Analysis
-
max time kernel
136s -
max time network
133s -
platform
windows7_x64 -
resource
win7 -
submitted
12-07-2020 08:16
Static task
static1
Behavioral task
behavioral1
Sample
de693a0ae0b1cdefbe778a8d8af1cd9d.exe
Resource
win7
Behavioral task
behavioral2
Sample
de693a0ae0b1cdefbe778a8d8af1cd9d.exe
Resource
win10
General
-
Target
de693a0ae0b1cdefbe778a8d8af1cd9d.exe
-
Size
717KB
-
MD5
de693a0ae0b1cdefbe778a8d8af1cd9d
-
SHA1
bc7fd9e2066415a9939d25c0c9ea2ee29176726a
-
SHA256
6dc5dc06eba82eb3dbfc51c48f44a0b6bc519d2432d357cb84d65cf7b9b4e763
-
SHA512
a82b2dc6aa9b48346c8747db22153249f18c76e45ddbd503144cae6853cb5d7c839839521dc83a6046a9b5e04b1ff81ab46aa7f9d1101a11b5eead6d6c4bba4d
Malware Config
Extracted
C:\MSOCache\All Users\{90140000-0011-0000-1000-0000000FF1CE}-C\Read_Me.txt
http://7rzpyw3hflwe2c7h.onion/?FFFFFFFF
http://helpqvrg3cc5mvb3.onion/
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
de693a0ae0b1cdefbe778a8d8af1cd9d.exedescription pid process target process PID 1668 set thread context of 1768 1668 de693a0ae0b1cdefbe778a8d8af1cd9d.exe de693a0ae0b1cdefbe778a8d8af1cd9d.exe -
Modifies service 2 TTPs 4 IoCs
Processes:
explorer.exeexplorer.exedescription ioc process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NapAgent\Shas explorer.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NapAgent\Qecs explorer.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NapAgent\Shas explorer.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NapAgent\Qecs explorer.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
explorer.exepid process 1672 explorer.exe -
Suspicious use of SendNotifyMessage 73 IoCs
Processes:
explorer.exeexplorer.exeexplorer.exepid process 1968 explorer.exe 1968 explorer.exe 1968 explorer.exe 1968 explorer.exe 1968 explorer.exe 1968 explorer.exe 1968 explorer.exe 1968 explorer.exe 1968 explorer.exe 1968 explorer.exe 1968 explorer.exe 1968 explorer.exe 1968 explorer.exe 1968 explorer.exe 1968 explorer.exe 1968 explorer.exe 1968 explorer.exe 1968 explorer.exe 1968 explorer.exe 1968 explorer.exe 1968 explorer.exe 1968 explorer.exe 1968 explorer.exe 1968 explorer.exe 1968 explorer.exe 1968 explorer.exe 1968 explorer.exe 1968 explorer.exe 1368 explorer.exe 1368 explorer.exe 1368 explorer.exe 1368 explorer.exe 1368 explorer.exe 1368 explorer.exe 1368 explorer.exe 1368 explorer.exe 1368 explorer.exe 1368 explorer.exe 1368 explorer.exe 1368 explorer.exe 1368 explorer.exe 1672 explorer.exe 1672 explorer.exe 1672 explorer.exe 1672 explorer.exe 1672 explorer.exe 1672 explorer.exe 1672 explorer.exe 1672 explorer.exe 1672 explorer.exe 1672 explorer.exe 1672 explorer.exe 1672 explorer.exe 1672 explorer.exe 1672 explorer.exe 1672 explorer.exe 1672 explorer.exe 1672 explorer.exe 1672 explorer.exe 1672 explorer.exe 1672 explorer.exe 1672 explorer.exe 1672 explorer.exe 1672 explorer.exe -
Enumerates connected drives 3 TTPs
-
Drops startup file 1 IoCs
Processes:
de693a0ae0b1cdefbe778a8d8af1cd9d.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\Read_Me.txt de693a0ae0b1cdefbe778a8d8af1cd9d.exe -
Modifies Installed Components in the registry 2 TTPs 3 IoCs
Processes:
explorer.exeexplorer.exeexplorer.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe -
Drops desktop.ini file(s) 41 IoCs
Processes:
de693a0ae0b1cdefbe778a8d8af1cd9d.exeexplorer.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\AJM03J3Y\desktop.ini de693a0ae0b1cdefbe778a8d8af1cd9d.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\desktop.ini de693a0ae0b1cdefbe778a8d8af1cd9d.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini de693a0ae0b1cdefbe778a8d8af1cd9d.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini de693a0ae0b1cdefbe778a8d8af1cd9d.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Desktop.ini de693a0ae0b1cdefbe778a8d8af1cd9d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini de693a0ae0b1cdefbe778a8d8af1cd9d.exe File opened for modification C:\Users\Admin\Videos\desktop.ini de693a0ae0b1cdefbe778a8d8af1cd9d.exe File opened for modification C:\Users\Public\Recorded TV\desktop.ini de693a0ae0b1cdefbe778a8d8af1cd9d.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Desktop.ini de693a0ae0b1cdefbe778a8d8af1cd9d.exe File opened for modification C:\Users\Public\desktop.ini de693a0ae0b1cdefbe778a8d8af1cd9d.exe File opened for modification C:\Users\Public\Pictures\Sample Pictures\desktop.ini de693a0ae0b1cdefbe778a8d8af1cd9d.exe File opened for modification C:\Users\Public\Videos\desktop.ini de693a0ae0b1cdefbe778a8d8af1cd9d.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini de693a0ae0b1cdefbe778a8d8af1cd9d.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\TGVUK4BG\desktop.ini de693a0ae0b1cdefbe778a8d8af1cd9d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini de693a0ae0b1cdefbe778a8d8af1cd9d.exe File opened for modification C:\Users\Admin\Links\desktop.ini de693a0ae0b1cdefbe778a8d8af1cd9d.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\RBDIK06K\desktop.ini de693a0ae0b1cdefbe778a8d8af1cd9d.exe File opened for modification C:\Users\Public\Desktop\desktop.ini de693a0ae0b1cdefbe778a8d8af1cd9d.exe File opened for modification C:\Users\Public\Music\desktop.ini de693a0ae0b1cdefbe778a8d8af1cd9d.exe File opened for modification C:\Users\Public\Music\Sample Music\desktop.ini de693a0ae0b1cdefbe778a8d8af1cd9d.exe File opened for modification \??\M:\$RECYCLE.BIN\S-1-5-21-1131729243-447456001-3632642222-1000\desktop.ini explorer.exe File opened for modification C:\Program Files (x86)\desktop.ini de693a0ae0b1cdefbe778a8d8af1cd9d.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini de693a0ae0b1cdefbe778a8d8af1cd9d.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini de693a0ae0b1cdefbe778a8d8af1cd9d.exe File opened for modification C:\Users\Admin\Music\desktop.ini de693a0ae0b1cdefbe778a8d8af1cd9d.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini de693a0ae0b1cdefbe778a8d8af1cd9d.exe File opened for modification C:\Users\Public\Documents\desktop.ini de693a0ae0b1cdefbe778a8d8af1cd9d.exe File opened for modification C:\Users\Public\Libraries\desktop.ini de693a0ae0b1cdefbe778a8d8af1cd9d.exe File opened for modification C:\Program Files\desktop.ini de693a0ae0b1cdefbe778a8d8af1cd9d.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\ZMLBLRQ7\desktop.ini de693a0ae0b1cdefbe778a8d8af1cd9d.exe File opened for modification C:\Users\Admin\Favorites\Links for United States\desktop.ini de693a0ae0b1cdefbe778a8d8af1cd9d.exe File opened for modification C:\Users\Public\Pictures\desktop.ini de693a0ae0b1cdefbe778a8d8af1cd9d.exe File opened for modification C:\Users\Public\Recorded TV\Sample Media\desktop.ini de693a0ae0b1cdefbe778a8d8af1cd9d.exe File opened for modification C:\Users\Public\Videos\Sample Videos\desktop.ini de693a0ae0b1cdefbe778a8d8af1cd9d.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini de693a0ae0b1cdefbe778a8d8af1cd9d.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini de693a0ae0b1cdefbe778a8d8af1cd9d.exe File opened for modification C:\Users\Admin\Documents\desktop.ini de693a0ae0b1cdefbe778a8d8af1cd9d.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini de693a0ae0b1cdefbe778a8d8af1cd9d.exe File opened for modification C:\Users\Admin\Searches\desktop.ini de693a0ae0b1cdefbe778a8d8af1cd9d.exe File opened for modification C:\Users\Public\Downloads\desktop.ini de693a0ae0b1cdefbe778a8d8af1cd9d.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI de693a0ae0b1cdefbe778a8d8af1cd9d.exe -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
de693a0ae0b1cdefbe778a8d8af1cd9d.exedescription pid process target process PID 1668 wrote to memory of 1768 1668 de693a0ae0b1cdefbe778a8d8af1cd9d.exe de693a0ae0b1cdefbe778a8d8af1cd9d.exe PID 1668 wrote to memory of 1768 1668 de693a0ae0b1cdefbe778a8d8af1cd9d.exe de693a0ae0b1cdefbe778a8d8af1cd9d.exe PID 1668 wrote to memory of 1768 1668 de693a0ae0b1cdefbe778a8d8af1cd9d.exe de693a0ae0b1cdefbe778a8d8af1cd9d.exe PID 1668 wrote to memory of 1768 1668 de693a0ae0b1cdefbe778a8d8af1cd9d.exe de693a0ae0b1cdefbe778a8d8af1cd9d.exe PID 1668 wrote to memory of 1768 1668 de693a0ae0b1cdefbe778a8d8af1cd9d.exe de693a0ae0b1cdefbe778a8d8af1cd9d.exe PID 1668 wrote to memory of 1768 1668 de693a0ae0b1cdefbe778a8d8af1cd9d.exe de693a0ae0b1cdefbe778a8d8af1cd9d.exe PID 1668 wrote to memory of 1768 1668 de693a0ae0b1cdefbe778a8d8af1cd9d.exe de693a0ae0b1cdefbe778a8d8af1cd9d.exe PID 1668 wrote to memory of 1768 1668 de693a0ae0b1cdefbe778a8d8af1cd9d.exe de693a0ae0b1cdefbe778a8d8af1cd9d.exe PID 1668 wrote to memory of 1768 1668 de693a0ae0b1cdefbe778a8d8af1cd9d.exe de693a0ae0b1cdefbe778a8d8af1cd9d.exe PID 1668 wrote to memory of 1768 1668 de693a0ae0b1cdefbe778a8d8af1cd9d.exe de693a0ae0b1cdefbe778a8d8af1cd9d.exe -
Suspicious use of FindShellTrayWindow 57 IoCs
Processes:
explorer.exeexplorer.exeexplorer.exepid process 1968 explorer.exe 1968 explorer.exe 1968 explorer.exe 1968 explorer.exe 1968 explorer.exe 1968 explorer.exe 1968 explorer.exe 1968 explorer.exe 1968 explorer.exe 1968 explorer.exe 1968 explorer.exe 1968 explorer.exe 1968 explorer.exe 1968 explorer.exe 1968 explorer.exe 1968 explorer.exe 1968 explorer.exe 1968 explorer.exe 1968 explorer.exe 1968 explorer.exe 1968 explorer.exe 1968 explorer.exe 1968 explorer.exe 1968 explorer.exe 1968 explorer.exe 1368 explorer.exe 1368 explorer.exe 1368 explorer.exe 1368 explorer.exe 1368 explorer.exe 1368 explorer.exe 1368 explorer.exe 1672 explorer.exe 1672 explorer.exe 1672 explorer.exe 1672 explorer.exe 1672 explorer.exe 1672 explorer.exe 1672 explorer.exe 1672 explorer.exe 1672 explorer.exe 1672 explorer.exe 1672 explorer.exe 1672 explorer.exe 1672 explorer.exe 1672 explorer.exe 1672 explorer.exe 1672 explorer.exe 1672 explorer.exe 1672 explorer.exe 1672 explorer.exe 1672 explorer.exe 1672 explorer.exe 1672 explorer.exe 1672 explorer.exe 1672 explorer.exe 1672 explorer.exe -
Modifies registry class 15 IoCs
Processes:
explorer.exeexplorer.exeexplorer.exedescription ioc process Set value (data) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_Classes\Local Settings explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe -
Drops file in Program Files directory 12081 IoCs
Processes:
de693a0ae0b1cdefbe778a8d8af1cd9d.exedescription ioc process File opened for modification C:\Program Files\VideoLAN\VLC\plugins\access\libsdp_plugin.dll de693a0ae0b1cdefbe778a8d8af1cd9d.exe File opened for modification C:\Program Files\7-Zip\Lang\ku-ckb.txt de693a0ae0b1cdefbe778a8d8af1cd9d.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Menominee de693a0ae0b1cdefbe778a8d8af1cd9d.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Damascus de693a0ae0b1cdefbe778a8d8af1cd9d.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD10265_.GIF de693a0ae0b1cdefbe778a8d8af1cd9d.exe File created C:\Program Files\VideoLAN\VLC\locale\ms\LC_MESSAGES\Read_Me.txt de693a0ae0b1cdefbe778a8d8af1cd9d.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\locale\core_ja.jar de693a0ae0b1cdefbe778a8d8af1cd9d.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.dll de693a0ae0b1cdefbe778a8d8af1cd9d.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\images\rssLogo.gif de693a0ae0b1cdefbe778a8d8af1cd9d.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+10 de693a0ae0b1cdefbe778a8d8af1cd9d.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes.nl_ja_4.4.0.v20140623020002.jar de693a0ae0b1cdefbe778a8d8af1cd9d.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0178523.JPG de693a0ae0b1cdefbe778a8d8af1cd9d.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\DGWEBPQT.XML de693a0ae0b1cdefbe778a8d8af1cd9d.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\spacer_highlights.png de693a0ae0b1cdefbe778a8d8af1cd9d.exe File opened for modification C:\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Austin.xml de693a0ae0b1cdefbe778a8d8af1cd9d.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR50F.GIF de693a0ae0b1cdefbe778a8d8af1cd9d.exe File created C:\Program Files\VideoLAN\VLC\lua\meta\Read_Me.txt de693a0ae0b1cdefbe778a8d8af1cd9d.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Havana de693a0ae0b1cdefbe778a8d8af1cd9d.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\ext\locale\Read_Me.txt de693a0ae0b1cdefbe778a8d8af1cd9d.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-core-output2.xml de693a0ae0b1cdefbe778a8d8af1cd9d.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Africa\El_Aaiun de693a0ae0b1cdefbe778a8d8af1cd9d.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\NA02423_.WMF de693a0ae0b1cdefbe778a8d8af1cd9d.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Updater.api de693a0ae0b1cdefbe778a8d8af1cd9d.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\16to9Squareframe_Buttongraphic.png de693a0ae0b1cdefbe778a8d8af1cd9d.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD15135_.GIF de693a0ae0b1cdefbe778a8d8af1cd9d.exe File created C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\en-US\Read_Me.txt de693a0ae0b1cdefbe778a8d8af1cd9d.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107134.WMF de693a0ae0b1cdefbe778a8d8af1cd9d.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0187817.WMF de693a0ae0b1cdefbe778a8d8af1cd9d.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18190_.WMF de693a0ae0b1cdefbe778a8d8af1cd9d.exe File created C:\Program Files\Microsoft Office\Office14\PROOF\1033\Read_Me.txt de693a0ae0b1cdefbe778a8d8af1cd9d.exe File opened for modification C:\Program Files\Microsoft Office\Templates\1033\ApothecaryLetter.dotx de693a0ae0b1cdefbe778a8d8af1cd9d.exe File created C:\Program Files\VideoLAN\VLC\locale\si\LC_MESSAGES\Read_Me.txt de693a0ae0b1cdefbe778a8d8af1cd9d.exe File created C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\OneNote.en-us\Read_Me.txt de693a0ae0b1cdefbe778a8d8af1cd9d.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Circle_SelectionSubpictureB.png de693a0ae0b1cdefbe778a8d8af1cd9d.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.flightrecorder.controlpanel.ui.zh_CN_5.5.0.165303.jar de693a0ae0b1cdefbe778a8d8af1cd9d.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14582_.GIF de693a0ae0b1cdefbe778a8d8af1cd9d.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\MSTINTL.DLL de693a0ae0b1cdefbe778a8d8af1cd9d.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\CLIP.WMF de693a0ae0b1cdefbe778a8d8af1cd9d.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\Read_Me.txt de693a0ae0b1cdefbe778a8d8af1cd9d.exe File created C:\Program Files (x86)\Common Files\SpeechEngines\Read_Me.txt de693a0ae0b1cdefbe778a8d8af1cd9d.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\THEMES14\JOURNAL\JOURNAL.INF de693a0ae0b1cdefbe778a8d8af1cd9d.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\1047x576black.png de693a0ae0b1cdefbe778a8d8af1cd9d.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\Macquarie de693a0ae0b1cdefbe778a8d8af1cd9d.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-sampler_zh_CN.jar de693a0ae0b1cdefbe778a8d8af1cd9d.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\MST de693a0ae0b1cdefbe778a8d8af1cd9d.exe File opened for modification C:\Program Files\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\PLANNERS.ONE de693a0ae0b1cdefbe778a8d8af1cd9d.exe File created C:\Program Files\VideoLAN\VLC\locale\kk\LC_MESSAGES\Read_Me.txt de693a0ae0b1cdefbe778a8d8af1cd9d.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ckb\LC_MESSAGES\vlc.mo de693a0ae0b1cdefbe778a8d8af1cd9d.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainToScenesBackground_PAL.wmv de693a0ae0b1cdefbe778a8d8af1cd9d.exe File opened for modification C:\Program Files\Java\jre7\lib\security\blacklist de693a0ae0b1cdefbe778a8d8af1cd9d.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099180.WMF de693a0ae0b1cdefbe778a8d8af1cd9d.exe File opened for modification C:\Program Files\Microsoft Office\Office14\EXSEC32.DLL de693a0ae0b1cdefbe778a8d8af1cd9d.exe File opened for modification C:\Program Files\Microsoft Office\Office14\OutlookAutoDiscover\PACBELL.NET.XML de693a0ae0b1cdefbe778a8d8af1cd9d.exe File created C:\Program Files\VideoLAN\VLC\skins\Read_Me.txt de693a0ae0b1cdefbe778a8d8af1cd9d.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\DataViewIconImagesMask.bmp de693a0ae0b1cdefbe778a8d8af1cd9d.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\settings_box_right.png de693a0ae0b1cdefbe778a8d8af1cd9d.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\22.png de693a0ae0b1cdefbe778a8d8af1cd9d.exe File opened for modification C:\Program Files\Java\jre7\lib\cmm\PYCC.pf de693a0ae0b1cdefbe778a8d8af1cd9d.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Yakutat de693a0ae0b1cdefbe778a8d8af1cd9d.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0185790.WMF de693a0ae0b1cdefbe778a8d8af1cd9d.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\TN00218_.WMF de693a0ae0b1cdefbe778a8d8af1cd9d.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Americana\TAB_OFF.GIF de693a0ae0b1cdefbe778a8d8af1cd9d.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_moon-waxing-crescent.png de693a0ae0b1cdefbe778a8d8af1cd9d.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_sv.dll de693a0ae0b1cdefbe778a8d8af1cd9d.exe -
Suspicious behavior: EnumeratesProcesses 4524 IoCs
Processes:
de693a0ae0b1cdefbe778a8d8af1cd9d.exepid process 1768 de693a0ae0b1cdefbe778a8d8af1cd9d.exe 1768 de693a0ae0b1cdefbe778a8d8af1cd9d.exe 1768 de693a0ae0b1cdefbe778a8d8af1cd9d.exe 1768 de693a0ae0b1cdefbe778a8d8af1cd9d.exe 1768 de693a0ae0b1cdefbe778a8d8af1cd9d.exe 1768 de693a0ae0b1cdefbe778a8d8af1cd9d.exe 1768 de693a0ae0b1cdefbe778a8d8af1cd9d.exe 1768 de693a0ae0b1cdefbe778a8d8af1cd9d.exe 1768 de693a0ae0b1cdefbe778a8d8af1cd9d.exe 1768 de693a0ae0b1cdefbe778a8d8af1cd9d.exe 1768 de693a0ae0b1cdefbe778a8d8af1cd9d.exe 1768 de693a0ae0b1cdefbe778a8d8af1cd9d.exe 1768 de693a0ae0b1cdefbe778a8d8af1cd9d.exe 1768 de693a0ae0b1cdefbe778a8d8af1cd9d.exe 1768 de693a0ae0b1cdefbe778a8d8af1cd9d.exe 1768 de693a0ae0b1cdefbe778a8d8af1cd9d.exe 1768 de693a0ae0b1cdefbe778a8d8af1cd9d.exe 1768 de693a0ae0b1cdefbe778a8d8af1cd9d.exe 1768 de693a0ae0b1cdefbe778a8d8af1cd9d.exe 1768 de693a0ae0b1cdefbe778a8d8af1cd9d.exe 1768 de693a0ae0b1cdefbe778a8d8af1cd9d.exe 1768 de693a0ae0b1cdefbe778a8d8af1cd9d.exe 1768 de693a0ae0b1cdefbe778a8d8af1cd9d.exe 1768 de693a0ae0b1cdefbe778a8d8af1cd9d.exe 1768 de693a0ae0b1cdefbe778a8d8af1cd9d.exe 1768 de693a0ae0b1cdefbe778a8d8af1cd9d.exe 1768 de693a0ae0b1cdefbe778a8d8af1cd9d.exe 1768 de693a0ae0b1cdefbe778a8d8af1cd9d.exe 1768 de693a0ae0b1cdefbe778a8d8af1cd9d.exe 