selected-jobs.xls

General
Target

selected-jobs.xls

Filesize

1MB

Completed

19-04-2021 09:54

Score
10 /10
MD5

4ab1efff60052e63eaace56a29413b62

SHA1

6e574a62a5ca46e5e2a8c3861feb3a4ef0b6e866

SHA256

eb6f84aa58fd61f76d3920f777607b242bb2fc132f6dbd7a84fdb7452f6a9605

Malware Config

Extracted

Family gozi_rm3
Botnet 210306
C2

https://getroad.xyz

Attributes
build
300960
exe_type
loader
non_target_locale
RU
server_id
12
url_path
index.htm
rsa_pubkey.plain
serpent.plain
Signatures 12

Filter: none

Defense Evasion
Discovery
  • Gozi RM3

    Description

    A heavily modified version of Gozi using RM3 loader.

  • Process spawned unexpected child process
    rundll32.exe

    Description

    This typically indicates the parent process was compromised via an exploit or macro.

    Reported IOCs

    descriptionpidpid_targetprocesstarget process
    Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process17963164rundll32.exeEXCEL.EXE
  • Blocklisted process makes network request
    rundll32.exe

    Reported IOCs

    flowpidprocess
    391808rundll32.exe
  • Downloads MZ/PE file
  • Loads dropped DLL
    rundll32.exe

    Reported IOCs

    pidprocess
    1808rundll32.exe
  • Checks processor information in registry
    EXCEL.EXE

    Description

    Processor information is often read in order to detect sandboxing environments.

    TTPs

    Query RegistrySystem Information Discovery

    Reported IOCs

    descriptioniocprocess
    Key opened\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0EXCEL.EXE
    Key value queried\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHzEXCEL.EXE
    Key value queried\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameStringEXCEL.EXE
  • Enumerates system info in registry
    EXCEL.EXE

    TTPs

    Query RegistrySystem Information Discovery

    Reported IOCs

    descriptioniocprocess
    Key opened\REGISTRY\MACHINE\Hardware\Description\System\BIOSEXCEL.EXE
    Key value queried\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamilyEXCEL.EXE
    Key value queried\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKUEXCEL.EXE
  • Modifies Internet Explorer settings
    iexplore.exeiexplore.exeIEXPLORE.EXEiexplore.exeiexplore.exeIEXPLORE.EXEiexplore.exeiexplore.exeIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXE

    TTPs

    Modify Registry

    Reported IOCs

    descriptioniocprocess
    Key created\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Mainiexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearchiexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPageiexplore.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{36EA96B1-A106-11EB-B2DB-FE963E078230} = "0"iexplore.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "190219117"iexplore.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30881043"iexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPageiexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\MainIEXPLORE.EXE
    Set value (int)\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"iexplore.exe
    Set value (str)\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"iexplore.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"iexplore.exe
    Set value (str)\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"iexplore.exe
    Set value (str)\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"iexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\MainIEXPLORE.EXE
    Set value (str)\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"IEXPLORE.EXE
    Key created\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecoveryiexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPageiexplore.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"iexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearchiexplore.exe
    Set value (str)\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"IEXPLORE.EXE
    Set value (data)\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007c369e1f7dd80e4a838305ff88bb1ffa000000000200000000001066000000010000200000001fd2c0e04e5b665fa829bace744b83862c8a812cdfd87003c1760030088ac1bd000000000e80000000020000200000008420ce4e861f4e1c88c51e3802c7deeaa2abe3292c9724f3f68624137a9ed8afa0000000d8c0455dcb4d93937f6abf88ff52d404b0620f70877210a92d50b0cc87096dca0d563083675d0fcd521720718855ba89e80232842f4c3dba2c74ec6dbb47423aad2b1e714cd8bd636a14d184df85fc6776bca103cca55486b5a84b0135224893ea1a7ba6abd9063bc2d5cd3365c9c03bd00ac3a6d4bad3ef5fb1555149b8e7be1faa1017b44a12a54875c0a94460c3dcb3c1e225e577d0b4d7c4a05ae0f9f00640000000253d183ee39865f7fa3d3332639849546b0b28e09d79a27e1e3605fddd79facc006331d7f74b2a2c5378c4f984994e03ca1d5f5219bbfc80f51b39c1b5ffe2ffiexplore.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"iexplore.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"iexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPageiexplore.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6D801454-A106-11EB-B2DB-FE963E078230} = "0"iexplore.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"iexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearchIEXPLORE.EXE
    Key created\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\MINIEiexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\MainIEXPLORE.EXE
    Set value (str)\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"iexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecoveryiexplore.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"iexplore.exe
    Set value (data)\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e02515141335d701iexplore.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{523B6806-A106-11EB-B2DB-FE963E078230} = "0"iexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\MINIEiexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\MainIEXPLORE.EXE
    Key created\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManageriexplore.exe
    Set value (data)\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007c369e1f7dd80e4a838305ff88bb1ffa00000000020000000000106600000001000020000000da3c291fd661b527b180c419d26477154f9e7193c7f048ab375c1639facd0da7000000000e8000000002000020000000758602c491edc90f54eceb358c164524f6ce6707ec097a81f9b4dd68e80f2f32a000000036583b21fa73631c013eb5c67425b4910611a054c938952fa7f5d70c7e216c6a09dfcfbab31e2af4e672058635ae4a995bc0bb4e301f1ac3065932050b62e0815b25b4be0e6a2477bf5b532a8beb9189fcfdd4d99981a74dcce76de0492b51776fd11c6600fe789c1dd5fc3c678551d4536c7c0d18662277a1e21b6a6889321e97b89f06c6ce51f3258710d1c20b73751e06c9b3285155e66bf063a3240177b4400000000220e1aaee50fde0b25557e1e102c2d325b28f5ac8ebc6c29ab0ca059a2d2762cd325cbd6fa112c43d6eb0ebb3998947ee0c76d50b3cb0ec4cd064f00f0fcc8biexplore.exe
    Set value (str)\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"iexplore.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"iexplore.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"iexplore.exe
    Set value (data)\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007c369e1f7dd80e4a838305ff88bb1ffa000000000200000000001066000000010000200000009d190711611e1c45857c7c81311da512ca3029e2e6fdc8fdb5392b77accce269000000000e800000000200002000000067c9d547ed3dd935c029547d1cb9f96d104b06aea27938c6bac9ebaa69ff3db9a0000000936efde3bcf6f4fa60d0adffecc190c3c317ddb3a7d268ad1792fded0f5ccc4e25e229c98c9fb0f0ee6c80810a38760a9b4427775365d1ad1f5b720904e2b4b95e48b096b6fcf227bcc478f8a2c0ca507f9254647936a61178bc2330c146c7993543df71c906209f555c14a669c0803dee6c423b73e28b63968465d92e050f4c429c4c0b6b2a9520415a5a90213f08a583a7da9b65d25118e180d2db32ed74ca400000000d64bbc8e198319afa2d6db7a73c46e59895ac5d095411c11f1a2930336f3d798457b40de881a08f773e9f4e9405f21c3676426bf76a160aa1c556bf8e080d20iexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Mainiexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearchiexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPageiexplore.exe
    Set value (str)\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"iexplore.exe
    Set value (data)\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 209e92151335d701iexplore.exe
    Set value (data)\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007c369e1f7dd80e4a838305ff88bb1ffa00000000020000000000106600000001000020000000f2940247d8b9af8467f1fe3b30212b2999b593b0e3283b3fb5d046d7f2e65fd0000000000e80000000020000200000001f50c5366fd3aa40eb3df62a4d22605a73c943e057a3c5755df908ba5f85ac3ba0000000224eeaf73241c791d046db7fc366649d39de252c90693b94ac4cea5dc7d18b54b9494871b32d74bada7ddfd5c88ace79ff2461cbb9196cdb9a583de2f6fcf5062b52bc0ce75f73eb22a4b3354a721a92ccff196a6fe83d319844afb8ca1ed13d968455ded174fe710f0b0052efba2fb1aa866e7e139f7a72e3c45e00ecb21a809ab0294b3e8108189317628f40d29c57c7699af64546227fb504dedf5c1d1dba400000001140f9f2250f30bba657bbc21be266555648b30dab26e837fdff513851a5904e11a9f61ebac28295b05aa1585ca6933332118156e40ac0cf30dfb1489617c63aiexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecoveryiexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearchiexplore.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30881043"iexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActiveiexplore.exe
    Set value (data)\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20e7fa131335d701iexplore.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"iexplore.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"iexplore.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"iexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Mainiexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearchIEXPLORE.EXE
    Set value (int)\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"iexplore.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"iexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Mainiexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActiveiexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\MainIEXPLORE.EXE
    Set value (int)\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "190219117"iexplore.exe
  • Suspicious behavior: AddClipboardFormatListener
    EXCEL.EXE

