Analysis
-
max time kernel
4294211s -
max time network
158s -
platform
windows7_x64 -
resource
win7-20220310-en -
submitted
15-03-2022 14:05
Static task
static1
Behavioral task
behavioral1
Sample
520636dbbdc33d8dbdf1b14f043b46f8.exe
Resource
win7-20220310-en
General
-
Target
520636dbbdc33d8dbdf1b14f043b46f8.exe
-
Size
252KB
-
MD5
520636dbbdc33d8dbdf1b14f043b46f8
-
SHA1
20eec5615c4ecca3603f889bccf975c855fa7a07
-
SHA256
bd8aa280646a2b601ccbd5cec125d51646624d34005eb7db56da6b70fda821cb
-
SHA512
fc3869cf9a917b21e16f2f7150dbf78227c4e52a4f73a3b572555f38b2ae51358f32d0af7e08dc944529a1ed931f4cd09c694a92ad6b5680de58c4a2149077b6
Malware Config
Extracted
gozi_rm3
-
build
300994
Signatures
-
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1788 cmd.exe -
Uses Tor communications 1 TTPs
Malware can proxy its traffic through Tor for more anonymity.
-
Drops file in System32 directory 3 IoCs
Processes:
powershell.exepowershell.exepowershell.exedescription ioc process File opened for modification C:\Windows\System32\WindowsPowerShell\v1.0\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe File opened for modification C:\Windows\System32\WindowsPowerShell\v1.0\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe File opened for modification C:\Windows\System32\WindowsPowerShell\v1.0\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe -
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 1636 timeout.exe -
Processes:
iexplore.exeIEXPLORE.EXEIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004dda8e4cddf84341b86bc814e98354e500000000020000000000106600000001000020000000848de11a691104a4a7621763c329328b3aafae11240aada6b98e1e8e4316efba000000000e800000000200002000000033961ac82e3b91e722cea73c4c855d66e882ed23618be401c2b7d4a2d835fe6930010000aea24903b1f8b8839e597eb09610f9cea839664384b047fa634ce18a229ed4ced27a94a9bedff63463d0eae5ca54774a9e634d18800389ddd4d6ef383866d50b8c8592ebf76917c6e7f6262c644c5eae283cd21108b2742e5b43e2b728e1dba4054e90cf92954f3410876cb4f2bd0dab0b509f30edcc4ca278230aaf0597b30b535774eb9b0e6104e059eac051e461307b6eb87313924a781b13b3a4afe3894d4595461caddd7f0947c2482dd87804b616669bb200a190ce6273c53e9c99cec9a913667e972bdf3f195c4e447de2ed7a7451cb04727fa4023558ea2711b87e12a949af914d2681b612cf5653f5d8ab7b797bbc880620358241a7ca64702b56ad9b41389312e0e6e2c44dd0faba7c35bb65d2e3aac29db12cd4e2e7375d537fe947cdd6bdf6ae6b2cac346ecfc960eaef400000009f062d4b0dc30d1b6b15907bc63decdf8d49a1277613928f5ee01c2c50698b7c8e9866c17d4b7cbb974b54cc229788159f31d3a192340026c476f3122dd05239 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff19000000190000009f0400007e020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004dda8e4cddf84341b86bc814e98354e500000000020000000000106600000001000020000000c2a6ae86826be4047133c7c7dcc86b768e5ba045c4e15af6aef05b91cf3cba84000000000e8000000002000020000000d33dccbc349c7a3ab621c7e37f5960b05b3564231a365a9f4d9d4bd46b7aac28300100005bb4a93d19191c934a7f1ea60357c5c09a967ea5774a4912fe2fee1b64d094d7eed429f574b4a894c71412d67716503619a39646a5adf8b0bfa52557b6ff22b2153120982dd84b2818c2f0092c2d29b4bdf5457e1ea2856f365b4b36806ed18bb6d1530ab4747944eeeee506edf486738e63c19151cf4e4502364c7dfae22d68cd32a866cd291332eb4a64e61e0cdc1a2940e9b547f8be744f90199096e7d18312be8a6f861388b7d9d6f3b85ea4222845e823e61b771d99697a6d8ab123929a46b38d346e16a2df77d7eec8b116595990fc9aecbfcd16b09ed9948f82a5621a4edad10f71f928370c47e43e4a97cc57274a50bfa143377ab371cbbb40a58aab45b75b68877d16e8e7a3890ceb68c8ee8ab809628efcfd25dc96f5b24ec6ec1c917d02f0978340e27047fab299a87fc640000000845256ab7d3b0aef3dcb07236ed3d63772fac2dc72adafca6ab5d382b095d734b0d53dfe89ad8ac4fd7856d60e264d0d08f05d0ac78af84262526135d46a4919 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004dda8e4cddf84341b86bc814e98354e50000000002000000000010660000000100002000000038820fba66496241cf9700077d97233f36089d05dcc089baa312ca1a96d9c2aa000000000e80000000020000200000006b7c7609116fe14d83cdb94adc9834244c3c71c36ccb17ac54e7c9407362d28530010000862b7a0a43c886bba981399e1a1fa564f73a8111600805c429b72c78fba68a4636ab39b63b14c3cdc1975dbd8458800e9cc894f50de0afb8ca796319a176d0b3987ce3d2cb9c6b5049b9b40e8a9e62572486e975b6f08c5c58219fa75013e78f8aedfe970b56e81f1ee38d5f4f288b5d467ffc9e477c6036b4a1866f941dfabcb3a1ea9073e445e7cdeb05d3ef1d975cccb3eafc5248317c418eac650c7e4cdd08ae3c5fb55163d88854c85cc3699cc8a70d8a65d83ea11cb8c8e4ec9930f655689035cf09acf0f9ac84922efe607817599f60e038094ef9473bfd48ac6e7eb92bfa34e1ce861e03998728318c82e11a5a3a9c2981e86ccc8388c2c40487fe71fd2c5c4d593e4e1dd2b0d9ac51fe8c3c90b7c8f5ddff96832756bab41508ec3cdcb755c1976a4d3d0844af32d27574ed400000008e74336338a83c2c2dfbbe6582757fb0cfddda26c078bdd177d1dc7b46613da9d293c0d351e584799d7b6e0474b6f28e8abe8f401ce8b15f0680f9c52954445c iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff6f00000019000000f50400007e020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff3200000032000000b804000097020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff6400000019000000ea0400007e020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 406df82d7e38d801 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004dda8e4cddf84341b86bc814e98354e5000000000200000000001066000000010000200000004da70a2a8d8f657ee493617ead9bfa85ff5a3a40dac172efc4c9069ad3ea209e000000000e8000000002000020000000e4122a9fad8930f138dc068757f584bdb351ae9d297010c6279fa44333f0d31f30010000474375028df37e5a4ca764379726aec4a9856dc73f396be4140a6e6d57c1ae1f902f0962842595965e0986230b281676444065eba59588573d05c03b3edb815290d2357b40effd4ef00deb86a07f4308f9a9efab5eb64d587abe57ca2d73c3ba0705545472c522c9532175c21a55070ccf1e8b080877bcbb07f6eca41196ce7404ae8ebebd7d0b0b043987453de9f74d01a9fffbfce09499c380698dbd12f8fe433b4e086e58b31d0631ad7c645c7272f917c399abe77e0d0e7edbf3e19646570a7fbd711a7b7899f91c4413f343a54ea34b3d54f647228c0dc17d753a8b737577f530598c388601ccb6b08c99420550a405527521a4206db8b233b32c607ddaef4d04f826ee87a771f7e20403b6c457b691870a4cc0a4cfb490adf85cde6597ce4047c806060c0e889fa7d7f5522b3640000000822ef81260457029cf7a39416f17b1e82472dc6f1c4c68333a7c2ea2a1c0637a50cff14c9bf5568a69d8b4a1a9233cfdaf3adbd701d23bc2a4b6ca16b29ec4e9 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{60815881-A471-11EC-ACC4-5A7BB634C6F6} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff00000000000000008604000065020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004dda8e4cddf84341b86bc814e98354e500000000020000000000106600000001000020000000fa5acc32a29e8820665400d28932650271f18652831449b5364d513e490d840f000000000e8000000002000020000000e5b77292f411cc1dd3dd2992ac4c0e153201eb4c5391f1304942fbd41e005fcb3001000029ed0abb74debf6443f8f9297ac44d38a27674fec2c1395dcd70e4236f2e1e4aeddb7d110153fdf83aabc2bffcadb01b71b08242c54553691253424fcc70c6e6c14b549556a5170bf1129743fd2f3d1253449430fa3958bbca10ec8f25426dcae2b8a89e755d6464aab57155788472561bc8081d937bec8e7971a0135d4470bdf1dd54ee2d6b09a4d4528fc4318d21ff4f3c39e29ab7c72bae8d13eca45a2a5c1e302313ff5f60aa5692bccdd56b17cc23440029c485e99795143653814328b8a6420f7fc7c9f49f9474367cadf235454ff734efa4e53d1d90c9ed8f8271b3acc8cb2a28eeb89979ed83f3403134036ec62dca8fe25cc5e062365ce4db57150c422e3a524515be0d40ecba8d590ef1c5802542cf501c26abbd9dd64dd1cbb58c48c08afe75e996dca43f968a4802109d4000000040f546d20bb12a27789a07519202d014b2c4c8749c3eb2834a86c597f08fa68d40ad23475e3c828e7c515e9ded1d58dc94d5cb267c7bf01cd64076015346b8e1 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004dda8e4cddf84341b86bc814e98354e5000000000200000000001066000000010000200000007164a8aa0278030caad5712525f19cc3b5e421a299aa25615e2712d144b03736000000000e8000000002000020000000de34d9e6a8c8cae055431619d02e81a3c7343c0f7fc1e142c8968139dd736a399000000028659c0277fee02be012aaf72256cd68966795c6fa850f04c61aa0ab94bf8525afcb7d45a6fda3f8cbb76d5bf8067595530e3073608a60058aa340775b966d8f8e2f45da05b298d2f763bf0b1b42df0e3d52d955956f284c5d01fbbb45278974c5a1f43bc2b2215f6eec965aaee911c552487e070b3b4d3b76c21110378ff68be3103d5d7ab68b1adb063b868eaaf8e9400000009a64f00d6404739aaf28608b30263eb34584d8dbb5250cfcbdc610aeab75cedd8df7dd6e7549bd7ee22f13dc46b2785eaca9fd0d2570fbeed4229d06c7529711 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004dda8e4cddf84341b86bc814e98354e500000000020000000000106600000001000020000000c0e3c8076960ba661f9913e22f8bee511a511c6341b43d35f84af669ab444989000000000e8000000002000020000000d7cc88cf612901c2668c545b39ce96c22ae1773585c7bda6b1cabca272e8027230010000a55f877eff2bef3f72ab0539bb5f1dd036a4a863139ce845f80ea5104a8eab2b44fa72e271287b05d26051addf4a598215d4909b321ea8442647f828290bff39417317afb869fec6024318d9fdf4545913684ab3a958904c247fb15840a607c65989810b22b0e98534832a9f8a306a3864c4a9f12f485e0206dbb3f8e708c710f2f0761cec570e4bae8c3fbde561b09005d5c2c97f02aaeed3cab739ed54c388871062e16ef1dd09166c037169b115ac02299232b031ce3e1f5e6ba8fe786e9de0a5b9aa34cbe80e58f1e14611aa56f6a652476a80be27a794d4d0a4eb0e5c099b6ae2dffd20cf1857df5775a29cfa578ec3969677d30880be3c4067d045403c56df3ecb2d7475bfbe84b27623051853d6303c17f34438d11df24a71ecf69992b601da0d20083d90d003471cc8bb1f40400000006d22f5a04e32e5a3d8466edeacf932dba5d49c1f8eee51a3663a413f9a0941e0d950101752db7aa20f486c6f425732b3170a950342b394e7f6522523e57deaec iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff4b00000000000000d104000065020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004dda8e4cddf84341b86bc814e98354e500000000020000000000106600000001000020000000c2797f40edac4b31681b03d7d44b72216d8c449a336471011bf238c0fc52c61a000000000e8000000002000020000000f41c85d1de46350762f16ad5549d664ef80e28256772f4783637074a5527187530010000be1bd8744b35b473beb215677ef029eca1384d1f38ab64a155ab9074cb0a9e5e3d2067d9ffbae84c506bf1e2803e3b63a0970c4ea3243c599787ec195f4427348ef919aa1c5102bfb9b4f5e31f84055b9a76c11215fdeef9343cae1f9e36d8d33903204852b9fceb7a2bc6b702a01a075627d40a980e3083af04638aeeb298f6ca205fbb6a76fa6d3bb3a934cbc43935748a7589e4dae69b9e9ad61832e1027943ff96be7ae6e0eb352867d6c4b63e313b2cb2d185f9f609226d6fe199b51f7f7c5dacdaf6aea5efc208aab99affbb23a45b7ff8c0d1de1dbff1e821a824038c0e6fec36092ff182089b63607697e202d4b5c7d77db5ec373a9420cbd5ac88ece960a8d87f2f502aa4985fb1dc3dd8d7e5c1310d1e50c65546db7f5d5f7a6ef7911d47f1e99881683e32a5967adc9a18400000003db41519f06a057313287039bdfa979e80672fdf21599526630f248d60b58f0fd24babb30d4f807e71b09203803895d91bc32d75d5a56e1e62fcb42acdb81a17 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004dda8e4cddf84341b86bc814e98354e5000000000200000000001066000000010000200000003c553aceacc9c3d1ea9900fef69b5e4d4ff339bb25ed4baa739946f9d7884d54000000000e800000000200002000000009466dcf8b39ce8940293b538d90e128e01e1b6f9419c346a4934f0985e8a0f22000000003186fea220cdd2ec20d54cf21108ff4371086526455f4c4fdc5c69e09cae2ea40000000532736d937bd0ebe623f6a3d0bdfd550697ab1d05204c1763c0449ed5bfc18ff8df4e18e8b246f0d7148607c3394291e170835115dbea538f2774adea503adfe iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004dda8e4cddf84341b86bc814e98354e5000000000200000000001066000000010000200000008d6ab81c0add1a71a83e6d19c1a86685433e44dbd4f93b9eadc54382f5ee8105000000000e8000000002000020000000baa5ae7a34ffe3160257822823aebe40fa4c8aa180f5cb0b95876618eb705857300100001bf98b54daefb1bb44ce44eaa7a36cf75a4adafa801b45316bf42c1e54d1507bcbaff6a5fbd8917ba62150046d5c8d4a6396a45f2a5ff2d8008f0d9c584b825ffb5d1f31db7226ad0c386841963b6fa652859e05911dbda433f5bd5cadb91ae09e387bb3e09681510f8de019c765abebea2aa6d8d9ab038c70390e52d82edc7714175cbc82eb53444865a628b9e2333eaf1ab216d7284c61736c1df03ccf47c03efdc69d4e08659f1de4b64e7717904c7dadaab3f0ec62cac80026276330f00519faeec9054f2f4eb82e12793bc5eb5074e58a9150ca021143d1ef5767d5cf4e2c432ec2cb08bd1ba7585b965c9945119158077dac80db84d0d0acb7dbcf3c6572006be2b2af0d262d0370825c0ad988e19a03d16dbbe3ad3534af466fc705f8b31e0acaaa395a649a709a1dfdaf6fe84000000015d5dd4e0211195b0d8a39d23c4b702108f7289d9611026501a3dba0b3e6929b7a5458a427008f7d6dbe1505362289050631046d61c0d3d24254b5f5bc924fb2 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff5600000000000000dc04000065020000 iexplore.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
powershell.exepowershell.exepowershell.exepid process 1912 powershell.exe 1404 powershell.exe 592 powershell.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
520636dbbdc33d8dbdf1b14f043b46f8.exepowershell.exepid process 1992 520636dbbdc33d8dbdf1b14f043b46f8.exe 1912 powershell.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
powershell.exepowershell.exepowershell.exedescription pid process Token: SeDebugPrivilege 1912 powershell.exe Token: SeDebugPrivilege 1404 powershell.exe Token: SeDebugPrivilege 592 powershell.exe -
Suspicious use of FindShellTrayWindow 11 IoCs
Processes:
iexplore.exepid process 1936 iexplore.exe 1936 iexplore.exe 1936 iexplore.exe 1936 iexplore.exe 1936 iexplore.exe 1936 iexplore.exe 1936 iexplore.exe 1936 iexplore.exe 1936 iexplore.exe 1936 iexplore.exe 1936 iexplore.exe -
Suspicious use of SetWindowsHookEx 44 IoCs
Processes:
iexplore.exeIEXPLORE.EXEIEXPLORE.EXEpid process 1936 iexplore.exe 1936 iexplore.exe 1012 IEXPLORE.EXE 1012 IEXPLORE.EXE 1936 iexplore.exe 1936 iexplore.exe 984 IEXPLORE.EXE 984 IEXPLORE.EXE 1936 iexplore.exe 1936 iexplore.exe 1012 IEXPLORE.EXE 1012 IEXPLORE.EXE 1936 iexplore.exe 1936 iexplore.exe 1012 IEXPLORE.EXE 1012 IEXPLORE.EXE 1936 iexplore.exe 1936 iexplore.exe 1012 IEXPLORE.EXE 1012 IEXPLORE.EXE 1936 iexplore.exe 1936 iexplore.exe 984 IEXPLORE.EXE 984 IEXPLORE.EXE 1936 iexplore.exe 1936 iexplore.exe 1012 IEXPLORE.EXE 1012 IEXPLORE.EXE 1936 iexplore.exe 1936 iexplore.exe 1012 IEXPLORE.EXE 1012 IEXPLORE.EXE 1936 iexplore.exe 1936 iexplore.exe 1012 IEXPLORE.EXE 1012 IEXPLORE.EXE 1936 iexplore.exe 1936 iexplore.exe 1012 IEXPLORE.EXE 1012 IEXPLORE.EXE 1936 iexplore.exe 1936 iexplore.exe 1012 IEXPLORE.EXE 1012 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 40 IoCs
Processes:
iexplore.execmd.exeforfiles.execmd.exe520636dbbdc33d8dbdf1b14f043b46f8.exepowershell.execsc.execsc.execmd.exedescription pid process target process PID 1936 wrote to memory of 1012 1936 iexplore.exe IEXPLORE.EXE PID 1936 wrote to memory of 1012 1936 iexplore.exe IEXPLORE.EXE PID 1936 wrote to memory of 1012 1936 iexplore.exe IEXPLORE.EXE PID 1936 wrote to memory of 1012 1936 iexplore.exe IEXPLORE.EXE PID 1936 wrote to memory of 984 1936 iexplore.exe IEXPLORE.EXE PID 1936 wrote to memory of 984 1936 iexplore.exe IEXPLORE.EXE PID 1936 wrote to memory of 984 1936 iexplore.exe IEXPLORE.EXE PID 1936 wrote to memory of 984 1936 iexplore.exe IEXPLORE.EXE PID 1736 wrote to memory of 1356 1736 cmd.exe forfiles.exe PID 1736 wrote to memory of 1356 1736 cmd.exe forfiles.exe PID 1736 wrote to memory of 1356 1736 cmd.exe forfiles.exe PID 1356 wrote to memory of 756 1356 forfiles.exe cmd.exe PID 1356 wrote to memory of 756 1356 forfiles.exe cmd.exe PID 1356 wrote to memory of 756 1356 forfiles.exe cmd.exe PID 756 wrote to memory of 1912 756 cmd.exe powershell.exe PID 756 wrote to memory of 1912 756 cmd.exe powershell.exe PID 756 wrote to memory of 1912 756 cmd.exe powershell.exe PID 1992 wrote to memory of 1264 1992 520636dbbdc33d8dbdf1b14f043b46f8.exe Explorer.EXE PID 1912 wrote to memory of 1404 1912 powershell.exe powershell.exe PID 1912 wrote to memory of 1404 1912 powershell.exe powershell.exe PID 1912 wrote to memory of 1404 1912 powershell.exe powershell.exe PID 1912 wrote to memory of 592 1912 powershell.exe powershell.exe PID 1912 wrote to memory of 592 1912 powershell.exe powershell.exe PID 1912 wrote to memory of 592 1912 powershell.exe powershell.exe PID 1912 wrote to memory of 1932 1912 powershell.exe csc.exe PID 1912 wrote to memory of 1932 1912 powershell.exe csc.exe PID 1912 wrote to memory of 1932 1912 powershell.exe csc.exe PID 1932 wrote to memory of 1076 1932 csc.exe cvtres.exe PID 1932 wrote to memory of 1076 1932 csc.exe cvtres.exe PID 1932 wrote to memory of 1076 1932 csc.exe cvtres.exe PID 1912 wrote to memory of 1948 1912 powershell.exe csc.exe PID 1912 wrote to memory of 1948 1912 powershell.exe csc.exe PID 1912 wrote to memory of 1948 1912 powershell.exe csc.exe PID 1948 wrote to memory of 1524 1948 csc.exe cvtres.exe PID 1948 wrote to memory of 1524 1948 csc.exe cvtres.exe PID 1948 wrote to memory of 1524 1948 csc.exe cvtres.exe PID 1912 wrote to memory of 1264 1912 powershell.exe Explorer.EXE PID 1788 wrote to memory of 1636 1788 cmd.exe timeout.exe PID 1788 wrote to memory of 1636 1788 cmd.exe timeout.exe PID 1788 wrote to memory of 1636 1788 cmd.exe timeout.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1264
-
C:\Users\Admin\AppData\Local\Temp\520636dbbdc33d8dbdf1b14f043b46f8.exe"C:\Users\Admin\AppData\Local\Temp\520636dbbdc33d8dbdf1b14f043b46f8.exe"2⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1992 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c start /min forfiles /c "cmd /k @path -ec aQBlAHgAIAAoAGcAcAAgACcASABLAEMAVQA6AFwAUwBvAGYAdAB3AGEAcgBlAFwATQBvAGQAZQBhAHIAYwBoAGkAdgBlACcAKQAuAFMA & exit" /p C:\Windows\system32 /s /m po*l.e*e2⤵
- Suspicious use of WriteProcessMemory
PID:1736 -
C:\Windows\system32\forfiles.exeforfiles /c "cmd /k @path -ec aQBlAHgAIAAoAGcAcAAgACcASABLAEMAVQA6AFwAUwBvAGYAdAB3AGEAcgBlAFwATQBvAGQAZQBhAHIAYwBoAGkAdgBlACcAKQAuAFMA & exit" /p C:\Windows\system32 /s /m po*l.e*e3⤵
- Suspicious use of WriteProcessMemory
PID:1356 -
C:\Windows\system32\cmd.exe/k "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -ec aQBlAHgAIAAoAGcAcAAgACcASABLAEMAVQA6AFwAUwBvAGYAdAB3AGEAcgBlAFwATQBvAGQAZQBhAHIAYwBoAGkAdgBlACcAKQAuAFMA & exit4⤵
- Suspicious use of WriteProcessMemory
PID:756 -
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -ec aQBlAHgAIAAoAGcAcAAgACcASABLAEMAVQA6AFwAUwBvAGYAdAB3AGEAcgBlAFwATQBvAGQAZQBhAHIAYwBoAGkAdgBlACcAKQAuAFMA5⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1912 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -E JwBwAGEAcgBhAG0AKAAkAG8AdgB0AHMAbAB5ACkAOwBbAFMAeQBzAHQAZQBtAC4AQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJABvAHYAdABzAGwAeQApACcA6⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1404 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -E JwBwAGEAcgBhAG0AKAAkAHAAYgBmAG0AYwBnAHQAcwB1AGYAbQApADsAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAQQBTAEMASQBJAC4ARwBlAHQAUwB0AHIAaQBuAGcAKAAkAHAAYgBmAG0AYwBnAHQAcwB1AGYAbQApACcA6⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:592 -
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\osypmjrv.cmdline"6⤵
- Suspicious use of WriteProcessMemory
PID:1932 -
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA842.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCA841.tmp"7⤵PID:1076
-
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\oza3_e8q.cmdline"6⤵
- Suspicious use of WriteProcessMemory
PID:1948 -
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA91C.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCA91B.tmp"7⤵PID:1524
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C timeout /t 5 && del "C:\USERS\ADMIN\APPDATA\LOCAL\TEMP\520636DBBDC33D8DBDF1B14F043B46F8.EXE"2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:1788 -
C:\Windows\system32\timeout.exetimeout /t 53⤵
- Delays execution with timeout.exe
PID:1636
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1936 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1936 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1012 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1936 CREDAT:996356 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:984
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
54e9306f95f32e50ccd58af19753d929
SHA1eab9457321f34d4dcf7d4a0ac83edc9131bf7c57
SHA25645f94dceb18a8f738a26da09ce4558995a4fe02b971882e8116fc9b59813bb72
SHA5128711a4d866f21cdf4d4e6131ec4cfaf6821d0d22b90946be8b5a09ab868af0270a89bc326f03b858f0361a83c11a1531b894dfd1945e4812ba429a7558791f4f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
MD58d59154f9fa5f78b9217db0c169eb259
SHA122a3b2e4f5238c8b321b8146dad6950eb272d427
SHA256b1288af8d602e81a315074a7c369b7d81237d41969290258ef206c17a854e5cf
SHA5121e89fe9f1a4a7da0ca6c5704d9f09306e67a328611fe8bcc57705e9de7951ad77a2644602f3cc23787404fdb2e619d3615fe6dfbaea9e849ab8480c756c3144d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
MD52760940dd3373665524479ac46781ac2
SHA193f6a6076c7e1ab3d535a0fb6adcae0313eef8ac
SHA256a4d66b76de6889bca2606c99d1002b5b01dd2ffd82a3cac12c72e62702c3da47
SHA512e7f63ae5fc5db271a16b17703a8fdd56d46a6afe1c582d0e519b2c35e0e5126d34019cf0f90d8985772a147f2810409a57e9b718066f1fe1cbbbae3811c7b0de
-
MD5
e0c253dbd4f75919730d1208457db2e0
SHA1edc50a6801c69134ff04d14f285006ab7ebf0acc
SHA256059333484fb4042c082f5e1e670bc39356f9a19d934b5c23fc6ab364e89302ee
SHA51274878e39b29e49e6aed445d75df9e35a0ed49eeffd09a59aefe13effe309d5fffd1ee5bec907f1725d53bb542d448ad8c1260c9cea8eb795c6d4d52f53514595
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3OL83HNN\favicon[1].ico
MD5a976d227e5d1dcf62f5f7e623211dd1b
SHA1a2a9dc1abdd3d888484678663928cb024c359ee6
SHA25666332859bd8e3441a019e073a318b62a47014ba244121301034b510dc7532271
SHA5126754d545f2ce095cfa1fa7ca9e3223f89e37726ee7e541ebcf3e209e18b2602f3be8677598cb30d697327a63de032c11dbf8ef7ad7889a79c488a21044c1cb3f
-
MD5
7f1f94f71dcce806d0bca78d612013d2
SHA195c33fc2b9e5be4c8ec3e3dc20802652fee94c48
SHA256956b1c753e9c0028cec53347d7cbf3be5dbd2f4613dcfe6f06c6f860d56ce912
SHA512e115b20ad57ddae1fb3d357aa83e4f186908832529a936c52f2242965f4edc3bd1c6f2c12ea5055e79836fbd8c8ad19d862752ea8a11738096901a24b44ec8ab
-
MD5
ec7a96eefbabd22e6aed087425c95ef6
SHA15d32bf83a615701250646bbcb2bef5c8234794ce
SHA25630578684c26a89bd82378ae4ecc7ce68dd10c7d168f6843e928fdd4d99f35f9f
SHA512722916ce5825fa8a283413578aef4b0cc110c83f0af42bfc4a40a901e4c399f3b0345dc80833a6eb2a51619e62946604a2e9ba3d5a05670ac8bacaaecc5c0b07
-
MD5
1c01f7d120ec811bebebf853c4c3e1f4
SHA1d378a6a2b3a070ebaa998f54f5d16f879147e761
SHA256918cb874e5c417b9a2c237e5dcb6bcfb86f0cb383da6520083a4173fdc93c14a
SHA51264d79b65aa7178288f570a53e2f3a489fce07b11c645699a995af2d14a8e4254b6224bdf92f9a41a2fbb2e64fbdb3fd44ae1257202ed8f483a819f01e48de6ec
-
MD5
9120556a97a45e7555ebda26a4891e04
SHA18d55a8b570407ac13120a661213e3de898df0c22
SHA256bb1dead640c14f03c904f43a2ac1520f5c8e214508ca3d70c7e7daf46b52765d
SHA512f642e1a7599a926b6c3e98b632c140f4ada33149975617470e270aeefb7d32d866aa3d80ceb290824a093a1d647ae154d97a426b767157c162b76e550629c5a4
-
MD5
34db741e5006a94367bc64b11110b0f5
SHA1a051a45c59d0e033b0d3d6c911d74832cfc17989
SHA256c50abb56dace7b907031f52db2053a339fa4ab8ac2c84e8aaa03728d66af641a
SHA512d5027b156a3fed8ff20bc6ad1aa90d5319341d35f440c4d3ae4be3746c3368a1caba53bccd5e72fa7d1126e80e5a2092ec9f9b5ba4a34d2825c43aa8c414a39b
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
MD5625b456ad24406be3c06dce3d5c3432e
SHA1c7cc8e0c4949ea162d68d6f3e59faedce758d7bf
SHA25690dabb84166493981c68dee7ee8e96624e4f944dd535cb63f2d982a648cac64e
SHA512ff3b2c4165ff654727e6e6f3c2c4cbfbc61dfc5c23a1f1f155c1037c088bd07f5ee7a3be75a5867a0c2fb7c328a22a3d950df7e96c0437601533bcde441b92ed
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
MD5625b456ad24406be3c06dce3d5c3432e
SHA1c7cc8e0c4949ea162d68d6f3e59faedce758d7bf
SHA25690dabb84166493981c68dee7ee8e96624e4f944dd535cb63f2d982a648cac64e
SHA512ff3b2c4165ff654727e6e6f3c2c4cbfbc61dfc5c23a1f1f155c1037c088bd07f5ee7a3be75a5867a0c2fb7c328a22a3d950df7e96c0437601533bcde441b92ed
-
MD5
c12d86f1dc02ea3123cdbee5d780f090
SHA1993d6216b7d549f301f9c6b322470781c4f3373f
SHA25631500aed6fdb95d5ad1e36055fd4f6c0afc26126dc4749f132e958b4cf60132c
SHA51214e5596b519346c1c044576e5b23f59fcc14c239b6e1fe735a6261970b33ac144310a144c9b881c9d8f743d8498de5d30e8a3684eae6bae743f96161b33bf604
-
MD5
7fceb996f934e8bda687cdd2bd46a9a7
SHA181e1edbcca6438daaccc3845fa0e3b1a6cff17a6
SHA256fa53f8174510a9ad008973d47798f022b681e1764a15134efd2004980f23bb6e
SHA5126aa6253527b72c0605859180887ff19cd96412cb816ec02e832d4a0e0cbcd03d9cc580112e4e2055d4a9ede850c1a339df974371f992b0b9b73e54e137610205
-
MD5
069ff734354afd99b6d5e75d868b1997
SHA1de903117803306256e72ff697009167ec69cb96f
SHA256505ede475e1a535e41dab26036a49fb09991de78ce34b157a2f2a486aee4dc93
SHA5129af3c46dd65f8a4b01aeb3e8b58c462186dbda6020357c594bf535234f9385519aafbcfd796608becc828a4d877049e431379d40b0f48dc35b620849bc742bf0
-
MD5
697f16b8c6892082559d8a17db343865
SHA1246d6ba1419478be7915e78b61525da894321fb9
SHA256518ab091348dea4f49183958185b3d42b5ddb191007bab25b6e69ff6ec923f1f
SHA512801a428c5dd5ff4a745923914505dcf5a9929b3dbfc5bb5f6320996ad849fa42dc75ac53a432dd01103e0d6db2269583351f14b189a76a066d6f940ff79d38d6
-
MD5
ec09b9ded659bf771729da49524ee0e8
SHA15da299ddd549cce62f1379e16d8396f6c6c615aa
SHA2561d36482409f8954a4ad2e52db7a481ce0e119200398ec3337fa0124f6abebdc1
SHA512665e506e357b1280eb34eee2efd607b7c1bb384b9c988194813b8ab8de5238a52c6b5d46a8126a043d42e2788d12765c50f87f96f931924c24ea79ff77780367