Overview
overview
10Static
static
3dd4ba94c5...68.exe
windows7_x64
103dd4ba94c5...68.exe
windows7_x64
103dd4ba94c5...68.exe
windows7_x64
103dd4ba94c5...68.exe
windows11_x64
103dd4ba94c5...68.exe
windows10_x64
103dd4ba94c5...68.exe
windows10_x64
103dd4ba94c5...68.exe
windows10_x64
103dd4ba94c5...68.exe
windows10_x64
10Analysis
-
max time kernel
1803s -
max time network
1795s -
platform
windows10_x64 -
resource
win10-ja-20210920 -
submitted
26-09-2021 14:45
Static task
static1
Behavioral task
behavioral1
Sample
3dd4ba94c558b54ba1fe639566cbc368.exe
Resource
win7-ja-20210920
arkeichinese_generic_botnetraccoonredlinesmokeloader5ff0ccb2bc00dc52d1ad09949e9c7663bc9ca4d4b2f2e53f9e27f901d453d8f6fbafe1b4d5266bb7blissinstallszxckarmaz0rm1onbuildbackdoorbotnetdiscoveryevasioninfostealerspywarestealerthemidatrojan
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
3dd4ba94c558b54ba1fe639566cbc368.exe
Resource
win7v20210408
arkeichinese_generic_botnetraccoonredlinesmokeloader5ff0ccb2bc00dc52d1ad09949e9c7663bc9ca4d4b2f2e53f9e27f901d453d8f6fbafe1b4d5266bb7blissinstallszxckarmaz0rm1onbuildbackdoorbotnetdiscoveryevasioninfostealerspywarestealersuricatathemidatrojan
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral3
Sample
3dd4ba94c558b54ba1fe639566cbc368.exe
Resource
win7-de-20210920
arkeichinese_generic_botnetraccoonredlinesmokeloader5ff0ccb2bc00dc52d1ad09949e9c7663bc9ca4d4b2f2e53f9e27f901d453d8f6fbafe1b4d5266bb7blissinstallszxckarmaz0rm1onbuildbackdoorbotnetdiscoveryevasioninfostealerspywarestealerthemidatrojan
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral4
Sample
3dd4ba94c558b54ba1fe639566cbc368.exe
Resource
win11
arkeiraccoonredlinesmokeloaderinstallszxcz0rm1onbuildbackdoordiscoveryevasioninfostealerspywarestealersuricatathemidatrojan
windows11_x64
0 signatures
0 seconds
Behavioral task
behavioral5
Sample
3dd4ba94c558b54ba1fe639566cbc368.exe
Resource
win10v20210408
arkeichinese_generic_botnetraccoonredlinesmokeloader5ff0ccb2bc00dc52d1ad09949e9c7663bc9ca4d4b2f2e53f9e27f901d453d8f6fbafe1b4d5266bb7blisskarmabackdoorbotnetdiscoveryevasioninfostealerpersistencespywarestealersuricatathemidatrojan
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral6
Sample
3dd4ba94c558b54ba1fe639566cbc368.exe
Resource
win10-ja-20210920
arkeiraccoonredlinesmokeloader5ff0ccb2bc00dc52d1ad09949e9c7663bc9ca4d4b2f2e53f9e27f901d453d8f6fbafe1b4d5266bb7f6d7183c9e82d2a9b81e6c0608450aa66cefb51finstallszxcz0rm1onbuildbackdoordiscoveryevasioninfostealerpersistencespywarestealersuricatathemidatrojan
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral7
Sample
3dd4ba94c558b54ba1fe639566cbc368.exe
Resource
win10-en-20210920
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral8
Sample
3dd4ba94c558b54ba1fe639566cbc368.exe
Resource
win10-de-20210920
arkeiraccoonredlinesmokeloader5ff0ccb2bc00dc52d1ad09949e9c7663bc9ca4d4b2f2e53f9e27f901d453d8f6fbafe1b4d5266bb7f6d7183c9e82d2a9b81e6c0608450aa66cefb51finstallszxcz0rm1onbuildbackdoordiscoveryevasioninfostealerpersistencespywarestealersuricatathemidatrojan
windows10_x64
0 signatures
0 seconds
General
-
Target
3dd4ba94c558b54ba1fe639566cbc368.exe
-
Size
237KB
-
MD5
3dd4ba94c558b54ba1fe639566cbc368
-
SHA1
8c44f1c918c3d2fd48694e8af653e473be3e02c1
-
SHA256
c75b223b462ba88c62c1c8d848a845e7aeacc0ec0c96a7ecf1644e782accdd52
-
SHA512
58e828507bd3be52ea340ed835c3dc06a655db0a067c746ef65e7382d2b09eb5e7d6847dc679b89539826b598749e60ddf62859e25930b8e586acc11228bb1fa
Malware Config
Extracted
Family
smokeloader
Version
2020
C2
http://naghenrietti1.top/
http://kimballiett2.top/
http://xadriettany3.top/
http://jebeccallis4.top/
http://nityanneron5.top/
http://umayaniela6.top/
http://lynettaram7.top/
http://sadineyalas8.top/
http://geenaldencia9.top/
http://aradysiusep10.top/
rc4.i32
rc4.i32
Extracted
Family
redline
Botnet
installszxc
C2
138.124.186.2:27999
Extracted
Family
redline
Botnet
z0rm1onbuild
C2
45.156.21.209:56326
Extracted
Family
raccoon
Botnet
f6d7183c9e82d2a9b81e6c0608450aa66cefb51f
Attributes
-
url4cnc
https://t.me/justoprostohello
rc4.plain
rc4.plain
Extracted
Family
raccoon
Botnet
b2f2e53f9e27f901d453d8f6fbafe1b4d5266bb7
Attributes
-
url4cnc
https://t.me/hcdrom1
rc4.plain
rc4.plain
Extracted
Family
raccoon
Botnet
5ff0ccb2bc00dc52d1ad09949e9c7663bc9ca4d4
Attributes
-
url4cnc
https://t.me/agrybirdsgamerept
rc4.plain
rc4.plain
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 3 IoCs
resource yara_rule behavioral6/files/0x000200000001a2c6-157.dat family_redline behavioral6/files/0x000200000001a2c6-159.dat family_redline behavioral6/memory/2064-171-0x0000000000F40000-0x0000000000F5E000-memory.dmp family_redline -
Registers COM server for autorun 1 TTPs
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
suricata: ET MALWARE Win32.Raccoon Stealer CnC Activity (dependency download)
suricata: ET MALWARE Win32.Raccoon Stealer CnC Activity (dependency download)
-
suricata: ET MALWARE Win32.Raccoon Stealer Data Exfil Attempt
suricata: ET MALWARE Win32.Raccoon Stealer Data Exfil Attempt
-
Arkei Stealer Payload 1 IoCs
resource yara_rule behavioral6/memory/4516-245-0x0000000000400000-0x000000000044D000-memory.dmp family_arkei -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
Downloads MZ/PE file
-
Executes dropped EXE 23 IoCs
pid Process 5036 usegjuv 2708 usegjuv 3892 usegjuv 4992 usegjuv 4116 DEBC.exe 3376 E67D.exe 4372 DEBC.exe 2384 F19A.exe 648 Stub.exe 2064 F593.exe 432 FE8D.exe 4812 7B5.exe 4272 115B.exe 2220 1A17.exe 4516 21F7.exe 4888 2748.exe 4040 FiSFfqJej6.exe 1988 SindonsWelfare_2021-09-26_15-02.exe 2240 SolanumsYoghurt_2021-09-26_14-52.exe 4440 fbf.exe 2176 sihost.exe 1188 usegjuv 4300 usegjuv -
Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion E67D.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 115B.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 115B.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion E67D.exe -
Deletes itself 1 IoCs
pid Process 2108 Process not Found -
Loads dropped DLL 14 IoCs
pid Process 432 FE8D.exe 432 FE8D.exe 432 FE8D.exe 432 FE8D.exe 432 FE8D.exe 432 FE8D.exe 4516 21F7.exe 4516 21F7.exe 4516 21F7.exe 2220 1A17.exe 2220 1A17.exe 2220 1A17.exe 2220 1A17.exe 2220 1A17.exe -
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral6/files/0x000400000001a2c4-135.dat themida behavioral6/files/0x000400000001a2c4-136.dat themida behavioral6/memory/3376-142-0x0000000000A20000-0x0000000000A21000-memory.dmp themida behavioral6/files/0x000800000001a2ce-204.dat themida behavioral6/memory/4272-219-0x0000000000C50000-0x0000000000C51000-memory.dmp themida -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Uuuocai.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\fbf.exe" fbf.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA E67D.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 115B.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA SolanumsYoghurt_2021-09-26_14-52.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA SindonsWelfare_2021-09-26_15-02.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\B: fbf.exe File opened (read-only) \??\M: fbf.exe File opened (read-only) \??\Q: fbf.exe File opened (read-only) \??\T: fbf.exe File opened (read-only) \??\Z: fbf.exe File opened (read-only) \??\G: fbf.exe File opened (read-only) \??\I: fbf.exe File opened (read-only) \??\J: fbf.exe File opened (read-only) \??\N: fbf.exe File opened (read-only) \??\S: fbf.exe File opened (read-only) \??\W: fbf.exe File opened (read-only) \??\Y: fbf.exe File opened (read-only) \??\E: fbf.exe File opened (read-only) \??\F: fbf.exe File opened (read-only) \??\K: fbf.exe File opened (read-only) \??\R: fbf.exe File opened (read-only) \??\U: fbf.exe File opened (read-only) \??\H: fbf.exe File opened (read-only) \??\L: fbf.exe File opened (read-only) \??\O: fbf.exe File opened (read-only) \??\P: fbf.exe File opened (read-only) \??\V: fbf.exe File opened (read-only) \??\X: fbf.exe -
Drops file in System32 directory 4 IoCs
description ioc Process File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat OfficeC2RClient.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\OTele\officec2rclient.exe.db OfficeC2RClient.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\OTele\officec2rclient.exe.db-wal OfficeC2RClient.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\OTele\officec2rclient.exe.db-shm OfficeC2RClient.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 3376 E67D.exe 4272 115B.exe -
Suspicious use of SetThreadContext 5 IoCs
description pid Process procid_target PID 3980 set thread context of 2940 3980 3dd4ba94c558b54ba1fe639566cbc368.exe 76 PID 5036 set thread context of 2708 5036 usegjuv 93 PID 3892 set thread context of 4992 3892 usegjuv 95 PID 4116 set thread context of 4372 4116 DEBC.exe 99 PID 1188 set thread context of 4300 1188 usegjuv 132 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
pid pid_target Process procid_target 4628 4516 WerFault.exe 110 -
Checks SCSI registry key(s) 3 TTPs 15 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI usegjuv Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI usegjuv Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 3dd4ba94c558b54ba1fe639566cbc368.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI DEBC.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI DEBC.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI usegjuv Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI usegjuv Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI usegjuv Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI DEBC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 3dd4ba94c558b54ba1fe639566cbc368.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI usegjuv Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI usegjuv Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 3dd4ba94c558b54ba1fe639566cbc368.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI usegjuv Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI usegjuv -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 fbf.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz fbf.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 5048 schtasks.exe 484 schtasks.exe -
Delays execution with timeout.exe 2 IoCs
pid Process 5008 timeout.exe 3472 timeout.exe -
Modifies data under HKEY_USERS 23 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun OfficeC2RClient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs OfficeC2RClient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentEcs\Overrides OfficeC2RClient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData OfficeC2RClient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officec2rclient.exe\ULSMonitor OfficeC2RClient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0 OfficeC2RClient.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officec2rclient.exe\ULSMonitor\ULSTagIds0 = "5804129,17110992,7202269,17110988,7153487,39965824,17962391,17962392,3702920,3462423,3700754,3965062,4297094,7153421,18716193,7153435,7202265,20502174,6308191,18407617" OfficeC2RClient.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officec2rclient.exe\ULSMonitor\ULSCategoriesSeverities = "1329 10,1329 50,941 10,1329 15,941 15,941 6,1329 100,1329 6" OfficeC2RClient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentEcs\officeclicktorun\Overrides OfficeC2RClient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentEcs\all\Overrides OfficeC2RClient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\ExternalFeatureOverrides\officeclicktorun OfficeC2RClient.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officec2rclient.exe OfficeC2RClient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\Common\ClientTelemetry OfficeC2RClient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\Common\ClientTelemetry\Volatile OfficeC2RClient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\TrustCenter\Experimentation OfficeC2RClient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officec2rclient.exe OfficeC2RClient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common OfficeC2RClient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata OfficeC2RClient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry OfficeC2RClient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\FirstSession\officeclicktorun OfficeC2RClient.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages\en-US = "2" OfficeC2RClient.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages\en-US = "1" OfficeC2RClient.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officec2rclient.exe\ULSMonitor OfficeC2RClient.exe -
Modifies registry class 47 IoCs
description ioc Process Key deleted \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_CLASSES\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\DEFAULTICON FileSyncConfig.exe Set value (int) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\InitPropertyBag\Attributes = "17" FileSyncConfig.exe Set value (str) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\ = "OneDrive" FileSyncConfig.exe Key deleted \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6} FileSyncConfig.exe Key deleted \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance FileSyncConfig.exe Set value (str) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\InitPropertyBag\TargetKnownFolder = "{a52bba46-e9e1-435f-b3d9-28daa648c0f6}" FileSyncConfig.exe Key created \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6} FileSyncConfig.exe Key deleted \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_CLASSES\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\INPROCSERVER32 FileSyncConfig.exe Key created \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance FileSyncConfig.exe Key created \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\ShellFolder FileSyncConfig.exe Key created \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\InProcServer32 FileSyncConfig.exe Set value (int) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\ShellFolder\FolderValueFlags = "40" FileSyncConfig.exe Set value (int) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\ShellFolder\Attributes = "4034920525" FileSyncConfig.exe Set value (int) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\SortOrderIndex = "66" FileSyncConfig.exe Key created \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\DefaultIcon FileSyncConfig.exe Set value (str) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\InProcServer32\ = "%systemroot%\\system32\\shell32.dll" FileSyncConfig.exe Key deleted \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_CLASSES\WOW6432NODE\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\DEFAULTICON FileSyncConfig.exe Key deleted \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_CLASSES\WOW6432NODE\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\SHELLFOLDER FileSyncConfig.exe Key deleted \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_CLASSES\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\INSTANCE\INITPROPERTYBAG FileSyncConfig.exe Key deleted \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6} FileSyncConfig.exe Set value (str) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\InProcServer32\ = "%systemroot%\\SysWow64\\shell32.dll" FileSyncConfig.exe Key created \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\DefaultIcon FileSyncConfig.exe Set value (str) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\OneDrive.exe,0" FileSyncConfig.exe Key created \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance FileSyncConfig.exe Set value (str) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\InitPropertyBag\TargetKnownFolder = "{a52bba46-e9e1-435f-b3d9-28daa648c0f6}" FileSyncConfig.exe Key deleted \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_CLASSES\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\SHELLFOLDER FileSyncConfig.exe Set value (int) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\SortOrderIndex = "66" FileSyncConfig.exe Set value (int) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\ShellFolder\FolderValueFlags = "40" FileSyncConfig.exe Set value (str) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\CLSID = "{0E5AAE11-A475-4c5b-AB00-C66DE400274E}" FileSyncConfig.exe Key created \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\InitPropertyBag FileSyncConfig.exe Set value (int) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\InitPropertyBag\Attributes = "17" FileSyncConfig.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance Process not Found Key deleted \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance FileSyncConfig.exe Key created \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\InProcServer32 FileSyncConfig.exe Set value (str) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\CLSID = "{0E5AAE11-A475-4c5b-AB00-C66DE400274E}" FileSyncConfig.exe Set value (str) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\OneDrive.exe,0" FileSyncConfig.exe Set value (int) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\System.IsPinnedToNameSpaceTree = "1" FileSyncConfig.exe Key created \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance Process not Found Key deleted \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_CLASSES\WOW6432NODE\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\INPROCSERVER32 FileSyncConfig.exe Key deleted \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_CLASSES\WOW6432NODE\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\INSTANCE\INITPROPERTYBAG FileSyncConfig.exe Key created \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6} FileSyncConfig.exe Set value (str) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\ = "OneDrive" FileSyncConfig.exe Set value (int) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\System.IsPinnedToNameSpaceTree = "1" FileSyncConfig.exe Key created \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\InitPropertyBag FileSyncConfig.exe Key created \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\ShellFolder FileSyncConfig.exe Set value (int) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\ShellFolder\Attributes = "4034920525" FileSyncConfig.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2940 3dd4ba94c558b54ba1fe639566cbc368.exe 2940 3dd4ba94c558b54ba1fe639566cbc368.exe 2108 Process not Found 2108 Process not Found 2108 Process not Found 2108 Process not Found 2108 Process not Found 2108 Process not Found 2108 Process not Found 2108 Process not Found 2108 Process not Found 2108 Process not Found 2108 Process not Found 2108 Process not Found 2108 Process not Found 2108 Process not Found 2108 Process not Found 2108 Process not Found 2108 Process not Found 2108 Process not Found 2108 Process not Found 2108 Process not Found 2108 Process not Found 2108 Process not Found 2108 Process not Found 2108 Process not Found 2108 Process not Found 2108 Process not Found 2108 Process not Found 2108 Process not Found 2108 Process not Found 2108 Process not Found 2108 Process not Found 2108 Process not Found 2108 Process not Found 2108 Process not Found 2108 Process not Found 2108 Process not Found 2108 Process not Found 2108 Process not Found 2108 Process not Found 2108 Process not Found 2108 Process not Found 2108 Process not Found 2108 Process not Found 2108 Process not Found 2108 Process not Found 2108 Process not Found 2108 Process not Found 2108 Process not Found 2108 Process not Found 2108 Process not Found 2108 Process not Found 2108 Process not Found 2108 Process not Found 2108 Process not Found 2108 Process not Found 2108 Process not Found 2108 Process not Found 2108 Process not Found 2108 Process not Found 2108 Process not Found 2108 Process not Found 2108 Process not Found -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2108 Process not Found -
Suspicious behavior: MapViewOfSection 5 IoCs
pid Process 2940 3dd4ba94c558b54ba1fe639566cbc368.exe 2708 usegjuv 4992 usegjuv 4372 DEBC.exe 4300 usegjuv -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2108 Process not Found Token: SeCreatePagefilePrivilege 2108 Process not Found Token: SeShutdownPrivilege 2108 Process not Found Token: SeCreatePagefilePrivilege 2108 Process not Found Token: SeShutdownPrivilege 2108 Process not Found Token: SeCreatePagefilePrivilege 2108 Process not Found Token: SeShutdownPrivilege 2108 Process not Found Token: SeCreatePagefilePrivilege 2108 Process not Found Token: SeShutdownPrivilege 2108 Process not Found Token: SeCreatePagefilePrivilege 2108 Process not Found Token: SeShutdownPrivilege 2108 Process not Found Token: SeCreatePagefilePrivilege 2108 Process not Found Token: SeShutdownPrivilege 2108 Process not Found Token: SeCreatePagefilePrivilege 2108 Process not Found Token: SeShutdownPrivilege 2108 Process not Found Token: SeCreatePagefilePrivilege 2108 Process not Found Token: SeShutdownPrivilege 2108 Process not Found Token: SeCreatePagefilePrivilege 2108 Process not Found Token: SeShutdownPrivilege 2108 Process not Found Token: SeCreatePagefilePrivilege 2108 Process not Found Token: SeShutdownPrivilege 2108 Process not Found Token: SeCreatePagefilePrivilege 2108 Process not Found Token: SeShutdownPrivilege 2108 Process not Found Token: SeCreatePagefilePrivilege 2108 Process not Found Token: SeShutdownPrivilege 2108 Process not Found Token: SeCreatePagefilePrivilege 2108 Process not Found Token: SeShutdownPrivilege 2108 Process not Found Token: SeCreatePagefilePrivilege 2108 Process not Found Token: SeShutdownPrivilege 2108 Process not Found Token: SeCreatePagefilePrivilege 2108 Process not Found Token: SeShutdownPrivilege 2108 Process not Found Token: SeCreatePagefilePrivilege 2108 Process not Found Token: SeShutdownPrivilege 2108 Process not Found Token: SeCreatePagefilePrivilege 2108 Process not Found Token: SeShutdownPrivilege 2108 Process not Found Token: SeCreatePagefilePrivilege 2108 Process not Found Token: SeShutdownPrivilege 2108 Process not Found Token: SeCreatePagefilePrivilege 2108 Process not Found Token: SeShutdownPrivilege 2108 Process not Found Token: SeCreatePagefilePrivilege 2108 Process not Found Token: SeShutdownPrivilege 2108 Process not Found Token: SeCreatePagefilePrivilege 2108 Process not Found Token: SeShutdownPrivilege 2108 Process not Found Token: SeCreatePagefilePrivilege 2108 Process not Found Token: SeShutdownPrivilege 2108 Process not Found Token: SeCreatePagefilePrivilege 2108 Process not Found Token: SeShutdownPrivilege 2108 Process not Found Token: SeCreatePagefilePrivilege 2108 Process not Found Token: SeShutdownPrivilege 2108 Process not Found Token: SeCreatePagefilePrivilege 2108 Process not Found Token: SeShutdownPrivilege 2108 Process not Found Token: SeCreatePagefilePrivilege 2108 Process not Found Token: SeShutdownPrivilege 2108 Process not Found Token: SeCreatePagefilePrivilege 2108 Process not Found Token: SeShutdownPrivilege 2108 Process not Found Token: SeCreatePagefilePrivilege 2108 Process not Found Token: SeShutdownPrivilege 2108 Process not Found Token: SeCreatePagefilePrivilege 2108 Process not Found Token: SeDebugPrivilege 2384 F19A.exe Token: SeShutdownPrivilege 2108 Process not Found Token: SeCreatePagefilePrivilege 2108 Process not Found Token: SeShutdownPrivilege 2108 Process not Found Token: SeCreatePagefilePrivilege 2108 Process not Found Token: SeShutdownPrivilege 2108 Process not Found -
Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 2108 Process not Found 2108 Process not Found 2108 Process not Found 2108 Process not Found -
Suspicious use of SendNotifyMessage 1 IoCs
pid Process 2108 Process not Found -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4924 OfficeC2RClient.exe 4440 fbf.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3980 wrote to memory of 2940 3980 3dd4ba94c558b54ba1fe639566cbc368.exe 76 PID 3980 wrote to memory of 2940 3980 3dd4ba94c558b54ba1fe639566cbc368.exe 76 PID 3980 wrote to memory of 2940 3980 3dd4ba94c558b54ba1fe639566cbc368.exe 76 PID 3980 wrote to memory of 2940 3980 3dd4ba94c558b54ba1fe639566cbc368.exe 76 PID 3980 wrote to memory of 2940 3980 3dd4ba94c558b54ba1fe639566cbc368.exe 76 PID 3980 wrote to memory of 2940 3980 3dd4ba94c558b54ba1fe639566cbc368.exe 76 PID 5036 wrote to memory of 2708 5036 usegjuv 93 PID 5036 wrote to memory of 2708 5036 usegjuv 93 PID 5036 wrote to memory of 2708 5036 usegjuv 93 PID 5036 wrote to memory of 2708 5036 usegjuv 93 PID 5036 wrote to memory of 2708 5036 usegjuv 93 PID 5036 wrote to memory of 2708 5036 usegjuv 93 PID 3892 wrote to memory of 4992 3892 usegjuv 95 PID 3892 wrote to memory of 4992 3892 usegjuv 95 PID 3892 wrote to memory of 4992 3892 usegjuv 95 PID 3892 wrote to memory of 4992 3892 usegjuv 95 PID 3892 wrote to memory of 4992 3892 usegjuv 95 PID 3892 wrote to memory of 4992 3892 usegjuv 95 PID 2108 wrote to memory of 4116 2108 Process not Found 96 PID 2108 wrote to memory of 4116 2108 Process not Found 96 PID 2108 wrote to memory of 4116 2108 Process not Found 96 PID 2108 wrote to memory of 3376 2108 Process not Found 97 PID 2108 wrote to memory of 3376 2108 Process not Found 97 PID 2108 wrote to memory of 3376 2108 Process not Found 97 PID 4116 wrote to memory of 4372 4116 DEBC.exe 99 PID 4116 wrote to memory of 4372 4116 DEBC.exe 99 PID 4116 wrote to memory of 4372 4116 DEBC.exe 99 PID 4116 wrote to memory of 4372 4116 DEBC.exe 99 PID 4116 wrote to memory of 4372 4116 DEBC.exe 99 PID 4116 wrote to memory of 4372 4116 DEBC.exe 99 PID 2108 wrote to memory of 2384 2108 Process not Found 100 PID 2108 wrote to memory of 2384 2108 Process not Found 100 PID 2108 wrote to memory of 2384 2108 Process not Found 100 PID 2384 wrote to memory of 648 2384 F19A.exe 101 PID 2384 wrote to memory of 648 2384 F19A.exe 101 PID 2384 wrote to memory of 648 2384 F19A.exe 101 PID 2108 wrote to memory of 2064 2108 Process not Found 103 PID 2108 wrote to memory of 2064 2108 Process not Found 103 PID 2108 wrote to memory of 432 2108 Process not Found 104 PID 2108 wrote to memory of 432 2108 Process not Found 104 PID 2108 wrote to memory of 432 2108 Process not Found 104 PID 2108 wrote to memory of 4812 2108 Process not Found 105 PID 2108 wrote to memory of 4812 2108 Process not Found 105 PID 2108 wrote to memory of 4812 2108 Process not Found 105 PID 2108 wrote to memory of 4272 2108 Process not Found 107 PID 2108 wrote to memory of 4272 2108 Process not Found 107 PID 2108 wrote to memory of 4272 2108 Process not Found 107 PID 2108 wrote to memory of 2220 2108 Process not Found 109 PID 2108 wrote to memory of 2220 2108 Process not Found 109 PID 2108 wrote to memory of 2220 2108 Process not Found 109 PID 2108 wrote to memory of 4516 2108 Process not Found 110 PID 2108 wrote to memory of 4516 2108 Process not Found 110 PID 2108 wrote to memory of 4516 2108 Process not Found 110 PID 2108 wrote to memory of 4888 2108 Process not Found 111 PID 2108 wrote to memory of 4888 2108 Process not Found 111 PID 432 wrote to memory of 4040 432 FE8D.exe 114 PID 432 wrote to memory of 4040 432 FE8D.exe 114 PID 432 wrote to memory of 4040 432 FE8D.exe 114 PID 432 wrote to memory of 5032 432 FE8D.exe 115 PID 432 wrote to memory of 5032 432 FE8D.exe 115 PID 432 wrote to memory of 5032 432 FE8D.exe 115 PID 5032 wrote to memory of 5008 5032 cmd.exe 117 PID 5032 wrote to memory of 5008 5032 cmd.exe 117 PID 5032 wrote to memory of 5008 5032 cmd.exe 117
Processes
-
C:\Users\Admin\AppData\Local\Temp\3dd4ba94c558b54ba1fe639566cbc368.exe"C:\Users\Admin\AppData\Local\Temp\3dd4ba94c558b54ba1fe639566cbc368.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3980 -
C:\Users\Admin\AppData\Local\Temp\3dd4ba94c558b54ba1fe639566cbc368.exe"C:\Users\Admin\AppData\Local\Temp\3dd4ba94c558b54ba1fe639566cbc368.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2940
-
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.170.0822.0002\FileSyncConfig.exe"C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.170.0822.0002\FileSyncConfig.exe"1⤵
- Modifies registry class
PID:3352
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe" /frequentupdate SCHEDULEDTASK displaylevel=False1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:4924
-
C:\Users\Admin\AppData\Roaming\usegjuvC:\Users\Admin\AppData\Roaming\usegjuv1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:5036 -
C:\Users\Admin\AppData\Roaming\usegjuvC:\Users\Admin\AppData\Roaming\usegjuv2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:2708
-
-
C:\Users\Admin\AppData\Roaming\usegjuvC:\Users\Admin\AppData\Roaming\usegjuv1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3892 -
C:\Users\Admin\AppData\Roaming\usegjuvC:\Users\Admin\AppData\Roaming\usegjuv2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:4992
-
-
C:\Users\Admin\AppData\Local\Temp\DEBC.exeC:\Users\Admin\AppData\Local\Temp\DEBC.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4116 -
C:\Users\Admin\AppData\Local\Temp\DEBC.exeC:\Users\Admin\AppData\Local\Temp\DEBC.exe2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:4372
-
-
C:\Users\Admin\AppData\Local\Temp\E67D.exeC:\Users\Admin\AppData\Local\Temp\E67D.exe1⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:3376
-
C:\Users\Admin\AppData\Local\Temp\F19A.exeC:\Users\Admin\AppData\Local\Temp\F19A.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2384 -
C:\ProgramData\Stub.exe"C:\ProgramData\Stub.exe"2⤵
- Executes dropped EXE
PID:648
-
-
C:\Users\Admin\AppData\Local\Temp\F593.exeC:\Users\Admin\AppData\Local\Temp\F593.exe1⤵
- Executes dropped EXE
PID:2064
-
C:\Users\Admin\AppData\Local\Temp\FE8D.exeC:\Users\Admin\AppData\Local\Temp\FE8D.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:432 -
C:\Users\Admin\AppData\Local\Temp\FiSFfqJej6.exe"C:\Users\Admin\AppData\Local\Temp\FiSFfqJej6.exe"2⤵
- Executes dropped EXE
PID:4040 -
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\sihost.exe"3⤵
- Creates scheduled task(s)
PID:5048
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\FE8D.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:5032 -
C:\Windows\SysWOW64\timeout.exetimeout /T 10 /NOBREAK3⤵
- Delays execution with timeout.exe
PID:5008
-
-
-
C:\Users\Admin\AppData\Local\Temp\7B5.exeC:\Users\Admin\AppData\Local\Temp\7B5.exe1⤵
- Executes dropped EXE
PID:4812
-
C:\Users\Admin\AppData\Local\Temp\115B.exeC:\Users\Admin\AppData\Local\Temp\115B.exe1⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4272
-
C:\Users\Admin\AppData\Local\Temp\1A17.exeC:\Users\Admin\AppData\Local\Temp\1A17.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2220 -
C:\Windows\SysWOW64\cmd.execmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\1A17.exe"2⤵PID:608
-
C:\Windows\SysWOW64\timeout.exetimeout /T 10 /NOBREAK3⤵
- Delays execution with timeout.exe
PID:3472
-
-
-
C:\Users\Admin\AppData\Local\Temp\21F7.exeC:\Users\Admin\AppData\Local\Temp\21F7.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4516 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4516 -s 13562⤵
- Program crash
PID:4628
-
-
C:\Users\Admin\AppData\Local\Temp\2748.exeC:\Users\Admin\AppData\Local\Temp\2748.exe1⤵
- Executes dropped EXE
PID:4888 -
C:\Users\Admin\AppData\Local\Temp\SindonsWelfare_2021-09-26_15-02.exe"C:\Users\Admin\AppData\Local\Temp\SindonsWelfare_2021-09-26_15-02.exe"2⤵
- Executes dropped EXE
- Checks whether UAC is enabled
PID:1988
-
-
C:\Users\Admin\AppData\Local\Temp\SolanumsYoghurt_2021-09-26_14-52.exe"C:\Users\Admin\AppData\Local\Temp\SolanumsYoghurt_2021-09-26_14-52.exe"2⤵
- Executes dropped EXE
- Checks whether UAC is enabled
PID:2240
-
-
C:\Users\Admin\AppData\Local\Temp\fbf.exe"C:\Users\Admin\AppData\Local\Temp\fbf.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Enumerates connected drives
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
PID:4440
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\sihost.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\sihost.exe1⤵
- Executes dropped EXE
PID:2176 -
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\sihost.exe"2⤵
- Creates scheduled task(s)
PID:484
-
-
C:\Users\Admin\AppData\Roaming\usegjuvC:\Users\Admin\AppData\Roaming\usegjuv1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1188 -
C:\Users\Admin\AppData\Roaming\usegjuvC:\Users\Admin\AppData\Roaming\usegjuv2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:4300
-