Analysis
-
max time kernel
150s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20220715-en -
resource tags
arch:x64arch:x86image:win7-20220715-enlocale:en-usos:windows7-x64system -
submitted
09-08-2022 11:59
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://107.182.129.251/download/Service.exe
Resource
win7-20220715-en
General
Malware Config
Extracted
privateloader
http://163.123.143.4/proxies.txt
http://107.182.129.251/server.txt
pastebin.com/raw/A7dSG1te
http://wfsdragon.ru/api/setStats.php
163.123.143.12
http://91.241.19.125/pub.php?pub=one
http://sarfoods.com/index.php
-
payload_url
https://vipsofts.xyz/files/mega.bmp
Signatures
-
Processes:
W0CQNhLKUfdoD11k1NyLd2Hl.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" W0CQNhLKUfdoD11k1NyLd2Hl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRawWriteNotification = "1" W0CQNhLKUfdoD11k1NyLd2Hl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection W0CQNhLKUfdoD11k1NyLd2Hl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" W0CQNhLKUfdoD11k1NyLd2Hl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" W0CQNhLKUfdoD11k1NyLd2Hl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" W0CQNhLKUfdoD11k1NyLd2Hl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" W0CQNhLKUfdoD11k1NyLd2Hl.exe -
PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
-
Downloads MZ/PE file
-
Executes dropped EXE 3 IoCs
Processes:
Service.exeW0CQNhLKUfdoD11k1NyLd2Hl.exeNiceProcessX64.bmp.exepid process 1916 Service.exe 868 W0CQNhLKUfdoD11k1NyLd2Hl.exe 1592 NiceProcessX64.bmp.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
W0CQNhLKUfdoD11k1NyLd2Hl.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Control Panel\International\Geo\Nation W0CQNhLKUfdoD11k1NyLd2Hl.exe -
Loads dropped DLL 7 IoCs
Processes:
Service.exeW0CQNhLKUfdoD11k1NyLd2Hl.exeWerFault.exepid process 1916 Service.exe 868 W0CQNhLKUfdoD11k1NyLd2Hl.exe 1536 WerFault.exe 1536 WerFault.exe 1536 WerFault.exe 1536 WerFault.exe 1536 WerFault.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 35 ipinfo.io 16 ipinfo.io 17 ipinfo.io -
Drops file in Program Files directory 2 IoCs
Processes:
Service.exedescription ioc process File created C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe Service.exe File opened for modification C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe Service.exe -
Drops file in Windows directory 2 IoCs
Processes:
iexplore.exedescription ioc process File opened for modification \??\c:\windows\installer\{ac76ba86-7ad7-1033-7b44-a90000000001}\sc_reader.exe iexplore.exe File opened for modification C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-A90000000001}\SC_Reader.exe iexplore.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1536 868 WerFault.exe W0CQNhLKUfdoD11k1NyLd2Hl.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Modifies Internet Explorer Phishing Filter 1 TTPs 2 IoCs
Processes:
iexplore.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\PhishingFilter iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\PhishingFilter\ClientSupported_MigrationTime = 406e7e92e7abd801 iexplore.exe -
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e528c10875d4b347a30c038b2e32007f000000000200000000001066000000010000200000008d22d1b4cfba4294ea81315faa5564b774fa5a939147aa59ae7db8272d59278f000000000e800000000200002000000043bb18c482d856df1289070b6f7dcf0f9eda2b5fe207f237b30b291a89530a2b200000001c4ad35ba9b2449c10a7605d2e2dcc90b870cc648a01d47bf55fbb9cc42f6eb94000000050382ae681958560d7bb248729c162e80b0de466a4583f92753ccf1120f487c1f50892ccbfdf786de02e39998470992b7e8d402f7c3c0652f7298390ac357e52 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CB007E71-17DA-11ED-8D3D-CE76330CF053} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "366811374" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80ccc3a4e7abd801 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e528c10875d4b347a30c038b2e32007f0000000002000000000010660000000100002000000002a8e3f9ccf248e80aa3481a97fb57a44c9c0f26c7207aaddbf8e5650106b97b000000000e8000000002000020000000593de5d727255df775564ed4521194887dfa5ee777d90a0592099be8f5c8e63d90000000967b26c20f1570a389063dcaabcbe03964425f2c41c7379cad2327e5d2041d9f8ca50be71854b3513f39c69f1e631986a22858597825e3196f94b38c37abec982a8be3bb5c8f630820af8bfc4dcbdfb6da0798f1011167bf620f1890fd3bcedfdcd29582aad6832408a0142100e16c3a40b492d4864f44486a42520e3b1f480f798044256d0ecab9b179b60aafee9a7e40000000e1d5cfdc0b0a648857627f68a7a9b82689f811def449fc1bf25eb89ce517779dd6c00fa4e76de412f7b6850e7a61d247d1c0e8a2ef164d06c58b800eb52434c2 iexplore.exe -
Modifies registry class 48 IoCs
Processes:
iexplore.exedescription ioc process Set value (data) \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a000000a000000030f125b7ef471a10a5f102608c9eebac0c00000050000000a66a63283d95d211b5d600c04fd918d00b0000007800000030f125b7ef471a10a5f102608c9eebac0e00000078000000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 200000001a00eebbfe230000100090e24d373f126545916439c4925e467b00000000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlot = "2" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\KnownFolderDerivedFolderType = "{57807898-8C4F-4462-BB63-71042380B109}" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7} iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000007800000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "48" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f44471a0359723fa74489c55595fe6b30ee0000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7} iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "2" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "6" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000_Classes\Local Settings iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags iexplore.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
W0CQNhLKUfdoD11k1NyLd2Hl.exeNiceProcessX64.bmp.exepid process 868 W0CQNhLKUfdoD11k1NyLd2Hl.exe 868 W0CQNhLKUfdoD11k1NyLd2Hl.exe 868 W0CQNhLKUfdoD11k1NyLd2Hl.exe 868 W0CQNhLKUfdoD11k1NyLd2Hl.exe 1592 NiceProcessX64.bmp.exe 1592 NiceProcessX64.bmp.exe 1592 NiceProcessX64.bmp.exe 1592 NiceProcessX64.bmp.exe 1592 NiceProcessX64.bmp.exe 1592 NiceProcessX64.bmp.exe 1592 NiceProcessX64.bmp.exe 1592 NiceProcessX64.bmp.exe 1592 NiceProcessX64.bmp.exe 1592 NiceProcessX64.bmp.exe 1592 NiceProcessX64.bmp.exe 1592 NiceProcessX64.bmp.exe 1592 NiceProcessX64.bmp.exe 1592 NiceProcessX64.bmp.exe 1592 