Analysis
-
max time kernel
409s -
max time network
437s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
11-05-2022 00:22
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://cdn.discordapp.com/attachments/939583004387471483/952319283906617374/GIFT_VOUCHER.zip
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
https://cdn.discordapp.com/attachments/939583004387471483/952319283906617374/GIFT_VOUCHER.zip
Resource
win10v2004-20220414-en
General
-
Target
https://cdn.discordapp.com/attachments/939583004387471483/952319283906617374/GIFT_VOUCHER.zip
Malware Config
Extracted
raccoon
7994c54742ba2370446cc758f5e797d4fefc8347
-
url4cnc
http://85.159.212.113/darnerd00m
http://185.163.204.81/darnerd00m
http://194.180.191.33/darnerd00m
http://174.138.11.98/darnerd00m
http://194.180.191.44/darnerd00m
http://91.219.236.120/darnerd00m
https://t.me/darnerd00m
Signatures
-
Executes dropped EXE 4 IoCs
Processes:
gift_voucher_100$.pdf.scrgift_voucher_100$.pdf.scrgift_voucher_100$.pdf.scrgift_voucher_100$.pdf.scrpid process 1888 gift_voucher_100$.pdf.scr 476 gift_voucher_100$.pdf.scr 588 gift_voucher_100$.pdf.scr 1592 gift_voucher_100$.pdf.scr -
Suspicious use of SetThreadContext 2 IoCs
Processes:
gift_voucher_100$.pdf.scrgift_voucher_100$.pdf.scrdescription pid process target process PID 1888 set thread context of 476 1888 gift_voucher_100$.pdf.scr gift_voucher_100$.pdf.scr PID 588 set thread context of 1592 588 gift_voucher_100$.pdf.scr gift_voucher_100$.pdf.scr -
Modifies Internet Explorer Phishing Filter 1 TTPs 2 IoCs
Processes:
iexplore.exedescription ioc process Set value (data) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\PhishingFilter\ClientSupported_MigrationTime = c0ed4762cd64d801 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\PhishingFilter iexplore.exe -
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{91E7CAA1-D0C0-11EC-BA79-C6DEEDF3EE1E} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Main\DownloadWindowPlacement = 2c0000000000000000000000ffffffffffffffffffffffffffffffff100100003d000000900300001d020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "358993582" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE -
Modifies registry class 48 IoCs
Processes:
iexplore.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000007800000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "2" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 200000001a00eebbfe230000100090e24d373f126545916439c4925e467b00000000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a000000a000000030f125b7ef471a10a5f102608c9eebac0c00000050000000a66a63283d95d211b5d600c04fd918d00b0000007800000030f125b7ef471a10a5f102608c9eebac0e00000078000000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7} iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "48" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000_Classes\Local Settings iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f44471a0359723fa74489c55595fe6b30ee0000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7} iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "6" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlot = "2" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\KnownFolderDerivedFolderType = "{57807898-8C4F-4462-BB63-71042380B109}" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0" iexplore.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
gift_voucher_100$.pdf.scrgift_voucher_100$.pdf.scrpid process 1888 gift_voucher_100$.pdf.scr 1888 gift_voucher_100$.pdf.scr 588 gift_voucher_100$.pdf.scr 588 gift_voucher_100$.pdf.scr -
Suspicious use of AdjustPrivilegeToken 10 IoCs
Processes:
AUDIODG.EXE7zG.exegift_voucher_100$.pdf.scrgift_voucher_100$.pdf.scrdescription pid process Token: 33 1980 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1980 AUDIODG.EXE Token: 33 1980 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1980 AUDIODG.EXE Token: SeRestorePrivilege 2012 7zG.exe Token: 35 2012 7zG.exe Token: SeSecurityPrivilege 2012 7zG.exe Token: SeSecurityPrivilege 2012 7zG.exe Token: SeDebugPrivilege 1888 gift_voucher_100$.pdf.scr Token: SeDebugPrivilege 588 gift_voucher_100$.pdf.scr -
