72c22d9c2150b022f3f15e30bfd2d76435d4091b99a0e443c96dcb4c48aa5539

Analysis

max time kernel
129s
max time network
117s
platform
windows10_x64
resource
win10v20210410
submitted
19/06/2021, 11:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
08848e849c6d54a362b67b9800772466.exe
Size 1.3MB
Sample210619-smze8vhtbx
SHA256 72c22d9c2150b022f3f15e30bfd2d76435d4091b99a0e443c96dcb4c48aa5539
MD5 08848e849c6d54a362b67b9800772466
SHA1 96fb215bdf206e28107535cb0be7e91c724e8628
SHA512 2ec4d656d3820af06a1ee8ef20edbbe1ce22c1d479e7e197767e785e67c5e001402ba10db64061ed5b826424384f83215c8ac5b74ebb2af872433b240131fdfd
MD5 SHA1 SHA512

Score

8^/10

discovery spyware stealer

Malware Config

Signatures

Blocklisted process makes network request 7 IoCs

flow	pid	Process
28	412	rundll32.exe
30	2692	WScript.exe
32	2692	WScript.exe
34	2692	WScript.exe
36	2692	WScript.exe
37	2508	rundll32.exe
41	2508	rundll32.exe

Downloads MZ/PE file

Executes dropped EXE 6 IoCs

pid	Process
2292	vpn.exe
2352	4.exe
192	Veduto.exe.com
3084	Veduto.exe.com
4040	SmartClock.exe
1864	burxtugcqvdl.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SmartClock.lnk	4.exe

Loads dropped DLL 3 IoCs

pid	Process
3260	08848e849c6d54a362b67b9800772466.exe
412	rundll32.exe
2508	rundll32.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
15	ip-api.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2508 set thread context of 3796	2508	rundll32.exe	95

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\foler\olader\acppage.dll	08848e849c6d54a362b67b9800772466.exe
File created	C:\Program Files (x86)\foler\olader\adprovider.dll	08848e849c6d54a362b67b9800772466.exe
File created	C:\Program Files (x86)\foler\olader\acledit.dll	08848e849c6d54a362b67b9800772466.exe
File created	C:\PROGRA~3\lauvhfdchyoek\jhakldcgpv.tmp	rundll32.exe
File created	C:\PROGRA~3\lauvhfdchyoek\Sfnth.tmp	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 25 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\VendorIdentifier	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Revision	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\FeatureSet	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data	rundll32.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Previous Update Revision	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Configuration Data	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Status	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Veduto.exe.com
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	rundll32.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Veduto.exe.com
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Status	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	rundll32.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings	Veduto.exe.com

Modifies system certificate store 2 TTPs 4 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	WScript.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c000000010000000400000000080000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\2BA7E55779E879771F5A60C0A0AF12D9EBE52954	rundll32.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\2BA7E55779E879771F5A60C0A0AF12D9EBE52954\Blob = 0300000001000000140000002ba7e55779e879771f5a60c0a0af12d9ebe529542000000001000000420200003082023e308201a7a003020102020831050a566cfd395b300d06092a864886f70d01010b050030443122302006035504030c194d693063726f736f667420526f6f7420417574686f72697479311e301c060355040b0c154d6963726f736f667420436f72706f726174696f6e301e170d3139303632303131313933335a170d3233303631393131313933335a30443122302006035504030c194d693063726f736f667420526f6f7420417574686f72697479311e301c060355040b0c154d6963726f736f667420436f72706f726174696f6e30819f300d06092a864886f70d010101050003818d0030818902818100e2e591a3678537610b8aa5e76e04fbade7d6f7581d3b6456b06444bb2b5c5e02ee26eefa5ce9c3d7ed4b879da05fa94322ffbed3a56e85ef952b76d0fe87a41e4ef2ad944b5ccce0cad42b0f668365a809b25e0355bacfccda90c4496a6885463938bfad59864365b54d9ad930d2dd4dc38c8c2ba40932c91cab32ec2ec268350203010001a3393037300f0603551d130101ff040530030101ff30240603551d11041d301b82194d693063726f736f667420526f6f7420417574686f72697479300d06092a864886f70d01010b05000381810049b32633ea26128289c452d5c93179d928afd54ead6874c5632dea0bddf3652d6ec7741b7d4d35e5339fbf6ddb4e85e14224fc733d4b5a5c1f33db37b80e7a31bc13354acdf15af4b5e08602e7f5542ec59ec09127e7a9b1d25db30b71efa19eceb49232829e7bdd2f3d800f675bd065024fce371c3682e832df51efc813105b	rundll32.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
1432	PING.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
4040	SmartClock.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
2508	rundll32.exe
2508	rundll32.exe
2508	rundll32.exe
2508	rundll32.exe
2508	rundll32.exe
2508	rundll32.exe
2508	rundll32.exe
2508	rundll32.exe
2896	powershell.exe
2896	powershell.exe
2896	powershell.exe
2508	rundll32.exe
2508	rundll32.exe
2348	powershell.exe
2348	powershell.exe
2348	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2508	rundll32.exe
Token: SeDebugPrivilege	2896	powershell.exe
Token: SeDebugPrivilege	2348	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2508	rundll32.exe

Suspicious use of WriteProcessMemory 60 IoCs

description	pid	Process	procid_target
PID 3260 wrote to memory of 2292	3260	08848e849c6d54a362b67b9800772466.exe	75
PID 3260 wrote to memory of 2292	3260	08848e849c6d54a362b67b9800772466.exe	75
PID 3260 wrote to memory of 2292	3260	08848e849c6d54a362b67b9800772466.exe	75
PID 3260 wrote to memory of 2352	3260	08848e849c6d54a362b67b9800772466.exe	76
PID 3260 wrote to memory of 2352	3260	08848e849c6d54a362b67b9800772466.exe	76
PID 3260 wrote to memory of 2352	3260	08848e849c6d54a362b67b9800772466.exe	76
PID 2292 wrote to memory of 2896	2292	vpn.exe	78
PID 2292 wrote to memory of 2896	2292	vpn.exe	78
PID 2292 wrote to memory of 2896	2292	vpn.exe	78
PID 2896 wrote to memory of 2716	2896	cmd.exe	80
PID 2896 wrote to memory of 2716	2896	cmd.exe	80
PID 2896 wrote to memory of 2716	2896	cmd.exe	80
PID 2716 wrote to memory of 420	2716	cmd.exe	81
PID 2716 wrote to memory of 420	2716	cmd.exe	81
PID 2716 wrote to memory of 420	2716	cmd.exe	81
PID 2716 wrote to memory of 192	2716	cmd.exe	82
PID 2716 wrote to memory of 192	2716	cmd.exe	82
PID 2716 wrote to memory of 192	2716	cmd.exe	82
PID 2716 wrote to memory of 1432	2716	cmd.exe	83
PID 2716 wrote to memory of 1432	2716	cmd.exe	83
PID 2716 wrote to memory of 1432	2716	cmd.exe	83
PID 192 wrote to memory of 3084	192	Veduto.exe.com	84
PID 192 wrote to memory of 3084	192	Veduto.exe.com	84
PID 192 wrote to memory of 3084	192	Veduto.exe.com	84
PID 2352 wrote to memory of 4040	2352	4.exe	87
PID 2352 wrote to memory of 4040	2352	4.exe	87
PID 2352 wrote to memory of 4040	2352	4.exe	87
PID 3084 wrote to memory of 1864	3084	Veduto.exe.com	90
PID 3084 wrote to memory of 1864	3084	Veduto.exe.com	90
PID 3084 wrote to memory of 1864	3084	Veduto.exe.com	90
PID 3084 wrote to memory of 3860	3084	Veduto.exe.com	91
PID 3084 wrote to memory of 3860	3084	Veduto.exe.com	91
PID 3084 wrote to memory of 3860	3084	Veduto.exe.com	91
PID 1864 wrote to memory of 412	1864	burxtugcqvdl.exe	92
PID 1864 wrote to memory of 412	1864	burxtugcqvdl.exe	92
PID 1864 wrote to memory of 412	1864	burxtugcqvdl.exe	92
PID 3084 wrote to memory of 2692	3084	Veduto.exe.com	93
PID 3084 wrote to memory of 2692	3084	Veduto.exe.com	93
PID 3084 wrote to memory of 2692	3084	Veduto.exe.com	93
PID 412 wrote to memory of 2508	412	rundll32.exe	94
PID 412 wrote to memory of 2508	412	rundll32.exe	94
PID 412 wrote to memory of 2508	412	rundll32.exe	94
PID 2508 wrote to memory of 3796	2508	rundll32.exe	95
PID 2508 wrote to memory of 3796	2508	rundll32.exe	95
PID 2508 wrote to memory of 3796	2508	rundll32.exe	95
PID 2508 wrote to memory of 2896	2508	rundll32.exe	96
PID 2508 wrote to memory of 2896	2508	rundll32.exe	96
PID 2508 wrote to memory of 2896	2508	rundll32.exe	96
PID 2508 wrote to memory of 2348	2508	rundll32.exe	99
PID 2508 wrote to memory of 2348	2508	rundll32.exe	99
PID 2508 wrote to memory of 2348	2508	rundll32.exe	99
PID 2348 wrote to memory of 2316	2348	powershell.exe	101
PID 2348 wrote to memory of 2316	2348	powershell.exe	101
PID 2348 wrote to memory of 2316	2348	powershell.exe	101
PID 2508 wrote to memory of 2564	2508	rundll32.exe	102
PID 2508 wrote to memory of 2564	2508	rundll32.exe	102
PID 2508 wrote to memory of 2564	2508	rundll32.exe	102
PID 2508 wrote to memory of 2276	2508	rundll32.exe	104
PID 2508 wrote to memory of 2276	2508	rundll32.exe	104
PID 2508 wrote to memory of 2276	2508	rundll32.exe	104

C:\Users\Admin\AppData\Local\Temp\08848e849c6d54a362b67b9800772466.exe
"C:\Users\Admin\AppData\Local\Temp\08848e849c6d54a362b67b9800772466.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:3260
- C:\Users\Admin\AppData\Local\Temp\New Feature\vpn.exe
  "C:\Users\Admin\AppData\Local\Temp\New Feature\vpn.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2292
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c cmd < Dormissero.wpd
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2896
  - - C:\Windows\SysWOW64\cmd.exe
      cmd
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2716
    - - C:\Windows\SysWOW64\findstr.exe
        
        findstr /V /R "^yDsOhfSavSpAbPmIcKdnQIreaKfHRDgtrOWNQEZgeibhzBUxbMIjNghvAfvCqkATDybISMRQKecJkQIQPUltV$" Uso.wpd
        5⤵
        
        PID:420
    - - C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Veduto.exe.com
        
        Veduto.exe.com o
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:192
      - C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Veduto.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Veduto.exe.com o
        6⤵
        Executes dropped EXE
        Checks processor information in registry
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3084
        
        C:\Users\Admin\AppData\Local\Temp\burxtugcqvdl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\burxtugcqvdl.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1864
        
        C:\Windows\SysWOW64\rundll32.exe
        
        C:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\BURXTU~1.TMP,S C:\Users\Admin\AppData\Local\Temp\BURXTU~1.EXE
        8⤵
        Blocklisted process makes network request
        Loads dropped DLL
        Drops file in Program Files directory
        Suspicious use of WriteProcessMemory
        
        PID:412
        
        C:\Windows\SysWOW64\rundll32.exe
        
        C:\Windows\system32\rundll32.exe C:\PROGRA~3\LAUVHF~1\JHAKLD~1.TMP,LhoUMw== C:\Users\Admin\AppData\Local\Temp\BURXTU~1.TMP
        9⤵
        Blocklisted process makes network request
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Checks processor information in registry
        Modifies system certificate store
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:2508
        
        C:\Windows\system32\rundll32.exe
        
        C:\Windows\system32\rundll32.exe C:\Windows\system32\shell32.dll,#61 31801
        10⤵
        
        PID:3796
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Executionpolicy bypass -File "C:\Users\Admin\AppData\Local\Temp\tmpB8D1.tmp.ps1"
        10⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2896
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Executionpolicy bypass -File "C:\Users\Admin\AppData\Local\Temp\tmpCB42.tmp.ps1"
        10⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2348
        
        C:\Windows\SysWOW64\nslookup.exe
        
        "C:\Windows\system32\nslookup.exe" -type=any localhost
        11⤵
        
        PID:2316
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /End /tn \Microsoft\Windows\Wininet\CacheTask
        10⤵
        
        PID:2564
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Run /tn \Microsoft\Windows\Wininet\CacheTask
        10⤵
        
        PID:2276
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ohkrngq.vbs"
        7⤵
        
        PID:3860
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\oiyfbqa.vbs"
        7⤵
        Blocklisted process makes network request
        Modifies system certificate store
        
        PID:2692
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 30
        5⤵
        Runs ping.exe
        
        PID:1432
- C:\Users\Admin\AppData\Local\Temp\New Feature\4.exe
  "C:\Users\Admin\AppData\Local\Temp\New Feature\4.exe"
  2⤵
  - Executes dropped EXE
  - Drops startup file
  - Suspicious use of WriteProcessMemory
  PID:2352
- - C:\Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exe
    "C:\Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: AddClipboardFormatListener
    PID:4040

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Install Root Certificate

T1130

Modify Registry

T1112

Web Service

T1102

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1864-152-0x0000000000400000-0x00000000009B4000-memory.dmp

Download

memory/1864-151-0x00000000027D0000-0x00000000028BD000-memory.dmp

Download

memory/2348-207-0x0000000004DC2000-0x0000000004DC3000-memory.dmp

Download

memory/2348-220-0x0000000004DC3000-0x0000000004DC4000-memory.dmp

Download

memory/2348-206-0x0000000004DC0000-0x0000000004DC1000-memory.dmp

Download

memory/2348-205-0x0000000008470000-0x0000000008471000-memory.dmp

Download

memory/2348-202-0x0000000008050000-0x0000000008051000-memory.dmp

Download

memory/2352-135-0x0000000000400000-0x00000000008F1000-memory.dmp

Download

memory/2352-134-0x0000000000900000-0x0000000000A4A000-memory.dmp

Download

memory/2508-164-0x00000000064E0000-0x00000000064E1000-memory.dmp

Download

memory/2896-177-0x0000000006F52000-0x0000000006F53000-memory.dmp

Download

memory/2896-192-0x0000000006F53000-0x0000000006F54000-memory.dmp

Download

memory/2896-176-0x0000000006F50000-0x0000000006F51000-memory.dmp

Download

memory/2896-170-0x00000000048E0000-0x00000000048E1000-memory.dmp

Download

memory/2896-178-0x0000000007550000-0x0000000007551000-memory.dmp

Download

memory/2896-179-0x00000000085D0000-0x00000000085D1000-memory.dmp

Download

memory/2896-180-0x0000000008350000-0x0000000008351000-memory.dmp

Download

memory/2896-182-0x0000000008450000-0x0000000008451000-memory.dmp

Download

memory/2896-187-0x0000000009B90000-0x0000000009B91000-memory.dmp

Download

memory/2896-188-0x0000000009110000-0x0000000009111000-memory.dmp

Download

memory/2896-189-0x00000000091B0000-0x00000000091B1000-memory.dmp

Download

memory/2896-174-0x0000000007BC0000-0x0000000007BC1000-memory.dmp

Download

memory/2896-175-0x0000000007CA0000-0x0000000007CA1000-memory.dmp

Download

memory/2896-171-0x0000000007590000-0x0000000007591000-memory.dmp

Download

memory/2896-172-0x0000000007320000-0x0000000007321000-memory.dmp

Download

memory/2896-173-0x0000000007C30000-0x0000000007C31000-memory.dmp

Download

memory/3084-141-0x00000000008A0000-0x00000000008A1000-memory.dmp

Download

memory/3796-165-0x0000000000B80000-0x0000000000D20000-memory.dmp

Download

memory/3796-166-0x000002C925F90000-0x000002C926141000-memory.dmp

Download

memory/4040-139-0x00000000009E0000-0x0000000000B2A000-memory.dmp

Download

memory/4040-140-0x0000000000400000-0x00000000008F1000-memory.dmp

Download