0cd1346813ea66e5ecb353180f0f01d9b2e53b230ccb5aece10e4366d632df25

Analysis

max time kernel
124s
max time network
123s
platform
windows7_x64
resource
win7v20201028
submitted
08-04-2021 07:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2295742285186ecb7ff7c4634d31bdc8.exe
Size

1.3MB
MD5

2295742285186ecb7ff7c4634d31bdc8
SHA1

f76643300796393b1e616f7e2d925644faae5caf
SHA256

0cd1346813ea66e5ecb353180f0f01d9b2e53b230ccb5aece10e4366d632df25
SHA512

102a852a9f4b9513dd41935c96cda22647151f06f3f10601f1e1d65f938e539e0447eae4029de0c5a88762a2c6e29afccf14e5f10447f3cd5df75acfb9be605c

Score

8^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 2 IoCs

Processes:

servs.exeservs.tmp

pid process

916 servs.exe
1752 servs.tmp
Loads dropped DLL 2 IoCs

Processes:

2295742285186ecb7ff7c4634d31bdc8.exeservs.exe

pid process

1056 2295742285186ecb7ff7c4634d31bdc8.exe
916 servs.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Suspicious use of SetThreadContext 1 IoCs

Processes:

2295742285186ecb7ff7c4634d31bdc8.exe

description pid process target process

PID 2008 set thread context of 1056 2008 2295742285186ecb7ff7c4634d31bdc8.exe 2295742285186ecb7ff7c4634d31bdc8.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

1360 timeout.exe

pid	process
916	servs.exe
1752	servs.tmp

pid	process
1056	2295742285186ecb7ff7c4634d31bdc8.exe
916	servs.exe

description	pid	process	target process
PID 2008 set thread context of 1056	2008	2295742285186ecb7ff7c4634d31bdc8.exe	2295742285186ecb7ff7c4634d31bdc8.exe

pid	process
1360	timeout.exe

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d011b8da492cd701	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{01614B01-983D-11EB-9DE0-42BBC6EE9B6F} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000088af0e747e0f3140b04904a9ef560f690000000002000000000010660000000100002000000058ea354c2dc9fc96ba3879079bc3de95f808e4196a8f86d83c85b65a47cdfc57000000000e8000000002000020000000825b2c43cef5ad65fd4668006e2c55e03a500673a7db5ba4ee913fbf868d78ba200000001e5c4088fcf0fe16fb922f6e3459636284ed6d09b7fa522ee4f0e5c79c1611c940000000e4350f5ad98b774388f298f068ab100e6a3487077789cbddeb245a1e35ba28b984252de9dd18a4f64134b33e98e65a3a9412a3bf4acbc9d507947cffebe7aa06	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000088af0e747e0f3140b04904a9ef560f6900000000020000000000106600000001000020000000721f579f99a02c5f5ac047e7b56a0c494c8ad13208028a5814a5b6d39c3818cb000000000e8000000002000020000000fd4733959482fb02419a6129e588f54fc92405dd174c0f8d4b25d8ac6c7d5bbc90000000fdbcfc6adb48ca835676f9b8b5946b7f6325cb813c2725cde15c92cf6444e75738ad9e93980b252f41bc8a0128dc99de94439fc606d73415ea874c701967e865622abd035fb004af066c4ae897d5589ffc5f8d6f00ae57db40c012913d86bbf31b3b61245c483fbf83407de6573e90cad5ed437829a9086039a43af670bdc65c30614c089e4b9c3a969a721daf3a83fd400000006bdb5b84011b6b251b6acf8d71c099a40769d096a1c97a03006ec559dca9f812f8973286fa37428774775540d1c44ad594250628e1e8f7f4a60759469d96a8b3	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "324632312"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe

Modifies system certificate store 2 TTPs 3 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

Processes:

2295742285186ecb7ff7c4634d31bdc8.exe

description	ioc	process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc252000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	2295742285186ecb7ff7c4634d31bdc8.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc35300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a82000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	2295742285186ecb7ff7c4634d31bdc8.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25	2295742285186ecb7ff7c4634d31bdc8.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

