Overview
overview
10Static
static
10ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
1ฺฺฺK...ฺฺ
windows10_x64
8ฺฺฺK...ฺฺ
windows10_x64
3ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
1ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
9ฺฺฺK...ฺฺ
windows10_x64
8ฺฺฺK...ฺฺ
windows10_x64
1ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
1ฺฺฺK...ฺฺ
windows10_x64
8ฺฺฺK...ฺฺ
windows10_x64
ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
ฺฺฺK...ฺฺ
windows10_x64
Analysis
-
max time kernel
1801s -
max time network
1769s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
20-11-2020 14:34
Static task
static1
Behavioral task
behavioral1
Sample
08751be484e1572995ebb085df1c2c6372084d63a64dce7fab28130d79a6ea2d.exe.dll
Resource
win10v20201028
Behavioral task
behavioral2
Sample
0a9f79abd48b95544d7e2b6658637d1eb23067a94e10bf06d05c9ecc73cf4b51.exe
Resource
win10v20201028
Behavioral task
behavioral3
Sample
0di3x.exe
Resource
win10v20201028
Behavioral task
behavioral4
Sample
2019-09-02_22-41-10.exe
Resource
win10v20201028
Behavioral task
behavioral5
Sample
2c01b007729230c415420ad641ad92eb.exe
Resource
win10v20201028
Behavioral task
behavioral6
Sample
31.exe
Resource
win10v20201028
Behavioral task
behavioral7
Sample
3DMark 11 Advanced Edition.exe
Resource
win10v20201028
Behavioral task
behavioral8
Sample
42f972925508a82236e8533567487761.exe
Resource
win10v20201028
Behavioral task
behavioral9
Sample
5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
Resource
win10v20201028
Behavioral task
behavioral10
Sample
69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
Resource
win10v20201028
Behavioral task
behavioral11
Sample
905d572f23883f5f161f920e53473989cf7dffc16643aa759f77842e54add550.exe
Resource
win10v20201028
Behavioral task
behavioral12
Sample
948340be97cc69c2cf8e5c8327ee52a89eeb50095f978696c710ad773a46b654.exe
Resource
win10v20201028
Behavioral task
behavioral13
Sample
95560f1a465e8ba87a73f8e60a6657545073d55c3b5cfc2ffdaf3d69d46afcf9.exe.dll
Resource
win10v20201028
Behavioral task
behavioral14
Sample
Archive.zip__ccacaxs2tbz2t6ob3e.exe
Resource
win10v20201028
Behavioral task
behavioral15
Sample
CVE-2018-15982_PoC.swf
Resource
win10v20201028
Behavioral task
behavioral16
Sample
DiskInternals_Uneraser_v5_keygen.exe
Resource
win10v20201028
Behavioral task
behavioral17
Sample
ForceOp 2.8.7 - By RaiSence.exe
Resource
win10v20201028
Behavioral task
behavioral18
Sample
HYDRA.exe
Resource
win10v20201028
Behavioral task
behavioral19
Sample
KLwC6vii.exe
Resource
win10v20201028
Behavioral task
behavioral20
Sample
Keygen.exe
Resource
win10v20201028
Behavioral task
behavioral21
Sample
Lonelyscreen.1.2.9.keygen.by.Paradox.exe
Resource
win10v20201028
Behavioral task
behavioral22
Sample
LtHv0O2KZDK4M637.exe
Resource
win10v20201028
Behavioral task
behavioral23
Sample
Magic_File_v3_keygen_by_KeygenNinja.exe
Resource
win10v20201028
Behavioral task
behavioral24
Sample
OnlineInstaller.exe
Resource
win10v20201028
Behavioral task
behavioral25
Sample
Remouse.Micro.Micro.v3.5.3.serial.maker.by.aaocg.exe
Resource
win10v20201028
Behavioral task
behavioral27
Sample
SecuriteInfo.com.Generic.mg.cde56cf0169830ee.29869.dll
Resource
win10v20201028
Behavioral task
behavioral28
Sample
SecurityTaskManager_Setup.exe
Resource
win10v20201028
Behavioral task
behavioral29
Sample
Treasure.Vault.3D.Screensaver.keygen.by.Paradox.exe
Resource
win10v20201028
Behavioral task
behavioral30
Sample
VyprVPN.exe
Resource
win10v20201028
Behavioral task
behavioral31
Sample
WSHSetup[1].exe
Resource
win10v20201028
Behavioral task
behavioral32
Sample
Yard.dll
Resource
win10v20201028
Malware Config
Extracted
smokeloader
2020
http://etasuklavish.today/
http://mragyzmachnobesdi.today/
http://kimchinikuzims.today/
http://slacvostinrius.today/
http://straponuliusyn.today/
http://grammmdinss.today/
http://viprasputinsd.chimkent.su/
http://lupadypa.dagestan.su/
http://stoknolimchin.exnet.su/
http://musaroprovadnikov.live/
http://teemforyourexprensiti.life/
http://stolkgolmishutich.termez.su/
http://roompampamgandish.wtf/
Extracted
zloader
r1
r1
https://notsweets.net/LKhwojehDgwegSDG/gateJKjdsh.php
https://olpons.com/LKhwojehDgwegSDG/gateJKjdsh.php
https://karamelliar.org/LKhwojehDgwegSDG/gateJKjdsh.php
https://dogrunn.com/LKhwojehDgwegSDG/gateJKjdsh.php
https://azoraz.net/LKhwojehDgwegSDG/gateJKjdsh.php
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
description pid Process procid_target PID 4804 created 1540 4804 WerFault.exe 90 -
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
description pid Process procid_target PID 3084 created 2576 3084 DEDC.tmp.exe 57 -
Blocklisted process makes network request 26 IoCs
flow pid Process 55 4768 msiexec.exe 56 4768 msiexec.exe 57 4768 msiexec.exe 60 4768 msiexec.exe 63 4768 msiexec.exe 64 4768 msiexec.exe 69 4768 msiexec.exe 70 4768 msiexec.exe 71 4768 msiexec.exe 72 4768 msiexec.exe 73 4768 msiexec.exe 74 4768 msiexec.exe 76 4768 msiexec.exe 77 4768 msiexec.exe 80 4768 msiexec.exe 81 4768 msiexec.exe 82 4768 msiexec.exe 83 4768 msiexec.exe 86 4768 msiexec.exe 88 4768 msiexec.exe 89 4768 msiexec.exe 92 4768 msiexec.exe 97 4768 msiexec.exe 107 4768 msiexec.exe 111 4768 msiexec.exe 114 4768 msiexec.exe -
Downloads MZ/PE file
-
Executes dropped EXE 3 IoCs
pid Process 3084 DEDC.tmp.exe 560 E0A2.tmp.exe 1540 rwfuvfh -
Deletes itself 1 IoCs
pid Process 2576 Explorer.EXE -
Loads dropped DLL 1 IoCs
pid Process 4776 0di3x.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3084 set thread context of 4768 3084 DEDC.tmp.exe 89 -
Program crash 1 IoCs
pid pid_target Process procid_target 4804 1540 WerFault.exe 90 -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 0di3x.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 0di3x.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 0di3x.exe -
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7053647F-2B3F-11EB-BEBD-F648E9E4AC23} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b06820334cbfd601 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30850892" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30850892" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f83ea431a1a9554d9899d7aad776ea2d000000000200000000001066000000010000200000007c6d06d0e2e43317f119a298ebfb1fab9a0fe3da5bf8161c1d2661ae0723ca21000000000e80000000020000200000002c7d3b83e06512c3f48788a278f5dbcb81bc110f39a65e74e54466deb5a29f9b20000000e2f312d9babb1776b97fb3b1e7a7d69abb6cc47999320d9324561724b870b29240000000a2853e71af2ae2224c9bd6ba7eb6dd0dfebb229bc13801be2ea7ae1610d0dad476ea01fb5c7aa855ef1bba839cdae676d70927c6a9587bdb254edd19970a596d iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40e92b264cbfd601 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f83ea431a1a9554d9899d7aad776ea2d00000000020000000000106600000001000020000000666158bb67b1f25a9b8e3017bfb5041f6bcc05eeae8e6a1d5c1b51006e81c350000000000e80000000020000200000000a9e7b44875546edb95a778595c9c5d97c1a4861f902c7fe50419edc5a3f2a2c20000000d9b46c8cdf0050a5557d5f51c91f5aee2242f57b81def897481de8cbf805a22340000000af29c2885bec192f5b8f1a61872be5bd9c579c6b44d3ddb4f42d6a4cbd8a9f1fe2c8cbd542c008e46b2b4fc9546a74b7976c5bd73503635c89ac1e1948d1c91a iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7D34C9D7-2B3F-11EB-BEBD-F648E9E4AC23} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "512763678" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f83ea431a1a9554d9899d7aad776ea2d00000000020000000000106600000001000020000000c20055d6df635e6d7bad1df833b4270e75222dab50b61de2f027b5b1e3655d0f000000000e8000000002000020000000108036856bcc40b05decdcbd4aeaa9102b9bc95b7310e87ebf29aafcd363ea4520000000625f8e87d1b68546564d74a5a9711964c9080c5a4a8ca6d179762f500ac5af7d4000000046fa45449850159548bf56c8a097e170f1e2612d45926603aac0c06f6012074d3263353eeb225577aa1544e4684f1420d21097f4ec4acfbdcc07d98e6766fc22 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40d66d1f4cbfd601 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "512763678" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60ef611f4cbfd601 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6357D5ED-2B3F-11EB-BEBD-F648E9E4AC23} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{49EFC616-2B3F-11EB-BEBD-F648E9E4AC23} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70348b414cbfd601 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f83ea431a1a9554d9899d7aad776ea2d000000000200000000001066000000010000200000002bcc5ba0265a28a837a71fe7cbf361853e53746382f04fe425d4db2ed3f5d4b2000000000e800000000200002000000099603bfc16b49717979e6679537f4f84db0b2a088dea3cee2b3d7cdda8d2efe620000000f971b759c556cb8712397bcda47a124c674e09c7a977b6fdc546f36c89a4d93b40000000df6b5692751369a725620d1869070aedf63ef13d66833228fc85e4b469b10e0adbe8420dc8006e83c67260d767a1e064a751da8c2774e3c6ae8221cc47cd8e00 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f83ea431a1a9554d9899d7aad776ea2d000000000200000000001066000000010000200000004e0ab7c88c7d24b1c61ece5b392a399ac4b808276d04036a7949362fc2a28a10000000000e80000000020000200000003daa069c70378a4a9f55811facd00e8da8a7b87d6fcb560f7d0cdd6ab0dd358c2000000035833b5746fa29963f07e8737cf398106cd859a8dd8a34783df52e970ed86aef400000005dc0d074b20e407a29fe2daa083a1ea9aa1d8a7aa64cdbfd60a1bac7486b033e6bae5a9948c6afdc4dc1d213a4992d07d4cce1f843bc049ad59c09b46baf6572 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4776 0di3x.exe 4776 0di3x.exe 2576 Explorer.EXE 2576 Explorer.EXE 2576 Explorer.EXE 2576 Explorer.EXE 2576 Explorer.EXE 2576 Explorer.EXE 2576 Explorer.EXE 2576 Explorer.EXE 2576 Explorer.EXE 2576 Explorer.EXE 2576 Explorer.EXE 2576 Explorer.EXE 2576 Explorer.EXE 2576 Explorer.EXE 2576 Explorer.EXE 2576 Explorer.EXE 2576 Explorer.EXE 2576 Explorer.EXE 2576 Explorer.EXE 2576 Explorer.EXE 2576 Explorer.EXE 2576 Explorer.EXE 2576 Explorer.EXE 2576 Explorer.EXE 2576 Explorer.EXE 2576 Explorer.EXE 2576 Explorer.EXE 2576 Explorer.EXE 2576 Explorer.EXE 2576 Explorer.EXE 2576 Explorer.EXE 2576 Explorer.EXE 2576 Explorer.EXE 2576 Explorer.EXE 2576 Explorer.EXE 2576 Explorer.EXE 2576 Explorer.EXE 2576 Explorer.EXE 2576 Explorer.EXE 2576 Explorer.EXE 2576 Explorer.EXE 2576 Explorer.EXE 2576 Explorer.EXE 2576 Explorer.EXE 2576 Explorer.EXE 2576 Explorer.EXE 2576 Explorer.EXE 2576 Explorer.EXE 2576 Explorer.EXE 2576 Explorer.EXE 2576 Explorer.EXE 2576 Explorer.EXE 2576 Explorer.EXE 2576 Explorer.EXE 2576 Explorer.EXE 2576 Explorer.EXE 2576 Explorer.EXE 2576 Explorer.EXE 2576 Explorer.EXE 2576 Explorer.EXE 2576 Explorer.EXE 2576 Explorer.EXE -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2576 Explorer.EXE -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 4776 0di3x.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2576 Explorer.EXE Token: SeCreatePagefilePrivilege 2576 Explorer.EXE Token: SeShutdownPrivilege 2576 Explorer.EXE Token: SeCreatePagefilePrivilege 2576 Explorer.EXE Token: SeShutdownPrivilege 2576 Explorer.EXE Token: SeCreatePagefilePrivilege 2576 Explorer.EXE Token: SeShutdownPrivilege 2576 Explorer.EXE Token: SeCreatePagefilePrivilege 2576 Explorer.EXE Token: SeShutdownPrivilege 2576 Explorer.EXE Token: SeCreatePagefilePrivilege 2576 Explorer.EXE Token: SeShutdownPrivilege 2576 Explorer.EXE Token: SeCreatePagefilePrivilege 2576 Explorer.EXE Token: SeShutdownPrivilege 2576 Explorer.EXE Token: SeCreatePagefilePrivilege 2576 Explorer.EXE Token: SeShutdownPrivilege 2576 Explorer.EXE Token: SeCreatePagefilePrivilege 2576 Explorer.EXE Token: SeShutdownPrivilege 2576 Explorer.EXE Token: SeCreatePagefilePrivilege 2576 Explorer.EXE Token: SeShutdownPrivilege 2576 Explorer.EXE Token: SeCreatePagefilePrivilege 2576 Explorer.EXE Token: SeShutdownPrivilege 2576 Explorer.EXE Token: SeCreatePagefilePrivilege 2576 Explorer.EXE Token: SeShutdownPrivilege 2576 Explorer.EXE Token: SeCreatePagefilePrivilege 2576 Explorer.EXE Token: SeShutdownPrivilege 2576 Explorer.EXE Token: SeCreatePagefilePrivilege 2576 Explorer.EXE Token: SeShutdownPrivilege 2576 Explorer.EXE Token: SeCreatePagefilePrivilege 2576 Explorer.EXE Token: SeShutdownPrivilege 2576 Explorer.EXE Token: SeCreatePagefilePrivilege 2576 Explorer.EXE Token: SeShutdownPrivilege 2576 Explorer.EXE Token: SeCreatePagefilePrivilege 2576 Explorer.EXE Token: SeShutdownPrivilege 2576 Explorer.EXE Token: SeCreatePagefilePrivilege 2576 Explorer.EXE Token: SeShutdownPrivilege 2576 Explorer.EXE Token: SeCreatePagefilePrivilege 2576 Explorer.EXE Token: SeShutdownPrivilege 2576 Explorer.EXE Token: SeCreatePagefilePrivilege 2576 Explorer.EXE Token: SeShutdownPrivilege 2576 Explorer.EXE Token: SeCreatePagefilePrivilege 2576 Explorer.EXE Token: SeShutdownPrivilege 2576 Explorer.EXE Token: SeCreatePagefilePrivilege 2576 Explorer.EXE Token: SeShutdownPrivilege 2576 Explorer.EXE Token: SeCreatePagefilePrivilege 2576 Explorer.EXE Token: SeShutdownPrivilege 2576 Explorer.EXE Token: SeCreatePagefilePrivilege 2576 Explorer.EXE Token: SeShutdownPrivilege 2576 Explorer.EXE Token: SeCreatePagefilePrivilege 2576 Explorer.EXE Token: SeShutdownPrivilege 2576 Explorer.EXE Token: SeCreatePagefilePrivilege 2576 Explorer.EXE Token: SeShutdownPrivilege 2576 Explorer.EXE Token: SeCreatePagefilePrivilege 2576 Explorer.EXE Token: SeShutdownPrivilege 2576 Explorer.EXE Token: SeCreatePagefilePrivilege 2576 Explorer.EXE Token: SeShutdownPrivilege 2576 Explorer.EXE Token: SeCreatePagefilePrivilege 2576 Explorer.EXE Token: SeShutdownPrivilege 2576 Explorer.EXE Token: SeCreatePagefilePrivilege 2576 Explorer.EXE Token: SeShutdownPrivilege 2576 Explorer.EXE Token: SeCreatePagefilePrivilege 2576 Explorer.EXE Token: SeShutdownPrivilege 2576 Explorer.EXE Token: SeCreatePagefilePrivilege 2576 Explorer.EXE Token: SeShutdownPrivilege 2576 Explorer.EXE Token: SeCreatePagefilePrivilege 2576 Explorer.EXE -
Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 1116 iexplore.exe 3144 iexplore.exe 4580 iexplore.exe 3632 iexplore.exe -
Suspicious use of SetWindowsHookEx 16 IoCs
pid Process 1116 iexplore.exe 1116 iexplore.exe 1316 IEXPLORE.EXE 1316 IEXPLORE.EXE 3144 iexplore.exe 3144 iexplore.exe 4492 IEXPLORE.EXE 4492 IEXPLORE.EXE 4580 iexplore.exe 4580 iexplore.exe 2364 IEXPLORE.EXE 2364 IEXPLORE.EXE 3632 iexplore.exe 3632 iexplore.exe 2588 IEXPLORE.EXE 2588 IEXPLORE.EXE -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 2576 Explorer.EXE -
Suspicious use of WriteProcessMemory 23 IoCs
description pid Process procid_target PID 2576 wrote to memory of 3084 2576 Explorer.EXE 78 PID 2576 wrote to memory of 3084 2576 Explorer.EXE 78 PID 2576 wrote to memory of 3084 2576 Explorer.EXE 78 PID 2576 wrote to memory of 560 2576 Explorer.EXE 79 PID 2576 wrote to memory of 560 2576 Explorer.EXE 79 PID 2576 wrote to memory of 560 2576 Explorer.EXE 79 PID 1116 wrote to memory of 1316 1116 iexplore.exe 82 PID 1116 wrote to memory of 1316 1116 iexplore.exe 82 PID 1116 wrote to memory of 1316 1116 iexplore.exe 82 PID 3144 wrote to memory of 4492 3144 iexplore.exe 84 PID 3144 wrote to memory of 4492 3144 iexplore.exe 84 PID 3144 wrote to memory of 4492 3144 iexplore.exe 84 PID 4580 wrote to memory of 2364 4580 iexplore.exe 86 PID 4580 wrote to memory of 2364 4580 iexplore.exe 86 PID 4580 wrote to memory of 2364 4580 iexplore.exe 86 PID 3632 wrote to memory of 2588 3632 iexplore.exe 88 PID 3632 wrote to memory of 2588 3632 iexplore.exe 88 PID 3632 wrote to memory of 2588 3632 iexplore.exe 88 PID 3084 wrote to memory of 4768 3084 DEDC.tmp.exe 89 PID 3084 wrote to memory of 4768 3084 DEDC.tmp.exe 89 PID 3084 wrote to memory of 4768 3084 DEDC.tmp.exe 89 PID 3084 wrote to memory of 4768 3084 DEDC.tmp.exe 89 PID 3084 wrote to memory of 4768 3084 DEDC.tmp.exe 89
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Deletes itself
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2576 -
C:\Users\Admin\AppData\Local\Temp\0di3x.exe"C:\Users\Admin\AppData\Local\Temp\0di3x.exe"2⤵
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:4776
-
-
C:\Users\Admin\AppData\Local\Temp\DEDC.tmp.exeC:\Users\Admin\AppData\Local\Temp\DEDC.tmp.exe2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3084
-
-
C:\Users\Admin\AppData\Local\Temp\E0A2.tmp.exeC:\Users\Admin\AppData\Local\Temp\E0A2.tmp.exe2⤵
- Executes dropped EXE
PID:560
-
-
C:\Windows\SysWOW64\msiexec.exemsiexec.exe2⤵
- Blocklisted process makes network request
PID:4768
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1116 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1116 CREDAT:82945 /prefetch:22⤵
- Suspicious use of SetWindowsHookEx
PID:1316
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3144 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3144 CREDAT:82945 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4492
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4580 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4580 CREDAT:82945 /prefetch:22⤵
- Suspicious use of SetWindowsHookEx
PID:2364
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3632 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3632 CREDAT:82945 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2588
-
-
C:\Users\Admin\AppData\Roaming\rwfuvfhC:\Users\Admin\AppData\Roaming\rwfuvfh1⤵
- Executes dropped EXE
PID:1540 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1540 -s 4762⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
PID:4804
-