c2452b97cff633876bc788ac4f72eb39f459a6c58f2a44f8443de1049b66d181

General

Target

a4863b8da0f8b001d7c28b956139e23f.exe
Size

1.3MB
MD5

a4863b8da0f8b001d7c28b956139e23f
SHA1

7d1d9bca4bf89e00e465f98f759f6d5b958fe4e4
SHA256

c2452b97cff633876bc788ac4f72eb39f459a6c58f2a44f8443de1049b66d181
SHA512

8b2fb4c0ec99bc92ad2c6081fc84fd6e83ca7b01f46fe87469bbf506ea8323d680f72edbd633396c0f2fd3d550ad0740a36c52c4af2457aefd27fe23b3781f1d

Score

10^/10

discovery persistence spyware stealer suricata

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 8 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

a4863b8da0f8b001d7c28b956139e23f.exea4863b8da0f8b001d7c28b956139e23f.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Uninstall Information\\a4863b8da0f8b001d7c28b956139e23f.exe\", \"C:\\Windows\\System32\\DXPTaskRingtone\\spoolsv.exe\", \"C:\\Windows\\System32\\fc\\csrss.exe\""	a4863b8da0f8b001d7c28b956139e23f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Uninstall Information\\a4863b8da0f8b001d7c28b956139e23f.exe\", \"C:\\Windows\\System32\\DXPTaskRingtone\\spoolsv.exe\", \"C:\\Windows\\System32\\fc\\csrss.exe\", \"C:\\Windows\\System32\\perfc011\\sppsvc.exe\""	a4863b8da0f8b001d7c28b956139e23f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Uninstall Information\\a4863b8da0f8b001d7c28b956139e23f.exe\", \"C:\\Windows\\System32\\DXPTaskRingtone\\spoolsv.exe\", \"C:\\Windows\\System32\\fc\\csrss.exe\", \"C:\\Windows\\System32\\perfc011\\sppsvc.exe\", \"C:\\Recovery\\467657e2-3dd5-11ec-a0d6-f2080972ab74\\services.exe\""	a4863b8da0f8b001d7c28b956139e23f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Uninstall Information\\a4863b8da0f8b001d7c28b956139e23f.exe\", \"C:\\Windows\\System32\\DXPTaskRingtone\\spoolsv.exe\", \"C:\\Windows\\System32\\fc\\csrss.exe\", \"C:\\Windows\\System32\\perfc011\\sppsvc.exe\", \"C:\\Recovery\\467657e2-3dd5-11ec-a0d6-f2080972ab74\\services.exe\", \"C:\\Recovery\\467657e2-3dd5-11ec-a0d6-f2080972ab74\\dwm.exe\""	a4863b8da0f8b001d7c28b956139e23f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Uninstall Information\\a4863b8da0f8b001d7c28b956139e23f.exe\", \"C:\\Windows\\System32\\DXPTaskRingtone\\spoolsv.exe\", \"C:\\Windows\\System32\\fc\\csrss.exe\", \"C:\\Windows\\System32\\perfc011\\sppsvc.exe\", \"C:\\Recovery\\467657e2-3dd5-11ec-a0d6-f2080972ab74\\services.exe\", \"C:\\Recovery\\467657e2-3dd5-11ec-a0d6-f2080972ab74\\dwm.exe\", \"C:\\Windows\\System32\\wbem\\RacWmiProv\\WmiPrvSE.exe\""	a4863b8da0f8b001d7c28b956139e23f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Uninstall Information\\a4863b8da0f8b001d7c28b956139e23f.exe\", \"C:\\Windows\\System32\\DXPTaskRingtone\\spoolsv.exe\", \"C:\\Windows\\System32\\fc\\csrss.exe\", \"C:\\Windows\\System32\\perfc011\\sppsvc.exe\", \"C:\\Recovery\\467657e2-3dd5-11ec-a0d6-f2080972ab74\\services.exe\", \"C:\\Recovery\\467657e2-3dd5-11ec-a0d6-f2080972ab74\\dwm.exe\", \"C:\\Windows\\System32\\wbem\\RacWmiProv\\WmiPrvSE.exe\", \"C:\\PerfLogs\\Admin\\lsass.exe\""	a4863b8da0f8b001d7c28b956139e23f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Uninstall Information\\a4863b8da0f8b001d7c28b956139e23f.exe\""	a4863b8da0f8b001d7c28b956139e23f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Uninstall Information\\a4863b8da0f8b001d7c28b956139e23f.exe\", \"C:\\Windows\\System32\\DXPTaskRingtone\\spoolsv.exe\""	a4863b8da0f8b001d7c28b956139e23f.exe

