0acebaf80946be0cb3099233e8807aa775c8304fc3dee48d42241ff68b7ab318

Analysis

max time kernel
131s
max time network
133s
platform
windows10_x64
resource
win10v20201028
submitted
05/12/2020, 07:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3ca6df4914385efd4ba9cd239b5ed254.exe
Size 4.5MB
Sample201205-wygr8zgpvx
SHA256 0acebaf80946be0cb3099233e8807aa775c8304fc3dee48d42241ff68b7ab318
MD5 3ca6df4914385efd4ba9cd239b5ed254
SHA1 b66535ff43334177a5a167b9f2b07ade75484eec
SHA512 7951ab74ecd2ea26ed7bbcbc8bf34a770854a8fb009f256f93d72c705871b5a31c24153cc77581eec6544085cdbb51a170b2b7ef9f3f9139572b818d75424ca6
MD5 SHA1 SHA512

Score

8^/10

bootkit macro persistence spyware

Malware Config

Signatures

Executes dropped EXE 8 IoCs

pid	Process
3920	setup.exe
3824	aliens.exe
3704	1E1C360C582DF797.exe
3940	1E1C360C582DF797.exe
2132	1607156958849.exe
3468	1607156973458.exe
3700	1607157005020.exe
3972	1607157019208.exe

Suspicious Office macro 1 IoCs

Office document equipped with 4.0 macros.

macro

resource	yara_rule
behavioral2/files/0x000200000001aba3-18.dat	office_xlm_macros

Loads dropped DLL 4 IoCs

pid	Process
644	3ca6df4914385efd4ba9cd239b5ed254.exe
644	3ca6df4914385efd4ba9cd239b5ed254.exe
644	3ca6df4914385efd4ba9cd239b5ed254.exe
356	MsiExec.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe

JavaScript code in executable 1 IoCs

resource	yara_rule
behavioral2/files/0x000200000001aba3-18.dat	js

Writes to the Master Boot Record (MBR) 1 TTPs 3 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1067

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	1E1C360C582DF797.exe
File opened for modification	\??\PhysicalDrive0	1E1C360C582DF797.exe
File opened for modification	\??\PhysicalDrive0	aliens.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
3824	aliens.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 3704 set thread context of 2280	3704	1E1C360C582DF797.exe	90
PID 3704 set thread context of 2452	3704	1E1C360C582DF797.exe	98
PID 3704 set thread context of 2160	3704	1E1C360C582DF797.exe	100
PID 3704 set thread context of 864	3704	1E1C360C582DF797.exe	102

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\71eza90awf48	setup.exe
File created	C:\Program Files (x86)\71eza90awf48\__tmp_rar_sfx_access_check_259299312	setup.exe
File created	C:\Program Files (x86)\71eza90awf48\aliens.exe	setup.exe
File opened for modification	C:\Program Files (x86)\71eza90awf48\aliens.exe	setup.exe

NSIS installer 10 IoCs

installer

resource	yara_rule
behavioral2/files/0x000200000001aba6-14.dat	nsis_installer_1
behavioral2/files/0x000200000001aba6-14.dat	nsis_installer_2
behavioral2/files/0x000200000001aba6-15.dat	nsis_installer_1
behavioral2/files/0x000200000001aba6-15.dat	nsis_installer_2
behavioral2/files/0x000200000001aba1-21.dat	nsis_installer_1
behavioral2/files/0x000200000001aba1-21.dat	nsis_installer_2
behavioral2/files/0x000200000001aba1-23.dat	nsis_installer_1
behavioral2/files/0x000200000001aba1-23.dat	nsis_installer_2
behavioral2/files/0x000200000001aba1-22.dat	nsis_installer_1
behavioral2/files/0x000200000001aba1-22.dat	nsis_installer_2