NiceProcessX64.bmp.exe 1592 NiceProcessX64.bmp.exe 1592 NiceProcessX64.bmp.exe 1592 NiceProcessX64.bmp.exe 1592 NiceProcessX64.bmp.exe 1592 NiceProcessX64.bmp.exe 1592 NiceProcessX64.bmp.exe 1592 NiceProcessX64.bmp.exe 1592 NiceProcessX64.bmp.exe 1592 NiceProcessX64.bmp.exe 1592 NiceProcessX64.bmp.exe 1592 NiceProcessX64.bmp.exe 1592 NiceProcessX64.bmp.exe 1592 NiceProcessX64.bmp.exe 1592 NiceProcessX64.bmp.exe 1592 NiceProcessX64.bmp.exe 1592 NiceProcessX64.bmp.exe 1592 NiceProcessX64.bmp.exe 1592 NiceProcessX64.bmp.exe 1592 NiceProcessX64.bmp.exe 1592 NiceProcessX64.bmp.exe 1592 NiceProcessX64.bmp.exe 1592 NiceProcessX64.bmp.exe 1592 NiceProcessX64.bmp.exe 1592 NiceProcessX64.bmp.exe 1592 NiceProcessX64.bmp.exe 1592 NiceProcessX64.bmp.exe 1592 NiceProcessX64.bmp.exe 1592 NiceProcessX64.bmp.exe 1592 NiceProcessX64.bmp.exe 1592 NiceProcessX64.bmp.exe 1592 NiceProcessX64.bmp.exe 1592 NiceProcessX64.bmp.exe 1592 NiceProcessX64.bmp.exe 1592 NiceProcessX64.bmp.exe 1592 NiceProcessX64.bmp.exe 1592 NiceProcessX64.bmp.exe 1592 NiceProcessX64.bmp.exe 1592 NiceProcessX64.bmp.exe 1592 NiceProcessX64.bmp.exe 1592 NiceProcessX64.bmp.exe 1592 NiceProcessX64.bmp.exe 1592 NiceProcessX64.bmp.exe 1592 NiceProcessX64.bmp.exe 1592 NiceProcessX64.bmp.exe 1592 NiceProcessX64.bmp.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
iexplore.exepid process 1940 iexplore.exe 1940 iexplore.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 1940 iexplore.exe 1940 iexplore.exe 816 IEXPLORE.EXE 816 IEXPLORE.EXE 1940 iexplore.exe -
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
iexplore.exeService.exeW0CQNhLKUfdoD11k1NyLd2Hl.exedescription pid process target process PID 1940 wrote to memory of 816 1940 iexplore.exe IEXPLORE.EXE PID 1940 wrote to memory of 816 1940 iexplore.exe IEXPLORE.EXE PID 1940 wrote to memory of 816 1940 iexplore.exe IEXPLORE.EXE PID 1940 wrote to memory of 816 1940 iexplore.exe IEXPLORE.EXE PID 1916 wrote to memory of 868 1916 Service.exe W0CQNhLKUfdoD11k1NyLd2Hl.exe PID 1916 wrote to memory of 868 1916 Service.exe W0CQNhLKUfdoD11k1NyLd2Hl.exe PID 1916 wrote to memory of 868 1916 Service.exe W0CQNhLKUfdoD11k1NyLd2Hl.exe PID 1916 wrote to memory of 868 1916 Service.exe W0CQNhLKUfdoD11k1NyLd2Hl.exe PID 1916 wrote to memory of 824 1916 Service.exe schtasks.exe PID 1916 wrote to memory of 824 1916 Service.exe schtasks.exe PID 1916 wrote to memory of 824 1916 Service.exe schtasks.exe PID 1916 wrote to memory of 824 1916 Service.exe schtasks.exe PID 1916 wrote to memory of 1636 1916 Service.exe schtasks.exe PID 1916 wrote to memory of 1636 1916 Service.exe schtasks.exe PID 1916 wrote to memory of 1636 1916 Service.exe schtasks.exe PID 1916 wrote to memory of 1636 1916 Service.exe schtasks.exe PID 868 wrote to memory of 1592 868 W0CQNhLKUfdoD11k1NyLd2Hl.exe NiceProcessX64.bmp.exe PID 868 wrote to memory of 1592 868 W0CQNhLKUfdoD11k1NyLd2Hl.exe NiceProcessX64.bmp.exe PID 868 wrote to memory of 1592 868 W0CQNhLKUfdoD11k1NyLd2Hl.exe NiceProcessX64.bmp.exe PID 868 wrote to memory of 1592 868 W0CQNhLKUfdoD11k1NyLd2Hl.exe NiceProcessX64.bmp.exe PID 868 wrote to memory of 1536 868 W0CQNhLKUfdoD11k1NyLd2Hl.exe WerFault.exe PID 868 wrote to memory of 1536 868 W0CQNhLKUfdoD11k1NyLd2Hl.exe WerFault.exe PID 868 wrote to memory of 1536 868 W0CQNhLKUfdoD11k1NyLd2Hl.exe WerFault.exe PID 868 wrote to memory of 1536 868 W0CQNhLKUfdoD11k1NyLd2Hl.exe WerFault.exe
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://107.182.129.251/download/Service.exe1⤵
- Drops file in Windows directory
- Modifies Internet Explorer Phishing Filter
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1940 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Desktop\Service.exe"C:\Users\Admin\Desktop\Service.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\Documents\W0CQNhLKUfdoD11k1NyLd2Hl.exe"C:\Users\Admin\Documents\W0CQNhLKUfdoD11k1NyLd2Hl.exe"2⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Pictures\Adobe Films\NiceProcessX64.bmp.exe"C:\Users\Admin\Pictures\Adobe Films\NiceProcessX64.bmp.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 868 -s 10643⤵
- Loads dropped DLL
- Program crash
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST2⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
340B
MD57ac92f3ba3f48b63cc16992738ac4775
SHA1bf2cbf6f1a5c3a611e56612745d820b820fcb3fe
SHA25640ea005127018330eb326cb50f504b45273b9b357d8883fbb748b90fb6da36b8
SHA512b2a19216cff3d34b8169729eaeb1f3e0c33cf5173a7ac53afaf959a39d1986f54a5e2d8010d065d60feeaf477576d77405919fec5ebadff43f4eaefa1519acd7
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\VMK55C73.txtFilesize
606B
MD52afce85eb2d98e8a736ea9d6d24f0a86
SHA18b4a394851b53130b531df6226777a1362d5633c
SHA256c914cf4609649f3518125cc519475e45bc33979c92a7541643100659c105f234
SHA51288cee7778cd98a9dbe5cc55d96a1134b9ff99093200d5153dd60dcd8642a8ebfec0530d36491e7e7641ab8fb502dc6eb675e9e8a5223ce548e6a22bdc69cad02
-
C:\Users\Admin\Desktop\Service.exeFilesize
400KB
MD59519c85c644869f182927d93e8e25a33
SHA1eadc9026e041f7013056f80e068ecf95940ea060
SHA256f0dc8fa1a18901ac46f4448e434c3885a456865a3a309840a1c4ac67fd56895b
SHA512dcc1dd25bba19aaf75ec4a1a69dc215eb519e9ee3b8f7b1bd16164b736b3aa81389c076ed4e8a17a1cbfaec2e0b3155df039d1bca3c7186cfeb9950369bccf23
-
C:\Users\Admin\Desktop\Service.exe.hiwj2me.partialFilesize
400KB
MD59519c85c644869f182927d93e8e25a33
SHA1eadc9026e041f7013056f80e068ecf95940ea060
SHA256f0dc8fa1a18901ac46f4448e434c3885a456865a3a309840a1c4ac67fd56895b
SHA512dcc1dd25bba19aaf75ec4a1a69dc215eb519e9ee3b8f7b1bd16164b736b3aa81389c076ed4e8a17a1cbfaec2e0b3155df039d1bca3c7186cfeb9950369bccf23
-
C:\Users\Admin\Documents\W0CQNhLKUfdoD11k1NyLd2Hl.exeFilesize
351KB
MD5312ad3b67a1f3a75637ea9297df1cedb
SHA17d922b102a52241d28f1451d3542db12b0265b75
SHA2563b4c1d0a112668872c1d4f9c9d76087a2afe7a8281a6cb6b972c95fb2f4eb28e
SHA512848db7d47dc37a9025e3df0dda4fbf1c84d9a9191febae38621d9c9b09342a987ff0587108cccfd874cb900c88c5f9f9ca0548f3027f6515ed85c92fd26f8515
-
C:\Users\Admin\Documents\W0CQNhLKUfdoD11k1NyLd2Hl.exeFilesize
351KB
MD5312ad3b67a1f3a75637ea9297df1cedb
SHA17d922b102a52241d28f1451d3542db12b0265b75
SHA2563b4c1d0a112668872c1d4f9c9d76087a2afe7a8281a6cb6b972c95fb2f4eb28e
SHA512848db7d47dc37a9025e3df0dda4fbf1c84d9a9191febae38621d9c9b09342a987ff0587108cccfd874cb900c88c5f9f9ca0548f3027f6515ed85c92fd26f8515
-
C:\Users\Admin\Pictures\Adobe Films\NiceProcessX64.bmp.exeFilesize
318KB
MD53f22bd82ee1b38f439e6354c60126d6d
SHA163b57d818f86ea64ebc8566faeb0c977839defde
SHA256265c2ddc8a21e6fa8dfaa38ef0e77df8a2e98273a1abfb575aef93c0cc8ee96a
SHA512b73e8e17e5e99d0e9edfb690ece8b0c15befb4d48b1c4f2fe77c5e3daf01df35858c06e1403a8636f86363708b80123d12122cb821a86b575b184227c760988f
-
\Users\Admin\Documents\W0CQNhLKUfdoD11k1NyLd2Hl.exeFilesize
351KB
MD5312ad3b67a1f3a75637ea9297df1cedb
SHA17d922b102a52241d28f1451d3542db12b0265b75
SHA2563b4c1d0a112668872c1d4f9c9d76087a2afe7a8281a6cb6b972c95fb2f4eb28e
SHA512848db7d47dc37a9025e3df0dda4fbf1c84d9a9191febae38621d9c9b09342a987ff0587108cccfd874cb900c88c5f9f9ca0548f3027f6515ed85c92fd26f8515
-
\Users\Admin\Documents\W0CQNhLKUfdoD11k1NyLd2Hl.exeFilesize
351KB
MD5312ad3b67a1f3a75637ea9297df1cedb
SHA17d922b102a52241d28f1451d3542db12b0265b75
SHA2563b4c1d0a112668872c1d4f9c9d76087a2afe7a8281a6cb6b972c95fb2f4eb28e
SHA512848db7d47dc37a9025e3df0dda4fbf1c84d9a9191febae38621d9c9b09342a987ff0587108cccfd874cb900c88c5f9f9ca0548f3027f6515ed85c92fd26f8515
-
\Users\Admin\Documents\W0CQNhLKUfdoD11k1NyLd2Hl.exeFilesize
351KB
MD5312ad3b67a1f3a75637ea9297df1cedb
SHA17d922b102a52241d28f1451d3542db12b0265b75
SHA2563b4c1d0a112668872c1d4f9c9d76087a2afe7a8281a6cb6b972c95fb2f4eb28e
SHA512848db7d47dc37a9025e3df0dda4fbf1c84d9a9191febae38621d9c9b09342a987ff0587108cccfd874cb900c88c5f9f9ca0548f3027f6515ed85c92fd26f8515
-
\Users\Admin\Documents\W0CQNhLKUfdoD11k1NyLd2Hl.exeFilesize
351KB
MD5312ad3b67a1f3a75637ea9297df1cedb
SHA17d922b102a52241d28f1451d3542db12b0265b75
SHA2563b4c1d0a112668872c1d4f9c9d76087a2afe7a8281a6cb6b972c95fb2f4eb28e
SHA512848db7d47dc37a9025e3df0dda4fbf1c84d9a9191febae38621d9c9b09342a987ff0587108cccfd874cb900c88c5f9f9ca0548f3027f6515ed85c92fd26f8515
-
\Users\Admin\Documents\W0CQNhLKUfdoD11k1NyLd2Hl.exeFilesize
351KB
MD5312ad3b67a1f3a75637ea9297df1cedb
SHA17d922b102a52241d28f1451d3542db12b0265b75
SHA2563b4c1d0a112668872c1d4f9c9d76087a2afe7a8281a6cb6b972c95fb2f4eb28e
SHA512848db7d47dc37a9025e3df0dda4fbf1c84d9a9191febae38621d9c9b09342a987ff0587108cccfd874cb900c88c5f9f9ca0548f3027f6515ed85c92fd26f8515
-
\Users\Admin\Documents\W0CQNhLKUfdoD11k1NyLd2Hl.exeFilesize
351KB
MD5312ad3b67a1f3a75637ea9297df1cedb
SHA17d922b102a52241d28f1451d3542db12b0265b75
SHA2563b4c1d0a112668872c1d4f9c9d76087a2afe7a8281a6cb6b972c95fb2f4eb28e
SHA512848db7d47dc37a9025e3df0dda4fbf1c84d9a9191febae38621d9c9b09342a987ff0587108cccfd874cb900c88c5f9f9ca0548f3027f6515ed85c92fd26f8515
-
\Users\Admin\Pictures\Adobe Films\NiceProcessX64.bmp.exeFilesize
318KB
MD53f22bd82ee1b38f439e6354c60126d6d
SHA163b57d818f86ea64ebc8566faeb0c977839defde
SHA256265c2ddc8a21e6fa8dfaa38ef0e77df8a2e98273a1abfb575aef93c0cc8ee96a
SHA512b73e8e17e5e99d0e9edfb690ece8b0c15befb4d48b1c4f2fe77c5e3daf01df35858c06e1403a8636f86363708b80123d12122cb821a86b575b184227c760988f
-
memory/824-61-0x0000000000000000-mapping.dmp
-
memory/868-64-0x0000000003D20000-0x0000000003EC5000-memory.dmpFilesize
1.6MB
-
memory/868-58-0x0000000000000000-mapping.dmp
-
memory/868-76-0x0000000003D20000-0x0000000003EC5000-memory.dmpFilesize
1.6MB
-
memory/1536-68-0x0000000000000000-mapping.dmp
-
memory/1592-66-0x0000000000000000-mapping.dmp
-
memory/1636-62-0x0000000000000000-mapping.dmp
-
memory/1916-56-0x00000000762A1000-0x00000000762A3000-memory.dmpFilesize
8KB