Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7v200430 -
submitted
09-07-2020 06:43
Static task
static1
Behavioral task
behavioral1
Sample
fd118cd10923a0d7a58d977fb74295f4.exe
Resource
win7v200430
Behavioral task
behavioral2
Sample
fd118cd10923a0d7a58d977fb74295f4.exe
Resource
win10
General
-
Target
fd118cd10923a0d7a58d977fb74295f4.exe
-
Size
977KB
-
MD5
fd118cd10923a0d7a58d977fb74295f4
-
SHA1
3e214c12aeb9f54c682dd63fd5e77ac10bc60774
-
SHA256
692dc7ac48dfa381cd7f860236876e3621af2e1dc984b8f14cad498e412e88d8
-
SHA512
549f0e6a5194a6e26d7a2c5b12167d2c0e1fba28d873e077a95462eb3f7d70b3d5fc6f85d0e19b7e5dc5c6b22d74b7a81e56921b9123e8059bdabd7b680e16b6
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 66 IoCs
Processes:
fd118cd10923a0d7a58d977fb74295f4.exeRegSvcs.exetaskkill.exewmic.exevssvc.exewmic.exewmic.exedescription pid process Token: SeDebugPrivilege 1032 fd118cd10923a0d7a58d977fb74295f4.exe Token: SeDebugPrivilege 1856 RegSvcs.exe Token: SeDebugPrivilege 1032 taskkill.exe Token: SeIncreaseQuotaPrivilege 1248 wmic.exe Token: SeSecurityPrivilege 1248 wmic.exe Token: SeTakeOwnershipPrivilege 1248 wmic.exe Token: SeLoadDriverPrivilege 1248 wmic.exe Token: SeSystemProfilePrivilege 1248 wmic.exe Token: SeSystemtimePrivilege 1248 wmic.exe Token: SeProfSingleProcessPrivilege 1248 wmic.exe Token: SeIncBasePriorityPrivilege 1248 wmic.exe Token: SeCreatePagefilePrivilege 1248 wmic.exe Token: SeBackupPrivilege 1248 wmic.exe Token: SeRestorePrivilege 1248 wmic.exe Token: SeShutdownPrivilege 1248 wmic.exe Token: SeDebugPrivilege 1248 wmic.exe Token: SeSystemEnvironmentPrivilege 1248 wmic.exe Token: SeRemoteShutdownPrivilege 1248 wmic.exe Token: SeUndockPrivilege 1248 wmic.exe Token: SeManageVolumePrivilege 1248 wmic.exe Token: 33 1248 wmic.exe Token: 34 1248 wmic.exe Token: 35 1248 wmic.exe Token: SeBackupPrivilege 1500 vssvc.exe Token: SeRestorePrivilege 1500 vssvc.exe Token: SeAuditPrivilege 1500 vssvc.exe Token: SeIncreaseQuotaPrivilege 1592 wmic.exe Token: SeSecurityPrivilege 1592 wmic.exe Token: SeTakeOwnershipPrivilege 1592 wmic.exe Token: SeLoadDriverPrivilege 1592 wmic.exe Token: SeSystemProfilePrivilege 1592 wmic.exe Token: SeSystemtimePrivilege 1592 wmic.exe Token: SeProfSingleProcessPrivilege 1592 wmic.exe Token: SeIncBasePriorityPrivilege 1592 wmic.exe Token: SeCreatePagefilePrivilege 1592 wmic.exe Token: SeBackupPrivilege 1592 wmic.exe Token: SeRestorePrivilege 1592 wmic.exe Token: SeShutdownPrivilege 1592 wmic.exe Token: SeDebugPrivilege 1592 wmic.exe Token: SeSystemEnvironmentPrivilege 1592 wmic.exe Token: SeRemoteShutdownPrivilege 1592 wmic.exe Token: SeUndockPrivilege 1592 wmic.exe Token: SeManageVolumePrivilege 1592 wmic.exe Token: 33 1592 wmic.exe Token: 34 1592 wmic.exe Token: 35 1592 wmic.exe Token: SeIncreaseQuotaPrivilege 1264 wmic.exe Token: SeSecurityPrivilege 1264 wmic.exe Token: SeTakeOwnershipPrivilege 1264 wmic.exe Token: SeLoadDriverPrivilege 1264 wmic.exe Token: SeSystemProfilePrivilege 1264 wmic.exe Token: SeSystemtimePrivilege 1264 wmic.exe Token: SeProfSingleProcessPrivilege 1264 wmic.exe Token: SeIncBasePriorityPrivilege 1264 wmic.exe Token: SeCreatePagefilePrivilege 1264 wmic.exe Token: SeBackupPrivilege 1264 wmic.exe Token: SeRestorePrivilege 1264 wmic.exe Token: SeShutdownPrivilege 1264 wmic.exe Token: SeDebugPrivilege 1264 wmic.exe Token: SeSystemEnvironmentPrivilege 1264 wmic.exe Token: SeRemoteShutdownPrivilege 1264 wmic.exe Token: SeUndockPrivilege 1264 wmic.exe Token: SeManageVolumePrivilege 1264 wmic.exe Token: 33 1264 wmic.exe -
Suspicious behavior: EnumeratesProcesses 725 IoCs
Processes:
fd118cd10923a0d7a58d977fb74295f4.exeRegSvcs.exemyzip.exepid process 1032 fd118cd10923a0d7a58d977fb74295f4.exe 1856 RegSvcs.exe 1688 myzip.exe 1688 myzip.exe 1688 myzip.exe 1688 myzip.exe 1688 myzip.exe 1688 myzip.exe 1688 myzip.exe 1688 myzip.exe 1688 myzip.exe 1688 myzip.exe 1688 myzip.exe 1688 myzip.exe 1688 myzip.exe 1688 myzip.exe 1688 myzip.exe 1688 myzip.exe 1688 myzip.exe 1688 myzip.exe 1688 myzip.exe 1688 myzip.exe 1688 myzip.exe 1688 myzip.exe 1688 myzip.exe 1688 myzip.exe 1688 myzip.exe 1688 myzip.exe 1688 myzip.exe 1688 myzip.exe 1688 myzip.exe 1688 myzip.exe 1688 myzip.exe 1688 myzip.exe 1688 myzip.exe 1688 myzip.exe 1688 myzip.exe 1688 myzip.exe 1688 myzip.exe 1688 myzip.exe 1688 myzip.exe 1688 myzip.exe 1688 myzip.exe 1688 myzip.exe 1688 myzip.exe 1688 myzip.exe 1688 myzip.exe 1688 myzip.exe 1688 myzip.exe 1688 myzip.exe 1688 myzip.exe 1688 myzip.exe 1688 myzip.exe 1688 myzip.exe 1688 myzip.exe 1688 myzip.exe 1688 myzip.exe 1688 myzip.exe 1688 myzip.exe 1688 myzip.exe 1688 myzip.exe 1688 myzip.exe 1688 myzip.exe 1688 myzip.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
fd118cd10923a0d7a58d977fb74295f4.exedescription pid process target process PID 1032 set thread context of 1856 1032 fd118cd10923a0d7a58d977fb74295f4.exe RegSvcs.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 1612 iexplore.exe -
Loads dropped DLL 2 IoCs
Processes:
RegSvcs.exepid process 1856 RegSvcs.exe 1856 RegSvcs.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
myzip.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion myzip.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion myzip.exe -
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 1032 taskkill.exe -
Drops desktop.ini file(s) 1 IoCs
Processes:
myzip.exedescription ioc process File opened for modification \??\Z:\$RECYCLE.BIN\S-1-5-21-910373003-3952921535-3480519689-1000\desktop.ini myzip.exe -
System policy modification 1 TTPs 1 IoCs
Processes:
myzip.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1" myzip.exe -
Processes:
RegSvcs.exedescription ioc process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e RegSvcs.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e RegSvcs.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d00f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e RegSvcs.exe Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\SystemCertificates\CA\Certificates\8D4C4A23BA9EE84EA7348FA98CC6E65FBB69DE7B RegSvcs.exe Set value (data) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\SystemCertificates\CA\Certificates\8D4C4A23BA9EE84EA7348FA98CC6E65FBB69DE7B\Blob = 0300000001000000140000008d4c4a23ba9ee84ea7348fa98cc6e65fbb69de7b19000000010000001000000082218ffb91733e64136be5719f57c3a1040000000100000010000000ab9b109ce8934f11e7cd22ed550680da0f0000000100000030000000a768343c4aeaced5c72f3571938864983a67ed49031c1da2495863caf65fe507011f7f0e70b6cb40e5631c07721be034140000000100000014000000bbaf7e023dfaa6f13c848eadee3898ecd93232d41800000001000000100000002aa1c05e2ae606f198c2c5e937c97aa22000000001000000820500003082057e30820466a003020102021067def43ef17bdae24ff5940606d2c084300d06092a864886f70d01010c0500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a308185310b3009060355040613024742311b30190603550408131247726561746572204d616e636865737465723110300e0603550407130753616c666f7264311a3018060355040a1311434f4d4f444f204341204c696d69746564312b302906035504031322434f4d4f444f205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010091e85492d20a56b1ac0d24ddc5cf446774992b37a37d23700071bc53dfc4fa2a128f4b7f1056bd9f7072b7617fc94b0f17a73de3b00461eeff1197c7f4863e0afa3e5cf993e6347ad9146be79cb385a0827a76af7190d7