netsupport | hxxps://google[.]com

Analysis

max time kernel
147s
max time network
150s
platform
windows10_x64
resource
win10v20210410
submitted
06-05-2021 11:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://google.com
Sample

210506-k28jje3eyj

Score

10^/10

netsupport persistence rat

Malware Config

Signatures

NetSupport
NetSupport is a remote access tool sold as a legitimate system administration software.
rat netsupport
Blocklisted process makes network request 2 IoCs

Processes:

WScript.exe

flow pid process

119 3752 WScript.exe
121 3752 WScript.exe
Executes dropped EXE 1 IoCs

Processes:

ctfmon.exe

pid process

5016 ctfmon.exe
Loads dropped DLL 6 IoCs

Processes:

ctfmon.exe

pid process

5016 ctfmon.exe
5016 ctfmon.exe
5016 ctfmon.exe
5016 ctfmon.exe
5016 ctfmon.exe
5016 ctfmon.exe

flow	pid	process
119	3752	WScript.exe
121	3752	WScript.exe

pid	process
5016	ctfmon.exe

pid	process
5016	ctfmon.exe
5016	ctfmon.exe
5016	ctfmon.exe
5016	ctfmon.exe
5016	ctfmon.exe
5016	ctfmon.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

powershell.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run\ctfmon_ = "C:\\Users\\Admin\\AppData\\Roaming\\ehv137aC\\ctfmon.exe"	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

firefox.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Modifies Internet Explorer Phishing Filter 1 TTPs 2 IoCs

Modify Registry

T1112

Processes:

iexplore.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\PhishingFilter\ClientSupported_MigrationTime = 339704ea112ed701	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\PhishingFilter	iexplore.exe

Modifies Internet Explorer settings 1 TTPs 64 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\DOMStorage\mauricesfurniture.com\Total = "245"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3661476191"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "637"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30884461"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.mauricesfurniture.com\ = "200"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com\Total = "579"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ad98e1c4c5c1f64cbad3c833b8884b2700000000020000000000106600000001000020000000ac7e2a9d8e5cd92c9e8fe43abb1c268107a77d6f0f76dc4f02da3a2851910dc1000000000e800000000200002000000090a087f3b5790412df3b2a4f8759ffd245d9e9915447801d3354b9d6cf64daa8200000005cc189a52fe0523d78256453d37e530ef7e275406441538a0fdb2c971cb301204000000009e3af30db515a7089332d31f46e8c9e99405d9e6ea32e4d9f721a1640e8c684010f0c0ba4abae5d44187822092d79b2cad0b320b6cb8fc492ded27424ae8655	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "370"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead\NextUpdateDate = "327115290"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3661476191"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com\Total = "125"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\DOMStorage\mauricesfurniture.com\Total = "145"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "653"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com\Total = "637"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0554099A-AE61-11EB-A11C-E62B3DD6123B} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\DOMStorage\mauricesfurniture.com\Total = "171"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.google.com\ = "653"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "80"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "244"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.mauricesfurniture.com\ = "171"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.mauricesfurniture.com\ = "232"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$MediaWiki	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$http://www.typepad.com/	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "573"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "647"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "218"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$vBulletin 3	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$vBulletin 4	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.mauricesfurniture.com\ = "145"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com\Total = "6"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "643"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead\FileVersion = "2016061511"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\DOMStorage\mauricesfurniture.com\Total = "93"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "270"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.mauricesfurniture.com\ = "245"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com\Total = "653"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "357"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "192"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "378"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ad98e1c4c5c1f64cbad3c833b8884b2700000000020000000000106600000001000020000000b76b26567d361391bc61915575e1567483aa8b6959e52f55dbedd293b6742306000000000e800000000200002000000021f2fa417362d95dbe375d959cc7f08bc85e6fec22d95d091416e66efcd81096200000007a0ddaaab196b08948d17317e6b502bde807f245b021b3780c6a4953fd860eb740000000d2f81aca1d7c03e319b4190defc45994ef0e83e7c8ef4b1a8f6ae3c2574ef8f34e6b30676cc437b2db4e4b308be583674d1eb48b39c9e4f9af3292817b560365	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "125"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10a031db6d42d701	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.mauricesfurniture.com\ = "93"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$Telligent	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$WordPress	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "612"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe

Modifies registry class 2 IoCs

Processes:

iexplore.exefirefox.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings	firefox.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

powershell.exe

pid process

4632 powershell.exe
4632 powershell.exe
4632 powershell.exe

pid	process
4632	powershell.exe
4632	powershell.exe
4632	powershell.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

Processes:

IEXPLORE.EXEAUDIODG.EXEfirefox.exepowershell.exectfmon.exe

description	pid	process
Token: SeShutdownPrivilege	2008	IEXPLORE.EXE
Token: SeCreatePagefilePrivilege	2008	IEXPLORE.EXE
Token: SeShutdownPrivilege	2008	IEXPLORE.EXE
Token: SeCreatePagefilePrivilege	2008	IEXPLORE.EXE
Token: 33	2252	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2252	AUDIODG.EXE
Token: SeDebugPrivilege	1176	firefox.exe
Token: SeDebugPrivilege	1176	firefox.exe
Token: SeDebugPrivilege	4632	powershell.exe
Token: SeSecurityPrivilege	5016	ctfmon.exe

Suspicious use of FindShellTrayWindow 7 IoCs

Processes:

iexplore.exefirefox.exectfmon.exe

pid process

3680 iexplore.exe
3680 iexplore.exe
1176 firefox.exe
1176 firefox.exe
1176 firefox.exe
1176 firefox.exe
5016 ctfmon.exe
Suspicious use of SendNotifyMessage 3 IoCs

Processes:

firefox.exe

pid process

1176 firefox.exe
1176 firefox.exe
1176 firefox.exe

pid	process
1176	firefox.exe
1176	firefox.exe
1176	firefox.exe

Suspicious use of SetWindowsHookEx 11 IoCs

Processes:

iexplore.exeIEXPLORE.EXEfirefox.exe

pid	process
3680	iexplore.exe
3680	iexplore.exe
2008	IEXPLORE.EXE
2008	IEXPLORE.EXE
2008	IEXPLORE.EXE
2008	IEXPLORE.EXE
2008	IEXPLORE.EXE
2008	IEXPLORE.EXE
2008	IEXPLORE.EXE
2008	IEXPLORE.EXE
1176	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

iexplore.exefirefox.exefirefox.exe

description	pid	process	target process
PID 3680 wrote to memory of 2008	3680	iexplore.exe	IEXPLORE.EXE
PID 3680 wrote to memory of 2008	3680	iexplore.exe	IEXPLORE.EXE
PID 3680 wrote to memory of 2008	3680	iexplore.exe	IEXPLORE.EXE
PID 3680 wrote to memory of 3752	3680	iexplore.exe	WScript.exe
PID 3680 wrote to memory of 3752	3680	iexplore.exe	WScript.exe
PID 2756 wrote to memory of 1176	2756	firefox.exe	firefox.exe
PID 2756 wrote to memory of 1176	2756	firefox.exe	firefox.exe
PID 2756 wrote to memory of 1176	2756	firefox.exe	firefox.exe
PID 2756 wrote to memory of 1176	2756	firefox.exe	firefox.exe
PID 2756 wrote to memory of 1176	2756	firefox.exe	firefox.exe
PID 2756 wrote to memory of 1176	2756	firefox.exe	firefox.exe
PID 2756 wrote to memory of 1176	2756	firefox.exe	firefox.exe
PID 2756 wrote to memory of 1176	2756	firefox.exe	firefox.exe
PID 2756 wrote to memory of 1176	2756	firefox.exe	firefox.exe
PID 1176 wrote to memory of 744	1176	firefox.exe	firefox.exe
PID 1176 wrote to memory of 744	1176	firefox.exe	firefox.exe
PID 1176 wrote to memory of 2700	1176	firefox.exe	firefox.exe
PID 1176 wrote to memory of 2700	1176	firefox.exe	firefox.exe
PID 1176 wrote to memory of 2700	1176	firefox.exe	firefox.exe
PID 1176 wrote to memory of 2700	1176	firefox.exe	firefox.exe
PID 1176 wrote to memory of 2700	1176	firefox.exe	firefox.exe
PID 1176 wrote to memory of 2700	1176	firefox.exe	firefox.exe
PID 1176 wrote to memory of 2700	1176	firefox.exe	firefox.exe
PID 1176 wrote to memory of 2700	1176	firefox.exe	firefox.exe
PID 1176 wrote to memory of 2700	1176	firefox.exe	firefox.exe
PID 1176 wrote to memory of 2700	1176	firefox.exe	firefox.exe
PID 1176 wrote to memory of 2700	1176	firefox.exe	firefox.exe
PID 1176 wrote to memory of 2700	1176	firefox.exe	firefox.exe
PID 1176 wrote to memory of 2700	1176	firefox.exe	firefox.exe
PID 1176 wrote to memory of 2700	1176	firefox.exe	firefox.exe
PID 1176 wrote to memory of 2700	1176	firefox.exe	firefox.exe
PID 1176 wrote to memory of 2700	1176	firefox.exe	firefox.exe
PID 1176 wrote to memory of 2700	1176	firefox.exe	firefox.exe
PID 1176 wrote to memory of 2700	1176	firefox.exe	firefox.exe
PID 1176 wrote to memory of 2700	1176	firefox.exe	firefox.exe
PID 1176 wrote to memory of 2700	1176	firefox.exe	firefox.exe
PID 1176 wrote to memory of 2700	1176	firefox.exe	firefox.exe
PID 1176 wrote to memory of 2700	1176	firefox.exe	firefox.exe
PID 1176 wrote to memory of 2700	1176	firefox.exe	firefox.exe
PID 1176 wrote to memory of 2700	1176	firefox.exe	firefox.exe
PID 1176 wrote to memory of 2700	1176	firefox.exe	firefox.exe
PID 1176 wrote to memory of 2700	1176	firefox.exe	firefox.exe
PID 1176 wrote to memory of 2700	1176	firefox.exe	firefox.exe
PID 1176 wrote to memory of 2700	1176	firefox.exe	firefox.exe
PID 1176 wrote to memory of 2700	1176	firefox.exe	firefox.exe
PID 1176 wrote to memory of 2700	1176	firefox.exe	firefox.exe
PID 1176 wrote to memory of 2700	1176	firefox.exe	firefox.exe
PID 1176 wrote to memory of 2700	1176	firefox.exe	firefox.exe
PID 1176 wrote to memory of 2700	1176	firefox.exe	firefox.exe
PID 1176 wrote to memory of 2700	1176	firefox.exe	firefox.exe
PID 1176 wrote to memory of 2700	1176	firefox.exe	firefox.exe
PID 1176 wrote to memory of 2700	1176	firefox.exe	firefox.exe
PID 1176 wrote to memory of 2700	1176	firefox.exe	firefox.exe
PID 1176 wrote to memory of 2700	1176	firefox.exe	firefox.exe
PID 1176 wrote to memory of 2700	1176	firefox.exe	firefox.exe
PID 1176 wrote to memory of 2700	1176	firefox.exe	firefox.exe
PID 1176 wrote to memory of 2700	1176	firefox.exe	firefox.exe
PID 1176 wrote to memory of 2700	1176	firefox.exe	firefox.exe
PID 1176 wrote to memory of 2700	1176	firefox.exe	firefox.exe
PID 1176 wrote to memory of 4116	1176	firefox.exe	firefox.exe
PID 1176 wrote to memory of 4116	1176	firefox.exe	firefox.exe
PID 1176 wrote to memory of 4116	1176	firefox.exe	firefox.exe
PID 1176 wrote to memory of 4116	1176	firefox.exe	firefox.exe
PID 1176 wrote to memory of 4116	1176	firefox.exe	firefox.exe

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://google.com
1⤵
- Modifies Internet Explorer Phishing Filter
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3680

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3680 CREDAT:82945 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2008

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\5TQ9Z63L\IE.63b72a.js"
2⤵
- Blocklisted process makes network request
PID:3752

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass -windowstyle hidden -f "C:\Users\Admin\AppData\Local\Temp\8092dff9.ps1"
3⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4632

C:\Users\Admin\AppData\Roaming\ehv137aC\ctfmon.exe
"C:\Users\Admin\AppData\Roaming\ehv137aC\ctfmon.exe"
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5016

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x3fc
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2252

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2756

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
2⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1176

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1176.0.113740543\1520655528" -parentBuildID 20200403170909 -prefsHandle 1552 -prefMapHandle 1524 -prefsLen 1 -prefMapSize 219680 -appdir "C:\Program Files\Mozilla Firefox\browser" - 1176 "\\.\pipe\gecko-crash-server-pipe.1176" 1632 gpu
3⤵
PID:744

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1176.3.1338260463\1617613843" -childID 1 -isForBrowser -prefsHandle 2200 -prefMapHandle 2180 -prefsLen 122 -prefMapSize 219680 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 1176 "\\.\pipe\gecko-crash-server-pipe.1176" 2012 tab
3⤵
PID:2700

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1176.13.325419656\1327622108" -childID 2 -isForBrowser -prefsHandle 3428 -prefMapHandle 3424 -prefsLen 6979 -prefMapSize 219680 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 1176 "\\.\pipe\gecko-crash-server-pipe.1176" 3440 tab
3⤵
PID:4116

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1176.20.1719695966\1310414325" -childID 3 -isForBrowser -prefsHandle 4408 -prefMapHandle 4428 -prefsLen 7907 -prefMapSize 219680 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 1176 "\\.\pipe\gecko-crash-server-pipe.1176" 4392 tab
3⤵
PID:4480

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Query Registry

T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\644B8874112055B5E195ECB0E8F243A4
MD5
9bd290c73c295139470b5a56f8d857bb

SHA1
c838907b18895bc98a601e27c30b5de9acef88e7

SHA256
bfc8f14e57e8fe77f10ec2c420b746a75291c034dd872bc673e459ebfdac5968

SHA512
c8a77182ce1832fe96f35a2816120c9df00eca1aa29dce49a111f057d3583b3b25a69c88f579cc84f4ff43fbf17f663a1e07234aacdd1831bbdb443f8f234e36

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
MD5
e7ea007349bdd0293011c35ce044e66d

SHA1
a871607bd61992484f45419f1446a1858744993d

SHA256
589a0c537a590d97fb564722e690a6080bcd57ff611a6c420c658e3e934099d9

SHA512
e7517d44448d79448d5cf89184ec3943128e63592d8c57ccb5e810f67234b8504cf8db5382862de3f68b5ffd2c6f292a9f8158eecf6022d17b7b6fde7a14c485

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CC197601BE0898B7B0FCC91FA15D8A69_5F0F16F363E79E7BD83FDF03966FD918
MD5
54bd38f9b53af4f9e9e194ef60db36cc

SHA1
3952b9a7fb0b2ae0e5a2b55d68ea45714bef8cd1

SHA256
86f3b2c94d991c62bfcfb87fe1821938ac67d865f484208b1fb3445ecaf87914

SHA512
cf7fe746a4439e477b73167492d780c7f1ac5b679294b8b17dbc857e53ada8ed782091f829bcaae79cee8786dddac4c76965f659c9ebbb85361bb8bd915d52b3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CFE86DBBE02D859DC92F1E17E0574EE8_46766FC45507C0B9E264E4C18BC7288B
MD5
4f914d6a12b48374677859978d3def97

SHA1
d29a1ff9bc1fbf5c4c0cf3210c9aefe33fc8e5a5

SHA256
eb9ac8c88c0857b9588076073491eec79f4725aa32bc7af00c20ef31095d1d68

SHA512
ab9cc44820d05b5207d1210e189041f3df258346619f05ae1b058de8b358438095a09b0fed26fcf09d7d08caae353f680936ebe24fdc94c18411463d5ecfbe61

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\644B8874112055B5E195ECB0E8F243A4
MD5
c0889e1de9f4d8ba0483b18c899a0018

SHA1
cffb2b7f39c5b0a153564c744af4aa028a04882f

SHA256
43e90a6df0d61c63fde550ac91098e23d04cd7d63de1939321e9b68ca131444a

SHA512
0be9e528b9af96900c15fcbc1e925322cbf0d93209c4a16d44f29a353a250a5a1f0f787976a338a8e3dc13ffb39fdaede156e23fe5d76d7cc5c06605ea86babe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
MD5
fbe0d9ccb00bcb8ba1793db8563454c3

SHA1
56e27ee58076efeb686c09eeb41eaa9e22353500

SHA256
eb56f56133bbdfb293ceaa3627478c34667593c257bd897c490c5f8a025ef24b

SHA512
ef56fad6f33708081856e1b83df8932269cd11221962d0db0d157e50aa177b0216eb9cf160b7ae6d8116f4cfe93703f316d7949a4f964e087294d576295289f6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CC197601BE0898B7B0FCC91FA15D8A69_5F0F16F363E79E7BD83FDF03966FD918
MD5
2ed8eb6eaefc98642aedec128ee2e8f3

SHA1
569051a84daedc04ff31a082c6ed257ed2ea5528

SHA256
c7c2b6a28738094237e5465d292c1b459920333d540a2e4e56b6afc176cae9b9

SHA512
950e7e6a52f08811f774766db263f2efd7c581d7b59b5c0ca335189e90f204507d043ec06b7dc835b2839feb95cd2548eadc171f1d1aa9063d035762c1e6868f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CFE86DBBE02D859DC92F1E17E0574EE8_46766FC45507C0B9E264E4C18BC7288B
MD5
9bf51886ac241b31606a9f79c82df733

SHA1
2ce81b8d06c2df6f9fe9a64da06437addd31eaeb

SHA256
35f669d2068b155a56357f82dd71675477f1be1eb277730082ff36ae0259280d

SHA512
0ae68384a998b06df51fe177ec9b1a9aed1280199ed60c510d143935a9bd641f7e35b1572f181b9a71848a0a65957ad8ae44535ad311b4447eb116d339ad3125

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\5TQ9Z63L\IE.63b72a.js.9qnt6z5.partial
MD5
827c3371fa4bfd2608983a4ccbbc725d

SHA1
b28db012bbb0ed6b9a70566521d5c434f985463c

SHA256
8b19520da9a4d426195307621fcd87e7d18edf352555852c732beb540c95942d

SHA512
f56bb4e95b39237c4fe62c1d2540147f551c1d3f39cd6478d273a44961136036f436ab084b19c181ce982a0c0570888efe3aaf5c4556e51042648614d413c269

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\E4CXZILN.cookie
MD5
98d6253546f3b1424a77d8f5959b5caa

SHA1
79e75871c9eff9b7f9699ac532476b06b2ca59bd

SHA256
bcdfd9c1078f9ad4489dfd478d0bd38b8715263ebe5abe2c1ac70eb93f97f527

SHA512
d60f77d267eae561f3f488da2827cf9478ba571930d57b414641e41637177ef4e0bc2fed03448c0adf1f84644fb2c7ee674e6e8b315a6d36936041fa91bf74b2

Download Submit
C:\Users\Admin\AppData\Local\Temp\8092dff9.ps1
MD5
93283f1d2e0e79c398a998f66d5dfb4f

SHA1
b88f6d7e05d3aa3eefada97199760fa230318c3d

SHA256
14ea1b6efe2267561bad0eeb88a8ab67d3839fcb707c7404ab8ca221403015be

SHA512
24fcc2798eda17c17d51c57c6b625571dff69acc027fa191b7ba8ac59120aef7e91b752a3ccf1cbf57c9e56067cca950bf6750f06da29af70be799a9859b89c7

Download Submit
C:\Users\Admin\AppData\Roaming\ehv137aC\HTCTL32.DLL
MD5
2d3b207c8a48148296156e5725426c7f

SHA1
ad464eb7cf5c19c8a443ab5b590440b32dbc618f

SHA256
edfe2b923bfb5d1088de1611401f5c35ece91581e71503a5631647ac51f7d796

SHA512
55c791705993b83c9b26a8dbd545d7e149c42ee358ecece638128ee271e85b4fdbfd6fbae61d13533bf39ae752144e2cc2c5edcda955f18c37a785084db0860c

Download Submit
C:\Users\Admin\AppData\Roaming\ehv137aC\MSVCR100.dll
MD5
0e37fbfa79d349d672456923ec5fbbe3

SHA1
4e880fc7625ccf8d9ca799d5b94ce2b1e7597335

SHA256
8793353461826fbd48f25ea8b835be204b758ce7510db2af631b28850355bd18

SHA512
2bea9bd528513a3c6a54beac25096ee200a4e6ccfc2a308ae9cfd1ad8738e2e2defd477d59db527a048e5e9a4fe1fc1d771701de14ef82b4dbcdc90df0387630

Download Submit
C:\Users\Admin\AppData\Roaming\ehv137aC\NSM.LIC
MD5
7067af414215ee4c50bfcd3ea43c84f0

SHA1
c331d410672477844a4ca87f43a14e643c863af9

SHA256
2050cc232710a2ea6a207bc78d1eac66a4042f2ee701cdfeee5de3ddcdc31d12

SHA512
17b888087192bcea9f56128d0950423b1807e294d1c4f953d1bf0f5bd08e5f8e35afeee584ebf9233bfc44e0723db3661911415798159ac118c8a42aaf0b902f

Download Submit
C:\Users\Admin\AppData\Roaming\ehv137aC\PCICL32.dll
MD5
00587238d16012152c2e951a087f2cc9

SHA1
c4e27a43075ce993ff6bb033360af386b2fc58ff

SHA256
63aa18c32af7144156e7ee2d5ba0fa4f5872a7deb56894f6f96505cbc9afe6f8

SHA512
637950a1f78d3f3d02c30a49a16e91cf3dfccc59104041876789bd7fdf9224d187209547766b91404c67319e13d1606da7cec397315495962cbf3e2ccd5f1226

Download Submit
C:\Users\Admin\AppData\Roaming\ehv137aC\client32.ini
MD5
41ae6c4e3f1567df9d74e7285407506b

SHA1
d969c05b4120cbc2f664db41ecb41721c84b943a

SHA256
6f66e92d7846a2987ef5150b370a6f32867d41fdf87b3cd49063c2e6c53dac9c

SHA512
924758d4eb6434507f6e3e892db840af089a89c09c06e6e79772695966ba136cac43c701528b445c1d7aa6305301db088552adca34ba1bc09f7ad7967ff56e33

Download Submit
C:\Users\Admin\AppData\Roaming\ehv137aC\ctfmon.exe
MD5
252dce576f9fbb9aaa7114dd7150f320

SHA1
c07f0a02c284b697dff119839f455836be39d10e

SHA256
b6b51f4273420c24ea7dc13ef4cc7615262ccbdf6f5e5a49dae604ec153055ad

SHA512
17255a8255b152edf896b4eb1719a2c52dbfed38887aa79b02fe54fcefca45c5089ed6340b8251fea1cf031b7c016328bd88741a066fa138ca7b722cf970b06b

Download Submit
C:\Users\Admin\AppData\Roaming\ehv137aC\ctfmon.exe
MD5
252dce576f9fbb9aaa7114dd7150f320

SHA1
c07f0a02c284b697dff119839f455836be39d10e

SHA256
b6b51f4273420c24ea7dc13ef4cc7615262ccbdf6f5e5a49dae604ec153055ad

SHA512
17255a8255b152edf896b4eb1719a2c52dbfed38887aa79b02fe54fcefca45c5089ed6340b8251fea1cf031b7c016328bd88741a066fa138ca7b722cf970b06b

Download Submit
C:\Users\Admin\AppData\Roaming\ehv137aC\pcicapi.dll
MD5
dcde2248d19c778a41aa165866dd52d0

SHA1
7ec84be84fe23f0b0093b647538737e1f19ebb03

SHA256
9074fd40ea6a0caa892e6361a6a4e834c2e51e6e98d1ffcda7a9a537594a6917

SHA512
c5d170d420f1aeb9bcd606a282af6e8da04ae45c83d07faaacb73ff2e27f4188b09446ce508620124f6d9b447a40a23620cfb39b79f02b04bb9e513866352166

Download Submit
C:\Users\Admin\AppData\Roaming\ehv137aC\pcichek.dll
MD5
a0b9388c5f18e27266a31f8c5765b263

SHA1
906f7e94f841d464d4da144f7c858fa2160e36db

SHA256
313117e723dda6ea3911faacd23f4405003fb651c73de8deff10b9eb5b4a058a

SHA512
6051a0b22af135b4433474dc7c6f53fb1c06844d0a30ed596a3c6c80644df511b023e140c4878867fa2578c79695fac2eb303aea87c0ecfc15a4ad264bd0b3cd

Download Submit
\Users\Admin\AppData\Roaming\ehv137aC\HTCTL32.DLL
MD5
2d3b207c8a48148296156e5725426c7f

SHA1
ad464eb7cf5c19c8a443ab5b590440b32dbc618f

SHA256
edfe2b923bfb5d1088de1611401f5c35ece91581e71503a5631647ac51f7d796

SHA512
55c791705993b83c9b26a8dbd545d7e149c42ee358ecece638128ee271e85b4fdbfd6fbae61d13533bf39ae752144e2cc2c5edcda955f18c37a785084db0860c

Download Submit
\Users\Admin\AppData\Roaming\ehv137aC\PCICHEK.DLL
MD5
a0b9388c5f18e27266a31f8c5765b263

