Analysis
-
max time kernel
1696s -
max time network
1776s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220113 -
submitted
15-03-2022 08:05
Static task
static1
Behavioral task
behavioral1
Sample
Restr.exe
Resource
win7-20220310-en
General
-
Target
Restr.exe
-
Size
252KB
-
MD5
16959900ff34c0ba60fe2a4d9f1242c5
-
SHA1
888148f1b31355192e26ea4fc97c91f4c4defe9e
-
SHA256
0f4395c5cdee1c9fe28ef9a63355594f0f7a23aa41e52b8085a0bda8715da13f
-
SHA512
a2b7a74fdc6525c5b8ecafc66706136e1e3996e28ebb3b1d8e236b120e59f8c4e85165f385365d706a8391ae2a5f30530a086c7820e26d1a6cd2f19a44da5d54
Malware Config
Extracted
gozi_rm3
-
build
300994
Signatures
-
Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.
-
Uses Tor communications 1 TTPs
Malware can proxy its traffic through Tor for more anonymity.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3316 4376 WerFault.exe Restr.exe -
Discovers systems in the same network 1 TTPs 1 IoCs
-
Enumerates processes with tasklist 1 TTPs 1 IoCs
-
Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
-
Processes:
iexplore.exeIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEdescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "2317671783" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 1064f97d4338d801 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f323031e69ff0a4483a9b6c67c2edc8a00000000020000000000106600000001000020000000af0b005e4d17189b80f17a7a9b9fae8dde5b3ee941963c35b330c332e6c35938000000000e800000000200002000000032baa51108dee1171cafe41bc03a45193341b239dbbd1408288a071e2f31768cc00000008ca69103c90cbb9d70b1dc7a31329374def34971f2aee6fbf1665acd6aaf5680586a96c25d07de46f72c857cd5be0137b5b4c77015a65ead41299de3b7b25e906d0554705b4ca6e6ad0056c11cbd420825ea7b34e4316dcacb0a6f31764665ac9b9640f2d0da0c5d3828eeb7fb42f1f88e7d024a56954cf1bbc8f3266f7f0e2b352dd10f2f04ee5e9ae47bb8baa33fbba0f98fc0c9bfe063f614272d2285f8a4eeed9b63edf4ea9e8e3f48a2df5965aeac7cbdd08b7725051a082d5fccb20603400000005832b57c34f5d8a5a89e69e152e47853950844bd6fed7a58a134c958bf9abafdbf9c8638699242eddfcd4935002207c77e54ae8c0073a45a376167519021c399 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Internet Explorer\IESettingSync IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff5800000000000000de04000065020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Internet Explorer\IESettingSync IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Internet Explorer\IESettingSync IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f323031e69ff0a4483a9b6c67c2edc8a00000000020000000000106600000001000020000000694908dbfb46b57cd6968555a943005e9119959593d00753b9321fd109749f6f000000000e8000000002000020000000bb00d8a1068d77372474e6e05666d87be8542d8d50dcfa6309fd3e30a23dcc6120000000bdd9b023ff3c8e96d682cc50e317e1622624ec1843c96d1648c5d9f55206baf84000000092099aac9dd1ede2d30e05180d80f415c8a1be5f00a5222873d56860a8a83c00fbf63ab02ece3f848ccc883fa7e0f00e778ae2c5406c37d5c1f8592155cdcf78 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff00000000000000008604000065020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f323031e69ff0a4483a9b6c67c2edc8a00000000020000000000106600000001000020000000e326887780a1cc42463cf93e23f06042acd5c980d89817792e775c618e0d43b8000000000e800000000200002000000055abac4686cabcc75247a81859be176f7a560c2c5bfd9dda27ff2afd67379033c00000002ff4356701135e094e80d75fdaecb8ab772ee676e5e01642c2a33e9bbf7e50375c8ee026ab0ccedb8787c7227d038aa46a402eca5c23325f7a4a451fdf6550daef8010e84deb2c9233436cb973eef1bf3aee4f921b581c1a1a27ad861e06fe37e191674716cb4ba64c2b6cbb6a4ca3d6e00a03571ff046a6fb7ca87f8b162b50f986670d5dd33eabbebccd8d2078011006a75e6db928b405f228ed9e790a55394f4503bb8024ecc4a3c69714d843817dd540a43745fb7767daf7ee1ddc22443840000000d014b15674dd9636b3652290fec5ed434ee14b05cd1fd10a50f2a0a2459d7129398ae538fb5ae639fd49cf02f80b36dd2733af24d7c80a0f0f37a0be1badc496 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30947395" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f323031e69ff0a4483a9b6c67c2edc8a000000000200000000001066000000010000200000003b5e9f8a3527493be13b41a2ebf9589c6a62d994d237ab9a902929e775e008db000000000e8000000002000020000000cc4c139c1f3d8410a3fd4853043fbe56b3d607b907b48298c54eacf00a9abd47c000000089e50698452806b0aee4c5b9089a35317661a825ac7b9d014527f1bcea9113a7ef7c06ac14da56fbee2af2dffcd63be96c075c9d8669adb3ee1122baf68e8e3a142f0ecb52f0046426d9aebb71f83e81d052bdb33f00fe5e454da98ca70b35a105afbaeb1f1aac26a1b3cbfd5552ec2bb815cba9fce85e4e284027fb3a5c50ec101b8f150dec2c9304f7ba46fe8660bb4c822f437fb42b08d6d262fed0f90354504905d57ed89a0a20333c547e510e2f60d76f146a03e117168ef32b23af7a4f40000000015aa826f466813f1d71d4311b3427b7a381f759fb95d11b8a0305c39a3d97ff37ea1b218cb305c18ac1d2bc089c6aa515ec559afab86ac24cd68446d0989b39 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff720000001a000000f80400007f020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{B5C4DBF1-A436-11EC-B9A4-4AFEF23D9694} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Internet Explorer\IESettingSync IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f323031e69ff0a4483a9b6c67c2edc8a000000000200000000001066000000010000200000002b81c0d1b0f11c7d4a69ac85f855dd5d3531371c745e79c1748263e9f65aafd7000000000e8000000002000020000000dec3bf4126fc2cec7658286bf2e75aea9cd303e274940af838a83d99b480d4a4c00000006a2273a44b604d49362481938faa54560d195fa9f572a0a70def88063b2e9ad78e8e23cea03120b97dc5495883d4a4d685fd288eb16ce0ebc9f0efaa8c6b0980c3286da79ce6fe3a2785adb3234965c736173a61fdf2ef35ec210c1a0a7ff3079f02b801b4f94159e3f1413998d7afbe4a6700c1257ec98e75f4a984f059e5e25d2f7c4c0bd78d47ec8f2a5a63f5c24a6ed338bad5258a4a45e294fb404b8319db27e63f91e15f40a8e0c863ff3e38fda6f967df22b01efdba3f2d90cc58b390400000008eab2544967c183af1aa951bde7de48503e099d1f9f342e1cc63bdf17b379cc3fbf7a265e549ff3d69a16a024e76b5ff318f32fd03c6ad372e8d81b1f79e8fe6 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f323031e69ff0a4483a9b6c67c2edc8a000000000200000000001066000000010000200000008b909b8338d4738f4b3b2e4dcbe9cf0e2b037d12806396cf22528efc111641bb000000000e8000000002000020000000366574914b9a1bd144898af76963d69ad400b90ba988cc139251325775b3fe2d200000001129b6fe636ba60b01daa27e12b9ab8fdc1487eff7892c55d8b815f2cb97ee5440000000f7cdcb0ff5fdc78d44c377472c443e9f35b6f7984431996e83c3ea46c09db82d47785179d8f732a0b5ffafb83318a2edcf3f22a3964433b7815b60c96d4348bb iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f323031e69ff0a4483a9b6c67c2edc8a00000000020000000000106600000001000020000000a66e371bb720c51e3ce959f7d76bb8c3cdb54906ddbacd6d16db9979ca8ee8fa000000000e800000000200002000000004b2a81af273a64ddc93af4aaa6f1741e55ca8e7ecb1b47489aad81f732e0205c0000000c1f9028bd43c6aab06677e5630a882416d5ecf594f78ce11bb4c7923d0cc945b015466f8e51f0eebadb06f225dd20801fb75bc06aada4047ce0c0b6b94a26fe7b7521eb0939e853f0e4c4534a8330afa77b05b9c674f7ae16c976509c0a5f253be1f71376005c18e943fe2cdf0449867f0de57d66c9983a2dbac1641bb19d0f6ff8b83536d8555b7f15507f68f55b707ea684b69deba8d1e18914d13d00d54f582e00c836065ad39d3093e75418b58bf996b600f7f54f9c94acf72a991a1f90f400000000e708e0f62d9f0fe62c53eb447fa000d062a052fcaf6e7dc4811e627bbc9696165c7c7723fca50b823d0c92ed7dda40a63d46d1f2565fe9605bc7f37542b1b31 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30947395" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Internet Explorer\IESettingSync IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f323031e69ff0a4483a9b6c67c2edc8a000000000200000000001066000000010000200000001f0aae9c0cd96dd491fc79ea15f0f6b636f967a6f3e23a18a441c4f3b0700d29000000000e800000000200002000000030a6ccf90c261a9482e7b4eedd1a54fa7bf5c252b59730b66240bf4ca554439ac00000009b6104ba8a136c318627f726fe926fa27afe30b366686bafc68e78b1b2a2132075e1d95790f16752f40207991ff7660d0694967f433347839165e8ab49734d841ff3735b4f36f968769a95996862c954c0302d109461a8b60a7703e5ef06ff67fa7dfec1876f9f9de6bd4d6c64cd3a462e6ac9acd58bfa6df8ab3f4a7e30be5b18ba8b378c44ed254394a86d22964cd4f297d4f296594c1fd3d0ad752e1f75be53ad75961b05f64646fdd98dd383bb4c6ebeb952130f00349d0cdfa782e2a2de400000003b47780404277f566799d740c110b41ce78ba25f81f641c2525b308b772869bc5c9ea86d3b67489239ed8827e40e915281086f4450d75b62ba9ec69759879750 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f323031e69ff0a4483a9b6c67c2edc8a00000000020000000000106600000001000020000000dab01f0f7faab4215f0fcb8b440aa7fe3462ab84531a7e991078e12322072e96000000000e800000000200002000000066f74c5f8304307b95bcb2799d4aa71384ea31b06948dda581989f0f3f73620fc0000000212ed449ae5d1b9a6ec1de03d13106297abfea4735369036b56e487aa036316c1256bc6d0b418a08b0e4c60b09c498a9d59160251f7a8e455bfde4c620e2fe70b2f144789ea683cfa5ed534706285fb43bec4e243c3e7dcfb1f6e3e1b54293543b34ff6a82ca84e9e4f66d4ccd7b72dfa50275a4d176e4c39382dca21eece1f0731a213e19312d6182ecf8c85ea6e26075cb1267dbb6ae952633120216c79f3fff6a627f5f9cb1ed801920a346f87adf7cd20f1f54f5254d9930b71c902d4086400000007ed9abcba78840c86d9f40c12c1be9a627f825e5fbbd6fb78fea9301c6e0bd1928dffe8f87d3565e508b3acf3294883c92f00226b0cfce0b58fda69926825808 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff1a0000001a000000a00400007f020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f323031e69ff0a4483a9b6c67c2edc8a00000000020000000000106600000001000020000000411587c25fe2549f47ac2ac20e6f02c2d12e2e48d4f22792472c74a43ec7d78b000000000e800000000200002000000088cb7284ad731794a44ee084fa73c72f4c7338652efa5b2eec4666fe23b1e1f0c00000009d93904ecaaad13abbf02c36ccad44b328e7b4c97957f2f7bbbbb8c6b6f368729bfbd3117aaf84d358ec421d1f313dd91780fa5dfefa28260e87f5f401955b0ab2ea80fbe028949043da6502a0f9ac30025034237511fdbd5a90a1a7bd8474eaca17673282739409211b3f61438b5403670e140d21be409f7fd95225268f0dc265aeda3c5bc9fb42570bde13b56213494b074f84e5793637cf82e13983e6ab832cd13d67094430c3c50b623e208c5b3b4d1a46cd39c4e130d78c3e63ca8c3e3e40000000a6f09b7d58a33e4e1cf57008065497942cbe53dbe2316009d86aa8245f160d2594e8c44028950d7ad387b82a8e5ad8eb8e81c243c22c0d5610f3cceb64e544eb iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2317671783" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80997d7c4338d801 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Internet Explorer\IESettingSync IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
powershell.exepowershell.exepowershell.exepid process 3884 powershell.exe 3884 powershell.exe 3896 powershell.exe 3896 powershell.exe 2864 powershell.exe 2864 powershell.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
powershell.exeRestr.exepid process 3884 powershell.exe 4376 Restr.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
powershell.exepowershell.exepowershell.exewhoami.exetasklist.exeWMIC.exedescription pid process Token: SeDebugPrivilege 3884 powershell.exe Token: SeDebugPrivilege 3896 powershell.exe Token: SeDebugPrivilege 2864 powershell.exe Token: SeDebugPrivilege 4132 whoami.exe Token: SeDebugPrivilege 4132 whoami.exe Token: SeDebugPrivilege 4132 whoami.exe Token: SeDebugPrivilege 4132 whoami.exe Token: SeDebugPrivilege 4132 whoami.exe Token: SeDebugPrivilege 4132 whoami.exe Token: SeDebugPrivilege 4132 whoami.exe Token: SeDebugPrivilege 4132 whoami.exe Token: SeDebugPrivilege 4132 whoami.exe Token: SeDebugPrivilege 4132 whoami.exe Token: SeDebugPrivilege 4132 whoami.exe Token: SeDebugPrivilege 4132 whoami.exe Token: SeDebugPrivilege 4132 whoami.exe Token: SeDebugPrivilege 4132 whoami.exe Token: SeDebugPrivilege 4132 whoami.exe Token: SeDebugPrivilege 4132 whoami.exe Token: SeDebugPrivilege 4132 whoami.exe Token: SeDebugPrivilege 4132 whoami.exe Token: SeDebugPrivilege 4132 whoami.exe Token: SeDebugPrivilege 4132 whoami.exe Token: SeDebugPrivilege 4132 whoami.exe Token: SeDebugPrivilege 4132 whoami.exe Token: SeDebugPrivilege 4132 whoami.exe Token: SeDebugPrivilege 4132 whoami.exe Token: SeDebugPrivilege 4132 whoami.exe Token: SeDebugPrivilege 4132 whoami.exe Token: SeDebugPrivilege 4132 whoami.exe Token: SeDebugPrivilege 1436 tasklist.exe Token: SeIncreaseQuotaPrivilege 504 WMIC.exe Token: SeSecurityPrivilege 504 WMIC.exe Token: SeTakeOwnershipPrivilege 504 WMIC.exe Token: SeLoadDriverPrivilege 504 WMIC.exe Token: SeSystemProfilePrivilege 504 WMIC.exe Token: SeSystemtimePrivilege 504 WMIC.exe Token: SeProfSingleProcessPrivilege 504 WMIC.exe Token: SeIncBasePriorityPrivilege 504 WMIC.exe Token: SeCreatePagefilePrivilege 504 WMIC.exe Token: SeBackupPrivilege 504 WMIC.exe Token: SeRestorePrivilege 504 WMIC.exe Token: SeShutdownPrivilege 504 WMIC.exe Token: SeDebugPrivilege 504 WMIC.exe Token: SeSystemEnvironmentPrivilege 504 WMIC.exe Token: SeRemoteShutdownPrivilege 504 WMIC.exe Token: SeUndockPrivilege 504 WMIC.exe Token: SeManageVolumePrivilege 504 WMIC.exe Token: 33 504 WMIC.exe Token: 34 504 WMIC.exe Token: 35 504 WMIC.exe Token: 36 504 WMIC.exe Token: SeIncreaseQuotaPrivilege 504 WMIC.exe Token: SeSecurityPrivilege 504 WMIC.exe Token: SeTakeOwnershipPrivilege 504 WMIC.exe Token: SeLoadDriverPrivilege 504 WMIC.exe Token: SeSystemProfilePrivilege 504 WMIC.exe Token: SeSystemtimePrivilege 504 WMIC.exe Token: SeProfSingleProcessPrivilege 504 WMIC.exe Token: SeIncBasePriorityPrivilege 504 WMIC.exe Token: SeCreatePagefilePrivilege 504 WMIC.exe Token: SeBackupPrivilege 504 WMIC.exe Token: SeRestorePrivilege 504 WMIC.exe Token: SeShutdownPrivilege 504 WMIC.exe -
Suspicious use of FindShellTrayWindow 11 IoCs
Processes:
iexplore.exepid process 2420 iexplore.exe 2420 iexplore.exe 2420 iexplore.exe 2420 iexplore.exe 2420 iexplore.exe 2420 iexplore.exe 2420 iexplore.exe 2420 iexplore.exe 2420 iexplore.exe 2420 iexplore.exe 2420 iexplore.exe -
Suspicious use of SetWindowsHookEx 44 IoCs
Processes:
iexplore.exeIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEpid process 2420 iexplore.exe 2420 iexplore.exe 2728 IEXPLORE.EXE 2728 IEXPLORE.EXE 2420 iexplore.exe 2420 iexplore.exe 1748 IEXPLORE.EXE 1748 IEXPLORE.EXE 2420 iexplore.exe 2420 iexplore.exe 4592 IEXPLORE.EXE 4592 IEXPLORE.EXE 2420 iexplore.exe 2420 iexplore.exe 3596 IEXPLORE.EXE 3596 IEXPLORE.EXE 2420 iexplore.exe 2420 iexplore.exe 2180 IEXPLORE.EXE 2180 IEXPLORE.EXE 2420 iexplore.exe 2420 iexplore.exe 4732 IEXPLORE.EXE 4732 IEXPLORE.EXE 2420 iexplore.exe 2420 iexplore.exe 1564 IEXPLORE.EXE 1564 IEXPLORE.EXE 2420 iexplore.exe 2420 iexplore.exe 2320 IEXPLORE.EXE 2320 IEXPLORE.EXE 2420 iexplore.exe 2420 iexplore.exe 4184 IEXPLORE.EXE 4184 IEXPLORE.EXE 2420 iexplore.exe 2420 iexplore.exe 2012 IEXPLORE.EXE 2012 IEXPLORE.EXE 2420 iexplore.exe 2420 iexplore.exe 3344 IEXPLORE.EXE 3344 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
iexplore.execmd.exeforfiles.execmd.exepowershell.execsc.execsc.exeRestr.execmd.exenet.execmd.execmd.execmd.execmd.exedescription pid process target process PID 2420 wrote to memory of 2728 2420 iexplore.exe IEXPLORE.EXE PID 2420 wrote to memory of 2728 2420 iexplore.exe IEXPLORE.EXE PID 2420 wrote to memory of 2728 2420 iexplore.exe IEXPLORE.EXE PID 2420 wrote to memory of 1748 2420 iexplore.exe IEXPLORE.EXE PID 2420 wrote to memory of 1748 2420 iexplore.exe IEXPLORE.EXE PID 2420 wrote to memory of 1748 2420 iexplore.exe IEXPLORE.EXE PID 2420 wrote to memory of 4592 2420 iexplore.exe IEXPLORE.EXE PID 2420 wrote to memory of 4592 2420 iexplore.exe IEXPLORE.EXE PID 2420 wrote to memory of 4592 2420 iexplore.exe IEXPLORE.EXE PID 2420 wrote to memory of 3596 2420 iexplore.exe IEXPLORE.EXE PID 2420 wrote to memory of 3596 2420 iexplore.exe IEXPLORE.EXE PID 2420 wrote to memory of 3596 2420 iexplore.exe IEXPLORE.EXE PID 2420 wrote to memory of 2180 2420 iexplore.exe IEXPLORE.EXE PID 2420 wrote to memory of 2180 2420 iexplore.exe IEXPLORE.EXE PID 2420 wrote to memory of 2180 2420 iexplore.exe IEXPLORE.EXE PID 2420 wrote to memory of 4732 2420 iexplore.exe IEXPLORE.EXE PID 2420 wrote to memory of 4732 2420 iexplore.exe IEXPLORE.EXE PID 2420 wrote to memory of 4732 2420 iexplore.exe IEXPLORE.EXE PID 2420 wrote to memory of 1564 2420 iexplore.exe IEXPLORE.EXE PID 2420 wrote to memory of 1564 2420 iexplore.exe IEXPLORE.EXE PID 2420 wrote to memory of 1564 2420 iexplore.exe IEXPLORE.EXE PID 2420 wrote to memory of 2320 2420 iexplore.exe IEXPLORE.EXE PID 2420 wrote to memory of 2320 2420 iexplore.exe IEXPLORE.EXE PID 2420 wrote to memory of 2320 2420 iexplore.exe IEXPLORE.EXE PID 2420 wrote to memory of 4184 2420 iexplore.exe IEXPLORE.EXE PID 2420 wrote to memory of 4184 2420 iexplore.exe IEXPLORE.EXE PID 2420 wrote to memory of 4184 2420 iexplore.exe IEXPLORE.EXE PID 2420 wrote to memory of 2012 2420 iexplore.exe IEXPLORE.EXE PID 2420 wrote to memory of 2012 2420 iexplore.exe IEXPLORE.EXE PID 2420 wrote to memory of 2012 2420 iexplore.exe IEXPLORE.EXE PID 2420 wrote to memory of 3344 2420 iexplore.exe IEXPLORE.EXE PID 2420 wrote to memory of 3344 2420 iexplore.exe IEXPLORE.EXE PID 2420 wrote to memory of 3344 2420 iexplore.exe IEXPLORE.EXE PID 1444 wrote to memory of 3268 1444 cmd.exe forfiles.exe PID 1444 wrote to memory of 3268 1444 cmd.exe forfiles.exe PID 3268 wrote to memory of 1184 3268 forfiles.exe cmd.exe PID 3268 wrote to memory of 1184 3268 forfiles.exe cmd.exe PID 1184 wrote to memory of 3884 1184 cmd.exe powershell.exe PID 1184 wrote to memory of 3884 1184 cmd.exe powershell.exe PID 3884 wrote to memory of 3896 3884 powershell.exe powershell.exe PID 3884 wrote to memory of 3896 3884 powershell.exe powershell.exe PID 3884 wrote to memory of 2864 3884 powershell.exe powershell.exe PID 3884 wrote to memory of 2864 3884 powershell.exe powershell.exe PID 3884 wrote to memory of 212 3884 powershell.exe csc.exe PID 3884 wrote to memory of 212 3884 powershell.exe csc.exe PID 212 wrote to memory of 204 212 csc.exe cvtres.exe PID 212 wrote to memory of 204 212 csc.exe cvtres.exe PID 3884 wrote to memory of 3596 3884 powershell.exe csc.exe PID 3884 wrote to memory of 3596 3884 powershell.exe csc.exe PID 3596 wrote to memory of 1380 3596 csc.exe cvtres.exe PID 3596 wrote to memory of 1380 3596 csc.exe cvtres.exe PID 3884 wrote to memory of 656 3884 powershell.exe Explorer.EXE PID 4376 wrote to memory of 656 4376 Restr.exe Explorer.EXE PID 5016 wrote to memory of 3344 5016 cmd.exe net.exe PID 5016 wrote to memory of 3344 5016 cmd.exe net.exe PID 3344 wrote to memory of 1704 3344 net.exe net1.exe PID 3344 wrote to memory of 1704 3344 net.exe net1.exe PID 3084 wrote to memory of 5076 3084 cmd.exe systeminfo.exe PID 3084 wrote to memory of 5076 3084 cmd.exe systeminfo.exe PID 4912 wrote to memory of 4768 4912 cmd.exe net.exe PID 4912 wrote to memory of 4768 4912 cmd.exe net.exe PID 1808 wrote to memory of 3824 1808 cmd.exe nslookup.exe PID 1808 wrote to memory of 3824 1808 cmd.exe nslookup.exe PID 2968 wrote to memory of 4132 2968 cmd.exe whoami.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:656
-
C:\Users\Admin\AppData\Local\Temp\Restr.exe"C:\Users\Admin\AppData\Local\Temp\Restr.exe"2⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4376 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4376 -s 9643⤵
- Program crash
PID:3316 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c start /min forfiles /c "cmd /k @path -ec aQBlAHgAIAAoAGcAcAAgACcASABLAEMAVQA6AFwAUwBvAGYAdAB3AGEAcgBlAFwAVgBlAHIAcwBpAG8AbgBkAGEAeQAnACkALgBCAA== & exit" /p C:\Windows\system32 /s /m po*l.e*e2⤵
- Suspicious use of WriteProcessMemory
PID:1444 -
C:\Windows\system32\forfiles.exeforfiles /c "cmd /k @path -ec aQBlAHgAIAAoAGcAcAAgACcASABLAEMAVQA6AFwAUwBvAGYAdAB3AGEAcgBlAFwAVgBlAHIAcwBpAG8AbgBkAGEAeQAnACkALgBCAA== & exit" /p C:\Windows\system32 /s /m po*l.e*e3⤵
- Suspicious use of WriteProcessMemory
PID:3268 -
C:\Windows\system32\cmd.exe/k "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -ec aQBlAHgAIAAoAGcAcAAgACcASABLAEMAVQA6AFwAUwBvAGYAdAB3AGEAcgBlAFwAVgBlAHIAcwBpAG8AbgBkAGEAeQAnACkALgBCAA== & exit4⤵
- Suspicious use of WriteProcessMemory
PID:1184 -
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -ec aQBlAHgAIAAoAGcAcAAgACcASABLAEMAVQA6AFwAUwBvAGYAdAB3AGEAcgBlAFwAVgBlAHIAcwBpAG8AbgBkAGEAeQAnACkALgBCAA==5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3884 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -E JwBwAGEAcgBhAG0AKAAkAG8AdgB0AHMAbAB5ACkAOwBbAFMAeQBzAHQAZQBtAC4AQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJABvAHYAdABzAGwAeQApACcA6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3896 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -E JwBwAGEAcgBhAG0AKAAkAHAAYgBmAG0AYwBnAHQAcwB1AGYAbQApADsAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAQQBTAEMASQBJAC4ARwBlAHQAUwB0AHIAaQBuAGcAKAAkAHAAYgBmAG0AYwBnAHQAcwB1AGYAbQApACcA6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2864 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\q2nnynnq\q2nnynnq.cmdline"6⤵
- Suspicious use of WriteProcessMemory
PID:212 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC14A.tmp" "c:\Users\Admin\AppData\Local\Temp\q2nnynnq\CSCB276EDCFA1D54AF48A876186B9A9B79.TMP"7⤵PID:204
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\gx2uheqz\gx2uheqz.cmdline"6⤵
- Suspicious use of WriteProcessMemory
PID:3596 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC215.tmp" "c:\Users\Admin\AppData\Local\Temp\gx2uheqz\CSCE43D2439906A4DEB84F6BE8B83451D.TMP"7⤵PID:1380
-
C:\Windows\system32\cmd.execmd /C "net session" >> C:\Users\Admin\AppData\Local\Temp\5B1B.bin02⤵
- Suspicious use of WriteProcessMemory
PID:5016 -
C:\Windows\system32\net.exenet session3⤵
- Suspicious use of WriteProcessMemory
PID:3344 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 session4⤵PID:1704
-
C:\Windows\system32\cmd.execmd /U /C "type C:\Users\Admin\AppData\Local\Temp\5B1B.bin0 > C:\Users\Admin\AppData\Local\Temp\5B1B.bin & del C:\Users\Admin\AppData\Local\Temp\5B1B.bin0"2⤵PID:1144
-
C:\Windows\system32\cmd.execmd /C "systeminfo.exe" >> C:\Users\Admin\AppData\Local\Temp\8482.bin02⤵
- Suspicious use of WriteProcessMemory
PID:3084 -
C:\Windows\system32\systeminfo.exesysteminfo.exe3⤵
- Gathers system information
PID:5076 -
C:\Windows\system32\cmd.execmd /C "echo -------- 1" >> C:\Users\Admin\AppData\Local\Temp\8482.bin02⤵PID:796
-
C:\Windows\system32\cmd.execmd /C "net view" >> C:\Users\Admin\AppData\Local\Temp\8482.bin02⤵
- Suspicious use of WriteProcessMemory
PID:4912 -
C:\Windows\system32\net.exenet view3⤵
- Discovers systems in the same network
PID:4768 -
C:\Windows\system32\cmd.execmd /C "echo -------- 2" >> C:\Users\Admin\AppData\Local\Temp\8482.bin02⤵PID:5108
-
C:\Windows\system32\cmd.execmd /C "nslookup 127.0.0.1" >> C:\Users\Admin\AppData\Local\Temp\8482.bin02⤵
- Suspicious use of WriteProcessMemory
PID:1808 -
C:\Windows\system32\nslookup.exenslookup 127.0.0.13⤵PID:3824
-
C:\Windows\system32\cmd.execmd /C "echo -------- 3" >> C:\Users\Admin\AppData\Local\Temp\8482.bin02⤵PID:5112
-
C:\Windows\system32\cmd.execmd /C "whoami /all" >> C:\Users\Admin\AppData\Local\Temp\8482.bin02⤵
- Suspicious use of WriteProcessMemory
PID:2968 -
C:\Windows\system32\whoami.exewhoami /all3⤵
- Suspicious use of AdjustPrivilegeToken
PID:4132 -
C:\Windows\system32\cmd.execmd /C "echo -------- 4" >> C:\Users\Admin\AppData\Local\Temp\8482.bin02⤵PID:852
-
C:\Windows\system32\cmd.execmd /C "net localgroup administrators" >> C:\Users\Admin\AppData\Local\Temp\8482.bin02⤵PID:2588
-
C:\Windows\system32\net.exenet localgroup administrators3⤵PID:4336
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 localgroup administrators4⤵PID:376
-
C:\Windows\system32\cmd.execmd /C "echo -------- 5" >> C:\Users\Admin\AppData\Local\Temp\8482.bin02⤵PID:3840
-
