oblique | 0283c0f02307adc4ee46c0382df4b5d7b4eb80114fbaf5cb7fe5412f027d165e

General

Target

0283c0f02307adc4ee46c0382df4b5d7b4eb80114fbaf5cb7fe5412f027d165e.exe
Size

5.4MB
MD5

d7d6889bfa96724f7b3f951bc06e8c02
SHA1

a897f6fb6fff70c71b224caea80846bcd264cf1e
SHA256

0283c0f02307adc4ee46c0382df4b5d7b4eb80114fbaf5cb7fe5412f027d165e
SHA512

0aabb090791d8b7c5af273793d61bc7ef164343d027e12b58faec66dbdddb724f58b267a423088ce06c52420af80ffe276b448cd3844fee4f929a98b0f64ae75

Score

10^/10

spyware persistence trojan oblique

Malware Config

Signatures

Modifies system executable filetype association 2 TTPs 1 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1042

Processes:

0283c0f02307adc4ee46c0382df4b5d7b4eb80114fbaf5cb7fe5412f027d165e.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	0283c0f02307adc4ee46c0382df4b5d7b4eb80114fbaf5cb7fe5412f027d165e.exe

ObliqueRAT
Remote Access Trojan discovered in early 2020.
trojan oblique

Executes dropped EXE 7 IoCs

Processes:

0283c0f02307adc4ee46c0382df4b5d7b4eb80114fbaf5cb7fe5412f027d165e.exesvchost.comframe.exesvchost.comsvchost.comlphsi.exehrss.exe

pid	process
2308	0283c0f02307adc4ee46c0382df4b5d7b4eb80114fbaf5cb7fe5412f027d165e.exe
3628	svchost.com
3864	frame.exe
3948	svchost.com
1860	svchost.com
3964	lphsi.exe
3720	hrss.exe

Drops startup file 1 IoCs

Processes:

hrss.exe

description ioc process

File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\script.lnk hrss.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\script.lnk	hrss.exe

JavaScript code in executable 5 IoCs

Processes:

resource	yara_rule
C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE	js
C:\Users\ALLUSE~1\MICROS~1\CLICKT~1\{9AC08~1\INTEGR~1.EXE	js
C:\Users\ALLUSE~1\PACKAG~1\{CA675~1\VCREDI~1.EXE	js
C:\Users\ALLUSE~1\PACKAG~1\{EF6B0~1\VCREDI~1.EXE	js
C:\Users\ALLUSE~1\PACKAG~1\{F4220~1\VC_RED~1.EXE	js

Drops file in Program Files directory 121 IoCs

Processes:

svchost.com0283c0f02307adc4ee46c0382df4b5d7b4eb80114fbaf5cb7fe5412f027d165e.exe

description	ioc	process
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\AdobeARM.exe	svchost.com
File opened for modification	C:\PROGRA~2\WINDOW~4\ACCESS~1\wordpad.exe	0283c0f02307adc4ee46c0382df4b5d7b4eb80114fbaf5cb7fe5412f027d165e.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE	0283c0f02307adc4ee46c0382df4b5d7b4eb80114fbaf5cb7fe5412f027d165e.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE	svchost.com
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE	svchost.com
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\Browser\WCCHRO~1\WCCHRO~1.EXE	svchost.com
File opened for modification	C:\PROGRA~2\Google\Update\1335~1.452\GOBD5D~1.EXE	0283c0f02307adc4ee46c0382df4b5d7b4eb80114fbaf5cb7fe5412f027d165e.exe
File opened for modification	C:\PROGRA~2\MOZILL~1\UNINST~1.EXE	svchost.com
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe	0283c0f02307adc4ee46c0382df4b5d7b4eb80114fbaf5cb7fe5412f027d165e.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\LOGTRA~1.EXE	svchost.com
File opened for modification	C:\PROGRA~2\Google\Chrome\APPLIC~1\840414~1.89\NOTIFI~1.EXE	svchost.com
File opened for modification	C:\PROGRA~2\WI54FB~1\wmpconfig.exe	0283c0f02307adc4ee46c0382df4b5d7b4eb80114fbaf5cb7fe5412f027d165e.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmpshare.exe	0283c0f02307adc4ee46c0382df4b5d7b4eb80114fbaf5cb7fe5412f027d165e.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE	svchost.com
File opened for modification	C:\PROGRA~2\WINDOW~2\wab.exe	0283c0f02307adc4ee46c0382df4b5d7b4eb80114fbaf5cb7fe5412f027d165e.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE	0283c0f02307adc4ee46c0382df4b5d7b4eb80114fbaf5cb7fe5412f027d165e.exe
File opened for modification	C:\PROGRA~2\Google\Update\1335~1.452\GOF5E2~1.EXE	svchost.com
File opened for modification	C:\PROGRA~2\INTERN~1\ieinstal.exe	svchost.com
File opened for modification	C:\PROGRA~2\WINDOW~4\ACCESS~1\wordpad.exe	svchost.com
File opened for modification	C:\PROGRA~3\PACKAG~1\{F4220~1\VC_RED~1.EXE	svchost.com
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADelRCP.exe	svchost.com
File opened for modification	C:\PROGRA~2\Google\Chrome\APPLIC~1\840414~1.89\ELEVAT~1.EXE	0283c0f02307adc4ee46c0382df4b5d7b4eb80114fbaf5cb7fe5412f027d165e.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmpshare.exe	svchost.com
File opened for modification	C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE	0283c0f02307adc4ee46c0382df4b5d7b4eb80114fbaf5cb7fe5412f027d165e.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\WOW_HE~1.EXE	svchost.com
File opened for modification	C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jucheck.exe	svchost.com
File opened for modification	C:\PROGRA~2\Google\Update\1335~1.452\GOBD5D~1.EXE	svchost.com
File opened for modification	C:\PROGRA~2\Google\Chrome\APPLIC~1\chrome.exe	0283c0f02307adc4ee46c0382df4b5d7b4eb80114fbaf5cb7fe5412f027d165e.exe
File opened for modification	C:\PROGRA~2\Google\Update\1335~1.452\GOOGLE~1.EXE	0283c0f02307adc4ee46c0382df4b5d7b4eb80114fbaf5cb7fe5412f027d165e.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ielowutil.exe	svchost.com
File opened for modification	C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE	svchost.com
File opened for modification	C:\PROGRA~2\WI8A19~1\ImagingDevices.exe	svchost.com
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\Eula.exe	0283c0f02307adc4ee46c0382df4b5d7b4eb80114fbaf5cb7fe5412f027d165e.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\AdobeARM.exe	0283c0f02307adc4ee46c0382df4b5d7b4eb80114fbaf5cb7fe5412f027d165e.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe	0283c0f02307adc4ee46c0382df4b5d7b4eb80114fbaf5cb7fe5412f027d165e.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{F4220~1\VC_RED~1.EXE	0283c0f02307adc4ee46c0382df4b5d7b4eb80114fbaf5cb7fe5412f027d165e.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe	svchost.com
File opened for modification	C:\PROGRA~2\INTERN~1\ielowutil.exe	0283c0f02307adc4ee46c0382df4b5d7b4eb80114fbaf5cb7fe5412f027d165e.exe
File opened for modification	C:\PROGRA~2\Google\Update\1335~1.452\GOOGLE~2.EXE	0283c0f02307adc4ee46c0382df4b5d7b4eb80114fbaf5cb7fe5412f027d165e.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe	svchost.com
File opened for modification	C:\PROGRA~2\Google\Update\1335~1.452\GO664E~1.EXE	svchost.com
File opened for modification	C:\PROGRA~2\INTERN~1\ExtExport.exe	0283c0f02307adc4ee46c0382df4b5d7b4eb80114fbaf5cb7fe5412f027d165e.exe
File opened for modification	C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE	0283c0f02307adc4ee46c0382df4b5d7b4eb80114fbaf5cb7fe5412f027d165e.exe
File opened for modification	C:\PROGRA~2\Google\Chrome\APPLIC~1\840414~1.89\INSTAL~1\chrmstp.exe	0283c0f02307adc4ee46c0382df4b5d7b4eb80114fbaf5cb7fe5412f027d165e.exe
File opened for modification	C:\PROGRA~2\Google\Update\1335~1.452\GOFB2B~1.EXE	0283c0f02307adc4ee46c0382df4b5d7b4eb80114fbaf5cb7fe5412f027d165e.exe
File opened for modification	C:\PROGRA~2\Google\Update\DISABL~1.EXE	0283c0f02307adc4ee46c0382df4b5d7b4eb80114fbaf5cb7fe5412f027d165e.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\64BITM~1.EXE	svchost.com
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE	svchost.com
File opened for modification	C:\PROGRA~2\WI54FB~1\wmlaunch.exe	svchost.com
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE	0283c0f02307adc4ee46c0382df4b5d7b4eb80114fbaf5cb7fe5412f027d165e.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jaureg.exe	svchost.com
File opened for modification	C:\PROGRA~2\Google\Update\1335~1.452\GOOGLE~4.EXE	0283c0f02307adc4ee46c0382df4b5d7b4eb80114fbaf5cb7fe5412f027d165e.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\WOW_HE~1.EXE	0283c0f02307adc4ee46c0382df4b5d7b4eb80114fbaf5cb7fe5412f027d165e.exe
File opened for modification	C:\PROGRA~2\INTERN~1\iexplore.exe	svchost.com
File opened for modification	C:\PROGRA~2\WI54FB~1\setup_wm.exe	svchost.com
File opened for modification	C:\PROGRA~2\Google\Chrome\APPLIC~1\840414~1.89\INSTAL~1\setup.exe	0283c0f02307adc4ee46c0382df4b5d7b4eb80114fbaf5cb7fe5412f027d165e.exe
File opened for modification	C:\PROGRA~2\Google\Update\1335~1.452\GOOGLE~4.EXE	svchost.com
File opened for modification	C:\PROGRA~2\Google\Update\1335~1.452\GOFB2B~1.EXE	svchost.com
File opened for modification	C:\PROGRA~2\Google\Update\DISABL~1.EXE	svchost.com
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\READER~1.EXE	svchost.com
File opened for modification	C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jusched.exe	0283c0f02307adc4ee46c0382df4b5d7b4eb80114fbaf5cb7fe5412f027d165e.exe
File opened for modification	C:\PROGRA~2\Google\Chrome\APPLIC~1\chrome.exe	svchost.com
File opened for modification	C:\PROGRA~2\INTERN~1\ieinstal.exe	0283c0f02307adc4ee46c0382df4b5d7b4eb80114fbaf5cb7fe5412f027d165e.exe
File opened for modification	C:\PROGRA~2\WINDOW~2\WinMail.exe	0283c0f02307adc4ee46c0382df4b5d7b4eb80114fbaf5cb7fe5412f027d165e.exe

Drops file in Windows directory 8 IoCs

Processes:

0283c0f02307adc4ee46c0382df4b5d7b4eb80114fbaf5cb7fe5412f027d165e.exesvchost.comsvchost.comsvchost.comsvchost.exe

description	ioc	process
File opened for modification	C:\Windows\svchost.com	0283c0f02307adc4ee46c0382df4b5d7b4eb80114fbaf5cb7fe5412f027d165e.exe
File opened for modification	C:\Windows\directx.sys	svchost.com
File opened for modification	C:\Windows\directx.sys	svchost.com
File opened for modification	C:\Windows\directx.sys	svchost.com
File opened for modification	C:\Windows\svchost.com	svchost.com
File opened for modification	C:\Windows\svchost.com	svchost.com
File opened for modification	C:\Windows\svchost.com	svchost.com
File opened for modification	C:\Windows\ServiceProfiles\LocalService\winhttp\cachev3.dat	svchost.exe

Modifies data under HKEY_USERS 5 IoCs

Processes:

svchost.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecisionReason = "1"	svchost.exe
Set value (data)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecisionTime = ca677a294a7dd601	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecision = "0"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	svchost.exe

Modifies registry class 3 IoCs

Processes:

frame.exe0283c0f02307adc4ee46c0382df4b5d7b4eb80114fbaf5cb7fe5412f027d165e.exe0283c0f02307adc4ee46c0382df4b5d7b4eb80114fbaf5cb7fe5412f027d165e.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000_Classes\Local Settings	frame.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	0283c0f02307adc4ee46c0382df4b5d7b4eb80114fbaf5cb7fe5412f027d165e.exe
Key created	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000_Classes\Local Settings	0283c0f02307adc4ee46c0382df4b5d7b4eb80114fbaf5cb7fe5412f027d165e.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

vlc.exe

pid process

3852 vlc.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

vlc.exe

pid process

3852 vlc.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

svchost.exeAUDIODG.EXEvlc.exe

description	pid	process
Token: SeShutdownPrivilege	1640	svchost.exe
Token: SeCreatePagefilePrivilege	1640	svchost.exe
Token: 33	208	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	208	AUDIODG.EXE
Token: 33	3852	vlc.exe
Token: SeIncBasePriorityPrivilege	3852	vlc.exe

Suspicious use of FindShellTrayWindow 28 IoCs

Processes:

vlc.exe

pid	process
3852	vlc.exe
3852	vlc.exe
3852	vlc.exe
3852	vlc.exe
3852	vlc.exe
3852	vlc.exe
3852	vlc.exe
3852	vlc.exe
3852	vlc.exe
3852	vlc.exe
3852	vlc.exe
3852	vlc.exe
3852	vlc.exe
3852	vlc.exe
3852	vlc.exe
3852	vlc.exe
3852	vlc.exe
3852	vlc.exe
3852	vlc.exe
3852	vlc.exe
3852	vlc.exe
3852	vlc.exe
3852	vlc.exe
3852	vlc.exe
3852	vlc.exe
3852	vlc.exe
3852	vlc.exe
3852	vlc.exe

Suspicious use of SendNotifyMessage 9 IoCs

Processes:

vlc.exe

pid process

3852 vlc.exe
3852 vlc.exe
3852 vlc.exe
3852 vlc.exe
3852 vlc.exe
3852 vlc.exe
3852 vlc.exe
3852 vlc.exe
3852 vlc.exe
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

vlc.exe

pid process

3852 vlc.exe
3852 vlc.exe
3852 vlc.exe
3852 vlc.exe

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

0283c0f02307adc4ee46c0382df4b5d7b4eb80114fbaf5cb7fe5412f027d165e.exe0283c0f02307adc4ee46c0382df4b5d7b4eb80114fbaf5cb7fe5412f027d165e.exesvchost.comframe.exesvchost.comsvchost.com

description	pid	process	target process
PID 3816 wrote to memory of 2308	3816	0283c0f02307adc4ee46c0382df4b5d7b4eb80114fbaf5cb7fe5412f027d165e.exe	0283c0f02307adc4ee46c0382df4b5d7b4eb80114fbaf5cb7fe5412f027d165e.exe
PID 3816 wrote to memory of 2308	3816	0283c0f02307adc4ee46c0382df4b5d7b4eb80114fbaf5cb7fe5412f027d165e.exe	0283c0f02307adc4ee46c0382df4b5d7b4eb80114fbaf5cb7fe5412f027d165e.exe
PID 3816 wrote to memory of 2308	3816	0283c0f02307adc4ee46c0382df4b5d7b4eb80114fbaf5cb7fe5412f027d165e.exe	0283c0f02307adc4ee46c0382df4b5d7b4eb80114fbaf5cb7fe5412f027d165e.exe
PID 2308 wrote to memory of 3628	2308	0283c0f02307adc4ee46c0382df4b5d7b4eb80114fbaf5cb7fe5412f027d165e.exe	svchost.com
PID 2308 wrote to memory of 3628	2308	0283c0f02307adc4ee46c0382df4b5d7b4eb80114fbaf5cb7fe5412f027d165e.exe	svchost.com
PID 2308 wrote to memory of 3628	2308	0283c0f02307adc4ee46c0382df4b5d7b4eb80114fbaf5cb7fe5412f027d165e.exe	svchost.com
PID 3628 wrote to memory of 3864	3628	svchost.com	frame.exe
PID 3628 wrote to memory of 3864	3628	svchost.com	frame.exe
PID 3628 wrote to memory of 3864	3628	svchost.com	frame.exe
PID 2308 wrote to memory of 3852	2308	0283c0f02307adc4ee46c0382df4b5d7b4eb80114fbaf5cb7fe5412f027d165e.exe	vlc.exe
PID 2308 wrote to memory of 3852	2308	0283c0f02307adc4ee46c0382df4b5d7b4eb80114fbaf5cb7fe5412f027d165e.exe	vlc.exe
PID 3864 wrote to memory of 3948	3864	frame.exe	svchost.com
PID 3864 wrote to memory of 3948	3864	frame.exe	svchost.com
PID 3864 wrote to memory of 3948	3864	frame.exe	svchost.com
PID 3864 wrote to memory of 1860	3864	frame.exe	svchost.com
PID 3864 wrote to memory of 1860	3864	frame.exe	svchost.com
PID 3864 wrote to memory of 1860	3864	frame.exe	svchost.com
PID 3948 wrote to memory of 3964	3948	svchost.com	lphsi.exe
PID 3948 wrote to memory of 3964	3948	svchost.com	lphsi.exe
PID 3948 wrote to memory of 3964	3948	svchost.com	lphsi.exe
PID 1860 wrote to memory of 3720	1860	svchost.com	hrss.exe
PID 1860 wrote to memory of 3720	1860	svchost.com	hrss.exe
PID 1860 wrote to memory of 3720	1860	svchost.com	hrss.exe

C:\Users\Admin\AppData\Local\Temp\0283c0f02307adc4ee46c0382df4b5d7b4eb80114fbaf5cb7fe5412f027d165e.exe
"C:\Users\Admin\AppData\Local\Temp\0283c0f02307adc4ee46c0382df4b5d7b4eb80114fbaf5cb7fe5412f027d165e.exe"
1⤵
- Modifies system executable filetype association
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3816
- C:\Users\Admin\AppData\Local\Temp\3582-490\0283c0f02307adc4ee46c0382df4b5d7b4eb80114fbaf5cb7fe5412f027d165e.exe
  "C:\Users\Admin\AppData\Local\Temp\3582-490\0283c0f02307adc4ee46c0382df4b5d7b4eb80114fbaf5cb7fe5412f027d165e.exe"
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2308
- - C:\Windows\svchost.com
    "C:\Windows\svchost.com" "C:\Users\Public\Video\frame.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Suspicious use of WriteProcessMemory
    PID:3628
  - - C:\Users\Public\Video\frame.exe
      C:\Users\Public\Video\frame.exe
      4⤵
      Executes dropped EXE
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:3864
    - - C:\Windows\svchost.com
        
        "C:\Windows\svchost.com" "C:\Users\Public\Video\lphsi.exe"
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of WriteProcessMemory
        
        PID:3948
      - C:\Users\Public\Video\lphsi.exe
        
        C:\Users\Public\Video\lphsi.exe
        6⤵
        Executes dropped EXE
        
        PID:3964
    - - C:\Windows\svchost.com
        
        "C:\Windows\svchost.com" "C:\Users\Public\Video\hrss.exe"
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of WriteProcessMemory
        
        PID:1860
      - C:\Users\Public\Video\hrss.exe
        
        C:\Users\Public\Video\hrss.exe
        6⤵
        Executes dropped EXE
        Drops startup file
        
        PID:3720
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Public\Video\movie.mp4"
    3⤵
    - Suspicious behavior: AddClipboardFormatListener
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    PID:3852

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -s WinHttpAutoProxySvc
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1640

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x404
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:208

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Change Default File Association

1

T1042

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PROGRA~2\Adobe\ACROBA~1\Reader\READER~1.EXE

Download Submit
C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe

Download Submit
C:\PROGRA~2\Google\Temp\GUM19FE.tmp\GOFB2B~1.EXE

Download Submit
C:\PROGRA~2\Google\Update\1335~1.452\GOOGLE~2.EXE

Download Submit
C:\PROGRA~2\Google\Update\1335~1.452\GOOGLE~3.EXE

Download Submit
C:\PROGRA~2\MOZILL~1\UNINST~1.EXE

Download Submit
C:\PROGRA~3\Adobe\Setup\{AC76B~1\setup.exe

Download Submit
C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE

Download Submit
C:\Users\ALLUSE~1\Adobe\Setup\{AC76B~1\setup.exe

Download Submit
C:\Users\ALLUSE~1\MICROS~1\CLICKT~1\{9AC08~1\INTEGR~1.EXE

Download Submit
C:\Users\ALLUSE~1\PACKAG~1\{CA675~1\VCREDI~1.EXE

Download Submit
C:\Users\ALLUSE~1\PACKAG~1\{EF6B0~1\VCREDI~1.EXE

Download Submit
C:\Users\ALLUSE~1\PACKAG~1\{F4220~1\VC_RED~1.EXE

Download Submit
C:\Users\Admin\AppData\Local\Temp\3582-490\0283c0f02307adc4ee46c0382df4b5d7b4eb80114fbaf5cb7fe5412f027d165e.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\3582-490\0283c0f02307adc4ee46c0382df4b5d7b4eb80114fbaf5cb7fe5412f027d165e.exe

Download Submit
C:\Users\Public\Video\frame.exe

Download Submit
C:\Users\Public\Video\frame.exe

Download Submit
C:\Users\Public\Video\hrss.exe

Download Submit
C:\Users\Public\Video\hrss.exe

Download Submit
C:\Users\Public\Video\lphsi.exe

Download Submit
C:\Users\Public\Video\lphsi.exe

Download Submit
C:\Users\Public\Video\movie.mp4

Download Submit
C:\Windows\directx.sys

Download Submit
C:\Windows\directx.sys

Download Submit
C:\Windows\svchost.com

Download Submit
C:\Windows\svchost.com

Download Submit
C:\Windows\svchost.com

Download Submit
C:\Windows\svchost.com

Download Submit
C:\odt\OFFICE~1.EXE

Download Submit
memory/1860-12-0x0000000000000000-mapping.dmp

Download
memory/2308-0-0x0000000000000000-mapping.dmp

Download
memory/3628-3-0x0000000000000000-mapping.dmp

Download
memory/3720-20-0x0000000000000000-mapping.dmp

Download
memory/3852-9-0x0000000000000000-mapping.dmp

Download
memory/3864-7-0x0000000000000000-mapping.dmp

Download
memory/3948-10-0x0000000000000000-mapping.dmp

Download
memory/3964-16-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads