Analysis
-
max time kernel
135s -
max time network
69s -
platform
windows7_x64 -
resource
win7 -
submitted
09-07-2020 17:13
Static task
static1
Behavioral task
behavioral1
Sample
262a1s0ssssd7da.exe
Resource
win7
Behavioral task
behavioral2
Sample
262a1s0ssssd7da.exe
Resource
win10v200430
General
-
Target
262a1s0ssssd7da.exe
-
Size
717KB
-
MD5
07ce42f25f61cff26f984e17163edb14
-
SHA1
ee189c7c5e1cc3584fe3e4aa5f7ded0afa23b222
-
SHA256
09344b412ef8dbc6b398dd6e3580f482382bd24b672554039668b17a39661b50
-
SHA512
fada769397f97cf32518a9b426a4c16ca99d0a9076d9e4ad6eeed2c3d7fb84edc5198bd5483de6d5d12a495292fab11c9c566283fd71abe66578c2f643b81795
Malware Config
Extracted
C:\MSOCache\All Users\{90140000-0011-0000-1000-0000000FF1CE}-C\Read_Me.txt
http://7rzpyw3hflwe2c7h.onion/?FFFFFFFF
http://helpqvrg3cc5mvb3.onion/
Signatures
-
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
262a1s0ssssd7da.exedescription pid process target process PID 1032 wrote to memory of 900 1032 262a1s0ssssd7da.exe 262a1s0ssssd7da.exe PID 1032 wrote to memory of 900 1032 262a1s0ssssd7da.exe 262a1s0ssssd7da.exe PID 1032 wrote to memory of 900 1032 262a1s0ssssd7da.exe 262a1s0ssssd7da.exe PID 1032 wrote to memory of 900 1032 262a1s0ssssd7da.exe 262a1s0ssssd7da.exe PID 1032 wrote to memory of 1364 1032 262a1s0ssssd7da.exe 262a1s0ssssd7da.exe PID 1032 wrote to memory of 1364 1032 262a1s0ssssd7da.exe 262a1s0ssssd7da.exe PID 1032 wrote to memory of 1364 1032 262a1s0ssssd7da.exe 262a1s0ssssd7da.exe PID 1032 wrote to memory of 1364 1032 262a1s0ssssd7da.exe 262a1s0ssssd7da.exe PID 1032 wrote to memory of 1304 1032 262a1s0ssssd7da.exe 262a1s0ssssd7da.exe PID 1032 wrote to memory of 1304 1032 262a1s0ssssd7da.exe 262a1s0ssssd7da.exe PID 1032 wrote to memory of 1304 1032 262a1s0ssssd7da.exe 262a1s0ssssd7da.exe PID 1032 wrote to memory of 1304 1032 262a1s0ssssd7da.exe 262a1s0ssssd7da.exe PID 1032 wrote to memory of 1304 1032 262a1s0ssssd7da.exe 262a1s0ssssd7da.exe PID 1032 wrote to memory of 1304 1032 262a1s0ssssd7da.exe 262a1s0ssssd7da.exe PID 1032 wrote to memory of 1304 1032 262a1s0ssssd7da.exe 262a1s0ssssd7da.exe PID 1032 wrote to memory of 1304 1032 262a1s0ssssd7da.exe 262a1s0ssssd7da.exe PID 1032 wrote to memory of 1304 1032 262a1s0ssssd7da.exe 262a1s0ssssd7da.exe PID 1032 wrote to memory of 1304 1032 262a1s0ssssd7da.exe 262a1s0ssssd7da.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
explorer.exepid process 1608 explorer.exe -
Enumerates connected drives 3 TTPs
-
Drops file in Program Files directory 12065 IoCs
Processes:
262a1s0ssssd7da.exedescription ioc process File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SceneButtonSubpicture.png 262a1s0ssssd7da.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\feature.properties 262a1s0ssssd7da.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0187851.WMF 262a1s0ssssd7da.exe File opened for modification C:\Program Files (x86)\Windows Photo Viewer\en-US\PhotoAcq.dll.mui 262a1s0ssssd7da.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\images\next_hov.png 262a1s0ssssd7da.exe File opened for modification C:\Program Files\Microsoft Office\Office14\OutlookAutoDiscover\YAHOO.CO.JP.XML 262a1s0ssssd7da.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\about.html 262a1s0ssssd7da.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-modules-appui_zh_CN.jar 262a1s0ssssd7da.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0101857.BMP 262a1s0ssssd7da.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0153305.WMF 262a1s0ssssd7da.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\CAGCAT10\J0222021.WMF 262a1s0ssssd7da.exe File opened for modification C:\Program Files\Microsoft Office\Office14\FORMS\1033\RECS.ICO 262a1s0ssssd7da.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Premium.css 262a1s0ssssd7da.exe File opened for modification C:\Program Files\Mozilla Firefox\d3dcompiler_47.dll 262a1s0ssssd7da.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_moon-first-quarter_partly-cloudy.png 262a1s0ssssd7da.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-multiview_zh_CN.jar 262a1s0ssssd7da.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\3.png 262a1s0ssssd7da.exe File opened for modification C:\Program Files\7-Zip\Lang\eo.txt 262a1s0ssssd7da.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\THEMES14\SATIN\SATIN.ELM 262a1s0ssssd7da.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-previous-static.png 262a1s0ssssd7da.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\ADRESPEL.POC 262a1s0ssssd7da.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\hint_down.png 262a1s0ssssd7da.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\main.html 262a1s0ssssd7da.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\NavigationRight_ButtonGraphic.png 262a1s0ssssd7da.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0174639.WMF 262a1s0ssssd7da.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\ProjectTool\Project Report Type\Fancy\Hierarchy.js 262a1s0ssssd7da.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PROOF\MSHY7EN.LEX 262a1s0ssssd7da.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\SIGNHM.POC 262a1s0ssssd7da.exe File created C:\Program Files\VideoLAN\VLC\locale\fur\Read_Me.txt 262a1s0ssssd7da.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libvorbis_plugin.dll 262a1s0ssssd7da.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\tnameserv.exe 262a1s0ssssd7da.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-coredump.xml 262a1s0ssssd7da.exe File opened for modification C:\Program Files\Java\jre7\lib\ext\zipfs.jar 262a1s0ssssd7da.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Tahiti 262a1s0ssssd7da.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\83.0.4103.106\swiftshader\libGLESv2.dll 262a1s0ssssd7da.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\Form.zip 262a1s0ssssd7da.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\sqlxmlx.dll 262a1s0ssssd7da.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\servertool.exe 262a1s0ssssd7da.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-execution_zh_CN.jar 262a1s0ssssd7da.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\BrightOrange.css 262a1s0ssssd7da.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\POWERPNT_K_COL.HXK 262a1s0ssssd7da.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libaom_plugin.dll 262a1s0ssssd7da.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MinionPro-Regular.otf 262a1s0ssssd7da.exe File opened for modification C:\Program Files\Internet Explorer\en-US\networkinspection.dll.mui 262a1s0ssssd7da.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PH02074U.BMP 262a1s0ssssd7da.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\rtf_justify.gif 262a1s0ssssd7da.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_gray_snow.png 262a1s0ssssd7da.exe File opened for modification C:\Program Files\Microsoft Office\Office14\OutlookAutoDiscover\BTOPENWORLD.COM.XML 262a1s0ssssd7da.exe File opened for modification C:\Program Files\7-Zip\Lang\en.ttt 262a1s0ssssd7da.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\THEMES14\REFINED\REFINED.ELM 262a1s0ssssd7da.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\npt.dll 262a1s0ssssd7da.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.intro.nl_ja_4.4.0.v20140623020002.jar 262a1s0ssssd7da.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Bibliography\Sort\AUTHOR.XSL 262a1s0ssssd7da.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\CALENDAR.GIF 262a1s0ssssd7da.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolIcons\StatusAway.ico 262a1s0ssssd7da.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.AddIn.dll 262a1s0ssssd7da.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\46.png 262a1s0ssssd7da.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_babypink_Thumbnail.bmp 262a1s0ssssd7da.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\CAGCAT10\J0229385.WMF 262a1s0ssssd7da.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\GREEK.TXT 262a1s0ssssd7da.exe File opened for modification C:\Program Files (x86)\Internet Explorer\en-US\iexplore.exe.mui 262a1s0ssssd7da.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\en-US\css\Read_Me.txt 262a1s0ssssd7da.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\720x480icongraphic.png 262a1s0ssssd7da.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\about.html 262a1s0ssssd7da.exe -
Modifies Installed Components in the registry 2 TTPs 4 IoCs
Processes:
explorer.exeexplorer.exeexplorer.exeexplorer.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe -
Suspicious use of SendNotifyMessage 98 IoCs
Processes:
explorer.exeexplorer.exeexplorer.exepid process 1544 explorer.exe 1544 explorer.exe 1544 explorer.exe 1544 explorer.exe 1544 explorer.exe 1544 explorer.exe 1544 explorer.exe 1544 explorer.exe 1544 explorer.exe 1544 explorer.exe 1544 explorer.exe 1544 explorer.exe 1544 explorer.exe 1544 explorer.exe 1544 explorer.exe 1544 explorer.exe 1544 explorer.exe 1544 explorer.exe 1544 explorer.exe 1544 explorer.exe 1544 explorer.exe 1544 explorer.exe 1544 explorer.exe 1544 explorer.exe 1544 explorer.exe 1544 explorer.exe 1544 explorer.exe 2036 explorer.exe 2036 explorer.exe 2036 explorer.exe 2036 explorer.exe 2036 explorer.exe 2036 explorer.exe 2036 explorer.exe 2036 explorer.exe 2036 explorer.exe 2036 explorer.exe 2036 explorer.exe 2036 explorer.exe 2036 explorer.exe 1084 explorer.exe 1084 explorer.exe 1084 explorer.exe 1084 explorer.exe 1084 explorer.exe 1084 explorer.exe 1084 explorer.exe 1084 explorer.exe 1084 explorer.exe 1084 explorer.exe 1084 explorer.exe 1084 explorer.exe 1084 explorer.exe 1084 explorer.exe 1084 explorer.exe 1084 explorer.exe 1084 explorer.exe 1084 explorer.exe 1084 explorer.exe 1084 explorer.exe 1084 explorer.exe 1084 explorer.exe 1084 explorer.exe 1084 explorer.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Modifies registry class 20 IoCs
Processes:
explorer.exeexplorer.exeexplorer.exeexplorer.exedescription ioc process Set value (data) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_Classes\Local Settings explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_Classes\Local Settings explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_Classes\Local Settings explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_Classes\Local Settings explorer.exe -
Modifies service 2 TTPs 6 IoCs
Processes:
explorer.exeexplorer.exeexplorer.exedescription ioc process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NapAgent\Shas explorer.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NapAgent\Qecs explorer.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NapAgent\Shas explorer.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NapAgent\Qecs explorer.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NapAgent\Shas explorer.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NapAgent\Qecs explorer.exe -
Drops startup file 1 IoCs
Processes:
262a1s0ssssd7da.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\Read_Me.txt 262a1s0ssssd7da.exe -
Suspicious use of AdjustPrivilegeToken 37 IoCs
Processes:
