redline | 692dc7ac48dfa381cd7f860236876e3621af2e1dc984b8f14cad498e412e88d8

Analysis

max time kernel
150s
max time network
123s
platform
windows7_x64
resource
win7v200430
submitted
09-07-2020 06:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fd118cd10923a0d7a58d977fb74295f4.exe
Size

977KB
MD5

fd118cd10923a0d7a58d977fb74295f4
SHA1

3e214c12aeb9f54c682dd63fd5e77ac10bc60774
SHA256

692dc7ac48dfa381cd7f860236876e3621af2e1dc984b8f14cad498e412e88d8
SHA512

549f0e6a5194a6e26d7a2c5b12167d2c0e1fba28d873e077a95462eb3f7d70b3d5fc6f85d0e19b7e5dc5c6b22d74b7a81e56921b9123e8059bdabd7b680e16b6

Score

10^/10

evasion spyware trojan infostealer redline ransomware persistence discovery

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 66 IoCs

Processes:

fd118cd10923a0d7a58d977fb74295f4.exeRegSvcs.exetaskkill.exewmic.exevssvc.exewmic.exewmic.exe

description	pid	process
Token: SeDebugPrivilege	1032	fd118cd10923a0d7a58d977fb74295f4.exe
Token: SeDebugPrivilege	1856	RegSvcs.exe
Token: SeDebugPrivilege	1032	taskkill.exe
Token: SeIncreaseQuotaPrivilege	1248	wmic.exe
Token: SeSecurityPrivilege	1248	wmic.exe
Token: SeTakeOwnershipPrivilege	1248	wmic.exe
Token: SeLoadDriverPrivilege	1248	wmic.exe
Token: SeSystemProfilePrivilege	1248	wmic.exe
Token: SeSystemtimePrivilege	1248	wmic.exe
Token: SeProfSingleProcessPrivilege	1248	wmic.exe
Token: SeIncBasePriorityPrivilege	1248	wmic.exe
Token: SeCreatePagefilePrivilege	1248	wmic.exe
Token: SeBackupPrivilege	1248	wmic.exe
Token: SeRestorePrivilege	1248	wmic.exe
Token: SeShutdownPrivilege	1248	wmic.exe
Token: SeDebugPrivilege	1248	wmic.exe
Token: SeSystemEnvironmentPrivilege	1248	wmic.exe
Token: SeRemoteShutdownPrivilege	1248	wmic.exe
Token: SeUndockPrivilege	1248	wmic.exe
Token: SeManageVolumePrivilege	1248	wmic.exe
Token: 33	1248	wmic.exe
Token: 34	1248	wmic.exe
Token: 35	1248	wmic.exe
Token: SeBackupPrivilege	1500	vssvc.exe
Token: SeRestorePrivilege	1500	vssvc.exe
Token: SeAuditPrivilege	1500	vssvc.exe
Token: SeIncreaseQuotaPrivilege	1592	wmic.exe
Token: SeSecurityPrivilege	1592	wmic.exe
Token: SeTakeOwnershipPrivilege	1592	wmic.exe
Token: SeLoadDriverPrivilege	1592	wmic.exe
Token: SeSystemProfilePrivilege	1592	wmic.exe
Token: SeSystemtimePrivilege	1592	wmic.exe
Token: SeProfSingleProcessPrivilege	1592	wmic.exe
Token: SeIncBasePriorityPrivilege	1592	wmic.exe
Token: SeCreatePagefilePrivilege	1592	wmic.exe
Token: SeBackupPrivilege	1592	wmic.exe
Token: SeRestorePrivilege	1592	wmic.exe
Token: SeShutdownPrivilege	1592	wmic.exe
Token: SeDebugPrivilege	1592	wmic.exe
Token: SeSystemEnvironmentPrivilege	1592	wmic.exe
Token: SeRemoteShutdownPrivilege	1592	wmic.exe
Token: SeUndockPrivilege	1592	wmic.exe
Token: SeManageVolumePrivilege	1592	wmic.exe
Token: 33	1592	wmic.exe
Token: 34	1592	wmic.exe
Token: 35	1592	wmic.exe
Token: SeIncreaseQuotaPrivilege	1264	wmic.exe
Token: SeSecurityPrivilege	1264	wmic.exe
Token: SeTakeOwnershipPrivilege	1264	wmic.exe
Token: SeLoadDriverPrivilege	1264	wmic.exe
Token: SeSystemProfilePrivilege	1264	wmic.exe
Token: SeSystemtimePrivilege	1264	wmic.exe
Token: SeProfSingleProcessPrivilege	1264	wmic.exe
Token: SeIncBasePriorityPrivilege	1264	wmic.exe
Token: SeCreatePagefilePrivilege	1264	wmic.exe
Token: SeBackupPrivilege	1264	wmic.exe
Token: SeRestorePrivilege	1264	wmic.exe
Token: SeShutdownPrivilege	1264	wmic.exe
Token: SeDebugPrivilege	1264	wmic.exe
Token: SeSystemEnvironmentPrivilege	1264	wmic.exe
Token: SeRemoteShutdownPrivilege	1264	wmic.exe
Token: SeUndockPrivilege	1264	wmic.exe
Token: SeManageVolumePrivilege	1264	wmic.exe
Token: 33	1264	wmic.exe