ecfd0dfa9c6cfadfb082f4147ef9bec4a62f4f7f997fb5fc674372bd0c00d689eb6b2cd3ed8f981c14ab7ee5e36efcd8a8e49224da436b62b855fdeac1bc6cb68bf30e8d9ae49b6c6999f878483045d5ade10d3c4560fc32965127bc67c3ca2eb66bea46c7c720a0b11f65de4808baa44ea9f283463784ebe8cc814843674e722a9b5cbd4c1b288a5c227bb4ab98d9eee05183c309464e6d3e99fa9517da7c3357413c8d51ed0bb65caf2c631adf57c83fbce95dc49baf4599e2a35a24b4baa9563dcf6faaff4958bef0a8fff4b8ade937fbbab8f40b3af9e843421e89d884cb13f1d9bbe18960b88c2856ac141d9c0ae771ebcf0edd3da996a148bd3cf7afb50d224cc01181ec563bf6d3a2e25bb7b204225295809369e88e4c65f191032d707402ea8b671529695202bbd7df506a5546bfa0a328617f70d0c3a2aa2c21aa47ce289c064576bf821827b4d5aeb4cb50e66bf44c867130e9a6df1686e0d8ff40ddfbd042887fa3333a2e5c1e41118163ce18716b2beca68ab7315c3a6a47e0c37959d6201aaff26a98aa72bc574ad24b9dbb10fcb04c41e5ed1d3d5e289d9cccbfb351daa747e584530203010001a381f23081ef301f0603551d23041830168014a0110a233e96f107ece2af29ef82a57fd030a4b4301d0603551d0e04160414bbaf7e023dfaa6f13c848eadee3898ecd93232d4300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff30110603551d20040a300830060604551d200030430603551d1f043c303a3038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c303406082b0601050507010104283026302406082b060105050730018618687474703a2f2f6f6373702e636f6d6f646f63612e636f6d300d06092a864886f70d01010c050003820101007ff25635b06d954a4e74af3ae26f018b87d33297edf840d2775311d7c7162ec69de64856be80a9f8bc78d2c86317ae8ced1631fa1f18c90ec7ee48799fc7c9b9bccc8815e36861d19f1d4b6181d7560463c2086926f0f0e52fdfc00a2ba905f4025a6a89d7b4844295e3ebf776205e35d9c0cd2508134c71388e87b0338491991e91f1ac9e3fa71d60812c364154a0e246060bac1bc799368c5ea10ba49ed9424624c5c55b81aeada0a0dc9f36b88dc21d15fa88ad8110391f44f02b9fdd10540c0734b136d114fd07023dff7255ab27d62c814171298d41f450571a7e6560afcbc5287698aeb3a853768be621526bea21d0840e494e8853da922ee71d0866d7 RegSvcs.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 RegSvcs.exe -
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Set value (data) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007cf8d5bd09b0364592b95b96ab312388000000000200000000001066000000010000200000000deabbf1b24afe41518fb517e4425d97e44e7074c679c2b9ddbae2ec8c135507000000000e8000000002000020000000e16f6ba8462cad1633b6201c54b3e431730fa286a2035bd14bf79efb980ba3ce2000000095ceca739f92c5c158bcdd6e658dd81ea961826c1d8e53aa00b0c4310eb308db40000000639bd40b8c54b7f68ecc5cc692eb0ab62beeb2c80c4fb4858047786b63b240d8d5b6def224c22af4b08bf0cd61755b0493390f976310d91ecc99fb3a581d8557 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "301049183" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0163f19cd55d601 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007cf8d5bd09b0364592b95b96ab3123880000000002000000000010660000000100002000000056e2806eae96e966a7691728f66cf220137f697f0549c0c781fa53af66670319000000000e80000000020000200000006890195454b1edeb6a667ed51232b13ac77295bf61805e8d4c2560db6e905a3f900000005e5d1cedbd9507ea49b29fa84c31cb6384d6547e93fc4b1a0f383f3b08ac87b497bc130afc5294f99ae1cdb5408935432eaa21f91f4a1e50962ce713d6b909b9ac4fe8f70e267ad5268a79050a84f9de3bf4ecb05343a5108eccaa84e3ecef9cefca2823dde7e70e00179f7863302d285fe6400465c1df80c88445737a3f98207e76cf2a9107a5aaf16d9fd3c8e7032540000000fe4db53873fe4eed875c7a2ebc830c5f6a08cd6d3a3ec0accf6e0789db8bf1bb5fcd23d6fded5c2a2a09a8b2d190c4d41212e9a6ec1e633bc166df977ed5b5de iexplore.exe Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{422AA4D1-C1C0-11EA-B2C5-FED453BC27D5} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Modifies service 2 TTPs 4 IoCs
Processes:
vssvc.exedescription ioc process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer vssvc.exe -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
