Analysis
- max time kernel
37s - max time network
107s - platform
windows10_x64 - resource
win10v20210408 - submitted
07/06/2021, 06:35
Errors
Reason
Machine shutdown
General
- Target 82D8FE8523A17596A64F5EC94845E7C0.exe
- Size 3.2MB
- Sample210607-8lf6dncra6
- SHA256 b412a43bbd6598818a0fe157f513fc8d74e67430b53b8f29eaefdceb57e7b80b
Score
10/10
Malware Config
Extracted
Family
-
smokeloader
Version
-
2020
C2
-
http://ppcspb.com/upload/
-
http://mebbing.com/upload/
-
http://twcamel.com/upload/
-
http://howdycash.com/upload/
-
http://lahuertasonora.com/upload/
-
http://kpotiques.com/upload/
rc4.i32
rc4.i32
Signatures
- ElysiumStealer
ElysiumStealer (previously known as ZeromaxStealer) is an info stealer that can steal login credentials for various accounts.
- PlugX
PlugX is a RAT (Remote Access Trojan) that has been around since 2008.
- SmokeLoader
Modular backdoor trojan in use since 2014.
- Vidar
Vidar is an infostealer based on Arkei stealer.
- Checks for common network interception software 1 TTPs
Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
- Downloads MZ/PE file
- Drops file in Drivers directory 1 IoCs
- Executes dropped EXE 40 IoCs
- UPX packed file 4 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- VMProtect packed file 3 IoCs
Detects executables packed with VMProtect commercial packer.
- Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL 13 IoCs
- Modifies file permissions 1 TTPs 1 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 3 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Drops desktop.ini file(s) 2 IoCs
- Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Legitimate hosting services abused for malware hosting/C2 1 TTPs
- Looks up external IP address via web service 9 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- autoit_exe 2 IoCs
AutoIT scripts compiled to PE executables.
- Drops file in Program Files directory 39 IoCs
- Drops file in Windows directory 8 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Program crash 4 IoCs
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Delays execution with timeout.exe 1 IoCs
- Kills process with taskkill 3 IoCs
- Modifies Internet Explorer settings 1 TTPs 3 IoCs
- Modifies data under HKEY_USERS 16 IoCs
- Modifies registry class 64 IoCs
- Modifies system certificate store 2 TTPs 5 IoCs
- Script User-Agent 9 IoCs
Uses user-agent string associated with script host/environment.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 3 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 28 IoCs
- Suspicious use of SendNotifyMessage 19 IoCs
- Suspicious use of SetWindowsHookEx 4 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s gpsvc1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Browser1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s WpnService1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Winmgmt1⤵
- Suspicious use of AdjustPrivilegeToken
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s IKEEXT1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s LanmanServer1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s SENS1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s UserManager1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Themes1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s ProfSvc1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Schedule1⤵
-
C:\Users\Admin\AppData\Local\Temp\82D8FE8523A17596A64F5EC94845E7C0.exe"C:\Users\Admin\AppData\Local\Temp\82D8FE8523A17596A64F5EC94845E7C0.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Files.exe"C:\Users\Admin\AppData\Local\Temp\Files.exe"2⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Users\Admin\AppData\Local\Temp\KRSetp.exe"C:\Users\Admin\AppData\Local\Temp\KRSetp.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\8884787.exe"C:\Users\Admin\AppData\Roaming\8884787.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\6572835.exe"C:\Users\Admin\AppData\Roaming\6572835.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Roaming\3955537.exe"C:\Users\Admin\AppData\Roaming\3955537.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4172 -s 19604⤵
- Drops file in Windows directory
- Program crash
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\jg3_3uag.exe"C:\Users\Admin\AppData\Local\Temp\jg3_3uag.exe"2⤵
- Executes dropped EXE
- Checks whether UAC is enabled
-
-
C:\Users\Admin\AppData\Local\Temp\pzyh.exe"C:\Users\Admin\AppData\Local\Temp\pzyh.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Users\Admin\AppData\Local\Temp\Folder.exe"C:\Users\Admin\AppData\Local\Temp\Folder.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rUNdlL32.eXe"C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\install.dll",shl3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
-
-
C:\Users\Admin\AppData\Local\Temp\IDWCH1.exe"C:\Users\Admin\AppData\Local\Temp\IDWCH1.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-F234U.tmp\IDWCH1.tmp"C:\Users\Admin\AppData\Local\Temp\is-F234U.tmp\IDWCH1.tmp" /SL5="$20156,506086,422400,C:\Users\Admin\AppData\Local\Temp\IDWCH1.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-FC4L5.tmp\è8__________________67.exe"C:\Users\Admin\AppData\Local\Temp\is-FC4L5.tmp\è8__________________67.exe" /S /UID=1244⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Reference Assemblies\HXSQGREFRN\IDownload.exe"C:\Program Files\Reference Assemblies\HXSQGREFRN\IDownload.exe" /VERYSILENT5⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\is-U7KJ7.tmp\IDownload.tmp"C:\Users\Admin\AppData\Local\Temp\is-U7KJ7.tmp\IDownload.tmp" /SL5="$401A4,994212,425984,C:\Program Files\Reference Assemblies\HXSQGREFRN\IDownload.exe" /VERYSILENT6⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
-
C:\Program Files (x86)\IDownload\IDownload.App.exe"C:\Program Files (x86)\IDownload\IDownload.App.exe" -silent -desktopShortcut -programMenu7⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\mhdffthi.cmdline"8⤵
-
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESED26.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCED25.tmp"9⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\11-345be-af1-88ca4-b03b84cf55aff\Gapyjaebimae.exe"C:\Users\Admin\AppData\Local\Temp\11-345be-af1-88ca4-b03b84cf55aff\Gapyjaebimae.exe"5⤵
- Executes dropped EXE
- Checks computer location settings
-
-
C:\Users\Admin\AppData\Local\Temp\a2-556db-8be-91387-f163e14305355\SHahigaegezhe.exe"C:\Users\Admin\AppData\Local\Temp\a2-556db-8be-91387-f163e14305355\SHahigaegezhe.exe"5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\2puuui0y.23q\001.exe & exit6⤵
-
C:\Users\Admin\AppData\Local\Temp\2puuui0y.23q\001.exeC:\Users\Admin\AppData\Local\Temp\2puuui0y.23q\001.exe7⤵
- Executes dropped EXE
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\qgygqesk.t4e\GcleanerEU.exe /eufive & exit6⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\cefhdszv.rjh\installer.exe /qn CAMPAIGN="654" & exit6⤵
-
C:\Users\Admin\AppData\Local\Temp\cefhdszv.rjh\installer.exeC:\Users\Admin\AppData\Local\Temp\cefhdszv.rjh\installer.exe /qn CAMPAIGN="654"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Modifies system certificate store
- Suspicious use of FindShellTrayWindow
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\97FDF62\Windows Manager - Postback Y.msi" /qn CAMPAIGN=654 AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\cefhdszv.rjh\installer.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\cefhdszv.rjh\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1622795877 /qn CAMPAIGN=""654"" " CAMPAIGN="654"8⤵
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\5rceyf3g.r4n\gaoou.exe & exit6⤵
-
C:\Users\Admin\AppData\Local\Temp\5rceyf3g.r4n\gaoou.exeC:\Users\Admin\AppData\Local\Temp\5rceyf3g.r4n\gaoou.exe7⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt8⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt8⤵
- Executes dropped EXE
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\gmokj04w.aui\Setup3310.exe /Verysilent /subid=623 & exit6⤵
-
C:\Users\Admin\AppData\Local\Temp\gmokj04w.aui\Setup3310.exeC:\Users\Admin\AppData\Local\Temp\gmokj04w.aui\Setup3310.exe /Verysilent /subid=6237⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\is-4JBV3.tmp\Setup3310.tmp"C:\Users\Admin\AppData\Local\Temp\is-4JBV3.tmp\Setup3310.tmp" /SL5="$20386,138429,56832,C:\Users\Admin\AppData\Local\Temp\gmokj04w.aui\Setup3310.exe" /Verysilent /subid=6238⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\AppData\Local\Temp\is-VKKDT.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-VKKDT.tmp\Setup.exe" /Verysilent9⤵
- Executes dropped EXE
- Drops file in Program Files directory
-
C:\Program Files (x86)\Data Finder\Versium Research\hjjgaa.exe"C:\Program Files (x86)\Data Finder\Versium Research\hjjgaa.exe"10⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt11⤵
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt11⤵
-
-
-
C:\Program Files (x86)\Data Finder\Versium Research\RunWW.exe"C:\Program Files (x86)\Data Finder\Versium Research\RunWW.exe"10⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im RunWW.exe /f & timeout /t 6 & del /f /q "C:\Program Files (x86)\Data Finder\Versium Research\RunWW.exe" & del C:\ProgramData\*.dll & exit11⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im RunWW.exe /f12⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 612⤵
- Delays execution with timeout.exe
-
-
-
-
C:\Program Files (x86)\Data Finder\Versium Research\guihuali-game.exe"C:\Program Files (x86)\Data Finder\Versium Research\guihuali-game.exe"10⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\rUNdlL32.eXe"C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\install.dll",install11⤵
-
-
-
C:\Program Files (x86)\Data Finder\Versium Research\003.exe"C:\Program Files (x86)\Data Finder\Versium Research\003.exe"10⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Data Finder\Versium Research\lylal220.exe"C:\Program Files (x86)\Data Finder\Versium Research\lylal220.exe"10⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\is-F56QQ.tmp\lylal220.tmp"C:\Users\Admin\AppData\Local\Temp\is-F56QQ.tmp\lylal220.tmp" /SL5="$203DA,491750,408064,C:\Program Files (x86)\Data Finder\Versium Research\lylal220.exe"11⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\is-RA8M1.tmp\56FT____________________.exe"C:\Users\Admin\AppData\Local\Temp\is-RA8M1.tmp\56FT____________________.exe" /S /UID=lylal22012⤵
-
C:\Program Files\Internet Explorer\PZYQKSTMUL\irecord.exe"C:\Program Files\Internet Explorer\PZYQKSTMUL\irecord.exe" /VERYSILENT13⤵
-
C:\Users\Admin\AppData\Local\Temp\is-POAOI.tmp\irecord.tmp"C:\Users\Admin\AppData\Local\Temp\is-POAOI.tmp\irecord.tmp" /SL5="$304FE,6139911,56832,C:\Program Files\Internet Explorer\PZYQKSTMUL\irecord.exe" /VERYSILENT14⤵
-
C:\Program Files (x86)\recording\i-record.exe"C:\Program Files (x86)\recording\i-record.exe" -silent -desktopShortcut -programMenu15⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\35-8cf69-94d-f638e-de613e2283eeb\Civedokyle.exe"C:\Users\Admin\AppData\Local\Temp\35-8cf69-94d-f638e-de613e2283eeb\Civedokyle.exe"13⤵
-
-
C:\Users\Admin\AppData\Local\Temp\0f-10ad4-81f-fcea3-eaba1471884a8\Dyzhushyjaepa.exe"C:\Users\Admin\AppData\Local\Temp\0f-10ad4-81f-fcea3-eaba1471884a8\Dyzhushyjaepa.exe"13⤵
-
-
-
-
-
C:\Program Files (x86)\Data Finder\Versium Research\BarSetpFile.exe"C:\Program Files (x86)\Data Finder\Versium Research\BarSetpFile.exe"10⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\8391470.exe"C:\Users\Admin\AppData\Roaming\8391470.exe"11⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6076 -s 194012⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Roaming\2066311.exe"C:\Users\Admin\AppData\Roaming\2066311.exe"11⤵
-
-
-
C:\Program Files (x86)\Data Finder\Versium Research\ask.exe"C:\Program Files (x86)\Data Finder\Versium Research\ask.exe"10⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe11⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe12⤵
- Kills process with taskkill
-
-
-
-
C:\Program Files (x86)\Data Finder\Versium Research\Browser.exe"C:\Program Files (x86)\Data Finder\Versium Research\Browser.exe"10⤵
- Executes dropped EXE
- Drops file in Program Files directory
-
C:\Program Files (x86)\Browzar\yRVGeBTYzVxq.exe"C:\Program Files (x86)\Browzar\yRVGeBTYzVxq.exe"11⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Program Files (x86)\Browzar\yRVGeBTYzVxq.exe"C:\Program Files (x86)\Browzar\yRVGeBTYzVxq.exe"12⤵
-
-
-
C:\Program Files (x86)\Browzar\Browzar.exe"C:\Program Files (x86)\Browzar\Browzar.exe"11⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2196 -s 213612⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2196 -s 219612⤵
- Program crash
-
-
-
-
C:\Program Files (x86)\Data Finder\Versium Research\LabPicV3.exe"C:\Program Files (x86)\Data Finder\Versium Research\LabPicV3.exe"10⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\is-H2O3D.tmp\LabPicV3.tmp"C:\Users\Admin\AppData\Local\Temp\is-H2O3D.tmp\LabPicV3.tmp" /SL5="$20494,506086,422400,C:\Program Files (x86)\Data Finder\Versium Research\LabPicV3.exe"11⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\is-0J1NE.tmp\_____________.exe"C:\Users\Admin\AppData\Local\Temp\is-0J1NE.tmp\_____________.exe" /S /UID=lab21412⤵
-
C:\Program Files\Windows Defender Advanced Threat Protection\OTTMNGXKAN\prolab.exe"C:\Program Files\Windows Defender Advanced Threat Protection\OTTMNGXKAN\prolab.exe" /VERYSILENT13⤵
-
C:\Users\Admin\AppData\Local\Temp\is-O637F.tmp\prolab.tmp"C:\Users\Admin\AppData\Local\Temp\is-O637F.tmp\prolab.tmp" /SL5="$704C0,575243,216576,C:\Program Files\Windows Defender Advanced Threat Protection\OTTMNGXKAN\prolab.exe" /VERYSILENT14⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\53-f79c0-7d6-d5a98-d9b147a642cdd\Laewofydeqe.exe"C:\Users\Admin\AppData\Local\Temp\53-f79c0-7d6-d5a98-d9b147a642cdd\Laewofydeqe.exe"13⤵
-
-
C:\Users\Admin\AppData\Local\Temp\32-d00b2-caa-1cfab-499849ba4adf3\Mitaeticasa.exe"C:\Users\Admin\AppData\Local\Temp\32-d00b2-caa-1cfab-499849ba4adf3\Mitaeticasa.exe"13⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\wu533eit.ugg\001.exe & exit14⤵
-
C:\Users\Admin\AppData\Local\Temp\wu533eit.ugg\001.exeC:\Users\Admin\AppData\Local\Temp\wu533eit.ugg\001.exe15⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\ivvrqp1i.voq\GcleanerEU.exe /eufive & exit14⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\pzjurx31.fym\installer.exe /qn CAMPAIGN="654" & exit14⤵
-
C:\Users\Admin\AppData\Local\Temp\pzjurx31.fym\installer.exeC:\Users\Admin\AppData\Local\Temp\pzjurx31.fym\installer.exe /qn CAMPAIGN="654"15⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\s03t3eoo.zgw\gaoou.exe & exit14⤵
-
C:\Users\Admin\AppData\Local\Temp\s03t3eoo.zgw\gaoou.exeC:\Users\Admin\AppData\Local\Temp\s03t3eoo.zgw\gaoou.exe15⤵
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt16⤵
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt16⤵
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\3gll0fyu.jiz\Setup3310.exe /Verysilent /subid=623 & exit14⤵
-
C:\Users\Admin\AppData\Local\Temp\3gll0fyu.jiz\Setup3310.exeC:\Users\Admin\AppData\Local\Temp\3gll0fyu.jiz\Setup3310.exe /Verysilent /subid=62315⤵
-
C:\Users\Admin\AppData\Local\Temp\is-KAA0N.tmp\Setup3310.tmp"C:\Users\Admin\AppData\Local\Temp\is-KAA0N.tmp\Setup3310.tmp" /SL5="$20566,138429,56832,C:\Users\Admin\AppData\Local\Temp\3gll0fyu.jiz\Setup3310.exe" /Verysilent /subid=62316⤵
-
C:\Users\Admin\AppData\Local\Temp\is-H3AFU.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-H3AFU.tmp\Setup.exe" /Verysilent17⤵
-
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\snx3beai.dqo\google-game.exe & exit14⤵
-
C:\Users\Admin\AppData\Local\Temp\snx3beai.dqo\google-game.exeC:\Users\Admin\AppData\Local\Temp\snx3beai.dqo\google-game.exe15⤵
-
C:\Windows\SysWOW64\rUNdlL32.eXe"C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\install.dll",get16⤵
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\siwbh34e.4ck\GcleanerWW.exe /mixone & exit14⤵
-
-
-
-
-
-
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\qr3kund2.32u\google-game.exe & exit6⤵
-
C:\Users\Admin\AppData\Local\Temp\qr3kund2.32u\google-game.exeC:\Users\Admin\AppData\Local\Temp\qr3kund2.32u\google-game.exe7⤵
- Executes dropped EXE
- Checks computer location settings
-
C:\Windows\SysWOW64\rUNdlL32.eXe"C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\install.dll",get8⤵
- Loads dropped DLL
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\xyosb0ed.m5m\GcleanerWW.exe /mixone & exit6⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\lwj1t3dz.lme\005.exe & exit6⤵
-
C:\Users\Admin\AppData\Local\Temp\lwj1t3dz.lme\005.exeC:\Users\Admin\AppData\Local\Temp\lwj1t3dz.lme\005.exe7⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\tetvskka.kd0\toolspab1.exe & exit6⤵
-
C:\Users\Admin\AppData\Local\Temp\tetvskka.kd0\toolspab1.exeC:\Users\Admin\AppData\Local\Temp\tetvskka.kd0\toolspab1.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\tetvskka.kd0\toolspab1.exeC:\Users\Admin\AppData\Local\Temp\tetvskka.kd0\toolspab1.exe8⤵
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\vact3mbu.rex\702564a0.exe & exit6⤵
-
C:\Users\Admin\AppData\Local\Temp\vact3mbu.rex\702564a0.exeC:\Users\Admin\AppData\Local\Temp\vact3mbu.rex\702564a0.exe7⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\ahcms03e.f0b\installer.exe /qn CAMPAIGN="654" & exit6⤵
-
C:\Users\Admin\AppData\Local\Temp\ahcms03e.f0b\installer.exeC:\Users\Admin\AppData\Local\Temp\ahcms03e.f0b\installer.exe /qn CAMPAIGN="654"7⤵
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\97FDF62\Windows Manager - Postback Y.msi" /qn CAMPAIGN=654 AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\ahcms03e.f0b\installer.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\ahcms03e.f0b\ EXE_CMD_LINE="/forcecleanup /wintime 1622795877 /qn CAMPAIGN=""654"" " CAMPAIGN="654"8⤵
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\pub2.exe"C:\Users\Admin\AppData\Local\Temp\pub2.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s BITS1⤵
- Suspicious use of SetThreadContext
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k SystemNetworkService2⤵
- Drops file in System32 directory
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Modifies registry class
-
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
- Modifies Internet Explorer settings
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding EDD89E2F4934847E0E7B684D99BB4CE7 C2⤵
- Loads dropped DLL
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding C51B7FAA06BA76C9261A0F0CFC9E77F32⤵
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\SysWOW64\taskkill.exe" /im AdvancedWindowsManager* /f3⤵
- Kills process with taskkill
-
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding D3555E257C10A23F44613268BE2981F3 E Global\MSI00002⤵
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding A6222C8482A63DF4855ECBE52A1620D8 C2⤵
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 4CF01A9C760264B96AF8066D84F678F02⤵
-
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Users\Admin\AppData\Local\Temp\A75C.exeC:\Users\Admin\AppData\Local\Temp\A75C.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\A75C.exeC:\Users\Admin\AppData\Local\Temp\A75C.exe2⤵
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Users\Admin\AppData\Local\8b29ba1b-efb4-48ed-99b3-0fb790ac4e9d" /deny *S-1-1-0:(OI)(CI)(DE,DC)3⤵
- Modifies file permissions
-
-
-
C:\Users\Admin\AppData\Local\Temp\BBA1.exeC:\Users\Admin\AppData\Local\Temp\BBA1.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\C0A3.exeC:\Users\Admin\AppData\Local\Temp\C0A3.exe1⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/204-267-0x0000000000570000-0x0000000000579000-memory.dmp
memory/204-268-0x0000000000400000-0x000000000044F000-memory.dmp
memory/340-227-0x000001A14E380000-0x000001A14E3F0000-memory.dmp
memory/580-126-0x00000000006E0000-0x00000000006E1000-memory.dmp
memory/580-145-0x000000001B520000-0x000000001B522000-memory.dmp
memory/580-140-0x0000000000BF0000-0x0000000000C0B000-memory.dmp
memory/652-158-0x0000000004D60000-0x0000000004DBC000-memory.dmp
memory/652-157-0x0000000004BA7000-0x0000000004CA8000-memory.dmp
memory/1064-207-0x000001E1F2B70000-0x000001E1F2BE0000-memory.dmp
memory/1108-198-0x000001FE3EC70000-0x000001FE3ECE0000-memory.dmp
memory/1224-229-0x00000220C3B70000-0x00000220C3BE0000-memory.dmp
memory/1296-246-0x0000021A3CEC0000-0x0000021A3CF30000-memory.dmp
memory/1308-285-0x0000000002C80000-0x0000000002C82000-memory.dmp
memory/1440-214-0x0000029F58ED0000-0x0000029F58F40000-memory.dmp
memory/1524-187-0x0000014C178E0000-0x0000014C17950000-memory.dmp
memory/1524-181-0x0000014C17630000-0x0000014C1767B000-memory.dmp
memory/1564-147-0x00000000001E0000-0x00000000001E1000-memory.dmp
memory/1668-193-0x0000000002250000-0x0000000002251000-memory.dmp
memory/1668-208-0x0000000009330000-0x0000000009331000-memory.dmp
memory/1668-179-0x0000000000140000-0x0000000000141000-memory.dmp
memory/1668-228-0x0000000004410000-0x0000000004411000-memory.dmp
memory/1668-221-0x0000000004B50000-0x0000000004B51000-memory.dmp
memory/1668-206-0x0000000004380000-0x000000000438E000-memory.dmp
memory/1680-264-0x0000000003610000-0x0000000003620000-memory.dmp
memory/1680-133-0x0000000000400000-0x00000000005DF000-memory.dmp
memory/1924-136-0x0000000000400000-0x000000000046D000-memory.dmp
memory/1992-222-0x000001B4ED2B0000-0x000001B4ED320000-memory.dmp
memory/2416-205-0x00000000051B0000-0x00000000051B1000-memory.dmp
memory/2416-196-0x0000000005160000-0x0000000005161000-memory.dmp
memory/2416-261-0x0000000008440000-0x0000000008441000-memory.dmp
memory/2416-225-0x0000000004B70000-0x0000000004B71000-memory.dmp
memory/2416-178-0x00000000008D0000-0x00000000008D1000-memory.dmp
memory/2416-219-0x0000000004B40000-0x0000000004B5E000-memory.dmp
memory/2464-188-0x000001EFDC930000-0x000001EFDC9A0000-memory.dmp
memory/2544-183-0x000001E8ED360000-0x000001E8ED3D0000-memory.dmp
memory/2700-248-0x000001A596F10000-0x000001A596F80000-memory.dmp
memory/2724-252-0x000001C9017D0000-0x000001C901840000-memory.dmp
memory/2740-213-0x000002812EB30000-0x000002812EBA0000-memory.dmp
memory/3052-293-0x0000000002620000-0x0000000002636000-memory.dmp
memory/3060-215-0x00000149620D0000-0x0000014962140000-memory.dmp
memory/3060-286-0x0000014963970000-0x000001496398B000-memory.dmp
memory/3060-274-0x0000014964700000-0x0000014964806000-memory.dmp
memory/3404-235-0x0000000001780000-0x0000000001782000-memory.dmp
memory/4120-301-0x0000000000DB5000-0x0000000000DB6000-memory.dmp
memory/4120-299-0x0000000000DB2000-0x0000000000DB4000-memory.dmp
memory/4120-296-0x0000000000DB0000-0x0000000000DB2000-memory.dmp
memory/4152-336-0x0000000005000000-0x0000000005001000-memory.dmp
memory/4152-337-0x0000000005010000-0x0000000005011000-memory.dmp
memory/4152-339-0x0000000005030000-0x0000000005031000-memory.dmp
memory/4152-340-0x0000000005040000-0x0000000005041000-memory.dmp
memory/4152-338-0x0000000005020000-0x0000000005021000-memory.dmp
memory/4152-341-0x0000000005050000-0x0000000005051000-memory.dmp
memory/4172-236-0x0000000002890000-0x0000000002891000-memory.dmp
memory/4172-211-0x0000000000E10000-0x0000000000E11000-memory.dmp
memory/4172-200-0x00000000004D0000-0x00000000004D1000-memory.dmp
memory/4172-233-0x0000000002720000-0x0000000002759000-memory.dmp
memory/4172-251-0x0000000000E00000-0x0000000000E01000-memory.dmp
memory/4356-307-0x00000000021A0000-0x00000000021A2000-memory.dmp
memory/4616-333-0x0000000000400000-0x0000000000414000-memory.dmp
memory/4700-258-0x00000000051B0000-0x00000000051B1000-memory.dmp
memory/4700-257-0x000000000AAD0000-0x000000000AAD1000-memory.dmp
memory/4860-273-0x0000000000400000-0x000000000046E000-memory.dmp
memory/4988-282-0x00000000001E0000-0x00000000001E1000-memory.dmp
memory/5116-327-0x0000000000D65000-0x0000000000D66000-memory.dmp
memory/5116-326-0x0000000000D64000-0x0000000000D65000-memory.dmp
memory/5116-329-0x0000000000D66000-0x0000000000D68000-memory.dmp
memory/5116-323-0x0000000000D62000-0x0000000000D64000-memory.dmp
memory/5116-294-0x0000000000D60000-0x0000000000D62000-memory.dmp
memory/5628-319-0x00000000001F0000-0x0000000000200000-memory.dmp
memory/5628-320-0x00000000006B0000-0x00000000006C2000-memory.dmp