Suspicious use of FindShellTrayWindow 3 IoCs
Processes:
iexplore.exe7zG.exepid process 1664 iexplore.exe 1664 iexplore.exe 2012 7zG.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 1664 iexplore.exe 1664 iexplore.exe 2016 IEXPLORE.EXE 2016 IEXPLORE.EXE 1664 iexplore.exe -
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
iexplore.exegift_voucher_100$.pdf.scrgift_voucher_100$.pdf.scrdescription pid process target process PID 1664 wrote to memory of 2016 1664 iexplore.exe IEXPLORE.EXE PID 1664 wrote to memory of 2016 1664 iexplore.exe IEXPLORE.EXE PID 1664 wrote to memory of 2016 1664 iexplore.exe IEXPLORE.EXE PID 1664 wrote to memory of 2016 1664 iexplore.exe IEXPLORE.EXE PID 1888 wrote to memory of 476 1888 gift_voucher_100$.pdf.scr gift_voucher_100$.pdf.scr PID 1888 wrote to memory of 476 1888 gift_voucher_100$.pdf.scr gift_voucher_100$.pdf.scr PID 1888 wrote to memory of 476 1888 gift_voucher_100$.pdf.scr gift_voucher_100$.pdf.scr PID 1888 wrote to memory of 476 1888 gift_voucher_100$.pdf.scr gift_voucher_100$.pdf.scr PID 1888 wrote to memory of 476 1888 gift_voucher_100$.pdf.scr gift_voucher_100$.pdf.scr PID 1888 wrote to memory of 476 1888 gift_voucher_100$.pdf.scr gift_voucher_100$.pdf.scr PID 1888 wrote to memory of 476 1888 gift_voucher_100$.pdf.scr gift_voucher_100$.pdf.scr PID 1888 wrote to memory of 476 1888 gift_voucher_100$.pdf.scr gift_voucher_100$.pdf.scr PID 1888 wrote to memory of 476 1888 gift_voucher_100$.pdf.scr gift_voucher_100$.pdf.scr PID 1888 wrote to memory of 476 1888 gift_voucher_100$.pdf.scr gift_voucher_100$.pdf.scr PID 588 wrote to memory of 1592 588 gift_voucher_100$.pdf.scr gift_voucher_100$.pdf.scr PID 588 wrote to memory of 1592 588 gift_voucher_100$.pdf.scr gift_voucher_100$.pdf.scr PID 588 wrote to memory of 1592 588 gift_voucher_100$.pdf.scr gift_voucher_100$.pdf.scr PID 588 wrote to memory of 1592 588 gift_voucher_100$.pdf.scr gift_voucher_100$.pdf.scr PID 588 wrote to memory of 1592 588 gift_voucher_100$.pdf.scr gift_voucher_100$.pdf.scr PID 588 wrote to memory of 1592 588 gift_voucher_100$.pdf.scr gift_voucher_100$.pdf.scr PID 588 wrote to memory of 1592 588 gift_voucher_100$.pdf.scr gift_voucher_100$.pdf.scr PID 588 wrote to memory of 1592 588 gift_voucher_100$.pdf.scr gift_voucher_100$.pdf.scr PID 588 wrote to memory of 1592 588 gift_voucher_100$.pdf.scr gift_voucher_100$.pdf.scr PID 588 wrote to memory of 1592 588 gift_voucher_100$.pdf.scr gift_voucher_100$.pdf.scr
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" https://cdn.discordapp.com/attachments/939583004387471483/952319283906617374/GIFT_VOUCHER.zip1⤵
- Modifies Internet Explorer Phishing Filter
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1664 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x1a81⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\7-Zip\7zG.exe"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\GIFT_VOUCHER\" -spe -an -ai#7zMap25581:86:7zEvent250501⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\Downloads\GIFT_VOUCHER\gift_voucher_100$.pdf.scr"C:\Users\Admin\Downloads\GIFT_VOUCHER\gift_voucher_100$.pdf.scr" /S1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Downloads\GIFT_VOUCHER\gift_voucher_100$.pdf.scrC:\Users\Admin\Downloads\GIFT_VOUCHER\gift_voucher_100$.pdf.scr2⤵
- Executes dropped EXE
-
C:\Users\Admin\Downloads\GIFT_VOUCHER\gift_voucher_100$.pdf.scr"C:\Users\Admin\Downloads\GIFT_VOUCHER\gift_voucher_100$.pdf.scr" /S1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Downloads\GIFT_VOUCHER\gift_voucher_100$.pdf.scrC:\Users\Admin\Downloads\GIFT_VOUCHER\gift_voucher_100$.pdf.scr2⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD558785b917f8c67a1c77cfcbcc0a9071a
SHA18d83339ba433bdd5cbf24e738519d9e1fcc9fc2a
SHA256e2c1bb2d2dc46710ab57ec40ad342445a5185149d1d2f793e741c6e6b6dfd5a8
SHA5127d7c42fa56f0e443f570a3ea158d1556a03da0c90e9ae3fc74e05793f15f2921b366f4564bde85b831a961f625a35bf58c52f45022db46bc0d1e8f9310910f3c
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\ZOML4N00.txtFilesize
602B
MD559eb00064364f6879ed376fed1a2abd9
SHA1241c90f8d21c43cbbf76e01ad4a7df4f1186a287
SHA2567172a3467442a5480499e254cc693df11b1d5502c31001c12acb9faa37da03bc
SHA512c38689d2b54a0b783a5fc908bc227618e7ba6ec69e2d68f2b6f756e64439aab8b6cea1d449f4f7287294935b21633cad1e06b175f64bb92767bfc761a0f91ee7
-
C:\Users\Admin\Downloads\GIFT_VOUCHER.zip.y1kpqfz.partialFilesize
1.8MB
MD59101462b86e488032f9cc335337dd817
SHA16a69416c11d5b979c21391b09cee5da559ce7a2d
SHA256cf7f7f7faa54a5cffd2e688f06e9eb4767e3a5b06aba5b3a68391bede91a1c2a
SHA5120623679e641693ad92555d6ca103614ac706826795eb1585007236e7baf675084432eb160b288504fc8a2ec0e38bb0aedca003836af9fcf689a37d7465d0b929
-
C:\Users\Admin\Downloads\GIFT_VOUCHER\gift_voucher_100$.pdf.scrFilesize
3.0MB
MD5ddcbde41f3a93c2bad710d35ed701b78
SHA175d02a20ea0c6bc59294d11046ee0e85a9f20c5f
SHA25665b7e35c4ca55c51e8d9c863c39d535858b3056dcf43014f3abbf2658e1b078b
SHA51254137c59bc30462ca346feba194a957dd2c7845c52f986ddc5437be5a70916c36ca0d89df3f65c8ceb933ff792b27c5860ff697682199bceb08bc93c44ce61a3
-
C:\Users\Admin\Downloads\GIFT_VOUCHER\gift_voucher_100$.pdf.scrFilesize
3.0MB
MD5ddcbde41f3a93c2bad710d35ed701b78
SHA175d02a20ea0c6bc59294d11046ee0e85a9f20c5f
SHA25665b7e35c4ca55c51e8d9c863c39d535858b3056dcf43014f3abbf2658e1b078b
SHA51254137c59bc30462ca346feba194a957dd2c7845c52f986ddc5437be5a70916c36ca0d89df3f65c8ceb933ff792b27c5860ff697682199bceb08bc93c44ce61a3
-
C:\Users\Admin\Downloads\GIFT_VOUCHER\gift_voucher_100$.pdf.scrFilesize
3.0MB
MD5ddcbde41f3a93c2bad710d35ed701b78
SHA175d02a20ea0c6bc59294d11046ee0e85a9f20c5f
SHA25665b7e35c4ca55c51e8d9c863c39d535858b3056dcf43014f3abbf2658e1b078b
SHA51254137c59bc30462ca346feba194a957dd2c7845c52f986ddc5437be5a70916c36ca0d89df3f65c8ceb933ff792b27c5860ff697682199bceb08bc93c44ce61a3
-
C:\Users\Admin\Downloads\GIFT_VOUCHER\gift_voucher_100$.pdf.scrFilesize
3.0MB
MD5ddcbde41f3a93c2bad710d35ed701b78
SHA175d02a20ea0c6bc59294d11046ee0e85a9f20c5f
SHA25665b7e35c4ca55c51e8d9c863c39d535858b3056dcf43014f3abbf2658e1b078b
SHA51254137c59bc30462ca346feba194a957dd2c7845c52f986ddc5437be5a70916c36ca0d89df3f65c8ceb933ff792b27c5860ff697682199bceb08bc93c44ce61a3
-
C:\Users\Admin\Downloads\GIFT_VOUCHER\gift_voucher_100$.pdf.scrFilesize
3.0MB
MD5ddcbde41f3a93c2bad710d35ed701b78
SHA175d02a20ea0c6bc59294d11046ee0e85a9f20c5f
SHA25665b7e35c4ca55c51e8d9c863c39d535858b3056dcf43014f3abbf2658e1b078b
SHA51254137c59bc30462ca346feba194a957dd2c7845c52f986ddc5437be5a70916c36ca0d89df3f65c8ceb933ff792b27c5860ff697682199bceb08bc93c44ce61a3
-
memory/476-74-0x0000000000400000-0x0000000000493000-memory.dmpFilesize
588KB
-
memory/476-80-0x0000000000400000-0x0000000000493000-memory.dmpFilesize
588KB
-
memory/476-66-0x0000000000400000-0x0000000000493000-memory.dmpFilesize
588KB
-
memory/476-65-0x0000000000400000-0x0000000000493000-memory.dmpFilesize
588KB
-
memory/476-68-0x0000000000400000-0x0000000000493000-memory.dmpFilesize
588KB
-
memory/476-70-0x0000000000400000-0x0000000000493000-memory.dmpFilesize
588KB
-
memory/476-72-0x0000000000400000-0x0000000000493000-memory.dmpFilesize
588KB
-
memory/476-75-0x0000000000440D8F-mapping.dmp
-
memory/476-79-0x0000000000400000-0x0000000000493000-memory.dmpFilesize
588KB
-
memory/588-82-0x00000000009C0000-0x0000000000A00000-memory.dmpFilesize
256KB
-
memory/1592-99-0x0000000000400000-0x0000000000493000-memory.dmpFilesize
588KB
-
memory/1592-94-0x0000000000440D8F-mapping.dmp
-
memory/1888-62-0x00000000059A0000-0x0000000005A4C000-memory.dmpFilesize
688KB
-
memory/1888-60-0x00000000009C0000-0x0000000000A00000-memory.dmpFilesize
256KB
-
memory/1888-61-0x0000000074E91000-0x0000000074E93000-memory.dmpFilesize
8KB
-
memory/1888-63-0x0000000005390000-0x0000000005406000-memory.dmpFilesize
472KB
-
memory/1888-64-0x0000000000B90000-0x0000000000BDC000-memory.dmpFilesize
304KB
-
memory/2012-57-0x000007FEFBA91000-0x000007FEFBA93000-memory.dmpFilesize
8KB