Suspicious behavior: EnumeratesProcesses 725 IoCs

Processes:

fd118cd10923a0d7a58d977fb74295f4.exeRegSvcs.exemyzip.exe

pid	process
1032	fd118cd10923a0d7a58d977fb74295f4.exe
1856	RegSvcs.exe
1688	myzip.exe
1688	myzip.exe
1688	myzip.exe
1688	myzip.exe
1688	myzip.exe
1688	myzip.exe
1688	myzip.exe
1688	myzip.exe
1688	myzip.exe
1688	myzip.exe
1688	myzip.exe
1688	myzip.exe
1688	myzip.exe
1688	myzip.exe
1688	myzip.exe
1688	myzip.exe
1688	myzip.exe
1688	myzip.exe
1688	myzip.exe
1688	myzip.exe
1688	myzip.exe
1688	myzip.exe
1688	myzip.exe
1688	myzip.exe
1688	myzip.exe
1688	myzip.exe
1688	myzip.exe
1688	myzip.exe
1688	myzip.exe
1688	myzip.exe
1688	myzip.exe
1688	myzip.exe
1688	myzip.exe
1688	myzip.exe
1688	myzip.exe
1688	myzip.exe
1688	myzip.exe
1688	myzip.exe
1688	myzip.exe
1688	myzip.exe
1688	myzip.exe
1688	myzip.exe
1688	myzip.exe
1688	myzip.exe
1688	myzip.exe
1688	myzip.exe
1688	myzip.exe
1688	myzip.exe
1688	myzip.exe
1688	myzip.exe
1688	myzip.exe
1688	myzip.exe
1688	myzip.exe
1688	myzip.exe
1688	myzip.exe
1688	myzip.exe
1688	myzip.exe
1688	myzip.exe
1688	myzip.exe
1688	myzip.exe
1688	myzip.exe
1688	myzip.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

fd118cd10923a0d7a58d977fb74295f4.exe

description pid process target process

PID 1032 set thread context of 1856 1032 fd118cd10923a0d7a58d977fb74295f4.exe RegSvcs.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

1612 iexplore.exe
Loads dropped DLL 2 IoCs

Processes:

RegSvcs.exe

pid process

1856 RegSvcs.exe
1856 RegSvcs.exe

description	pid	process	target process
PID 1032 set thread context of 1856	1032	fd118cd10923a0d7a58d977fb74295f4.exe	RegSvcs.exe

pid	process
1612	iexplore.exe

pid	process
1856	RegSvcs.exe
1856	RegSvcs.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

myzip.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	myzip.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	myzip.exe

Kills process with taskkill 1 IoCs
evasion

Processes:

taskkill.exe

pid process

1032 taskkill.exe
Drops desktop.ini file(s) 1 IoCs

Processes:

myzip.exe

description ioc process

File opened for modification \??\Z:\$RECYCLE.BIN\S-1-5-21-910373003-3952921535-3480519689-1000\desktop.ini myzip.exe

pid	process
1032	taskkill.exe

description	ioc	process
File opened for modification	\??\Z:\$RECYCLE.BIN\S-1-5-21-910373003-3952921535-3480519689-1000\desktop.ini	myzip.exe

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

T1112

Processes:

myzip.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1"	myzip.exe

Modifies system certificate store 2 TTPs 6 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

Processes:

RegSvcs.exe

description	ioc	process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	RegSvcs.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	RegSvcs.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d00f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	RegSvcs.exe
Key created	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\SystemCertificates\CA\Certificates\8D4C4A23BA9EE84EA7348FA98CC6E65FBB69DE7B	RegSvcs.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\SystemCertificates\CA\Certificates\8D4C4A23BA9EE84EA7348FA98CC6E65FBB69DE7B\Blob = 0300000001000000140000008d4c4a23ba9ee84ea7348fa98cc6e65fbb69de7b19000000010000001000000082218ffb91733e64136be5719f57c3a1040000000100000010000000ab9b109ce8934f11e7cd22ed550680da0f0000000100000030000000a768343c4aeaced5c72f3571938864983a67ed49031c1da2495863caf65fe507011f7f0e70b6cb40e5631c07721be034140000000100000014000000bbaf7e023dfaa6f13c848eadee3898ecd93232d41800000001000000100000002aa1c05e2ae606f198c2c5e937c97aa22000000001000000820500003082057e30820466a003020102021067def43ef17bdae24ff5940606d2c084300d06092a864886f70d01010c0500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a308185310b3009060355040613024742311b30190603550408131247726561746572204d616e636865737465723110300e0603550407130753616c666f7264311a3018060355040a1311434f4d4f444f204341204c696d69746564312b302906035504031322434f4d4f444f205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010091e85492d20a56b1ac0d24ddc5cf446774992b37a37d23700071bc53dfc4fa2a128f4b7f1056bd9f7072b7617fc94b0f17a73de3b00461eeff1197c7f4863e0afa3e5cf993e6347ad9146be79cb385a0827a76af7190d7ecfd0dfa9c6cfadfb082f4147ef9bec4a62f4f7f997fb5fc674372bd0c00d689eb6b2cd3ed8f981c14ab7ee5e36efcd8a8e49224da436b62b855fdeac1bc6cb68bf30e8d9ae49b6c6999f878483045d5ade10d3c4560fc32965127bc67c3ca2eb66bea46c7c720a0b11f65de4808baa44ea9f283463784ebe8cc814843674e722a9b5cbd4c1b288a5c227bb4ab98d9eee05183c309464e6d3e99fa9517da7c3357413c8d51ed0bb65caf2c631adf57c83fbce95dc49baf4599e2a35a24b4baa9563dcf6faaff4958bef0a8fff4b8ade937fbbab8f40b3af9e843421e89d884cb13f1d9bbe18960b88c2856ac141d9c0ae771ebcf0edd3da996a148bd3cf7afb50d224cc01181ec563bf6d3a2e25bb7b204225295809369e88e4c65f191032d707402ea8b671529695202bbd7df506a5546bfa0a328617f70d0c3a2aa2c21aa47ce289c064576bf821827b4d5aeb4cb50e66bf44c867130e9a6df1686e0d8ff40ddfbd042887fa3333a2e5c1e41118163ce18716b2beca68ab7315c3a6a47e0c37959d6201aaff26a98aa72bc574ad24b9dbb10fcb04c41e5ed1d3d5e289d9cccbfb351daa747e584530203010001a381f23081ef301f0603551d23041830168014a0110a233e96f107ece2af29ef82a57fd030a4b4301d0603551d0e04160414bbaf7e023dfaa6f13c848eadee3898ecd93232d4300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff30110603551d20040a300830060604551d200030430603551d1f043c303a3038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c303406082b0601050507010104283026302406082b060105050730018618687474703a2f2f6f6373702e636f6d6f646f63612e636f6d300d06092a864886f70d01010c050003820101007ff25635b06d954a4e74af3ae26f018b87d33297edf840d2775311d7c7162ec69de64856be80a9f8bc78d2c86317ae8ced1631fa1f18c90ec7ee48799fc7c9b9bccc8815e36861d19f1d4b6181d7560463c2086926f0f0e52fdfc00a2ba905f4025a6a89d7b4844295e3ebf776205e35d9c0cd2508134c71388e87b0338491991e91f1ac9e3fa71d60812c364154a0e246060bac1bc799368c5ea10ba49ed9424624c5c55b81aeada0a0dc9f36b88dc21d15fa88ad8110391f44f02b9fdd10540c0734b136d114fd07023dff7255ab27d62c814171298d41f450571a7e6560afcbc5287698aeb3a853768be621526bea21d0840e494e8853da922ee71d0866d7	RegSvcs.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	RegSvcs.exe

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Set value (data)	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007cf8d5bd09b0364592b95b96ab312388000000000200000000001066000000010000200000000deabbf1b24afe41518fb517e4425d97e44e7074c679c2b9ddbae2ec8c135507000000000e8000000002000020000000e16f6ba8462cad1633b6201c54b3e431730fa286a2035bd14bf79efb980ba3ce2000000095ceca739f92c5c158bcdd6e658dd81ea961826c1d8e53aa00b0c4310eb308db40000000639bd40b8c54b7f68ecc5cc692eb0ab62beeb2c80c4fb4858047786b63b240d8d5b6def224c22af4b08bf0cd61755b0493390f976310d91ecc99fb3a581d8557	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "301049183"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0163f19cd55d601	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007cf8d5bd09b0364592b95b96ab3123880000000002000000000010660000000100002000000056e2806eae96e966a7691728f66cf220137f697f0549c0c781fa53af66670319000000000e80000000020000200000006890195454b1edeb6a667ed51232b13ac77295bf61805e8d4c2560db6e905a3f900000005e5d1cedbd9507ea49b29fa84c31cb6384d6547e93fc4b1a0f383f3b08ac87b497bc130afc5294f99ae1cdb5408935432eaa21f91f4a1e50962ce713d6b909b9ac4fe8f70e267ad5268a79050a84f9de3bf4ecb05343a5108eccaa84e3ecef9cefca2823dde7e70e00179f7863302d285fe6400465c1df80c88445737a3f98207e76cf2a9107a5aaf16d9fd3c8e7032540000000fe4db53873fe4eed875c7a2ebc830c5f6a08cd6d3a3ec0accf6e0789db8bf1bb5fcd23d6fded5c2a2a09a8b2d190c4d41212e9a6ec1e633bc166df977ed5b5de	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{422AA4D1-C1C0-11EA-B2C5-FED453BC27D5} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

Modifies service 2 TTPs 4 IoCs

persistence

Modify Registry

T1112

Modify Existing Service

T1031

Processes:

vssvc.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer	vssvc.exe

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

Query Registry
T1012

System Information Discovery
T1082

Processes:

myzip.exe

description ioc process

Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ myzip.exe
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	myzip.exe

Checks for installed software on the system 1 TTPs 30 IoCs

discovery

Query Registry

T1012

Processes:

RegSvcs.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\WIC\DisplayName	RegSvcs.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{00203668-8170-44A0-BE44-B632FA4D780F}\DisplayName	RegSvcs.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2549743\DisplayName	RegSvcs.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall	RegSvcs.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook\DisplayName	RegSvcs.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome\DisplayName	RegSvcs.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\DisplayName	RegSvcs.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\MobileOptionPack\DisplayName	RegSvcs.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\SchedulingAgent\DisplayName	RegSvcs.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2467173\DisplayName	RegSvcs.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB982573\DisplayName	RegSvcs.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\DisplayName	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall	RegSvcs.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Adobe AIR\DisplayName	RegSvcs.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE5BAKEX\DisplayName	RegSvcs.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager\DisplayName	RegSvcs.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data\DisplayName	RegSvcs.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2544655\DisplayName	RegSvcs.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx\DisplayName	RegSvcs.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2151757\DisplayName	RegSvcs.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{92FB6C44-E685-45AD-9B20-CADF4CABA132}.KB4087364\DisplayName	RegSvcs.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2565063\DisplayName	RegSvcs.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2524860\DisplayName	RegSvcs.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{BB8B979E-E336-47E7-96BC-1031C1B94561}\DisplayName	RegSvcs.exe
Key enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall	RegSvcs.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE40\DisplayName	RegSvcs.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IEData\DisplayName	RegSvcs.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore\DisplayName	RegSvcs.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{AC76BA86-7AD7-1033-7B44-A90000000001}\DisplayName	RegSvcs.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{f4220b74-9edd-4ded-bc8b-0342c1e164d8}\DisplayName	RegSvcs.exe

Suspicious use of WriteProcessMemory 67 IoCs

Processes:

fd118cd10923a0d7a58d977fb74295f4.exeRegSvcs.exeiexplore.execmd.exemyzip.exe

description	pid	process	target process
PID 1032 wrote to memory of 1840	1032	fd118cd10923a0d7a58d977fb74295f4.exe	RegSvcs.exe
PID 1032 wrote to memory of 1840	1032	fd118cd10923a0d7a58d977fb74295f4.exe	RegSvcs.exe
PID 1032 wrote to memory of 1840	1032	fd118cd10923a0d7a58d977fb74295f4.exe	RegSvcs.exe
PID 1032 wrote to memory of 1840	1032	fd118cd10923a0d7a58d977fb74295f4.exe	RegSvcs.exe
PID 1032 wrote to memory of 1840	1032	fd118cd10923a0d7a58d977fb74295f4.exe	RegSvcs.exe
PID 1032 wrote to memory of 1840	1032	fd118cd10923a0d7a58d977fb74295f4.exe	RegSvcs.exe
PID 1032 wrote to memory of 1840	1032	fd118cd10923a0d7a58d977fb74295f4.exe	RegSvcs.exe
PID 1032 wrote to memory of 1856	1032	fd118cd10923a0d7a58d977fb74295f4.exe	RegSvcs.exe
PID 1032 wrote to memory of 1856	1032	fd118cd10923a0d7a58d977fb74295f4.exe	RegSvcs.exe
PID 1032 wrote to memory of 1856	1032	fd118cd10923a0d7a58d977fb74295f4.exe	RegSvcs.exe
PID 1032 wrote to memory of 1856	1032	fd118cd10923a0d7a58d977fb74295f4.exe	RegSvcs.exe
PID 1032 wrote to memory of 1856	1032	fd118cd10923a0d7a58d977fb74295f4.exe	RegSvcs.exe
PID 1032 wrote to memory of 1856	1032	fd118cd10923a0d7a58d977fb74295f4.exe	RegSvcs.exe
PID 1032 wrote to memory of 1856	1032	fd118cd10923a0d7a58d977fb74295f4.exe	RegSvcs.exe
PID 1032 wrote to memory of 1856	1032	fd118cd10923a0d7a58d977fb74295f4.exe	RegSvcs.exe
PID 1032 wrote to memory of 1856	1032	fd118cd10923a0d7a58d977fb74295f4.exe	RegSvcs.exe
PID 1032 wrote to memory of 1856	1032	fd118cd10923a0d7a58d977fb74295f4.exe	RegSvcs.exe
PID 1032 wrote to memory of 1856	1032	fd118cd10923a0d7a58d977fb74295f4.exe	RegSvcs.exe
PID 1032 wrote to memory of 1856	1032	fd118cd10923a0d7a58d977fb74295f4.exe	RegSvcs.exe
PID 1856 wrote to memory of 1612	1856	RegSvcs.exe	iexplore.exe
PID 1856 wrote to memory of 1612	1856	RegSvcs.exe	iexplore.exe
PID 1856 wrote to memory of 1612	1856	RegSvcs.exe	iexplore.exe
PID 1856 wrote to memory of 1612	1856	RegSvcs.exe	iexplore.exe
PID 1612 wrote to memory of 1944	1612	iexplore.exe	IEXPLORE.EXE
PID 1612 wrote to memory of 1944	1612	iexplore.exe	IEXPLORE.EXE
PID 1612 wrote to memory of 1944	1612	iexplore.exe	IEXPLORE.EXE
PID 1612 wrote to memory of 1944	1612	iexplore.exe	IEXPLORE.EXE
PID 1856 wrote to memory of 1688	1856	RegSvcs.exe	myzip.exe
PID 1856 wrote to memory of 1688	1856	RegSvcs.exe	myzip.exe
PID 1856 wrote to memory of 1688	1856	RegSvcs.exe	myzip.exe
PID 1856 wrote to memory of 1688	1856	RegSvcs.exe	myzip.exe
PID 1856 wrote to memory of 672	1856	RegSvcs.exe	cmd.exe
PID 1856 wrote to memory of 672	1856	RegSvcs.exe	cmd.exe
PID 1856 wrote to memory of 672	1856	RegSvcs.exe	cmd.exe
PID 1856 wrote to memory of 672	1856	RegSvcs.exe	cmd.exe
PID 672 wrote to memory of 1032	672	cmd.exe	taskkill.exe
PID 672 wrote to memory of 1032	672	cmd.exe	taskkill.exe
PID 672 wrote to memory of 1032	672	cmd.exe	taskkill.exe
PID 672 wrote to memory of 1032	672	cmd.exe	taskkill.exe
PID 672 wrote to memory of 1744	672	cmd.exe	choice.exe
PID 672 wrote to memory of 1744	672	cmd.exe	choice.exe
PID 672 wrote to memory of 1744	672	cmd.exe	choice.exe
PID 672 wrote to memory of 1744	672	cmd.exe	choice.exe
PID 1688 wrote to memory of 1248	1688	myzip.exe	wmic.exe
PID 1688 wrote to memory of 1248	1688	myzip.exe	wmic.exe
PID 1688 wrote to memory of 1248	1688	myzip.exe	wmic.exe
PID 1688 wrote to memory of 1248	1688	myzip.exe	wmic.exe
PID 1688 wrote to memory of 328	1688	myzip.exe	vssadmin.exe
PID 1688 wrote to memory of 328	1688	myzip.exe	vssadmin.exe
PID 1688 wrote to memory of 328	1688	myzip.exe	vssadmin.exe
PID 1688 wrote to memory of 328	1688	myzip.exe	vssadmin.exe
PID 1688 wrote to memory of 1592	1688	myzip.exe	wmic.exe
PID 1688 wrote to memory of 1592	1688	myzip.exe	wmic.exe
PID 1688 wrote to memory of 1592	1688	myzip.exe	wmic.exe
PID 1688 wrote to memory of 1592	1688	myzip.exe	wmic.exe
PID 1688 wrote to memory of 1764	1688	myzip.exe	vssadmin.exe
PID 1688 wrote to memory of 1764	1688	myzip.exe	vssadmin.exe
PID 1688 wrote to memory of 1764	1688	myzip.exe	vssadmin.exe
PID 1688 wrote to memory of 1764	1688	myzip.exe	vssadmin.exe
PID 1688 wrote to memory of 1264	1688	myzip.exe	wmic.exe
PID 1688 wrote to memory of 1264	1688	myzip.exe	wmic.exe
PID 1688 wrote to memory of 1264	1688	myzip.exe	wmic.exe
PID 1688 wrote to memory of 1264	1688	myzip.exe	wmic.exe
PID 1688 wrote to memory of 1028	1688	myzip.exe	vssadmin.exe

Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

1612 iexplore.exe
1612 iexplore.exe
1944 IEXPLORE.EXE
1944 IEXPLORE.EXE
1944 IEXPLORE.EXE
1944 IEXPLORE.EXE
Executes dropped EXE 1 IoCs

Processes:

myzip.exe

pid process

1688 myzip.exe

pid	process
1612	iexplore.exe
1612	iexplore.exe
1944	IEXPLORE.EXE
1944	IEXPLORE.EXE
1944	IEXPLORE.EXE
1944	IEXPLORE.EXE

pid	process
1688	myzip.exe

UAC bypass 3 TTPs 2 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

myzip.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	myzip.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	myzip.exe

Enumerates connected drives 3 TTPs

Query Registry
T1012

Peripheral Device Discovery
T1120

System Information Discovery
T1082
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

myzip.exeiexplore.exeIEXPLORE.EXE

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	myzip.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	iexplore.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	IEXPLORE.EXE
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	myzip.exe

Interacts with shadow copies 2 TTPs 3 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Processes:

vssadmin.exevssadmin.exevssadmin.exe

pid process

328 vssadmin.exe
1764 vssadmin.exe
1028 vssadmin.exe
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

13 checkip.amazonaws.com
38 api.myip.com
39 api.myip.com

pid	process
328	vssadmin.exe
1764	vssadmin.exe
1028	vssadmin.exe

flow	ioc
13	checkip.amazonaws.com
38	api.myip.com
39	api.myip.com

C:\Users\Admin\AppData\Local\Temp\fd118cd10923a0d7a58d977fb74295f4.exe
"C:\Users\Admin\AppData\Local\Temp\fd118cd10923a0d7a58d977fb74295f4.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1032

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"{path}"
2⤵
PID:1840

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"{path}"
2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Loads dropped DLL
- Modifies system certificate store
- Checks for installed software on the system
- Suspicious use of WriteProcessMemory
PID:1856

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://localhost:15104/
3⤵
- Suspicious use of FindShellTrayWindow
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
- Suspicious use of SetWindowsHookEx
- Checks whether UAC is enabled
PID:1612

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1612 CREDAT:275457 /prefetch:2
4⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Checks whether UAC is enabled
PID:1944

C:\Users\Admin\AppData\Local\Temp\myzip.exe
"C:\Users\Admin\AppData\Local\Temp\myzip.exe"
3⤵
- Suspicious behavior: EnumeratesProcesses
- Checks BIOS information in registry
- Drops desktop.ini file(s)
- System policy modification
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Suspicious use of WriteProcessMemory
- Executes dropped EXE
- UAC bypass
- Checks whether UAC is enabled
PID:1688

C:\Windows\SysWOW64\Wbem\wmic.exe
wmic.exe SHADOWCOPY /nointeractive
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:1248

C:\Windows\SysWOW64\vssadmin.exe
vssadmin.exe Delete Shadows /All /Quiet
4⤵
- Interacts with shadow copies
PID:328

C:\Windows\SysWOW64\Wbem\wmic.exe
wmic.exe SHADOWCOPY /nointeractive
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:1592

C:\Windows\SysWOW64\vssadmin.exe
vssadmin.exe Delete Shadows /All /Quiet
4⤵
- Interacts with shadow copies
PID:1764

C:\Windows\SysWOW64\Wbem\wmic.exe
wmic.exe SHADOWCOPY /nointeractive
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:1264

C:\Windows\SysWOW64\vssadmin.exe
vssadmin.exe Delete Shadows /All /Quiet
4⤵
- Interacts with shadow copies
PID:1028

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /C taskkill /F /PID 1856 && choice /C Y /N /D Y /T 3 & Del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
3⤵
- Suspicious use of WriteProcessMemory
PID:672

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /PID 1856
4⤵
- Suspicious use of AdjustPrivilegeToken
- Kills process with taskkill
PID:1032

C:\Windows\SysWOW64\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:1744

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
- Modifies service
PID:1500

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Privilege Escalation

Bypass User Account Control

T1088

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

T1089

File Deletion

T1107

Install Root Certificate

T1130

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Download Submit
C:\Users\Admin\AppData\Local\Temp\myzip.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\myzip.exe

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\O0ZKTYI9.txt

Download Submit
\Users\Admin\AppData\Local\Temp\myzip.exe

Download Submit
\Users\Admin\AppData\Local\Temp\myzip.exe

Download Submit
memory/328-23-0x0000000000000000-mapping.dmp

Download
memory/672-14-0x0000000000000000-mapping.dmp

Download
memory/1028-27-0x0000000000000000-mapping.dmp

Download
memory/1032-15-0x0000000000000000-mapping.dmp

Download
memory/1032-1-0x0000000000000000-0x0000000000000000-disk.dmp

Download
memory/1248-22-0x0000000000000000-mapping.dmp

Download
memory/1264-26-0x0000000000000000-mapping.dmp

Download
memory/1592-24-0x0000000000000000-mapping.dmp

Download
memory/1612-7-0x0000000000000000-mapping.dmp

Download
memory/1688-12-0x0000000000000000-mapping.dmp

Download
memory/1744-16-0x0000000000000000-mapping.dmp

Download
memory/1764-25-0x0000000000000000-mapping.dmp

Download
memory/1856-4-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/1856-3-0x0000000000427D6E-mapping.dmp

Download
memory/1856-5-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/1856-2-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/1944-8-0x0000000000000000-mapping.dmp

Download