SHA1
906f7e94f841d464d4da144f7c858fa2160e36db

SHA256
313117e723dda6ea3911faacd23f4405003fb651c73de8deff10b9eb5b4a058a

SHA512
6051a0b22af135b4433474dc7c6f53fb1c06844d0a30ed596a3c6c80644df511b023e140c4878867fa2578c79695fac2eb303aea87c0ecfc15a4ad264bd0b3cd

Download Submit
\Users\Admin\AppData\Roaming\ehv137aC\PCICL32.DLL
MD5
00587238d16012152c2e951a087f2cc9

SHA1
c4e27a43075ce993ff6bb033360af386b2fc58ff

SHA256
63aa18c32af7144156e7ee2d5ba0fa4f5872a7deb56894f6f96505cbc9afe6f8

SHA512
637950a1f78d3f3d02c30a49a16e91cf3dfccc59104041876789bd7fdf9224d187209547766b91404c67319e13d1606da7cec397315495962cbf3e2ccd5f1226

Download Submit
\Users\Admin\AppData\Roaming\ehv137aC\msvcr100.dll
MD5
0e37fbfa79d349d672456923ec5fbbe3

SHA1
4e880fc7625ccf8d9ca799d5b94ce2b1e7597335

SHA256
8793353461826fbd48f25ea8b835be204b758ce7510db2af631b28850355bd18

SHA512
2bea9bd528513a3c6a54beac25096ee200a4e6ccfc2a308ae9cfd1ad8738e2e2defd477d59db527a048e5e9a4fe1fc1d771701de14ef82b4dbcdc90df0387630

Download Submit
\Users\Admin\AppData\Roaming\ehv137aC\msvcr100.dll
MD5
0e37fbfa79d349d672456923ec5fbbe3

SHA1
4e880fc7625ccf8d9ca799d5b94ce2b1e7597335

SHA256
8793353461826fbd48f25ea8b835be204b758ce7510db2af631b28850355bd18

SHA512
2bea9bd528513a3c6a54beac25096ee200a4e6ccfc2a308ae9cfd1ad8738e2e2defd477d59db527a048e5e9a4fe1fc1d771701de14ef82b4dbcdc90df0387630

Download Submit
\Users\Admin\AppData\Roaming\ehv137aC\pcicapi.dll
MD5
dcde2248d19c778a41aa165866dd52d0

SHA1
7ec84be84fe23f0b0093b647538737e1f19ebb03

SHA256
9074fd40ea6a0caa892e6361a6a4e834c2e51e6e98d1ffcda7a9a537594a6917

SHA512
c5d170d420f1aeb9bcd606a282af6e8da04ae45c83d07faaacb73ff2e27f4188b09446ce508620124f6d9b447a40a23620cfb39b79f02b04bb9e513866352166

Download Submit
memory/744-129-0x0000000000000000-mapping.dmp

Download
memory/1176-127-0x0000000000000000-mapping.dmp

Download
memory/2008-115-0x0000000000000000-mapping.dmp

Download
memory/2700-136-0x0000000000000000-mapping.dmp

Download
memory/3680-114-0x00007FF88DAC0000-0x00007FF88DB2B000-memory.dmp

Filesize
428KB

Download
memory/3752-126-0x0000000000000000-mapping.dmp

Download
memory/4116-139-0x0000000000000000-mapping.dmp

Download
memory/4480-141-0x0000000000000000-mapping.dmp

Download
memory/4632-189-0x000002036D210000-0x000002036D211000-memory.dmp

Filesize
4KB

Download
memory/4632-160-0x000002036D8F6000-0x000002036D8F8000-memory.dmp

Filesize
8KB

Download
memory/4632-155-0x000002036D8F3000-0x000002036D8F5000-memory.dmp

Filesize
8KB

Download
memory/4632-154-0x000002036D8F0000-0x000002036D8F2000-memory.dmp

Filesize
8KB

Download
memory/4632-152-0x000002036DA00000-0x000002036DA01000-memory.dmp

Filesize
4KB

Download
memory/4632-147-0x000002036D800000-0x000002036D801000-memory.dmp

Filesize
4KB

Download
memory/4632-142-0x0000000000000000-mapping.dmp

Download
memory/4632-216-0x000002036D8F8000-0x000002036D8F9000-memory.dmp

Filesize
4KB

Download
memory/5016-200-0x0000000000000000-mapping.dmp

Download