Analysis
-
max time kernel
144s -
max time network
143s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
14-10-2021 09:25
Static task
static1
General
-
Target
Se adjunta estado de cuenta.exe
-
Size
774KB
-
MD5
4a951f6b124474b354ad38403074d5bd
-
SHA1
b633ade3ba620fcc4ae0a96adc0e30c502cf3017
-
SHA256
5d94a08cddf84ab11cc26e7e8531a04bab46f9ddf44c1ccd7e38a269ffdfaad0
-
SHA512
3b1c03ee01a32e186e4a9a84f90f6713c90c7cc04e974d28956155ba754d5cc19e5544b9815b069a5284dd1d05eecd36b4e137945619281041b43c5f26a53d73
Malware Config
Extracted
formbook
4.1
bc3s
http://www.topei-products.com/bc3s/
anna-ng.com
mariangelamata.com
szqnbl.com
nesherguitars.com
mysekrit.com
againbeautyviensui.xyz
appf.life
bilalsolution.com
technoratii.com
11restoran.com
birthingly.com
crystalcarrillo.com
cohenasset.info
bunchofdesign.com
highstreetmag.com
talentkerning.com
outdoor-glassesadvice.com
aliceeety.com
habbuhot.info
pao91.com
resgatarpontosparavoce.com
tuancai.net
cnynckcrw.com
visaza.com
paulettecallen.com
kandmfinancialgroup.com
malibuclassix.com
thespoonteller.com
vidyaxyp.com
xn--gmsepetim-q9ab20j.com
saudesexualdoshomens.com
safehandmarketing.com
yebimhieu.site
alimitchellmedia.com
andrewpatrickpiette.com
astro-paradise.com
domainechoquet.com
navihealthpartners.com
detroitveganseafood.com
spankingandpunishment.com
magalu-queromais.com
mallsinup.com
rmsnidlogini.cloud
lifeisveryessential.com
stolzfus.com
iniciala.com
designslayers.com
clinivahq.com
ubersms.com
welenb.com
skyegroupllc.com
happyburger.net
moredate-s.com
alon-mail.com
voceprofessor.com
dokadveri.com
lafabricadisseny.com
westwooddesign.net
blossoms-boutique.com
jumtix.xyz
dietgulfport.com
soccerstreamer.com
lapurtcedd.com
secret-mall.com
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Formbook Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1076-116-0x0000000000000000-mapping.dmp formbook behavioral1/memory/1076-118-0x0000000072480000-0x00000000724AE000-memory.dmp formbook behavioral1/memory/1160-126-0x0000000000740000-0x000000000076E000-memory.dmp formbook -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
Se adjunta estado de cuenta.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\Obzwclq = "C:\\Users\\Public\\Libraries\\qlcwzbO.url" Se adjunta estado de cuenta.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
logagent.execmd.exedescription pid process target process PID 1076 set thread context of 3028 1076 logagent.exe Explorer.EXE PID 1160 set thread context of 3028 1160 cmd.exe Explorer.EXE -
Processes:
Explorer.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Toolbar Explorer.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1" Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser Explorer.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 Explorer.EXE -
Modifies registry class 61 IoCs
Processes:
Explorer.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\WorkFolders Explorer.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\ShowCmd = "1" Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings Explorer.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Vid = "{137E7700-3573-11CF-AE69-08002B2E1262}" Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668} Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3 Explorer.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0 = 3a002e8005398e082303024b98265d99428e115f260001002600efbe11000000f4ecfc87702cd701b477473c762cd701b477473c762cd70114000000 Explorer.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 14001f80cb859f6720028040b29b5540cc05aab60000 Explorer.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 020000000100000000000000ffffffff Explorer.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}\GroupByKey:FMTID = "{30C8EEF4-A832-41E2-AB32-E3C3CA28FD29}" Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0 Explorer.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}\FFlags = "1092616193" Explorer.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}\FFlags = "1092616209" Explorer.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}\GroupByKey:PID = "2" Explorer.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Rev = "0" Explorer.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616193" Explorer.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" Explorer.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1" Explorer.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = ffffffff Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2 Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell Explorer.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}\Rev = "0" Explorer.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}\LogicalViewMode = "2" Explorer.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}\Sort = 0000000000000000000000000000000002000000f4eec83032a8e241ab32e3c3ca28fd29030000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 Explorer.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}\GroupView = "4294967295" Explorer.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}\GroupByDirection = "1" Explorer.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags Explorer.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 Explorer.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0" Explorer.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}\Mode = "6" Explorer.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202 Explorer.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0\NodeSlot = "3" Explorer.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16" Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU Explorer.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff Explorer.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2 = 14001f50e04fd020ea3a6910a2d808002b30309d0000 Explorer.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0" Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance Explorer.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202 Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7} Explorer.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance Explorer.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff Explorer.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000007800000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 Explorer.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}\IconSize = "48" Explorer.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000007800000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell Explorer.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\HotKey = "0" Explorer.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 Explorer.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0\MRUListEx = ffffffff Explorer.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1" Explorer.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\SniffedFolderType = "Generic" Explorer.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4" Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2 Explorer.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\MRUListEx = 00000000ffffffff Explorer.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\KnownFolderDerivedFolderType = "{57807898-8C4F-4462-BB63-71042380B109}" Explorer.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\WFlags = "0" Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 Explorer.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}\Vid = "{65F125E5-7BE1-4810-BA9D-D271C8432CE3}" Explorer.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\NodeSlot = "2" Explorer.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
Explorer.EXEpid process 3028 Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 52 IoCs
Processes:
logagent.execmd.exepid process 1076 logagent.exe 1076 logagent.exe 1076 logagent.exe 1076 logagent.exe 1160 cmd.exe 1160 cmd.exe 1160 cmd.exe 1160 cmd.exe 1160 cmd.exe 1160 cmd.exe 1160 cmd.exe 1160 cmd.exe 1160 cmd.exe 1160 cmd.exe 1160 cmd.exe 1160 cmd.exe 1160 cmd.exe 1160 cmd.exe 1160 cmd.exe 1160 cmd.exe 1160 cmd.exe 1160 cmd.exe 1160 cmd.exe 1160 cmd.exe 1160 cmd.exe 1160 cmd.exe 1160 cmd.exe 1160 cmd.exe 1160 cmd.exe 1160 cmd.exe 1160 cmd.exe 1160 cmd.exe 1160 cmd.exe 1160 cmd.exe 1160 cmd.exe 1160 cmd.exe 1160 cmd.exe 1160 cmd.exe 1160 cmd.exe 1160 cmd.exe 1160 cmd.exe 1160 cmd.exe 1160 cmd.exe 1160 cmd.exe 1160 cmd.exe 1160 cmd.exe 1160 cmd.exe 1160 cmd.exe 1160 cmd.exe 1160 cmd.exe 1160 cmd.exe 1160 cmd.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 3028 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
logagent.execmd.exepid process 1076 logagent.exe 1076 logagent.exe 1076 logagent.exe 1160 cmd.exe 1160 cmd.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
logagent.exeExplorer.EXEcmd.exedescription pid process Token: SeDebugPrivilege 1076 logagent.exe Token: SeShutdownPrivilege 3028 Explorer.EXE Token: SeCreatePagefilePrivilege 3028 Explorer.EXE Token: SeShutdownPrivilege 3028 Explorer.EXE Token: SeCreatePagefilePrivilege 3028 Explorer.EXE Token: SeDebugPrivilege 1160 cmd.exe Token: SeShutdownPrivilege 3028 Explorer.EXE Token: SeCreatePagefilePrivilege 3028 Explorer.EXE Token: SeShutdownPrivilege 3028 Explorer.EXE Token: SeCreatePagefilePrivilege 3028 Explorer.EXE Token: SeShutdownPrivilege 3028 Explorer.EXE Token: SeCreatePagefilePrivilege 3028 Explorer.EXE Token: SeShutdownPrivilege 3028 Explorer.EXE Token: SeCreatePagefilePrivilege 3028 Explorer.EXE Token: SeShutdownPrivilege 3028 Explorer.EXE Token: SeCreatePagefilePrivilege 3028 Explorer.EXE Token: SeShutdownPrivilege 3028 Explorer.EXE Token: SeCreatePagefilePrivilege 3028 Explorer.EXE Token: SeShutdownPrivilege 3028 Explorer.EXE Token: SeCreatePagefilePrivilege 3028 Explorer.EXE Token: SeShutdownPrivilege 3028 Explorer.EXE Token: SeCreatePagefilePrivilege 3028 Explorer.EXE Token: SeShutdownPrivilege 3028 Explorer.EXE Token: SeCreatePagefilePrivilege 3028 Explorer.EXE Token: SeShutdownPrivilege 3028 Explorer.EXE Token: SeCreatePagefilePrivilege 3028 Explorer.EXE Token: SeShutdownPrivilege 3028 Explorer.EXE Token: SeCreatePagefilePrivilege 3028 Explorer.EXE Token: SeShutdownPrivilege 3028 Explorer.EXE Token: SeCreatePagefilePrivilege 3028 Explorer.EXE Token: SeShutdownPrivilege 3028 Explorer.EXE Token: SeCreatePagefilePrivilege 3028 Explorer.EXE Token: SeShutdownPrivilege 3028 Explorer.EXE Token: SeCreatePagefilePrivilege 3028 Explorer.EXE Token: SeShutdownPrivilege 3028 Explorer.EXE Token: SeCreatePagefilePrivilege 3028 Explorer.EXE Token: SeShutdownPrivilege 3028 Explorer.EXE Token: SeCreatePagefilePrivilege 3028 Explorer.EXE Token: SeShutdownPrivilege 3028 Explorer.EXE Token: SeCreatePagefilePrivilege 3028 Explorer.EXE Token: SeShutdownPrivilege 3028 Explorer.EXE Token: SeCreatePagefilePrivilege 3028 Explorer.EXE Token: SeShutdownPrivilege 3028 Explorer.EXE Token: SeCreatePagefilePrivilege 3028 Explorer.EXE Token: SeShutdownPrivilege 3028 Explorer.EXE Token: SeCreatePagefilePrivilege 3028 Explorer.EXE Token: SeShutdownPrivilege 3028 Explorer.EXE Token: SeCreatePagefilePrivilege 3028 Explorer.EXE Token: SeShutdownPrivilege 3028 Explorer.EXE Token: SeCreatePagefilePrivilege 3028 Explorer.EXE Token: SeShutdownPrivilege 3028 Explorer.EXE Token: SeCreatePagefilePrivilege 3028 Explorer.EXE Token: SeShutdownPrivilege 3028 Explorer.EXE Token: SeCreatePagefilePrivilege 3028 Explorer.EXE Token: SeShutdownPrivilege 3028 Explorer.EXE Token: SeCreatePagefilePrivilege 3028 Explorer.EXE Token: SeShutdownPrivilege 3028 Explorer.EXE Token: SeCreatePagefilePrivilege 3028 Explorer.EXE Token: SeShutdownPrivilege 3028 Explorer.EXE Token: SeCreatePagefilePrivilege 3028 Explorer.EXE Token: SeShutdownPrivilege 3028 Explorer.EXE Token: SeCreatePagefilePrivilege 3028 Explorer.EXE Token: SeShutdownPrivilege 3028 Explorer.EXE Token: SeCreatePagefilePrivilege 3028 Explorer.EXE -
Suspicious use of FindShellTrayWindow 14 IoCs
Processes:
Explorer.EXEpid process 3028 Explorer.EXE 3028 Explorer.EXE 3028 Explorer.EXE 3028 Explorer.EXE 3028 Explorer.EXE 3028 Explorer.EXE 3028 Explorer.EXE 3028 Explorer.EXE 3028 Explorer.EXE 3028 Explorer.EXE 3028 Explorer.EXE 3028 Explorer.EXE 3028 Explorer.EXE 3028 Explorer.EXE -
Suspicious use of SendNotifyMessage 64 IoCs
Processes:
Explorer.EXEpid process 3028 Explorer.EXE 3028 Explorer.EXE 3028 Explorer.EXE 3028 Explorer.EXE 3028 Explorer.EXE 3028 Explorer.EXE 3028 Explorer.EXE 3028 Explorer.EXE 3028 Explorer.EXE 3028 Explorer.EXE 3028 Explorer.EXE 3028 Explorer.EXE 3028 Explorer.EXE 3028 Explorer.EXE 3028 Explorer.EXE 3028 Explorer.EXE 3028 Explorer.EXE 3028 Explorer.EXE 3028 Explorer.EXE 3028 Explorer.EXE 3028 Explorer.EXE 3028 Explorer.EXE 3028 Explorer.EXE 3028 Explorer.EXE 3028 Explorer.EXE 3028 Explorer.EXE 3028 Explorer.EXE 3028 Explorer.EXE 3028 Explorer.EXE 3028 Explorer.EXE 3028 Explorer.EXE 3028 Explorer.EXE 3028 Explorer.EXE 3028 Explorer.EXE 3028 Explorer.EXE 3028 Explorer.EXE 3028 Explorer.EXE 3028 Explorer.EXE 3028 Explorer.EXE 3028 Explorer.EXE 3028 Explorer.EXE 3028 Explorer.EXE 3028 Explorer.EXE 3028 Explorer.EXE 3028 Explorer.EXE 3028 Explorer.EXE 3028 Explorer.EXE 3028 Explorer.EXE 3028 Explorer.EXE 3028 Explorer.EXE 3028 Explorer.EXE 3028 Explorer.EXE 3028 Explorer.EXE 3028 Explorer.EXE 3028 Explorer.EXE 3028 Explorer.EXE 3028 Explorer.EXE 3028 Explorer.EXE 3028 Explorer.EXE 3028 Explorer.EXE 3028 Explorer.EXE 3028 Explorer.EXE 3028 Explorer.EXE 3028 Explorer.EXE -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
Explorer.EXEpid process 3028 Explorer.EXE 3028 Explorer.EXE 3028 Explorer.EXE 3028 Explorer.EXE 3028 Explorer.EXE 3028 Explorer.EXE -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 3028 Explorer.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
Se adjunta estado de cuenta.exeExplorer.EXEcmd.exedescription pid process target process PID 4044 wrote to memory of 1076 4044 Se adjunta estado de cuenta.exe logagent.exe PID 4044 wrote to memory of 1076 4044 Se adjunta estado de cuenta.exe logagent.exe PID 4044 wrote to memory of 1076 4044 Se adjunta estado de cuenta.exe logagent.exe PID 4044 wrote to memory of 1076 4044 Se adjunta estado de cuenta.exe logagent.exe PID 4044 wrote to memory of 1076 4044 Se adjunta estado de cuenta.exe logagent.exe PID 4044 wrote to memory of 1076 4044 Se adjunta estado de cuenta.exe logagent.exe PID 3028 wrote to memory of 1160 3028 Explorer.EXE cmd.exe PID 3028 wrote to memory of 1160 3028 Explorer.EXE cmd.exe PID 3028 wrote to memory of 1160 3028 Explorer.EXE cmd.exe PID 1160 wrote to memory of 1596 1160 cmd.exe cmd.exe PID 1160 wrote to memory of 1596 1160 cmd.exe cmd.exe PID 1160 wrote to memory of 1596 1160 cmd.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Se adjunta estado de cuenta.exe"C:\Users\Admin\AppData\Local\Temp\Se adjunta estado de cuenta.exe"2⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\logagent.exeC:\Windows\System32\logagent.exe3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\SysWOW64\logagent.exe"3⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1076-116-0x0000000000000000-mapping.dmp
-
memory/1076-118-0x0000000072480000-0x00000000724AE000-memory.dmpFilesize
184KB
-
memory/1076-117-0x0000000002D40000-0x0000000002D41000-memory.dmpFilesize
4KB
-
memory/1076-121-0x00000000033B0000-0x0000000003417000-memory.dmpFilesize
412KB
-
memory/1076-120-0x0000000004F00000-0x0000000005220000-memory.dmpFilesize
3.1MB
-
memory/1160-123-0x0000000000000000-mapping.dmp
-
memory/1160-125-0x0000000000C40000-0x0000000000C99000-memory.dmpFilesize
356KB
-
memory/1160-126-0x0000000000740000-0x000000000076E000-memory.dmpFilesize
184KB
-
memory/1160-127-0x0000000003340000-0x0000000003660000-memory.dmpFilesize
3.1MB
-
memory/1160-128-0x0000000003200000-0x0000000003293000-memory.dmpFilesize
588KB
-
memory/1596-124-0x0000000000000000-mapping.dmp
-
memory/3028-122-0x0000000006DB0000-0x0000000006EBD000-memory.dmpFilesize
1.1MB
-
memory/3028-129-0x0000000007250000-0x00000000073D4000-memory.dmpFilesize
1.5MB
-
memory/3028-130-0x0000000000FE0000-0x0000000000FE2000-memory.dmpFilesize
8KB
-
memory/3028-131-0x0000000000FE0000-0x0000000000FE2000-memory.dmpFilesize
8KB
-
memory/3028-132-0x0000000000F90000-0x0000000000FA0000-memory.dmpFilesize
64KB
-
memory/3028-133-0x0000000000FE0000-0x0000000000FE2000-memory.dmpFilesize
8KB
-
memory/3028-134-0x0000000001070000-0x0000000001080000-memory.dmpFilesize
64KB
-
memory/3028-135-0x0000000000FE0000-0x0000000000FE2000-memory.dmpFilesize
8KB
-
memory/3028-136-0x0000000000FE0000-0x0000000000FE2000-memory.dmpFilesize
8KB
-
memory/3028-137-0x0000000001070000-0x0000000001080000-memory.dmpFilesize
64KB
-
memory/3028-138-0x0000000000FE0000-0x0000000000FE2000-memory.dmpFilesize
8KB
-
memory/3028-139-0x0000000001070000-0x0000000001080000-memory.dmpFilesize
64KB
-
memory/3028-140-0x0000000001070000-0x0000000001080000-memory.dmpFilesize
64KB
-
memory/3028-141-0x0000000001070000-0x0000000001080000-memory.dmpFilesize
64KB
-
memory/3028-142-0x0000000001070000-0x0000000001080000-memory.dmpFilesize
64KB
-
memory/3028-143-0x0000000000FE0000-0x0000000000FE2000-memory.dmpFilesize
8KB
-
memory/3028-144-0x0000000000FE0000-0x0000000000FE2000-memory.dmpFilesize
8KB
-
memory/3028-145-0x0000000001070000-0x0000000001080000-memory.dmpFilesize
64KB
-
memory/3028-146-0x0000000000FE0000-0x0000000000FE2000-memory.dmpFilesize
8KB
-
memory/3028-147-0x0000000000FE0000-0x0000000000FE2000-memory.dmpFilesize
8KB
-
memory/3028-148-0x0000000001070000-0x0000000001080000-memory.dmpFilesize
64KB
-
memory/3028-149-0x0000000001070000-0x0000000001080000-memory.dmpFilesize
64KB
-
memory/3028-150-0x0000000001070000-0x0000000001080000-memory.dmpFilesize
64KB
-
memory/3028-151-0x0000000001070000-0x0000000001080000-memory.dmpFilesize
64KB
-
memory/3028-152-0x0000000001070000-0x0000000001080000-memory.dmpFilesize
64KB
-
memory/3028-153-0x0000000000FE0000-0x0000000000FE2000-memory.dmpFilesize
8KB
-
memory/3028-154-0x0000000000FE0000-0x0000000000FE2000-memory.dmpFilesize
8KB
-
memory/3028-155-0x0000000001070000-0x0000000001080000-memory.dmpFilesize
64KB
-
memory/3028-156-0x0000000001070000-0x0000000001080000-memory.dmpFilesize
64KB
-
memory/3028-157-0x0000000001070000-0x0000000001080000-memory.dmpFilesize
64KB
-
memory/3028-158-0x0000000001070000-0x0000000001080000-memory.dmpFilesize
64KB
-
memory/3028-160-0x0000000001070000-0x0000000001080000-memory.dmpFilesize
64KB
-
memory/3028-159-0x0000000000F90000-0x0000000000FA0000-memory.dmpFilesize
64KB
-
memory/3028-162-0x0000000001070000-0x0000000001080000-memory.dmpFilesize
64KB
-
memory/3028-163-0x0000000001070000-0x0000000001080000-memory.dmpFilesize
64KB
-
memory/3028-161-0x0000000001080000-0x0000000001090000-memory.dmpFilesize
64KB
-
memory/3028-164-0x0000000001070000-0x0000000001080000-memory.dmpFilesize
64KB
-
memory/3028-165-0x0000000001070000-0x0000000001080000-memory.dmpFilesize
64KB
-
memory/3028-166-0x0000000001070000-0x0000000001080000-memory.dmpFilesize
64KB
-
memory/3028-167-0x0000000003090000-0x00000000030A0000-memory.dmpFilesize
64KB
-
memory/3028-168-0x0000000001070000-0x0000000001080000-memory.dmpFilesize
64KB
-
memory/3028-171-0x0000000001070000-0x0000000001080000-memory.dmpFilesize
64KB
-
memory/3028-174-0x0000000001070000-0x0000000001080000-memory.dmpFilesize
64KB
-
memory/3028-173-0x0000000001070000-0x0000000001080000-memory.dmpFilesize
64KB
-
memory/3028-172-0x0000000001070000-0x0000000001080000-memory.dmpFilesize
64KB
-
memory/3028-169-0x0000000003090000-0x00000000030A0000-memory.dmpFilesize
64KB
-
memory/3028-170-0x0000000001070000-0x0000000001080000-memory.dmpFilesize
64KB
-
memory/3028-175-0x0000000003090000-0x00000000030A0000-memory.dmpFilesize
64KB
-
memory/3028-177-0x0000000001070000-0x0000000001080000-memory.dmpFilesize
64KB
-
memory/3028-176-0x0000000001070000-0x0000000001080000-memory.dmpFilesize
64KB
-
memory/3028-178-0x0000000001070000-0x0000000001080000-memory.dmpFilesize
64KB
-
memory/3028-179-0x0000000001070000-0x0000000001080000-memory.dmpFilesize
64KB
-
memory/3028-180-0x0000000000FE0000-0x0000000000FE2000-memory.dmpFilesize
8KB
-
memory/4044-114-0x0000000002811000-0x0000000002825000-memory.dmpFilesize
80KB
-
memory/4044-115-0x0000000002220000-0x0000000002221000-memory.dmpFilesize
4KB