gozi_ifsb | 385f77e0604e9926408a261fb3e56268f60e0fda4f124f2d1b0c1b45d106bdc0

Analysis

max time kernel
150s
max time network
112s
platform
windows10_x64
resource
win10v200410
submitted
17-04-2020 22:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

job_attach_h6x.js
Size

1.3MB
MD5

c9a6a820f7d344bfd42471b9964049a8
SHA1

bdc1669dec4e00d2d76817379b7b5088fadb471b
SHA256

385f77e0604e9926408a261fb3e56268f60e0fda4f124f2d1b0c1b45d106bdc0
SHA512

8b5d2d1ad55b942a5158036530c7c92cdb7318b4e878ff4d3e31d891b5b4a874914860c708d056b0033872cff006ce542ebdd79d04d13249e9c63c7f2622fa8f

Score

10^/10

spyware banker trojan gozi_ifsb ursnif

Malware Config

Signatures

Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

3304 regsvr32.exe

pid	process
3304	regsvr32.exe

Suspicious use of AdjustPrivilegeToken 25 IoCs

Processes:

powershell.exeExplorer.EXE

description	pid	process
Token: SeDebugPrivilege	1776	powershell.exe
Token: SeShutdownPrivilege	3004	Explorer.EXE
Token: SeCreatePagefilePrivilege	3004	Explorer.EXE
Token: SeShutdownPrivilege	3004	Explorer.EXE
Token: SeCreatePagefilePrivilege	3004	Explorer.EXE
Token: SeShutdownPrivilege	3004	Explorer.EXE
Token: SeCreatePagefilePrivilege	3004	Explorer.EXE
Token: SeShutdownPrivilege	3004	Explorer.EXE
Token: SeCreatePagefilePrivilege	3004	Explorer.EXE
Token: SeShutdownPrivilege	3004	Explorer.EXE
Token: SeCreatePagefilePrivilege	3004	Explorer.EXE
Token: SeShutdownPrivilege	3004	Explorer.EXE
Token: SeCreatePagefilePrivilege	3004	Explorer.EXE
Token: SeShutdownPrivilege	3004	Explorer.EXE
Token: SeCreatePagefilePrivilege	3004	Explorer.EXE
Token: SeShutdownPrivilege	3004	Explorer.EXE
Token: SeCreatePagefilePrivilege	3004	Explorer.EXE
Token: SeShutdownPrivilege	3004	Explorer.EXE
Token: SeCreatePagefilePrivilege	3004	Explorer.EXE
Token: SeShutdownPrivilege	3004	Explorer.EXE
Token: SeCreatePagefilePrivilege	3004	Explorer.EXE
Token: SeShutdownPrivilege	3004	Explorer.EXE
Token: SeCreatePagefilePrivilege	3004	Explorer.EXE
Token: SeShutdownPrivilege	3004	Explorer.EXE
Token: SeCreatePagefilePrivilege	3004	Explorer.EXE

Suspicious behavior: MapViewOfSection 7 IoCs

Processes:

powershell.exeExplorer.EXEcmd.exe

pid process

1776 powershell.exe
3004 Explorer.EXE
3004 Explorer.EXE
3004 Explorer.EXE
1492 cmd.exe
3004 Explorer.EXE
3004 Explorer.EXE
Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

Processes:

PING.EXE

pid process

2100 PING.EXE

pid	process
2100	PING.EXE

Makes http(s) request 14 IoCs

Contacts server via http/https, possibly for C2 communication.

Processes:

description	flow	ioc
HTTP URL	9	http://f1.pipen.at/api1/7GADvelaQdBbcG3cbgNJ/6PTVYPIzuoy2_2Fo7Vs/Z7Ftbay9t5_2FrgAwVuB07/ndO3mq_2Bb4bq/d3OqtCkH/Sc8eiDnGQAevMRCWB6L9HZz/MYQAssSNqn/ECQuVHuPYw5wDz7Mh/cWjlKyW60knY/zLJxzs_2Bgf/fqMhC7655CM_2F/oXAJMbyHgHEgAt3lxzK42/Hy1kHZTXr_2BAlM0/E68oT1_2FvoJpSs/RrSoKWtqa5cWhCcPmC/c7NBZD5VJ/fLebuDJPAgNO7AhYoq_0/A_0Dgctzv5dzstE2o9T/ArSgFesZKZLkgPOdWbrLbF/5MvCthq87r3xv/VAsSgiDzqAX1/IN_2Btqi
HTTP URL	7	http://f1.pipen.at/favicon.ico
HTTP URL	18	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8sEMlbBsCTf7jUSfg%2BhWk%3D
HTTP URL	14	https://iecvlist.microsoft.com/ie11blocklist/1401746408/versionlist.xml
HTTP URL	36	http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/pinrulesstl.cab?68e7dc638e6ec9f3
HTTP URL	28	http://vv.malorun.at/api1/KulXPZBhPRI9AZpt0KVnSY/EmUH0xBPcRseT/CVKrnRad/BtAmyswQafP1ETIiT2jGBvC/NaH6_2BlvK/mTndwDfwLg_2BNY41/KcH9yCOCJked/vsuY8RrWnUs/lKuTpejJvqFqps/VnTOqyd8rzcl8DKJXkHsX/8NEntAZ_2BV0Eaw_/2FaokEL_2FC7PWk/iw9mQPnlfZnfpGajNg/7sLeiY59B/Qpx7Tz4gmpgSTGudpIJB/JUPG7pajyhtjRI_2F31/qkQY8rM2_2BZYflWfA_0A_/0DZX_2F9WLLP5/_2Ft_2Fe/v1npgVweaKpPMVH4DtZXwTy/jyW5YGk6h/lY
HTTP URL	29	http://vv.malorun.at/api1/aJmNvxexK8IcNZYPpXr5j/pJNl6hXCqIDwZZzZ/1IQgI0SgF41C4VT/HZq9m7HnCjVdpPQZ0L/8G41RVsEw/x29Zk2pOUfHxMKHrMQb5/m97IEnNikOkgzRgrIAF/aGzIp6PhKyqole3CCWrg07/Nqi5nQsliTpoR/iiWAbanz/J93rS58IPIpV68LlM8jmkzK/CuTU_2F6k1/ra7bIQj7mX4oYjz57/wcRIiP45bG0n/0REmhXN_2BA/_2Be0iRAbNriP3/RJwBEDY7C8_0A_0DrMC5J/XSw9Zf1alyfreMcN/lZUtyv9vfNrAFEV/BQ_2B54t5I/8tF
HTTP URL	19	https://iecvlist.microsoft.com/ie11blocklist/1401746408/versionlist.xml
HTTP URL	30	http://vv.malorun.at/api1/DtVa0JKDu7t7/rCn5O7WB_2B/l1PNE6VLBJRB5A/_2B41iJuLJsHB2_2F3QlE/16kjdUDk7ZySfLu4/_2FdA7NveiaApfr/EGZhanFAxZ5SIDh3Mk/q_2FscHo_/2BLQy8TGbImkT9e_2Bdu/QwRSMyc_2FGjEG4QWem/xMOaXcmDH5et3e6KvST7sD/Y5q2ylkfIsJTw/zeUUs87p/UIIvO1xtKV814WLu4h0MIkC/kUzidBd_2B/rbnsfgDDbl5AwaSQl/DCPmqQAYQu1B/YZqiEYW3St_/0A_0Diy9Ik2Jbq/ounq_2FunUs7VsDRXlsiw/AL2DaLK_2BpYccIIdD/GXV
HTTP URL	16	http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?5c7c3d4323d2c5b0
HTTP URL	5	http://f1.pipen.at/api1/NzPZt7xlYBIGaMAgWr0LnK1/mCqKX5N7nd/WLnFw0YpeIkJ47ism/_2Fd5tx3oUnx/8mxM0_2FWpZ/10j4aoqtfdVHr1/1SOvz5YDPOHV9bmC_2BtZ/ExG4KkAcAfV2LpU3/oV34RFUxCvYgfUO/MnCa_2FNsWNqv0P1IF/EMt6RqnGP/2H5euJw1BG9xXAOeCRE1/JSZ2A_2BonghZKRscJs/Mt4wn_2BV_2B43a2UsRPVa/eWTQ_2FSvnSKH/0kCeYlbp/HeDHRuVhbK53BXDLqrPO_0A/_0DyXN6e4N/vldvH5S6U0cy4H3UC/c9fx1gwkP4M6/fvYKKfVajXz/gli9vtRJjQMIZBJFok/kVp
HTTP URL	8	http://f1.pipen.at/favicon.ico
HTTP URL	6	http://f1.pipen.at/api1/AlPStzn1F/pMrvuw9ZsvHIKCK8Biz9/1HZ6ZQamdd9mtGrSZkJ/tXEEJ4tFgK3XSFVBWef2TF/7MiKiIqv1b9Jr/mf8C9OFs/geqoMAmm1rwgUhkwm_2BaQk/qOYAC6Lv6k/4r3AcbOLkOUL8IqEK/R5Bb8gdeZyHj/1_2BSQF1HVM/TSwv7oBqoZ_2FT/m3WlCJSX9_2BQeP9KeINi/OToUYF9PiLh1xXI_/2FWdiNnx5QixvCs/2FcIsb_2FIA0a5Om9F/cR9LSMuWm/7WMUc2V_0A_0DFT6rcV6/Xb7h3j0nWlUPRZdhc0N/a3RaWTEX7ZV8wpcXYPFg7Q/8hej4uURpKV47cnp5/VU1
HTTP URL	12	http://api10.dianer.at/jvassets/xI/t64.dat