2295742285186ecb7ff7c4634d31bdc8.exeservs.tmp

pid process

1056 2295742285186ecb7ff7c4634d31bdc8.exe
1752 servs.tmp
1752 servs.tmp
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

2295742285186ecb7ff7c4634d31bdc8.exe

description pid process

Token: SeDebugPrivilege 1056 2295742285186ecb7ff7c4634d31bdc8.exe
Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

servs.tmpiexplore.exe

pid process

1752 servs.tmp
324 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

324 iexplore.exe
324 iexplore.exe
556 IEXPLORE.EXE
556 IEXPLORE.EXE
556 IEXPLORE.EXE
556 IEXPLORE.EXE

pid	process
1056	2295742285186ecb7ff7c4634d31bdc8.exe
1752	servs.tmp
1752	servs.tmp

description	pid	process
Token: SeDebugPrivilege	1056	2295742285186ecb7ff7c4634d31bdc8.exe

pid	process
1752	servs.tmp
324	iexplore.exe

pid	process
324	iexplore.exe
324	iexplore.exe
556	IEXPLORE.EXE
556	IEXPLORE.EXE
556	IEXPLORE.EXE
556	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 38 IoCs

Processes:

2295742285186ecb7ff7c4634d31bdc8.exe2295742285186ecb7ff7c4634d31bdc8.exeservs.exeservs.tmpiexplore.execmd.exe

description	pid	process	target process
PID 2008 wrote to memory of 1056	2008	2295742285186ecb7ff7c4634d31bdc8.exe	2295742285186ecb7ff7c4634d31bdc8.exe
PID 2008 wrote to memory of 1056	2008	2295742285186ecb7ff7c4634d31bdc8.exe	2295742285186ecb7ff7c4634d31bdc8.exe
PID 2008 wrote to memory of 1056	2008	2295742285186ecb7ff7c4634d31bdc8.exe	2295742285186ecb7ff7c4634d31bdc8.exe
PID 2008 wrote to memory of 1056	2008	2295742285186ecb7ff7c4634d31bdc8.exe	2295742285186ecb7ff7c4634d31bdc8.exe
PID 2008 wrote to memory of 1056	2008	2295742285186ecb7ff7c4634d31bdc8.exe	2295742285186ecb7ff7c4634d31bdc8.exe
PID 2008 wrote to memory of 1056	2008	2295742285186ecb7ff7c4634d31bdc8.exe	2295742285186ecb7ff7c4634d31bdc8.exe
PID 2008 wrote to memory of 1056	2008	2295742285186ecb7ff7c4634d31bdc8.exe	2295742285186ecb7ff7c4634d31bdc8.exe
PID 2008 wrote to memory of 1056	2008	2295742285186ecb7ff7c4634d31bdc8.exe	2295742285186ecb7ff7c4634d31bdc8.exe
PID 2008 wrote to memory of 1056	2008	2295742285186ecb7ff7c4634d31bdc8.exe	2295742285186ecb7ff7c4634d31bdc8.exe
PID 1056 wrote to memory of 916	1056	2295742285186ecb7ff7c4634d31bdc8.exe	servs.exe
PID 1056 wrote to memory of 916	1056	2295742285186ecb7ff7c4634d31bdc8.exe	servs.exe
PID 1056 wrote to memory of 916	1056	2295742285186ecb7ff7c4634d31bdc8.exe	servs.exe
PID 1056 wrote to memory of 916	1056	2295742285186ecb7ff7c4634d31bdc8.exe	servs.exe
PID 1056 wrote to memory of 916	1056	2295742285186ecb7ff7c4634d31bdc8.exe	servs.exe
PID 1056 wrote to memory of 916	1056	2295742285186ecb7ff7c4634d31bdc8.exe	servs.exe
PID 1056 wrote to memory of 916	1056	2295742285186ecb7ff7c4634d31bdc8.exe	servs.exe
PID 1056 wrote to memory of 324	1056	2295742285186ecb7ff7c4634d31bdc8.exe	iexplore.exe
PID 1056 wrote to memory of 324	1056	2295742285186ecb7ff7c4634d31bdc8.exe	iexplore.exe
PID 1056 wrote to memory of 324	1056	2295742285186ecb7ff7c4634d31bdc8.exe	iexplore.exe
PID 1056 wrote to memory of 324	1056	2295742285186ecb7ff7c4634d31bdc8.exe	iexplore.exe
PID 916 wrote to memory of 1752	916	servs.exe	servs.tmp
PID 916 wrote to memory of 1752	916	servs.exe	servs.tmp
PID 916 wrote to memory of 1752	916	servs.exe	servs.tmp
PID 916 wrote to memory of 1752	916	servs.exe	servs.tmp
PID 916 wrote to memory of 1752	916	servs.exe	servs.tmp
PID 916 wrote to memory of 1752	916	servs.exe	servs.tmp
PID 916 wrote to memory of 1752	916	servs.exe	servs.tmp
PID 1752 wrote to memory of 1216	1752	servs.tmp	cmd.exe
PID 1752 wrote to memory of 1216	1752	servs.tmp	cmd.exe
PID 1752 wrote to memory of 1216	1752	servs.tmp	cmd.exe
PID 1752 wrote to memory of 1216	1752	servs.tmp	cmd.exe
PID 324 wrote to memory of 556	324	iexplore.exe	IEXPLORE.EXE
PID 324 wrote to memory of 556	324	iexplore.exe	IEXPLORE.EXE
PID 324 wrote to memory of 556	324	iexplore.exe	IEXPLORE.EXE
PID 324 wrote to memory of 556	324	iexplore.exe	IEXPLORE.EXE
PID 1216 wrote to memory of 1360	1216	cmd.exe	timeout.exe
PID 1216 wrote to memory of 1360	1216	cmd.exe	timeout.exe
PID 1216 wrote to memory of 1360	1216	cmd.exe	timeout.exe