C:\Windows\system32\cmd.execmd /C "net group "domain computers" /domain" >> C:\Users\Admin\AppData\Local\Temp\8482.bin02⤵PID:548
-
C:\Windows\system32\net.exenet group "domain computers" /domain3⤵PID:3492
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 group "domain computers" /domain4⤵PID:3156
-
C:\Windows\system32\cmd.execmd /C "echo -------- 6" >> C:\Users\Admin\AppData\Local\Temp\8482.bin02⤵PID:4576
-
C:\Windows\system32\cmd.execmd /C "tasklist.exe /SVC" >> C:\Users\Admin\AppData\Local\Temp\8482.bin02⤵PID:1528
-
C:\Windows\system32\tasklist.exetasklist.exe /SVC3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:1436 -
C:\Windows\system32\cmd.execmd /C "echo -------- 7" >> C:\Users\Admin\AppData\Local\Temp\8482.bin02⤵PID:2052
-
C:\Windows\system32\cmd.execmd /C "driverquery.exe" >> C:\Users\Admin\AppData\Local\Temp\8482.bin02⤵PID:3484
-
C:\Windows\system32\driverquery.exedriverquery.exe3⤵PID:3396
-
C:\Windows\system32\cmd.execmd /C "echo -------- 8" >> C:\Users\Admin\AppData\Local\Temp\8482.bin02⤵PID:1276
-
C:\Windows\system32\cmd.execmd /C "reg.exe query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" /s" >> C:\Users\Admin\AppData\Local\Temp\8482.bin02⤵PID:3912
-
C:\Windows\system32\reg.exereg.exe query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" /s3⤵PID:764
-
C:\Windows\system32\cmd.execmd /C "echo -------- 9" >> C:\Users\Admin\AppData\Local\Temp\8482.bin02⤵PID:3804
-
C:\Windows\system32\cmd.execmd /C "wmic computersystem get domain |more" >> C:\Users\Admin\AppData\Local\Temp\8482.bin02⤵PID:2296
-
C:\Windows\System32\Wbem\WMIC.exewmic computersystem get domain3⤵
- Suspicious use of AdjustPrivilegeToken
PID:504 -
C:\Windows\system32\more.commore3⤵PID:4068
-
C:\Windows\system32\cmd.execmd /U /C "type C:\Users\Admin\AppData\Local\Temp\8482.bin0 > C:\Users\Admin\AppData\Local\Temp\8482.bin & del C:\Users\Admin\AppData\Local\Temp\8482.bin0"2⤵PID:4160
-
C:\Windows\system32\cmd.execmd /C "net group "domain computers" /domain" >> C:\Users\Admin\AppData\Local\Temp\268A.bin02⤵PID:1132
-
C:\Windows\system32\net.exenet group "domain computers" /domain3⤵PID:396
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 group "domain computers" /domain4⤵PID:1356
-
C:\Windows\syswow64\svchost.exeC:\Windows\syswow64\svchost.exe2⤵PID:808
-
C:\Program Files (x86)\Internet Explorer\ielowutil.exe"C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding1⤵PID:2192
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2420 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2420 CREDAT:17410 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2728 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2420 CREDAT:82950 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1748 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2420 CREDAT:82954 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4592 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2420 CREDAT:17412 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3596 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2420 CREDAT:82960 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2180 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2420 CREDAT:82964 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4732 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2420 CREDAT:82968 /prefetch:22⤵
- Suspicious use of SetWindowsHookEx
PID:1564 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2420 CREDAT:82972 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2320 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2420 CREDAT:82976 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4184 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2420 CREDAT:82980 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2012 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2420 CREDAT:82984 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3344
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 4376 -ip 43761⤵PID:2580
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
54e9306f95f32e50ccd58af19753d929
SHA1eab9457321f34d4dcf7d4a0ac83edc9131bf7c57
SHA25645f94dceb18a8f738a26da09ce4558995a4fe02b971882e8116fc9b59813bb72
SHA5128711a4d866f21cdf4d4e6131ec4cfaf6821d0d22b90946be8b5a09ab868af0270a89bc326f03b858f0361a83c11a1531b894dfd1945e4812ba429a7558791f4f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
MD5707b3dbca770b75e95ad28432f3382be
SHA1fd1a606c1b3485980b3feb269c77a6ec997164ff
SHA25692dabf8d30c3914a107c6301d9f7306bbb5585b1e9067288428a816d86df18ea
SHA512763a26a15a4ebcd224ab58c21cc8e956184b06114b853b411e81b9fe8d438df53ae73b4af6fe073dc7c4fff040068d843836536d57567954e841ce0b196fcf79
-
MD5
d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
MD5
363ab12b18b904149383cd18a3cebdb5
SHA11f1cd7407638f2f2b349aee61fe1de162ed3ea4f
SHA2560ff90d9f35c1cc3ece0e6bfdbe3408f86551d8f94b13462eb81c008e71c732ad
SHA512479113739f9dd4662ba5c14a0cb69b5623f5840794b7ea346e022a80f9d7f069dd0bb3e406e27273e3101019e022e9e75997c4a494ec0fc77ea04cfc436aed04
-
MD5
a976d227e5d1dcf62f5f7e623211dd1b
SHA1a2a9dc1abdd3d888484678663928cb024c359ee6
SHA25666332859bd8e3441a019e073a318b62a47014ba244121301034b510dc7532271
SHA5126754d545f2ce095cfa1fa7ca9e3223f89e37726ee7e541ebcf3e209e18b2602f3be8677598cb30d697327a63de032c11dbf8ef7ad7889a79c488a21044c1cb3f
-
MD5
a6c9d692ed2826ecb12c09356e69cc09
SHA1def728a6138cf083d8a7c61337f3c9dade41a37f
SHA256a07d329eb9b4105ba442c89f7cfa0d7b263f9f0617e26df93cf8cdc8dc94d57b
SHA5122f27d2b241ce34f988c39e17ca5a1ebe628ac6c1b8ee8df121db9ad8929eaadf5f24ad66457591cccf87e60d2ba2eab88af860ab9c323a5c2a9867045d6e7ba3
-
MD5
9856eec246073417aba7c4e517d16d0b
SHA1ce495a8b86044e11eaf50cc89a92116cc9b13724
SHA2560ed72f3f9a4847fc67fe0d6dc44d1773b8a652aaaf84352440b44da59a66d7f8
SHA5128227671cae6eb7e5d2f77e82656c9099efb0e59b9478a7884216e83bc2be8c11ae2cbdea1c9137da263825c3a8357321fc5c931841020596cdd82ca42489f16e
-
MD5
768165e0abf16bf3056836d5431a7296
SHA19fb3196be60e49bfc319ebd9e0b103954d711e34
SHA256b44c505b721e93e2a596577018cc65b993cd632b9fe7620a4b3db54031afff5d
SHA5121250ec40ba20f39a5b9a3aafd45c63cb6f1bf48b89acce1f885470c936fb48a803081943c68458ba1adce92d5fe79d3e45682285f56ecb29884d41974269992d
-
MD5
278c1ace6d180ce0d2c2ecd222ee2aa3
SHA1da06f35689d597518c4a8a3cc743e125b9dcc866
SHA256ebe0cf8abf15361f6b10742f63a04171a28e43fdd3863eb5f398986d41c60187
SHA512472f2a7bbb180e70ae3420199b33b879ead1ba712f6f40193342007bc614e368eddaad3e71ed21ba640cb44c0ced4e6e78d05af898ff2f68a52a77e7f974eb95
-
MD5
278c1ace6d180ce0d2c2ecd222ee2aa3
SHA1da06f35689d597518c4a8a3cc743e125b9dcc866
SHA256ebe0cf8abf15361f6b10742f63a04171a28e43fdd3863eb5f398986d41c60187
SHA512472f2a7bbb180e70ae3420199b33b879ead1ba712f6f40193342007bc614e368eddaad3e71ed21ba640cb44c0ced4e6e78d05af898ff2f68a52a77e7f974eb95
-
MD5
02a55310a7541dd55a0a4fefdf02c0a1
SHA14a963314d795178e25a81d31a15b8169a48bf14d
SHA2564dcb1fdb6827966ceeba7f49cb95c8fe1739edd08ca99dbf2cc407a1c270c179
SHA5129c899419162e3cce20992fd458b2790bfcfc59537ac01f2f0f710d835d4ef45d6f1da77f3458f9a24f1227217260e027040f3d52ff06b6583c230a4a4fd0757d
-
MD5
f860816dfd8ae9dceca75f9ca6a4e913
SHA17cda655a02b443b14e1fdcf5c7071b9354c252f0
SHA256837f9b578ce4d348c8f753a774a50bb39f13321b538ab4ffd3d1787ede9eadac
SHA512ea074551c24b78a55e8519c0fb8cde7a2b7b441a7faa010114ff0ad53ccde45d386d6c3d2af63c2804b822754a395d2d2b564dbab40b929aa0e834a28c9e5002
-
MD5
16fee889e9e7685190429ab2e731bde0
SHA1979dcad14fb7bd4e0d63b8bb3731acc501b1dc29
SHA256905230421593eb9319596ef16cdbb80d50eb79c1bb26103d062131a5517c52e2
SHA512480abc09c3393929cf40e9dec9be2b72fd00eec1c94ae0c0823c7584e2e528356ef041002f052c239c3927a30f3a248842b4d3bc5862b4147b1f971839abb08b
-
MD5
2493cc05c90edd0145e0f5d738b017aa
SHA131e8fde9ca901f49de3d262cc50f68431015cd20
SHA256aa14ee992ebf44b5776a835b06a9435a597d1a1aaab44d46f63004f5e12bae7b
SHA512eba2f3f107abda1acd30370b087bc754e898771f20d525e54b12d0bb47571d0e702a60b243cc00c74d96862d6106ac31398a93b78633e0b3a8f9fb26f8f38011
-
MD5
2493cc05c90edd0145e0f5d738b017aa
SHA131e8fde9ca901f49de3d262cc50f68431015cd20
SHA256aa14ee992ebf44b5776a835b06a9435a597d1a1aaab44d46f63004f5e12bae7b
SHA512eba2f3f107abda1acd30370b087bc754e898771f20d525e54b12d0bb47571d0e702a60b243cc00c74d96862d6106ac31398a93b78633e0b3a8f9fb26f8f38011
-
MD5
eadd82d5d5519fecf1de63eb0a063859
SHA18c02cfac9a483fdfbe10ec50fc7a8598bbe70fff
SHA256bf007b20b023ca78164e716fb82697e602f7e42553cd949ad84371188539cf86
SHA5124e987c987bfe2c80ceed9b52cb809347b76d4e9d2689d5655096ab01b50be5f74eb2a2697664532a845791fd51883f78032286abb9d3b201938c0de16f7d7e89
-
MD5
eadd82d5d5519fecf1de63eb0a063859
SHA18c02cfac9a483fdfbe10ec50fc7a8598bbe70fff
SHA256bf007b20b023ca78164e716fb82697e602f7e42553cd949ad84371188539cf86
SHA5124e987c987bfe2c80ceed9b52cb809347b76d4e9d2689d5655096ab01b50be5f74eb2a2697664532a845791fd51883f78032286abb9d3b201938c0de16f7d7e89
-
MD5
19a396949e1bd0cc78bfa8e1daa9dbd0
SHA1ac61be12b20cbf3b95c6d7350aa70b8576fe01e1
SHA2569cbc92a86083425f38fb92bf31f7ffb3f2e0793b5e17b48503a1f8caf194fc88
SHA512f52a701ecdf12aca4e7100e454d383ae944bb8ff5c468e89d109fd53c502936a67b5504b14dd993017e977b3a0c5c097890339ab13669513112525552cfcabf4
-
MD5
0580c99b54cdbdf84f17b1786194755e
SHA1153fd31cc9776d4cca634685eb5afd29e2df8b7a
SHA256e53616c5e459b5b7499ce14dbff3cb1b167cec8a626bf79f521a3bdcdcb92a29
SHA512c7beeac631cd4f2a614a6c1715d55e8c6e62d2898150c81a45b901a41e339b9cf374b1dbde70c5f7687b7d56083f8ebcd83424bf167a8380e029a1062508c053
-
MD5
505aeab455b7a1e0816887731baa9178
SHA15a1ece96843c5c54536e266c807110e73eda7357
SHA256ddf6ef9bdd541942b8feb004e91f4a071a1e38b96a1014390fff8f408b6bbce7
SHA512bc3c62972c1e63089c1dfd3d9ed3a88182d614f91d6509b1f42898a81e82f6ab8277732503e8931fa052af09bde8728ea502c70e6d35fcdb4fabb83c51e22f9e
-
MD5
505aeab455b7a1e0816887731baa9178
SHA15a1ece96843c5c54536e266c807110e73eda7357
SHA256ddf6ef9bdd541942b8feb004e91f4a071a1e38b96a1014390fff8f408b6bbce7
SHA512bc3c62972c1e63089c1dfd3d9ed3a88182d614f91d6509b1f42898a81e82f6ab8277732503e8931fa052af09bde8728ea502c70e6d35fcdb4fabb83c51e22f9e
-
MD5
8ebe49ed4828f6eeb44d05cb0313bd88
SHA125b95af9c5ee9fc39fdfdc4aa0e837238338b42b
SHA256d44a99d5220c1bebe4430e78a3f3442d00256423d5fee98a3bd91559a510f944
SHA5124e7c4e4c6cbae0975a8e76aa19f58ff65b519275b0566f6971b3c93494f00f9bb3b10722d6fd7b3afab2d2858d275f8d83b66eefc5bef4a2d51bc0f191ac226b
-
MD5
8ebe49ed4828f6eeb44d05cb0313bd88
SHA125b95af9c5ee9fc39fdfdc4aa0e837238338b42b
SHA256d44a99d5220c1bebe4430e78a3f3442d00256423d5fee98a3bd91559a510f944
SHA5124e7c4e4c6cbae0975a8e76aa19f58ff65b519275b0566f6971b3c93494f00f9bb3b10722d6fd7b3afab2d2858d275f8d83b66eefc5bef4a2d51bc0f191ac226b
-
MD5
1f6df24136b3f7b01a597b0fa206cbe5
SHA1c8b7f4d4157759d86c3c47ccc2791e9ab71e3452
SHA2562bc8072642804e5672657ca34bd65b428e2e935bd3dfecb4d35e4d66b5e2d372
SHA512cf77dcde1d07fd11d02213a576a57d5783fb20f18d095c989029c5d448e685db49b68026c8bde994d4afe80e111677cf5f035ab26b0bea2a8e883bdc9d8fb651
-
MD5
2ad5de9643df750e3a9d210cf9123401
SHA165d7233e73fafe9902c5ad753c9ca3171aee9f94
SHA256c7cfd09982b750b6e306ccfcdb23e25f42032120ee4566ab5730e1799e88fdc6
SHA512e1d98d995c2419a33c9339cc17277d1fb7cb449ebeecefda1b5049643dec398da0401467a548d646abe2954d521ea541d3d0bc7f26f6569ff782af6e46fd943f
-
MD5
48de94df16a77e4e136e9882a689d026
SHA1f13197b76805f60338c34f1507901b7656652c97
SHA2567e11f9903cb6fbee08d2d6c7cc99abbd5834895c4d2443c86068ce1329d0c6b5
SHA5128dd6a862620234e8b7605da60d7153690ea42c53ecb0ff155883599c1061bb8f47b83f0f5769e3efd355a1bb2b3d10a33c7865104ca1e7d819bc0b974ac83a15
-
MD5
fa22191790bee14e8d085ff6dd276419
SHA1ec3347b4a1bf6733986457e2cb1e3eadd803bbd2
SHA256471ecfcd24672f79cfe5207b15931c53234035c1adce3b9ba334b453cc417a25
SHA51272a5f4a3a205d1604f20fe3b86ad699c2c0f075c1c90b0dd44f71824a87322b64ffb74ae3287ca6a4e8a076641bc076c6c41aab472010743e5a40f30cf948125
-
MD5
23b40ff16d1b736242a25b224c3ae6b7
SHA11de9269190588a723cdfc2a94a54e4ec69002516
SHA256f8769687f100387d3c8c031e973e432ea68d1f57d94bdc5ffa00e69dbbc809d3
SHA512480d08774c023bcfee40d4d05be44aa804a0c152b0d8678f1c634cf6c250b66f9a0544fc495d51dd84433099f91e03ca85649ff1f1dfbfd0807c8cd396aaf6c3
-
MD5
2901d06232efaf1ec0d929b642ce90da
SHA16378b3e97b56e0a0001971108ec21780742d6a18
SHA256c5d9ad171654a1e7ec987e42ec773a0821f72f7d531b3a04e5fd585d865f8056
SHA5126867eb666caa89ce4dc19435b5256f0b9ee5f9346c0e3d3de0c9b94cb72fdd2d8574545e1558753871615c366d6252473142a342080bc8610397eab3faebdc23
-
MD5
5f9b2e2a76dc742f124237ed870c7eff
SHA13395557dd68e19e45003503affd10c040fe63422
SHA2569cfa324774567beed80bb948451d4c8cdf86a9bc81b782a24c3df6da8702e12f
SHA5120c73aa766542027522fecd596be84945eb2cede903fee7080a5c8fa29b0dee0553eb7472775c3ab4f0a0d380fb32f355afd45bc5e62eeaae1fe96ad98d3ae610
-
MD5
697f16b8c6892082559d8a17db343865
SHA1246d6ba1419478be7915e78b61525da894321fb9
SHA256518ab091348dea4f49183958185b3d42b5ddb191007bab25b6e69ff6ec923f1f
SHA512801a428c5dd5ff4a745923914505dcf5a9929b3dbfc5bb5f6320996ad849fa42dc75ac53a432dd01103e0d6db2269583351f14b189a76a066d6f940ff79d38d6
-
MD5
bddf4ce8e4cdccfa7a2f9338cbd0f673
SHA199b7d9e67ff382eb8449ca1a138dae0160bb221f
SHA2563349366b42d0d3583f000644dd98f3c12ba66f58a3249e7dcdf10944048dcad4
SHA512eb6bc8c9cddf13c8dab7a03b4042581aa0496e7c012e3d3596556c94ecd096779595c88b56df82b5f67dcafd10282ee9a6a9d61d7ff3fae59f1ea7cca0a2bd0c
-
MD5
c25eda9b7a6c36f1e45517f5ae447370
SHA1106227f3e6176afbcca86632ed9c6372639a5b63
SHA256bdd9373edfc1d546f053dafc00d73c423a994ecc051b46a8b22ba345fbd6edc0
SHA512811412f6f6bb918945c79f3f3defef9e4c1abe2efb761a0b462fb8071a6960ffcc4783f7b93a67eefc2ef6d2d0f90452fa035bc9db51f8750f435811fab0af4f
-
MD5
7fceb996f934e8bda687cdd2bd46a9a7
SHA181e1edbcca6438daaccc3845fa0e3b1a6cff17a6
SHA256fa53f8174510a9ad008973d47798f022b681e1764a15134efd2004980f23bb6e
SHA5126aa6253527b72c0605859180887ff19cd96412cb816ec02e832d4a0e0cbcd03d9cc580112e4e2055d4a9ede850c1a339df974371f992b0b9b73e54e137610205
-
MD5
9c644120c46a4b3d6b0a4fca6b11b28d
SHA1c29929e67d5856c0d844a174b6c185299c84876d
SHA25652245374ba820b7241465c7952ae45ea06df99e1110a6df44f666863e4ca7bea
SHA512fad8e69fc65b6c05ead56202036cec12b88bc32446756e2d997777dd4f5c707b8d760176524a50d4ce964271aeac17af17a360404b2c293fe1130fb08817a2ab