darkcomet | 329d1b0ef6c7cff38838a20f5dfa682467aa7810db5890bed748d72cc5fc4db3

Analysis

max time kernel
152s
max time network
167s
platform
windows7_x64
resource
win7-20220414-en
submitted
25-05-2022 02:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

329d1b0ef6c7cff38838a20f5dfa682467aa7810db5890bed748d72cc5fc4db3.exe
Size

1.6MB
MD5

178c2baefb6626687b762086a7162857
SHA1

3d5c62f40405adedafc593c36c10e2a270f932c6
SHA256

329d1b0ef6c7cff38838a20f5dfa682467aa7810db5890bed748d72cc5fc4db3
SHA512

74ae030dc3d18866263fa1730f7c0963b051b2867e6bdfe32251220a964f0d84a67649bdcd06596cc9d91ad0393cb0987af5f29da811cd6d786702e6c88a83fa

Score

10^/10

darkcomet sazan persistence rat trojan

Malware Config

Extracted

Family

darkcomet

Botnet

Sazan

127.0.0.1:1604

Mutex

DC_MUTEX-D2H1NG0

Attributes

gencode
Tgf2hTTuGTVx
install
false
offline_keylogger
true
persistence
false

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet
Executes dropped EXE 2 IoCs

Processes:

._cache_329d1b0ef6c7cff38838a20f5dfa682467aa7810db5890bed748d72cc5fc4db3.exeSynaptics.exe

pid process

1552 ._cache_329d1b0ef6c7cff38838a20f5dfa682467aa7810db5890bed748d72cc5fc4db3.exe
596 Synaptics.exe

pid	process
1552	._cache_329d1b0ef6c7cff38838a20f5dfa682467aa7810db5890bed748d72cc5fc4db3.exe
596	Synaptics.exe

Loads dropped DLL 4 IoCs

Processes:

329d1b0ef6c7cff38838a20f5dfa682467aa7810db5890bed748d72cc5fc4db3.exe

pid	process
1156	329d1b0ef6c7cff38838a20f5dfa682467aa7810db5890bed748d72cc5fc4db3.exe
1156	329d1b0ef6c7cff38838a20f5dfa682467aa7810db5890bed748d72cc5fc4db3.exe
1156	329d1b0ef6c7cff38838a20f5dfa682467aa7810db5890bed748d72cc5fc4db3.exe
1156	329d1b0ef6c7cff38838a20f5dfa682467aa7810db5890bed748d72cc5fc4db3.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

329d1b0ef6c7cff38838a20f5dfa682467aa7810db5890bed748d72cc5fc4db3.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\RIP crack dragonjin = "C:\\ProgramData\\Synaptics\\Synaptics.exe"	329d1b0ef6c7cff38838a20f5dfa682467aa7810db5890bed748d72cc5fc4db3.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

._cache_329d1b0ef6c7cff38838a20f5dfa682467aa7810db5890bed748d72cc5fc4db3.exe

description	pid	process	target process
PID 1552 set thread context of 1288	1552	._cache_329d1b0ef6c7cff38838a20f5dfa682467aa7810db5890bed748d72cc5fc4db3.exe	iexplore.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry
T1012

System Information Discovery
T1082

Processes:

EXCEL.EXE

description ioc process

Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor	EXCEL.EXE

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

Processes:

EXCEL.EXE

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell	EXCEL.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Toolbar	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell	EXCEL.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit"	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\MenuExt	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit"	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor	EXCEL.EXE

Modifies registry class 64 IoCs

Processes:

EXCEL.EXE

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command	EXCEL.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shellex\IconHandler	EXCEL.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\ = "[open(\"%1\")]"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\DefaultIcon\ = "\"%1\""	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shellex\IconHandler\ = "{42042206-2D85-11D3-8CFF-005004838597}"	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\topic\ = "system"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\ = "&Edit"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command	EXCEL.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shellex\IconHandler\ = "{42042206-2D85-11D3-8CFF-005004838597}"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon\htmlfile	EXCEL.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\ = "&Open"	EXCEL.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht	EXCEL.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\application	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\topic	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1"	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\ = "&Open"	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1"	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\ = "&Print"	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" %1"	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\ = "&Print"	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit	EXCEL.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\DefaultIcon	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ = "&Open"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32\ThreadingModel = "Apartment"	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\ = "&Open"	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application\ = "Excel"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\ShellEx	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList	EXCEL.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

EXCEL.EXE

pid process

1732 EXCEL.EXE

pid	process
1732	EXCEL.EXE

Suspicious use of AdjustPrivilegeToken 46 IoCs

Processes:

._cache_329d1b0ef6c7cff38838a20f5dfa682467aa7810db5890bed748d72cc5fc4db3.exeiexplore.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	1552	._cache_329d1b0ef6c7cff38838a20f5dfa682467aa7810db5890bed748d72cc5fc4db3.exe
Token: SeSecurityPrivilege	1552	._cache_329d1b0ef6c7cff38838a20f5dfa682467aa7810db5890bed748d72cc5fc4db3.exe
Token: SeTakeOwnershipPrivilege	1552	._cache_329d1b0ef6c7cff38838a20f5dfa682467aa7810db5890bed748d72cc5fc4db3.exe
Token: SeLoadDriverPrivilege	1552	._cache_329d1b0ef6c7cff38838a20f5dfa682467aa7810db5890bed748d72cc5fc4db3.exe
Token: SeSystemProfilePrivilege	1552	._cache_329d1b0ef6c7cff38838a20f5dfa682467aa7810db5890bed748d72cc5fc4db3.exe
Token: SeSystemtimePrivilege	1552	._cache_329d1b0ef6c7cff38838a20f5dfa682467aa7810db5890bed748d72cc5fc4db3.exe
Token: SeProfSingleProcessPrivilege	1552	._cache_329d1b0ef6c7cff38838a20f5dfa682467aa7810db5890bed748d72cc5fc4db3.exe
Token: SeIncBasePriorityPrivilege	1552	._cache_329d1b0ef6c7cff38838a20f5dfa682467aa7810db5890bed748d72cc5fc4db3.exe
Token: SeCreatePagefilePrivilege	1552	._cache_329d1b0ef6c7cff38838a20f5dfa682467aa7810db5890bed748d72cc5fc4db3.exe
Token: SeBackupPrivilege	1552	._cache_329d1b0ef6c7cff38838a20f5dfa682467aa7810db5890bed748d72cc5fc4db3.exe
Token: SeRestorePrivilege	1552	._cache_329d1b0ef6c7cff38838a20f5dfa682467aa7810db5890bed748d72cc5fc4db3.exe
Token: SeShutdownPrivilege	1552	._cache_329d1b0ef6c7cff38838a20f5dfa682467aa7810db5890bed748d72cc5fc4db3.exe
Token: SeDebugPrivilege	1552	._cache_329d1b0ef6c7cff38838a20f5dfa682467aa7810db5890bed748d72cc5fc4db3.exe
Token: SeSystemEnvironmentPrivilege	1552	._cache_329d1b0ef6c7cff38838a20f5dfa682467aa7810db5890bed748d72cc5fc4db3.exe
Token: SeChangeNotifyPrivilege	1552	._cache_329d1b0ef6c7cff38838a20f5dfa682467aa7810db5890bed748d72cc5fc4db3.exe
Token: SeRemoteShutdownPrivilege	1552	._cache_329d1b0ef6c7cff38838a20f5dfa682467aa7810db5890bed748d72cc5fc4db3.exe
Token: SeUndockPrivilege	1552	._cache_329d1b0ef6c7cff38838a20f5dfa682467aa7810db5890bed748d72cc5fc4db3.exe
Token: SeManageVolumePrivilege	1552	._cache_329d1b0ef6c7cff38838a20f5dfa682467aa7810db5890bed748d72cc5fc4db3.exe
Token: SeImpersonatePrivilege	1552	._cache_329d1b0ef6c7cff38838a20f5dfa682467aa7810db5890bed748d72cc5fc4db3.exe
Token: SeCreateGlobalPrivilege	1552	._cache_329d1b0ef6c7cff38838a20f5dfa682467aa7810db5890bed748d72cc5fc4db3.exe
Token: 33	1552	._cache_329d1b0ef6c7cff38838a20f5dfa682467aa7810db5890bed748d72cc5fc4db3.exe
Token: 34	1552	._cache_329d1b0ef6c7cff38838a20f5dfa682467aa7810db5890bed748d72cc5fc4db3.exe
Token: 35	1552	._cache_329d1b0ef6c7cff38838a20f5dfa682467aa7810db5890bed748d72cc5fc4db3.exe
Token: SeIncreaseQuotaPrivilege	1288	iexplore.exe
Token: SeSecurityPrivilege	1288	iexplore.exe
Token: SeTakeOwnershipPrivilege	1288	iexplore.exe
Token: SeLoadDriverPrivilege	1288	iexplore.exe
Token: SeSystemProfilePrivilege	1288	iexplore.exe
Token: SeSystemtimePrivilege	1288	iexplore.exe
Token: SeProfSingleProcessPrivilege	1288	iexplore.exe
Token: SeIncBasePriorityPrivilege	1288	iexplore.exe
Token: SeCreatePagefilePrivilege	1288	iexplore.exe
Token: SeBackupPrivilege	1288	iexplore.exe
Token: SeRestorePrivilege	1288	iexplore.exe
Token: SeShutdownPrivilege	1288	iexplore.exe
Token: SeDebugPrivilege	1288	iexplore.exe
Token: SeSystemEnvironmentPrivilege	1288	iexplore.exe
Token: SeChangeNotifyPrivilege	1288	iexplore.exe
Token: SeRemoteShutdownPrivilege	1288	iexplore.exe
Token: SeUndockPrivilege	1288	iexplore.exe
Token: SeManageVolumePrivilege	1288	iexplore.exe
Token: SeImpersonatePrivilege	1288	iexplore.exe
Token: SeCreateGlobalPrivilege	1288	iexplore.exe
Token: 33	1288	iexplore.exe
Token: 34	1288	iexplore.exe
Token: 35	1288	iexplore.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

iexplore.exeEXCEL.EXE

pid process

1288 iexplore.exe
1732 EXCEL.EXE

pid	process
1288	iexplore.exe
1732	EXCEL.EXE

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

329d1b0ef6c7cff38838a20f5dfa682467aa7810db5890bed748d72cc5fc4db3.exe._cache_329d1b0ef6c7cff38838a20f5dfa682467aa7810db5890bed748d72cc5fc4db3.exe

description	pid	process	target process
PID 1156 wrote to memory of 1552	1156	329d1b0ef6c7cff38838a20f5dfa682467aa7810db5890bed748d72cc5fc4db3.exe	._cache_329d1b0ef6c7cff38838a20f5dfa682467aa7810db5890bed748d72cc5fc4db3.exe
PID 1156 wrote to memory of 1552	1156	329d1b0ef6c7cff38838a20f5dfa682467aa7810db5890bed748d72cc5fc4db3.exe	._cache_329d1b0ef6c7cff38838a20f5dfa682467aa7810db5890bed748d72cc5fc4db3.exe
PID 1156 wrote to memory of 1552	1156	329d1b0ef6c7cff38838a20f5dfa682467aa7810db5890bed748d72cc5fc4db3.exe	._cache_329d1b0ef6c7cff38838a20f5dfa682467aa7810db5890bed748d72cc5fc4db3.exe
PID 1156 wrote to memory of 1552	1156	329d1b0ef6c7cff38838a20f5dfa682467aa7810db5890bed748d72cc5fc4db3.exe	._cache_329d1b0ef6c7cff38838a20f5dfa682467aa7810db5890bed748d72cc5fc4db3.exe
PID 1552 wrote to memory of 1288	1552	._cache_329d1b0ef6c7cff38838a20f5dfa682467aa7810db5890bed748d72cc5fc4db3.exe	iexplore.exe
PID 1552 wrote to memory of 1288	1552	._cache_329d1b0ef6c7cff38838a20f5dfa682467aa7810db5890bed748d72cc5fc4db3.exe	iexplore.exe
PID 1552 wrote to memory of 1288	1552	._cache_329d1b0ef6c7cff38838a20f5dfa682467aa7810db5890bed748d72cc5fc4db3.exe	iexplore.exe
PID 1552 wrote to memory of 1288	1552	._cache_329d1b0ef6c7cff38838a20f5dfa682467aa7810db5890bed748d72cc5fc4db3.exe	iexplore.exe
PID 1552 wrote to memory of 1288	1552	._cache_329d1b0ef6c7cff38838a20f5dfa682467aa7810db5890bed748d72cc5fc4db3.exe	iexplore.exe
PID 1552 wrote to memory of 1288	1552	._cache_329d1b0ef6c7cff38838a20f5dfa682467aa7810db5890bed748d72cc5fc4db3.exe	iexplore.exe
PID 1156 wrote to memory of 596	1156	329d1b0ef6c7cff38838a20f5dfa682467aa7810db5890bed748d72cc5fc4db3.exe	Synaptics.exe
PID 1156 wrote to memory of 596	1156	329d1b0ef6c7cff38838a20f5dfa682467aa7810db5890bed748d72cc5fc4db3.exe	Synaptics.exe
PID 1156 wrote to memory of 596	1156	329d1b0ef6c7cff38838a20f5dfa682467aa7810db5890bed748d72cc5fc4db3.exe	Synaptics.exe
PID 1156 wrote to memory of 596	1156	329d1b0ef6c7cff38838a20f5dfa682467aa7810db5890bed748d72cc5fc4db3.exe	Synaptics.exe

C:\Users\Admin\AppData\Local\Temp\329d1b0ef6c7cff38838a20f5dfa682467aa7810db5890bed748d72cc5fc4db3.exe
"C:\Users\Admin\AppData\Local\Temp\329d1b0ef6c7cff38838a20f5dfa682467aa7810db5890bed748d72cc5fc4db3.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1156

C:\Users\Admin\AppData\Local\Temp\._cache_329d1b0ef6c7cff38838a20f5dfa682467aa7810db5890bed748d72cc5fc4db3.exe
"C:\Users\Admin\AppData\Local\Temp\._cache_329d1b0ef6c7cff38838a20f5dfa682467aa7810db5890bed748d72cc5fc4db3.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1552

C:\Program Files (x86)\Internet Explorer\iexplore.exe
"C:\Program Files (x86)\Internet Explorer\iexplore.exe"
3⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1288

C:\ProgramData\Synaptics\Synaptics.exe
"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
2⤵
- Executes dropped EXE
PID:596

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1732

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Query Registry

T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Synaptics\Synaptics.exe
Filesize
939KB

MD5
4431d23847904ab8bd03aa6505ef9012

SHA1
983f6c25926404cb1b8183e8977464f4fed722f0

SHA256
6dc69ae06ba3401d0bc3ebd18f7bc30b9e4f796d1dca85443aeb34c3ac719bbc

SHA512
8de3c5215a16d524221fe5c466b16cc1eadce200f910d2c891611b5a8fdeea963f5134fe918aaa2c9582ff02e2ab39dc7d3b93f87aa5b3724df9dafcb442ae1c

Download Submit
C:\ProgramData\Synaptics\Synaptics.exe
Filesize
939KB

MD5
4431d23847904ab8bd03aa6505ef9012

SHA1
983f6c25926404cb1b8183e8977464f4fed722f0

SHA256
6dc69ae06ba3401d0bc3ebd18f7bc30b9e4f796d1dca85443aeb34c3ac719bbc

SHA512
8de3c5215a16d524221fe5c466b16cc1eadce200f910d2c891611b5a8fdeea963f5134fe918aaa2c9582ff02e2ab39dc7d3b93f87aa5b3724df9dafcb442ae1c

Download Submit
C:\Users\Admin\AppData\Local\Temp\._cache_329d1b0ef6c7cff38838a20f5dfa682467aa7810db5890bed748d72cc5fc4db3.exe
Filesize
658KB

MD5
bfa2581d641f24ca24afecf3d3178ba7

SHA1
1081171c77907bfb8acc2a95aed78be91301479d

SHA256
384995b54f58b56e7b24e9448250f377c08e181866e9af6d0cda5eb37976f37a

SHA512
63c37e4cf07e0a14b3cce8d1a80183c85089e26bedc2c7e0ec35583355ddd392ecb21ec08a180e2c47942497827e96f4992f97606163f17a2ca561ccb6bdc2ef

Download Submit
C:\Users\Admin\AppData\Local\Temp\._cache_329d1b0ef6c7cff38838a20f5dfa682467aa7810db5890bed748d72cc5fc4db3.exe
Filesize
658KB

MD5
bfa2581d641f24ca24afecf3d3178ba7

SHA1
1081171c77907bfb8acc2a95aed78be91301479d

SHA256
384995b54f58b56e7b24e9448250f377c08e181866e9af6d0cda5eb37976f37a

SHA512
63c37e4cf07e0a14b3cce8d1a80183c85089e26bedc2c7e0ec35583355ddd392ecb21ec08a180e2c47942497827e96f4992f97606163f17a2ca561ccb6bdc2ef

Download Submit
C:\Users\Admin\AppData\Local\Temp\LcBAoV2c.xlsm
Filesize
17KB

MD5
e566fc53051035e1e6fd0ed1823de0f9

SHA1
00bc96c48b98676ecd67e81a6f1d7754e4156044

SHA256
8e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15

SHA512
a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04

Download Submit
\ProgramData\Synaptics\Synaptics.exe
Filesize
939KB

MD5
4431d23847904ab8bd03aa6505ef9012

SHA1
983f6c25926404cb1b8183e8977464f4fed722f0

SHA256
6dc69ae06ba3401d0bc3ebd18f7bc30b9e4f796d1dca85443aeb34c3ac719bbc

SHA512
8de3c5215a16d524221fe5c466b16cc1eadce200f910d2c891611b5a8fdeea963f5134fe918aaa2c9582ff02e2ab39dc7d3b93f87aa5b3724df9dafcb442ae1c

Download Submit
\ProgramData\Synaptics\Synaptics.exe
Filesize
939KB

MD5
4431d23847904ab8bd03aa6505ef9012

SHA1
983f6c25926404cb1b8183e8977464f4fed722f0

SHA256
6dc69ae06ba3401d0bc3ebd18f7bc30b9e4f796d1dca85443aeb34c3ac719bbc

SHA512
8de3c5215a16d524221fe5c466b16cc1eadce200f910d2c891611b5a8fdeea963f5134fe918aaa2c9582ff02e2ab39dc7d3b93f87aa5b3724df9dafcb442ae1c

Download Submit
\Users\Admin\AppData\Local\Temp\._cache_329d1b0ef6c7cff38838a20f5dfa682467aa7810db5890bed748d72cc5fc4db3.exe
Filesize
658KB

MD5
bfa2581d641f24ca24afecf3d3178ba7

SHA1
1081171c77907bfb8acc2a95aed78be91301479d

SHA256
384995b54f58b56e7b24e9448250f377c08e181866e9af6d0cda5eb37976f37a

SHA512
63c37e4cf07e0a14b3cce8d1a80183c85089e26bedc2c7e0ec35583355ddd392ecb21ec08a180e2c47942497827e96f4992f97606163f17a2ca561ccb6bdc2ef

Download Submit
\Users\Admin\AppData\Local\Temp\._cache_329d1b0ef6c7cff38838a20f5dfa682467aa7810db5890bed748d72cc5fc4db3.exe
Filesize
658KB

MD5
bfa2581d641f24ca24afecf3d3178ba7

SHA1
1081171c77907bfb8acc2a95aed78be91301479d

SHA256
384995b54f58b56e7b24e9448250f377c08e181866e9af6d0cda5eb37976f37a

SHA512
63c37e4cf07e0a14b3cce8d1a80183c85089e26bedc2c7e0ec35583355ddd392ecb21ec08a180e2c47942497827e96f4992f97606163f17a2ca561ccb6bdc2ef

Download Submit
memory/596-63-0x0000000000000000-mapping.dmp

Download
memory/1156-54-0x0000000074F91000-0x0000000074F93000-memory.dmp

Filesize
8KB

Download
memory/1552-57-0x0000000000000000-mapping.dmp

Download
memory/1732-71-0x0000000071EAD000-0x0000000071EB8000-memory.dmp

Filesize
44KB

Download
memory/1732-81-0x00000000007F6000-0x00000000007FC000-memory.dmp

Filesize
24KB

Download
memory/1732-67-0x0000000070EC1000-0x0000000070EC3000-memory.dmp

Filesize
8KB

Download
memory/1732-75-0x00000000007F6000-0x00000000007FC000-memory.dmp

Filesize
24KB

Download
memory/1732-74-0x00000000007F6000-0x00000000007FC000-memory.dmp

Filesize
24KB

Download
memory/1732-83-0x00000000007F6000-0x00000000007FC000-memory.dmp

Filesize
24KB

Download
memory/1732-82-0x00000000007F6000-0x00000000007FC000-memory.dmp

Filesize
24KB

Download
memory/1732-68-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/1732-80-0x00000000007F6000-0x00000000007FC000-memory.dmp

Filesize
24KB

Download
memory/1732-79-0x00000000007F6000-0x00000000007FC000-memory.dmp

Filesize
24KB

Download
memory/1732-78-0x00000000007F6000-0x00000000007FC000-memory.dmp

Filesize
24KB

Download
memory/1732-77-0x00000000007F6000-0x00000000007FC000-memory.dmp

Filesize
24KB

Download
memory/1732-76-0x00000000007F6000-0x00000000007FC000-memory.dmp

Filesize
24KB

Download
memory/1732-73-0x00000000007F6000-0x00000000007FC000-memory.dmp

Filesize
24KB

Download
memory/1732-72-0x00000000007F6000-0x00000000007FC000-memory.dmp

Filesize
24KB

Download
memory/1732-66-0x000000002FE11000-0x000000002FE14000-memory.dmp

Filesize
12KB

Download