C:\Users\Admin\AppData\Local\Temp\2295742285186ecb7ff7c4634d31bdc8.exe
"C:\Users\Admin\AppData\Local\Temp\2295742285186ecb7ff7c4634d31bdc8.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2008

C:\Users\Admin\AppData\Local\Temp\2295742285186ecb7ff7c4634d31bdc8.exe
"{path}"
2⤵
- Loads dropped DLL
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1056

C:\Users\Admin\AppData\Local\Temp\servs.exe
"C:\Users\Admin\AppData\Local\Temp\servs.exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:916

C:\Users\Admin\AppData\Local\Temp\is-9KFLL.tmp\servs.tmp
"C:\Users\Admin\AppData\Local\Temp\is-9KFLL.tmp\servs.tmp" /SL5="$60130,10541093,724480,C:\Users\Admin\AppData\Local\Temp\servs.exe"
4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1752

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe" /C ""C:\ProgramData\uacwev.bat""
5⤵
- Suspicious use of WriteProcessMemory
PID:1216

C:\Windows\system32\timeout.exe
TIMEOUT /T 8
6⤵
- Delays execution with timeout.exe
PID:1360

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://iplogger.org/1x8vh7
3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:324

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:324 CREDAT:275457 /prefetch:2
4⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:556

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Install Root Certificate

T1130

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Web Service

T1102

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\pass.exe
MD5
a5e2bb848405dfc3a56fc892b691b614

SHA1
7bc55828682e93191d6ee4c20e727308d0eeac6d

SHA256
ea5982c7dd3396d89d54ba0f0269b96807ab59111c22503ca5f9e593b78660f3

SHA512
0502630b436079ab2660134e6545ef18fc4b0927073b274e3fc4c706f49c417ad36ddd8f166c4a016ac0fa0065b88f75a921bee3e7029a9a5cb051a5faa7a954

Download Submit
C:\ProgramData\uacwev.bat
MD5
ace1a6c2ea9446d1bd4b645d00bc2c46

SHA1
a9c41e189775db5a507785c1c527ff9fb7a07bd6

SHA256
2b875f4d5f0722425969fd5963fa0276a101ce63ddb91e5960f2860ab0aedbf4

SHA512
1fba8400d354a46fe3e1b19f8a4d817df1ef4c1289d42a8a2257af45838b6b468a0632b9f31239fc45de11771aa9d9fb0b803a6cda359b14c24fb05f71bddbb2

Download Submit
C:\ProgramData\uxtheme.dll
MD5
531fcc0848cf13fa300600df16a71a87

SHA1
20bff8b5030d74afba1b4c20b5c8cc6f75011b62

SHA256
5b192bbc069b8aef74dabb1dd5459bda8ea2a64a7336db54e57afb38569ece68

SHA512
af8b8bbc666ce3c57e248acf056a3c65b2e4eea244c3c8dbb2d3765964407af93478a3d452a08862501f61994c964dd6048720742413506952395143841673e3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
MD5
61a03d15cf62612f50b74867090dbe79

SHA1
15228f34067b4b107e917bebaf17cc7c3c1280a8

SHA256
f9e23dc21553daa34c6eb778cd262831e466ce794f4bea48150e8d70d3e6af6d

SHA512
5fece89ccbbf994e4f1e3ef89a502f25a72f359d445c034682758d26f01d9f3aa20a43010b9a87f2687da7ba201476922aa46d4906d442d56eb59b2b881259d3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
MD5
c8856f1bfa55208e0e0360c5c2527192

SHA1
6f8841869425b035018714dda305c75e450cf53f

SHA256
d1653b3e1bb80efafa7a7d0c30210f0670c834e3fd57ea92636030f2e7420beb

SHA512
afb80776f2a24e7105e55c3b0777949510ed2a6fc51f2bdb847a1fc002766bf346c5bd9d38fca264695caae04d4fc4bdd6cc93a570d6f8b1f61fe1ac96fe2e8e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
MD5
348a7c5122a50dd3bd13e6dff4171496

SHA1
b99a4792da15351b9e295867f8298100817cc792

SHA256
060042911e7225ae2b42a544202ff74e8f2ce7ac53ca3fd77152dce33a692d3d

SHA512
a7fdceabb00c03818dbec1519cb89d9d8ff424fa18dbd25d2a65539927be41d6257dd150f5766be608b6e56605dd870a4938a623201e38a11de92138379dfd96

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\w5ukms8\imagestore.dat
MD5
1ca2ce464873fd66b3eea4c1630f9db2

SHA1
599e6810975215a1e4e308d6228082bbbd3e1888

SHA256
4cd2f3ac29ca059d716ceecd1887c939fa9ccc728a9217c06fd25c2363b32cc8

SHA512
c417e5b87d15d3592b4d15bc5024a87c008efaa1d9901cac75a0b9e47cf883552be5119bc2c84c08e156092060bb035dcc3214ad484ce18b0098c17e1b0d9965

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-9KFLL.tmp\servs.tmp
MD5
c1b49299eb51afa1264d69fc022bb49b

SHA1
8126de1c2b2ec7d2ddd83735067aef2eefa77b37

SHA256
03b49d8261ed6fbfd23c6f1233e6c7fa131ff067d059fde696be60105286a895

SHA512
893e32f9a13c7b2b4e260c8acb6027fa3aa74c8268666012240aacbae2cbbf045b33cb256958a9ab230f0654c5452e4c3e114727e853431f63ec5d47719a9f60

Download Submit
C:\Users\Admin\AppData\Local\Temp\servs.exe
MD5
6df7008811f88eeb253064a99c79f234

SHA1
41744103d74456cb63397841ef25945ca9e553bf

SHA256
4be7dd4ecb8434b14e36f0f747eddd8b98435e98f3d664f6206223e54d212a1a

SHA512
1f26e014ea7382c5d61c8f758d4afb428af096a10a8795bf7cfe7d1221dd73a8d56b18b033d4fe82f178dc7ce309ceaad83bf0178db300bec5f6fd42d1952482

Download Submit
C:\Users\Admin\AppData\Local\Temp\servs.exe
MD5
6df7008811f88eeb253064a99c79f234