Processes:
myzip.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ myzip.exe -
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Checks for installed software on the system 1 TTPs 30 IoCs
Processes:
RegSvcs.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\WIC\DisplayName RegSvcs.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{00203668-8170-44A0-BE44-B632FA4D780F}\DisplayName RegSvcs.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2549743\DisplayName RegSvcs.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall RegSvcs.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook\DisplayName RegSvcs.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome\DisplayName RegSvcs.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\DisplayName RegSvcs.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\MobileOptionPack\DisplayName RegSvcs.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\SchedulingAgent\DisplayName RegSvcs.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2467173\DisplayName RegSvcs.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB982573\DisplayName RegSvcs.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\DisplayName RegSvcs.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall RegSvcs.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Adobe AIR\DisplayName RegSvcs.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE5BAKEX\DisplayName RegSvcs.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager\DisplayName RegSvcs.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data\DisplayName RegSvcs.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2544655\DisplayName RegSvcs.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx\DisplayName RegSvcs.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2151757\DisplayName RegSvcs.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{92FB6C44-E685-45AD-9B20-CADF4CABA132}.KB4087364\DisplayName RegSvcs.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2565063\DisplayName RegSvcs.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2524860\DisplayName RegSvcs.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{BB8B979E-E336-47E7-96BC-1031C1B94561}\DisplayName RegSvcs.exe Key enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall RegSvcs.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE40\DisplayName RegSvcs.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IEData\DisplayName RegSvcs.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore\DisplayName RegSvcs.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{AC76BA86-7AD7-1033-7B44-A90000000001}\DisplayName RegSvcs.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{f4220b74-9edd-4ded-bc8b-0342c1e164d8}\DisplayName RegSvcs.exe -
Suspicious use of WriteProcessMemory 67 IoCs
Processes:
fd118cd10923a0d7a58d977fb74295f4.exeRegSvcs.exeiexplore.execmd.exemyzip.exedescription pid process target process PID 1032 wrote to memory of 1840 1032 fd118cd10923a0d7a58d977fb74295f4.exe RegSvcs.exe PID 1032 wrote to memory of 1840 1032 fd118cd10923a0d7a58d977fb74295f4.exe RegSvcs.exe PID 1032 wrote to memory of 1840 1032 fd118cd10923a0d7a58d977fb74295f4.exe RegSvcs.exe PID 1032 wrote to memory of 1840 1032 fd118cd10923a0d7a58d977fb74295f4.exe RegSvcs.exe PID 1032 wrote to memory of 1840 1032 fd118cd10923a0d7a58d977fb74295f4.exe RegSvcs.exe PID 1032 wrote to memory of 1840 1032 fd118cd10923a0d7a58d977fb74295f4.exe RegSvcs.exe PID 1032 wrote to memory of 1840 1032 fd118cd10923a0d7a58d977fb74295f4.exe RegSvcs.exe PID 1032 wrote to memory of 1856 1032 fd118cd10923a0d7a58d977fb74295f4.exe RegSvcs.exe PID 1032 wrote to memory of 1856 1032 fd118cd10923a0d7a58d977fb74295f4.exe RegSvcs.exe PID 1032 wrote to memory of 1856 1032 fd118cd10923a0d7a58d977fb74295f4.exe RegSvcs.exe PID 1032 wrote to memory of 1856 1032 fd118cd10923a0d7a58d977fb74295f4.exe RegSvcs.exe PID 1032 wrote to memory of 1856 1032 fd118cd10923a0d7a58d977fb74295f4.exe RegSvcs.exe PID 1032 wrote to memory of 1856 1032 fd118cd10923a0d7a58d977fb74295f4.exe RegSvcs.exe PID 1032 wrote to memory of 1856 1032 fd118cd10923a0d7a58d977fb74295f4.exe RegSvcs.exe PID 1032 wrote to memory of 1856 1032 fd118cd10923a0d7a58d977fb74295f4.exe RegSvcs.exe PID 1032 wrote to memory of 1856 1032 fd118cd10923a0d7a58d977fb74295f4.exe RegSvcs.exe PID 1032 wrote to memory of 1856 1032 fd118cd10923a0d7a58d977fb74295f4.exe RegSvcs.exe PID 1032 wrote to memory of 1856 1032 fd118cd10923a0d7a58d977fb74295f4.exe RegSvcs.exe PID 1032 wrote to memory of 1856 1032 fd118cd10923a0d7a58d977fb74295f4.exe RegSvcs.exe PID 1856 wrote to memory of 1612 1856 RegSvcs.exe iexplore.exe PID 1856 wrote to memory of 1612 1856 RegSvcs.exe iexplore.exe PID 1856 wrote to memory of 1612 1856 RegSvcs.exe iexplore.exe PID 1856 wrote to memory of 1612 1856 RegSvcs.exe iexplore.exe PID 1612 wrote to memory of 1944 1612 iexplore.exe IEXPLORE.EXE PID 1612 wrote to memory of 1944 1612 iexplore.exe IEXPLORE.EXE PID 1612 wrote to memory of 1944 1612 iexplore.exe IEXPLORE.EXE PID 1612 wrote to memory of 1944 1612 iexplore.exe IEXPLORE.EXE PID 1856 wrote to memory of 1688 1856 RegSvcs.exe myzip.exe PID 1856 wrote to memory of 1688 1856 RegSvcs.exe myzip.exe PID 1856 wrote to memory of 1688 1856 RegSvcs.exe myzip.exe PID 1856 wrote to memory of 1688 1856 RegSvcs.exe myzip.exe PID 1856 wrote to memory of 672 1856 RegSvcs.exe cmd.exe PID 1856 wrote to memory of 672 1856 RegSvcs.exe cmd.exe PID 1856 wrote to memory of 672 1856 RegSvcs.exe cmd.exe PID 1856 wrote to memory of 672 1856 RegSvcs.exe cmd.exe PID 672 wrote to memory of 1032 672 cmd.exe taskkill.exe PID 672 wrote to memory of 1032 672 cmd.exe taskkill.exe PID 672 wrote to memory of 1032 672 cmd.exe taskkill.exe PID 672 wrote to memory of 1032 672 cmd.exe taskkill.exe PID 672 wrote to memory of 1744 672 cmd.exe choice.exe PID 672 wrote to memory of 1744 672 cmd.exe choice.exe PID 672 wrote to memory of 1744 672 cmd.exe choice.exe PID 672 wrote to memory of 1744 672 cmd.exe choice.exe PID 1688 wrote to memory of 1248 1688 myzip.exe wmic.exe PID 1688 wrote to memory of 1248 1688 myzip.exe wmic.exe PID 1688 wrote to memory of 1248 1688 myzip.exe wmic.exe PID 1688 wrote to memory of 1248 1688 myzip.exe wmic.exe PID 1688 wrote to memory of 328 1688 myzip.exe vssadmin.exe PID 1688 wrote to memory of 328 1688 myzip.exe vssadmin.exe PID 1688 wrote to memory of 328 1688 myzip.exe vssadmin.exe PID 1688 wrote to memory of 328 1688 myzip.exe vssadmin.exe PID 1688 wrote to memory of 1592 1688 myzip.exe wmic.exe PID 1688 wrote to memory of 1592 1688 myzip.exe wmic.exe PID 1688 wrote to memory of 1592 1688 myzip.exe wmic.exe PID 1688 wrote to memory of 1592 1688 myzip.exe wmic.exe PID 1688 wrote to memory of 1764 1688 myzip.exe vssadmin.exe PID 1688 wrote to memory of 1764 1688 myzip.exe vssadmin.exe PID 1688 wrote to memory of 1764 1688 myzip.exe vssadmin.exe PID 1688 wrote to memory of 1764 1688 myzip.exe vssadmin.exe PID 1688 wrote to memory of 1264 1688 myzip.exe wmic.exe PID 1688 wrote to memory of 1264 1688 myzip.exe wmic.exe PID 1688 wrote to memory of 1264 1688 myzip.exe wmic.exe PID 1688 wrote to memory of 1264 1688 myzip.exe wmic.exe PID 1688 wrote to memory of 1028 1688 myzip.exe vssadmin.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 1612 iexplore.exe 1612 iexplore.exe 1944 IEXPLORE.EXE 1944 IEXPLORE.EXE 1944 IEXPLORE.EXE 1944 IEXPLORE.EXE -
