Analysis
- max time kernel
123s - max time network
150s - platform
windows10_x64 - resource
win10 - submitted
02/08/2020, 15:28
Static task
static1
Behavioral task
behavioral1
Sample
762002910000000.bin.exe
Resource
win7v200722
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
762002910000000.bin.exe
Resource
win10
windows10_x64
0 signatures
0 seconds
General
- Target 762002910000000.bin.exe
- Size 85KB
- Sample200802-vbht9618he
- SHA256 e1f3874c42cdd4e2c49477d7b2bc3ebd3bcd4e3a2cf882fa4d1ea09546c74f5d
- MD5 2a23b69ccccebf091787fc9861697bd0
- SHA1 b8d9631cbdfe5833db70c8995b539d3f1b5985b1
- SHA512 c106b9605e7dd64877975aed3375a687e96a18990f88d6e16918fbd9ca08ac283ace24e0ea2e6278a8a283f9853f35f65c39010bb4d0eaa807a17ea6f6a96889
- MD5 SHA1 SHA512
Score
8/10
Malware Config
Signatures
- Suspicious use of WriteProcessMemory 39 IoCs
description pid Process procid_target PID 720 wrote to memory of 3816 720 762002910000000.bin.exe 67 PID 720 wrote to memory of 3816 720 762002910000000.bin.exe 67 PID 720 wrote to memory of 3816 720 762002910000000.bin.exe 67 PID 720 wrote to memory of 3864 720 762002910000000.bin.exe 68 PID 720 wrote to memory of 3864 720 762002910000000.bin.exe 68 PID 720 wrote to memory of 3864 720 762002910000000.bin.exe 68 PID 3816 wrote to memory of 3424 3816 firefox.exe 69 PID 3816 wrote to memory of 3424 3816 firefox.exe 69 PID 3816 wrote to memory of 3424 3816 firefox.exe 69 PID 3816 wrote to memory of 828 3816 firefox.exe 71 PID 3816 wrote to memory of 828 3816 firefox.exe 71 PID 3816 wrote to memory of 828 3816 firefox.exe 71 PID 828 wrote to memory of 1356 828 firefox.exe 72 PID 828 wrote to memory of 1356 828 firefox.exe 72 PID 828 wrote to memory of 1356 828 firefox.exe 72 PID 3864 wrote to memory of 720 3864 setup.exe 77 PID 3864 wrote to memory of 720 3864 setup.exe 77 PID 3864 wrote to memory of 720 3864 setup.exe 77 PID 3864 wrote to memory of 1508 3864 setup.exe 79 PID 3864 wrote to memory of 1508 3864 setup.exe 79 PID 3864 wrote to memory of 1508 3864 setup.exe 79 PID 3864 wrote to memory of 2160 3864 setup.exe 81 PID 3864 wrote to memory of 2160 3864 setup.exe 81 PID 3864 wrote to memory of 2160 3864 setup.exe 81 PID 3864 wrote to memory of 3024 3864 setup.exe 83 PID 3864 wrote to memory of 3024 3864 setup.exe 83 PID 3864 wrote to memory of 3024 3864 setup.exe 83 PID 3864 wrote to memory of 708 3864 setup.exe 85 PID 3864 wrote to memory of 708 3864 setup.exe 85 PID 3864 wrote to memory of 708 3864 setup.exe 85 PID 3864 wrote to memory of 2408 3864 setup.exe 87 PID 3864 wrote to memory of 2408 3864 setup.exe 87 PID 3864 wrote to memory of 2408 3864 setup.exe 87 PID 3864 wrote to memory of 728 3864 setup.exe 89 PID 3864 wrote to memory of 728 3864 setup.exe 89 PID 3864 wrote to memory of 728 3864 setup.exe 89 PID 3864 wrote to memory of 1696 3864 setup.exe 91 PID 3864 wrote to memory of 1696 3864 setup.exe 91 PID 3864 wrote to memory of 1696 3864 setup.exe 91 -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\Main 762002910000000.bin.exe Set value (int) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "525" 762002910000000.bin.exe Set value (int) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\Main\TabProcGrowth = "0" firefox.exe Set value (int) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\Main\NoProtectedModeBanner = "1" firefox.exe - Enumerates connected drives 3 TTPs
- Modifies data under HKEY_USERS 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "132408557391087836" setup.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry setup.exe -
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f6200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa62000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 762002910000000.bin.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d43190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 762002910000000.bin.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 5c000000010000000400000000080000190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f6200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa604000000010000001000000087ce0b7b2a0e4900e158719b37a893722000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 762002910000000.bin.exe Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\SystemCertificates\REQUEST setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43 762002910000000.bin.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 0f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d432000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 762002910000000.bin.exe - Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AB4C9050E3B05675.lnk firefox.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Executes dropped EXE 5 IoCs
pid Process 3816 firefox.exe 3864 setup.exe 3424 tor.exe 828 firefox.exe 1356 tor.exe - Loads dropped DLL 27 IoCs
pid Process 3816 firefox.exe 3816 firefox.exe 3816 firefox.exe 3816 firefox.exe 3816 firefox.exe 3424 tor.exe 3424 tor.exe 3424 tor.exe 3424 tor.exe 3424 tor.exe 3424 tor.exe 3424 tor.exe 828 firefox.exe 828 firefox.exe 828 firefox.exe 828 firefox.exe 828 firefox.exe 828 firefox.exe 828 firefox.exe 1356 tor.exe 1356 tor.exe 1356 tor.exe 1356 tor.exe 1356 tor.exe 1356 tor.exe 1356 tor.exe 1356 tor.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3864 setup.exe 3864 setup.exe - JavaScript code in executable 15 IoCs
resource yara_rule behavioral2/files/0x000200000001adc8-24.dat js behavioral2/files/0x000200000001adc8-26.dat js behavioral2/files/0x000200000001adb8-38.dat js behavioral2/files/0x000200000001adb8-39.dat js behavioral2/files/0x000200000001adb5-46.dat js behavioral2/files/0x000200000001adb5-50.dat js behavioral2/files/0x000300000001adb6-80.dat js behavioral2/files/0x000200000001adba-83.dat js behavioral2/files/0x000200000001adbc-85.dat js behavioral2/files/0x000100000001ae3c-109.dat js behavioral2/files/0x000100000001ae3c-110.dat js behavioral2/files/0x000100000001ae12-112.dat js behavioral2/files/0x000100000001ae0f-116.dat js behavioral2/files/0x000100000001ae12-111.dat js behavioral2/files/0x000100000001ae0f-115.dat js - Modifies service 2 TTPs 14 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Interfaces\{eae0de04-c558-47fb-8761-331818d23af1}\NameServer = "185.81.157.105" netsh.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Interfaces\{D61488AB-B008-11EA-95E4-806E6F6E6963} netsh.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Interfaces\{EAE0DE04-C558-47FB-8761-331818D23AF1} netsh.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Interfaces\{EAE0DE04-C558-47FB-8761-331818D23AF1} netsh.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Interfaces\{d61488ab-b008-11ea-95e4-806e6f6e6963}\NameServer netsh.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Interfaces\{D61488AB-B008-11EA-95E4-806E6F6E6963} netsh.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Interfaces\{d61488ab-b008-11ea-95e4-806e6f6e6963}\NameServer netsh.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Interfaces\{d61488ab-b008-11ea-95e4-806e6f6e6963}\NameServer = "185.81.157.105" netsh.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Interfaces\{EAE0DE04-C558-47FB-8761-331818D23AF1} netsh.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Interfaces\{D61488AB-B008-11EA-95E4-806E6F6E6963} netsh.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Interfaces\{D61488AB-B008-11EA-95E4-806E6F6E6963} netsh.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Interfaces\{eae0de04-c558-47fb-8761-331818d23af1}\NameServer netsh.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Interfaces\{EAE0DE04-C558-47FB-8761-331818D23AF1} netsh.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Interfaces\{eae0de04-c558-47fb-8761-331818d23af1}\NameServer netsh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\762002910000000.bin.exe"C:\Users\Admin\AppData\Local\Temp\762002910000000.bin.exe"1⤵
- Suspicious use of WriteProcessMemory
- Modifies Internet Explorer settings
- Modifies system certificate store
PID:720 -
C:\Users\Admin\AppData\Local\Temp\firefox.exe"C:\Users\Admin\AppData\Local\Temp\firefox.exe"2⤵
- Suspicious use of WriteProcessMemory
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
PID:3816 -
C:\Users\Admin\AppData\Local\Temp\tor.exe"C:\Users\Admin\AppData\Local\Temp\tor.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3424
-
-
C:\Users\Admin\AppData\Roaming\AB4C9050E3B05675\firefox.exe"C:\Users\Admin\AppData\Roaming\AB4C9050E3B05675\firefox.exe"3⤵
- Suspicious use of WriteProcessMemory
- Modifies Internet Explorer settings
- Executes dropped EXE
- Loads dropped DLL
PID:828 -
C:\Users\Admin\AppData\Roaming\AB4C9050E3B05675\tor.exe"C:\Users\Admin\AppData\Roaming\AB4C9050E3B05675\tor.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1356
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup.exe"C:\Users\Admin\AppData\Local\Temp\setup.exe"2⤵
- Suspicious use of WriteProcessMemory
- Modifies data under HKEY_USERS
- Modifies system certificate store
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3864 -
C:\Windows\SysWOW64\netsh.exeWindows\System32\netsh.exe interface ipv4 delete dnsservers "Ethernet" all3⤵
- Modifies service
PID:720
-
-
C:\Windows\SysWOW64\netsh.exeWindows\System32\netsh.exe interface ip delete dns "Ethernet" all3⤵
- Modifies service
PID:1508
-
-
C:\Windows\SysWOW64\netsh.exeWindows\System32\netsh.exe interface ipv4 add dnsserver "Ethernet" 185.81.157.105 index=1 validate=no3⤵
- Modifies service
PID:2160
-
-
C:\Windows\SysWOW64\netsh.exeWindows\System32\netsh.exe interface ip add dns "Ethernet" 185.81.157.105 index=13⤵
- Modifies service
PID:3024
-
-
C:\Windows\SysWOW64\netsh.exeWindows\System32\netsh.exe interface ipv4 delete dnsservers "Loopback Pseudo-Interface 1" all3⤵
- Modifies service
PID:708
-
-
C:\Windows\SysWOW64\netsh.exeWindows\System32\netsh.exe interface ip delete dns "Loopback Pseudo-Interface 1" all3⤵
- Modifies service
PID:2408
-
-
C:\Windows\SysWOW64\netsh.exeWindows\System32\netsh.exe interface ipv4 add dnsserver "Loopback Pseudo-Interface 1" 185.81.157.105 index=1 validate=no3⤵
- Modifies service
PID:728
-
-
C:\Windows\SysWOW64\netsh.exeWindows\System32\netsh.exe interface ip add dns "Loopback Pseudo-Interface 1" 185.81.157.105 index=13⤵
- Modifies service
PID:1696
-
-
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s NgcSvc1⤵PID:3776
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s DeviceAssociationService1⤵PID:3848