Process spawned unexpected child process 8 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

description	pid	pid_target	process
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2000	1108	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1228	1108	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1136	1108	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1600	1108	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	956	1108	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1724	1108	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1684	1108	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	568	1108	schtasks.exe

suricata: ET MALWARE DCRAT Activity (GET)
suricata: ET MALWARE DCRAT Activity (GET)
suricata
Executes dropped EXE 2 IoCs

Processes:

a4863b8da0f8b001d7c28b956139e23f.exeservices.exe

pid process

1992 a4863b8da0f8b001d7c28b956139e23f.exe
1812 services.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

pid	process
1992	a4863b8da0f8b001d7c28b956139e23f.exe
1812	services.exe

Adds Run key to start application 2 TTPs 16 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

a4863b8da0f8b001d7c28b956139e23f.exea4863b8da0f8b001d7c28b956139e23f.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Windows\CurrentVersion\Run\a4863b8da0f8b001d7c28b956139e23f = "\"C:\\Program Files\\Uninstall Information\\a4863b8da0f8b001d7c28b956139e23f.exe\""	a4863b8da0f8b001d7c28b956139e23f.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\Windows\\System32\\perfc011\\sppsvc.exe\""	a4863b8da0f8b001d7c28b956139e23f.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Recovery\\467657e2-3dd5-11ec-a0d6-f2080972ab74\\services.exe\""	a4863b8da0f8b001d7c28b956139e23f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Recovery\\467657e2-3dd5-11ec-a0d6-f2080972ab74\\dwm.exe\""	a4863b8da0f8b001d7c28b956139e23f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "\"C:\\Windows\\System32\\wbem\\RacWmiProv\\WmiPrvSE.exe\""	a4863b8da0f8b001d7c28b956139e23f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\System32\\fc\\csrss.exe\""	a4863b8da0f8b001d7c28b956139e23f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\Windows\\System32\\perfc011\\sppsvc.exe\""	a4863b8da0f8b001d7c28b956139e23f.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "\"C:\\Windows\\System32\\wbem\\RacWmiProv\\WmiPrvSE.exe\""	a4863b8da0f8b001d7c28b956139e23f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\a4863b8da0f8b001d7c28b956139e23f = "\"C:\\Program Files\\Uninstall Information\\a4863b8da0f8b001d7c28b956139e23f.exe\""	a4863b8da0f8b001d7c28b956139e23f.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\Windows\\System32\\DXPTaskRingtone\\spoolsv.exe\""	a4863b8da0f8b001d7c28b956139e23f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\Windows\\System32\\DXPTaskRingtone\\spoolsv.exe\""	a4863b8da0f8b001d7c28b956139e23f.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\System32\\fc\\csrss.exe\""	a4863b8da0f8b001d7c28b956139e23f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Recovery\\467657e2-3dd5-11ec-a0d6-f2080972ab74\\services.exe\""	a4863b8da0f8b001d7c28b956139e23f.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Recovery\\467657e2-3dd5-11ec-a0d6-f2080972ab74\\dwm.exe\""	a4863b8da0f8b001d7c28b956139e23f.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\PerfLogs\\Admin\\lsass.exe\""	a4863b8da0f8b001d7c28b956139e23f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\PerfLogs\\Admin\\lsass.exe\""	a4863b8da0f8b001d7c28b956139e23f.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 15 IoCs

Processes:

a4863b8da0f8b001d7c28b956139e23f.exea4863b8da0f8b001d7c28b956139e23f.exe

description	ioc	process
File created	C:\Windows\System32\perfc011\sppsvc.exe	a4863b8da0f8b001d7c28b956139e23f.exe
File opened for modification	C:\Windows\System32\DXPTaskRingtone\spoolsv.exe	a4863b8da0f8b001d7c28b956139e23f.exe
File opened for modification	C:\Windows\System32\fc\RCXD829.tmp	a4863b8da0f8b001d7c28b956139e23f.exe
File created	C:\Windows\System32\wbem\RacWmiProv\24dbde2999530ef5fd907494bc374d663924116c	a4863b8da0f8b001d7c28b956139e23f.exe
File created	C:\Windows\System32\DXPTaskRingtone\f3b6ecef712a24f33798f5d2fb3790c3d9b894c4	a4863b8da0f8b001d7c28b956139e23f.exe
File opened for modification	C:\Windows\System32\DXPTaskRingtone\RCXD51C.tmp	a4863b8da0f8b001d7c28b956139e23f.exe
File opened for modification	C:\Windows\System32\perfc011\sppsvc.exe	a4863b8da0f8b001d7c28b956139e23f.exe
File created	C:\Windows\System32\DXPTaskRingtone\spoolsv.exe	a4863b8da0f8b001d7c28b956139e23f.exe
File created	C:\Windows\System32\fc\csrss.exe	a4863b8da0f8b001d7c28b956139e23f.exe
File created	C:\Windows\System32\fc\886983d96e3d3e31032c679b2d4ea91b6c05afef	a4863b8da0f8b001d7c28b956139e23f.exe
File created	C:\Windows\System32\perfc011\0a1fd5f707cd16ea89afd3d6db52b2da58214a6c	a4863b8da0f8b001d7c28b956139e23f.exe
File opened for modification	C:\Windows\System32\perfc011\RCXDB46.tmp	a4863b8da0f8b001d7c28b956139e23f.exe
File created	C:\Windows\System32\wbem\RacWmiProv\WmiPrvSE.exe	a4863b8da0f8b001d7c28b956139e23f.exe
File opened for modification	C:\Windows\System32\fc\csrss.exe	a4863b8da0f8b001d7c28b956139e23f.exe
File opened for modification	C:\Windows\System32\wbem\RacWmiProv\WmiPrvSE.exe	a4863b8da0f8b001d7c28b956139e23f.exe

Drops file in Program Files directory 4 IoCs

Processes:

a4863b8da0f8b001d7c28b956139e23f.exe

description	ioc	process
File created	C:\Program Files\Uninstall Information\a4863b8da0f8b001d7c28b956139e23f.exe	a4863b8da0f8b001d7c28b956139e23f.exe
File opened for modification	C:\Program Files\Uninstall Information\a4863b8da0f8b001d7c28b956139e23f.exe	a4863b8da0f8b001d7c28b956139e23f.exe
File created	C:\Program Files\Uninstall Information\8bdb607b0d6d8ac503d9b1f1205cfbba47d77f90	a4863b8da0f8b001d7c28b956139e23f.exe
File opened for modification	C:\Program Files\Uninstall Information\RCXD20F.tmp	a4863b8da0f8b001d7c28b956139e23f.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 8 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid process

1684 schtasks.exe
568 schtasks.exe
2000 schtasks.exe
1228 schtasks.exe
1136 schtasks.exe
1600 schtasks.exe
956 schtasks.exe
1724 schtasks.exe

pid	process
1684	schtasks.exe
568	schtasks.exe
2000	schtasks.exe
1228	schtasks.exe
1136	schtasks.exe
1600	schtasks.exe
956	schtasks.exe
1724	schtasks.exe

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6F766E01-555F-11EC-8E0E-CA5035EAFC97} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb601b266500a1439caac4cd216a44ab0000000002000000000010660000000100002000000084bd705073ef3dda53abb7523ed624f7d53e522831bc7f09d261595d76d7b760000000000e800000000200002000000079dbcb0dc7f8b53e56e17b9bb45e5671d5c179fe2be71fc5fbdf11608dcc52fc900000008a6ea34456312287faeab3da4a64853d722b6d6451c7039ba53e5fa0ba23fa08ed6df60552629845424ed317ecdddefac891ef949a330be185a0a2309492bebf8a76fcad2ccc5bf0af4bbe12705046cc8dcd7db809c6b559b6791633a2f59244ed40efcde5ee68e031c6ba3edf0bfea2274e9414031dfcc8245286f4c3246eb222c7488bef6e9d55578c4c4ff7c9637a40000000d95419abbc7d2a22bf80757ef43e588498b4dba0a9fb4f2d411a019a6c19ae90e2e2add9a754c6f535a9a6d145a4f200d94146f67354f533b1cad08748ee6a8a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "345427868"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c007634b6ce9d701	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb601b266500a1439caac4cd216a44ab000000000200000000001066000000010000200000003aa85a7ee0896564ab1907eacbd3b618128cb1d0c27c832d4c49d531242abaa9000000000e800000000200002000000003b5d8381eba6dc640252fd775b2b9a6cc90e1db2ca2ac2b099d21ca58b98e9620000000b6210dc30d2893398c80c41c4f747e30407ab1642c32ad086a70b42a1f82eca9400000000f9d72f5a3dbed3f5931054d753fe97d01bc8a133a02f6eec54e31d43c4b4bd8fb5ee06421b1c72cc2eba43196850d852bd4a09924a8c81f676183ebe6f63f38	iexplore.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