1768 de693a0ae0b1cdefbe778a8d8af1cd9d.exe 1768 de693a0ae0b1cdefbe778a8d8af1cd9d.exe 1768 de693a0ae0b1cdefbe778a8d8af1cd9d.exe 1768 de693a0ae0b1cdefbe778a8d8af1cd9d.exe 1768 de693a0ae0b1cdefbe778a8d8af1cd9d.exe 1768 de693a0ae0b1cdefbe778a8d8af1cd9d.exe 1768 de693a0ae0b1cdefbe778a8d8af1cd9d.exe 1768 de693a0ae0b1cdefbe778a8d8af1cd9d.exe 1768 de693a0ae0b1cdefbe778a8d8af1cd9d.exe 1768 de693a0ae0b1cdefbe778a8d8af1cd9d.exe 1768 de693a0ae0b1cdefbe778a8d8af1cd9d.exe 1768 de693a0ae0b1cdefbe778a8d8af1cd9d.exe 1768 de693a0ae0b1cdefbe778a8d8af1cd9d.exe 1768 de693a0ae0b1cdefbe778a8d8af1cd9d.exe 1768 de693a0ae0b1cdefbe778a8d8af1cd9d.exe 1768 de693a0ae0b1cdefbe778a8d8af1cd9d.exe 1768 de693a0ae0b1cdefbe778a8d8af1cd9d.exe 1768 de693a0ae0b1cdefbe778a8d8af1cd9d.exe 1768 de693a0ae0b1cdefbe778a8d8af1cd9d.exe 1768 de693a0ae0b1cdefbe778a8d8af1cd9d.exe 1768 de693a0ae0b1cdefbe778a8d8af1cd9d.exe 1768 de693a0ae0b1cdefbe778a8d8af1cd9d.exe 1768 de693a0ae0b1cdefbe778a8d8af1cd9d.exe 1768 de693a0ae0b1cdefbe778a8d8af1cd9d.exe 1768 de693a0ae0b1cdefbe778a8d8af1cd9d.exe 1768 de693a0ae0b1cdefbe778a8d8af1cd9d.exe 1768 de693a0ae0b1cdefbe778a8d8af1cd9d.exe 1768 de693a0ae0b1cdefbe778a8d8af1cd9d.exe 1768 de693a0ae0b1cdefbe778a8d8af1cd9d.exe 1768 de693a0ae0b1cdefbe778a8d8af1cd9d.exe 1768 de693a0ae0b1cdefbe778a8d8af1cd9d.exe 1768 de693a0ae0b1cdefbe778a8d8af1cd9d.exe 1768 de693a0ae0b1cdefbe778a8d8af1cd9d.exe 1768 de693a0ae0b1cdefbe778a8d8af1cd9d.exe 1768 de693a0ae0b1cdefbe778a8d8af1cd9d.exe -
Suspicious use of AdjustPrivilegeToken 27 IoCs
Processes:
explorer.exeexplorer.exeexplorer.exedescription pid process Token: SeShutdownPrivilege 1968 explorer.exe Token: SeShutdownPrivilege 1968 explorer.exe Token: SeShutdownPrivilege 1968 explorer.exe Token: SeShutdownPrivilege 1968 explorer.exe Token: SeShutdownPrivilege 1968 explorer.exe Token: SeShutdownPrivilege 1968 explorer.exe Token: SeShutdownPrivilege 1968 explorer.exe Token: SeShutdownPrivilege 1968 explorer.exe Token: SeShutdownPrivilege 1968 explorer.exe Token: SeShutdownPrivilege 1968 explorer.exe Token: SeShutdownPrivilege 1968 explorer.exe Token: SeShutdownPrivilege 1368 explorer.exe Token: SeShutdownPrivilege 1368 explorer.exe Token: SeShutdownPrivilege 1368 explorer.exe Token: SeShutdownPrivilege 1368 explorer.exe Token: SeShutdownPrivilege 1368 explorer.exe Token: SeShutdownPrivilege 1368 explorer.exe Token: SeShutdownPrivilege 1368 explorer.exe Token: SeShutdownPrivilege 1672 explorer.exe Token: SeShutdownPrivilege 1672 explorer.exe Token: SeShutdownPrivilege 1672 explorer.exe Token: SeShutdownPrivilege 1672 explorer.exe Token: SeShutdownPrivilege 1672 explorer.exe Token: SeShutdownPrivilege 1672 explorer.exe Token: SeShutdownPrivilege 1672 explorer.exe Token: SeShutdownPrivilege 1672 explorer.exe Token: SeShutdownPrivilege 1672 explorer.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\de693a0ae0b1cdefbe778a8d8af1cd9d.exe"C:\Users\Admin\AppData\Local\Temp\de693a0ae0b1cdefbe778a8d8af1cd9d.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\de693a0ae0b1cdefbe778a8d8af1cd9d.exe"{path}"2⤵
- Drops startup file
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies service
- Suspicious use of SendNotifyMessage
- Modifies Installed Components in the registry
- Drops desktop.ini file(s)
- Suspicious use of FindShellTrayWindow
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Suspicious use of SendNotifyMessage
- Modifies Installed Components in the registry
- Suspicious use of FindShellTrayWindow
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies service
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SendNotifyMessage
- Modifies Installed Components in the registry
- Suspicious use of FindShellTrayWindow
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\WPDNSE\Read_Me.txt
-
C:\Users\Admin\Desktop\BackupRestore.mpg.readme
-
C:\Users\Admin\Desktop\BlockDisconnect.odp.readme
-
C:\Users\Admin\Desktop\BlockSet.i64.readme
-
C:\Users\Admin\Desktop\CheckpointClear.snd.readme
-
C:\Users\Admin\Desktop\CompressProtect.TS.readme
-
C:\Users\Admin\Desktop\ConvertFromWatch.jpeg.readme
-
C:\Users\Admin\Desktop\DebugStart.mp4.readme
-
C:\Users\Admin\Desktop\DenyExpand.vstm.readme
-
C:\Users\Admin\Desktop\DismountEnter.svgz.readme
-
C:\Users\Admin\Desktop\ExitComplete.ini.readme
-
C:\Users\Admin\Desktop\ExitImport.lock.readme
-
C:\Users\Admin\Desktop\LimitRename.iso.readme
-
C:\Users\Admin\Desktop\LockPing.cfg.readme
-
C:\Users\Admin\Desktop\MountRead.eprtx.readme
-
C:\Users\Admin\Desktop\NewClose.xltm.readme
-
C:\Users\Admin\Desktop\OutClose.MOD.readme
-
C:\Users\Admin\Desktop\PingProtect.cr2.readme
-
C:\Users\Admin\Desktop\PopMount.wm.readme
-
C:\Users\Admin\Desktop\Read_Me.txt
-
C:\Users\Admin\Desktop\RedoClear.snd.readme
-
C:\Users\Admin\Desktop\RequestUndo.vb.readme
-
C:\Users\Admin\Desktop\RevokeUnlock.cmd.readme
-
C:\Users\Admin\Desktop\SplitGet.xlsm.readme
-
C:\Users\Admin\Desktop\StepUnblock.contact.readme
-
C:\Users\Admin\Desktop\UnblockImport.rtf.readme
-
C:\Users\Admin\Desktop\UninstallDebug.csv.readme
-
C:\Users\Admin\Desktop\UnregisterEdit.vdw.readme
-
C:\Users\Admin\Desktop\UnregisterEnable.TTS.readme
-
C:\Users\Admin\Desktop\UpdateUninstall.wma.readme
-
C:\Users\Admin\Desktop\desktop.ini.readme
-
C:\Users\Public\Desktop\Adobe Reader 9.lnk.readme
-
C:\Users\Public\Desktop\Firefox.lnk.readme
-
C:\Users\Public\Desktop\Google Chrome.lnk.readme
-
C:\Users\Public\Desktop\Read_Me.txt
-
C:\Users\Public\Desktop\VLC media player.lnk.readme
-
C:\Users\Public\Desktop\desktop.ini.readme
-
\??\M:\$RECYCLE.BIN\S-1-5-21-1131729243-447456001-3632642222-1000\desktop.ini
-
memory/1368-7-0x0000000003BA0000-0x0000000003BA1000-memory.dmpFilesize
4KB
-
memory/1672-47-0x00000000038F0000-0x00000000038F1000-memory.dmpFilesize
4KB
-
memory/1672-48-0x0000000003F90000-0x0000000003F91000-memory.dmpFilesize
4KB
-
memory/1768-1-0x0000000000407CA0-mapping.dmp
-
memory/1768-2-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/1768-0-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/1968-5-0x0000000003B40000-0x0000000003B41000-memory.dmpFilesize
4KB
-
memory/1968-6-0x0000000003B40000-0x0000000003B41000-memory.dmpFilesize
4KB