SHA1
41744103d74456cb63397841ef25945ca9e553bf

SHA256
4be7dd4ecb8434b14e36f0f747eddd8b98435e98f3d664f6206223e54d212a1a

SHA512
1f26e014ea7382c5d61c8f758d4afb428af096a10a8795bf7cfe7d1221dd73a8d56b18b033d4fe82f178dc7ce309ceaad83bf0178db300bec5f6fd42d1952482

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\9KKQEY5F.txt
MD5
cefbd9ed3affd582ef93f49fae716ea2

SHA1
2957b64a4dd3aa3ae6fd3585e585f0bcc36299cf

SHA256
0a5dc0685afa9b7a4f2a3fdef74ffbfa7bb83ef3d83494d3518741f3c0febd11

SHA512
82b070f70ff343469a7a96f7d71d85d5a8294f9ed753c5782234e05237873cc80c70f83b0155ffd2b6775f7a1b6e8e71dc5a2a007415ce85f917e39ba5d433c4

Download Submit
\Users\Admin\AppData\Local\Temp\is-9KFLL.tmp\servs.tmp
MD5
c1b49299eb51afa1264d69fc022bb49b

SHA1
8126de1c2b2ec7d2ddd83735067aef2eefa77b37

SHA256
03b49d8261ed6fbfd23c6f1233e6c7fa131ff067d059fde696be60105286a895

SHA512
893e32f9a13c7b2b4e260c8acb6027fa3aa74c8268666012240aacbae2cbbf045b33cb256958a9ab230f0654c5452e4c3e114727e853431f63ec5d47719a9f60

Download Submit
\Users\Admin\AppData\Local\Temp\servs.exe
MD5
6df7008811f88eeb253064a99c79f234

SHA1
41744103d74456cb63397841ef25945ca9e553bf

SHA256
4be7dd4ecb8434b14e36f0f747eddd8b98435e98f3d664f6206223e54d212a1a

SHA512
1f26e014ea7382c5d61c8f758d4afb428af096a10a8795bf7cfe7d1221dd73a8d56b18b033d4fe82f178dc7ce309ceaad83bf0178db300bec5f6fd42d1952482

Download Submit
memory/324-19-0x0000000000000000-mapping.dmp

Download
memory/556-30-0x0000000000000000-mapping.dmp

Download
memory/916-25-0x0000000000401000-0x00000000004A9000-memory.dmp

Filesize
672KB

Download
memory/916-16-0x0000000000000000-mapping.dmp

Download
memory/916-18-0x0000000076641000-0x0000000076643000-memory.dmp

Filesize
8KB

Download
memory/1056-11-0x0000000074BA0000-0x000000007528E000-memory.dmp

Filesize
6.9MB

Download
memory/1056-14-0x0000000004ED0000-0x0000000004ED1000-memory.dmp

Filesize
4KB

Download
memory/1056-12-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1056-9-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1056-10-0x000000000041653A-mapping.dmp

Download
memory/1216-29-0x0000000000000000-mapping.dmp

Download
memory/1360-33-0x0000000000000000-mapping.dmp

Download
memory/1752-26-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/1752-28-0x000000006D1F1000-0x000000006D1F3000-memory.dmp

Filesize
8KB

Download
memory/1752-22-0x0000000000000000-mapping.dmp

Download
memory/1932-27-0x000007FEF7B20000-0x000007FEF7D9A000-memory.dmp

Filesize
2.5MB

Download
memory/2008-2-0x0000000074BA0000-0x000000007528E000-memory.dmp

Filesize
6.9MB

Download
memory/2008-8-0x0000000002040000-0x0000000002096000-memory.dmp

Filesize
344KB

Download
memory/2008-7-0x00000000057D0000-0x0000000005873000-memory.dmp

Filesize
652KB

Download
memory/2008-6-0x00000000003F0000-0x00000000003F5000-memory.dmp

Filesize
20KB

Download
memory/2008-5-0x0000000004C40000-0x0000000004C41000-memory.dmp

Filesize
4KB

Download
memory/2008-3-0x0000000000900000-0x0000000000901000-memory.dmp

Filesize
4KB

Download