0580f2e1a63c8db40f25570a673b1620d753d28f55101dd5f9d8270755d69261

Analysis

max time kernel
154s
max time network
141s
platform
windows10_x64
resource
win10-en-20211208
submitted
21-12-2021 12:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SPELIST0120Dec-130073_164300887Spec_Pdf.exe
Size

1.3MB
MD5

38f21e75ff73996220385c651b977d13
SHA1

c46c478a05c788c60abccf265d58de93115da221
SHA256

0580f2e1a63c8db40f25570a673b1620d753d28f55101dd5f9d8270755d69261
SHA512

28cbaa62ddc069ec325a61bdb585be6ef76265f9ee1fb75560e19ed99fa429387b488217942fc1e7c1393cefc7546d82abbe63f02ad321d90b31a5682ba1a069

Score

10^/10

evasion trojan

Malware Config

Signatures

UAC bypass 3 TTPs
evasion trojan

Bypass User Account Control
T1088

Disabling Security Tools
T1089

Modify Registry
T1112
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

SPELIST0120Dec-130073_164300887Spec_Pdf.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UACDisableNotify = "0"	SPELIST0120Dec-130073_164300887Spec_Pdf.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

SPELIST0120Dec-130073_164300887Spec_Pdf.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	SPELIST0120Dec-130073_164300887Spec_Pdf.exe

Program crash 19 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
3884	2456	WerFault.exe	iexplore.exe
1096	3272	WerFault.exe	iexplore.exe
2872	388	WerFault.exe	iexplore.exe
3880	3860	WerFault.exe	iexplore.exe
972	3396	WerFault.exe	iexplore.exe
1284	1064	WerFault.exe	iexplore.exe
1384	1488	WerFault.exe	iexplore.exe
2304	1020	WerFault.exe	iexplore.exe
1840	1552	WerFault.exe	iexplore.exe
1928	2192	WerFault.exe	iexplore.exe
2176	1060	WerFault.exe	iexplore.exe
2364	548	WerFault.exe	iexplore.exe
3004	3036	WerFault.exe	iexplore.exe
2952	3176	WerFault.exe	iexplore.exe
3356	2944	WerFault.exe	iexplore.exe
1876	1972	WerFault.exe	iexplore.exe
900	1484	WerFault.exe	iexplore.exe
880	1700	WerFault.exe	iexplore.exe
2956	3284	WerFault.exe	iexplore.exe

Suspicious use of SetThreadContext 21 IoCs

Processes:

SPELIST0120Dec-130073_164300887Spec_Pdf.exeSPELIST0120Dec-130073_164300887Spec_Pdf.exe