    Reported IOCs

    pidprocess
    3164EXCEL.EXE
  • Suspicious use of FindShellTrayWindow
    iexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exe

    Reported IOCs

    pidprocess
    2292iexplore.exe
    2364iexplore.exe
    2844iexplore.exe
    2232iexplore.exe
    2560iexplore.exe
    2592iexplore.exe
  • Suspicious use of SetWindowsHookEx
    EXCEL.EXEiexplore.exeIEXPLORE.EXEiexplore.exeIEXPLORE.EXEiexplore.exeIEXPLORE.EXEiexplore.exeIEXPLORE.EXEiexplore.exeIEXPLORE.EXEiexplore.exeIEXPLORE.EXE

    Reported IOCs

    pidprocess
    3164EXCEL.EXE
    3164EXCEL.EXE
    3164EXCEL.EXE
    3164EXCEL.EXE
    3164EXCEL.EXE
    3164EXCEL.EXE
    3164EXCEL.EXE
    3164EXCEL.EXE
    2292iexplore.exe
    2292iexplore.exe
    3156IEXPLORE.EXE
    3156IEXPLORE.EXE
    3164EXCEL.EXE
    3164EXCEL.EXE
    3164EXCEL.EXE
    3164EXCEL.EXE
    2364iexplore.exe
    2364iexplore.exe
    2272IEXPLORE.EXE
    2272IEXPLORE.EXE
    2844iexplore.exe
    2844iexplore.exe
    188IEXPLORE.EXE
    188IEXPLORE.EXE
    2232iexplore.exe
    2232iexplore.exe
    3076IEXPLORE.EXE
    3076IEXPLORE.EXE
    2560iexplore.exe
    2560iexplore.exe
    2628IEXPLORE.EXE
    2628IEXPLORE.EXE
    2592iexplore.exe
    2592iexplore.exe
    492IEXPLORE.EXE
    492IEXPLORE.EXE
  • Suspicious use of WriteProcessMemory
    EXCEL.EXErundll32.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 3164 wrote to memory of 17963164EXCEL.EXErundll32.exe
    PID 3164 wrote to memory of 17963164EXCEL.EXErundll32.exe
    PID 1796 wrote to memory of 18081796rundll32.exerundll32.exe
    PID 1796 wrote to memory of 18081796rundll32.exerundll32.exe
    PID 1796 wrote to memory of 18081796rundll32.exerundll32.exe
    PID 2292 wrote to memory of 31562292iexplore.exeIEXPLORE.EXE
    PID 2292 wrote to memory of 31562292iexplore.exeIEXPLORE.EXE
    PID 2292 wrote to memory of 31562292iexplore.exeIEXPLORE.EXE
    PID 2364 wrote to memory of 22722364iexplore.exeIEXPLORE.EXE
    PID 2364 wrote to memory of 22722364iexplore.exeIEXPLORE.EXE
    PID 2364 wrote to memory of 22722364iexplore.exeIEXPLORE.EXE
    PID 2844 wrote to memory of 1882844iexplore.exeIEXPLORE.EXE
    PID 2844 wrote to memory of 1882844iexplore.exeIEXPLORE.EXE
    PID 2844 wrote to memory of 1882844iexplore.exeIEXPLORE.EXE
    PID 2232 wrote to memory of 30762232iexplore.exeIEXPLORE.EXE
    PID 2232 wrote to memory of 30762232iexplore.exeIEXPLORE.EXE
    PID 2232 wrote to memory of 30762232iexplore.exeIEXPLORE.EXE
    PID 2560 wrote to memory of 26282560iexplore.exeIEXPLORE.EXE
    PID 2560 wrote to memory of 26282560iexplore.exeIEXPLORE.EXE
    PID 2560 wrote to memory of 26282560iexplore.exeIEXPLORE.EXE
    PID 2592 wrote to memory of 4922592iexplore.exeIEXPLORE.EXE
    PID 2592 wrote to memory of 4922592iexplore.exeIEXPLORE.EXE
    PID 2592 wrote to memory of 4922592iexplore.exeIEXPLORE.EXE
Processes 15
  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\selected-jobs.xls"
    Checks processor information in registry
    Enumerates system info in registry
    Suspicious behavior: AddClipboardFormatListener
    Suspicious use of SetWindowsHookEx
    Suspicious use of WriteProcessMemory
    PID:3164
    • C:\Windows\SYSTEM32\rundll32.exe
      rundll32 ..\ismvxl.woc,DllRegisterServer
      Process spawned unexpected child process
      Suspicious use of WriteProcessMemory
      PID:1796
      • C:\Windows\SysWOW64\rundll32.exe
        rundll32 ..\ismvxl.woc,DllRegisterServer
        Blocklisted process makes network request
        Loads dropped DLL
        PID:1808
  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
    Modifies Internet Explorer settings
    Suspicious use of FindShellTrayWindow
    Suspicious use of SetWindowsHookEx
    Suspicious use of WriteProcessMemory
    PID:2292
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2292 CREDAT:82945 /prefetch:2
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:3156
  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
    Modifies Internet Explorer settings
    Suspicious use of FindShellTrayWindow
    Suspicious use of SetWindowsHookEx
    Suspicious use of WriteProcessMemory
    PID:2364
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2364 CREDAT:82945 /prefetch:2
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:2272
  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
    Modifies Internet Explorer settings
    Suspicious use of FindShellTrayWindow
    Suspicious use of SetWindowsHookEx
    Suspicious use of WriteProcessMemory
    PID:2844
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2844 CREDAT:82945 /prefetch:2
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:188
  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
    Modifies Internet Explorer settings
    Suspicious use of FindShellTrayWindow
    Suspicious use of SetWindowsHookEx
    Suspicious use of WriteProcessMemory
    PID:2232
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2232 CREDAT:82945 /prefetch:2
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:3076
  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
    Modifies Internet Explorer settings
    Suspicious use of FindShellTrayWindow
    Suspicious use of SetWindowsHookEx
    Suspicious use of WriteProcessMemory
    PID:2560
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2560 CREDAT:82945 /prefetch:2
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:2628
  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
    Modifies Internet Explorer settings
    Suspicious use of FindShellTrayWindow
    Suspicious use of SetWindowsHookEx
    Suspicious use of WriteProcessMemory
    PID:2592
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2592 CREDAT:82945 /prefetch:2
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:492
Network
MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
        Execution
          Exfiltration
            Impact
              Initial Access
                Lateral Movement
                  Persistence
                    Privilege Escalation
                      Replay Monitor
                      00:00 00:00
                      Downloads
                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\644B8874112055B5E195ECB0E8F243A4

                        MD5

                        d1b1f562e42dd37c408c0a3c7ccfe189

                        SHA1

                        c01e61a5c5f44fb038228b7e542f6a8d7c8c283d

                        SHA256

                        7f468f04fe5a1b0616685f157a4285090b6ed3858d4cd9efe915aaeed83c158e

                        SHA512

                        404d279fabd4886008e47e9138f799cf398f0aa4c8556192d6e45dbcde99eac2cd65c47b9e0b88bd6d3a6529818f6048a23a197a913fb917b19dffbbd5d75850

                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\644B8874112055B5E195ECB0E8F243A4

                        MD5

                        83225bcb7c7cd66c9f4b5a784b73e182

                        SHA1

                        e5fec26150bf6aa4ff3539224d940501fa83b85d

                        SHA256

                        b7eb6b6a19733728b03e818ab60d91a4de11de48230ce5d6a612e2cd5622bc1d

                        SHA512

                        b6259517e4695d2fad580453789718406a2d0e52db1eeb8dc9377b67dc537d2956648f58b9d55a82aeec08f3d817848113f2266cc5fd5e6b62ab509cf44a4901

                      • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-314712940\msapplication.xml

                        MD5

                        143c3e0f050b28abe67d081571648ec5

                        SHA1

                        a863987ea723b796d5e68580968766c7a95666ba

                        SHA256

                        e4b0d2df86d0642ffa17dfce013f25ec6ea8ea04057f2522eea2ae16ecb3e683

                        SHA512

                        e036d2542104927c81a5420fe8bf3931c41c3eb5f97ee13e3a9dda444301aba6eb54de2273f5d0a053099f2b5212a1f90e51d95d145adbaf1d9b220809f57a9f

                      • C:\Users\Admin\ismvxl.woc

                        MD5

                        5a52b1494c7929a2ef4d2e6d485358e8

                        SHA1

                        a78dbd06aef4815e272f476695989706a5432e8d

                        SHA256

                        e4fdba0b24b4184ddafe6add29b6d3415e26422e3752a81d049cb888791aabf3

                        SHA512

                        d9d76e7ef16394af4576f187cab4fc5e6653c62c4bb092a76a4c0cc4d9209f31b13eeed3533d5e13c969bc7cc7fcd436867cca345fd3677f953f488a91b0eb25

                      • \Users\Admin\ismvxl.woc

                        MD5

                        5a52b1494c7929a2ef4d2e6d485358e8

                        SHA1

                        a78dbd06aef4815e272f476695989706a5432e8d

                        SHA256

                        e4fdba0b24b4184ddafe6add29b6d3415e26422e3752a81d049cb888791aabf3

                        SHA512

                        d9d76e7ef16394af4576f187cab4fc5e6653c62c4bb092a76a4c0cc4d9209f31b13eeed3533d5e13c969bc7cc7fcd436867cca345fd3677f953f488a91b0eb25

                      • memory/188-190-0x0000000000000000-mapping.dmp

                      • memory/492-193-0x0000000000000000-mapping.dmp

                      • memory/1796-179-0x0000000000000000-mapping.dmp

                      • memory/1808-183-0x0000000002FD0000-0x0000000002FDC000-memory.dmp

                      • memory/1808-181-0x0000000000000000-mapping.dmp

                      • memory/1808-184-0x0000000002FF0000-0x0000000002FFF000-memory.dmp

                      • memory/2272-188-0x0000000000000000-mapping.dmp

                      • memory/2628-192-0x0000000000000000-mapping.dmp

                      • memory/3076-191-0x0000000000000000-mapping.dmp

                      • memory/3156-185-0x0000000000000000-mapping.dmp

                      • memory/3164-123-0x0000025CE5100000-0x0000025CE6FF5000-memory.dmp

                      • memory/3164-117-0x00007FFB7C310000-0x00007FFB7C320000-memory.dmp

                      • memory/3164-118-0x00007FFB7C310000-0x00007FFB7C320000-memory.dmp

                      • memory/3164-116-0x00007FFB7C310000-0x00007FFB7C320000-memory.dmp

                      • memory/3164-115-0x00007FFB7C310000-0x00007FFB7C320000-memory.dmp

                      • memory/3164-119-0x00007FFB7C310000-0x00007FFB7C320000-memory.dmp

                      • memory/3164-122-0x00007FFB9C6D0000-0x00007FFB9D7BE000-memory.dmp

                      • memory/3164-114-0x00007FF6011A0000-0x00007FF604756000-memory.dmp