Executes dropped EXE 1 IoCs
Processes:
myzip.exepid process 1688 myzip.exe -
Processes:
myzip.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" myzip.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" myzip.exe -
Enumerates connected drives 3 TTPs
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Processes:
myzip.exeiexplore.exeIEXPLORE.EXEdescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" myzip.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA iexplore.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA IEXPLORE.EXE Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA myzip.exe -
Interacts with shadow copies 2 TTPs 3 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exevssadmin.exevssadmin.exepid process 328 vssadmin.exe 1764 vssadmin.exe 1028 vssadmin.exe -
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 13 checkip.amazonaws.com 38 api.myip.com 39 api.myip.com
Processes
-
C:\Users\Admin\AppData\Local\Temp\fd118cd10923a0d7a58d977fb74295f4.exe"C:\Users\Admin\AppData\Local\Temp\fd118cd10923a0d7a58d977fb74295f4.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1032 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"{path}"2⤵PID:1840
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"{path}"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Loads dropped DLL
- Modifies system certificate store
- Checks for installed software on the system
- Suspicious use of WriteProcessMemory
PID:1856 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://localhost:15104/3⤵
- Suspicious use of FindShellTrayWindow
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
- Suspicious use of SetWindowsHookEx
- Checks whether UAC is enabled
PID:1612 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1612 CREDAT:275457 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Checks whether UAC is enabled
PID:1944 -
C:\Users\Admin\AppData\Local\Temp\myzip.exe"C:\Users\Admin\AppData\Local\Temp\myzip.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Checks BIOS information in registry
- Drops desktop.ini file(s)
- System policy modification
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Suspicious use of WriteProcessMemory
- Executes dropped EXE
- UAC bypass
- Checks whether UAC is enabled
PID:1688 -
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive4⤵
- Suspicious use of AdjustPrivilegeToken
PID:1248 -
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet4⤵
- Interacts with shadow copies
PID:328 -
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive4⤵
- Suspicious use of AdjustPrivilegeToken
PID:1592 -
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet4⤵
- Interacts with shadow copies
PID:1764 -
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive4⤵
- Suspicious use of AdjustPrivilegeToken
PID:1264 -
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet4⤵
- Interacts with shadow copies
PID:1028 -
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C taskkill /F /PID 1856 && choice /C Y /N /D Y /T 3 & Del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
- Suspicious use of WriteProcessMemory
PID:672 -
C:\Windows\SysWOW64\taskkill.exetaskkill /F /PID 18564⤵
- Suspicious use of AdjustPrivilegeToken
- Kills process with taskkill
PID:1032 -
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 34⤵PID:1744
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
- Modifies service
PID:1500