Checks SCSI registry key(s) 3 TTPs 12 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\FriendlyName	1E1C360C582DF797.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\FriendlyName	1E1C360C582DF797.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000	1E1C360C582DF797.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000	1E1C360C582DF797.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc	1E1C360C582DF797.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\FriendlyName	1E1C360C582DF797.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000	1E1C360C582DF797.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc	1E1C360C582DF797.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc	1E1C360C582DF797.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\FriendlyName	1E1C360C582DF797.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000	1E1C360C582DF797.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc	1E1C360C582DF797.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
1032	taskkill.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\6C0CE2DD0584C47CAC18839F14055F19FA270CDD	aliens.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\6C0CE2DD0584C47CAC18839F14055F19FA270CDD\Blob = 0300000001000000140000006c0ce2dd0584c47cac18839f14055f19fa270cdd2000000001000000500500003082054c30820434a0030201020206016de34cff62300d06092a864886f70d01010b05003081aa313b303906035504030c32436861726c65732050726f78792043412028313920e58d81e69c8820323031392c204445534b544f502d424e41543131552931253023060355040b0c1c68747470733a2f2f636861726c657370726f78792e636f6d2f73736c3111300f060355040a0c08584b3732204c74643111300f06035504070c084175636b6c616e643111300f06035504080c084175636b6c616e64310b3009060355040613024e5a301e170d3030303130313030303030305a170d3438313231353039313533375a3081aa313b303906035504030c32436861726c65732050726f78792043412028313920e58d81e69c8820323031392c204445534b544f502d424e41543131552931253023060355040b0c1c68747470733a2f2f636861726c657370726f78792e636f6d2f73736c3111300f060355040a0c08584b3732204c74643111300f06035504070c084175636b6c616e643111300f06035504080c084175636b6c616e64310b3009060355040613024e5a30820122300d06092a864886f70d01010105000382010f003082010a0282010100ae86c5043ed34d99f44fa3052ea34047a7fbbe33188b1dc2ca645ca3249e85e54b4921d4998fda6a22247c32d9087d742af3bf850803ae8c1e25faad53fb8fd823b7353d9a3ac992bf917f693826c790e53a540b120b6553508ec9585e467d310bd3ef9fb61731deb522eb78f43f824b34be36782db7a8cb162cd22247b14e4c5ae633ed66542354a59971bddc59160ecdc521b4477c93ca9e624e0af00298602300f5dc368819c3cb9f02604636888276b3a498570473b5328b0834f327c34285e333da9207e12f0edbb654c8cf11e3cc7cba17a52cd7cd42c10ae095a2e4eb9d3e3f361488243f0584af40e72d6e6e182149bfb8342384f60f12e14734258d0203010001a382017430820170300f0603551d130101ff040530030101ff3082012c06096086480186f842010d0482011d138201195468697320526f6f74206365727469666963617465207761732067656e65726174656420627920436861726c65732050726f787920666f722053534c2050726f7879696e672e20496620746869732063657274696669636174652069732070617274206f66206120636572746966696361746520636861696e2c2074686973206d65616e73207468617420796f752772652062726f7773696e67207468726f75676820436861726c65732050726f787920776974682053534c2050726f7879696e6720656e61626c656420666f72207468697320776562736974652e20506c656173652073656520687474703a2f2f636861726c657370726f78792e636f6d2f73736c20666f72206d6f726520696e666f726d6174696f6e2e300e0603551d0f0101ff040403020204301d0603551d0e04160414f8d0dc54367cf794020f8b92783a5d8a91251f9f300d06092a864886f70d01010b05000382010100662271eb9d5c744c88382de98ba37320e6312104d04273a92007a8670976d6530e6347d00bbded1319bb6754f36237596095922911e3661a70354f6ba0b797a76258be7adebb8c8dbeeed977760b80271d74b2444d92f6c1337a379b73545b251de5f8812b9625abbbfaedc15f8c6c374b9b26dd0fef035185f5899d8819e689dc6db5f0babbfd637c52b1bec80115b889faeed493d4112d744954ad3abe6607c41a4a2d657ba330ed131fa4e8c25bb28ee181dcef8da91c17bfd30a23c8eae81b152ed85ff938afc32b34ffdaffbdb72d9bb04067bfc87f579eba9637b165ea008ea7408bc8265f33c039bf60f506d245a6b53017afc8e161d70ed5b0d76576	aliens.exe

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

T1018

pid	Process
4064	PING.EXE
204	PING.EXE

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2132	1607156958849.exe
2132	1607156958849.exe
3468	1607156973458.exe
3468	1607156973458.exe
3700	1607157005020.exe
3700	1607157005020.exe
3972	1607157019208.exe
3972	1607157019208.exe

Suspicious use of AdjustPrivilegeToken 91 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2204	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2204	msiexec.exe
Token: SeSecurityPrivilege	1968	msiexec.exe
Token: SeCreateTokenPrivilege	2204	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2204	msiexec.exe
Token: SeLockMemoryPrivilege	2204	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2204	msiexec.exe
Token: SeMachineAccountPrivilege	2204	msiexec.exe
Token: SeTcbPrivilege	2204	msiexec.exe
Token: SeSecurityPrivilege	2204	msiexec.exe
Token: SeTakeOwnershipPrivilege	2204	msiexec.exe
Token: SeLoadDriverPrivilege	2204	msiexec.exe
Token: SeSystemProfilePrivilege	2204	msiexec.exe
Token: SeSystemtimePrivilege	2204	msiexec.exe
Token: SeProfSingleProcessPrivilege	2204	msiexec.exe
Token: SeIncBasePriorityPrivilege	2204	msiexec.exe
Token: SeCreatePagefilePrivilege	2204	msiexec.exe
Token: SeCreatePermanentPrivilege	2204	msiexec.exe
Token: SeBackupPrivilege	2204	msiexec.exe
Token: SeRestorePrivilege	2204	msiexec.exe
Token: SeShutdownPrivilege	2204	msiexec.exe
Token: SeDebugPrivilege	2204	msiexec.exe
Token: SeAuditPrivilege	2204	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2204	msiexec.exe
Token: SeChangeNotifyPrivilege	2204	msiexec.exe
Token: SeRemoteShutdownPrivilege	2204	msiexec.exe
Token: SeUndockPrivilege	2204	msiexec.exe
Token: SeSyncAgentPrivilege	2204	msiexec.exe
Token: SeEnableDelegationPrivilege	2204	msiexec.exe
Token: SeManageVolumePrivilege	2204	msiexec.exe
Token: SeImpersonatePrivilege	2204	msiexec.exe
Token: SeCreateGlobalPrivilege	2204	msiexec.exe
Token: SeCreateTokenPrivilege	2204	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2204	msiexec.exe
Token: SeLockMemoryPrivilege	2204	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2204	msiexec.exe
Token: SeMachineAccountPrivilege	2204	msiexec.exe
Token: SeTcbPrivilege	2204	msiexec.exe
Token: SeSecurityPrivilege	2204	msiexec.exe
Token: SeTakeOwnershipPrivilege	2204	msiexec.exe
Token: SeLoadDriverPrivilege	2204	msiexec.exe
Token: SeSystemProfilePrivilege	2204	msiexec.exe
Token: SeSystemtimePrivilege	2204	msiexec.exe
Token: SeProfSingleProcessPrivilege	2204	msiexec.exe
Token: SeIncBasePriorityPrivilege	2204	msiexec.exe
Token: SeCreatePagefilePrivilege	2204	msiexec.exe
Token: SeCreatePermanentPrivilege	2204	msiexec.exe
Token: SeBackupPrivilege	2204	msiexec.exe
Token: SeRestorePrivilege	2204	msiexec.exe
Token: SeShutdownPrivilege	2204	msiexec.exe
Token: SeDebugPrivilege	2204	msiexec.exe
Token: SeAuditPrivilege	2204	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2204	msiexec.exe
Token: SeChangeNotifyPrivilege	2204	msiexec.exe
Token: SeRemoteShutdownPrivilege	2204	msiexec.exe
Token: SeUndockPrivilege	2204	msiexec.exe
Token: SeSyncAgentPrivilege	2204	msiexec.exe
Token: SeEnableDelegationPrivilege	2204	msiexec.exe
Token: SeManageVolumePrivilege	2204	msiexec.exe
Token: SeImpersonatePrivilege	2204	msiexec.exe
Token: SeCreateGlobalPrivilege	2204	msiexec.exe
Token: SeCreateTokenPrivilege	2204	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2204	msiexec.exe
Token: SeLockMemoryPrivilege	2204	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2204	msiexec.exe
Token: SeMachineAccountPrivilege	2204	msiexec.exe
Token: SeTcbPrivilege	2204	msiexec.exe
Token: SeSecurityPrivilege	2204	msiexec.exe
Token: SeTakeOwnershipPrivilege	2204	msiexec.exe
Token: SeLoadDriverPrivilege	2204	msiexec.exe
Token: SeSystemProfilePrivilege	2204	msiexec.exe
Token: SeSystemtimePrivilege	2204	msiexec.exe
Token: SeProfSingleProcessPrivilege	2204	msiexec.exe
Token: SeIncBasePriorityPrivilege	2204	msiexec.exe
Token: SeCreatePagefilePrivilege	2204	msiexec.exe
Token: SeCreatePermanentPrivilege	2204	msiexec.exe
Token: SeBackupPrivilege	2204	msiexec.exe
Token: SeRestorePrivilege	2204	msiexec.exe
Token: SeShutdownPrivilege	2204	msiexec.exe
Token: SeDebugPrivilege	2204	msiexec.exe
Token: SeAuditPrivilege	2204	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2204	msiexec.exe
Token: SeChangeNotifyPrivilege	2204	msiexec.exe
Token: SeRemoteShutdownPrivilege	2204	msiexec.exe
Token: SeUndockPrivilege	2204	msiexec.exe
Token: SeSyncAgentPrivilege	2204	msiexec.exe
Token: SeEnableDelegationPrivilege	2204	msiexec.exe
Token: SeManageVolumePrivilege	2204	msiexec.exe
Token: SeImpersonatePrivilege	2204	msiexec.exe
Token: SeCreateGlobalPrivilege	2204	msiexec.exe
Token: SeDebugPrivilege	1032	taskkill.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2204	msiexec.exe

