Analysis
-
max time kernel
141s -
max time network
59s -
platform
windows7_x64 -
resource
win7 -
submitted
09-07-2020 17:16
Static task
static1
Behavioral task
behavioral1
Sample
703a1s0ssssd7da.exe
Resource
win7
Behavioral task
behavioral2
Sample
703a1s0ssssd7da.exe
Resource
win10v200430
General
-
Target
703a1s0ssssd7da.exe
-
Size
717KB
-
MD5
83f6e8129fd4917311956264f46971f0
-
SHA1
183757c527e8f213be0c1397f40b6cd3979c854c
-
SHA256
a7add0057b62fd19144486d1933b3a68331aebab989192d3f32e5c85f07b8590
-
SHA512
1a31f54a50f6d09765ca1be1c39ac1d6a200e8564926155eab7249407e48029aba312976ccc09328679cf9b0629f7af0448af98ecea6ee0c3c68fc24905bb7d8
Malware Config
Extracted
\??\M:\Boot\cs-CZ\Read_Me.txt
http://7rzpyw3hflwe2c7h.onion/?FFFFFFFF
http://helpqvrg3cc5mvb3.onion/
Signatures
-
Modifies Installed Components in the registry 2 TTPs 3 IoCs
Processes:
explorer.exeexplorer.exeexplorer.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe -
Drops desktop.ini file(s) 41 IoCs
Processes:
703a1s0ssssd7da.exeexplorer.exedescription ioc process File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Desktop.ini 703a1s0ssssd7da.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\ZMLBLRQ7\desktop.ini 703a1s0ssssd7da.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini 703a1s0ssssd7da.exe File opened for modification C:\Users\Public\Music\Sample Music\desktop.ini 703a1s0ssssd7da.exe File opened for modification C:\Program Files (x86)\desktop.ini 703a1s0ssssd7da.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\desktop.ini 703a1s0ssssd7da.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 703a1s0ssssd7da.exe File opened for modification C:\Users\Admin\Videos\desktop.ini 703a1s0ssssd7da.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 703a1s0ssssd7da.exe File opened for modification C:\Users\Public\Videos\desktop.ini 703a1s0ssssd7da.exe File opened for modification C:\Users\Public\Downloads\desktop.ini 703a1s0ssssd7da.exe File opened for modification C:\Users\Public\Music\desktop.ini 703a1s0ssssd7da.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI 703a1s0ssssd7da.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\AJM03J3Y\desktop.ini 703a1s0ssssd7da.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini 703a1s0ssssd7da.exe File opened for modification C:\Users\Admin\Favorites\Links for United States\desktop.ini 703a1s0ssssd7da.exe File opened for modification C:\Users\Public\desktop.ini 703a1s0ssssd7da.exe File opened for modification C:\Users\Public\Documents\desktop.ini 703a1s0ssssd7da.exe File opened for modification C:\Users\Public\Pictures\desktop.ini 703a1s0ssssd7da.exe File opened for modification \??\M:\$RECYCLE.BIN\S-1-5-21-1131729243-447456001-3632642222-1000\desktop.ini explorer.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\TGVUK4BG\desktop.ini 703a1s0ssssd7da.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Desktop.ini 703a1s0ssssd7da.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini 703a1s0ssssd7da.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini 703a1s0ssssd7da.exe File opened for modification C:\Users\Public\Recorded TV\Sample Media\desktop.ini 703a1s0ssssd7da.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\RBDIK06K\desktop.ini 703a1s0ssssd7da.exe File opened for modification C:\Users\Admin\Documents\desktop.ini 703a1s0ssssd7da.exe File opened for modification C:\Users\Admin\Links\desktop.ini 703a1s0ssssd7da.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini 703a1s0ssssd7da.exe File opened for modification C:\Users\Admin\Searches\desktop.ini 703a1s0ssssd7da.exe File opened for modification C:\Users\Public\Desktop\desktop.ini 703a1s0ssssd7da.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini 703a1s0ssssd7da.exe File opened for modification C:\Program Files\desktop.ini 703a1s0ssssd7da.exe File opened for modification C:\Users\Public\Recorded TV\desktop.ini 703a1s0ssssd7da.exe File opened for modification C:\Users\Public\Videos\Sample Videos\desktop.ini 703a1s0ssssd7da.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini 703a1s0ssssd7da.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini 703a1s0ssssd7da.exe File opened for modification C:\Users\Admin\Music\desktop.ini 703a1s0ssssd7da.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini 703a1s0ssssd7da.exe File opened for modification C:\Users\Public\Libraries\desktop.ini 703a1s0ssssd7da.exe File opened for modification C:\Users\Public\Pictures\Sample Pictures\desktop.ini 703a1s0ssssd7da.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
703a1s0ssssd7da.exedescription pid process target process PID 1684 set thread context of 1844 1684 703a1s0ssssd7da.exe 703a1s0ssssd7da.exe -
Suspicious behavior: EnumeratesProcesses 4524 IoCs
Processes:
703a1s0ssssd7da.exepid process 1844 703a1s0ssssd7da.exe 1844 703a1s0ssssd7da.exe 1844 703a1s0ssssd7da.exe 1844 703a1s0ssssd7da.exe 1844 703a1s0ssssd7da.exe 1844 703a1s0ssssd7da.exe 1844 703a1s0ssssd7da.exe 1844 703a1s0ssssd7da.exe 1844 703a1s0ssssd7da.exe 1844 703a1s0ssssd7da.exe 1844 703a1s0ssssd7da.exe 1844 703a1s0ssssd7da.exe 1844 703a1s0ssssd7da.exe 1844 703a1s0ssssd7da.exe 1844 703a1s0ssssd7da.exe 1844 703a1s0ssssd7da.exe 1844 703a1s0ssssd7da.exe 1844 703a1s0ssssd7da.exe 1844 703a1s0ssssd7da.exe 1844 703a1s0ssssd7da.exe 1844 703a1s0ssssd7da.exe 1844 703a1s0ssssd7da.exe 1844 703a1s0ssssd7da.exe 1844 703a1s0ssssd7da.exe 1844 703a1s0ssssd7da.exe 1844 703a1s0ssssd7da.exe 1844 703a1s0ssssd7da.exe 1844 703a1s0ssssd7da.exe 1844 703a1s0ssssd7da.exe 1844 703a1s0ssssd7da.exe 1844 703a1s0ssssd7da.exe 1844 703a1s0ssssd7da.exe 1844 703a1s0ssssd7da.exe 1844 703a1s0ssssd7da.exe 1844 703a1s0ssssd7da.exe 1844 703a1s0ssssd7da.exe 1844 703a1s0ssssd7da.exe 1844 703a1s0ssssd7da.exe 1844 703a1s0ssssd7da.exe 1844 703a1s0ssssd7da.exe 1844 703a1s0ssssd7da.exe 1844 703a1s0ssssd7da.exe 1844 703a1s0ssssd7da.exe 1844 703a1s0ssssd7da.exe 1844 703a1s0ssssd7da.exe 1844 703a1s0ssssd7da.exe 1844 703a1s0ssssd7da.exe 1844 703a1s0ssssd7da.exe 1844 703a1s0ssssd7da.exe 1844 703a1s0ssssd7da.exe 1844 703a1s0ssssd7da.exe 1844 703a1s0ssssd7da.exe 1844 703a1s0ssssd7da.exe 1844 703a1s0ssssd7da.exe 1844 703a1s0ssssd7da.exe 1844 703a1s0ssssd7da.exe 1844 703a1s0ssssd7da.exe 1844 703a1s0ssssd7da.exe 1844 703a1s0ssssd7da.exe 1844 703a1s0ssssd7da.exe 1844 703a1s0ssssd7da.exe 1844 703a1s0ssssd7da.exe 1844 703a1s0ssssd7da.exe 1844 703a1s0ssssd7da.exe -
Suspicious use of AdjustPrivilegeToken 964 IoCs
Processes:
explorer.exemsiexec.exedescription pid process Token: SeShutdownPrivilege 2000 explorer.exe Token: SeShutdownPrivilege 2000 explorer.exe Token: SeShutdownPrivilege 2000 explorer.exe Token: SeShutdownPrivilege 2000 explorer.exe Token: SeShutdownPrivilege 2000 explorer.exe Token: SeShutdownPrivilege 2000 explorer.exe Token: SeShutdownPrivilege 2000 explorer.exe Token: SeShutdownPrivilege 2000 explorer.exe Token: SeShutdownPrivilege 2000 explorer.exe Token: SeShutdownPrivilege 2000 explorer.exe Token: SeShutdownPrivilege 2000 explorer.exe Token: SeIncreaseQuotaPrivilege 2000 explorer.exe Token: SeShutdownPrivilege 2000 explorer.exe Token: SeShutdownPrivilege 2000 explorer.exe Token: SeShutdownPrivilege 2000 explorer.exe Token: SeShutdownPrivilege 2000 explorer.exe Token: SeRestorePrivilege 1080 msiexec.exe Token: SeTakeOwnershipPrivilege 1080 msiexec.exe Token: SeSecurityPrivilege 1080 msiexec.exe Token: SeCreateTokenPrivilege 2000 explorer.exe Token: SeAssignPrimaryTokenPrivilege 2000 explorer.exe Token: SeLockMemoryPrivilege 2000 explorer.exe Token: SeIncreaseQuotaPrivilege 2000 explorer.exe Token: SeMachineAccountPrivilege 2000 explorer.exe Token: SeTcbPrivilege 2000 explorer.exe Token: SeSecurityPrivilege 2000 explorer.exe Token: SeTakeOwnershipPrivilege 2000 explorer.exe Token: SeLoadDriverPrivilege 2000 explorer.exe Token: SeSystemProfilePrivilege 2000 explorer.exe Token: SeSystemtimePrivilege 2000 explorer.exe Token: SeProfSingleProcessPrivilege 2000 explorer.exe Token: SeIncBasePriorityPrivilege 2000 explorer.exe Token: SeCreatePagefilePrivilege 2000 explorer.exe Token: SeCreatePermanentPrivilege 2000 explorer.exe Token: SeBackupPrivilege 2000 explorer.exe Token: SeRestorePrivilege 2000 explorer.exe Token: SeShutdownPrivilege 2000 explorer.exe Token: SeDebugPrivilege 2000 explorer.exe Token: SeAuditPrivilege 2000 explorer.exe Token: SeSystemEnvironmentPrivilege 2000 explorer.exe Token: SeChangeNotifyPrivilege 2000 explorer.exe Token: SeRemoteShutdownPrivilege 2000 explorer.exe Token: SeUndockPrivilege 2000 explorer.exe Token: SeSyncAgentPrivilege 2000 explorer.exe Token: SeEnableDelegationPrivilege 2000 explorer.exe Token: SeManageVolumePrivilege 2000 explorer.exe Token: SeImpersonatePrivilege 2000 explorer.exe Token: SeCreateGlobalPrivilege 2000 explorer.exe Token: SeRestorePrivilege 1080 msiexec.exe Token: SeTakeOwnershipPrivilege 1080 msiexec.exe Token: SeRestorePrivilege 1080 msiexec.exe Token: SeTakeOwnershipPrivilege 1080 msiexec.exe Token: SeRestorePrivilege 1080 msiexec.exe Token: SeTakeOwnershipPrivilege 1080 msiexec.exe Token: SeRestorePrivilege 1080 msiexec.exe Token: SeTakeOwnershipPrivilege 1080 msiexec.exe Token: SeRestorePrivilege 1080 msiexec.exe Token: SeTakeOwnershipPrivilege 1080 msiexec.exe Token: SeRestorePrivilege 1080 msiexec.exe Token: SeTakeOwnershipPrivilege 1080 msiexec.exe Token: SeRestorePrivilege 1080 msiexec.exe Token: SeTakeOwnershipPrivilege 1080 msiexec.exe Token: SeRestorePrivilege 1080 msiexec.exe Token: SeTakeOwnershipPrivilege 1080 msiexec.exe -
Suspicious use of FindShellTrayWindow 74 IoCs
Processes:
explorer.exeexplorer.exeexplorer.exepid process 2000 explorer.exe 2000 explorer.exe 2000 explorer.exe 2000 explorer.exe 2000 explorer.exe 2000 explorer.exe 2000 explorer.exe 2000 explorer.exe 2000 explorer.exe 2000 explorer.exe 2000 explorer.exe 2000 explorer.exe 2000 explorer.exe 2000 explorer.exe 2000 explorer.exe 2000 explorer.exe 2000 explorer.exe 2000 explorer.exe 2000 explorer.exe 2000 explorer.exe 2000 explorer.exe 2000 explorer.exe 2000 explorer.exe 2000 explorer.exe 2000 explorer.exe 2000 explorer.exe 2000 explorer.exe 2000 explorer.exe 2000 explorer.exe 2000 explorer.exe 2000 explorer.exe 1052 explorer.exe 1052 explorer.exe 1052 explorer.exe 1052 explorer.exe 1052 explorer.exe 1052 explorer.exe 1052 explorer.exe 1456 explorer.exe 1456 explorer.exe 1456 explorer.exe 1456 explorer.exe 1456 explorer.exe 1456 explorer.exe 1456 explorer.exe 1456 explorer.exe 1456 explorer.exe 1456 explorer.exe 1456 explorer.exe 1456 explorer.exe 1456 explorer.exe 1456 explorer.exe 1456 explorer.exe 1456 explorer.exe 1456 explorer.exe 1456 explorer.exe 1456 explorer.exe 1456 explorer.exe 1456 explorer.exe 1456 explorer.exe 1456 explorer.exe 1456 explorer.exe 1456 explorer.exe 1456 explorer.exe -
Enumerates connected drives 3 TTPs
-
Drops file in Windows directory 42 IoCs
Processes:
msiexec.exedescription ioc process File opened for modification C:\Windows\Installer\MSI7863.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIFAC6.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIFF1.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSIF596.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI3FE9.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI9D8C.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI656A.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI769C.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI902E.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI9C53.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI22A7.tmp msiexec.exe File created C:\Windows\Installer\1ef02.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSI63B3.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI8F33.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI558C.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI61ED.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI7E3F.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI7824.tmp msiexec.exe File opened for modification C:\Windows\Installer\1ef02.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSIDBE.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI55AD.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI6450.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI7739.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI7D83.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI7F1A.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI8DEA.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI91A6.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIF4DA.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIE99.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI3B66.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIFB92.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI935C.tmp msiexec.exe File created C:\Windows\Installer\1eeff.mst msiexec.exe File opened for modification C:\Windows\Installer\MSIF343.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIF95E.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI6886.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI6A2C.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI92BF.tmp msiexec.exe File opened for modification C:\Windows\Installer\1eeff.mst msiexec.exe File opened for modification C:\Windows\Installer\MSIFC8C.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIFD29.tmp msiexec.exe -
Suspicious use of WriteProcessMemory 27 IoCs
Processes:
703a1s0ssssd7da.exemsiexec.exedescription pid process target process PID 1684 wrote to memory of 1844 1684 703a1s0ssssd7da.exe 703a1s0ssssd7da.exe PID 1684 wrote to memory of 1844 1684 703a1s0ssssd7da.exe 703a1s0ssssd7da.exe PID 1684 wrote to memory of 1844 1684 703a1s0ssssd7da.exe 703a1s0ssssd7da.exe PID 1684 wrote to memory of 1844 1684 703a1s0ssssd7da.exe 703a1s0ssssd7da.exe PID 1684 wrote to memory of 1844 1684 703a1s0ssssd7da.exe 703a1s0ssssd7da.exe PID 1684 wrote to memory of 1844 1684 703a1s0ssssd7da.exe 703a1s0ssssd7da.exe PID 1684 wrote to memory of 1844 1684 703a1s0ssssd7da.exe 703a1s0ssssd7da.exe PID 1684 wrote to memory of 1844 1684 703a1s0ssssd7da.exe 703a1s0ssssd7da.exe PID 1684 wrote to memory of 1844 1684 703a1s0ssssd7da.exe 703a1s0ssssd7da.exe PID 1684 wrote to memory of 1844 1684 703a1s0ssssd7da.exe 703a1s0ssssd7da.exe PID 1080 wrote to memory of 1672 1080 msiexec.exe MsiExec.exe PID 1080 wrote to memory of 1672 1080 msiexec.exe MsiExec.exe PID 1080 wrote to memory of 1672 1080 msiexec.exe MsiExec.exe PID 1080 wrote to memory of 1672 1080 msiexec.exe MsiExec.exe PID 1080 wrote to memory of 1672 1080 msiexec.exe MsiExec.exe PID 1080 wrote to memory of 1744 1080 msiexec.exe MsiExec.exe PID 1080 wrote to memory of 1744 1080 msiexec.exe MsiExec.exe PID 1080 wrote to memory of 1744 1080 msiexec.exe MsiExec.exe PID 1080 wrote to memory of 1744 1080 msiexec.exe MsiExec.exe PID 1080 wrote to memory of 1744 1080 msiexec.exe MsiExec.exe PID 1080 wrote to memory of 1744 1080 msiexec.exe MsiExec.exe PID 1080 wrote to memory of 1744 1080 msiexec.exe MsiExec.exe PID 1080 wrote to memory of 1964 1080 msiexec.exe MsiExec.exe PID 1080 wrote to memory of 1964 1080 msiexec.exe MsiExec.exe PID 1080 wrote to memory of 1964 1080 msiexec.exe MsiExec.exe PID 1080 wrote to memory of 1964 1080 msiexec.exe MsiExec.exe PID 1080 wrote to memory of 1964 1080 msiexec.exe MsiExec.exe -
Loads dropped DLL 40 IoCs
Processes:
MsiExec.exeMsiExec.exeMsiExec.exepid process 1672 MsiExec.exe 1672 MsiExec.exe 1744 MsiExec.exe 1672 MsiExec.exe 1672 MsiExec.exe 1672 MsiExec.exe 1672 MsiExec.exe 1744 MsiExec.exe 1672 MsiExec.exe 1672 MsiExec.exe 1672 MsiExec.exe 1672 MsiExec.exe 1672 MsiExec.exe 1672 MsiExec.exe 1744 MsiExec.exe 1672 MsiExec.exe 1744 MsiExec.exe 1672 MsiExec.exe 1672 MsiExec.exe 1744 MsiExec.exe 1744 MsiExec.exe 1744 MsiExec.exe 1744 MsiExec.exe 1744 MsiExec.exe 1744 MsiExec.exe 1672 MsiExec.exe 1672 MsiExec.exe 1672 MsiExec.exe 1672 MsiExec.exe 1672 MsiExec.exe 1964 MsiExec.exe 1964 MsiExec.exe 1964 MsiExec.exe 1964 MsiExec.exe 1964 MsiExec.exe 1964 MsiExec.exe 1964 MsiExec.exe 1964 MsiExec.exe 1964 MsiExec.exe 1964 MsiExec.exe -
Drops file in Program Files directory 12093 IoCs
Processes:
703a1s0ssssd7da.exedescription ioc process File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\local_policy.jar 703a1s0ssssd7da.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\NA02453_.WMF 703a1s0ssssd7da.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI 703a1s0ssssd7da.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\en-US\css\slideShow.css 703a1s0ssssd7da.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_blue_snow.png 703a1s0ssssd7da.exe File opened for modification C:\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Angles.xml 703a1s0ssssd7da.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\DocumentShare\WSSFilesToolHomePageBackground.jpg 703a1s0ssssd7da.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libaudio_format_plugin.dll 703a1s0ssssd7da.exe File opened for modification C:\Program Files\Windows Journal\Templates\Dotted_Line.jtp 703a1s0ssssd7da.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\FDFFile_8.ico 703a1s0ssssd7da.exe File opened for modification C:\Program Files (x86)\Windows NT\TableTextService\TableTextServiceDaYi.txt 703a1s0ssssd7da.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\TexturedBlue.css 703a1s0ssssd7da.exe File opened for modification C:\Program Files\Microsoft Office\Office14\MEDIA\DRUMROLL.WAV 703a1s0ssssd7da.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-core-ui.jar 703a1s0ssssd7da.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\SystemV\HST10 703a1s0ssssd7da.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00037_.GIF 703a1s0ssssd7da.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0150861.WMF 703a1s0ssssd7da.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME04.CSS 703a1s0ssssd7da.exe File created C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\Read_Me.txt 703a1s0ssssd7da.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\hint_up.png 703a1s0ssssd7da.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\83.0.4103.106\chrome_pwa_launcher.exe 703a1s0ssssd7da.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsViewAttachmentIcons.jpg 703a1s0ssssd7da.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\system_settings.png 703a1s0ssssd7da.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationRight_SelectionSubpicture.png 703a1s0ssssd7da.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\WhiteDot.png 703a1s0ssssd7da.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Wallis 703a1s0ssssd7da.exe File opened for modification C:\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Verve.xml 703a1s0ssssd7da.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PSRCHLTS.DAT 703a1s0ssssd7da.exe File opened for modification C:\Program Files\Microsoft Office\Office14\FORMS\1033\SCDRESNS.ICO 703a1s0ssssd7da.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\shuffle_down.png 703a1s0ssssd7da.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\Publisher\Backgrounds\WB02082_.GIF 703a1s0ssssd7da.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\LINES\BD14800_.GIF 703a1s0ssssd7da.exe File created C:\Program Files\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\Read_Me.txt 703a1s0ssssd7da.exe File created C:\Program Files\VideoLAN\VLC\locale\uz\Read_Me.txt 703a1s0ssssd7da.exe File opened for modification C:\Program Files\Windows Media Player\WMPNSSUI.dll 703a1s0ssssd7da.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_lv.dll 703a1s0ssssd7da.exe File opened for modification C:\Program Files\Microsoft Office\Office14\MEDIA\WHOOSH.WAV 703a1s0ssssd7da.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\baseAltGr_rtl.xml 703a1s0ssssd7da.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\Read_Me.txt 703a1s0ssssd7da.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00195_.WMF 703a1s0ssssd7da.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PE00563_.WMF 703a1s0ssssd7da.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SO00783_.WMF 703a1s0ssssd7da.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FieldTypePreview\COMBOBOX.JPG 703a1s0ssssd7da.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0101867.BMP 703a1s0ssssd7da.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\NA02373_.WMF 703a1s0ssssd7da.exe File opened for modification C:\Program Files (x86)\Windows Media Player\en-US\setup_wm.exe.mui 703a1s0ssssd7da.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe 703a1s0ssssd7da.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipschs.xml 703a1s0ssssd7da.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105412.WMF 703a1s0ssssd7da.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SL01395_.WMF 703a1s0ssssd7da.exe File opened for modification C:\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Metro.xml 703a1s0ssssd7da.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\ProjectTool\Project Report Type\Fancy\Hierarchy.xsl 703a1s0ssssd7da.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Wordcnvpxy.cnv 703a1s0ssssd7da.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\tipresx.dll.mui 703a1s0ssssd7da.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\high-contrast.css 703a1s0ssssd7da.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14985_.GIF 703a1s0ssssd7da.exe File opened for modification C:\Program Files\Microsoft Office\Office14\SCANPST.EXE 703a1s0ssssd7da.exe File opened for modification C:\Program Files (x86)\Common Files\System\msadc\handsafe.reg 703a1s0ssssd7da.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\en-US\css\picturePuzzle.css 703a1s0ssssd7da.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_hail.png 703a1s0ssssd7da.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\THEMES14\STUDIO\STUDIO.INF 703a1s0ssssd7da.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\shadowonlyframe_videoinset.png 703a1s0ssssd7da.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-core-windows.xml 703a1s0ssssd7da.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-io_zh_CN.jar 703a1s0ssssd7da.exe -
Modifies registry class 203 IoCs
Processes:
msiexec.exeexplorer.exeexplorer.exeexplorer.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{31411198-a502-11d2-bbca-00c04f8ec294}\Implemented Categories\ msiexec.exe Set value (data) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{31411198-a502-11d2-bbca-00c04f8ec294}\Implemented Categories\{7DD95802-9882-11CF-9FA9-00AA006C42C4} msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\Microsoft\HTMLHelp\2.0 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{314111c7-a502-11d2-bbca-00c04f8ec294}\TypeLib\ = "{31411197-a502-11d2-bbca-00c04f8ec294}" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{314111f0-a502-11d2-bbca-00c04f8ec294}\TypeLib msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{31411228-a502-11d2-bbca-00c04f8ec294}\VersionIndependentProgID msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\SOFTWARE\Microsoft\HTMLHelp\2.0\LocalReg\CLSID\{314111e2-a502-11d2-bbca-00c04f8ec294}\Implemented Categories msiexec.exe Set value (data) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\ms-help msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\Microsoft\HTMLHelp\2.0\LocalReg\CLSID\{314111bd-a502-11d2-bbca-00c04f8ec294}\InprocServer32 msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\Microsoft\HTMLHelp\2.0\LocalReg\CLSID\{314111bd-a502-11d2-bbca-00c04f8ec294}\VersionIndependentProgID msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\Microsoft\HTMLHelp\2.0\LocalReg\CLSID\{314111db-a502-11d2-bbca-00c04f8ec294}\Implemented Categories msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{31411198-a502-11d2-bbca-00c04f8ec294}\VersionIndependentProgID msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{31411198-a502-11d2-bbca-00c04f8ec294}\ProgID msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{31411198-a502-11d2-bbca-00c04f8ec294}\ProgID\ = "HxDS.HxSession.1" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{31411219-a502-11d2-bbca-00c04f8ec294}\VersionIndependentProgID\ = "HxDS.HxRegisterSession" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\SOFTWARE\Microsoft\HTMLHelp\2.0\LocalReg\CLSID\{314111e2-a502-11d2-bbca-00c04f8ec294} msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\Microsoft\HTMLHelp\2.0\LocalReg\CLSID\{314111db-a502-11d2-bbca-00c04f8ec294}\Implemented Categories\ msiexec.exe Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\Microsoft\HTMLHelp\2.0\LocalReg\CLSID\{314111db-a502-11d2-bbca-00c04f8ec294}\TypeLib msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{314111f0-a502-11d2-bbca-00c04f8ec294}\Programmable msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{314111f0-a502-11d2-bbca-00c04f8ec294} msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{31411219-a502-11d2-bbca-00c04f8ec294}\ = "HxRegisterSession Class" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\Microsoft\HTMLHelp\2.0\LocalReg\CLSID\{314111bd-a502-11d2-bbca-00c04f8ec294}\Programmable\ msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{314111f7-a502-11d2-bbca-00c04f8ec294}\TypeLib msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\Microsoft\HTMLHelp\2.0\LocalReg\CLSID\{314111bd-a502-11d2-bbca-00c04f8ec294}\TypeLib\ = "{31411199-a502-11d2-bbca-00c04f8ec294}" msiexec.exe Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{31411219-a502-11d2-bbca-00c04f8ec294}\TypeLib msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\xmlfile\shell\open msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{314111f0-a502-11d2-bbca-00c04f8ec294}\VersionIndependentProgID msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{314111f7-a502-11d2-bbca-00c04f8ec294}\ = "HxParseDisplayName Class" msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\Microsoft\HTMLHelp\2.0\LocalReg\CLSID\{314111db-a502-11d2-bbca-00c04f8ec294}\VersionIndependentProgID msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\Microsoft\HTMLHelp\2.0\LocalReg\CLSID\{314111e2-a502-11d2-bbca-00c04f8ec294}\Implemented Categories\ msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\SOFTWARE\Microsoft\HTMLHelp\2.0\LocalReg\CLSID\{314111db-a502-11d2-bbca-00c04f8ec294}\Programmable msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\Microsoft\HTMLHelp\2.0\LocalReg\CLSID\{314111db-a502-11d2-bbca-00c04f8ec294}\InprocServer32\ThreadingModel = "Apartment" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\SOFTWARE\Microsoft\HTMLHelp\2.0\LocalReg\CLSID\{314111bd-a502-11d2-bbca-00c04f8ec294}\ProgID msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{31411198-a502-11d2-bbca-00c04f8ec294}\Implemented Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4}\ msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\Microsoft\HTMLHelp\2.0\LocalReg\CLSID\{314111db-a502-11d2-bbca-00c04f8ec294}\InprocServer32 msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\xmlfile\ShellEx\IconHandler msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{314111f0-a502-11d2-bbca-00c04f8ec294}\ = "HxRegistryWalker Class" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{31411228-a502-11d2-bbca-00c04f8ec294}\Implemented Categories msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\SOFTWARE\Microsoft\HTMLHelp\2.0\LocalReg\CLSID\{314111db-a502-11d2-bbca-00c04f8ec294}\Implemented Categories msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{31411198-a502-11d2-bbca-00c04f8ec294} msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\Microsoft\HTMLHelp\2.0\LocalReg\CLSID\{314111e2-a502-11d2-bbca-00c04f8ec294}\TypeLib msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\Microsoft\HTMLHelp\2.0\LocalReg\CLSID\{314111e2-a502-11d2-bbca-00c04f8ec294}\VersionIndependentProgID msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{314111f0-a502-11d2-bbca-00c04f8ec294}\TypeLib msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\Microsoft\HTMLHelp\2.0\LocalReg\CLSID\{314111db-a502-11d2-bbca-00c04f8ec294}\InprocServer32\ = "C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\Microsoft\HTMLHelp\2.0\LocalReg\CLSID\{314111e2-a502-11d2-bbca-00c04f8ec294}\InprocServer32\ThreadingModel = "Apartment" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\Microsoft\HTMLHelp\2.0\LocalReg\CLSID\{314111db-a502-11d2-bbca-00c04f8ec294}\Programmable\ msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\SOFTWARE\Microsoft\HTMLHelp\2.0\LocalReg\CLSID\{314111bd-a502-11d2-bbca-00c04f8ec294} msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{31411198-a502-11d2-bbca-00c04f8ec294}\Implemented Categories msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{314111c7-a502-11d2-bbca-00c04f8ec294}\Implemented Categories msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\Microsoft\HTMLHelp\2.0\LocalReg\CLSID\{314111e2-a502-11d2-bbca-00c04f8ec294} msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{314111f0-a502-11d2-bbca-00c04f8ec294} msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{314111f0-a502-11d2-bbca-00c04f8ec294}\Programmable msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{314111c7-a502-11d2-bbca-00c04f8ec294}\Implemented Categories\ msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{31411219-a502-11d2-bbca-00c04f8ec294} msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\Microsoft\HTMLHelp\2.0\LocalReg\CLSID\{314111e2-a502-11d2-bbca-00c04f8ec294}\InprocServer32\ = "C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\SOFTWARE\Microsoft\HTMLHelp\2.0\LocalReg\CLSID\{314111db-a502-11d2-bbca-00c04f8ec294}\InprocServer32 msiexec.exe Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_Classes\Local Settings explorer.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\Microsoft\HTMLHelp\2.0\LocalReg\CLSID\{314111e2-a502-11d2-bbca-00c04f8ec294}\Implemented Categories msiexec.exe -
Modifies service 2 TTPs 4 IoCs
Processes:
explorer.exeexplorer.exedescription ioc process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NapAgent\Qecs explorer.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NapAgent\Shas explorer.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NapAgent\Qecs explorer.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NapAgent\Shas explorer.exe -
Suspicious use of SendNotifyMessage 83 IoCs
Processes:
explorer.exeexplorer.exeexplorer.exepid process 2000 explorer.exe 2000 explorer.exe 2000 explorer.exe 2000 explorer.exe 2000 explorer.exe 2000 explorer.exe 2000 explorer.exe 2000 explorer.exe 2000 explorer.exe 2000 explorer.exe 2000 explorer.exe 2000 explorer.exe 2000 explorer.exe 2000 explorer.exe 2000 explorer.exe 2000 explorer.exe 2000 explorer.exe 2000 explorer.exe 2000 explorer.exe 2000 explorer.exe 2000 explorer.exe 2000 explorer.exe 2000 explorer.exe 2000 explorer.exe 2000 explorer.exe 2000 explorer.exe 2000 explorer.exe 2000 explorer.exe 2000 explorer.exe 1052 explorer.exe 1052 explorer.exe 1052 explorer.exe 1052 explorer.exe 1052 explorer.exe 1052 explorer.exe 1052 explorer.exe 1052 explorer.exe 1052 explorer.exe 1052 explorer.exe 1052 explorer.exe 1052 explorer.exe 1052 explorer.exe 1456 explorer.exe 1456 explorer.exe 1456 explorer.exe 1456 explorer.exe 1456 explorer.exe 1456 explorer.exe 1456 explorer.exe 1456 explorer.exe 1456 explorer.exe 1456 explorer.exe 1456 explorer.exe 1456 explorer.exe 1456 explorer.exe 1456 explorer.exe 1456 explorer.exe 1456 explorer.exe 1456 explorer.exe 1456 explorer.exe 1456 explorer.exe 1456 explorer.exe 1456 explorer.exe 1456 explorer.exe -
Drops startup file 1 IoCs
Processes:
703a1s0ssssd7da.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\Read_Me.txt 703a1s0ssssd7da.exe -
Registers COM server for autorun 1 TTPs 24 IoCs
Processes:
msiexec.exedescription ioc process Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{31411198-a502-11d2-bbca-00c04f8ec294}\InprocServer32 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{31411228-a502-11d2-bbca-00c04f8ec294}\InprocServer32\ = "C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{31411198-a502-11d2-bbca-00c04f8ec294}\InprocServer32\ = "C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{314111f0-a502-11d2-bbca-00c04f8ec294}\InprocServer32\ = "C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll" msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{314111c7-a502-11d2-bbca-00c04f8ec294}\InprocServer32 msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{31411219-a502-11d2-bbca-00c04f8ec294}\InprocServer32 msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{31411228-a502-11d2-bbca-00c04f8ec294}\InprocServer32 msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{314111f7-a502-11d2-bbca-00c04f8ec294}\InprocServer32 msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{314111f0-a502-11d2-bbca-00c04f8ec294}\InprocServer32 msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{314111f0-a502-11d2-bbca-00c04f8ec294}\InprocServer32 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{314111f0-a502-11d2-bbca-00c04f8ec294}\InprocServer32\ThreadingModel = "Apartment" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{314111f7-a502-11d2-bbca-00c04f8ec294}\InprocServer32 msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{31411228-a502-11d2-bbca-00c04f8ec294}\InprocServer32 msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{31411219-a502-11d2-bbca-00c04f8ec294}\InprocServer32 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{314111c7-a502-11d2-bbca-00c04f8ec294}\InprocServer32\ = "C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{314111f7-a502-11d2-bbca-00c04f8ec294}\InprocServer32\ = "C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{31411219-a502-11d2-bbca-00c04f8ec294}\InprocServer32\ThreadingModel = "Apartment" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{31411219-a502-11d2-bbca-00c04f8ec294}\InprocServer32\ = "C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{314111c7-a502-11d2-bbca-00c04f8ec294}\InprocServer32 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{314111c7-a502-11d2-bbca-00c04f8ec294}\InprocServer32\ThreadingModel = "Apartment" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{314111f7-a502-11d2-bbca-00c04f8ec294}\InprocServer32\ThreadingModel = "Apartment" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{31411228-a502-11d2-bbca-00c04f8ec294}\InprocServer32\ThreadingModel = "Apartment" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{31411198-a502-11d2-bbca-00c04f8ec294}\InprocServer32 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{31411198-a502-11d2-bbca-00c04f8ec294}\InprocServer32\ThreadingModel = "Apartment" msiexec.exe -
Modifies data under HKEY_USERS 3 IoCs
Processes:
msiexec.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25 msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\24\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\24 msiexec.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
Processes
-
C:\Users\Admin\AppData\Local\Temp\703a1s0ssssd7da.exe"C:\Users\Admin\AppData\Local\Temp\703a1s0ssssd7da.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\703a1s0ssssd7da.exe"{path}"2⤵
- Drops desktop.ini file(s)
- Suspicious behavior: EnumeratesProcesses
- Drops file in Program Files directory
- Drops startup file
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Drops desktop.ini file(s)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Modifies registry class
- Modifies service
- Suspicious use of SendNotifyMessage
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Suspicious use of AdjustPrivilegeToken
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
- Modifies registry class
- Registers COM server for autorun
- Modifies data under HKEY_USERS
-
C:\Windows\system32\MsiExec.exeC:\Windows\system32\MsiExec.exe -Embedding C98124D9B649C5E996D48646E974F5AD2⤵
- Loads dropped DLL
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding E85922811A17BAA4B232FC524EDE42712⤵
- Loads dropped DLL
-
C:\Windows\system32\MsiExec.exeC:\Windows\system32\MsiExec.exe -Embedding D0A015570E0CA14ABBF7297691CFA42E M Global\MSI00002⤵
- Loads dropped DLL
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Suspicious use of FindShellTrayWindow
- Modifies registry class
- Suspicious use of SendNotifyMessage
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Suspicious use of FindShellTrayWindow
- Modifies registry class
- Modifies service
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\Hx621C.tmp
-
C:\Users\Admin\AppData\Local\Temp\WPDNSE\Read_Me.txt
-
C:\Users\Admin\Desktop\AssertExport.jpg.readme
-
C:\Users\Admin\Desktop\BlockWatch.m3u.readme
-
C:\Users\Admin\Desktop\CompareShow.cmd.readme
-
C:\Users\Admin\Desktop\CompleteMove.html.readme
-
C:\Users\Admin\Desktop\CompressPublish.odt.readme
-
C:\Users\Admin\Desktop\ConfirmMeasure.M2TS.readme
-
C:\Users\Admin\Desktop\ConvertToCheckpoint.avi.readme
-
C:\Users\Admin\Desktop\DisconnectGroup.edrwx.readme
-
C:\Users\Admin\Desktop\EnterRestart.fon.readme
-
C:\Users\Admin\Desktop\GrantRevoke.vsdx.readme
-
C:\Users\Admin\Desktop\InvokeJoin.aif.readme
-
C:\Users\Admin\Desktop\MountConfirm.tiff.readme
-
C:\Users\Admin\Desktop\MountSet.wmv.readme
-
C:\Users\Admin\Desktop\NewConfirm.3g2.readme
-
C:\Users\Admin\Desktop\OptimizeSwitch.potm.readme
-
C:\Users\Admin\Desktop\OptimizeUse.jtx.readme
-
C:\Users\Admin\Desktop\PingUnprotect.cmd.readme
-
C:\Users\Admin\Desktop\ProtectMove.dwfx.readme
-
C:\Users\Admin\Desktop\PublishResolve.search-ms.readme
-
C:\Users\Admin\Desktop\Read_Me.txt
-
C:\Users\Admin\Desktop\RedoLock.m3u.readme
-
C:\Users\Admin\Desktop\RenameRequest.vdx.readme
-
C:\Users\Admin\Desktop\RequestWatch.jpg.readme
-
C:\Users\Admin\Desktop\RevokeConvert.mpeg3.readme
-
C:\Users\Admin\Desktop\SelectShow.htm.readme
-
C:\Users\Admin\Desktop\StartMeasure.eprtx.readme
-
C:\Users\Admin\Desktop\UninstallRequest.rtf.readme
-
C:\Users\Admin\Desktop\UnregisterBackup.dotm.readme
-
C:\Users\Admin\Desktop\WatchImport.jpeg.readme
-
C:\Users\Admin\Desktop\desktop.ini.readme
-
C:\Users\Public\Desktop\Adobe Reader 9.lnk.readme
-
C:\Users\Public\Desktop\Firefox.lnk.readme
-
C:\Users\Public\Desktop\Google Chrome.lnk.readme
-
C:\Users\Public\Desktop\Read_Me.txt
-
C:\Users\Public\Desktop\VLC media player.lnk.readme
-
C:\Users\Public\Desktop\desktop.ini.readme
-
C:\Windows\Installer\MSI22A7.tmp
-
C:\Windows\Installer\MSI3B66.tmp
-
C:\Windows\Installer\MSI3FE9.tmp
-
C:\Windows\Installer\MSI55AD.tmp
-
C:\Windows\Installer\MSI61ED.tmp
-
C:\Windows\Installer\MSI63B3.tmp
-
C:\Windows\Installer\MSI6450.tmp
-
C:\Windows\Installer\MSI656A.tmp
-
C:\Windows\Installer\MSI6886.tmp
-
C:\Windows\Installer\MSI6A2C.tmp
-
C:\Windows\Installer\MSI769C.tmp
-
C:\Windows\Installer\MSI7739.tmp
-
C:\Windows\Installer\MSI7824.tmp
-
C:\Windows\Installer\MSI7863.tmp
-
C:\Windows\Installer\MSI7D83.tmp
-
C:\Windows\Installer\MSI7E3F.tmp
-
C:\Windows\Installer\MSI7F1A.tmp
-
C:\Windows\Installer\MSI8DEA.tmp
-
C:\Windows\Installer\MSI8F33.tmp
-
C:\Windows\Installer\MSI902E.tmp
-
C:\Windows\Installer\MSI91A6.tmp
-
C:\Windows\Installer\MSI92BF.tmp
-
C:\Windows\Installer\MSI935C.tmp
-
C:\Windows\Installer\MSI9C53.tmp
-
C:\Windows\Installer\MSI9D8C.tmp
-
C:\Windows\Installer\MSIDBE.tmp
-
C:\Windows\Installer\MSIE99.tmp
-
C:\Windows\Installer\MSIF343.tmp
-
C:\Windows\Installer\MSIF4DA.tmp
-
C:\Windows\Installer\MSIF596.tmp
-
C:\Windows\Installer\MSIF95E.tmp
-
C:\Windows\Installer\MSIFAC6.tmp
-
C:\Windows\Installer\MSIFB92.tmp
-
C:\Windows\Installer\MSIFC8C.tmp
-
C:\Windows\Installer\MSIFD29.tmp
-
C:\Windows\Installer\MSIFF1.tmp
-
\??\M:\$RECYCLE.BIN\S-1-5-21-1131729243-447456001-3632642222-1000\desktop.ini
-
\Users\Admin\AppData\Local\Temp\Hx621C.tmp
-
\Users\Admin\AppData\Local\Temp\Hx621C.tmp
-
\Users\Admin\AppData\Local\Temp\Hx621C.tmp
-
\Users\Admin\AppData\Local\Temp\Hx621C.tmp
-
\Windows\Installer\MSI22A7.tmp
-
\Windows\Installer\MSI3B66.tmp
-
\Windows\Installer\MSI3FE9.tmp
-
\Windows\Installer\MSI55AD.tmp
-
\Windows\Installer\MSI61ED.tmp
-
\Windows\Installer\MSI63B3.tmp
-
\Windows\Installer\MSI6450.tmp
-
\Windows\Installer\MSI656A.tmp
-
\Windows\Installer\MSI6886.tmp
-
\Windows\Installer\MSI6A2C.tmp
-
\Windows\Installer\MSI769C.tmp
-
\Windows\Installer\MSI7739.tmp
-
\Windows\Installer\MSI7824.tmp
-
\Windows\Installer\MSI7863.tmp
-
\Windows\Installer\MSI7D83.tmp
-
\Windows\Installer\MSI7E3F.tmp
-
\Windows\Installer\MSI7F1A.tmp
-
\Windows\Installer\MSI8DEA.tmp
-
\Windows\Installer\MSI8F33.tmp
-
\Windows\Installer\MSI902E.tmp
-
\Windows\Installer\MSI91A6.tmp
-
\Windows\Installer\MSI92BF.tmp
-
\Windows\Installer\MSI935C.tmp
-
\Windows\Installer\MSI9C53.tmp
-
\Windows\Installer\MSI9D8C.tmp
-
\Windows\Installer\MSIDBE.tmp
-
\Windows\Installer\MSIE99.tmp
-
\Windows\Installer\MSIF343.tmp
-
\Windows\Installer\MSIF4DA.tmp
-
\Windows\Installer\MSIF596.tmp
-
\Windows\Installer\MSIF95E.tmp
-
\Windows\Installer\MSIFAC6.tmp
-
\Windows\Installer\MSIFB92.tmp
-
\Windows\Installer\MSIFC8C.tmp
-
\Windows\Installer\MSIFD29.tmp
-
\Windows\Installer\MSIFF1.tmp
-
memory/1052-23-0x0000000003C80000-0x0000000003D81000-memory.dmpFilesize
1.0MB
-
memory/1080-161-0x0000000000320000-0x0000000000324000-memory.dmpFilesize
16KB
-
memory/1080-201-0x0000000005C80000-0x0000000005C84000-memory.dmpFilesize
16KB
-
memory/1080-145-0x0000000000320000-0x0000000000324000-memory.dmpFilesize
16KB
-
memory/1080-204-0x0000000001370000-0x0000000001374000-memory.dmpFilesize
16KB
-
memory/1080-123-0x0000000000320000-0x0000000000324000-memory.dmpFilesize
16KB
-
memory/1080-173-0x0000000000320000-0x0000000000324000-memory.dmpFilesize
16KB
-
memory/1080-174-0x0000000000320000-0x0000000000324000-memory.dmpFilesize
16KB
-
memory/1080-203-0x0000000000320000-0x0000000000324000-memory.dmpFilesize
16KB
-
memory/1080-131-0x0000000000320000-0x0000000000324000-memory.dmpFilesize
16KB
-
memory/1080-89-0x0000000000320000-0x0000000000324000-memory.dmpFilesize
16KB
-
memory/1080-179-0x0000000000320000-0x0000000000324000-memory.dmpFilesize
16KB
-
memory/1080-57-0x0000000000320000-0x0000000000324000-memory.dmpFilesize
16KB
-
memory/1080-109-0x0000000000320000-0x0000000000324000-memory.dmpFilesize
16KB
-
memory/1080-82-0x0000000000320000-0x0000000000324000-memory.dmpFilesize
16KB
-
memory/1080-88-0x0000000000320000-0x0000000000324000-memory.dmpFilesize
16KB
-
memory/1080-192-0x0000000005C80000-0x0000000005C84000-memory.dmpFilesize
16KB
-
memory/1080-97-0x0000000000320000-0x0000000000324000-memory.dmpFilesize
16KB
-
memory/1080-43-0x0000000000AD0000-0x0000000000AD4000-memory.dmpFilesize
16KB
-
memory/1456-42-0x0000000004BD0000-0x0000000004BD4000-memory.dmpFilesize
16KB
-
memory/1456-35-0x0000000004BD0000-0x0000000004BD4000-memory.dmpFilesize
16KB
-
memory/1456-31-0x0000000003790000-0x0000000003791000-memory.dmpFilesize
4KB
-
memory/1456-34-0x0000000009190000-0x0000000009194000-memory.dmpFilesize
16KB
-
memory/1456-207-0x0000000003D10000-0x0000000003D11000-memory.dmpFilesize
4KB
-
memory/1672-5-0x0000000000000000-mapping.dmp
-
memory/1744-10-0x0000000000000000-mapping.dmp
-
memory/1844-2-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/1844-1-0x0000000000407CA0-mapping.dmp
-
memory/1844-0-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/1964-176-0x0000000000000000-mapping.dmp
-
memory/2000-4-0x0000000004FA0000-0x0000000004FA4000-memory.dmpFilesize
16KB
-
memory/2000-3-0x00000000097A0000-0x00000000097A4000-memory.dmpFilesize
16KB