Analysis
- max time kernel
148s - max time network
146s - platform
windows10-2004_x64 - resource
win10v2004-20220310-en - submitted
22/03/2022, 03:28
Static task
static1
Behavioral task
behavioral1
Sample
LfePS4pubczviio.exe
Resource
win7-20220311-en
windows7_x64
0 signatures
0 seconds
General
- Target LfePS4pubczviio.exe
- Size 844KB
- Sample220322-d1b4caech7
- SHA256 293e285042ed8b51e4166782005c54d1b3c20ba5f148f90b318f3c788115e892
- MD5 8df829ff4c1b14e4e0ad428259e1b68a
- SHA1 09699b5a45147b12b3ab15c273c2f43ea98ec910
- SHA512 827059a31eae40b3c847e8ca96152e00b2410c756f650730a9830312d18e2159a40f98d13995b93147d655ecd5568a188d8211d81d827d0b9fea527bd3d70446
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
xloader
Version
-
2.5
Campaign
-
rmpc
Decoy
-
lrsdh.com
-
sugarcurd.com
-
genussqmzg.online
-
warkulat.net
-
topstitched.com
-
sman1kotatambaloka.xyz
-
hireprowriter.com
-
robroyrecords.com
-
merlinreport.com
-
topofluna.com
-
planident.com
-
hokashoesingapore.com
-
buckitload.com
-
xn--0k1a.com
-
mynba2k22.com
-
thiccblanket.com
-
zayedhealth.clinic
-
alfer-srl.com
-
sunnysikka.com
-
sdtcbh.com
-
izzat.green
-
princealwaleed.com
-
cesiesis.com
-
alternativedata.company
-
chriscrown.xyz
-
fsyetuo.com
-
gmat-easy.online
-
daadoosh.com
-
sectorfarmaceutico.com
-
loueofficial.com
-
daddybearbodywork.com
-
dtmrealtyspi.com
-
contact-europe.com
-
meltingpotspot.com
-
baojiangou.com
-
escuelaacupunturaimai.com
-
bboldit.com
-
drawerfuid.com
-
sdysjskj.com
-
nbslktwx.com
-
nashvilleholdings.com
-
bajrangiexch9.com
-
cryptowhaledone.com
-
kai6agfw.com
-
silhouette-consult.com
-
vegane-adventskalender.info
-
6dianliu.com
-
virboss.online
-
mocmynghe.com
-
lilbimbi.com
-
dpsxsec.com
-
odnamyslowa.xyz
-
meetmedubai.com
-
rafke.online
-
unusual696.club
-
chathamwaste.com
-
yjaxx.com
-
eurostyl.net
-
krnlfree.com
-
urbandevelopers.net
-
k9surg.com
-
eazlabor.net
-
ttt-asia.com
-
12y0-blog.com
-
lktdjvbwepiw.mobi
Signatures
- Xloader Payload 2 IoCs
resource yara_rule behavioral2/memory/2208-148-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/3148-155-0x0000000000A10000-0x0000000000A39000-memory.dmp xloader - Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 3380 set thread context of 2208 3380 LfePS4pubczviio.exe 97 PID 2208 set thread context of 2724 2208 LfePS4pubczviio.exe 50 PID 3148 set thread context of 2724 3148 rundll32.exe 50 - Drops file in Windows directory 62 IoCs
description ioc Process File opened for modification C:\Windows\SoftwareDistribution\Download\ca4af4339884f7018bf988ecac7702ff\BIT91C3.tmp svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\d341f4322500ef92547a141039af2d20\o\egfDu3QHOC\BITDAE9.tmp svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\17087e6e4710e63df4fcd8834f70bc99\pj5OoD7hJ+dBGy+3XOjLT8WsuYwervv\LZOCjtiHKk8= svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\17087e6e4710e63df4fcd8834f70bc99\a3f602ea4d534d006919a2613d91f9506b383314 svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\d1d4bb0c910695f4fcf53d8f91faafa7\Jda7di8befpfPWz3DrhkMwwJL9XbuL8\BITAD40.tmp svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\d60cb501610b6a66743c55eade3ef996\BIT42C9.tmp svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\9d6172fa1dc41a48846593219fc6519f\BIT650E.tmp svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\ca4af4339884f7018bf988ecac7702ff\612ad442b8740f4c57b8c84e6bf465ba4699118c svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\d60cb501610b6a66743c55eade3ef996\CsA9z1\SlUHUPO8bKnA\5ondRmJ90JlkPETuN535TWk= svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\7752a73587b3362d505a041fe7f69ecd\BIT981D.tmp svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\7752a73587b3362d505a041fe7f69ecd\F2WKV54ysEMEW9U+EfiUeJcNcgfNL4pMC5NmE0a3mAg= svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\2ef09e08315a593ec3af8ec57ab6a31e\BITAE0C.tmp svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\26794b1631618c81e2caec277357b370\BITCA49.tmp svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\26794b1631618c81e2caec277357b370\BITCB05.tmp svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\9d6172fa1dc41a48846593219fc6519f\Cmn5TH6S2lFFnfMN8MLr2EoNUIAGzQo2UUjHGMEC99A= svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\9d6172fa1dc41a48846593219fc6519f\BIT4337.tmp svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\7752a73587b3362d505a041fe7f69ecd\BIT8E16.tmp svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\d341f4322500ef92547a141039af2d20\o\egfDu3QHOC\Xbfe7KpvVnvJHxQ2cRDBmUlnoMnpDY= svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\26794b1631618c81e2caec277357b370\BITBAA4.tmp svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\cb9f14b7916e97a31f1e53948ed1b67f\c3ca3df6b0660cc02fa0c60992eb1164c186b223 svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\cb9f14b7916e97a31f1e53948ed1b67f\BITC15F.tmp svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\d60cb501610b6a66743c55eade3ef996\CsA9z1\SlUHUPO8bKnA\BIT4B29.tmp svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\26794b1631618c81e2caec277357b370\daNJ9YVgpN191GzoPynRDpTEDO9uUytOK6Ln7xcN8To= svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\d341f4322500ef92547a141039af2d20\BITD393.tmp svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\d341f4322500ef92547a141039af2d20\o\egfDu3QHOC\BITD4AD.tmp svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\d1d4bb0c910695f4fcf53d8f91faafa7\Jda7di8befpfPWz3DrhkMwwJL9XbuL8\fDFnweOZvFE= svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\2ef09e08315a593ec3af8ec57ab6a31e\6e15245aed25ee83b027521f9cf9ea812c9d016d svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\2ef09e08315a593ec3af8ec57ab6a31e\YZBnsYBVNBTl3Isrrjy7P0\BITB300.tmp svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\d341f4322500ef92547a141039af2d20\o\egfDu3QHOC\BITD2B7.tmp svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\d341f4322500ef92547a141039af2d20\2cd32031792245e69c7777193005916861cbbe94 svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\d60cb501610b6a66743c55eade3ef996\f3535a3b47819a04c6d5ee18905493be086e801e svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\17087e6e4710e63df4fcd8834f70bc99\BIT4637.tmp svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\d1d4bb0c910695f4fcf53d8f91faafa7\d9f2a302574bf135efc9dbd1a8083a336f7f52f0 svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\2ef09e08315a593ec3af8ec57ab6a31e\BITB3AD.tmp svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\ca4af4339884f7018bf988ecac7702ff\9+dL4Puh6FM8puPxsBEX86BMeGqpuC0b7gf2fD9DLLo= svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\2ef09e08315a593ec3af8ec57ab6a31e\YZBnsYBVNBTl3Isrrjy7P0\FTTOLXxEZk0li+ZNE2Uo= svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\d1d4bb0c910695f4fcf53d8f91faafa7\BITAE1D.tmp svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\7752a73587b3362d505a041fe7f69ecd\af66e12c1bb9d8519da21259d0fcd88c247cb4f1 svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\d1d4bb0c910695f4fcf53d8f91faafa7\BITAA22.tmp svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\26794b1631618c81e2caec277357b370\BITBB33.tmp svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\26794b1631618c81e2caec277357b370\fbaaae7103d0f0a1303a40d280aa18bafcd08dcf svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\9d6172fa1dc41a48846593219fc6519f\BIT419E.tmp svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\9d6172fa1dc41a48846593219fc6519f\e1a85885fd4453165061351651289cce8f8590c4 svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\17087e6e4710e63df4fcd8834f70bc99\BIT4E59.tmp svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\d60cb501610b6a66743c55eade3ef996\BIT4BD6.tmp svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\cb9f14b7916e97a31f1e53948ed1b67f\BITBB12.tmp svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\cb9f14b7916e97a31f1e53948ed1b67f\6\BITB9A9.tmp svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\cb9f14b7916e97a31f1e53948ed1b67f\6\v9GXr9MSfUt92b0dEpOsHH2H0TwcnvKmtIW8g3ovM= svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\cb9f14b7916e97a31f1e53948ed1b67f\6\BITC073.tmp svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\d341f4322500ef92547a141039af2d20\BITDB77.tmp svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\d60cb501610b6a66743c55eade3ef996\CsA9z1\SlUHUPO8bKnA\BIT422B.tmp svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\17087e6e4710e63df4fcd8834f70bc99\pj5OoD7hJ+dBGy+3XOjLT8WsuYwervv\BIT454B.tmp svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\ca4af4339884f7018bf988ecac7702ff\BIT8D89.tmp svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\7752a73587b3362d505a041fe7f69ecd\BIT8F31.tmp svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\ca4af4339884f7018bf988ecac7702ff\BIT9154.tmp svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\7752a73587b3362d505a041fe7f69ecd\BIT9F13.tmp svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\d1d4bb0c910695f4fcf53d8f91faafa7\Jda7di8befpfPWz3DrhkMwwJL9XbuL8\BITA84B.tmp svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\2ef09e08315a593ec3af8ec57ab6a31e\YZBnsYBVNBTl3Isrrjy7P0\BITA985.tmp svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\d341f4322500ef92547a141039af2d20\BITD53B.tmp svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\17087e6e4710e63df4fcd8834f70bc99\pj5OoD7hJ+dBGy+3XOjLT8WsuYwervv\BIT4D8D.tmp svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\9d6172fa1dc41a48846593219fc6519f\BIT76D2.tmp svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\ca4af4339884f7018bf988ecac7702ff\BIT8CEB.tmp svchost.exe - Modifies data under HKEY_USERS 7 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\IdentityCRL\Immersive\production\Token\{D6D5A677-0872-4AB0-9442-BB792FCE85C5} svchost.exe Set value (data) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\{D6D5A677-0872-4AB0-9442-BB792FCE85C5}\DeviceTicket = 0100000001000000d08c9ddf0115d1118c7a00c04fc297eb01000000d79ef4adb8e2df4e96c16fb9ef12577e00000000020000000000106600000001000020000000d90244a43b6691c68cf2cbd7861db1e6915cff3dc44fa3782efbbf7cb781e592000000000e8000000002000020000000b81ca44e6c870e35b58ca53f2b9563217e72a011b724410e19633cb66f29ab57100d00004b22d858952c6ab3b6bae6f6d35afcffc336e4884f7664a92a51013e398a0a40fc935df9a02e7705f560a75d381186c8dcc425282daa8b20143e9f89e63b81d3a8ba1415debec6289db390dad324d27cc41e7ef04cd85753eb50f2d7b69c6d96bfe25328eb719cfe702e9263a0727efe35489d468e9fc975aaacd6ed7d437ac214fb091a6d78a9904426549f0b0ed921964281b5938ab9b3189f579618c18c8c26b351b3c26cf1515334c25255e68c1bf6c691605c5e4e58d6279fd1ed0b6879c715057be9e07a38cb82211bfb7effc5c9aec208a3cb22b54fa26e865ffb30662a930865cc2516fe6b22fd3b46ce4ae048e1ac107d7bf28e47d4ed2461b3aeb6d89a04344fce055fed46f3ad56c01c9484ac1ad62071835c75f0c4b44d73258a90e8e3839361cb0f4d0b9cb70bda7cb3643ca486228d56b81cd9f55acc3d163b66ef3f7d3899c71d484fb3a248ea19e4a8d5041124dc8b74e895f9c87a7ed0c5a224bc703d0e115af2c139d3501d946b3c0b7e95f5f73fbd621b034b1991f44bedc966b6158f8303e64b52628f076b7613bb4cf36e497cba70cca13aab61b7654a98aa9d201e083b8ceb0ebdcb25293fbaaf1f9ecdffd0ff59db0fde2777e7da557f0a09e904f94c743987789dd4483f96f53e78b58e93fcf75381d263b0b8b1c16358eacd47ceea407230dd2fc26568ac7c8122fa3ec055d9a070a99601a60db3c7085a218538d4bea933700060acad1a8f4a2e23d420726554da0a4df3175c24de014d4d93631196d544e23167f127d07a2e4054903794f25e935826e7bfee24eefb033f36b3ec7ec07e8ac0625f562a2b7d4a5f6a94e7ebdebebdfab05cc9bdf9b912094a039fc9d5f440613b8e5ccb88622866a89f72eef82e2a4ea540918eb7fc8da98ec4050684f476672e736db8ee5f0e1d1a02e8def9a7668bfd085addaa43ad4d1d3f5aa76ecca1fec2518e1217031785579736414c55d67bb6ba9f9d423aab9a8c1c3cc0b4d4d9e31931bfbbddf66f03d1030fed675bf1519bd4cab45586037a53439d32e0135e51c559e8caf1e3de88de8f25ed53875746cef5a4ae799eb71cb8fc9ecbf22d3e89aa58caa3f0bf415b574909676960dbaa1ad39851cdb859ae68f66be6228580a5417d5e65d804681c0beaf3ba305bcf593c39b9628b9ad4b371fb1b3d9b3d4c3d47fdd809db6becfe1e11b6a417703532bc6c693d84675851d31a2c2005f1edd01fadbe364031e3cbba366738172fc85ab1f5846d63708197ac20297ccb339ce55f4230849df6b7e8859ca4fe50cc78f69d31e97ae0797429ec3df28a0e07c03796b23219f3fa8074ea5ec130faa7719a6704a3bf219ffa27596adbeb5f2fc78352f8f420c5f16750b42f6564f2f878e057c19033a0451d13d663c66737480b58d4bb220f9d8ac9bce217fc6f75fa248552f4b03d2507e259e470a0b4955ee63e30496704558b8870f621b84ef30bf49b1cbf911ebc71ded2df8f0e8b433f045b5b02ff593c647aa65a27df5acbd3b97ebac5e32e1380947a58eb6ab38be1bd3259e65ec38098644530f9f7b446c8f0a3dc9b2286d7a4fa9bacb654f1c158ac18e6b0ee2b8d4e2ee895394ad2da7ef1b397638df423d43a87977b05041ba6852530a79c340d1bac7e4b892ef24cf1de9d1d6643266ba2763234f2b48b58543f4f23f371d77113e403f75dec2a3c2acf20a325e15a51d2f44787e5bbf95a9c9d032f0ad53bd3466b88720ff85a0983be5797f494daaf9366435718e6553da2aae5945c7f293a23be28119b5e1bb94ff1c08a27c28109a55af727520ddf87dedd5d8e7aaeba9dc20ebdbaacdc5b2f32658849a1e9face11e0e3bb88b3a5b7215df53642a8478da20bec7dc7ebf278670e49be75af4809beaccd320757aa47ebf7ec627a69ba35690ae21e8983bcdd62a8011f3b1f9859aef55a3631036d161e9190b5bcb382478cb87bd5f6d0a56b2c46cd92a005e0a5920ea3453ec19b73cdee1a1df1e5938dee9af7e9607d7902215dd9d306db07ac70a2b77af5884064ae61d3404d46b18844049df1ff7ba8e85c7ac2577c8adc906767e44ec6ace1e202ecb091a52135592fa4de572d606e1af8cbf012786858ac12984dd1b1a625c0142cfcd808b15ee2562572f4da978e85b0ce7a63d96280b7afa5c98eac43e42b12db89800544ccef1531d70a8ff08a94ba817e144f355604b51de3ef4097a2c70d9aa2bc1d1cabc50b1c6f9b1da396d8023cb3fc6d7bd66be9364ab8ce5fa1b62705e4e1d424d9deb59f3e0163477d3cc8b52828b561aade0e4b98816961e6d9647d9253a64bfccd8fa29a03c52e40bbb51e5c5b87ddd440d4896c4fa9fb1baf9cb91d69894639b579bd4098564d4f62f669b2a8a3042b1b570096300552789575d3d78cb57426b2d35488c55ab75c8786dbaf555d6a0bdc0413df8d9d91b4e2a6267fcce7c44df0d685902d8637465dfe5623fe815c5e7851e2d153c43452ad9ae0c0a9a82e691aadcb2ac0b5773f467f08664c52284bf119cfbd84121e424886e1a7bc7275321508d8d6660bfc019dbcdb67442bb1399b6c06c5527ac4449eb4ecdb4e406b1c2d3f8cb3a7f631ae1c02e625757e2a3bf39386e5496b2dd55633c0c38706401a9acc93ac1bc06c9207a971702977a24f4780f4e734eaca501eff843e5b3417f80843f739ca22592674186349213619caed5b183f5b35e8f3d534a3609e01a45f3e68c0723195bf13612b9b11c0169d5289f8fd88c63ce29ecd292b88690b8d8052ac9a7b5a45aa5d5592f792d7bbf15c51bd19f99b0aa4cab2dce8376a9372a9fe6dfa7dca76dde4d0a7fdf70be092db14f411c0990e9c50236e48387585ec2b71334a03358b31c7e223db853a199ebbf745d7e9c4bdb14a8b354ef67ec81e96068c6548f38f263818cf17de8f1856cde412bb4d788247a42973f3a8943f3ebc2f18570772315ccf8740cd7419e41627024d4886851efb7a8d852cb341bd518cd19d15544a807d0a7c4d8a6863e6085a9e300dcb0b748947ca4825c280250df3fd4b0ed3997d8bda226721c0eefd2b2ab60cabce3f7128ca80e6b7cda1c0e7cc42d48dc9278d4ca8cb2e9ce71996388a88326ce0c9434a1246668982a1b5f31b945be513e977e82f5fd8e5738efeedfec205fc9afbd9658536512bde94aa4a248320a8c35d4ff714d734f556a40a832e4dd2f5c6625b728cdf67b76e40e38879fa51a46026e15cc5a13ec84cf1f4ae05178ba9d716132292c4e356949acf5dbca957881acf8023d51603d4b3de336a4e6c4812c97c3cbc1c36c336d4f6910c216b296a77c2cd432916c30d0a10d9af511885d4a702182c7f06e0e1150becaa50b8580e750f07cfc61cc38f05fc753c25b7f6a01a572fb6fefd2f05e8895c86741f0b3b9ee7521cb80e98a464f3852e16df908d8da1c85cb460292d15523ba0c0ba457da20a64cc7fc38b5762881a2d99e5c08197085572d5d9cf83a1bff3a015a9ae8ae556e3b861c31d048922ef8ed19d422921634b194408bf45e6368584b2b330d3e69d482e6782ea098b031b5d6cc7f96145fa85bacd582d124bfdf910b22d238abc0c74c7de36d473ebaad8cf9ff4ef4b7c6b1fe9d4e831ad5844ea3e4fff2046f33b1d81e0a670a8affa9725c6f9c206957c48a16231c8ade5e071fb974135ecc56e2c1426d254927f6bfbea8511460e969127012e83a7aab5628b281b0d4d0ca287117a0d33cd22a907f011a44a7ed4d671810b81e258d9441f4494ae5749beaf34bbd69a8199b11232b89583cd687bfe9b37e03a1e2a6f05b25e3710ebf4ee3ce53294dea3c8cab2c23bacd0e49392088512f4afa1e882bb33589fc754a61d0533fc9de69b87aa1b12dcea5cd9da37df0ffd3f43feaff3ceaa55117a57593643fc5f6103094378ece857535199cfa0b7dfc6330ac204b4aa465db8a375c09df3b608a49ffc234385d04df68adb47c6a072168e45ca8d83a8e260319c20663af686b28dc82397f55edfb6333d0fad47c2e44598be81d5fea77277b15ab95a2b29d734f2f42e5e23dae3f0f65635b6268b0109af32481c26b76b0d250714135495a7c83b66ab26428c73b6de1fff264d2afe3bda1d1c15f66a34c173dab7e232013917697c54b78a09101cec71e61fea266f17ddd5aa8abed6938c2e7a5c944155e7ccd87845b3967e6d488f62246ad93f61bda8b50b53e6e3d0657f9609a601cf090b997c644fb956e3225dd0e53098cf8d2c7d2e673e2d434957edcb4d4d1d42e17d34aaa6b3e1a62b12d1cd155a773484570a187290f0c676289a2d0980c00203ad54e881090e30246f70a67e38846d6e2234037f2998bf511d33f8d02e008f7ae6f62c5944fa7f69cf8b5cf84b4daae71e9e584ee4ccbab3db0241e1348f4fc6180e0816fc2b8c4a50711bf776d0f6c019e7f5187859faec2ec134da5d2ca371c116385d6c949bebddeb86565db6bca84fdbe03cf8a0301535d1e9dfe204767e49991a07d140ec584ccf388573d939d2911d0b6b9d73f2a2364e0e9f8a62b3a590b0c1a1474daa553b9891d92f0408f6f967d7a289d9189264816afa1d12527896a72bd3c255d2132df4611057086f4964f87e4fd5c12944b2e757ad4f3e0c119730042d261d1b5a8cc301a59658d880343151d0f2b71ca229cbd0ba454d135845acc7183782e2cf24be8c5ca02acef780ce5f7a4790d845653c40000000ee8b077faf457a53618fd5a0be7b5e88581e623784f803f174e47a8d60db8f0dd128f5c53b8804faa14eeaca82583209478e7dae1805cf2762fdcc9c1e8a3912 svchost.exe Set value (str) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\{D6D5A677-0872-4AB0-9442-BB792FCE85C5}\DeviceId = "001840065F806E6D" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\{D6D5A677-0872-4AB0-9442-BB792FCE85C5}\ApplicationFlags = "1" svchost.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections svchost.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\IdentityCRL\Immersive\production\Property svchost.exe Set value (data) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Property\001840065F806E6D = 0100000001000000d08c9ddf0115d1118c7a00c04fc297eb01000000d79ef4adb8e2df4e96c16fb9ef12577e00000000020000000000106600000001000020000000dc8f460b6d5edc75ca35577416ccfa5b037d57b3877f54b1515f6ec7805c6b18000000000e8000000002000020000000a3477e942a3920455f8463f7ed1372292fe1601f656deeab0e53a86416c3749480000000ea550f7846966b8544aeccec64bca977ac8b477166106e6c0375e992021e362c10758a55102a08beb4313fc943b79edd5a082d33557f496f17552ebf8edad375c19c3ee9e91456caa31dbc0494a151cd3c7473485c7f3dacecb1c853c6e601b84d4e88fda3d6e9576ede321b4b2db8d135471d949613450a6d1fff515598933240000000f592c23d70913b8f52557ebe81a01630b77b4cdc9a5de60795bf2174aaaa86410c074d3dbfeae8498ebe57b1b374562b5117562c7ac3d0fbcc0e09516418571f svchost.exe - Modifies registry class 3 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ Explorer.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ Explorer.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Explorer.EXE - Suspicious behavior: EnumeratesProcesses 54 IoCs
pid Process 2208 LfePS4pubczviio.exe 2208 LfePS4pubczviio.exe 2208 LfePS4pubczviio.exe 2208 LfePS4pubczviio.exe 2208 LfePS4pubczviio.exe 2208 LfePS4pubczviio.exe 3148 rundll32.exe 3148 rundll32.exe 3148 rundll32.exe 3148 rundll32.exe 3148 rundll32.exe 3148 rundll32.exe 3148 rundll32.exe 3148 rundll32.exe 3148 rundll32.exe 3148 rundll32.exe 3148 rundll32.exe 3148 rundll32.exe 3148 rundll32.exe 3148 rundll32.exe 3148 rundll32.exe 3148 rundll32.exe 3148 rundll32.exe 3148 rundll32.exe 3148 rundll32.exe 3148 rundll32.exe 3148 rundll32.exe 3148 rundll32.exe 3148 rundll32.exe 3148 rundll32.exe 3148 rundll32.exe 3148 rundll32.exe 3148 rundll32.exe 3148 rundll32.exe 3148 rundll32.exe 3148 rundll32.exe 3148 rundll32.exe 3148 rundll32.exe 3148 rundll32.exe 3148 rundll32.exe 3148 rundll32.exe 3148 rundll32.exe 3148 rundll32.exe 3148 rundll32.exe 3148 rundll32.exe 3148 rundll32.exe 3148 rundll32.exe 3148 rundll32.exe 3148 rundll32.exe 3148 rundll32.exe 3148 rundll32.exe 3148 rundll32.exe 3148 rundll32.exe 3148 rundll32.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2724 Explorer.EXE - Suspicious behavior: MapViewOfSection 5 IoCs
pid Process 2208 LfePS4pubczviio.exe 2208 LfePS4pubczviio.exe 2208 LfePS4pubczviio.exe 3148 rundll32.exe 3148 rundll32.exe - Suspicious use of AdjustPrivilegeToken 7 IoCs
description pid Process Token: SeDebugPrivilege 3380 LfePS4pubczviio.exe Token: SeDebugPrivilege 2208 LfePS4pubczviio.exe Token: SeDebugPrivilege 3148 rundll32.exe Token: SeShutdownPrivilege 2724 Explorer.EXE Token: SeCreatePagefilePrivilege 2724 Explorer.EXE Token: SeShutdownPrivilege 2724 Explorer.EXE Token: SeCreatePagefilePrivilege 2724 Explorer.EXE - Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 2724 Explorer.EXE 2724 Explorer.EXE 2724 Explorer.EXE 2724 Explorer.EXE - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3380 LfePS4pubczviio.exe - Suspicious use of UnmapMainImage 1 IoCs
pid Process 2724 Explorer.EXE - Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 3380 wrote to memory of 2208 3380 LfePS4pubczviio.exe 97 PID 3380 wrote to memory of 2208 3380 LfePS4pubczviio.exe 97 PID 3380 wrote to memory of 2208 3380 LfePS4pubczviio.exe 97 PID 3380 wrote to memory of 2208 3380 LfePS4pubczviio.exe 97 PID 3380 wrote to memory of 2208 3380 LfePS4pubczviio.exe 97 PID 3380 wrote to memory of 2208 3380 LfePS4pubczviio.exe 97 PID 2724 wrote to memory of 3148 2724 Explorer.EXE 98 PID 2724 wrote to memory of 3148 2724 Explorer.EXE 98 PID 2724 wrote to memory of 3148 2724 Explorer.EXE 98 PID 3148 wrote to memory of 1284 3148 rundll32.exe 99 PID 3148 wrote to memory of 1284 3148 rundll32.exe 99 PID 3148 wrote to memory of 1284 3148 rundll32.exe 99
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2724 -
C:\Users\Admin\AppData\Local\Temp\LfePS4pubczviio.exe"C:\Users\Admin\AppData\Local\Temp\LfePS4pubczviio.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3380 -
C:\Users\Admin\AppData\Local\Temp\LfePS4pubczviio.exe"{path}"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2208
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\SysWOW64\rundll32.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3148 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\LfePS4pubczviio.exe"3⤵PID:1284
-
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager1⤵
- Modifies data under HKEY_USERS
PID:980
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s BITS1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:1444