description	pid	process	target process
PID 3992 set thread context of 1412	3992	SPELIST0120Dec-130073_164300887Spec_Pdf.exe	SPELIST0120Dec-130073_164300887Spec_Pdf.exe
PID 1412 set thread context of 2456	1412	SPELIST0120Dec-130073_164300887Spec_Pdf.exe	iexplore.exe
PID 1412 set thread context of 3272	1412	SPELIST0120Dec-130073_164300887Spec_Pdf.exe	iexplore.exe
PID 1412 set thread context of 388	1412	SPELIST0120Dec-130073_164300887Spec_Pdf.exe	iexplore.exe
PID 1412 set thread context of 3860	1412	SPELIST0120Dec-130073_164300887Spec_Pdf.exe	iexplore.exe
PID 1412 set thread context of 3396	1412	SPELIST0120Dec-130073_164300887Spec_Pdf.exe	iexplore.exe
PID 1412 set thread context of 1064	1412	SPELIST0120Dec-130073_164300887Spec_Pdf.exe	iexplore.exe
PID 1412 set thread context of 1488	1412	SPELIST0120Dec-130073_164300887Spec_Pdf.exe	iexplore.exe
PID 1412 set thread context of 1020	1412	SPELIST0120Dec-130073_164300887Spec_Pdf.exe	iexplore.exe
PID 1412 set thread context of 1552	1412	SPELIST0120Dec-130073_164300887Spec_Pdf.exe	iexplore.exe
PID 1412 set thread context of 2192	1412	SPELIST0120Dec-130073_164300887Spec_Pdf.exe	iexplore.exe
PID 1412 set thread context of 1060	1412	SPELIST0120Dec-130073_164300887Spec_Pdf.exe	iexplore.exe
PID 1412 set thread context of 548	1412	SPELIST0120Dec-130073_164300887Spec_Pdf.exe	iexplore.exe
PID 1412 set thread context of 3036	1412	SPELIST0120Dec-130073_164300887Spec_Pdf.exe	iexplore.exe
PID 1412 set thread context of 3176	1412	SPELIST0120Dec-130073_164300887Spec_Pdf.exe	iexplore.exe
PID 1412 set thread context of 2944	1412	SPELIST0120Dec-130073_164300887Spec_Pdf.exe	iexplore.exe
PID 1412 set thread context of 1972	1412	SPELIST0120Dec-130073_164300887Spec_Pdf.exe	iexplore.exe
PID 1412 set thread context of 1484	1412	SPELIST0120Dec-130073_164300887Spec_Pdf.exe	iexplore.exe
PID 1412 set thread context of 1700	1412	SPELIST0120Dec-130073_164300887Spec_Pdf.exe	iexplore.exe
PID 1412 set thread context of 3284	1412	SPELIST0120Dec-130073_164300887Spec_Pdf.exe	iexplore.exe
PID 1412 set thread context of 3828	1412	SPELIST0120Dec-130073_164300887Spec_Pdf.exe	iexplore.exe

Suspicious behavior: EnumeratesProcesses 40 IoCs

Processes:

SPELIST0120Dec-130073_164300887Spec_Pdf.exe

pid	process
1412	SPELIST0120Dec-130073_164300887Spec_Pdf.exe
1412	SPELIST0120Dec-130073_164300887Spec_Pdf.exe
1412	SPELIST0120Dec-130073_164300887Spec_Pdf.exe
1412	SPELIST0120Dec-130073_164300887Spec_Pdf.exe
1412	SPELIST0120Dec-130073_164300887Spec_Pdf.exe
1412	SPELIST0120Dec-130073_164300887Spec_Pdf.exe
1412	SPELIST0120Dec-130073_164300887Spec_Pdf.exe
1412	SPELIST0120Dec-130073_164300887Spec_Pdf.exe
1412	SPELIST0120Dec-130073_164300887Spec_Pdf.exe
1412	SPELIST0120Dec-130073_164300887Spec_Pdf.exe
1412	SPELIST0120Dec-130073_164300887Spec_Pdf.exe
1412	SPELIST0120Dec-130073_164300887Spec_Pdf.exe
1412	SPELIST0120Dec-130073_164300887Spec_Pdf.exe
1412	SPELIST0120Dec-130073_164300887Spec_Pdf.exe
1412	SPELIST0120Dec-130073_164300887Spec_Pdf.exe
1412	SPELIST0120Dec-130073_164300887Spec_Pdf.exe
1412	SPELIST0120Dec-130073_164300887Spec_Pdf.exe
1412	SPELIST0120Dec-130073_164300887Spec_Pdf.exe
1412	SPELIST0120Dec-130073_164300887Spec_Pdf.exe
1412	SPELIST0120Dec-130073_164300887Spec_Pdf.exe
1412	SPELIST0120Dec-130073_164300887Spec_Pdf.exe
1412	SPELIST0120Dec-130073_164300887Spec_Pdf.exe
1412	SPELIST0120Dec-130073_164300887Spec_Pdf.exe
1412	SPELIST0120Dec-130073_164300887Spec_Pdf.exe
1412	SPELIST0120Dec-130073_164300887Spec_Pdf.exe
1412	SPELIST0120Dec-130073_164300887Spec_Pdf.exe
1412	SPELIST0120Dec-130073_164300887Spec_Pdf.exe
1412	SPELIST0120Dec-130073_164300887Spec_Pdf.exe
1412	SPELIST0120Dec-130073_164300887Spec_Pdf.exe
1412	SPELIST0120Dec-130073_164300887Spec_Pdf.exe
1412	SPELIST0120Dec-130073_164300887Spec_Pdf.exe
1412	SPELIST0120Dec-130073_164300887Spec_Pdf.exe
1412	SPELIST0120Dec-130073_164300887Spec_Pdf.exe
1412	SPELIST0120Dec-130073_164300887Spec_Pdf.exe
1412	SPELIST0120Dec-130073_164300887Spec_Pdf.exe
1412	SPELIST0120Dec-130073_164300887Spec_Pdf.exe
1412	SPELIST0120Dec-130073_164300887Spec_Pdf.exe
1412	SPELIST0120Dec-130073_164300887Spec_Pdf.exe
1412	SPELIST0120Dec-130073_164300887Spec_Pdf.exe
1412	SPELIST0120Dec-130073_164300887Spec_Pdf.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

SPELIST0120Dec-130073_164300887Spec_Pdf.exe

pid process

1412 SPELIST0120Dec-130073_164300887Spec_Pdf.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

SPELIST0120Dec-130073_164300887Spec_Pdf.exeSPELIST0120Dec-130073_164300887Spec_Pdf.exe

description	pid	process	target process
PID 3992 wrote to memory of 1412	3992	SPELIST0120Dec-130073_164300887Spec_Pdf.exe	SPELIST0120Dec-130073_164300887Spec_Pdf.exe
PID 3992 wrote to memory of 1412	3992	SPELIST0120Dec-130073_164300887Spec_Pdf.exe	SPELIST0120Dec-130073_164300887Spec_Pdf.exe
PID 3992 wrote to memory of 1412	3992	SPELIST0120Dec-130073_164300887Spec_Pdf.exe	SPELIST0120Dec-130073_164300887Spec_Pdf.exe
PID 3992 wrote to memory of 1412	3992	SPELIST0120Dec-130073_164300887Spec_Pdf.exe	SPELIST0120Dec-130073_164300887Spec_Pdf.exe
PID 3992 wrote to memory of 1412	3992	SPELIST0120Dec-130073_164300887Spec_Pdf.exe	SPELIST0120Dec-130073_164300887Spec_Pdf.exe
PID 3992 wrote to memory of 1412	3992	SPELIST0120Dec-130073_164300887Spec_Pdf.exe	SPELIST0120Dec-130073_164300887Spec_Pdf.exe
PID 3992 wrote to memory of 1412	3992	SPELIST0120Dec-130073_164300887Spec_Pdf.exe	SPELIST0120Dec-130073_164300887Spec_Pdf.exe
PID 1412 wrote to memory of 2456	1412	SPELIST0120Dec-130073_164300887Spec_Pdf.exe	iexplore.exe
PID 1412 wrote to memory of 2456	1412	SPELIST0120Dec-130073_164300887Spec_Pdf.exe	iexplore.exe
PID 1412 wrote to memory of 2456	1412	SPELIST0120Dec-130073_164300887Spec_Pdf.exe	iexplore.exe
PID 1412 wrote to memory of 2456	1412	SPELIST0120Dec-130073_164300887Spec_Pdf.exe	iexplore.exe
PID 1412 wrote to memory of 2456	1412	SPELIST0120Dec-130073_164300887Spec_Pdf.exe	iexplore.exe
PID 1412 wrote to memory of 2456	1412	SPELIST0120Dec-130073_164300887Spec_Pdf.exe	iexplore.exe
PID 1412 wrote to memory of 2456	1412	SPELIST0120Dec-130073_164300887Spec_Pdf.exe	iexplore.exe
PID 1412 wrote to memory of 2456	1412	SPELIST0120Dec-130073_164300887Spec_Pdf.exe	iexplore.exe
PID 1412 wrote to memory of 3272	1412	SPELIST0120Dec-130073_164300887Spec_Pdf.exe	iexplore.exe
PID 1412 wrote to memory of 3272	1412	SPELIST0120Dec-130073_164300887Spec_Pdf.exe	iexplore.exe
PID 1412 wrote to memory of 3272	1412	SPELIST0120Dec-130073_164300887Spec_Pdf.exe	iexplore.exe
PID 1412 wrote to memory of 3272	1412	SPELIST0120Dec-130073_164300887Spec_Pdf.exe	iexplore.exe
PID 1412 wrote to memory of 3272	1412	SPELIST0120Dec-130073_164300887Spec_Pdf.exe	iexplore.exe
PID 1412 wrote to memory of 3272	1412	SPELIST0120Dec-130073_164300887Spec_Pdf.exe	iexplore.exe
PID 1412 wrote to memory of 3272	1412	SPELIST0120Dec-130073_164300887Spec_Pdf.exe	iexplore.exe
PID 1412 wrote to memory of 3272	1412	SPELIST0120Dec-130073_164300887Spec_Pdf.exe	iexplore.exe
PID 1412 wrote to memory of 388	1412	SPELIST0120Dec-130073_164300887Spec_Pdf.exe	iexplore.exe
PID 1412 wrote to memory of 388	1412	SPELIST0120Dec-130073_164300887Spec_Pdf.exe	iexplore.exe
PID 1412 wrote to memory of 388	1412	SPELIST0120Dec-130073_164300887Spec_Pdf.exe	iexplore.exe
PID 1412 wrote to memory of 388	1412	SPELIST0120Dec-130073_164300887Spec_Pdf.exe	iexplore.exe
PID 1412 wrote to memory of 388	1412	SPELIST0120Dec-130073_164300887Spec_Pdf.exe	iexplore.exe
PID 1412 wrote to memory of 388	1412	SPELIST0120Dec-130073_164300887Spec_Pdf.exe	iexplore.exe
PID 1412 wrote to memory of 388	1412	SPELIST0120Dec-130073_164300887Spec_Pdf.exe	iexplore.exe
PID 1412 wrote to memory of 388	1412	SPELIST0120Dec-130073_164300887Spec_Pdf.exe	iexplore.exe
PID 1412 wrote to memory of 3860	1412	SPELIST0120Dec-130073_164300887Spec_Pdf.exe	iexplore.exe
PID 1412 wrote to memory of 3860	1412	SPELIST0120Dec-130073_164300887Spec_Pdf.exe	iexplore.exe
PID 1412 wrote to memory of 3860	1412	SPELIST0120Dec-130073_164300887Spec_Pdf.exe	iexplore.exe
PID 1412 wrote to memory of 3860	1412	SPELIST0120Dec-130073_164300887Spec_Pdf.exe	iexplore.exe
PID 1412 wrote to memory of 3860	1412	SPELIST0120Dec-130073_164300887Spec_Pdf.exe	iexplore.exe
PID 1412 wrote to memory of 3860	1412	SPELIST0120Dec-130073_164300887Spec_Pdf.exe	iexplore.exe
PID 1412 wrote to memory of 3860	1412	SPELIST0120Dec-130073_164300887Spec_Pdf.exe	iexplore.exe
PID 1412 wrote to memory of 3860	1412	SPELIST0120Dec-130073_164300887Spec_Pdf.exe	iexplore.exe
PID 1412 wrote to memory of 3396	1412	SPELIST0120Dec-130073_164300887Spec_Pdf.exe	iexplore.exe
PID 1412 wrote to memory of 3396	1412	SPELIST0120Dec-130073_164300887Spec_Pdf.exe	iexplore.exe
PID 1412 wrote to memory of 3396	1412	SPELIST0120Dec-130073_164300887Spec_Pdf.exe	iexplore.exe
PID 1412 wrote to memory of 3396	1412	SPELIST0120Dec-130073_164300887Spec_Pdf.exe	iexplore.exe
PID 1412 wrote to memory of 3396	1412	SPELIST0120Dec-130073_164300887Spec_Pdf.exe	iexplore.exe
PID 1412 wrote to memory of 3396	1412	SPELIST0120Dec-130073_164300887Spec_Pdf.exe	iexplore.exe
PID 1412 wrote to memory of 3396	1412	SPELIST0120Dec-130073_164300887Spec_Pdf.exe	iexplore.exe
PID 1412 wrote to memory of 3396	1412	SPELIST0120Dec-130073_164300887Spec_Pdf.exe	iexplore.exe
PID 1412 wrote to memory of 1064	1412	SPELIST0120Dec-130073_164300887Spec_Pdf.exe	iexplore.exe
PID 1412 wrote to memory of 1064	1412	SPELIST0120Dec-130073_164300887Spec_Pdf.exe	iexplore.exe
PID 1412 wrote to memory of 1064	1412	SPELIST0120Dec-130073_164300887Spec_Pdf.exe	iexplore.exe
PID 1412 wrote to memory of 1064	1412	SPELIST0120Dec-130073_164300887Spec_Pdf.exe	iexplore.exe
PID 1412 wrote to memory of 1064	1412	SPELIST0120Dec-130073_164300887Spec_Pdf.exe	iexplore.exe
PID 1412 wrote to memory of 1064	1412	SPELIST0120Dec-130073_164300887Spec_Pdf.exe	iexplore.exe
PID 1412 wrote to memory of 1064	1412	SPELIST0120Dec-130073_164300887Spec_Pdf.exe	iexplore.exe
PID 1412 wrote to memory of 1064	1412	SPELIST0120Dec-130073_164300887Spec_Pdf.exe	iexplore.exe
PID 1412 wrote to memory of 1488	1412	SPELIST0120Dec-130073_164300887Spec_Pdf.exe	iexplore.exe
PID 1412 wrote to memory of 1488	1412	SPELIST0120Dec-130073_164300887Spec_Pdf.exe	iexplore.exe
PID 1412 wrote to memory of 1488	1412	SPELIST0120Dec-130073_164300887Spec_Pdf.exe	iexplore.exe
PID 1412 wrote to memory of 1488	1412	SPELIST0120Dec-130073_164300887Spec_Pdf.exe	iexplore.exe
PID 1412 wrote to memory of 1488	1412	SPELIST0120Dec-130073_164300887Spec_Pdf.exe	iexplore.exe
PID 1412 wrote to memory of 1488	1412	SPELIST0120Dec-130073_164300887Spec_Pdf.exe	iexplore.exe
PID 1412 wrote to memory of 1488	1412	SPELIST0120Dec-130073_164300887Spec_Pdf.exe	iexplore.exe
PID 1412 wrote to memory of 1488	1412	SPELIST0120Dec-130073_164300887Spec_Pdf.exe	iexplore.exe
PID 1412 wrote to memory of 1020	1412	SPELIST0120Dec-130073_164300887Spec_Pdf.exe	iexplore.exe

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

T1112

Processes:

SPELIST0120Dec-130073_164300887Spec_Pdf.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	SPELIST0120Dec-130073_164300887Spec_Pdf.exe

C:\Users\Admin\AppData\Local\Temp\SPELIST0120Dec-130073_164300887Spec_Pdf.exe
"C:\Users\Admin\AppData\Local\Temp\SPELIST0120Dec-130073_164300887Spec_Pdf.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3992
- C:\Users\Admin\AppData\Local\Temp\SPELIST0120Dec-130073_164300887Spec_Pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\SPELIST0120Dec-130073_164300887Spec_Pdf.exe"
  2⤵
  - Windows security modification
  - Checks whether UAC is enabled
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:1412
- - C:\Program Files (x86)\Internet Explorer\iexplore.exe
    C:\Users\Admin\AppData\Local\Temp\SPELIST0120Dec-130073_164300887Spec_Pdf.exe
    3⤵
    PID:2456
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2456 -s 28
      4⤵
      Program crash
      PID:3884
- - C:\Program Files (x86)\Internet Explorer\iexplore.exe
    C:\Users\Admin\AppData\Local\Temp\SPELIST0120Dec-130073_164300887Spec_Pdf.exe
    3⤵
    PID:3272
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3272 -s 24
      4⤵
      Program crash
      PID:1096
- - C:\Program Files (x86)\Internet Explorer\iexplore.exe
    C:\Users\Admin\AppData\Local\Temp\SPELIST0120Dec-130073_164300887Spec_Pdf.exe
    3⤵
    PID:388
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 388 -s 24
      4⤵
      Program crash
      PID:2872
- - C:\Program Files (x86)\Internet Explorer\iexplore.exe
    C:\Users\Admin\AppData\Local\Temp\SPELIST0120Dec-130073_164300887Spec_Pdf.exe
    3⤵
    PID:3860
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3860 -s 24
      4⤵
      Program crash
      PID:3880
- - C:\Program Files (x86)\Internet Explorer\iexplore.exe
    C:\Users\Admin\AppData\Local\Temp\SPELIST0120Dec-130073_164300887Spec_Pdf.exe
    3⤵
    PID:3396
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3396 -s 24
      4⤵
      Program crash
      PID:972
- - C:\Program Files (x86)\Internet Explorer\iexplore.exe
    C:\Users\Admin\AppData\Local\Temp\SPELIST0120Dec-130073_164300887Spec_Pdf.exe
    3⤵
    PID:1064
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1064 -s 24
      4⤵
      Program crash
      PID:1284
- - C:\Program Files (x86)\Internet Explorer\iexplore.exe
    C:\Users\Admin\AppData\Local\Temp\SPELIST0120Dec-130073_164300887Spec_Pdf.exe
    3⤵
    PID:1488
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1488 -s 24
      4⤵
      Program crash
      PID:1384
- - C:\Program Files (x86)\Internet Explorer\iexplore.exe
    C:\Users\Admin\AppData\Local\Temp\SPELIST0120Dec-130073_164300887Spec_Pdf.exe
    3⤵
    PID:1020
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1020 -s 24
      4⤵
      Program crash
      PID:2304
- - C:\Program Files (x86)\Internet Explorer\iexplore.exe
    C:\Users\Admin\AppData\Local\Temp\SPELIST0120Dec-130073_164300887Spec_Pdf.exe
    3⤵
    PID:1552
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1552 -s 24
      4⤵
      Program crash
      PID:1840
- - C:\Program Files (x86)\Internet Explorer\iexplore.exe
    C:\Users\Admin\AppData\Local\Temp\SPELIST0120Dec-130073_164300887Spec_Pdf.exe
    3⤵
    PID:2192
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2192 -s 24
      4⤵
      Program crash
      PID:1928
- - C:\Program Files (x86)\Internet Explorer\iexplore.exe
    C:\Users\Admin\AppData\Local\Temp\SPELIST0120Dec-130073_164300887Spec_Pdf.exe
    3⤵
    PID:1060
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1060 -s 24
      4⤵
      Program crash
      PID:2176
- - C:\Program Files (x86)\Internet Explorer\iexplore.exe
    C:\Users\Admin\AppData\Local\Temp\SPELIST0120Dec-130073_164300887Spec_Pdf.exe
    3⤵
    PID:548
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 548 -s 24
      4⤵
      Program crash
      PID:2364
- - C:\Program Files (x86)\Internet Explorer\iexplore.exe
    C:\Users\Admin\AppData\Local\Temp\SPELIST0120Dec-130073_164300887Spec_Pdf.exe
    3⤵
    PID:3036
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3036 -s 24
      4⤵
      Program crash
      PID:3004
- - C:\Program Files (x86)\Internet Explorer\iexplore.exe
    C:\Users\Admin\AppData\Local\Temp\SPELIST0120Dec-130073_164300887Spec_Pdf.exe
    3⤵
    PID:3176
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3176 -s 24
      4⤵
      Program crash
      PID:2952
- - C:\Program Files (x86)\Internet Explorer\iexplore.exe
    C:\Users\Admin\AppData\Local\Temp\SPELIST0120Dec-130073_164300887Spec_Pdf.exe
    3⤵
    PID:2944
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2944 -s 24
      4⤵
      Program crash
      PID:3356
- - C:\Program Files (x86)\Internet Explorer\iexplore.exe
    C:\Users\Admin\AppData\Local\Temp\SPELIST0120Dec-130073_164300887Spec_Pdf.exe
    3⤵
    PID:1972
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1972 -s 24
      4⤵
      Program crash
      PID:1876
- - C:\Program Files (x86)\Internet Explorer\iexplore.exe
    C:\Users\Admin\AppData\Local\Temp\SPELIST0120Dec-130073_164300887Spec_Pdf.exe
    3⤵
    PID:1484
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1484 -s 24
      4⤵
      Program crash
      PID:900
- - C:\Program Files (x86)\Internet Explorer\iexplore.exe
    C:\Users\Admin\AppData\Local\Temp\SPELIST0120Dec-130073_164300887Spec_Pdf.exe
    3⤵
    PID:1700
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1700 -s 24
      4⤵
      Program crash
      PID:880
- - C:\Program Files (x86)\Internet Explorer\iexplore.exe
    C:\Users\Admin\AppData\Local\Temp\SPELIST0120Dec-130073_164300887Spec_Pdf.exe
    3⤵
    PID:3284
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3284 -s 24
      4⤵
      Program crash
      PID:2956
- - C:\Program Files (x86)\Internet Explorer\iexplore.exe
    C:\Users\Admin\AppData\Local\Temp\SPELIST0120Dec-130073_164300887Spec_Pdf.exe
    3⤵
    PID:3828

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Bypass User Account Control

T1088

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/388-135-0x0000000000401364-mapping.dmp

Download
memory/548-144-0x0000000000401364-mapping.dmp

Download
memory/1020-140-0x0000000000401364-mapping.dmp

Download
memory/1060-143-0x0000000000401364-mapping.dmp

Download
memory/1064-138-0x0000000000401364-mapping.dmp

Download
memory/1412-129-0x00000000004010B8-mapping.dmp

Download
memory/1412-132-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/1412-131-0x0000000000F70000-0x0000000000F7A000-memory.dmp

Filesize
40KB

Download
memory/1412-130-0x0000000000F70000-0x0000000000F76000-memory.dmp

Filesize
24KB

Download
memory/1412-128-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/1484-149-0x0000000000401364-mapping.dmp

Download
memory/1488-139-0x0000000000401364-mapping.dmp

Download
memory/1552-141-0x0000000000401364-mapping.dmp

Download
memory/1700-150-0x0000000000401364-mapping.dmp

Download
memory/1972-148-0x0000000000401364-mapping.dmp

Download
memory/2192-142-0x0000000000401364-mapping.dmp

Download
memory/2456-133-0x0000000000401364-mapping.dmp

Download
memory/2944-147-0x0000000000401364-mapping.dmp

Download
memory/3036-145-0x0000000000401364-mapping.dmp

Download
memory/3176-146-0x0000000000401364-mapping.dmp

Download
memory/3272-134-0x0000000000401364-mapping.dmp

Download
memory/3284-151-0x0000000000401364-mapping.dmp

Download
memory/3396-137-0x0000000000401364-mapping.dmp

Download
memory/3828-152-0x0000000000401364-mapping.dmp

Download
memory/3860-136-0x0000000000401364-mapping.dmp

Download
memory/3992-118-0x00000000000D0000-0x00000000000D1000-memory.dmp

Filesize
4KB

Download
memory/3992-120-0x0000000004EC0000-0x0000000004EC1000-memory.dmp

Filesize
4KB

Download
memory/3992-121-0x0000000004AA0000-0x0000000004AA1000-memory.dmp

Filesize
4KB

Download
memory/3992-123-0x0000000004A80000-0x0000000004A81000-memory.dmp

Filesize
4KB

Download
memory/3992-124-0x0000000007FB0000-0x0000000007FB8000-memory.dmp

Filesize
32KB

Download
memory/3992-122-0x00000000049C0000-0x0000000004EBE000-memory.dmp

Filesize
5.0MB

Download
memory/3992-127-0x00000000083E0000-0x00000000084F9000-memory.dmp

Filesize
1.1MB

Download
memory/3992-126-0x0000000008340000-0x0000000008341000-memory.dmp

Filesize
4KB

Download
memory/3992-125-0x0000000007FC0000-0x0000000007FC1000-memory.dmp

Filesize
4KB

Download