6f4c49af2816b18488a1f4e2c08380c719df849c7030652e4971332ba3100927

General

Target

DCQPKX.bin
Size

118KB
MD5

10f237e6da56cf46bfd0ea8c22544bee
SHA1

d83d7974796fd286f24dd606cf11b444ca55e249
SHA256

6f4c49af2816b18488a1f4e2c08380c719df849c7030652e4971332ba3100927
SHA512

834b6c9b3cfe740c3c0560f974e399d9efd2ca4586580bf148a43285b2cc4c0ad21ed05869587143be448f6fb42fa4b8dea9f2a2c585c4bfb77ba8056130c1ab

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs
persistence

Winlogon Helper DLL
T1004

Modify Registry
T1112

Processes:

Argos.exe

description ioc process

Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "empty" Argos.exe
Disables Task Manager via registry modification
evasion
Downloads MZ/PE file
Executes dropped EXE 1 IoCs

Processes:

Argos.exe

pid process

836 Argos.exe
Drops desktop.ini file(s) 1 IoCs

Processes:

Argos.exe

description ioc process

File created C:\Users\Admin\Downloads\desktop.ini Argos.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "empty"	Argos.exe

pid	process
836	Argos.exe

description	ioc	process
File created	C:\Users\Admin\Downloads\desktop.ini	Argos.exe

Drops file in Program Files directory 3 IoCs

Processes:

DCQPKX.bin

description	ioc	process
File created	C:\Program Files\System32\README.txt	DCQPKX.bin
File created	C:\Program Files\System32\Argos.exe	DCQPKX.bin
File created	C:\Program Files\System32\Bunifu_UI_v1.52.dll	DCQPKX.bin

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

108 836 WerFault.exe Argos.exe

pid	pid_target	process	target process
108	836	WerFault.exe	Argos.exe

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d078b91241e9d701	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3A980D51-5534-11EC-8EC9-6E0E796DF1A1} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005bf5749d3a275447873d564a46cb193600000000020000000000106600000001000020000000602ad142ecccacb555e8bfe86f2ba93c3c2a057037bac59c1106fd3da5dcca63000000000e80000000020000200000004249cc4e79c2a9b29af37fcd439fd0fa4018cd5c86d9af4d7f9d1ca9c511c90b200000003f1c550b684af0e03631f08222f4948651fa8c6ee7e89e7768467cf44b4d277e40000000e36a1da725c6421248b2a9c13c93fd1897ea7684e7b44e7b4ea04b7e30459234c2488e210550012c97fa412c5ef829db5fcb582c216ddbcacbc2418cc1f3afd6	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005bf5749d3a275447873d564a46cb19360000000002000000000010660000000100002000000000df6e00942c6730bb5818f6edb9ea8a5e6460923338dac0143c67490d44f790000000000e800000000200002000000033e7a895ee09bdf81359b840637563823d1229df248c9ab6d8e0242faf392f3090000000a19107b705b924485bb37e06c4015734c0e5193faad9574636b5b7d7f1ff357188b4a0ed5e596f3766fec33f0e42c4c6b31c79f21ba20a20d4ebacc0ab03956f183dd04d2782a2e03ea6257a90e29404cf17d399f87d0e469670e89831de5383d8707911a7c54deca4794f6e3b504dfe2a3abe8f7e46f552a8f744df91ca9edffd941d7a3a99f2e97eb41e339d80616e400000000dfd2b6302f69343af1701dd03950be168190cc08767075d67c47df08288dbcd1db0f557810f45d85a6fde331574c92bca7c7f755bbdb4d85ec8725bfda738d6	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "345409314"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe

Modifies system certificate store 2 TTPs 4 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

Processes:

DCQPKX.bin

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25	DCQPKX.bin
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc252000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	DCQPKX.bin
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 040000000100000010000000d474de575c39b2d39c8583c5c065498a0300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc35300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a82000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	DCQPKX.bin
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25040000000100000010000000d474de575c39b2d39c8583c5c065498a2000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	DCQPKX.bin

Suspicious behavior: EnumeratesProcesses 44 IoCs

Processes:

DCQPKX.binArgos.exeWerFault.exe

pid	process
572	DCQPKX.bin
572	DCQPKX.bin
836	Argos.exe
836	Argos.exe
836	Argos.exe
836	Argos.exe
836	Argos.exe
836	Argos.exe
836	Argos.exe
836	Argos.exe
836	Argos.exe
836	Argos.exe
836	Argos.exe
836	Argos.exe
836	Argos.exe
836	Argos.exe
836	Argos.exe
836	Argos.exe
836	Argos.exe
836	Argos.exe
836	Argos.exe
836	Argos.exe
836	Argos.exe
836	Argos.exe
836	Argos.exe
836	Argos.exe
836	Argos.exe
836	Argos.exe
836	Argos.exe
836	Argos.exe
836	Argos.exe
836	Argos.exe
836	Argos.exe
836	Argos.exe
836	Argos.exe
836	Argos.exe
836	Argos.exe
836	Argos.exe
108	WerFault.exe
108	WerFault.exe
108	WerFault.exe
108	WerFault.exe
108	WerFault.exe
108	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

DCQPKX.binArgos.exeWerFault.exe

description pid process

Token: SeDebugPrivilege 572 DCQPKX.bin
Token: SeDebugPrivilege 836 Argos.exe
Token: SeDebugPrivilege 108 WerFault.exe
Suspicious use of FindShellTrayWindow 3 IoCs

Processes:

iexplore.exeWerFault.exe

pid process

1540 iexplore.exe
108 WerFault.exe
108 WerFault.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

iexplore.exe

pid process

1540 iexplore.exe
1540 iexplore.exe

description	pid	process
Token: SeDebugPrivilege	572	DCQPKX.bin
Token: SeDebugPrivilege	836	Argos.exe
Token: SeDebugPrivilege	108	WerFault.exe

pid	process
1540	iexplore.exe
108	WerFault.exe
108	WerFault.exe

pid	process
1540	iexplore.exe
1540	iexplore.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

cmd.exeDCQPKX.biniexplore.exeArgos.exe

description	pid	process	target process
PID 656 wrote to memory of 572	656	cmd.exe	DCQPKX.bin
PID 656 wrote to memory of 572	656	cmd.exe	DCQPKX.bin
PID 656 wrote to memory of 572	656	cmd.exe	DCQPKX.bin
PID 572 wrote to memory of 836	572	DCQPKX.bin	Argos.exe
PID 572 wrote to memory of 836	572	DCQPKX.bin	Argos.exe
PID 572 wrote to memory of 836	572	DCQPKX.bin	Argos.exe
PID 1540 wrote to memory of 1276	1540	iexplore.exe	IEXPLORE.EXE
PID 1540 wrote to memory of 1276	1540	iexplore.exe	IEXPLORE.EXE
PID 1540 wrote to memory of 1276	1540	iexplore.exe	IEXPLORE.EXE
PID 1540 wrote to memory of 1276	1540	iexplore.exe	IEXPLORE.EXE
PID 836 wrote to memory of 108	836	Argos.exe	WerFault.exe
PID 836 wrote to memory of 108	836	Argos.exe	WerFault.exe
PID 836 wrote to memory of 108	836	Argos.exe	WerFault.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\DCQPKX.bin
1⤵
- Suspicious use of WriteProcessMemory
PID:656

C:\Users\Admin\AppData\Local\Temp\DCQPKX.bin
C:\Users\Admin\AppData\Local\Temp\DCQPKX.bin
2⤵
- Drops file in Program Files directory
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:572

C:\Program Files\System32\Argos.exe
"C:\Program Files\System32\Argos.exe"
3⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Drops desktop.ini file(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:836

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 836 -s 780
4⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:108

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\WriteUninstall.htm
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1540

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1540 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
PID:1276

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

1

T1004

Privilege Escalation

Defense Evasion

Modify Registry

3

T1112

Install Root Certificate

1

T1130

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\System32\Argos.exe
MD5
85149ce849c4468a1cd6179c88814de2

SHA1
44099a40b7af2da7e7435d62de84589813580178

SHA256
7bb72f6d4ea8c4008bf51cc0817db28cbf18bdaa3862509d6aa0f842d7822daf

SHA512
d3b1d7a0bded732c51f838116a66d7ae361f1a9c785a1b4ae774b512199182588e12c2489ee75785b291455f87e2dc3a3d1cb92b00c8cb0ce0e60db86cd74272

Download Submit
C:\Program Files\System32\Argos.exe
MD5
85149ce849c4468a1cd6179c88814de2

SHA1
44099a40b7af2da7e7435d62de84589813580178

SHA256
7bb72f6d4ea8c4008bf51cc0817db28cbf18bdaa3862509d6aa0f842d7822daf

SHA512
d3b1d7a0bded732c51f838116a66d7ae361f1a9c785a1b4ae774b512199182588e12c2489ee75785b291455f87e2dc3a3d1cb92b00c8cb0ce0e60db86cd74272

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
MD5
acaeda60c79c6bcac925eeb3653f45e0

SHA1
2aaae490bcdaccc6172240ff1697753b37ac5578

SHA256
6b0ceccf0103afd89844761417c1d23acc41f8aebf3b7230765209b61eee5658

SHA512
feaa6e7ed7dda1583739b3e531ab5c562a222ee6ecd042690ae7dcff966717c6e968469a7797265a11f6e899479ae0f3031e8cf5bebe1492d5205e9c59690900

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
MD5
a364698f173b591caff462baccd45635

SHA1
dcb4e589eef3d1bf4b0f6816357f644f89df5502

SHA256
bb17758b7202efff4be2f2ba9512a05680e5d8146916e55a3ec43ad924f8046a

SHA512
d6358ebe8364670da04e97062aff73da990564aec2157cdb2286fddbb508227b41aebe750679169063128ab88e920d49d638fdc0db2b1e03b300769304e5c3a4

Download Submit
C:\Users\Admin\Desktop\._cache_ARGOS.exe
MD5
8ed6556cd7f9533c8c2657eb0250219b

SHA1
a2e40c11b14efe1d8c1b4e602e6257b4545fd95e

SHA256
0067207bcaeba1d05b5a6d985f93fecd33c4d091825a30a60e6757e56c07f2b0

SHA512
6d9186ea6674ba1c9a1ea9fa036196fd764e9c41e149fd884529dd6bc21ba9bcd132689050a0a229af1055d35617e23fad3c11feac8f5f51e8531c195f9191bc

Download Submit
C:\Users\Admin\Desktop\README.txt
MD5
8b3e49acf59c25c4bc99e11fe8e06f21

SHA1
20f1b205454871df2862cda882bd6150a97823ec

SHA256
3f618be70b390efbbffc37ebda76d8ae1e48155be72ff796d187c7891754875b

SHA512
a0026bacecd0b6f8b7efc5d87c1f10ced199d76b3cd4c29dc31f330d9582db350b052551ad7c215483147b89435c521cabbc2fc663433c72725c792ba9ce1c6f

Download Submit
memory/108-70-0x0000000000000000-mapping.dmp

Download
memory/108-72-0x0000000001D70000-0x0000000001D71000-memory.dmp

Filesize
4KB

Download
memory/108-71-0x000007FEFBD61000-0x000007FEFBD63000-memory.dmp

Filesize
8KB

Download
memory/572-56-0x0000000001380000-0x0000000001381000-memory.dmp

Filesize
4KB

Download
memory/572-58-0x000000001A840000-0x000000001A842000-memory.dmp

Filesize
8KB

Download
memory/572-55-0x0000000000000000-mapping.dmp

Download
memory/836-65-0x00000000006E6000-0x0000000000705000-memory.dmp

Filesize
124KB

Download
memory/836-67-0x0000000000705000-0x0000000000706000-memory.dmp

Filesize
4KB

Download
memory/836-64-0x00000000006E0000-0x00000000006E2000-memory.dmp

Filesize
8KB

Download
memory/836-62-0x0000000000B00000-0x0000000000B01000-memory.dmp

Filesize
4KB

Download
memory/836-59-0x0000000000000000-mapping.dmp

Download
memory/1276-69-0x0000000000000000-mapping.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads