Overview
overview
10Static
static
3dd4ba94c5...68.exe
windows7_x64
103dd4ba94c5...68.exe
windows7_x64
103dd4ba94c5...68.exe
windows7_x64
103dd4ba94c5...68.exe
windows11_x64
103dd4ba94c5...68.exe
windows10_x64
103dd4ba94c5...68.exe
windows10_x64
103dd4ba94c5...68.exe
windows10_x64
103dd4ba94c5...68.exe
windows10_x64
10Analysis
-
max time kernel
1802s -
max time network
1799s -
platform
windows10_x64 -
resource
win10-de-20210920 -
submitted
26-09-2021 14:45
Static task
static1
Behavioral task
behavioral1
Sample
3dd4ba94c558b54ba1fe639566cbc368.exe
Resource
win7-ja-20210920
arkeichinese_generic_botnetraccoonredlinesmokeloader5ff0ccb2bc00dc52d1ad09949e9c7663bc9ca4d4b2f2e53f9e27f901d453d8f6fbafe1b4d5266bb7blissinstallszxckarmaz0rm1onbuildbackdoorbotnetdiscoveryevasioninfostealerspywarestealerthemidatrojan
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
3dd4ba94c558b54ba1fe639566cbc368.exe
Resource
win7v20210408
arkeichinese_generic_botnetraccoonredlinesmokeloader5ff0ccb2bc00dc52d1ad09949e9c7663bc9ca4d4b2f2e53f9e27f901d453d8f6fbafe1b4d5266bb7blissinstallszxckarmaz0rm1onbuildbackdoorbotnetdiscoveryevasioninfostealerspywarestealersuricatathemidatrojan
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral3
Sample
3dd4ba94c558b54ba1fe639566cbc368.exe
Resource
win7-de-20210920
arkeichinese_generic_botnetraccoonredlinesmokeloader5ff0ccb2bc00dc52d1ad09949e9c7663bc9ca4d4b2f2e53f9e27f901d453d8f6fbafe1b4d5266bb7blissinstallszxckarmaz0rm1onbuildbackdoorbotnetdiscoveryevasioninfostealerspywarestealerthemidatrojan
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral4
Sample
3dd4ba94c558b54ba1fe639566cbc368.exe
Resource
win11
arkeiraccoonredlinesmokeloaderinstallszxcz0rm1onbuildbackdoordiscoveryevasioninfostealerspywarestealersuricatathemidatrojan
windows11_x64
0 signatures
0 seconds
Behavioral task
behavioral5
Sample
3dd4ba94c558b54ba1fe639566cbc368.exe
Resource
win10v20210408
arkeichinese_generic_botnetraccoonredlinesmokeloader5ff0ccb2bc00dc52d1ad09949e9c7663bc9ca4d4b2f2e53f9e27f901d453d8f6fbafe1b4d5266bb7blisskarmabackdoorbotnetdiscoveryevasioninfostealerpersistencespywarestealersuricatathemidatrojan
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral6
Sample
3dd4ba94c558b54ba1fe639566cbc368.exe
Resource
win10-ja-20210920
arkeiraccoonredlinesmokeloader5ff0ccb2bc00dc52d1ad09949e9c7663bc9ca4d4b2f2e53f9e27f901d453d8f6fbafe1b4d5266bb7f6d7183c9e82d2a9b81e6c0608450aa66cefb51finstallszxcz0rm1onbuildbackdoordiscoveryevasioninfostealerpersistencespywarestealersuricatathemidatrojan
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral7
Sample
3dd4ba94c558b54ba1fe639566cbc368.exe
Resource
win10-en-20210920
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral8
Sample
3dd4ba94c558b54ba1fe639566cbc368.exe
Resource
win10-de-20210920
arkeiraccoonredlinesmokeloader5ff0ccb2bc00dc52d1ad09949e9c7663bc9ca4d4b2f2e53f9e27f901d453d8f6fbafe1b4d5266bb7f6d7183c9e82d2a9b81e6c0608450aa66cefb51finstallszxcz0rm1onbuildbackdoordiscoveryevasioninfostealerpersistencespywarestealersuricatathemidatrojan
windows10_x64
0 signatures
0 seconds
General
-
Target
3dd4ba94c558b54ba1fe639566cbc368.exe
-
Size
237KB
-
MD5
3dd4ba94c558b54ba1fe639566cbc368
-
SHA1
8c44f1c918c3d2fd48694e8af653e473be3e02c1
-
SHA256
c75b223b462ba88c62c1c8d848a845e7aeacc0ec0c96a7ecf1644e782accdd52
-
SHA512
58e828507bd3be52ea340ed835c3dc06a655db0a067c746ef65e7382d2b09eb5e7d6847dc679b89539826b598749e60ddf62859e25930b8e586acc11228bb1fa
Malware Config
Extracted
Family
smokeloader
Version
2020
C2
http://naghenrietti1.top/
http://kimballiett2.top/
http://xadriettany3.top/
http://jebeccallis4.top/
http://nityanneron5.top/
http://umayaniela6.top/
http://lynettaram7.top/
http://sadineyalas8.top/
http://geenaldencia9.top/
http://aradysiusep10.top/
rc4.i32
rc4.i32
Extracted
Family
redline
Botnet
installszxc
C2
138.124.186.2:27999
Extracted
Family
redline
Botnet
z0rm1onbuild
C2
45.156.21.209:56326
Extracted
Family
raccoon
Botnet
b2f2e53f9e27f901d453d8f6fbafe1b4d5266bb7
Attributes
-
url4cnc
https://t.me/hcdrom1
rc4.plain
rc4.plain
Extracted
Family
raccoon
Botnet
f6d7183c9e82d2a9b81e6c0608450aa66cefb51f
Attributes
-
url4cnc
https://t.me/justoprostohello
rc4.plain
rc4.plain
Extracted
Family
raccoon
Botnet
5ff0ccb2bc00dc52d1ad09949e9c7663bc9ca4d4
Attributes
-
url4cnc
https://t.me/agrybirdsgamerept
rc4.plain
rc4.plain
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 4 IoCs
resource yara_rule behavioral8/files/0x000200000001a2ca-163.dat family_redline behavioral8/files/0x000200000001a2ca-164.dat family_redline behavioral8/memory/2452-188-0x0000000000EF0000-0x0000000000F0E000-memory.dmp family_redline behavioral8/memory/2748-319-0x00000000004D0000-0x000000000061A000-memory.dmp family_redline -
Registers COM server for autorun 1 TTPs
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
suricata: ET MALWARE Sharik/Smoke CnC Beacon 11
suricata: ET MALWARE Sharik/Smoke CnC Beacon 11
-
suricata: ET MALWARE Win32.Raccoon Stealer CnC Activity (dependency download)
suricata: ET MALWARE Win32.Raccoon Stealer CnC Activity (dependency download)
-
suricata: ET MALWARE Win32.Raccoon Stealer Data Exfil Attempt
suricata: ET MALWARE Win32.Raccoon Stealer Data Exfil Attempt
-
Arkei Stealer Payload 1 IoCs
resource yara_rule behavioral8/memory/3552-281-0x0000000000400000-0x000000000044D000-memory.dmp family_arkei -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
Downloads MZ/PE file
-
Executes dropped EXE 23 IoCs
pid Process 2928 jvasguu 2776 jvasguu 2424 D5E3.exe 1880 DDB4.exe 772 D5E3.exe 3064 3CEC.exe 1552 Stub.exe 2452 9231.exe 372 90D6.exe 508 9A2D.exe 656 A318.exe 1232 A897.exe 1852 v4m2QTdZmu.exe 2288 sihost.exe 3512 jvasguu 480 jvasguu 3552 4D87.exe 3780 5102.exe 3500 SindonsWelfare_2021-09-26_15-02.exe 2748 SolanumsYoghurt_2021-09-26_14-52.exe 1644 fbf.exe 2336 jvasguu 1728 jvasguu -
Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion DDB4.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion A318.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion A318.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion DDB4.exe -
Deletes itself 1 IoCs
pid Process 3048 Process not Found -
Loads dropped DLL 14 IoCs
pid Process 372 90D6.exe 372 90D6.exe 372 90D6.exe 372 90D6.exe 372 90D6.exe 372 90D6.exe 1232 A897.exe 1232 A897.exe 1232 A897.exe 1232 A897.exe 1232 A897.exe 3552 4D87.exe 3552 4D87.exe 3552 4D87.exe -
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral8/files/0x000400000001a2c5-130.dat themida behavioral8/files/0x000400000001a2c5-131.dat themida behavioral8/memory/1880-137-0x0000000000260000-0x0000000000261000-memory.dmp themida behavioral8/files/0x000300000001a2d2-218.dat themida behavioral8/memory/656-220-0x0000000000890000-0x0000000000891000-memory.dmp themida -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Uuuocai.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\fbf.exe" fbf.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA DDB4.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA A318.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\G: fbf.exe File opened (read-only) \??\L: fbf.exe File opened (read-only) \??\U: fbf.exe File opened (read-only) \??\V: fbf.exe File opened (read-only) \??\W: fbf.exe File opened (read-only) \??\X: fbf.exe File opened (read-only) \??\N: fbf.exe File opened (read-only) \??\P: fbf.exe File opened (read-only) \??\T: fbf.exe File opened (read-only) \??\Z: fbf.exe File opened (read-only) \??\B: fbf.exe File opened (read-only) \??\F: fbf.exe File opened (read-only) \??\H: fbf.exe File opened (read-only) \??\J: fbf.exe File opened (read-only) \??\K: fbf.exe File opened (read-only) \??\O: fbf.exe File opened (read-only) \??\S: fbf.exe File opened (read-only) \??\Y: fbf.exe File opened (read-only) \??\E: fbf.exe File opened (read-only) \??\I: fbf.exe File opened (read-only) \??\M: fbf.exe File opened (read-only) \??\Q: fbf.exe File opened (read-only) \??\R: fbf.exe -
Drops file in System32 directory 4 IoCs
description ioc Process File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat OfficeC2RClient.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\OTele\officec2rclient.exe.db OfficeC2RClient.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\OTele\officec2rclient.exe.db-wal OfficeC2RClient.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\OTele\officec2rclient.exe.db-shm OfficeC2RClient.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 1880 DDB4.exe 656 A318.exe -
Suspicious use of SetThreadContext 5 IoCs
description pid Process procid_target PID 3564 set thread context of 1064 3564 3dd4ba94c558b54ba1fe639566cbc368.exe 75 PID 2928 set thread context of 2776 2928 jvasguu 91 PID 2424 set thread context of 772 2424 D5E3.exe 95 PID 3512 set thread context of 480 3512 jvasguu 119 PID 2336 set thread context of 1728 2336 jvasguu 131 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
pid pid_target Process procid_target 2640 3552 WerFault.exe 120 -
Checks SCSI registry key(s) 3 TTPs 15 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 3dd4ba94c558b54ba1fe639566cbc368.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI jvasguu Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI jvasguu Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI jvasguu Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI D5E3.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI D5E3.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI jvasguu Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 3dd4ba94c558b54ba1fe639566cbc368.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 3dd4ba94c558b54ba1fe639566cbc368.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI jvasguu Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI jvasguu Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI jvasguu Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI jvasguu Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI D5E3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI jvasguu -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 fbf.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz fbf.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1444 schtasks.exe 3784 schtasks.exe -
Delays execution with timeout.exe 2 IoCs
pid Process 3616 timeout.exe 320 timeout.exe -
Modifies data under HKEY_USERS 23 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\ExternalFeatureOverrides\officeclicktorun OfficeC2RClient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData OfficeC2RClient.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages\en-US = "2" OfficeC2RClient.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages\en-US = "1" OfficeC2RClient.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officec2rclient.exe\ULSMonitor OfficeC2RClient.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officec2rclient.exe OfficeC2RClient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata OfficeC2RClient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun OfficeC2RClient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs OfficeC2RClient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentEcs\all\Overrides OfficeC2RClient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\TrustCenter\Experimentation OfficeC2RClient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officec2rclient.exe OfficeC2RClient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0 OfficeC2RClient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\Common\ClientTelemetry OfficeC2RClient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\Common\ClientTelemetry\Volatile OfficeC2RClient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\FirstSession\officeclicktorun OfficeC2RClient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry OfficeC2RClient.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officec2rclient.exe\ULSMonitor\ULSTagIds0 = "5804129,17110992,7202269,17110988,7153487,39965824,17962391,17962392,3702920,3462423,3700754,3965062,4297094,7153421,18716193,7153435,7202265,20502174,6308191,18407617" OfficeC2RClient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentEcs\Overrides OfficeC2RClient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentEcs\officeclicktorun\Overrides OfficeC2RClient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officec2rclient.exe\ULSMonitor OfficeC2RClient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common OfficeC2RClient.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officec2rclient.exe\ULSMonitor\ULSCategoriesSeverities = "1329 10,1329 50,941 10,1329 15,941 15,941 6,1329 100,1329 6" OfficeC2RClient.exe -
Modifies registry class 47 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6} FileSyncConfig.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance Process not Found Key deleted \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_CLASSES\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\SHELLFOLDER FileSyncConfig.exe Key deleted \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6} FileSyncConfig.exe Key created \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\InProcServer32 FileSyncConfig.exe Set value (str) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\InProcServer32\ = "%systemroot%\\SysWow64\\shell32.dll" FileSyncConfig.exe Key created \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\InitPropertyBag FileSyncConfig.exe Set value (int) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\ShellFolder\FolderValueFlags = "40" FileSyncConfig.exe Set value (str) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\ = "OneDrive" FileSyncConfig.exe Key created \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\ShellFolder FileSyncConfig.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance Process not Found Key deleted \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_CLASSES\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\DEFAULTICON FileSyncConfig.exe Set value (int) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\System.IsPinnedToNameSpaceTree = "1" FileSyncConfig.exe Key created \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\InProcServer32 FileSyncConfig.exe Set value (str) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\CLSID = "{0E5AAE11-A475-4c5b-AB00-C66DE400274E}" FileSyncConfig.exe Key deleted \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_CLASSES\WOW6432NODE\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\SHELLFOLDER FileSyncConfig.exe Key deleted \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6} FileSyncConfig.exe Key deleted \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_CLASSES\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\INSTANCE\INITPROPERTYBAG FileSyncConfig.exe Set value (str) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\ = "OneDrive" FileSyncConfig.exe Key created \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\DefaultIcon FileSyncConfig.exe Key created \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6} FileSyncConfig.exe Key created \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\DefaultIcon FileSyncConfig.exe Set value (str) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\OneDrive.exe,0" FileSyncConfig.exe Key created \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance FileSyncConfig.exe Key deleted \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_CLASSES\WOW6432NODE\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\DEFAULTICON FileSyncConfig.exe Key deleted \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance FileSyncConfig.exe Key deleted \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_CLASSES\WOW6432NODE\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\INSTANCE\INITPROPERTYBAG FileSyncConfig.exe Set value (int) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\SortOrderIndex = "66" FileSyncConfig.exe Set value (str) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\OneDrive.exe,0" FileSyncConfig.exe Set value (int) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\ShellFolder\Attributes = "4034920525" FileSyncConfig.exe Set value (int) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\SortOrderIndex = "66" FileSyncConfig.exe Set value (str) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\InProcServer32\ = "%systemroot%\\system32\\shell32.dll" FileSyncConfig.exe Set value (int) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\ShellFolder\Attributes = "4034920525" FileSyncConfig.exe Key deleted \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_CLASSES\WOW6432NODE\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\INPROCSERVER32 FileSyncConfig.exe Key deleted \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_CLASSES\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\INPROCSERVER32 FileSyncConfig.exe Set value (int) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\System.IsPinnedToNameSpaceTree = "1" FileSyncConfig.exe Key created \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance FileSyncConfig.exe Set value (str) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\CLSID = "{0E5AAE11-A475-4c5b-AB00-C66DE400274E}" FileSyncConfig.exe Set value (int) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\InitPropertyBag\Attributes = "17" FileSyncConfig.exe Key created \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\ShellFolder FileSyncConfig.exe Set value (int) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\InitPropertyBag\Attributes = "17" FileSyncConfig.exe Set value (str) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\InitPropertyBag\TargetKnownFolder = "{a52bba46-e9e1-435f-b3d9-28daa648c0f6}" FileSyncConfig.exe Key created \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance Process not Found Key deleted \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance FileSyncConfig.exe Set value (str) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\InitPropertyBag\TargetKnownFolder = "{a52bba46-e9e1-435f-b3d9-28daa648c0f6}" FileSyncConfig.exe Key created \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\InitPropertyBag FileSyncConfig.exe Set value (int) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\ShellFolder\FolderValueFlags = "40" FileSyncConfig.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1064 3dd4ba94c558b54ba1fe639566cbc368.exe 1064 3dd4ba94c558b54ba1fe639566cbc368.exe 3048 Process not Found 3048 Process not Found 3048 Process not Found 3048 Process not Found 3048 Process not Found 3048 Process not Found 3048 Process not Found 3048 Process not Found 3048 Process not Found 3048 Process not Found 3048 Process not Found 3048 Process not Found 3048 Process not Found 3048 Process not Found 3048 Process not Found 3048 Process not Found 3048 Process not Found 3048 Process not Found 3048 Process not Found 3048 Process not Found 3048 Process not Found 3048 Process not Found 3048 Process not Found 3048 Process not Found 3048 Process not Found 3048 Process not Found 3048 Process not Found 3048 Process not Found 3048 Process not Found 3048 Process not Found 3048 Process not Found 3048 Process not Found 3048 Process not Found 3048 Process not Found 3048 Process not Found 3048 Process not Found 3048 Process not Found 3048 Process not Found 3048 Process not Found 3048 Process not Found 3048 Process not Found 3048 Process not Found 3048 Process not Found 3048 Process not Found 3048 Process not Found 3048 Process not Found 3048 Process not Found 3048 Process not Found 3048 Process not Found 3048 Process not Found 3048 Process not Found 3048 Process not Found 3048 Process not Found 3048 Process not Found 3048 Process not Found 3048 Process not Found 3048 Process not Found 3048 Process not Found 3048 Process not Found 3048 Process not Found 3048 Process not Found 3048 Process not Found -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3048 Process not Found -
Suspicious behavior: MapViewOfSection 5 IoCs
pid Process 1064 3dd4ba94c558b54ba1fe639566cbc368.exe 2776 jvasguu 772 D5E3.exe 480 jvasguu 1728 jvasguu -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3048 Process not Found Token: SeCreatePagefilePrivilege 3048 Process not Found Token: SeShutdownPrivilege 3048 Process not Found Token: SeCreatePagefilePrivilege 3048 Process not Found Token: SeShutdownPrivilege 3048 Process not Found Token: SeCreatePagefilePrivilege 3048 Process not Found Token: SeShutdownPrivilege 3048 Process not Found Token: SeCreatePagefilePrivilege 3048 Process not Found Token: SeShutdownPrivilege 3048 Process not Found Token: SeCreatePagefilePrivilege 3048 Process not Found Token: SeShutdownPrivilege 3048 Process not Found Token: SeCreatePagefilePrivilege 3048 Process not Found Token: SeShutdownPrivilege 3048 Process not Found Token: SeCreatePagefilePrivilege 3048 Process not Found Token: SeShutdownPrivilege 3048 Process not Found Token: SeCreatePagefilePrivilege 3048 Process not Found Token: SeShutdownPrivilege 3048 Process not Found Token: SeCreatePagefilePrivilege 3048 Process not Found Token: SeShutdownPrivilege 3048 Process not Found Token: SeCreatePagefilePrivilege 3048 Process not Found Token: SeShutdownPrivilege 3048 Process not Found Token: SeCreatePagefilePrivilege 3048 Process not Found Token: SeShutdownPrivilege 3048 Process not Found Token: SeCreatePagefilePrivilege 3048 Process not Found Token: SeShutdownPrivilege 3048 Process not Found Token: SeCreatePagefilePrivilege 3048 Process not Found Token: SeShutdownPrivilege 3048 Process not Found Token: SeCreatePagefilePrivilege 3048 Process not Found Token: SeShutdownPrivilege 3048 Process not Found Token: SeCreatePagefilePrivilege 3048 Process not Found Token: SeShutdownPrivilege 3048 Process not Found Token: SeCreatePagefilePrivilege 3048 Process not Found Token: SeShutdownPrivilege 3048 Process not Found Token: SeCreatePagefilePrivilege 3048 Process not Found Token: SeShutdownPrivilege 3048 Process not Found Token: SeCreatePagefilePrivilege 3048 Process not Found Token: SeShutdownPrivilege 3048 Process not Found Token: SeCreatePagefilePrivilege 3048 Process not Found Token: SeShutdownPrivilege 3048 Process not Found Token: SeCreatePagefilePrivilege 3048 Process not Found Token: SeShutdownPrivilege 3048 Process not Found Token: SeCreatePagefilePrivilege 3048 Process not Found Token: SeShutdownPrivilege 3048 Process not Found Token: SeCreatePagefilePrivilege 3048 Process not Found Token: SeShutdownPrivilege 3048 Process not Found Token: SeCreatePagefilePrivilege 3048 Process not Found Token: SeShutdownPrivilege 3048 Process not Found Token: SeCreatePagefilePrivilege 3048 Process not Found Token: SeShutdownPrivilege 3048 Process not Found Token: SeCreatePagefilePrivilege 3048 Process not Found Token: SeShutdownPrivilege 3048 Process not Found Token: SeCreatePagefilePrivilege 3048 Process not Found Token: SeShutdownPrivilege 3048 Process not Found Token: SeCreatePagefilePrivilege 3048 Process not Found Token: SeShutdownPrivilege 3048 Process not Found Token: SeCreatePagefilePrivilege 3048 Process not Found Token: SeShutdownPrivilege 3048 Process not Found Token: SeCreatePagefilePrivilege 3048 Process not Found Token: SeShutdownPrivilege 3048 Process not Found Token: SeCreatePagefilePrivilege 3048 Process not Found Token: SeShutdownPrivilege 3048 Process not Found Token: SeCreatePagefilePrivilege 3048 Process not Found Token: SeShutdownPrivilege 3048 Process not Found Token: SeCreatePagefilePrivilege 3048 Process not Found -
Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 3048 Process not Found 3048 Process not Found 3048 Process not Found 3048 Process not Found -
Suspicious use of SendNotifyMessage 1 IoCs
pid Process 3048 Process not Found -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4088 OfficeC2RClient.exe 1644 fbf.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3564 wrote to memory of 1064 3564 3dd4ba94c558b54ba1fe639566cbc368.exe 75 PID 3564 wrote to memory of 1064 3564 3dd4ba94c558b54ba1fe639566cbc368.exe 75 PID 3564 wrote to memory of 1064 3564 3dd4ba94c558b54ba1fe639566cbc368.exe 75 PID 3564 wrote to memory of 1064 3564 3dd4ba94c558b54ba1fe639566cbc368.exe 75 PID 3564 wrote to memory of 1064 3564 3dd4ba94c558b54ba1fe639566cbc368.exe 75 PID 3564 wrote to memory of 1064 3564 3dd4ba94c558b54ba1fe639566cbc368.exe 75 PID 2928 wrote to memory of 2776 2928 jvasguu 91 PID 2928 wrote to memory of 2776 2928 jvasguu 91 PID 2928 wrote to memory of 2776 2928 jvasguu 91 PID 2928 wrote to memory of 2776 2928 jvasguu 91 PID 2928 wrote to memory of 2776 2928 jvasguu 91 PID 2928 wrote to memory of 2776 2928 jvasguu 91 PID 3048 wrote to memory of 2424 3048 Process not Found 92 PID 3048 wrote to memory of 2424 3048 Process not Found 92 PID 3048 wrote to memory of 2424 3048 Process not Found 92 PID 3048 wrote to memory of 1880 3048 Process not Found 93 PID 3048 wrote to memory of 1880 3048 Process not Found 93 PID 3048 wrote to memory of 1880 3048 Process not Found 93 PID 2424 wrote to memory of 772 2424 D5E3.exe 95 PID 2424 wrote to memory of 772 2424 D5E3.exe 95 PID 2424 wrote to memory of 772 2424 D5E3.exe 95 PID 2424 wrote to memory of 772 2424 D5E3.exe 95 PID 2424 wrote to memory of 772 2424 D5E3.exe 95 PID 2424 wrote to memory of 772 2424 D5E3.exe 95 PID 3048 wrote to memory of 3064 3048 Process not Found 97 PID 3048 wrote to memory of 3064 3048 Process not Found 97 PID 3048 wrote to memory of 3064 3048 Process not Found 97 PID 3064 wrote to memory of 1552 3064 3CEC.exe 98 PID 3064 wrote to memory of 1552 3064 3CEC.exe 98 PID 3064 wrote to memory of 1552 3064 3CEC.exe 98 PID 3048 wrote to memory of 2452 3048 Process not Found 100 PID 3048 wrote to memory of 2452 3048 Process not Found 100 PID 3048 wrote to memory of 372 3048 Process not Found 101 PID 3048 wrote to memory of 372 3048 Process not Found 101 PID 3048 wrote to memory of 372 3048 Process not Found 101 PID 3048 wrote to memory of 508 3048 Process not Found 102 PID 3048 wrote to memory of 508 3048 Process not Found 102 PID 3048 wrote to memory of 508 3048 Process not Found 102 PID 3048 wrote to memory of 656 3048 Process not Found 103 PID 3048 wrote to memory of 656 3048 Process not Found 103 PID 3048 wrote to memory of 656 3048 Process not Found 103 PID 3048 wrote to memory of 1232 3048 Process not Found 105 PID 3048 wrote to memory of 1232 3048 Process not Found 105 PID 3048 wrote to memory of 1232 3048 Process not Found 105 PID 372 wrote to memory of 1852 372 90D6.exe 106 PID 372 wrote to memory of 1852 372 90D6.exe 106 PID 372 wrote to memory of 1852 372 90D6.exe 106 PID 372 wrote to memory of 3128 372 90D6.exe 107 PID 372 wrote to memory of 3128 372 90D6.exe 107 PID 372 wrote to memory of 3128 372 90D6.exe 107 PID 3128 wrote to memory of 3616 3128 cmd.exe 109 PID 3128 wrote to memory of 3616 3128 cmd.exe 109 PID 3128 wrote to memory of 3616 3128 cmd.exe 109 PID 1852 wrote to memory of 1444 1852 v4m2QTdZmu.exe 110 PID 1852 wrote to memory of 1444 1852 v4m2QTdZmu.exe 110 PID 1852 wrote to memory of 1444 1852 v4m2QTdZmu.exe 110 PID 1232 wrote to memory of 588 1232 A897.exe 112 PID 1232 wrote to memory of 588 1232 A897.exe 112 PID 1232 wrote to memory of 588 1232 A897.exe 112 PID 588 wrote to memory of 320 588 cmd.exe 114 PID 588 wrote to memory of 320 588 cmd.exe 114 PID 588 wrote to memory of 320 588 cmd.exe 114 PID 2288 wrote to memory of 3784 2288 sihost.exe 116 PID 2288 wrote to memory of 3784 2288 sihost.exe 116
Processes
-
C:\Users\Admin\AppData\Local\Temp\3dd4ba94c558b54ba1fe639566cbc368.exe"C:\Users\Admin\AppData\Local\Temp\3dd4ba94c558b54ba1fe639566cbc368.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3564 -
C:\Users\Admin\AppData\Local\Temp\3dd4ba94c558b54ba1fe639566cbc368.exe"C:\Users\Admin\AppData\Local\Temp\3dd4ba94c558b54ba1fe639566cbc368.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:1064
-
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.170.0822.0002\FileSyncConfig.exe"C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.170.0822.0002\FileSyncConfig.exe"1⤵
- Modifies registry class
PID:3604
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe" /frequentupdate SCHEDULEDTASK displaylevel=False1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:4088
-
C:\Users\Admin\AppData\Roaming\jvasguuC:\Users\Admin\AppData\Roaming\jvasguu1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2928 -
C:\Users\Admin\AppData\Roaming\jvasguuC:\Users\Admin\AppData\Roaming\jvasguu2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:2776
-
-
C:\Users\Admin\AppData\Local\Temp\D5E3.exeC:\Users\Admin\AppData\Local\Temp\D5E3.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2424 -
C:\Users\Admin\AppData\Local\Temp\D5E3.exeC:\Users\Admin\AppData\Local\Temp\D5E3.exe2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:772
-
-
C:\Users\Admin\AppData\Local\Temp\DDB4.exeC:\Users\Admin\AppData\Local\Temp\DDB4.exe1⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1880
-
C:\Users\Admin\AppData\Local\Temp\3CEC.exeC:\Users\Admin\AppData\Local\Temp\3CEC.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3064 -
C:\ProgramData\Stub.exe"C:\ProgramData\Stub.exe"2⤵
- Executes dropped EXE
PID:1552
-
-
C:\Users\Admin\AppData\Local\Temp\9231.exeC:\Users\Admin\AppData\Local\Temp\9231.exe1⤵
- Executes dropped EXE
PID:2452
-
C:\Users\Admin\AppData\Local\Temp\90D6.exeC:\Users\Admin\AppData\Local\Temp\90D6.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:372 -
C:\Users\Admin\AppData\Local\Temp\v4m2QTdZmu.exe"C:\Users\Admin\AppData\Local\Temp\v4m2QTdZmu.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1852 -
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\sihost.exe"3⤵
- Creates scheduled task(s)
PID:1444
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\90D6.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3128 -
C:\Windows\SysWOW64\timeout.exetimeout /T 10 /NOBREAK3⤵
- Delays execution with timeout.exe
PID:3616
-
-
-
C:\Users\Admin\AppData\Local\Temp\9A2D.exeC:\Users\Admin\AppData\Local\Temp\9A2D.exe1⤵
- Executes dropped EXE
PID:508
-
C:\Users\Admin\AppData\Local\Temp\A318.exeC:\Users\Admin\AppData\Local\Temp\A318.exe1⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:656
-
C:\Users\Admin\AppData\Local\Temp\A897.exeC:\Users\Admin\AppData\Local\Temp\A897.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1232 -
C:\Windows\SysWOW64\cmd.execmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\A897.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:588 -
C:\Windows\SysWOW64\timeout.exetimeout /T 10 /NOBREAK3⤵
- Delays execution with timeout.exe
PID:320
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\sihost.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\sihost.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2288 -
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\sihost.exe"2⤵
- Creates scheduled task(s)
PID:3784
-
-
C:\Users\Admin\AppData\Roaming\jvasguuC:\Users\Admin\AppData\Roaming\jvasguu1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3512 -
C:\Users\Admin\AppData\Roaming\jvasguuC:\Users\Admin\AppData\Roaming\jvasguu2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:480
-
-
C:\Users\Admin\AppData\Local\Temp\4D87.exeC:\Users\Admin\AppData\Local\Temp\4D87.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3552 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3552 -s 13202⤵
- Program crash
PID:2640
-
-
C:\Users\Admin\AppData\Local\Temp\5102.exeC:\Users\Admin\AppData\Local\Temp\5102.exe1⤵
- Executes dropped EXE
PID:3780 -
C:\Users\Admin\AppData\Local\Temp\SindonsWelfare_2021-09-26_15-02.exe"C:\Users\Admin\AppData\Local\Temp\SindonsWelfare_2021-09-26_15-02.exe"2⤵
- Executes dropped EXE
PID:3500
-
-
C:\Users\Admin\AppData\Local\Temp\SolanumsYoghurt_2021-09-26_14-52.exe"C:\Users\Admin\AppData\Local\Temp\SolanumsYoghurt_2021-09-26_14-52.exe"2⤵
- Executes dropped EXE
PID:2748
-
-
C:\Users\Admin\AppData\Local\Temp\fbf.exe"C:\Users\Admin\AppData\Local\Temp\fbf.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Enumerates connected drives
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
PID:1644
-
-
C:\Users\Admin\AppData\Roaming\jvasguuC:\Users\Admin\AppData\Roaming\jvasguu1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2336 -
C:\Users\Admin\AppData\Roaming\jvasguuC:\Users\Admin\AppData\Roaming\jvasguu2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:1728
-