Ursnif, Dreambot
Ursnif is a variant of the Gozi IFSB with more capabilities.
banker trojan ursnif

Suspicious use of WriteProcessMemory 54 IoCs

Processes:

wscript.exeregsvr32.exeiexplore.exemshta.exepowershell.execsc.execsc.exeExplorer.EXEcmd.exe

description	pid	process	target process
PID 3328 wrote to memory of 3880	3328	wscript.exe	regsvr32.exe
PID 3328 wrote to memory of 3880	3328	wscript.exe	regsvr32.exe
PID 3880 wrote to memory of 3304	3880	regsvr32.exe	regsvr32.exe
PID 3880 wrote to memory of 3304	3880	regsvr32.exe	regsvr32.exe
PID 3880 wrote to memory of 3304	3880	regsvr32.exe	regsvr32.exe
PID 4008 wrote to memory of 3316	4008	iexplore.exe	IEXPLORE.EXE
PID 4008 wrote to memory of 3316	4008	iexplore.exe	IEXPLORE.EXE
PID 4008 wrote to memory of 3316	4008	iexplore.exe	IEXPLORE.EXE
PID 4008 wrote to memory of 3572	4008	iexplore.exe	IEXPLORE.EXE
PID 4008 wrote to memory of 3572	4008	iexplore.exe	IEXPLORE.EXE
PID 4008 wrote to memory of 3572	4008	iexplore.exe	IEXPLORE.EXE
PID 3836 wrote to memory of 1776	3836	mshta.exe	powershell.exe
PID 3836 wrote to memory of 1776	3836	mshta.exe	powershell.exe
PID 1776 wrote to memory of 860	1776	powershell.exe	csc.exe
PID 1776 wrote to memory of 860	1776	powershell.exe	csc.exe
PID 860 wrote to memory of 1004	860	csc.exe	cvtres.exe
PID 860 wrote to memory of 1004	860	csc.exe	cvtres.exe
PID 1776 wrote to memory of 1032	1776	powershell.exe	csc.exe
PID 1776 wrote to memory of 1032	1776	powershell.exe	csc.exe
PID 1032 wrote to memory of 1248	1032	csc.exe	cvtres.exe
PID 1032 wrote to memory of 1248	1032	csc.exe	cvtres.exe
PID 1776 wrote to memory of 3004	1776	powershell.exe	Explorer.EXE
PID 1776 wrote to memory of 3004	1776	powershell.exe	Explorer.EXE
PID 1776 wrote to memory of 3004	1776	powershell.exe	Explorer.EXE
PID 3004 wrote to memory of 3488	3004	Explorer.EXE	RuntimeBroker.exe
PID 3004 wrote to memory of 1492	3004	Explorer.EXE	cmd.exe
PID 3004 wrote to memory of 1492	3004	Explorer.EXE	cmd.exe
PID 3004 wrote to memory of 1492	3004	Explorer.EXE	cmd.exe
PID 3004 wrote to memory of 3488	3004	Explorer.EXE	RuntimeBroker.exe
PID 3004 wrote to memory of 3488	3004	Explorer.EXE	RuntimeBroker.exe
PID 3004 wrote to memory of 4008	3004	Explorer.EXE	iexplore.exe
PID 3004 wrote to memory of 1492	3004	Explorer.EXE	cmd.exe
PID 3004 wrote to memory of 1492	3004	Explorer.EXE	cmd.exe
PID 3004 wrote to memory of 4008	3004	Explorer.EXE	iexplore.exe
