
|
page read and write
|
||
|
28C076C2000
|
heap
|
page read and write
|
||
|
28C077A0000
|
heap
|
page read and write
|
||
|
28C075A0000
|
heap
|
page read and write
|
||
|
28C07649000
|
heap
|
page read and write
|
||
|
28C0767B000
|
heap
|
page read and write
|
||
|
28C075C0000
|
heap
|
page read and write
|
||
|
28C09530000
|
trusted library allocation
|
page read and write
|
||
|
28C09D30000
|
heap
|
page read and write
|
||
|
28C07640000
|
heap
|
page read and write
|
||
|
9C5249B000
|
stack
|
page read and write
|
||
|
2A5BE8C5000
|
heap
|
page read and write
|
There are 54 hidden memdumps, click here to show them.