Processes:

a4863b8da0f8b001d7c28b956139e23f.exea4863b8da0f8b001d7c28b956139e23f.exeservices.exe

pid	process
524	a4863b8da0f8b001d7c28b956139e23f.exe
1992	a4863b8da0f8b001d7c28b956139e23f.exe
1812	services.exe
1812	services.exe
1812	services.exe
1812	services.exe
1812	services.exe
1812	services.exe
1812	services.exe
1812	services.exe
1812	services.exe
1812	services.exe
1812	services.exe
1812	services.exe
1812	services.exe
1812	services.exe
1812	services.exe
1812	services.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

services.exe

pid process

1812 services.exe

pid	process
1812	services.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

a4863b8da0f8b001d7c28b956139e23f.exea4863b8da0f8b001d7c28b956139e23f.exeservices.exe

description	pid	process
Token: SeDebugPrivilege	524	a4863b8da0f8b001d7c28b956139e23f.exe
Token: SeDebugPrivilege	1992	a4863b8da0f8b001d7c28b956139e23f.exe
Token: SeDebugPrivilege	1812	services.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

1688 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

1688 iexplore.exe
1688 iexplore.exe
2040 IEXPLORE.EXE
2040 IEXPLORE.EXE
2040 IEXPLORE.EXE
2040 IEXPLORE.EXE

pid	process
1688	iexplore.exe

pid	process
1688	iexplore.exe
1688	iexplore.exe
2040	IEXPLORE.EXE
2040	IEXPLORE.EXE
2040	IEXPLORE.EXE
2040	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

a4863b8da0f8b001d7c28b956139e23f.exea4863b8da0f8b001d7c28b956139e23f.exeservices.exeiexplore.exe

description	pid	process	target process
PID 524 wrote to memory of 1992	524	a4863b8da0f8b001d7c28b956139e23f.exe	a4863b8da0f8b001d7c28b956139e23f.exe
PID 524 wrote to memory of 1992	524	a4863b8da0f8b001d7c28b956139e23f.exe	a4863b8da0f8b001d7c28b956139e23f.exe
PID 524 wrote to memory of 1992	524	a4863b8da0f8b001d7c28b956139e23f.exe	a4863b8da0f8b001d7c28b956139e23f.exe
PID 1992 wrote to memory of 1812	1992	a4863b8da0f8b001d7c28b956139e23f.exe	services.exe
PID 1992 wrote to memory of 1812	1992	a4863b8da0f8b001d7c28b956139e23f.exe	services.exe
PID 1992 wrote to memory of 1812	1992	a4863b8da0f8b001d7c28b956139e23f.exe	services.exe
PID 1812 wrote to memory of 1688	1812	services.exe	iexplore.exe
PID 1812 wrote to memory of 1688	1812	services.exe	iexplore.exe
PID 1812 wrote to memory of 1688	1812	services.exe	iexplore.exe
PID 1688 wrote to memory of 2040	1688	iexplore.exe	IEXPLORE.EXE
PID 1688 wrote to memory of 2040	1688	iexplore.exe	IEXPLORE.EXE
PID 1688 wrote to memory of 2040	1688	iexplore.exe	IEXPLORE.EXE
PID 1688 wrote to memory of 2040	1688	iexplore.exe	IEXPLORE.EXE

C:\Users\Admin\AppData\Local\Temp\a4863b8da0f8b001d7c28b956139e23f.exe
"C:\Users\Admin\AppData\Local\Temp\a4863b8da0f8b001d7c28b956139e23f.exe"
1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:524

C:\Users\Admin\AppData\Local\Temp\a4863b8da0f8b001d7c28b956139e23f.exe
"C:\Users\Admin\AppData\Local\Temp\a4863b8da0f8b001d7c28b956139e23f.exe"
2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1992

C:\Recovery\467657e2-3dd5-11ec-a0d6-f2080972ab74\services.exe
"C:\Recovery\467657e2-3dd5-11ec-a0d6-f2080972ab74\services.exe"
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1812

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://localhost:12145/
4⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1688

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1688 CREDAT:275457 /prefetch:2
5⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2040

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "a4863b8da0f8b001d7c28b956139e23f" /sc ONLOGON /tr "'C:\Program Files\Uninstall Information\a4863b8da0f8b001d7c28b956139e23f.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2000

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Windows\System32\DXPTaskRingtone\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1228

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Windows\System32\fc\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1136

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Windows\System32\perfc011\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1600

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Recovery\467657e2-3dd5-11ec-a0d6-f2080972ab74\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:956

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Recovery\467657e2-3dd5-11ec-a0d6-f2080972ab74\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1724

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Windows\System32\wbem\RacWmiProv\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1684

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\PerfLogs\Admin\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:568

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:1948

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Winlogon Helper DLL

1

T1004

Registry Run Keys / Startup Folder

1

T1060

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Modify Registry

3

T1112

Credential Access

Credentials in Files

2

T1081

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

2

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Recovery\467657e2-3dd5-11ec-a0d6-f2080972ab74\services.exe
MD5
a4863b8da0f8b001d7c28b956139e23f

