hxxps://anonfiles[.]com/Hfo8Qbc5p5/FsE42k9kJ_exe

Reason

Machine shutdown

General

Target

https://anonfiles.com/Hfo8Qbc5p5/FsE42k9kJ_exe
Sample

201018-zp1q9wj3ke

Score

8^/10

vmprotect ransomware bootkit

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

FsE42k9kJ.exe

pid process

2452 FsE42k9kJ.exe
Modifies WinLogon to allow AutoLogon 2 TTPs 1 IoCs
Enables rebooting of the machine without requiring login credentials.
ransomware bootkit

Winlogon Helper DLL
T1004

Modify Registry
T1112

Processes:

LogonUI.exe

description ioc process

Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\AutoLogonChecked LogonUI.exe

pid	process
2452	FsE42k9kJ.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\AutoLogonChecked	LogonUI.exe

VMProtect packed file 2 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

Processes:

resource	yara_rule
C:\Users\Admin\Downloads\FsE42k9kJ.exe.1ubcake.partial	vmprotect
C:\Users\Admin\Downloads\FsE42k9kJ.exe	vmprotect

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

FsE42k9kJ.exe

pid process

2452 FsE42k9kJ.exe

pid	process
2452	FsE42k9kJ.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

IEXPLORE.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	IEXPLORE.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	IEXPLORE.EXE

Modifies Internet Explorer Phishing Filter 1 TTPs 2 IoCs

Modify Registry

T1112

Processes:

iexplore.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\PhishingFilter	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\PhishingFilter\ClientSupported_MigrationTime = b4679a610d44d601	iexplore.exe

Modifies Internet Explorer settings 1 TTPs 55 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\FlipAhead	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$Telligent	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2467769287"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificate	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$blogger	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificate\NextUpdateDate = "309780044"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0ada2950ea5d601	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\FlipAhead\NextUpdateDate = "309812036"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\DOMStorage\anonfiles.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$vBulletin 3	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\FlipAhead\FileVersion = "2016061511"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\DOMStorage\anonfiles.com	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BE4CF842-1101-11EB-95F0-C603A23B7D16} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "309763450"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$WordPress	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "2467769287"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bf4556abf008534caf0e093d1a48993300000000020000000000106600000001000020000000ed8d3e89667844482e30f19c23c87b96ec7bb9d8e2d6949b015369d383fe4807000000000e80000000020000200000003c17fd3f0062b45366a240711962d42b3de7472787167812e0c25670c59b503820000000ab99d34614b3ae92ea666692aac1a96bdc240b3550505d0de4074c5815bf0348400000001f98b8faec2635748ba637762c9299402b7fe83f870140e74cd994849249e9ede3e24c08bd3516a332b371ce7b3cd0cada20b56dffcc1dd76111b9c6953cc38c	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$vBulletin 4	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30844174"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2476675050"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$Discuz!	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$MediaWiki	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\Toolbar	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\RepId	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bf4556abf008534caf0e093d1a48993300000000020000000000106600000001000020000000bbde36f259dd1193e93d3528513ec658426b4c710241c93abbb69a97aae26ba8000000000e80000000020000200000006bd280d5e5a905720cc9cd16c966b5c0fc1b9b8d09fcc3641eb2c0b2ce80495320000000b69880ec21d09ea18ccd650807b3edf339e39e0d51d92c304a1b7b790268cef54000000081696849dcb4c0bf031bcd454a265c1486e6785160ebcd4f64dd456a3c477cfe821b5dab3e348741a82c8f5ebbb733b1625f0298bd3440bffde0c22a062352eb	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$http://www.typepad.com/	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30844174"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30844174"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 904fb3950ea5d601	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\RepId\PublicId = "{FBC7F49A-105C-4256-8DAB-4817D5EA4FE4}"	iexplore.exe

Modifies data under HKEY_USERS 15 IoCs

Processes:

LogonUI.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe

Runs .reg file with regedit 1 IoCs

Processes:

regedit.exe

pid process

2072 regedit.exe
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

3760 PING.EXE
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

FsE42k9kJ.exe

pid process

2452 FsE42k9kJ.exe
2452 FsE42k9kJ.exe
Suspicious behavior: GetForegroundWindowSpam 2 IoCs

Processes:

FsE42k9kJ.exeiexplore.exe

pid process

2452 FsE42k9kJ.exe
3832 iexplore.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

AUDIODG.EXE

description pid process

Token: 33 4060 AUDIODG.EXE
Token: SeIncBasePriorityPrivilege 4060 AUDIODG.EXE
Suspicious use of FindShellTrayWindow 3 IoCs

Processes:

iexplore.exe

pid process

3832 iexplore.exe
3832 iexplore.exe
3832 iexplore.exe

pid	process
2072	regedit.exe

pid	process
3760	PING.EXE

pid	process
2452	FsE42k9kJ.exe
2452	FsE42k9kJ.exe

pid	process
2452	FsE42k9kJ.exe
3832	iexplore.exe

description	pid	process
Token: 33	4060	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4060	AUDIODG.EXE

Suspicious use of SetWindowsHookEx 15 IoCs

Processes:

iexplore.exeIEXPLORE.EXELogonUI.exe

pid	process
3832	iexplore.exe
3832	iexplore.exe
3524	IEXPLORE.EXE
3524	IEXPLORE.EXE
3524	IEXPLORE.EXE
3524	IEXPLORE.EXE
3524	IEXPLORE.EXE
3524	IEXPLORE.EXE
3524	IEXPLORE.EXE
3524	IEXPLORE.EXE
3524	IEXPLORE.EXE
3524	IEXPLORE.EXE
3524	IEXPLORE.EXE
3260	LogonUI.exe
3260	LogonUI.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

iexplore.exeFsE42k9kJ.execmd.exe

description	pid	process	target process
PID 3832 wrote to memory of 3524	3832	iexplore.exe	IEXPLORE.EXE
PID 3832 wrote to memory of 3524	3832	iexplore.exe	IEXPLORE.EXE
PID 3832 wrote to memory of 3524	3832	iexplore.exe	IEXPLORE.EXE
PID 3832 wrote to memory of 2452	3832	iexplore.exe	FsE42k9kJ.exe
PID 3832 wrote to memory of 2452	3832	iexplore.exe	FsE42k9kJ.exe
PID 2452 wrote to memory of 3256	2452	FsE42k9kJ.exe	cmd.exe
PID 2452 wrote to memory of 3256	2452	FsE42k9kJ.exe	cmd.exe
PID 3256 wrote to memory of 3760	3256	cmd.exe	PING.EXE
PID 3256 wrote to memory of 3760	3256	cmd.exe	PING.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://anonfiles.com/Hfo8Qbc5p5/FsE42k9kJ_exe
1⤵
- Modifies Internet Explorer Phishing Filter
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3832

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3832 CREDAT:82945 /prefetch:2
2⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3524

C:\Users\Admin\Downloads\FsE42k9kJ.exe
"C:\Users\Admin\Downloads\FsE42k9kJ.exe"
2⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:2452

C:\Windows\SYSTEM32\cmd.exe
cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\Downloads\FsE42k9kJ.exe"
3⤵
- Suspicious use of WriteProcessMemory
PID:3256

C:\Windows\system32\PING.EXE
ping 1.1.1.1 -n 1 -w 3000
4⤵
- Runs ping.exe
PID:3760

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {24AC8F2B-4D4A-4C17-9607-6A4B14068F97} -Embedding
1⤵
PID:2864

C:\Windows\regedit.exe
"regedit.exe" "C:\Users\Admin\Desktop\InvokeOptimize.reg"
1⤵
- Runs .reg file with regedit
PID:2072

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1344

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x2b8
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4060

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0 /state0:0xa3ade055 /state1:0x41c64e6d
1⤵
- Modifies WinLogon to allow AutoLogon
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:3260

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

1

T1004

Privilege Escalation

Defense Evasion

Modify Registry

3

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Remote System Discovery

1

T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27
MD5
52c8ff8b999c1449aa14a11ab1bdfb6c

SHA1
8dd131a76c188b5e5f5e6864995bdd5d56146725

SHA256
9637cae37edfa438df0ddda51c5c2deba138d8548ffc415ed56d5abb902f15cf

SHA512
bd727851f9da606eefd98665ee814c8dd268660aa6dedd65f775dc70fd466a3ff5618310724a23aaeb2388d65c883de0da302c997ba80de6ffb900e1c7365944

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_D9817BD5013875AD517DA73475345203
MD5
f2219af60c38b0f20b395fe1a1b7d869

SHA1
2eadc4b73a1a4c83226a5f461e1883302a486f18

SHA256
e8c961a9213e3fffa7cd32738b71519f0942b28ee847ad8cf12a37b2d0acc8da

SHA512
a4d0c93b71f090ca12ceed826aca703e3a6b3b4d4ee12f7402d03093afded68504c42b29b5f03697363c95221e3d20c1040d2fbf73d44cbb69515b0983d83f33

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27
MD5
4257108557e9e6971aa077414a5aa8a8

SHA1
ef03f250e6681dd1669fdbfdaa9e06dad6c1809d

SHA256
612dbf6f8c5f50cbb6f73f5d79c573cce97abdc787b680fbf451031923c3053c

SHA512
383b4c7f774e8127459e39e6f4ad2b9e0cac7fc8639bcc6f2104de2b28d4c9f0d06badc68d0e0c8b2759ee717bcac1530cc08afc50286ed80c92b1fa199ae186

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_D9817BD5013875AD517DA73475345203
MD5
b177cb549056ad544e9326786000fbd5

SHA1
4ad7244754d3d47629fd3a6f05c4bbd0f38daf7f

SHA256
56a4172a29ec9a69c9a129813d68c6ec04c338bda7eef21d1a4f57d0126fef55

SHA512
d9be3a2422f01fd1dbf51c66d70da716e16002d6408524966cbbbfbd31bc8cf0e04041f20a18bb44988ab25f73c40daa92720a198a088f4f7d8315cf4597b140

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\6ADLN19X.cookie
MD5
5f2bfce5ed9368c447e869ad1acd16d0

SHA1
87ccb12f7ada6ec31ae8fbe1a7de5b52a4bc1817

SHA256
5f5989e4037b3ec7cf9935f9401ff70cf604fc452ddc4248641f3eeeb59cdf59

SHA512
3d55542d43e4a55a14865b6e6729d71b360ae6ea77b095b70c01155f7599a1d25b05ed6d10266ffc3ad81165a094ed95c315266cacc123d03bbe27c55e2d9923

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\P4I22FM1.cookie
MD5
125b5f1872372f5c4b6c9f2d3446b90d

SHA1
ec5799a57c7c53b61766c63e878327146c7ed6fc

SHA256
91813eb00f58023b76806380012aebde5cce1d689efb3ba016ce4f63d1b4767c

SHA512
7394e2c324470b80c333bb75851de2325a6606d8c433053cfecf0a9f22288c009ced62333db6cbde60cc5e96751775d930ffd40a4966357708d0f78f09a80229

Download Submit
C:\Users\Admin\Downloads\FsE42k9kJ.exe
MD5
4407c7c717997c58011aaaac9af61758

SHA1
b2287f759e03650c8ece45472d914fa3481ce6d6

SHA256
07c9eebaca4315566ee657ef167ebea0f4c7f4f7a99da75253fcaf46eadf765f

SHA512
f984e123d6e687aaf6715f0d58d6edbb703a0b13fd645aec8a55cdf1599fbc652e29068ba51ab9af5debb3aba29ed2b4ace030db8c61713a46d6abaa271b9d63

Download Submit
C:\Users\Admin\Downloads\FsE42k9kJ.exe.1ubcake.partial
MD5
4407c7c717997c58011aaaac9af61758

SHA1
b2287f759e03650c8ece45472d914fa3481ce6d6

SHA256
07c9eebaca4315566ee657ef167ebea0f4c7f4f7a99da75253fcaf46eadf765f

SHA512
f984e123d6e687aaf6715f0d58d6edbb703a0b13fd645aec8a55cdf1599fbc652e29068ba51ab9af5debb3aba29ed2b4ace030db8c61713a46d6abaa271b9d63

Download Submit
memory/2452-8-0x0000000000000000-mapping.dmp

Download
memory/3256-10-0x0000000000000000-mapping.dmp

Download
memory/3524-0-0x0000000000000000-mapping.dmp

Download
memory/3760-11-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads