Analysis
- max time kernel
154s - max time network
159s - platform
windows10-2004_x64 - resource
win10v2004-20220310-en - submitted
22/03/2022, 13:05
Static task
static1
Behavioral task
behavioral1
Sample
907a1b434c45f4dbbf6987ca34bfb3a6a99fe7ab7333ab7cae57ab04e1e9eb22.dll
Resource
win7-20220310-en
windows7_x64
0 signatures
0 seconds
General
- Target 907a1b434c45f4dbbf6987ca34bfb3a6a99fe7ab7333ab7cae57ab04e1e9eb22.dll
- Size 1004KB
- Sample220322-qblygafch2
- SHA256 907a1b434c45f4dbbf6987ca34bfb3a6a99fe7ab7333ab7cae57ab04e1e9eb22
- MD5 01bdf6fea597acc1b500dab09a2671ff
- SHA1 e8ea550ae28e3146adc3a56d6be7a44e666937c3
- SHA512 8f1a6fa66678af28ce46ad7549046d2a6228fea39c255888617f66f792b3f8e42606d9952fb1a6d3635b3bea9d4520caac03b8cd4955dd0545ea2832674ec94a
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
emotet
Botnet
-
Epoch5
C2
-
168.119.39.118:443
-
185.168.130.138:443
-
168.197.250.14:80
-
195.77.239.39:8080
-
68.183.93.250:443
-
185.184.25.78:8080
-
118.98.72.86:443
-
78.47.204.80:443
-
159.69.237.188:443
-
61.7.231.226:443
-
103.41.204.169:8080
-
207.148.81.119:8080
-
85.214.67.203:8080
-
190.90.233.66:443
-
191.252.103.16:80
-
93.104.209.107:8080
-
194.9.172.107:8080
-
66.42.57.149:443
-
59.148.253.194:443
-
62.171.178.147:8080
-
139.196.72.155:8080
-
198.199.98.78:8080
-
185.148.168.15:8080
-
195.154.146.35:443
-
104.131.62.48:8080
-
37.44.244.177:8080
-
217.182.143.207:443
-
54.38.242.185:443
-
185.148.168.220:8080
-
203.153.216.46:443
-
87.106.97.83:7080
-
78.46.73.125:443
-
54.37.106.167:8080
-
37.59.209.141:8080
-
54.37.228.122:443
-
61.7.231.229:443
-
45.71.195.104:8080
-
116.124.128.206:8080
-
128.199.192.135:8080
-
210.57.209.142:8080
eck1.plain
ecs1.plain
Signatures
- Drops file in Windows directory 13 IoCs
description ioc Process File opened for modification C:\Windows\SoftwareDistribution\Download\d60cb501610b6a66743c55eade3ef996\CsA9z1\SlUHUPO8bKnA\BIT43E.tmp svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\d60cb501610b6a66743c55eade3ef996\BIT53A.tmp svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\17087e6e4710e63df4fcd8834f70bc99\BIT8D6.tmp svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\17087e6e4710e63df4fcd8834f70bc99\a3f602ea4d534d006919a2613d91f9506b383314 svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\9d6172fa1dc41a48846593219fc6519f\BIT2E5.tmp svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\d60cb501610b6a66743c55eade3ef996\CsA9z1\SlUHUPO8bKnA\5ondRmJ90JlkPETuN535TWk= svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\9d6172fa1dc41a48846593219fc6519f\BIT4DB.tmp svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\9d6172fa1dc41a48846593219fc6519f\e1a85885fd4453165061351651289cce8f8590c4 svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\d60cb501610b6a66743c55eade3ef996\f3535a3b47819a04c6d5ee18905493be086e801e svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\17087e6e4710e63df4fcd8834f70bc99\pj5OoD7hJ+dBGy+3XOjLT8WsuYwervv\BIT693.tmp svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\17087e6e4710e63df4fcd8834f70bc99\pj5OoD7hJ+dBGy+3XOjLT8WsuYwervv\LZOCjtiHKk8= svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\9d6172fa1dc41a48846593219fc6519f\BIT5205.tmp svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\9d6172fa1dc41a48846593219fc6519f\Cmn5TH6S2lFFnfMN8MLr2EoNUIAGzQo2UUjHGMEC99A= svchost.exe - Modifies data under HKEY_USERS 8 IoCs
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\{D6D5A677-0872-4AB0-9442-BB792FCE85C5}\DeviceTicket = 0100000001000000d08c9ddf0115d1118c7a00c04fc297eb01000000d79ef4adb8e2df4e96c16fb9ef12577e00000000020000000000106600000001000020000000ed9cf38496276e499c7e4388b6f4679d5c818cc5fbef59aba5586287fc37d330000000000e8000000002000020000000f0f639ea93e48540e129f9f6a6101562bb1faf68544c2f860ae8de71b6f2979e100d0000a3aab7c1daeaf73590070dff6f97c8e938df4d7a8c7973a367a46a27c9f3afce4a834fa0cb036bc7b5790ce01f39a6881c7cb22b13dd81b5e79d0c1695ed1f1b867151b233bb36ae48f1f5d66eec188e55902025e0ff3c62a03b040e247c96f46541bfbd9acb4b145c5b51a1b6bdd5cb496148a7802348ad6db8bc217ca18f3773c41a638ea9fbc3badc3d36549c8b8232ec80116ae68eca571db3fd45b09be00c678e6837e4705aa5e7114bb3e19db0f9c4367228865e956c9b05917daea538b0485a2bc18643a1d7e598622a6b6eede49d2208307f44e55142d3a55c388c6c7e16e14128368190553113306ceeada731b047bf56e9fc28df676de1920d2b3349c3fc95645d12a2a8575cb0db5c65ce0cd3532efebc9c853801755ea2d233bf226a392ff735f13fea3d9cd7090428645b065866424ad724bc69869811dfd6435653cde898c26f08b1e74168abf9fa9d313a899c3b1f7cb5940a50b1ba400b8758a369c6f39e07f2a52782d1dd3416c9042566463bdc5639e9c7b42676210958e25a0a0fb690f908010626a0f9ce465258ec3ff18345036ffab1116c90980f6455497834d96a195076a759e81c1f69d3d24d6b9b06bf5749fbab9d0278f3a16e8da8371e3b8b846a94d529177d0c7a327d5d655be99474b18e3d6e187e2f2899e8795e39d37a0d378aabf922655cc7160d047d3d16028f4a8cf58eaba5783954b2fe9b9c018998ba63bf06b7a29df35a238abd9a219767799ca930f5d09e61dc54b3ca4b30ba9d94bbd7f605ae7ad631a7c1e058b87c4bad13682c55e73c62a490a290039536a0374466c939e350c104bb8927245d5bc26ab133d3d581762d176f5d2aab39e8049e91716ab8f6f4f677e990ce732214df3a6cea2c3c1983fed950ea654bd1bc00e3cac69dbf4f963492b6c4cd502b38a2a33a6398c2022fad521c7897615effbbac910a9410c2f45eb2a064bad9b720408c8c3b43a3dd775a33580d787ddb93444ba669aa8fb0d8f1eb57953bfb23fb25e723a4247b2d74e580ab2e6b5b4f41a210a1a13e75fbba40e412ddbe12171f299bcf3183d0135632634562e1e499cf97d32b9afd6450b03712ef8a13b8856ea37f1950388d47d7365cc7ea0b1141d8bcce0c5f91c3c53dea46c6ed5d8960410ec6c3ebf0a38050a8841eb81900dc2f97df03033a03a54c1a5ef49755d62f91415a49a1510ea987c3f97c00313f35f65f3018ffff8d71af1f84fe7ca6ea5f61619102dddf14c6eca6521c41a467d24d8945c4e4bba486d66c6da13bff78778b30d0d823ac720bf28b4c7a27a1805026b503c075c7bac344202c09be9bb733a35b9544e6c41d06a8eca5a0dba4a3ce6f67b561f30e7fc0340e86806c6bf8c71114d720ce13161b1833fbc4893083a8e5e378981a541e99538aa9b2ede7e86f8d4409e9386368174426df3d0324c6d9beaa988c67f7070ceb921590b6b81b9998c8d2d5ef13ad0aba9af0ea45da48575f85ae01cdc539694273e4ffe7667d93c0f70d18028d05be28802c074abcceb1f622e309e33c15b698ba87bb1107f9d1f3849841095b9263169f68fc493b826f1b8c29e88c055b825b90bdf1ee2c769cbf08daa56af0209f1e28b2ebb83bcff8fff8cdd648395d4991eacce341bb19321e8344a46058b1f0c797cc1e2ff109d91d4ff9f29b7bbef20c8c56389a72370e9e1ce343c7dbee35c90c8b5ec9e1b03ee12cedceb1c18074491c99b624d5ca46f95b7676dca1f7c5ad5e7cfdaa9d09f94ec5cef532aa50b1db3c5eaf93bfeeb8f283a876088abd30f73bd461f705c60eaf42572e7a98bf6d315202b68a6c0989e4507fcf97b45df07bf33c4bbb7742f21e2e5de5ec82e96d6d6faca9f74cddcf4dd25d84a79fd7cfb293b98ecb510687d28ce625a20f16e3b30962980d0402dc3f1781e60089a37d11c8cf001e5a0759f839f67d882d1615f60a3477abb3dcc1d21fed87f31299492f99d573909ce853d2f8de8ceac0c8bdcbfdc18cc0347caa14e8364a41b555ac9599de33bfe24725284c68b5ecb80c926db1fa6d6a557ddda8ad73fe9306874e41cf5a1f02e3e1d229a6ba701421ba7e570fd9b71fccd215a5249b15ac8af3c2079fe475e7bff75a338a25d760c813c3b083901483a262ed8b50c9152f61501b6e2993a76228219737260eb5c5621525a93c5d29d63655f1bda1f6d987ee4cc7f6bf167bad0d13361b1fa4c0780db54dfb4437a3279ca1e840612297ffd61e3f8b4b313778c36f9c3837442f1118f0502b65a2b88bd8c1662063a1819cc37f0cb7a404c7f5359c5db644475260b0e77ee0fbf781fcbdd36ba20eaf8866019b5a02bdcdb7a450d4639a09c4e26fbb28fece360760135c955045846197bae8b5fcd13f19176e93b087049f0088ebba6c43e0303a3993f8c05bf5fda7a0a168b519a45f9370e7f469688b9dca3011279d855f4597768aaff47b88348774f9aad2261b2c82583c11d540d78ccd7e705cf8cb621935b250500b2e1300f7d11fac5f980f73dc8336760c02c85dd7d66fd3528f2b6e917fa502726ae6c46949118b2de0a92501bc7f2962eaee92405dee3429d867c3ca59f89dc80acfeb40db94a15ca005b53d1f095c7fa9b1ce61275a54c2a591f26462d7a4e4c0956913ab5937d1793a29f1aef79f288a4b986b1f451a1437beafef97feb777a7f12a5e3c85e9e4969b1b17ecb1930ede04763c28983125cf28430d585b760624765dc3d779df5850efd98f3dfc101099980b349abbad907ee2a9b6191aadf06fb92e5eb348ddf31ca9c7973f65309239f088d46812047dad0d43ba6a803190416803e57834a9dc9b6b8fde0954e94c18621b1eab618909833ff09d3ced59d5e34060c774020a5164141f25a06f75a4891463ed554e5006aec754dd442c27c9d7b7d7ec3ef820f1071c149155defa2891632220b769b544941afa9d433a3b3d4f32a32b00bae5ff319d30fe52995113644fe770cd6bb2aee2f0bb0fe46c950f59aca981a0210a2ab1007329ef48d06ef3e6563847d3d05e4e1813b864a74b99a62aad0d18c81fb64806e8f4425122b40e2e8d1b7cbb11f85b1ffdf1f37d0b70ca1f965eaa1cd2c2fd3a8558c1d0c70fb40666065291d073e46d7905f02c9a740885f73aa8cfb3ddb45aabd0721b06f53ace04a048c6c68e3ac25ef440328b691ba0f444e8f2c052f44d604c982e35ac63e90cff8ac96f32850812076c30c766efd2ded7a29847b493c5d3145294a7bfdb0ceb4805062ce14c33ef5814bdcb137d470f95f4c804f135dfb0b4aed125ababb4c28d74b08a607c17a0f404956788abc784ab9c6dff3fca96049a6c1c0b530b14e70e622ea95822f850f575769e64597d4781be834b4789c65589f4c454b485eb5b9884a16515e5d295570273e3a8ad5cd6b0aa621b6acecf904e4e36525415dc6e64269f4dae60829a7c28ff41734816299d0347e4c69dfe7e386aa24b6fa24256a2cb95f8240adbaa6c724911f01ca90eb922b70cd830fbe6112d8102feebc46fa159e4190944096a91bb65be1e839e24c9eb3788d90d149a68099870a20e7132a563d40287427a8e69a1bc2822f43f3bd18b199a5d402d6945207001a413a23e5b7dc6a4d18f29079a7d8ea4e8162699198461bd15cee1e61ad932638bfb7fa05bc2e65599c784d213d93da94b8a7a8b4f6f85a1c7368e59a348967075bf3eb4fd1e2c7ec4dbe74dd54fda0c7b666064ac5f7c082293e01cfd6510abfd7f645b4fb98fef9bd8a7c291f436a4c8062fe974eb21e18373ca71b975ea215ba1b13f530ad8458434df98fc9fa3eb27b82c2bfb22f1c4a022eaf2972883e39d210174949296278f466f679ec6ba612f53b18ab800dbe990b2d0a9392954737274ef81ec27d19491a5410bb468dceffe79c927290e6b227b92407ea316e195f9278434414d97d4cc904ea82f662dee58ee6be7d68950f9324b56747b3a2e7b65bbcd1b760ae63ec5f5c3f4348ec708dddb0be3e49abecf449777a8fde2f77d7952ec152e0accbb9c3fbd9edcc90cf97d0c507f6b8b54c02abbf9e475d7068754618a690118cbb2109f6bc3bda09fdc71ec4b1538f5a98deb562b90966455abb77e750782cee82631847860fdd61533a1f5af8a075f313aa52d902889dc08add864148c01f301fcf65d739d20098079735434a975e11d3203bc6da1274173ca2a3ea0f03fcba1cbe77a07a6fd9fa7e15b660561e310a2c73cb791d03c1e36d0985084d090456f5c4e3513c3de19c697249bfb929f3154918ee4b16cbf8abe39d072304af9ed415e4eba344963ca229f186fda0440e8451731484ca9dc832b28c11d1b758546647a9693430409acf0e21f9123dfa10e1fca293ae9cccb96c92485b1f1b094c6e15dfb1dc33d88fa3b102a732003b18ea8d8b2317ead44a6f381363a6f9b16e7b60ad9964a061c49018ba15b4ba3f299de6f30036226d585c75e133a594945fc0321d7b99bfe1d6ce922e79eaf9414bdc6600d07ff0bd69fd58b217c2b4cc7c4986e5da4b84c34608023c88a5759ddbca50789391507c5a8d31d20fad0adf5824734975a4a641ca0948f0242fcff0e824609d4dd7093b401a4926658d69e54391adf588aa9945a6e983187aefd2819b29fbc3f0191a6cabb141d85a4eec63d385e093224912b76b9add58618326ce48ba28296f5bdb7af3f7e665dbc836019480840a185537f1e40000000343669c67f01a0f265660fcfb835fb72c600bf66ca4fe1abf2b7592939525de7a8502cbd1ab8bbde4d0be061a9c9f32d658bed4bdc3d9ea125dd74133155b9ab svchost.exe Set value (str) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\{D6D5A677-0872-4AB0-9442-BB792FCE85C5}\DeviceId = "00184006609A9472" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\{D6D5A677-0872-4AB0-9442-BB792FCE85C5}\ApplicationFlags = "1" svchost.exe Set value (data) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Property\00184006609A9472 = 0100000001000000d08c9ddf0115d1118c7a00c04fc297eb01000000d79ef4adb8e2df4e96c16fb9ef12577e000000000200000000001066000000010000200000004f93405ec509730c2c0cbd969f6d392a60c99d290b97d0fadb5f172e239b724a000000000e80000000020000200000002c70ad9ce468b6e0c9eeb863b33e8ceb6a0241fa8cf7cce172093aea041e3b0980000000aab5c81d781089848ae431345493094d01276427795442ad0769c3c6e8f1e7bc5925e1ee4fcc6761e95b36c7088b663aa1a58ceaf515b992352b879eaf149ff5c763808b98c4d0526fe349fe3974d8fcac355bdb7959dc301f2533cafac6dacafab2bb813eac66f9dc1fd03dc83fe8c541171ef7b84452e0346e8fed975e9d7e4000000073f509b42cf27c956c3f9e4b72eaf7b356ef60000bd10b12c9c2a51808449c07181b783c3ff4f00a6fcdf84387d68dd817eabfc92557286dfee7fc0d9edb4432 svchost.exe Set value (data) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\{D6D5A677-0872-4AB0-9442-BB792FCE85C5}\DeviceTicket = 0100000001000000d08c9ddf0115d1118c7a00c04fc297eb01000000d79ef4adb8e2df4e96c16fb9ef12577e0000000002000000000010660000000100002000000021db6dd9fe898f37b04919a5cae8370adb0b59fc265558fac63582ad5c1af8b1000000000e80000000020000200000006a63dc4097754ffc5e94d69cd3b1cd2ab138f9bec848710fb1c84fd4da6ea45f100d00007dc2fc1e508daca6ab49aafa48baf0ecf2589a7edf09fad152fc3f849778719f15c265493b080c8d41f0bf7ea78f031adc5617f8b1ce66f3ed3feb4dd55b52bafd7893e73645ef0ef6c2ccbb7c24e1df3337b42310a8f9c16e79507797d644a9e9a87e2fa922d8f387ac2f2d5e2a33317ccaf827f51020deeb14e7c1f39f1a7e71ccb509b09ae717905e1d696ef27adb084a9b2e991843085f7cdfce367979e35c935341de63bdd8df5aa8ab81619e861a80ed027473c8fa09ff0c3a4ca79a2c94690c4c79b59bb18a6f1e068d81610028052fbd278c9ad5e530f0ad4b5c9e667dcfb014cf10f350b1c3676abb6886a46fdd7ef4ef7ee29a913b32fde6a488fb8bd3dbe10f1331b065835259bb0330fcb2cb67b6443c57d1177d5998ae4f417a73a877693049f1cc4e09411d9cb9fb9290ea57bba11631af97d7b835dbe131cfbced392476d3045491e0ae1dcd9701de4228ba17a977c7ae349d0f0c3d397e41776a1d5b08dbde569f0e98b6e1c8018d8dd657e1acc16f30c902c634ff9eedac2e19eb7c7a3c226a0c1fb450a33d91eefda3d3d6c1c11389926d2fe8113530f89dbc4c8b2b58764ad1bfc4b0d2977a159d75e2043aeccc5afa1c44b9793c3cc9b9b42a106e37a34ab05ff56ac594b5ee55254c80533a78dba04e12ed843b61407dd0fb7e5e6fb5509b95edbbe1a3993bac54cef8d3ab027683d496bf5cfe1ef2d23f0bf7e168908cc025fc66c8eb5a8a65d6aa5370c0d5373894cefb182da913d8220a0e275ea6af54346eaa96ceb14a6e870782acac1fbfeb4f4086673a2838f9e6d803f6b3196e45652c43024aaab030b0882562e40597683d80d6d10f392593612d47b967895629e4871fdc840583e09165124fad2da89adf83eec6cf2683c8ba2f0d5e986065d5d111e0bcdfd2c1afb60e41855f075477c8e5510510f7b4de8a77499830c5f5a92852b18ecf8061735ad509e6f60be44b2f4fafa976cf6dfd6fffd18c7881b11e3a55235d41052cf6fd4856c2ac161e94479b7c8e0aa5053d52d1345760d53ee4c29bb796d66025304748e08549f3e3bf52c03989b917d5d5ebaebb2dd6ec9a8d68cc449c60470b0f0803baa5670fa68989f984a2f39a2dc155f31d5d4cc00f39a281efeecd829502c6c0b14ea8596fe25a5f2bd11f9ee741b1c6438c4345cb338d04fba533a1ba8c8a09db0be16644713591be1603d027d38a60a5ebb1f27fcd39a49aeb5208381ee7ade41f23c387d44f10bf14f1a9e811917a9f5aaf8cf410b56ea3e7e810d73c6c469a8c078e7261c630702d50f7836cf18fa4f289c16451e69e03fb563ffd9b38d5f266b1f7c2b3946b1bab7c1175cfcb8773cf4b9c907014349a0b7f6a0c9c6d105190abe0b2eac2165031eec967fa457f2f0a69fdf2e18b73539088a3794cf21451d41287317ed82b71a89721e61fbd5e81b4f3de9f4dd246f1214922c45b6f83a981c77bf5df6ce4f1d5df6b17808d2c0be3bc6ee704759c352e45e73a6be2a46d54440b8c87875cd9afb38304b33aed960302f2c5fabcd4568e6b1480ebfd2fc9b4b504c772aa701be671d9f7fa8a2f0e0aa66ba0419b414d9cdd337eceedb1f0e3220ca7ca2f55d5741c51ce7e259c1df4cdff153032d5811cfd40f4d6d637d0a777a2f7e42af9a48798617e4257d55962336405083e104b07806153200191a0c760c58bba9155ed22ad0c79162e3a1eaad8880cfda1b43cdaa43042eb674f510717c9a8d8488ad1e80e3f0356a6c27236da441d513ca27f4eac1e92e36c4bb9389dc1e2a92aa2c143ac8af7bf6beef138d5e75f7fe507ea318d7345699be1b12a40401e0f4f423a5861c2619a2e0fffd08aa8b542334aaa4cbd182fb11cbd72e529cb97fdd0e6050e6d4819982611ab9784e796142fb22212d3c825e7f1e14d51facaaebe5569ee9bf69b1783841667ffdd8039cf5fe1faea2d51f3b512f58292778853568e18a2d2f6961e415e63b8d8d6f0501b23f905812fb773b4ce3be1771e9c6f39ab1c6b98fecbbc4f3e7d2f12f736db321a91f3f08d53c7360af376d60703b1f83c0aa74e81a60e6161080b99a7ebc959fd928b1bdf186ecd2ef194e4ab6df7f1a9b5691536aa767a0df12ad0100a854c50b061771e47b6b8f9bc6cb44c1ed83430d4fec22f974582ee9321ba80df38405805c953cc5ab7de087ef7eb259d219e93c6c1395917831edd0ddbce8136205484abd5414f4a41bd4693b0e71b5b6334112fcb0b2e924b297be986d737f03965e05c616b436ad87c3b1cf9d8c9b53ad630184e0d16da0d506c1b819e6ec26cab62dedb79a35455e87ec6a0e5940f90cbe0e2945c6e4c40f8fed1cb397049d10e3052d8e28c2d822d1e6af79a65489990ccb75204d529dac19e2e3fc343ebe00b1c87533c5bbabf8c34bbfb73000a1a6cc6fab89333e2e5e6a002037dbc766cc6f83bd36e4d1fc992fe4ea1e8c038b200551f99bc573022b62f79a0b5612a6546be1680a45d9a93b727d3246ed8c9e2cf340aca3ee161af61acb19d5e9fae01a410d251b7bb3e5a75b439a8daa9d863e3d4f3a957a744fd794c1b50a1cbd3a307a7a47f77ddf12a14c7b5882fdfde127e48e0330f50c92185e3e8482c1e19996af1bbb17ee0d1cd5d94728740a4792376303d5ca4373b5a0fd1c13eb0fd071f6bc203597f0a632ffbf44c8b61a3fb8ce1d37a89ec64e6df804ab0e6724920864a90150ec4a9d698a5ff4bd601167cd8e60dc1e38995aac2949bd63a1df9913a61c9c6ae4b27744b420b82ba35a53eba19d02edf9350152027b351958653c3607c7481476c33133a5445f1901513adc88f1b9482985988ab6005f312ec2c9fc244d0c22e9b12776d210a743a8a5cc9dab03ead2fd02950ca6ae391e498641e71d68cc1fa1359e39bd784da0873657ecf750e244a413714447acbfb396db5e8572148b98362480fba605c1992133b94cf5bc8feb163b7662a621c528949d0c36428dcd350a3fb49890e9b7f26c0ffad059c0b533f2811ad3e4c0ab6a1fdd8a9f38ab26c7b475d8b87cbeedecea6f516ce9488bee0c175c6ed10c664e7aa911179cc2070bc5190a4cef654a14e2679645b1ac90a4242e8853353c442ca676d331dfdd2407f767a97cdd9454f949ffaf63dda365ff182df64744555a97018603fa9577001232f9360e5bfdc2ab0b935dd32e16e9c48e77c7b30362cd8458f7c2dcb152ae4362d55d747b91eb543201b4d5162c5cdcd39654ceda402ce891e0222ada05543917b8a4876f2621b4094b89b402518a367bad0d39d01a65024bfb0203dbc789dcf1fc307f3b6e05b18aa6366a6822eebdd12b65b8b8acf4e695367ab1443afeb9e288d28587b5fce5f71c2235098f874496d64bd2e40f27ce52ac5249e01e23652ecdfa13fc14a5c764c3cb856b4dd35881e0aad04846b55dd9527d1f61b7cd79d8437b64078cdd23dd55ce27b70f32f055c4b99cc1fcfec0255f7be07bbc463d2e17df03656c07c3f5bc65c1670fa759ae30eb133aac772784b3aba794cbdf57e23e01de3f9a25da02081b85d5ad7ccf84cce5a1872038920b71fe7ffeb649b8a24ec2d4b01d58e21d878efc8112e18f609e9608d7749fceb4199a5b2b5f94f7fc187598905e6d8d37d165331d403d5413439c3fd30b2aa266b5c4916bb41dfdf8c937a3763acfdba602a6f8cb6f801bec749b12897bf324eb78e920139d51584ad8da3768e57a130e37293eeb225ec18e84e6e0d5cfd494a600ec1ea8477f8e338424d04f24158058c6c991657776aab83df70eb48593a539184bf9fc18f75fb45538b22fa8ab6981632141b9e054055b84096e04a9ac48d8dca476cbf79b157f410624689a312c39e6a45f9b693ad06c5ececa26e346198ea5160684bac6155a3c6c45648799e6b364173382897245fc3388d8c5eb6914c7db92873119852a374ccad8dde1e92560bab61e5014fb1133b64a96b8f9df136fa269f44e69b89e66885fb566f55b8e603f1d1eb9c108145d00c89c911681ee345d9f735d0198dc694dcadcb133d0faaa6da944a13ca5095cd54fe30eb16b735991ff8241d71b99b9244b09efd5050422da23f220f707728736bc12e33d80d3cf78b20fee69fa54d0af95fb639a96c510cbd2060242a5dec136f0e0548e362bda81618a10ecf982c1a4a3e1d7bc8869487a1a4f5c57a3aab77194035cc234e365a095599639935322ecd37b2eb6d42868f7d38603fdac694b6749b483b918c79894a97f7f7311f0b8eb83fa70294da0584a674a6745ab6a1bfb2c1a87509357bbf22ab8248be3c5052cafeeae66d9d775d14b06dbe7534ba5b314e7aaeb6a6eef39e199636c1ecf1a36ca9496cc1c7b0b62c598322f9ed7a08d2b60be6001b9be3f37d696b34c7fc5cf9cfb3007e5d5587acc1c69c0153a773598ba584817f0439d5b06e962a8fc937ad0d2498390937cd7c3259a548fc45f9294da1f44f99f1d3fee2b72e38c78cfa59fc1574ed8c4168e44f21f4cf0ccadc76cd3d475594c5cf3588218f45d5d9357ef7ab48c4546131fb9c29cfd05be38083abc367d2bdf432db0c4e2d75ac552a98dca6c1cdf507df5f3b5586d8704db030544c32297a707d3920975a8cdc40982c05cc0464ac0f4097d7a9f7e184d83df4da2da95fc508a0e5c52d150efef7fb3a29a93bd4156fd147a3bb0c7bceac227b1a248b8b9ee2175217da8e1880247579019a40000000dd423d4d51c65e9986d43f2ef14d4a14258bce2820413cb68973581c324152775a3c1bbd0ded0acf121ce277396d889cec90b3e2c0330a4751c927dfb64b8d76 svchost.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\IdentityCRL\Immersive\production\Property svchost.exe Set value (data) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Property\00184006609A9472 = 0100000001000000d08c9ddf0115d1118c7a00c04fc297eb01000000d79ef4adb8e2df4e96c16fb9ef12577e00000000020000000000106600000001000020000000e929274c31b5837cc908a5c122829f1ef7928848516427a3de713cada7d4883d000000000e800000000200002000000082673e4b0ec08189ebca7b7597b744895a9024f55361ed6c9ce971cf97dd133280000000a385111c15623aa3bc561dffc811c75f9c914be2df56fbdba0a138837388b9e7e2e2f74dd736a20335bdc65b825729605985fbf5696f91d84e2bb54ce334cffcecf08de918674e05df990a44e94815a38173aff65843013e92ea57e33806aba48a85628279f844aadb1e4f5cb2bc66745565aa296de8296a207176e62f9697904000000025fd0ddd1190ba09871150e8caddd2968fa9db2af5887d6bf8ab6a0c2ca2c3e990dce931cabc741f4926c1a6593e1b2a0f8875eb9b2bf86d4eaa0f8b156329aa svchost.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\IdentityCRL\Immersive\production\Token\{D6D5A677-0872-4AB0-9442-BB792FCE85C5} svchost.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4340 regsvr32.exe 4340 regsvr32.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4304 wrote to memory of 4340 4304 regsvr32.exe 82 PID 4304 wrote to memory of 4340 4304 regsvr32.exe 82 PID 4304 wrote to memory of 4340 4304 regsvr32.exe 82
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\907a1b434c45f4dbbf6987ca34bfb3a6a99fe7ab7333ab7cae57ab04e1e9eb22.dll1⤵
- Suspicious use of WriteProcessMemory
PID:4304 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\907a1b434c45f4dbbf6987ca34bfb3a6a99fe7ab7333ab7cae57ab04e1e9eb22.dll2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4340
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager1⤵
- Modifies data under HKEY_USERS
PID:1028
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s BITS1⤵
- Drops file in Windows directory
PID:2596