SHA1
7d1d9bca4bf89e00e465f98f759f6d5b958fe4e4

SHA256
c2452b97cff633876bc788ac4f72eb39f459a6c58f2a44f8443de1049b66d181

SHA512
8b2fb4c0ec99bc92ad2c6081fc84fd6e83ca7b01f46fe87469bbf506ea8323d680f72edbd633396c0f2fd3d550ad0740a36c52c4af2457aefd27fe23b3781f1d

Download Submit
C:\Recovery\467657e2-3dd5-11ec-a0d6-f2080972ab74\services.exe
MD5
a4863b8da0f8b001d7c28b956139e23f

SHA1
7d1d9bca4bf89e00e465f98f759f6d5b958fe4e4

SHA256
c2452b97cff633876bc788ac4f72eb39f459a6c58f2a44f8443de1049b66d181

SHA512
8b2fb4c0ec99bc92ad2c6081fc84fd6e83ca7b01f46fe87469bbf506ea8323d680f72edbd633396c0f2fd3d550ad0740a36c52c4af2457aefd27fe23b3781f1d

Download Submit
C:\Users\Admin\AppData\Local\Temp\a4863b8da0f8b001d7c28b956139e23f.exe
MD5
a4863b8da0f8b001d7c28b956139e23f

SHA1
7d1d9bca4bf89e00e465f98f759f6d5b958fe4e4

SHA256
c2452b97cff633876bc788ac4f72eb39f459a6c58f2a44f8443de1049b66d181

SHA512
8b2fb4c0ec99bc92ad2c6081fc84fd6e83ca7b01f46fe87469bbf506ea8323d680f72edbd633396c0f2fd3d550ad0740a36c52c4af2457aefd27fe23b3781f1d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\MYNZF0CA.txt
MD5
7b868505e0ffbd5055835d7f2d83ce60

SHA1
08cc6ed145f96e297c1bd12c883adf3941c18afa

SHA256
c93e46c6b183d8a5304725e1fd5a43c37557f173e0702a967210b005ceb3f3eb

SHA512
2b281f6edf2e8e5ac1fa01530cdfe887555a4122206a22fb44bde11edbc1faec842ece67b9105845c54ae88cc1ced49267efbd4a4163e6cdc551d15563c5b54f

Download Submit
memory/524-62-0x0000000000590000-0x0000000000595000-memory.dmp

Filesize
20KB

Download
memory/524-67-0x00000000005E0000-0x00000000005E6000-memory.dmp

Filesize
24KB

Download
memory/524-55-0x0000000000F50000-0x0000000000F51000-memory.dmp

Filesize
4KB

Download
memory/524-63-0x00000000005A0000-0x00000000005A2000-memory.dmp

Filesize
8KB

Download
memory/524-64-0x0000000000580000-0x0000000000585000-memory.dmp

Filesize
20KB

Download
memory/524-65-0x00000000005C0000-0x00000000005C5000-memory.dmp

Filesize
20KB

Download
memory/524-66-0x00000000005D0000-0x00000000005D2000-memory.dmp

Filesize
8KB

Download
memory/524-58-0x00000000003C0000-0x00000000003CA000-memory.dmp

Filesize
40KB

Download
memory/524-68-0x00000000005F0000-0x00000000005F4000-memory.dmp

Filesize
16KB

Download
memory/524-57-0x000000001AFE0000-0x000000001AFE2000-memory.dmp

Filesize
8KB

Download
memory/524-60-0x0000000000570000-0x0000000000577000-memory.dmp

Filesize
28KB

Download
memory/524-61-0x00000000005B0000-0x00000000005B7000-memory.dmp

Filesize
28KB

Download
memory/524-59-0x0000000000560000-0x0000000000561000-memory.dmp

Filesize
4KB

Download
memory/1688-102-0x0000000000000000-mapping.dmp

Download
memory/1812-98-0x000000001ADE0000-0x000000001ADE2000-memory.dmp

Filesize
8KB

Download
memory/1812-88-0x0000000000810000-0x0000000000811000-memory.dmp

Filesize
4KB

Download
memory/1812-85-0x0000000000000000-mapping.dmp

Download
memory/1812-103-0x000000001ADE6000-0x000000001AE05000-memory.dmp

Filesize
124KB

Download
memory/1992-73-0x000000001AF50000-0x000000001AF52000-memory.dmp

Filesize
8KB

Download
memory/1992-69-0x0000000000000000-mapping.dmp

Download
memory/2040-104-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads