General
Target

bbe7f26bcc02ee60e972c1b094be7944146a53f886b249b3f977a8f871a22510.exe

Filesize

24KB

Completed

03-04-2022 04:44

Task

behavioral2

Score
10/10
MD5

0d9cdf4a04cbd4ad7d58d777f5cdd5cf

SHA1

3e4909844bfe19cd4a239052e3f4a043c915d269

SHA256

bbe7f26bcc02ee60e972c1b094be7944146a53f886b249b3f977a8f871a22510

SHA512

905cff6972682d02afad4c7decc680004f82ac1bdbef686a03414055dace8eaaf4a1c080af7afd8dffe61412046bdbf3e76cf77132a9afef5dfd47f6787e0e41

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\8E73FL5R\f[1].txt

Family

ryuk

Ransom Note
{"sodar_query_id":"7iVJYpTKA6CR9fgPo6icwAk","injector_basename":"sodar2","bg_hash_basename":"qK1_kiClR8859HLR2ZQEsar5twHbosMJ2VQOYA2yeqI","bg_binary":"BQWlSWReMJjt7UvgRlrkyWTOOYbkJJi1JNI649bDuI0AOCczd95WQyh+rZkBwRoaCKxJaH6EcuVbaTBzk+/EQfjiZzOiFzDqzAdVeQx6lv8M0Ku1WSrb81TJaIOWwPtxLQMI9KhjK7Nzbibv5xRnJUJPy1EbnvbQoBn2jPxaHeoMifFLDwoKZa1Z3khd8jqBI7AieTvzHNJv1KBFCNi/EADCZNVTo95/uZJXkKfSCNfuwg4ZHE7YIALCXx2BfWox4PbNmko976Td/5AAOriTxH5Kh9lVdEy6s4Oio16viJZ6Y9QDlLSQmeiCxFXjXBKs+Hj/dO4emrS/Ki46RZcTkpeEuP+leSFLFpdyRNtP3RaUj0O0ilaOtgSXHsVqouj0ZBl4Qvx1uKLm7Z06zY5N38D+2rX9GY/FWdieFadZIKqutN2MSXB5sgn9E3cVfARy0rTRGISdgdzE3JhQcMkmLhYuL9XwSQSgsn0SLbcYvSl1M6/mM+JqZa6GXALlOQK2Iuj9koctgzxEnOFu+E5BANvHky2H+8q33ceHcvjuFEzhlT1+GvdjE3+AALMTF0PrfStjUfwMgjVbIVBdjUii9tmVILnaM6DQ9Ub9rzVO48S+9RhMLPuMrySsv2f60D5UQu38UUqihe/nek1gkJDluMDYbfO2ImzebdgtQlt3l0qLIEJoaZujMt3rsAc/s5vmBu0f3LtFUttcUitAi0qggJhbbWMONPux/oQIwk0ObWSEti+rLablYkwTD2nkFpZmNIXsvIEM6/t4wDjSxXOalqf/Q0hpFjXMZb8D9AjdNjlVfweHCfnJKapTummRHnRMoQ96EGeDdzBNMO1JbSVTjutzcg9LYq0A//HpT88+dieCkv3cW+kD96dlLgan28Hji2jBLMs13nOtlK8r5oZ4y/Wq7ZIZ+ZngPd3ixqWmeIryzkRHrcrxR1ePQSSX/TKwLDFUBvU8KVJHC90Rgz6xZQAw6QXpx72NCatafPNKFQtNhckZehN+ubmmx64al/belGyd8iMWxNKTp4yCdFVQ8dWbtG94y89JJlZOXxR/FQ8hoZskqFAddyQFtB8Lo2h7LPJAu1botQ3y/JV0iOD0qudsO/3VbYVi+DImDyQZIT67n4vckbIV/iTXu7rG7P+qUgBZ1EnI6GUPCfCWviuU7rNz80m1bwwazxyii4FPYKGQjpIbSQJeGruCovhDPMgb+V+/KLuXZt9oNednQcDxYovaCxkNKXo4sMogh2creyx60KrMrP8cuu4O9t40YVLx1whF0sbQakc4GJCDqtDIOJw6P/YUXpyqUrmDC6wmH4Vc9Ca/dCORBP8FKB3smBWF8Y/ZDJ/KTF2+RAtGElHXVSVcpWFEJfYUnTJNGz5OSwS5gpXa7Ns7cHc+SRlrlVhriOGiMXB1EL+0tQT+xMwFQFoL76ogBH+E/+LkN3v/RdZMX00/AQYu6PCU0FxWzRNTFXNZ9oeb23MJml9wcZjHK8b7qPwbEr5B/S9n2zIEfH8vlCnS/kp45DqDdXTpW+ZqIfkQoqUs/iowgx29DncpbqOyBUdD0yFfurU7hVH4uxqkqpnXpxtVP5MewUf+KiZPI8ds5Xs1sd0/wnAbyYmnmm0c4VRyL9vXGaLIcGwhN4tvm0v82xH+F2+B4xaqEh4FirlTkjvIMNNt+wtHp1uM42mWQAh6nLCu+WLtY7erlNSsP3DCln/a/FdLSLKsDymUelA+8fVEhIhZmdTuAtUrapVnP6Q6k1FHlAGS+UbrMnL9A3em5JbF94Lqc5ezPYTPpk0TutKZZNkXg16n/1zFojD90YvhgJZsvMeyy6sT4QpAX5U/peHGCseHtd8sp7YwhmTQRYcGkF5J98v7/GBDsh3NuLrb2MF6w9l2RZAchv3Fx+cYZRgDsymcgZd1c4DMqqtwzr5sRrUjwwCFj5S0cl6m5HZQvypoYg0AVtVaQIFMEWPbLFQq1iBfaazP5XP7Hc03iUm/1mCOWlnKzfWxMUkMpLMGK4fa+lbn53hr3v8N/K+yATxTNCwBCibTuYQf2AijURf5nhTjIlfTc0lz9hvgxIafiBwelcCzdg/rP3Styk+S8nt5DYy99nDH62evxaLK4CeC1145HI+El9Or9dMjNMN/NJQftO6+Hu2e43i+HYWqQWZHcQ25b1KUZvjQBYMp3GCA4yXyo2gKhOEbXIVx0zw+gUiZhm5WK5Y1q/UPj+s4lDogw0W28QtyB/a0lLzjNvS3Gu8h6meUy/Q5NkIKhzvssqO+oTLIAfTLOJOHbv4oIg1zWU0/mcLX56y9iNgu9db4D2fhV3Kvx08zSFKvi4156TsHPeyGH4UYOX+yxqq4O7N4vohCZ+BR1HOqFVh0bg1+Rze4DOKegzhhkEKL59kYWTaobGacEqHpPRgRCZ6C7cDJ+UeeOufus6yw6iwei3MBkD/IjzVIq/VO5X4cHDsig6ilsaJq4j+dXA8AqwcwxKZwWcyz9qKP7+Kq+ymPBq0Vphmcv/0BQ1Z1OP4vDZAC9xBskrjFViEUqc+vu23jIm70PYpOwTAcMf2LEXt96YjgIiLOiZXGkCSnX8jI704+NDNrZ5i9TKLlYBpttr7Zn+xQ7UV4sN/0l36jp4TePD9dnVoRTuV6BvmQ8gnwrTnmF1ko361Lt5j9nEFrIf7Yl7G40cskgDzBmY/kN21Bp8pk/J1zPtWkWJD1D8ufNrYFMxMmRDdIQmEbeW5qrvlR6Nu9I86+uskbfHZtMGjI/HA2v1tyj4xJeITnT5qsUQs9QEH3nMkxQAvnAzQu17DPLYdjfJIv25f+ysV8eWASwq29fkhWIm2mFb2KxkBvGxQoXXGIRysuvdG4HpJkcQEU0PKCY9LlVqnQnf0H6flm57v0GPKrvCUvGVWnMWVyikytPtI/Km51saMLF/Tvo8PPlTcr9vMMeTA7alCo/cTkj9oEm5IDeBLQ2HD1ju/vcC6qQx1RcttgMwnP433vjDOvU+bXb7IMwdW8UvW94ZMHvMvE6ZAz6dSnXcmUqOSJqJhu9x84vkx4CbUzFr7qpBsNV153HIoVD44dRUub2hSbPSJZt6BGdWN7Mzs17xqtgnSp8ZUVP5fZ64GpHJK8+7huyA+SCN2mzTwzqFdO4xcdZuvnh6/bv9ZNu4rna45tbNOxtloo0ty/6XPqK6bR7VzGljYsHrsLedum6iqhzUOBUx5e9WzRDMQjB/Sj+6U91CAj1x7Xgo9dcGSl+hPWBuMYUn3rt0tgayMnAa5U9E1ceUH/Nqm2kA68TulKsRjlMfA1IfPAuGjRMlLrfcEmMB9F1H0bn33mcXxMEIRS4Fo6pAT7q1mSep3BVDxzCA4MQ7LhE3yy12FztKqcnabLL8f7RiUnFUc73I5TKShy0H3AkbW6ZoLQspNg7CPrY/AvAqoF5rhvXaGsFgKyRQTx9tUEPB3XuJyDbSW3CH25MnWk5rf1PX5GOKVlnJ/um+skundmaZcMHLyA7xrkLxv1/vVJgwaACd2mW+IHP7tV48tkQgy0PQBVLzL+Uk4oWhdm13plHJcDOxbusge2VqYOGEUWL81pd6ONSL+bwARn0+Dr+T32mVeWQegp3x8AreUfE4Pxy3/SVTsOdKlyYBrvFmjKUU97t77uNtUIV2bt6mChfQTfp2M+OGb4irff6WciF0O7VxxLWAcq8v/nfvUbBMt7grEKSPvnV4PzHPU0G33JJfdb4rOpip4i3VPtVCbaJvC6k/HPWeXHkzekkzl2O2zO9FyDEdsYrZD4DjINNjm4MJnlFPPLDJ7h0Yq+Z3AjDpUcy3HXhvK0JO0sH+S3jEvprKetLlVO4byT0AaQ0g6h6/KKrtBN2vw8XhLXZ9CcozRHNgk0q04Pi+6TI6dHh7/j9Ft571hY7NjubNsh4o8mPTFIoL6I2mrgkrAwmMi0QO+PfchsLqwDoeh/wcoWa1GOj5QJaJ4RE3keI/DhXp36O2z3YPW3PgbxWNWMMEna1mPpxvXiToMMsMGUypgQATlyCKWsAkSQ0yf5RixNbVY26sEkO6DJxojaqnEMLT1mIGQ7NcpYf+j26uB16JQvrjGt96BBCaD2aqeKlTUNabGBxpdQlclH4PuDVak1Dtfg6tWFHgqqcf6f/SZPl9FUpVMm03Ow9Dbeztl5jRCDqDpZNCfG2D6pAE4hlSiM/WKxRCyO0fsp70SpdNLu6yxLhzJdHa9JLlExEUlU54mEr9a5WLZE+OrUW4FvLuDRu33njhCiGSVA9ghL/qrh6k9rIrQkrH3KCIiNDCUj6JtDS0gx56qDLpmj0wgKwa30a32rAFHJWCxUtdWz1R0lXgkNEjgJ7yTt9FwnBfpLrcbu8lF2T+f70r3IXsaO3PHfh/yTO/OsPn31g1C9uystV6sM9DZTMf/LYCR4ueDlWjPzSDBFCiFd1G3Uyn7sVcwRxh9jlJU5A3NXeI4TAiZFAItLAAoXVqrVqQFrQF52ncdAsytSj1LRbCWsodpaWyq7KKqt2MY3q3RKt9tgfO8nmXrqLbuFPEKmj/V+P47gwgA6rvc63IlNhwIhBr0bsao0IPADISrFvO/0QjVOot5qjyU16VRV2tcFyG6kn53k26U0rVWRNQWhsSaDRvy+pIZqBBlggViK4p892ZAvRJtMKWFbinfQzhoZCi0v9cc2uQLbtGc3garzi2DLajW38lRjNOuLarLoExnzKvk/+IOd8UClMvZovC+vY5/0EPDXRCEyMCoZugrpEvRNUWR6YwAIDpx5o7tkGuxJOrr7iZUTvwX62j1DtUnIEibTLV3ggmTRDyhUdGysOJABTeWSl8viOX5MlvDzowYVtnI0VYnEwVoaoQanhyyl3fZVKVAWrTOYQ5pjFEnLZasnJS26XeIKOp/m8zipuHDeSTVaAbbUSJUQU0d/+KvXfgOSDPVRAyxV+lxRrpeG7z7W9C912Rgp67NwRassdBKUWbk0qJP9zgCQG1MrjecLQd3lhYTJyfa9n08Yaaaiw7a5r8P6XdIfIg19ErARDTySuHIYMKSd/1RYKjUmx0SpB0E763wfAID/CK3PC1shOdU07EwZwtVeqdWcLirMNZI/HQtz5aXDMnK7RPb6oLJ9n2U6TP0kQuG42g0kIl/iGDvZ3rgjo8HljU80NDmvhcA+DbLqxc0z60bO2D6AaZVv3VSGWZxz0uHxwbczL3rjb8j4TPZzYI+6cNw0bZjRNzKx7k4UAkBptOuJD04W8E7MFGBVp/W1eUUyzX2tP4BZ4HK2DbBc5ZO6RgYYowMBhxFtNMPUzpqb1NlDmi+dE7jzxrTcUX3IrjiSqjc6xxyLQpE5SBqmgoNKao+WOad+zG/py07CrwFj3//HqpFBez+TSNINVxJx08EVGFOgV2DAfLINQGkIS0pnUpjRG6Yly4Esa0lokDzKzsiQ9FiAsVOtSaSUHyWdNGnvrUPlMQMFhPDocbhj2iomVTv1PyqbBIp8bE2Ql7QR5v+SchrrJ4fvmU58dKIbLvuroeDvL/0tCHu+v+lG+RGd5rFqNog/0WyL4aoRfDnmPFeuOezv78VpHsMaGTi/wvgiL3V2wiNvnB4pNkY7ntCmd/9aXvq9RCz1uq1eG//tj8WkP3fjfFm7iCIAxLyMVfqR7zvS/jXJncTOE8pwFyRMuVPnrlscUg4uh90iS+j9DjJC4mAx3EK4WETmv11IK37Ph0cyEzCE6e2h76z/LGbmrzIWNW2/s49aN1Mqo5XoFyOKMoG32d2KVrn38a1ro9ezlxjkd46cZIaigCSvzrJKCSVw+Fm6QeYT+udtXIJRchDd7j3tcEOViIvcLZOE4dQQkD2DsHhKnF3QHo98hmEVnIDFgPrm5C93ZczWAEHiywJSdLK+wbzex/mih7ii0SIJlsByXsr1oVaVz38jM1Kiz8icgKFh5FA0LBtmNra8Xn9mj2yU54vV5XIYsdrsFpWsHPz0pQD/MuMgak8QLWyb3xkS/Z0alaxSBu+POzC/Vc//7KdOrX+3QFs5n0bWAprlztbPbgphJhcMoIv+3u83RXn5yD/FxoysmUpLYRzI8NLj/gKbDGiHkB1QeLqndlmRhbV6l2p55RyKZH2+erzzQxHUB9zWBywKLGsrmhZxJ9I/g/tvWiumXp6JSUUDM3Kjb/SjE6k+2LZWEmWpF+Z5JzmAIcGVmWYiqzvZWy3LlFcXNuBVhjuQwaE3Z0ITka4+hiTyKba6o0LYV6f7D4xmy4Bh1/oRZwgxn+ayCIuFOwPrQ+qUusX4Kx6bgXcCU+9YVHuDoD5NlpLAzraUPNX7pd58yyGZU4bxEmCYN/ff5kpFDOWJC/EBf8FDK49695VKFr85+QKpvmAEFjJC6Ep/bayHtdgKm+dxGktkIlfHzShdF2PJ7YCnDBT92tsjfoekCLI+1w9kFBlCMnVz9c3AwfMR8aStm1TZEwn236UK+EERwRiQGTFF5hPTdz4kmhzbfxTWn83j4nsiPhzqUYcZJHJKRd2ICvL3nFKsDnL8FXGtJurNlb0TfLQNGPfmkbm2V6fKKGcdXDlW2UBHYld+YyF5x53oclmaMXkyL5/3/fjUTzj3JlXkcze49Q/QWqRmQm0S01/FtSSk7tzcbS9M6Sx5rab9XTk29V6nwPbP0ozL6Aq4S3cXGPO57+Ed9a/t+Vv3AVPmIxV4JfFkx2GFsQqHXt0DxZr9ux8OgY/962wsa8rFd0j1NBFHSPOd9heWPWJ9+HgkZ+zbWHjTDeQhV9mh5pvymeWueqyMF73Zl+mnff7YwQF6LkS4LqIujVk7E4Gqe/K5IhJuEQrQ0tYxWpu1IbRB0kIZPUvs2aXHgUN+N7t8Y0jMmwsJ+2iUOB8bclZQshTOls2/lRLWCkL3wjl92EdWhamUmxASg/foXsYWjD1dMaI4U/lGu12GyE6/bm5tPzxE3/Gl6Rw0wmAIt3DwoLOg/XT0ewvSu8J1RRhSIhSZ97/RCjgORmkcXvkXqkhTZmrL6cYNi9ExD7ZkQAJSJQZi7Q5XQPkkxzeuAAn1ZovgCTKS9/ENcxVW0JHHFDS7WG/csYQIwuHhsbJfsopcdlb0lsDdvCdojmNLwWtcfaftsOeCzHSkZREyZ/jhnsldha1Rzmg1OG4BQHkHkJ3TqRXcl9ZzG83FBYBSrie0+KqnHVn6mI6qWDf6S8IKy32q9VSN4fA0W/aJwjM6scKjFL7j5aF7o3D8JptidjfHTAbId7cmeS28eRo2mJI+slP+QfOL4voz+6zLQMhKn6RnqWmyMw5OUm+SRF4zr/Gs24raosDKyD92NKuYVDAcVaNYYWOp/X70D8KHa9YlxqaJDVirqLzX6spQXPl/lIRxw4Ny5MHq94ID1JZs+i/fmc9iKn+2L2lnskzfuLqXHbftHiofuWnU+Zc2yY1o8+5XN3y5teVPqKYRwt+bc7A0wh6jZEmanCY7nRUWFlGvDD0yrd2iCiDfNHfj6LWD9ylc8/bR144EskfS4PnHjIhq2lNjzDZA4/IKLvhfIweRe8hoc65riJbgjwHR2HGBOlFDbNmOvREYxbg6iYnW+NsG6g4AAXJDQofWTUouDjLAJz2d6fSped07JV+YN1y0auKCZ50c9b260a+eTQIlPavh8tIsKzGroDSqcbqpaBVCOTQjKZGFj5W1qASpdzOFwF9RKNjj8kYJNi20pR6fi55wXqdlRzr3s2IZw2pqEVBl7W/0q/jzBCn4Fsfu94Bl79zl/P0ywgi1oudNO4kxcRe0Z/AozwZmJ6z9RNE8Jv3SQx1Vn4SX9VW21LcQZhxzWhPRdUqz2zfSrP2TRkwhLz3cFq8ZGdVvk9wmd6ThOnmZhx40QtLKj44bJwnnqsLNpfbEk62bwVVYOw2k5xXPO43DUMWfVpEeAxgQLtNgVYxBumyf/8/4W/We94wgSoOadaEN88ioX4N1Xr+rHiai/xQBI92dZGp7yWGMe4rtIEMJCMfz+dBG1ZCVdFoKb3FAYzTE0MwajG+XCqNEWFp8RHC2DaqLPl7K52n2qsQCXpM6IpluqYRv3pMWQ6DX3JudwEvWlVwyUwd0z2Hpo7U9laqGqPZRMoOPMjRi7oK19i2h9y6Bhlf1uRx4kGyVbmDOdN0h9k0gZPMQZblTZksktaIhIvUu+9Fxu/L40bW7nSASJqyQCy18PAktcCxtr+W09ZG0CVL2LmwUY5j6wsQUCJ7tLELlSXS+uK2XpWk2UBqMd08EIHwioLWq6HxquLT1ted37RjhOjBGLyjAbeoKkqdEvPgP1YxXidgj2iby4/keuHHswkXCdPVV2rlkAOtwswJLqQHemCzf7RJP4lKDakNJOYxXf2J8EoehLksCeYsj4zikdlRIgxiuoWpHmoy2m2kGPs7j4HZBQWpHL56Zk6H4bzRbVSujO1lBkPPYIZU5SpQLXhR00dRYzrpNAe34dfrw/vOVmzU3AGwmRgSr04jmLsXIi2xTPW4kfXpd8aJWFfzJS2Cwn/gvB3kQI+VmsBFbBRm0fjTMgNlWZ9aBS0gWe+VXjwDdPQHpnl3n/LY7epjIn3VTLQw2bmFUSGINNjBwXAO3CbIh/dU5WDisQ5CmG1aoZNi91HAL4K0isYsg5dBF4A25CUjtNm9+5XdueT5ws1f8vu74k2ONxv4M2NrJ/HcXHbpHKEPGDiu1PiGUNiHQMTlasqQVDMoSek5aG8YIpnjcZkbECRy0rkqEQCovmdxWeQXyTKA9/lFwmgax99YiWrgfh5T7kNNoYvjmlnlNbu9UTxd7rtJCz7kN7VqDYgCvY4Az4l93Od83qs/6m1ZK5Z7of6jxRC0FnZnQExJDUy83N6fVmMC8n1g/qdiebKrExoh1Xqrl77arDuID8s14JMNvztMiD3L6y9e7YQ77rzNwC3sd21v6nmLLRaI6R1+dXV9d2SkqpKecuNI360qBZdC5G/McPijk5ts7NYRATvAYy6R5Nu+PhzrcvCJioM+h1p+m7wAQholENwZFGry551XWp5DNxT5NUXjfn3UvnbXdrrSKNPjnfr3Rm4G0659Sbh6NzxIsywdzAFOKmA4g4JWBieW4GkBCwtX7dKkqv9P+AnibqRfyjqdI9hew8nyYQmjBnw5+GXpK6qWrYLjKrpy6t0AVeGVJ+hr6Pf7dxK+nc6lmN+PAz7pUO+bKstBBFbYMqyXslxIugP6KBGLUqj4LUH1yfwhM2gjQSAfb4GbHHCucbWM6lnsPPzn9R8581XBcYmZPzg2DsebOkJzFGMtniyPE+ez/drPxMgxg4S2uPMx1Id4ds6GgA0gJK6t9ewRXU1Fj9QTjjhuME5Bl/RfTUI1Q9t2qRtYIRZ9sf3z5skotbxwvlRBosB4DQEqkReQq6oaJaI9vazF5553lICH1eW9Tf9brgSOvIAYO79+3JKUGNeuMgkudxHc61Rri298GMoJVIkKGUw/T2u6NVp3reT1T+5IGR1LOTjWe2IjO20N9GZzLAUW0hDSPQnwn+6HEZCj4U6H5s8wnWAXbGt7fiS+j7esHIyEFk4UAkK9oI65n2wTOCNzYSQmH0dUDckKMCpVQ0gdRasAi1ykNBhKFVYmC9/h2B6lmCQ70AlEH1xFG4Hn8312QEUBspxjLR9ZgI8eSGvZ4XOZuDEex5Cdv76CnvtiO8riDvX898mFDH8ktePtFt4YlpRhYRUvoOk9xJjbBQCOj0TrzJU3umOe/Lc4SFeSp5rYEkvV1cyXNoGnaouwRwtdbMhL+TLkyHyTRpzrMQrzH/bIvxjTYipazP2oFrUj49SDKeF7O5wTaSFuWsGixfsNivuKTRo2YKD8tA4tBJgWimTh9M92BtFOQYMkvXP6FwPnOwI00Lbm/wZFQdSsPnFmrys7GwZjczImMQdJ2iWQP+BoLQIfOx9/M2nb0fYBoSbovG4yTWkgIev+XUkPwHTPdidhZ1zF+LYSzqz34urggyQvQSILrjWBbJIF85R8S252v9uSPVSza3BRehT9ghsgFtW+CTqMT5c3f+5jXA2vkp+ogEkXi/iEwr+OteTt70M1PQdAuCcalyrhgqmO5xnCuoeb3GV8Oa/b7FT6vGxwKnB1UkXv4jdYI9WJsEKdNMW5jKzObmDr10b9oeGObB3ER82QUvNJkU7jarXja30nPuqlL4CnlqY/K5byrpKKN9X7oSLN3lmN/0KTvtKBU9LWDp50BeQ6Wol3X3rAEqXVeNIQJSKxLpu17UILHwAXOwQvTdc3cXiFG/Y5u2fAzYANan7udNqBW/zI0mlNEn7+gHnnqIKusG1dJTJM50Hfz9aRccUZGfaZz7P1uiTj2C/BDXtenfS74nNgJdO0P6WE3JBJcw3gq3gYedZ7mPHiZ7Di9eR20O9TPx+893utDDfbp7q5znPuizXoSDTQ5MSLuYdlfev2fk3cgJHSLYpTFpwpSuGI6x3SdnS4RCmdRLHJNw6FZqBgqt5t13KoZ4ghxIR3PKMq1z7YKoUMtvolVdPMLywwxBDMeFbwJuq4ipgiGqSRN1DTLiXYG7I0z6dMjgL7k2yIf4OcsTX7zlpXsQT8jHw6hR+JAKBGmzAT815sbiDj0kxBiZj5GRDgn/67d+ssIuwZR3YqIgZN5dGaXgdoQf8IU2Ac7aWhk1jcy44j7YK6RDYhrwxhFetQ6CJYm9XRHPsDJbe80lRQGS4YwSwlL3lFD1Zb5fdz0Uz5nBGz82V3mqXvTt8ItpBFmBobicmIa8PXVCujRrBqyh9BjzgKPOjyStRug1q005v+WWtoZ00Bcn1/6Rv+TBc2Bx5jiZL9ElMDP9mnk7Q2BhAB+BoWxKBvjjk1UEN60f+2TiNUmDubWTc2CqKHDCwV2hEIs8PFlxge4On2h+S37ABJAaSxFf15fpTWQZzYJUSsz6h+NtyMr6s4S9i76+O9jHvONpnfvGItKYGJkLmz0bMxhaoytMUMftAU+gHXNGi+E9OaSdwQcP8sIQ0+EZrVFIfDMay4ID3doWNcGra1s+qO7qT/gvlWaQovr6+U+vqhZszAHfR7XBokPHzBJqlMs8/dhThmrMzAaIf49cMNTfFhHrc0HtYLAppUNvvJ3AEQJArO6wVtz63bqZ8CFG68Py6DqWKg7Cgh0z8fM+65R6hkqq4KLTHupj508EWLtSZqFp7NxgkLVY3AP/ZRl5uOU55cKBsNZfOafLB78elhvZ23IeRiHcLAK3iK5i0lg7Rvc2seUYGyMQpwDHOHz1VBZg7N7gud74YG10yJLXtQlQNM0BL0WIEhoKNwb3BLQjvOWHzGiRtcqeCqzMEy1ovcW7F25uVz+pTnNRRa8GXVjqtwguQpJEcFXJQcQqxKVHr6OTEJzPrPXXEvdYEmDTPs1oPp9tNJrwLRc5D+Pp8S6zRRYwICkOXwilqD/Z33wDtv6wLnPZAfMkmPaAZFOSb2wxXEWUteh5EQYewBfyomMZPsCWCD1e+8GEIPoT4rQ7POlXi7/hPvpMFX2B1ueapq1m+FkStTDaQ3qkz+9MdWQ+7rYodly2BCDXbZGGRRNX60cXndokuo4rxzr/DfMnkJ+34Ab7vChXalLLtRgVu434xcObfy63U9obH88c5o1LvLE2yrfeRA6v47APo+yOkOc9FjTWLLQurjdJK5BINjmxjEEnHvg+WnVTSsNQUICzuPqGldHiju+sZl9n7bR/1kZT51H/Q62/pSYTswrlGl3AjecTiDGykMjze63sbOwMrmQnJ637iGbBY4yfs0ZyndssVakwCkybM+EKXDNgrBe0KDQcuk15zqmRh1PRgcVCC2wKrkAFGTJVJVo9Vri8q0U2AkRoMTF+QiusM4fnF8SVA428hQjDoKvTM1FSjcKciZ5CF99DmjXtTzwkT+Xmx1bHv2usA8wuHDvBbyoQ6RzFyg4lyy08WLD94YLiBRK2dfty2tJOCCeGHVNJ+nj7TtJO4fxOcEz6EEWc3j6gd+AI9lpj55yPjinXzielteHxDxr49kW284+/dZBeutC/qL3iy+aGtCkvVU/TI+Afbsm7VZJzzL66oMZb9R1hySjbwRB+MXAWxf5i9aDngQ42jdyWpwWwiTPznXPXGg8fL75LI9GmxX6fRWft6jjVTO2ORJU+lbFmdeUr2wWmIn6+OTgAg1FrmNKn48ni3C3sf+exGxXCZf/bFCho47sstRlWMrZx8ScNQgxhTW8StyCNIu9lOWwYnso7sH3wsxmh2J2uwzwWua/jAmgONSp0FqpfHFVAgX3QgB+phZH27XPdEPtE+AHFE77XtbSfno37LAJXrJ4z9WlN7HGVWA+9xs1ok33k8YUVFNiIPGc58kuN4EuP3x8ihSQvSbyjy3a9kO7hAzMx6zh1gxNCbTJuAGvMOztoq2NS/x3WM/MGH6qmzRlLkaskxBY5tL7bjOm1Ys85b3fd52B/bEjBZPEyInZb9wauztytXvakpWmBTUQze0+DlSCwlptgQmr+gCTkwqFUV48y7p82AzNTDHW/V22McqVh+Q0Q8wb+LHRObdRhGnTkRRB9bAFOksMFWJcXEhKJx7vRuXxsXtG9+QaCM5InYBRyukQuaUxK3nwGIhHjS/MBw7WplYuleV5KJr/GST8V3WtVa3dMze3ilJEzqh1uiCk1ob0bahnO4uzToLAVahMi35eyebXblq/ioEwBGnFShDoDCxlySK+kUxEce/FSp/a3m++rRXaakYO82oB2pSgsVcqDDzZnivMbLA/r3LMygnezmbOPJBaZBJLLYPBk/K2b2oMsbXVekRoC69gy4MqlGCxplqPjyWXIOh7M4Tj28HvnqJupa35/IPhFr3ftN8HtiXgVaR4RNvY5QmJ3n0QM6h3VdKilwX/aV+eL1xTkiJYEpQVxXth8kdESwRNv61jZpa0eidgm9lYgFcFGx3XtxA6QgzVwHgg0WxR8jQ7NfmOoBH+8R0TCMsY2hexsDTS49dxk99R58mz4zn6B//lr35GWBYXDTvwqd3g07REO/J+QVNvBhodxkUdWisgZ0R0jf1sQttVJ6DQov0UQdWDXC/xU3/w5Ea4dgnRPXIVk0EcDujcfd5ZeuEk2ogVASJZKkVGARnuEYU1Wz4HpCe7D1KzDw2TShS1+wr/Z2UbawDE869El0NFP1ANzDUEZyRoDpbMF5V0aJfO2XPmsmx744doaunDt0o7/di1CHueqLIU2qztS5jOUN/89ZdTanU4+gw26uperzUBN0N6vh2X1rbUkEzrB36CW0VFfeniV0W3uX/Wuskq4RZOVT6nxXdGJTejBUA8QaIeE2tXOo+CAyx9bHjtEFRmVbQe4RnKRASdzej5SSFvuMmw3srO2HcVoAxP37BONFT+B3k9iNBsJIETKd9u54cqY5//gFk3OZjJIp/YWs5/PTbvHs3p2NtAGpPnOac5U5jv6+SZdXwRWLcGcLWmYt6O7kqZeXKNPBd0bVywOFaAVhA7BmKvPzMDI7x/PoSoG7m2bpoh9+r1675gG/PurHgsx8LBZrYalGT7lDl8v40PuvnBqFidJQdsY4cRHNKjVDpKNbV4YAyvXfpQoPebnZBwRVn+3P8RNJClWwWSsZiPgfcU/njoNRQSUCOaFo/5eUfmRYBqhwVocfbv9QyyPRVaOtS4YBM1SJI1SADXWIpWVVp/pCVxAvGDO0bZkf81HbYJlzX2+9KC8ruqQvSQ7nhaZoUWCkjg7MDy4Hk647Wnh7Mb9v+9Ji8/Do2aWV5vgmBS+mUCeBUMdVn0jV+tjZu5W5ASVWin9vvIRP4uIVw+TZANT7yAdfI1VYdMwDc4M7ALauLoxC2MjFCoP3CT3QM8kpy+t9zYlo40CXsT6RrFru38ye8JRUzwCb5ky40S3WnOrsBG8TQYEB+R0LBhRar98VB2UM5egwCvVNxQO2SGf5yAKPp2/1B17dlU/pWhmkJEAkj6HAZs79LRl34PDT81HyKrB7P9HS/MSijup/FgF3QVp93OhKRgFkBp134G4C+PkY9EiaIavlhd+7unIoeZ5JgyqlhAY/CNZpfOApwDzuLiYKH8vesbBubhL6G13Vn/qs0A55GHVRnQYRTNdMvbfiGOrthylPWF7LZLts/83eRd967P8p/9m0/G3vUkzSUOXAAABkhalaUlBZ87QU/Bs1jzZb24AsXEV3uFBwBQh9cWp8D6RnDkaJ7m5fMQexzTy4fTJs36+OpKIdP53mf8L+RK6yzzhPpZADaiKRwjRRa9YXowjnFSAPFAYAc4iyyQCwB5GwG1x01Rvc/mFscw6dYI9K5gTSDUQ12xEpFwBUyN8NdJcghfDrJX65Jyy/2hUvEkoi20N903zE8Ky+4EAwgW0GKpozTuJcrUvRBtRmxlQJd/EJkOopfZgynY3TU1hiBbSL3BibzCtSbIEZaj7tZpeLyF32GbD3SpJd/kxdTHtbDI+cRUFmyTpJBkm3LmAc/VOHePYm4mXUfuuHnsZo0mUxccKlHfKiZW+GptRLhb5oH/63jqM56EV9pZc4HTDnt/JrIf52lQGA5R4h61nN/dr3K+XNAag/NZqp1BhRxDHDjuP796b232kOMbd3XJj1AgjGTlSBEHfURaXtlhKQYxT9Sc/Q+6rKwsLSdzr9JtzmTug1plldCcxBUuKM7GD2QuZ6e4/xTOBVXLXEGZvQGfGouwbpDZOtD83wCjSI1RnJzW6biYsR01iw3xvED/yjzZVQIwB+tFrj87ZoFLCFJZNEPwziMXpnZN3wcRjUpJL0zfKe6ZFDpGLxw2EhbvGSs2nWIDnTKpmb64nxnHlf/Fk+A7FGMSF1o9la574GYIaQxcChJujqfqsew4EeKJv/uqlJpAOQy9Rbe2ukW+i+M45mXNvZLZMKXyVDPV2/KnKia6jE1lhqD4EiCeh7hkSZNUq0nVE75/iDkGlkcuYH+qf/ywaH1tWlSlw+P5US02WomNCZYSIzuBJTe/TumJZDLd4ndqow7yu611wcqZxm0fXBXgh6ysAVtwxyjP/SYNzvOyOVdWtxpf8H8fVk+qhW500vI6gScKG7G7mAdF+mfRDnzRswgyuT721QGffnFk4BhRggKZDDJwQ8rvckYesgONLpDlNWAQcZ/YSabm4cLmrUxvUn2f7D3Lv8+VF5OnzUheXsGklB3u8mh+PMBhRnAM+VeVZtKSpX75SsUal1H7ez51Kub9Y/5tJPZAFITo+tS94ZmEe3d8b4JYfxDVdWf5JcCPujVr/VZ+WE4qgQSIJD8tywqGYPqXll+df6MVtlDPXToh6svHs2IvE/X5ui9LEqCB2ycrsw=","rc_enable":"y","bg_snapshot_delay_ms":"500"}
Signatures 7

Filter: none

Defense Evasion
Discovery
  • Ryuk

    Description

    Ransomware distributed via existing botnets, often Trickbot or Emotet.

  • Checks computer location settings
    bbe7f26bcc02ee60e972c1b094be7944146a53f886b249b3f977a8f871a22510.exe

    Description

    Looks up country code configured in the registry, likely geofence.

    TTPs

    Query RegistrySystem Information Discovery

    Reported IOCs

    descriptioniocprocess
    Key value queried\REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\Control Panel\International\Geo\Nationbbe7f26bcc02ee60e972c1b094be7944146a53f886b249b3f977a8f871a22510.exe
  • Enumerates physical storage devices

    Description

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

    TTPs

    System Information Discovery
  • Modifies Internet Explorer settings
    iexplore.exeIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXE

    TTPs

    Modify Registry

    Reported IOCs

    descriptioniocprocess
    Set value (int)\REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"iexplore.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "374664185"iexplore.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "67"IEXPLORE.EXE
    Set value (int)\REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\adult.oo.lv\ = "119"IEXPLORE.EXE
    Key created\REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecoveryiexplore.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"iexplore.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "151"IEXPLORE.EXE
    Key created\REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearchiexplore.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\oo.lv\Total = "67"IEXPLORE.EXE
    Set value (int)\REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30951206"iexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorageIEXPLORE.EXE
    Set value (data)\REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000iexplore.exe
    Set value (str)\REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"iexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\Software\Microsoft\Internet Explorer\VersionManageriexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\Software\Microsoft\Internet Explorer\MainIEXPLORE.EXE
    Set value (str)\REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"iexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\Software\Microsoft\Internet Explorer\TabbedBrowsingiexplore.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\adult.oo.lv\ = "15"IEXPLORE.EXE
    Set value (int)\REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\adult.oo.lv\ = "93"IEXPLORE.EXE
    Key created\REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPageiexplore.exe
    Set value (data)\REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e2bdf96ee36d9544a96c6515b05c558200000000020000000000106600000001000020000000b097b75cf82d2a7efcb764090820a9c74b65e24db226f63d6c4219da6a0a7db8000000000e8000000002000020000000073716e67c4d7670714d7c7b653d51514408add95132907166fce3fb061cb55420000000894327386df8628ca6c3cbfac5cc32a28b430032508c096435988af3b5e1fd984000000016b3bb44497b2fbfc17b3a03666dc5bd534e2ce2b75e21044870cc163da6cbe9d5532a4369363d9a588ed7e59415d96daac892f176038845999450ff4ca1cb66iexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\Software\Microsoft\Internet Explorer\DOMStorage\oo.lvIEXPLORE.EXE
    Set value (int)\REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\oo.lv\NumberOfSubdomains = "1"IEXPLORE.EXE
    Set value (int)\REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\oo.lv\Total = "41"IEXPLORE.EXE
    Set value (int)\REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"IEXPLORE.EXE
    Key created\REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\Software\Microsoft\Internet Explorer\MINIEiexplore.exe
    Set value (data)\REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e2bdf96ee36d9544a96c6515b05c558200000000020000000000106600000001000020000000d4dc5a569ea0e4905d216bae0f6b414180de450046df845d78f4f86dd2e4a1a6000000000e8000000002000020000000933c2f7243794b85ed61e8493b41750c06ffe8ffbc3eb8c7d769aee30dfb7f7c20000000f1cc5d7dc421f4c3a23d451b7064ecbcc18eca85bb3f1ac421e3a9c2b9abb04040000000fe4e175a3c6536a04246e1cf45a9350e634475bbb25796dcefe5edc365ce4eef204f36b4a90210864054f485c75db1a23235fd899ae3aa8417615019491da09ciexplore.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\adult.oo.lv\ = "41"IEXPLORE.EXE
    Key created\REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearchIEXPLORE.EXE
    Key created\REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\Software\Microsoft\Internet Explorer\DOMStorage\adult.oo.lvIEXPLORE.EXE
    Set value (int)\REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "93"IEXPLORE.EXE
    Set value (int)\REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "119"IEXPLORE.EXE
    Set value (int)\REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"iexplore.exe
    Set value (data)\REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c04f67192647d801iexplore.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"iexplore.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30951206"IEXPLORE.EXE
    Set value (str)\REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"IEXPLORE.EXE
    Key created\REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\Software\Microsoft\Internet Explorer\Mainiexplore.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"iexplore.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "15"IEXPLORE.EXE
    Key created\REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\Software\Microsoft\Internet Explorer\IESettingSyncIEXPLORE.EXE
    Set value (int)\REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\adult.oo.lv\ = "151"IEXPLORE.EXE
    Set value (int)\REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{4108E0CC-B319-11EC-9DAB-CA521D86E63B} = "0"iexplore.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "382165020"IEXPLORE.EXE
    Set value (int)\REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "382165020"IEXPLORE.EXE
    Key created\REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\oo.lvIEXPLORE.EXE
    Key created\REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\Software\Microsoft\Internet Explorer\MainIEXPLORE.EXE
    Set value (int)\REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "374664185"iexplore.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30951206"iexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActiveiexplore.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\oo.lv\Total = "93"IEXPLORE.EXE
    Set value (int)\REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\oo.lv\Total = "151"IEXPLORE.EXE
    Key created\REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\Software\Microsoft\Internet Explorer\DOMStorage\TotalIEXPLORE.EXE
    Set value (int)\REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\oo.lv\Total = "119"IEXPLORE.EXE
    Key created\REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\Software\Microsoft\Internet Explorer\MainIEXPLORE.EXE
    Key created\REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\Software\Microsoft\Internet Explorer\VersionManagerIEXPLORE.EXE
    Set value (int)\REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "41"IEXPLORE.EXE
    Set value (int)\REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\adult.oo.lv\ = "67"IEXPLORE.EXE
    Set value (int)\REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"iexplore.exe
    Set value (data)\REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60d2c2182647d801iexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPageiexplore.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30951206"IEXPLORE.EXE
    Set value (int)\REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\oo.lv\Total = "15"IEXPLORE.EXE
  • Suspicious use of FindShellTrayWindow
    iexplore.exe

    Reported IOCs

    pidprocess
    4476iexplore.exe
    4476iexplore.exe
    4476iexplore.exe
  • Suspicious use of SetWindowsHookEx
    iexplore.exeIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXE

    Reported IOCs

    pidprocess
    4476iexplore.exe
    4476iexplore.exe
    2172IEXPLORE.EXE
    2172IEXPLORE.EXE
    4476iexplore.exe
    4476iexplore.exe
    4728IEXPLORE.EXE
    4728IEXPLORE.EXE
    4476iexplore.exe
    4476iexplore.exe
    1144IEXPLORE.EXE
    1144IEXPLORE.EXE
  • Suspicious use of WriteProcessMemory
    bbe7f26bcc02ee60e972c1b094be7944146a53f886b249b3f977a8f871a22510.exeiexplore.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 2608 wrote to memory of 3922608bbe7f26bcc02ee60e972c1b094be7944146a53f886b249b3f977a8f871a22510.exewscript.exe
    PID 2608 wrote to memory of 3922608bbe7f26bcc02ee60e972c1b094be7944146a53f886b249b3f977a8f871a22510.exewscript.exe
    PID 2608 wrote to memory of 3922608bbe7f26bcc02ee60e972c1b094be7944146a53f886b249b3f977a8f871a22510.exewscript.exe
    PID 4476 wrote to memory of 21724476iexplore.exeIEXPLORE.EXE
    PID 4476 wrote to memory of 21724476iexplore.exeIEXPLORE.EXE
    PID 4476 wrote to memory of 21724476iexplore.exeIEXPLORE.EXE
    PID 4476 wrote to memory of 47284476iexplore.exeIEXPLORE.EXE
    PID 4476 wrote to memory of 47284476iexplore.exeIEXPLORE.EXE
    PID 4476 wrote to memory of 47284476iexplore.exeIEXPLORE.EXE
    PID 4476 wrote to memory of 11444476iexplore.exeIEXPLORE.EXE
    PID 4476 wrote to memory of 11444476iexplore.exeIEXPLORE.EXE
    PID 4476 wrote to memory of 11444476iexplore.exeIEXPLORE.EXE
Processes 7
  • C:\Users\Admin\AppData\Local\Temp\bbe7f26bcc02ee60e972c1b094be7944146a53f886b249b3f977a8f871a22510.exe
    "C:\Users\Admin\AppData\Local\Temp\bbe7f26bcc02ee60e972c1b094be7944146a53f886b249b3f977a8f871a22510.exe"
    Checks computer location settings
    Suspicious use of WriteProcessMemory
    PID:2608
    • C:\Windows\SysWOW64\wscript.exe
      "C:\Windows\system32\wscript.exe" //B "C:\Users\Admin\AppData\Local\Temp\OLbPoNJH.js" "C:\Users\Admin\AppData\Local\Temp\bbe7f26bcc02ee60e972c1b094be7944146a53f886b249b3f977a8f871a22510.exe"
      PID:392
  • C:\Program Files (x86)\Internet Explorer\ielowutil.exe
    "C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding
    PID:4612
  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
    Modifies Internet Explorer settings
    Suspicious use of FindShellTrayWindow
    Suspicious use of SetWindowsHookEx
    Suspicious use of WriteProcessMemory
    PID:4476
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4476 CREDAT:17410 /prefetch:2
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:2172
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4476 CREDAT:17412 /prefetch:2
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:4728
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4476 CREDAT:82952 /prefetch:2
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:1144
Network
MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
        Execution
          Exfiltration
            Impact
              Initial Access
                Lateral Movement
                  Persistence
                    Privilege Escalation
                      Replay Monitor
                      00:00 00:00
                      Downloads
                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\8E73FL5R\favicon[1].htm

                        MD5

                        b73189024a094989653a1002fb6a790b

                        SHA1

                        0c44f096cd1fec253c1fe2fcfcd3c58fe05c402d

                        SHA256

                        014c471c07b2bc1b90cf5b46eb8eb60abe3ac278e43cd8fcc7c4e6c8950c592d

                        SHA512

                        1bca726835d33847812060c968e5306535f513429de5c90d66942155fd42ff75508dba97da8ca36c6d6e6a8df5a2602fe3be047bb5612ad4e367c6c00e1e50a3

                      • C:\Users\Admin\AppData\Local\Temp\OLbPoNJH.js

                        MD5

                        3055ff6048a60e79a704001c8b7a0cdd

                        SHA1

                        c793381bcc5ae2e1da599352eb74131a6790c224

                        SHA256

                        6f739f14f1d4dec5d4a62f91cd63caa98766874e9b25cae430990137ad812f37

                        SHA512

                        e4ee9df4b1c7ee75feb331fa2a597b6dfdf83ed714a753a9278b22eabc389ca78aad48609811ce913ebbb7d7ac01c02f7f495aba7d9c244fa31e7f367d906fc1

                      • memory/392-124-0x0000000000000000-mapping.dmp