Analysis
-
max time kernel
504s -
max time network
510s -
platform
windows10-2004_x64 -
resource
win10v2004-20220721-en -
resource tags
arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system -
submitted
06-08-2022 06:30
Static task
static1
Behavioral task
behavioral1
Sample
Download-07-04-19.html
Resource
win7-20220718-en
Behavioral task
behavioral2
Sample
Download-07-04-19.html
Resource
win10v2004-20220721-en
General
-
Target
Download-07-04-19.html
-
Size
6KB
-
MD5
fdf285faa9ebb125f479f9dcaa460bed
-
SHA1
11d5c8b9ec3316079eb03b4537d6c7c14726c7ac
-
SHA256
72a5c757284def375d51e6b90aea5df9ad99d1b7765029ab19a485c8f59dc903
-
SHA512
7c9f27a8e89713445f51a484ed6f8fb9fc40d15de9ce69a279e4e64a3dc2b121e6e3980f58b1d8f7cf94d4701695eaa356288e87c0570f1010158a8951d06dd0
Malware Config
Extracted
raccoon
8f4e4706e9b4e3a904862901d32e2123
http://78.159.97.21/
http://78.159.103.195
http://78.159.103.196
Signatures
-
Raccoon Stealer payload 14 IoCs
Processes:
resource yara_rule behavioral2/memory/5956-132-0x0000000000180000-0x0000000000C2B000-memory.dmp family_raccoon behavioral2/memory/5956-133-0x0000000000180000-0x0000000000C2B000-memory.dmp family_raccoon behavioral2/memory/5956-135-0x0000000000180000-0x0000000000C2B000-memory.dmp family_raccoon behavioral2/memory/5956-136-0x0000000000180000-0x0000000000C2B000-memory.dmp family_raccoon behavioral2/memory/5580-137-0x0000000000180000-0x0000000000C2B000-memory.dmp family_raccoon behavioral2/memory/5580-139-0x0000000000180000-0x0000000000C2B000-memory.dmp family_raccoon behavioral2/memory/648-140-0x0000000000180000-0x0000000000C2B000-memory.dmp family_raccoon behavioral2/memory/648-142-0x0000000000180000-0x0000000000C2B000-memory.dmp family_raccoon behavioral2/memory/6772-143-0x0000000000180000-0x0000000000C2B000-memory.dmp family_raccoon behavioral2/memory/6772-145-0x0000000000180000-0x0000000000C2B000-memory.dmp family_raccoon behavioral2/memory/6492-146-0x0000000000180000-0x0000000000C2B000-memory.dmp family_raccoon behavioral2/memory/6492-148-0x0000000000180000-0x0000000000C2B000-memory.dmp family_raccoon behavioral2/memory/6492-149-0x0000000000180000-0x0000000000C2B000-memory.dmp family_raccoon behavioral2/memory/5580-150-0x0000000000180000-0x0000000000C2B000-memory.dmp family_raccoon -
Suspicious use of NtSetInformationThreadHideFromDebugger 10 IoCs
Processes:
launch.exelaunch.exelaunch.exelaunch.exelaunch.exepid process 5956 launch.exe 5956 launch.exe 5580 launch.exe 5580 launch.exe 648 launch.exe 648 launch.exe 6772 launch.exe 6772 launch.exe 6492 launch.exe 6492 launch.exe -
Checks processor information in registry 2 TTPs 5 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
firefox.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe -
Processes:
IEXPLORE.EXEiexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3757183288" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\mega.nz\NumberOfSubdomains = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\Software\Microsoft\Internet Explorer\IESettingSync IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30976366" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\Software\Microsoft\Internet Explorer\IESettingSync IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 4093fdd26ea9d801 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3757183288" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "366539612" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\mega.nz\ = "65" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30976366" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "65" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3816668758" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30976366" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000094c858eae3d57f4bbeeb69290716aab40000000002000000000010660000000100002000000043931a10442926ab1cd4ac2524ce9cc4bbc198956740a3541f5acdf2dcf31f0c000000000e80000000020000200000003b50f2616dbf800fb890eb85aff7d1891a508df73b43bc1b3e6b952f1b62b1c0200000009cf0287347af795652981a292d59584a50b762fca66d470b15b3514f7bb8d8fb400000000ce4be72d921e14f37a13d3f2888b78e4198fc460219d486da266da9d2fa8fca9d487b2232679c19d1fc71a3ca2aa4995083ccad4bf76d9c566bb56cbfba4f24 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\mega.nz IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30976366" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3789523528" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\Software\Microsoft\Internet Explorer\DOMStorage\mega.nz IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{0B8809C7-1562-11ED-B78D-6ACBA7CB7325} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\mega.nz\Total = "65" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe -
Modifies registry class 1 IoCs
Processes:
firefox.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000_Classes\Local Settings firefox.exe -
NTFS ADS 1 IoCs
Processes:
firefox.exedescription ioc process File created C:\Users\Admin\AppData\Local\Temp\Software.zip:Zone.Identifier firefox.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
launch.exelaunch.exelaunch.exelaunch.exelaunch.exepid process 5956 launch.exe 5956 launch.exe 5580 launch.exe 5580 launch.exe 648 launch.exe 648 launch.exe 6772 launch.exe 6772 launch.exe 6492 launch.exe 6492 launch.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
firefox.exedescription pid process Token: SeDebugPrivilege 3096 firefox.exe Token: SeDebugPrivilege 3096 firefox.exe Token: SeDebugPrivilege 3096 firefox.exe -
Suspicious use of FindShellTrayWindow 11 IoCs
Processes:
iexplore.exefirefox.exeIEXPLORE.EXEpid process 3008 iexplore.exe 3096 firefox.exe 3096 firefox.exe 3096 firefox.exe 3096 firefox.exe 4480 IEXPLORE.EXE 4480 IEXPLORE.EXE 4480 IEXPLORE.EXE 4480 IEXPLORE.EXE 3096 firefox.exe 3096 firefox.exe -
Suspicious use of SendNotifyMessage 9 IoCs
Processes:
firefox.exeIEXPLORE.EXEpid process 3096 firefox.exe 3096 firefox.exe 3096 firefox.exe 4480 IEXPLORE.EXE 4480 IEXPLORE.EXE 4480 IEXPLORE.EXE 4480 IEXPLORE.EXE 3096 firefox.exe 3096 firefox.exe -
Suspicious use of SetWindowsHookEx 12 IoCs
Processes:
iexplore.exeIEXPLORE.EXEIEXPLORE.EXEfirefox.exepid process 3008 iexplore.exe 3008 iexplore.exe 4480 IEXPLORE.EXE 4480 IEXPLORE.EXE 1508 IEXPLORE.EXE 1508 IEXPLORE.EXE 4480 IEXPLORE.EXE 4480 IEXPLORE.EXE 3096 firefox.exe 3096 firefox.exe 3096 firefox.exe 3096 firefox.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
iexplore.exefirefox.exefirefox.exedescription pid process target process PID 3008 wrote to memory of 4480 3008 iexplore.exe IEXPLORE.EXE PID 3008 wrote to memory of 4480 3008 iexplore.exe IEXPLORE.EXE PID 3008 wrote to memory of 4480 3008 iexplore.exe IEXPLORE.EXE PID 3008 wrote to memory of 1508 3008 iexplore.exe IEXPLORE.EXE PID 3008 wrote to memory of 1508 3008 iexplore.exe IEXPLORE.EXE PID 3008 wrote to memory of 1508 3008 iexplore.exe IEXPLORE.EXE PID 4832 wrote to memory of 3096 4832 firefox.exe firefox.exe PID 4832 wrote to memory of 3096 4832 firefox.exe firefox.exe PID 4832 wrote to memory of 3096 4832 firefox.exe firefox.exe PID 4832 wrote to memory of 3096 4832 firefox.exe firefox.exe PID 4832 wrote to memory of 3096 4832 firefox.exe firefox.exe PID 4832 wrote to memory of 3096 4832 firefox.exe firefox.exe PID 4832 wrote to memory of 3096 4832 firefox.exe firefox.exe PID 4832 wrote to memory of 3096 4832 firefox.exe firefox.exe PID 4832 wrote to memory of 3096 4832 firefox.exe firefox.exe PID 3096 wrote to memory of 4844 3096 firefox.exe firefox.exe PID 3096 wrote to memory of 4844 3096 firefox.exe firefox.exe PID 3096 wrote to memory of 3272 3096 firefox.exe firefox.exe PID 3096 wrote to memory of 3272 3096 firefox.exe firefox.exe PID 3096 wrote to memory of 3272 3096 firefox.exe firefox.exe PID 3096 wrote to memory of 3272 3096 firefox.exe firefox.exe PID 3096 wrote to memory of 3272 3096 firefox.exe firefox.exe PID 3096 wrote to memory of 3272 3096 firefox.exe firefox.exe PID 3096 wrote to memory of 3272 3096 firefox.exe firefox.exe PID 3096 wrote to memory of 3272 3096 firefox.exe firefox.exe PID 3096 wrote to memory of 3272 3096 firefox.exe firefox.exe PID 3096 wrote to memory of 3272 3096 firefox.exe firefox.exe PID 3096 wrote to memory of 3272 3096 firefox.exe firefox.exe PID 3096 wrote to memory of 3272 3096 firefox.exe firefox.exe PID 3096 wrote to memory of 3272 3096 firefox.exe firefox.exe PID 3096 wrote to memory of 3272 3096 firefox.exe firefox.exe PID 3096 wrote to memory of 3272 3096 firefox.exe firefox.exe PID 3096 wrote to memory of 3272 3096 firefox.exe firefox.exe PID 3096 wrote to memory of 3272 3096 firefox.exe firefox.exe PID 3096 wrote to memory of 3272 3096 firefox.exe firefox.exe PID 3096 wrote to memory of 3272 3096 firefox.exe firefox.exe PID 3096 wrote to memory of 3272 3096 firefox.exe firefox.exe PID 3096 wrote to memory of 3272 3096 firefox.exe firefox.exe PID 3096 wrote to memory of 3272 3096 firefox.exe firefox.exe PID 3096 wrote to memory of 3272 3096 firefox.exe firefox.exe PID 3096 wrote to memory of 3272 3096 firefox.exe firefox.exe PID 3096 wrote to memory of 3272 3096 firefox.exe firefox.exe PID 3096 wrote to memory of 3272 3096 firefox.exe firefox.exe PID 3096 wrote to memory of 3272 3096 firefox.exe firefox.exe PID 3096 wrote to memory of 3272 3096 firefox.exe firefox.exe PID 3096 wrote to memory of 3272 3096 firefox.exe firefox.exe PID 3096 wrote to memory of 3272 3096 firefox.exe firefox.exe PID 3096 wrote to memory of 3272 3096 firefox.exe firefox.exe PID 3096 wrote to memory of 3272 3096 firefox.exe firefox.exe PID 3096 wrote to memory of 3272 3096 firefox.exe firefox.exe PID 3096 wrote to memory of 3272 3096 firefox.exe firefox.exe PID 3096 wrote to memory of 3272 3096 firefox.exe firefox.exe PID 3096 wrote to memory of 3272 3096 firefox.exe firefox.exe PID 3096 wrote to memory of 3272 3096 firefox.exe firefox.exe PID 3096 wrote to memory of 3272 3096 firefox.exe firefox.exe PID 3096 wrote to memory of 3272 3096 firefox.exe firefox.exe PID 3096 wrote to memory of 3272 3096 firefox.exe firefox.exe PID 3096 wrote to memory of 3272 3096 firefox.exe firefox.exe PID 3096 wrote to memory of 3272 3096 firefox.exe firefox.exe PID 3096 wrote to memory of 3272 3096 firefox.exe firefox.exe PID 3096 wrote to memory of 5384 3096 firefox.exe firefox.exe PID 3096 wrote to memory of 5384 3096 firefox.exe firefox.exe PID 3096 wrote to memory of 5384 3096 firefox.exe firefox.exe PID 3096 wrote to memory of 5384 3096 firefox.exe firefox.exe
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\Download-07-04-19.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3008 CREDAT:17410 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3008 CREDAT:17412 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"2⤵
- Checks processor information in registry
- Modifies registry class
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3096.0.1937883635\220280769" -parentBuildID 20200403170909 -prefsHandle 1720 -prefMapHandle 1608 -prefsLen 1 -prefMapSize 220117 -appdir "C:\Program Files\Mozilla Firefox\browser" - 3096 "\\.\pipe\gecko-crash-server-pipe.3096" 1800 gpu3⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3096.3.1595932548\941868320" -childID 1 -isForBrowser -prefsHandle 2416 -prefMapHandle 2448 -prefsLen 78 -prefMapSize 220117 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 3096 "\\.\pipe\gecko-crash-server-pipe.3096" 2372 tab3⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3096.13.949966046\1658813602" -childID 2 -isForBrowser -prefsHandle 3624 -prefMapHandle 1552 -prefsLen 6860 -prefMapSize 220117 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 3096 "\\.\pipe\gecko-crash-server-pipe.3096" 3432 tab3⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Users\Admin\Desktop\Software\launch.exe"C:\Users\Admin\Desktop\Software\launch.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\Desktop\Software\launch.exe"C:\Users\Admin\Desktop\Software\launch.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\Desktop\Software\launch.exe"C:\Users\Admin\Desktop\Software\launch.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\Desktop\Software\launch.exe"C:\Users\Admin\Desktop\Software\launch.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\Desktop\Software\launch.exe"C:\Users\Admin\Desktop\Software\launch.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\kt9o6s3\imagestore.datFilesize
6KB
MD5dabf618b49ecb74e4c523b73123806e0
SHA19eec0152786ff5495f6d7cf887eeb0fb6d2c148a
SHA2561e9ca63ff58189f410daafc2819830e6ce2e83fd1f0ca223added213bb3a8e37
SHA5127cfd301f6a37ba8c8174241cc440f3ac5fe356559e40e23bfa4afc9ab15151d45c70a78c1204fc046d5499db7331ee81844a226033687fc176568b70a5dff5a1
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\0S6OBVY5\favicon[1].icoFilesize
6KB
MD572f13fa5f987ea923a68a818d38fb540
SHA1f014620d35787fcfdef193c20bb383f5655b9e1e
SHA25637127c1a29c164cdaa75ec72ae685094c2468fe0577f743cb1f307d23dd35ec1
SHA512b66af0b6b95560c20584ed033547235d5188981a092131a7c1749926ba1ac208266193bd7fa8a3403a39eee23fcdd53580e9533803d7f52df5fb01d508e292b3
-
memory/648-142-0x0000000000180000-0x0000000000C2B000-memory.dmpFilesize
10.7MB
-
memory/648-140-0x0000000000180000-0x0000000000C2B000-memory.dmpFilesize
10.7MB
-
memory/5580-139-0x0000000000180000-0x0000000000C2B000-memory.dmpFilesize
10.7MB
-
memory/5580-150-0x0000000000180000-0x0000000000C2B000-memory.dmpFilesize
10.7MB
-
memory/5580-137-0x0000000000180000-0x0000000000C2B000-memory.dmpFilesize
10.7MB
-
memory/5956-135-0x0000000000180000-0x0000000000C2B000-memory.dmpFilesize
10.7MB
-
memory/5956-136-0x0000000000180000-0x0000000000C2B000-memory.dmpFilesize
10.7MB
-
memory/5956-133-0x0000000000180000-0x0000000000C2B000-memory.dmpFilesize
10.7MB
-
memory/5956-132-0x0000000000180000-0x0000000000C2B000-memory.dmpFilesize
10.7MB
-
memory/6492-146-0x0000000000180000-0x0000000000C2B000-memory.dmpFilesize
10.7MB
-
memory/6492-148-0x0000000000180000-0x0000000000C2B000-memory.dmpFilesize
10.7MB
-
memory/6492-149-0x0000000000180000-0x0000000000C2B000-memory.dmpFilesize
10.7MB
-
memory/6772-143-0x0000000000180000-0x0000000000C2B000-memory.dmpFilesize
10.7MB
-
memory/6772-145-0x0000000000180000-0x0000000000C2B000-memory.dmpFilesize
10.7MB