262a1s0ssssd7da.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exedescription pid process Token: SeDebugPrivilege 1032 262a1s0ssssd7da.exe Token: SeShutdownPrivilege 1544 explorer.exe Token: SeShutdownPrivilege 1544 explorer.exe Token: SeShutdownPrivilege 1544 explorer.exe Token: SeShutdownPrivilege 1544 explorer.exe Token: SeShutdownPrivilege 1544 explorer.exe Token: SeShutdownPrivilege 1544 explorer.exe Token: SeShutdownPrivilege 1544 explorer.exe Token: SeShutdownPrivilege 1544 explorer.exe Token: SeShutdownPrivilege 1544 explorer.exe Token: SeShutdownPrivilege 2036 explorer.exe Token: SeShutdownPrivilege 2036 explorer.exe Token: SeShutdownPrivilege 2036 explorer.exe Token: SeShutdownPrivilege 2036 explorer.exe Token: SeShutdownPrivilege 2036 explorer.exe Token: SeShutdownPrivilege 2036 explorer.exe Token: SeShutdownPrivilege 2036 explorer.exe Token: SeShutdownPrivilege 1084 explorer.exe Token: SeShutdownPrivilege 1084 explorer.exe Token: SeShutdownPrivilege 1084 explorer.exe Token: SeShutdownPrivilege 1084 explorer.exe Token: SeShutdownPrivilege 1084 explorer.exe Token: SeShutdownPrivilege 1084 explorer.exe Token: SeShutdownPrivilege 1084 explorer.exe Token: SeShutdownPrivilege 1084 explorer.exe Token: SeShutdownPrivilege 1084 explorer.exe Token: SeShutdownPrivilege 1084 explorer.exe Token: SeShutdownPrivilege 1084 explorer.exe Token: SeShutdownPrivilege 1608 explorer.exe Token: SeShutdownPrivilege 1608 explorer.exe Token: SeShutdownPrivilege 1608 explorer.exe Token: SeShutdownPrivilege 1608 explorer.exe Token: SeShutdownPrivilege 1608 explorer.exe Token: SeShutdownPrivilege 1608 explorer.exe Token: SeShutdownPrivilege 1608 explorer.exe Token: SeShutdownPrivilege 1608 explorer.exe Token: SeShutdownPrivilege 1608 explorer.exe -
Suspicious behavior: EnumeratesProcesses 4530 IoCs
Processes:
262a1s0ssssd7da.exe262a1s0ssssd7da.exepid process 1032 262a1s0ssssd7da.exe 1032 262a1s0ssssd7da.exe 1304 262a1s0ssssd7da.exe 1304 262a1s0ssssd7da.exe 1304 262a1s0ssssd7da.exe 1304 262a1s0ssssd7da.exe 1304 262a1s0ssssd7da.exe 1304 262a1s0ssssd7da.exe 1304 262a1s0ssssd7da.exe 1304 262a1s0ssssd7da.exe 1304 262a1s0ssssd7da.exe 1304 262a1s0ssssd7da.exe 1304 262a1s0ssssd7da.exe 1304 262a1s0ssssd7da.exe 1304 262a1s0ssssd7da.exe 1304 262a1s0ssssd7da.exe 1304 262a1s0ssssd7da.exe 1304 262a1s0ssssd7da.exe 1304 262a1s0ssssd7da.exe 1304 262a1s0ssssd7da.exe 1304 262a1s0ssssd7da.exe 1304 262a1s0ssssd7da.exe 1304 262a1s0ssssd7da.exe 1304 262a1s0ssssd7da.exe 1304 262a1s0ssssd7da.exe 1304 262a1s0ssssd7da.exe 1304 262a1s0ssssd7da.exe 1304 262a1s0ssssd7da.exe 1304 262a1s0ssssd7da.exe 1304 262a1s0ssssd7da.exe 1304 262a1s0ssssd7da.exe 1304 262a1s0ssssd7da.exe 1304 262a1s0ssssd7da.exe 1304 262a1s0ssssd7da.exe 1304 262a1s0ssssd7da.exe 1304 262a1s0ssssd7da.exe 1304 262a1s0ssssd7da.exe 1304 262a1s0ssssd7da.exe 1304 262a1s0ssssd7da.exe 1304 262a1s0ssssd7da.exe 1304 262a1s0ssssd7da.exe 1304 262a1s0ssssd7da.exe 1304 262a1s0ssssd7da.exe 1304 262a1s0ssssd7da.exe 1304 262a1s0ssssd7da.exe 1304 262a1s0ssssd7da.exe 1304 262a1s0ssssd7da.exe 1304 262a1s0ssssd7da.exe 1304 262a1s0ssssd7da.exe 1304 262a1s0ssssd7da.exe 1304 262a1s0ssssd7da.exe 1304 262a1s0ssssd7da.exe 1304 262a1s0ssssd7da.exe 1304 262a1s0ssssd7da.exe 1304 262a1s0ssssd7da.exe 1304 262a1s0ssssd7da.exe 1304 262a1s0ssssd7da.exe 1304 262a1s0ssssd7da.exe 1304 262a1s0ssssd7da.exe 1304 262a1s0ssssd7da.exe 1304 262a1s0ssssd7da.exe 1304 262a1s0ssssd7da.exe 1304 262a1s0ssssd7da.exe 1304 262a1s0ssssd7da.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
262a1s0ssssd7da.exedescription pid process target process PID 1032 set thread context of 1304 1032 262a1s0ssssd7da.exe 262a1s0ssssd7da.exe -
Suspicious use of FindShellTrayWindow 88 IoCs
Processes:
explorer.exeexplorer.exeexplorer.exeexplorer.exepid process 1544 explorer.exe 1544 explorer.exe 1544 explorer.exe 1544 explorer.exe 1544 explorer.exe 1544 explorer.exe 1544 explorer.exe 1544 explorer.exe 1544 explorer.exe 1544 explorer.exe 1544 explorer.exe 1544 explorer.exe 1544 explorer.exe 1544 explorer.exe 1544 explorer.exe 1544 explorer.exe 1544 explorer.exe 1544 explorer.exe 1544 explorer.exe 1544 explorer.exe 1544 explorer.exe 1544 explorer.exe 1544 explorer.exe 1544 explorer.exe 1544 explorer.exe 1544 explorer.exe 2036 explorer.exe 2036 explorer.exe 2036 explorer.exe 2036 explorer.exe 2036 explorer.exe 2036 explorer.exe 2036 explorer.exe 1084 explorer.exe 1084 explorer.exe 1084 explorer.exe 1084 explorer.exe 1084 explorer.exe 1084 explorer.exe 1084 explorer.exe 1084 explorer.exe 1084 explorer.exe 1084 explorer.exe 1084 explorer.exe 1084 explorer.exe 1084 explorer.exe 1084 explorer.exe 1084 explorer.exe 1084 explorer.exe 1084 explorer.exe 1084 explorer.exe 1084 explorer.exe 1084 explorer.exe 1084 explorer.exe 1084 explorer.exe 1084 explorer.exe 1084 explorer.exe 1084 explorer.exe 1084 explorer.exe 1084 explorer.exe 1084 explorer.exe 1084 explorer.exe 1608 explorer.exe 1608 explorer.exe -
Drops desktop.ini file(s) 41 IoCs
Processes:
262a1s0ssssd7da.exeexplorer.exedescription ioc process File opened for modification C:\Users\Admin\Pictures\desktop.ini 262a1s0ssssd7da.exe File opened for modification C:\Users\Public\Downloads\desktop.ini 262a1s0ssssd7da.exe File opened for modification C:\Users\Public\Pictures\desktop.ini 262a1s0ssssd7da.exe File opened for modification C:\Users\Public\Recorded TV\Sample Media\desktop.ini 262a1s0ssssd7da.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini 262a1s0ssssd7da.exe File opened for modification C:\Program Files\desktop.ini 262a1s0ssssd7da.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 262a1s0ssssd7da.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini 262a1s0ssssd7da.exe File opened for modification C:\Users\Public\Desktop\desktop.ini 262a1s0ssssd7da.exe File opened for modification C:\Users\Public\Libraries\desktop.ini 262a1s0ssssd7da.exe File opened for modification \??\M:\$RECYCLE.BIN\S-1-5-21-1131729243-447456001-3632642222-1000\desktop.ini explorer.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini 262a1s0ssssd7da.exe File opened for modification C:\Users\Admin\Documents\desktop.ini 262a1s0ssssd7da.exe File opened for modification C:\Users\Admin\Links\desktop.ini 262a1s0ssssd7da.exe File opened for modification C:\Users\Admin\Searches\desktop.ini 262a1s0ssssd7da.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\RBDIK06K\desktop.ini 262a1s0ssssd7da.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\desktop.ini 262a1s0ssssd7da.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\ZMLBLRQ7\desktop.ini 262a1s0ssssd7da.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Desktop.ini 262a1s0ssssd7da.exe File opened for modification C:\Users\Public\Documents\desktop.ini 262a1s0ssssd7da.exe File opened for modification C:\Users\Public\Recorded TV\desktop.ini 262a1s0ssssd7da.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\AJM03J3Y\desktop.ini 262a1s0ssssd7da.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini 262a1s0ssssd7da.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 262a1s0ssssd7da.exe File opened for modification C:\Users\Public\Music\desktop.ini 262a1s0ssssd7da.exe File opened for modification C:\Users\Public\Music\Sample Music\desktop.ini 262a1s0ssssd7da.exe File opened for modification C:\Users\Public\Videos\desktop.ini 262a1s0ssssd7da.exe File opened for modification C:\Users\Public\Videos\Sample Videos\desktop.ini 262a1s0ssssd7da.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini 262a1s0ssssd7da.exe File opened for modification C:\Program Files (x86)\desktop.ini 262a1s0ssssd7da.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\TGVUK4BG\desktop.ini 262a1s0ssssd7da.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini 262a1s0ssssd7da.exe File opened for modification C:\Users\Admin\Favorites\Links for United States\desktop.ini 262a1s0ssssd7da.exe File opened for modification C:\Users\Admin\Music\desktop.ini 262a1s0ssssd7da.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini 262a1s0ssssd7da.exe File opened for modification C:\Users\Admin\Videos\desktop.ini 262a1s0ssssd7da.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI 262a1s0ssssd7da.exe File opened for modification C:\Users\Public\Pictures\Sample Pictures\desktop.ini 262a1s0ssssd7da.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Desktop.ini 262a1s0ssssd7da.exe File opened for modification C:\Users\Public\desktop.ini 262a1s0ssssd7da.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini 262a1s0ssssd7da.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\262a1s0ssssd7da.exe"C:\Users\Admin\AppData\Local\Temp\262a1s0ssssd7da.exe"1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\262a1s0ssssd7da.exe"{path}"2⤵
-
C:\Users\Admin\AppData\Local\Temp\262a1s0ssssd7da.exe"{path}"2⤵
-
C:\Users\Admin\AppData\Local\Temp\262a1s0ssssd7da.exe"{path}"2⤵
- Drops file in Program Files directory
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Drops desktop.ini file(s)
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Suspicious use of SendNotifyMessage
- Modifies registry class
- Modifies service
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Drops desktop.ini file(s)
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Suspicious use of SendNotifyMessage
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Suspicious use of SendNotifyMessage
- Modifies registry class
- Modifies service
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Modifies Installed Components in the registry
- Modifies registry class
- Modifies service
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\WPDNSE\Read_Me.txt
-
C:\Users\Admin\Desktop\AddRevoke.pub.readme
-
C:\Users\Admin\Desktop\CheckpointRestart.dxf.readme
-
C:\Users\Admin\Desktop\ConvertToBackup.html.readme
-
C:\Users\Admin\Desktop\CopyLimit.DVR-MS.readme
-
C:\Users\Admin\Desktop\DenyResize.mhtml.readme
-
C:\Users\Admin\Desktop\EnableRemove.dll.readme
-
C:\Users\Admin\Desktop\ExpandShow.mpp.readme
-
C:\Users\Admin\Desktop\ExportSelect.wmv.readme
-
C:\Users\Admin\Desktop\FormatWrite.docm.readme
-
C:\Users\Admin\Desktop\GetRead.avi.readme
-
C:\Users\Admin\Desktop\GrantSelect.jpg.readme
-
C:\Users\Admin\Desktop\HideUndo.au.readme
-
C:\Users\Admin\Desktop\InstallSuspend.png.readme
-
C:\Users\Admin\Desktop\InvokeSync.png.readme
-
C:\Users\Admin\Desktop\ProtectCompare.dib.readme
-
C:\Users\Admin\Desktop\ReadRedo.3gpp.readme
-
C:\Users\Admin\Desktop\Read_Me.txt
-
C:\Users\Admin\Desktop\RegisterBlock.svg.readme
-
C:\Users\Admin\Desktop\RequestSwitch.js.readme
-
C:\Users\Admin\Desktop\ResolveRegister.vsw.readme
-
C:\Users\Admin\Desktop\RestartSearch.ppsx.readme
-
C:\Users\Admin\Desktop\SkipGet.midi.readme
-
C:\Users\Admin\Desktop\StepUnblock.mp3.readme
-
C:\Users\Admin\Desktop\StopCompress.jpeg.readme
-
C:\Users\Admin\Desktop\SubmitCopy.wmf.readme
-
C:\Users\Admin\Desktop\SyncClose.au3.readme
-
C:\Users\Admin\Desktop\desktop.ini.readme
-
C:\Users\Public\Desktop\Adobe Reader 9.lnk.readme
-
C:\Users\Public\Desktop\Firefox.lnk.readme
-
C:\Users\Public\Desktop\Google Chrome.lnk.readme
-
C:\Users\Public\Desktop\Read_Me.txt
-
C:\Users\Public\Desktop\VLC media player.lnk.readme
-
C:\Users\Public\Desktop\desktop.ini.readme
-
\??\M:\$RECYCLE.BIN\S-1-5-21-1131729243-447456001-3632642222-1000\desktop.ini
-
memory/1304-0-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/1304-2-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/1304-1-0x0000000000407CA0-mapping.dmp
-
memory/1608-17-0x0000000004270000-0x0000000004271000-memory.dmpFilesize
4KB
-
memory/1608-16-0x00000000037C0000-0x00000000037C1000-memory.dmpFilesize
4KB
-
memory/1608-51-0x0000000004270000-0x0000000004271000-memory.dmpFilesize
4KB
-
memory/2036-9-0x0000000004240000-0x0000000004241000-memory.dmpFilesize
4KB
-
memory/2036-3-0x0000000003C20000-0x0000000003D21000-memory.dmpFilesize
1.0MB