Suspicious use of SetWindowsHookEx 11 IoCs

pid	Process
3824	aliens.exe
3940	1E1C360C582DF797.exe
3704	1E1C360C582DF797.exe
2280	firefox.exe
2132	1607156958849.exe
2452	firefox.exe
3468	1607156973458.exe
2160	firefox.exe
3700	1607157005020.exe
864	firefox.exe
3972	1607157019208.exe

Suspicious use of WriteProcessMemory 72 IoCs

description	pid	Process	procid_target
PID 644 wrote to memory of 3920	644	3ca6df4914385efd4ba9cd239b5ed254.exe	75
PID 644 wrote to memory of 3920	644	3ca6df4914385efd4ba9cd239b5ed254.exe	75
PID 644 wrote to memory of 3920	644	3ca6df4914385efd4ba9cd239b5ed254.exe	75
PID 3920 wrote to memory of 3824	3920	setup.exe	76
PID 3920 wrote to memory of 3824	3920	setup.exe	76
PID 3920 wrote to memory of 3824	3920	setup.exe	76
PID 3824 wrote to memory of 2204	3824	aliens.exe	80
PID 3824 wrote to memory of 2204	3824	aliens.exe	80
PID 3824 wrote to memory of 2204	3824	aliens.exe	80
PID 3824 wrote to memory of 3704	3824	aliens.exe	82
PID 3824 wrote to memory of 3704	3824	aliens.exe	82
PID 3824 wrote to memory of 3704	3824	aliens.exe	82
PID 3824 wrote to memory of 3940	3824	aliens.exe	83
PID 3824 wrote to memory of 3940	3824	aliens.exe	83
PID 3824 wrote to memory of 3940	3824	aliens.exe	83
PID 1968 wrote to memory of 356	1968	msiexec.exe	84
PID 1968 wrote to memory of 356	1968	msiexec.exe	84
PID 1968 wrote to memory of 356	1968	msiexec.exe	84
PID 3824 wrote to memory of 2932	3824	aliens.exe	86
PID 3824 wrote to memory of 2932	3824	aliens.exe	86
PID 3824 wrote to memory of 2932	3824	aliens.exe	86
PID 2932 wrote to memory of 4064	2932	cmd.exe	88
PID 2932 wrote to memory of 4064	2932	cmd.exe	88
PID 2932 wrote to memory of 4064	2932	cmd.exe	88
PID 3940 wrote to memory of 2616	3940	1E1C360C582DF797.exe	89
PID 3940 wrote to memory of 2616	3940	1E1C360C582DF797.exe	89
PID 3940 wrote to memory of 2616	3940	1E1C360C582DF797.exe	89
PID 3704 wrote to memory of 2280	3704	1E1C360C582DF797.exe	90
PID 3704 wrote to memory of 2280	3704	1E1C360C582DF797.exe	90
PID 3704 wrote to memory of 2280	3704	1E1C360C582DF797.exe	90
PID 3704 wrote to memory of 2280	3704	1E1C360C582DF797.exe	90
PID 3704 wrote to memory of 2280	3704	1E1C360C582DF797.exe	90
PID 3704 wrote to memory of 2280	3704	1E1C360C582DF797.exe	90
PID 2616 wrote to memory of 1032	2616	cmd.exe	92
PID 2616 wrote to memory of 1032	2616	cmd.exe	92
PID 2616 wrote to memory of 1032	2616	cmd.exe	92
PID 3940 wrote to memory of 3840	3940	1E1C360C582DF797.exe	93
PID 3940 wrote to memory of 3840	3940	1E1C360C582DF797.exe	93
PID 3940 wrote to memory of 3840	3940	1E1C360C582DF797.exe	93
PID 3704 wrote to memory of 2132	3704	1E1C360C582DF797.exe	95
PID 3704 wrote to memory of 2132	3704	1E1C360C582DF797.exe	95
PID 3704 wrote to memory of 2132	3704	1E1C360C582DF797.exe	95
PID 3840 wrote to memory of 204	3840	cmd.exe	96
PID 3840 wrote to memory of 204	3840	cmd.exe	96
PID 3840 wrote to memory of 204	3840	cmd.exe	96
PID 3704 wrote to memory of 2452	3704	1E1C360C582DF797.exe	98
PID 3704 wrote to memory of 2452	3704	1E1C360C582DF797.exe	98
PID 3704 wrote to memory of 2452	3704	1E1C360C582DF797.exe	98
PID 3704 wrote to memory of 2452	3704	1E1C360C582DF797.exe	98
PID 3704 wrote to memory of 2452	3704	1E1C360C582DF797.exe	98
PID 3704 wrote to memory of 2452	3704	1E1C360C582DF797.exe	98
PID 3704 wrote to memory of 3468	3704	1E1C360C582DF797.exe	99
PID 3704 wrote to memory of 3468	3704	1E1C360C582DF797.exe	99
PID 3704 wrote to memory of 3468	3704	1E1C360C582DF797.exe	99
PID 3704 wrote to memory of 2160	3704	1E1C360C582DF797.exe	100
PID 3704 wrote to memory of 2160	3704	1E1C360C582DF797.exe	100
PID 3704 wrote to memory of 2160	3704	1E1C360C582DF797.exe	100
PID 3704 wrote to memory of 2160	3704	1E1C360C582DF797.exe	100
PID 3704 wrote to memory of 2160	3704	1E1C360C582DF797.exe	100
PID 3704 wrote to memory of 2160	3704	1E1C360C582DF797.exe	100
PID 3704 wrote to memory of 3700	3704	1E1C360C582DF797.exe	101
PID 3704 wrote to memory of 3700	3704	1E1C360C582DF797.exe	101
PID 3704 wrote to memory of 3700	3704	1E1C360C582DF797.exe	101
PID 3704 wrote to memory of 864	3704	1E1C360C582DF797.exe	102
PID 3704 wrote to memory of 864	3704	1E1C360C582DF797.exe	102
PID 3704 wrote to memory of 864	3704	1E1C360C582DF797.exe	102
PID 3704 wrote to memory of 864	3704	1E1C360C582DF797.exe	102
PID 3704 wrote to memory of 864	3704	1E1C360C582DF797.exe	102
PID 3704 wrote to memory of 864	3704	1E1C360C582DF797.exe	102
PID 3704 wrote to memory of 3972	3704	1E1C360C582DF797.exe	103
PID 3704 wrote to memory of 3972	3704	1E1C360C582DF797.exe	103
PID 3704 wrote to memory of 3972	3704	1E1C360C582DF797.exe	103

C:\Users\Admin\AppData\Local\Temp\3ca6df4914385efd4ba9cd239b5ed254.exe
"C:\Users\Admin\AppData\Local\Temp\3ca6df4914385efd4ba9cd239b5ed254.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:644
- C:\Users\Admin\AppData\Local\Temp\sib8787.tmp\0\setup.exe
  "C:\Users\Admin\AppData\Local\Temp\sib8787.tmp\0\setup.exe" -s
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Suspicious use of WriteProcessMemory
  PID:3920
- - C:\Program Files (x86)\71eza90awf48\aliens.exe
    "C:\Program Files (x86)\71eza90awf48\aliens.exe"
    3⤵
    - Executes dropped EXE
    - Writes to the Master Boot Record (MBR)
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Modifies system certificate store
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3824
  - - C:\Windows\SysWOW64\msiexec.exe
      msiexec.exe /i "C:\Users\Admin\AppData\Local\Temp\gdiview.msi"
      4⤵
      Enumerates connected drives
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      PID:2204
  - - C:\Users\Admin\AppData\Local\Temp\1E1C360C582DF797.exe
      C:\Users\Admin\AppData\Local\Temp\1E1C360C582DF797.exe 0011 installp3
      4⤵
      Executes dropped EXE
      Writes to the Master Boot Record (MBR)
      Suspicious use of SetThreadContext
      Checks SCSI registry key(s)
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3704
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe"
        5⤵
        Suspicious use of SetWindowsHookEx
        
        PID:2280
    - - C:\Users\Admin\AppData\Roaming\1607156958849.exe
        
        "C:\Users\Admin\AppData\Roaming\1607156958849.exe" /sjson "C:\Users\Admin\AppData\Roaming\1607156958849.txt"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:2132
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe"
        5⤵
        Suspicious use of SetWindowsHookEx
        
        PID:2452
    - - C:\Users\Admin\AppData\Roaming\1607156973458.exe
        
        "C:\Users\Admin\AppData\Roaming\1607156973458.exe" /sjson "C:\Users\Admin\AppData\Roaming\1607156973458.txt"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:3468
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe"
        5⤵
        Suspicious use of SetWindowsHookEx
        
        PID:2160
    - - C:\Users\Admin\AppData\Roaming\1607157005020.exe
        
        "C:\Users\Admin\AppData\Roaming\1607157005020.exe" /sjson "C:\Users\Admin\AppData\Roaming\1607157005020.txt"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:3700
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe"
        5⤵
        Suspicious use of SetWindowsHookEx
        
        PID:864
    - - C:\Users\Admin\AppData\Roaming\1607157019208.exe
        
        "C:\Users\Admin\AppData\Roaming\1607157019208.exe" /sjson "C:\Users\Admin\AppData\Roaming\1607157019208.txt"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:3972
  - - C:\Users\Admin\AppData\Local\Temp\1E1C360C582DF797.exe
      C:\Users\Admin\AppData\Local\Temp\1E1C360C582DF797.exe 200 installp3
      4⤵
      Executes dropped EXE
      Writes to the Master Boot Record (MBR)
      Checks SCSI registry key(s)
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3940
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /c taskkill /f /im chrome.exe
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2616
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im chrome.exe
        6⤵
        Kills process with taskkill
        
        PID:1032
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ping 127.0.0.1 -n 3 & del "C:\Users\Admin\AppData\Local\Temp\1E1C360C582DF797.exe"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3840
      - C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 3
        6⤵
        Runs ping.exe
        
        PID:204
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c ping 127.0.0.1 -n 3 & del "C:\Program Files (x86)\71eza90awf48\aliens.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2932
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 3
        5⤵
        Runs ping.exe
        
        PID:4064

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1968
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 41F4F593062954CBA2342187C6FB0AC7 C
  2⤵
  - Loads dropped DLL
  PID:356

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Bootkit

T1067

Privilege Escalation

Defense Evasion

Install Root Certificate

T1130

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/644-8-0x0000000010C90000-0x0000000010C91000-memory.dmp

Download

memory/644-6-0x0000000010C70000-0x0000000010C71000-memory.dmp

Download

memory/644-3-0x0000000073950000-0x000000007403E000-memory.dmp

Download

memory/2280-35-0x0000000010000000-0x0000000010057000-memory.dmp

Download

memory/3704-31-0x00000000055F0000-0x0000000005AA1000-memory.dmp

Download

memory/3824-16-0x0000000010000000-0x000000001033D000-memory.dmp

Download

memory/3940-32-0x0000000005590000-0x0000000005A41000-memory.dmp

Download