PID 3004 wrote to memory of 4008	3004	Explorer.EXE	iexplore.exe
PID 1492 wrote to memory of 2100	1492	cmd.exe	PING.EXE
PID 3004 wrote to memory of 2836	3004	Explorer.EXE	cmd.exe
PID 3004 wrote to memory of 2836	3004	Explorer.EXE	cmd.exe
PID 3004 wrote to memory of 2820	3004	Explorer.EXE	cmd.exe
PID 3004 wrote to memory of 2820	3004	Explorer.EXE	cmd.exe
PID 3004 wrote to memory of 3556	3004	Explorer.EXE	cmd.exe
PID 3004 wrote to memory of 3556	3004	Explorer.EXE	cmd.exe
PID 3004 wrote to memory of 3608	3004	Explorer.EXE	cmd.exe
PID 3004 wrote to memory of 3608	3004	Explorer.EXE	cmd.exe
PID 3004 wrote to memory of 1924	3004	Explorer.EXE	WinMail.exe
PID 3004 wrote to memory of 1924	3004	Explorer.EXE	WinMail.exe
PID 3004 wrote to memory of 1924	3004	Explorer.EXE	WinMail.exe
PID 3004 wrote to memory of 1924	3004	Explorer.EXE	WinMail.exe
PID 3004 wrote to memory of 1924	3004	Explorer.EXE	WinMail.exe
PID 3004 wrote to memory of 4016	3004	Explorer.EXE	WinMail.exe
PID 3004 wrote to memory of 4016	3004	Explorer.EXE	WinMail.exe
PID 3004 wrote to memory of 4016	3004	Explorer.EXE	WinMail.exe
PID 3004 wrote to memory of 4016	3004	Explorer.EXE	WinMail.exe
PID 3004 wrote to memory of 4016	3004	Explorer.EXE	WinMail.exe

Suspicious use of FindShellTrayWindow 3 IoCs

Processes:

iexplore.exe

pid process

4008 iexplore.exe
4008 iexplore.exe
4008 iexplore.exe

Suspicious use of SetThreadContext 7 IoCs

Processes:

powershell.exeExplorer.EXEcmd.exe

description	pid	process	target process
PID 1776 set thread context of 3004	1776	powershell.exe	Explorer.EXE
PID 3004 set thread context of 3488	3004	Explorer.EXE	RuntimeBroker.exe
PID 3004 set thread context of 1492	3004	Explorer.EXE	cmd.exe
PID 3004 set thread context of 4008	3004	Explorer.EXE	iexplore.exe
PID 1492 set thread context of 2100	1492	cmd.exe	PING.EXE
PID 3004 set thread context of 1924	3004	Explorer.EXE	WinMail.exe
PID 3004 set thread context of 4016	3004	Explorer.EXE	WinMail.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

Checks whether UAC is enabled 3 IoCs

Processes:

IEXPLORE.EXEIEXPLORE.EXEiexplore.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	IEXPLORE.EXE
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	IEXPLORE.EXE
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	iexplore.exe

Gozi, Gozi IFSB
Gozi ISFB is a well-known and widely distributed banking trojan.
banker trojan gozi_ifsb

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXEIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2136578390-2771164089-400866267-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2136578390-2771164089-400866267-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2136578390-2771164089-400866267-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2136578390-2771164089-400866267-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3193963248"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2136578390-2771164089-400866267-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2136578390-2771164089-400866267-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2136578390-2771164089-400866267-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2136578390-2771164089-400866267-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2136578390-2771164089-400866267-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2136578390-2771164089-400866267-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e015e5b11715d601	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2136578390-2771164089-400866267-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff5800000000000000de04000065020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2136578390-2771164089-400866267-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2136578390-2771164089-400866267-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3224119161"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2136578390-2771164089-400866267-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E9A303E1-810A-11EA-8133-7E6CB608EB13} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2136578390-2771164089-400866267-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2136578390-2771164089-400866267-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff3e0000003e000000c4040000a3020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2136578390-2771164089-400866267-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2136578390-2771164089-400866267-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2136578390-2771164089-400866267-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2136578390-2771164089-400866267-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2136578390-2771164089-400866267-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2136578390-2771164089-400866267-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2136578390-2771164089-400866267-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006277417e0e384844bb6ae3857779503200000000020000000000106600000001000020000000f0ed12ed9076570408c256bfb1433c0335287970bebe0b68e5e442089099d1a2000000000e8000000002000020000000068e0308c5f3caee4f529656b105e594b866de467b1ffc1e1f2774a988e75f0b20000000b84a61972d301d55e6c56fd1ed8ca92c321d3f6754bd8ef97fab02fe1e77662240000000105434f343f78cb6ad7d9a546be353241304db01a0c048c2b16f4aafaf7a9ea57d54284163a416048d6010f95568eea8e7eeaff37718f4246fa29f5759e70028	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2136578390-2771164089-400866267-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2136578390-2771164089-400866267-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2136578390-2771164089-400866267-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2136578390-2771164089-400866267-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 804fd8b21715d601	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2136578390-2771164089-400866267-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3193963248"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2136578390-2771164089-400866267-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2136578390-2771164089-400866267-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2136578390-2771164089-400866267-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006277417e0e384844bb6ae385777950320000000002000000000010660000000100002000000083bc407a013c578fd215cd3888c53a8df09b66011ad00050d646a9adfa1e0c98000000000e8000000002000020000000fc783272e09eb3c647c9d5c4022ee9a51c25fd4a20b28c09e9810dc82dbcd31e20000000ea5f54eccbb1bdc7cee0e861acc07f96b532276e5cf6f6fb2e59c89cf59ab95c400000008568e7f071682668e7233f0b7f073ee2ffc45255db9d2adf50da81a21b6b29caebcbfba17b91daf157d5c38ef1da15599f7a3292852ffb2e0b2a48bc11c2cba5	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2136578390-2771164089-400866267-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30807319"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2136578390-2771164089-400866267-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30807319"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2136578390-2771164089-400866267-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30807319"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2136578390-2771164089-400866267-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2136578390-2771164089-400866267-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE

Suspicious use of SetWindowsHookEx 12 IoCs

Processes:

iexplore.exeIEXPLORE.EXEIEXPLORE.EXE

pid	process
4008	iexplore.exe
4008	iexplore.exe
3316	IEXPLORE.EXE
3316	IEXPLORE.EXE
4008	iexplore.exe
4008	iexplore.exe
3572	IEXPLORE.EXE
3572	IEXPLORE.EXE
4008	iexplore.exe
4008	iexplore.exe
3316	IEXPLORE.EXE
3316	IEXPLORE.EXE

Suspicious behavior: EnumeratesProcesses 1259 IoCs

Processes:

powershell.exeExplorer.EXE

pid	process
1776	powershell.exe
1776	powershell.exe
1776	powershell.exe
3004	Explorer.EXE
3004	Explorer.EXE
3004	Explorer.EXE
3004	Explorer.EXE
3004	Explorer.EXE
3004	Explorer.EXE
3004	Explorer.EXE
3004	Explorer.EXE
3004	Explorer.EXE
3004	Explorer.EXE
3004	Explorer.EXE
3004	Explorer.EXE
3004	Explorer.EXE
3004	Explorer.EXE
3004	Explorer.EXE
3004	Explorer.EXE
3004	Explorer.EXE
3004	Explorer.EXE
3004	Explorer.EXE
3004	Explorer.EXE
3004	Explorer.EXE
3004	Explorer.EXE
3004	Explorer.EXE
3004	Explorer.EXE
3004	Explorer.EXE
3004	Explorer.EXE
3004	Explorer.EXE
3004	Explorer.EXE
3004	Explorer.EXE
3004	Explorer.EXE
3004	Explorer.EXE
3004	Explorer.EXE
3004	Explorer.EXE
3004	Explorer.EXE
3004	Explorer.EXE
3004	Explorer.EXE
3004	Explorer.EXE
3004	Explorer.EXE
3004	Explorer.EXE
3004	Explorer.EXE
3004	Explorer.EXE
3004	Explorer.EXE
3004	Explorer.EXE
3004	Explorer.EXE
3004	Explorer.EXE
3004	Explorer.EXE
3004	Explorer.EXE
3004	Explorer.EXE
3004	Explorer.EXE
3004	Explorer.EXE
3004	Explorer.EXE
3004	Explorer.EXE
3004	Explorer.EXE
3004	Explorer.EXE
3004	Explorer.EXE
3004	Explorer.EXE
3004	Explorer.EXE
3004	Explorer.EXE
3004	Explorer.EXE
3004	Explorer.EXE
3004	Explorer.EXE

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

2100 PING.EXE

pid	process
2100	PING.EXE

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
PID:3004
- C:\Windows\system32\wscript.exe
  wscript.exe C:\Users\Admin\AppData\Local\Temp\job_attach_h6x.js
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3328
- - C:\Windows\System32\regsvr32.exe
    "C:\Windows\System32\regsvr32.exe" C:\Users\Admin\AppData\Local\Temp\\DeNSXQbUgM.txt
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3880
  - - C:\Windows\SysWOW64\regsvr32.exe
      C:\Users\Admin\AppData\Local\Temp\\DeNSXQbUgM.txt
      4⤵
      Loads dropped DLL
      PID:3304
- C:\Windows\System32\mshta.exe
  "C:\Windows\System32\mshta.exe" "about:<hta:application><script>resizeTo(1,1);eval(new ActiveXObject('WScript.Shell').RegRead('HKCU\\Software\\AppDataLow\\Software\\Microsoft\\786D016B-7752-6A8D-C12C-9B3E8520FF52\\Apdsprov'));if(!window.flag)close()</script>"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3836
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" iex ([System.Text.Encoding]::ASCII.GetString(( gp "HKCU:Software\AppDataLow\Software\Microsoft\786D016B-7752-6A8D-C12C-9B3E8520FF52").Assioker))
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    PID:1776
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\pfnir1g1\pfnir1g1.cmdline"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:860
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA3FB.tmp" "c:\Users\Admin\AppData\Local\Temp\pfnir1g1\CSCE0BA480496764639A1B88C2E1BD35991.TMP"
        5⤵
        
        PID:1004
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\0wty5kk1\0wty5kk1.cmdline"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1032
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA5E0.tmp" "c:\Users\Admin\AppData\Local\Temp\0wty5kk1\CSCEC611F6845DA41ED958C798A60768BC3.TMP"
        5⤵
        
        PID:1248
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C ping localhost -n 5 && del "C:\Users\Admin\AppData\Local\Temp\DeNSXQbUgM.txt"
  2⤵
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  - Suspicious use of SetThreadContext
  PID:1492
- - C:\Windows\system32\PING.EXE
    ping localhost -n 5
    3⤵
    - Suspicious behavior: CmdExeWriteProcessMemorySpam
    - Runs ping.exe
    PID:2100
- C:\Windows\system32\cmd.exe
  cmd /C "nslookup myip.opendns.com resolver1.opendns.com > C:\Users\Admin\AppData\Local\Temp\BEA8.bi1"
  2⤵
  PID:2836
- - C:\Windows\system32\nslookup.exe
    nslookup myip.opendns.com resolver1.opendns.com
    3⤵
    PID:3648
- C:\Windows\system32\cmd.exe
  cmd /C "nslookup myip.opendns.com resolver1.opendns.com > C:\Users\Admin\AppData\Local\Temp\BEC4.bi1"
  2⤵
  PID:2820
- - C:\Windows\system32\nslookup.exe
    nslookup myip.opendns.com resolver1.opendns.com
    3⤵
    PID:3668
- C:\Windows\system32\cmd.exe
  cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\BEA8.bi1"
  2⤵
  PID:3556
- C:\Windows\system32\cmd.exe
  cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\BEC4.bi1"
  2⤵
  PID:3608
- C:\Program Files\Windows Mail\WinMail.exe
  "C:\Program Files\Windows Mail\WinMail" OCInstallUserConfigOE
  2⤵
  PID:1924
- C:\Program Files\Windows Mail\WinMail.exe
  "C:\Program Files\Windows Mail\WinMail" OCInstallUserConfigOE
  2⤵
  PID:4016

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3488

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of FindShellTrayWindow
- Checks whether UAC is enabled
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4008
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4008 CREDAT:82945 /prefetch:2
  2⤵
  - Checks whether UAC is enabled
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3316
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4008 CREDAT:82950 /prefetch:2
  2⤵
  - Checks whether UAC is enabled
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3572

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Remote System Discovery

T1018

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_D9817BD5013875AD517DA73475345203

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_D9817BD5013875AD517DA73475345203

Download Submit
C:\Users\Admin\AppData\Local\Temp\0wty5kk1\0wty5kk1.dll

Download Submit
C:\Users\Admin\AppData\Local\Temp\BEA8.bi1

Download Submit
C:\Users\Admin\AppData\Local\Temp\BEA8.bi1

Download Submit
C:\Users\Admin\AppData\Local\Temp\BEC4.bi1

Download Submit
C:\Users\Admin\AppData\Local\Temp\BEC4.bi1

Download Submit
C:\Users\Admin\AppData\Local\Temp\DeNSXQbUgM.txt

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESA3FB.tmp

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESA5E0.tmp

Download Submit
C:\Users\Admin\AppData\Local\Temp\pfnir1g1\pfnir1g1.dll

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\0wty5kk1\0wty5kk1.0.cs

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\0wty5kk1\0wty5kk1.cmdline

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\0wty5kk1\CSCEC611F6845DA41ED958C798A60768BC3.TMP

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\pfnir1g1\CSCE0BA480496764639A1B88C2E1BD35991.TMP

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\pfnir1g1\pfnir1g1.0.cs

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\pfnir1g1\pfnir1g1.cmdline

Download Submit
\Users\Admin\AppData\Local\Temp\DeNSXQbUgM.txt

Download Submit
memory/1492-16-0x000001E826D40000-0x000001E826D41000-memory.dmp

Filesize
4KB

Download
memory/1492-22-0x000001E829110000-0x000001E8291C1000-memory.dmp

Filesize
708KB

Download
memory/1776-13-0x00000286FB940000-0x00000286FB9F1000-memory.dmp

Filesize
708KB

Download
memory/1924-30-0x0000025573C90000-0x0000025573C91000-memory.dmp

Filesize
4KB

Download
memory/2100-20-0x0000020DE7600000-0x0000020DE7601000-memory.dmp

Filesize
4KB

Download
memory/3004-15-0x0000000002520000-0x00000000025D1000-memory.dmp

Filesize
708KB

Download
memory/3004-17-0x0000000002520000-0x00000000025D1000-memory.dmp

Filesize
708KB

Download
memory/3004-12-0x0000000000180000-0x0000000000181000-memory.dmp

Filesize
4KB

Download
memory/3004-19-0x0000000002520000-0x00000000025D1000-memory.dmp

Filesize
708KB

Download
memory/3004-31-0x0000000004C90000-0x0000000004D41000-memory.dmp

Filesize
708KB

Download
memory/3004-35-0x0000000004C90000-0x0000000004D41000-memory.dmp

Filesize
708KB

Download
memory/3488-14-0x000001E308570000-0x000001E308571000-memory.dmp

Filesize
4KB

Download
memory/4008-18-0x000002A7783C0000-0x000002A7783C1000-memory.dmp

Filesize
4KB

Download
memory/4016-34-0x000002A67A220000-0x000002A67A221000-memory.dmp

Filesize
4KB

Download