Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
299s -
max time network
293s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
20/09/2022, 05:56
Static task
static1
Behavioral task
behavioral1
Sample
BB11B196D32DF32F5DC5F41447031A54168ADFA66BA4F828F988E58260DB48E0.exe
Resource
win7-20220812-en
General
-
Target
BB11B196D32DF32F5DC5F41447031A54168ADFA66BA4F828F988E58260DB48E0.exe
-
Size
1.9MB
-
MD5
b80d607c42e36d7ef5ad0609263180f1
-
SHA1
c73593f3aba0038949b55388a38e09f734e907ec
-
SHA256
bb11b196d32df32f5dc5f41447031a54168adfa66ba4f828f988e58260db48e0
-
SHA512
52ef56b38a5ffac9df27801008f2acfdf0da296c826e1af016b5e57c40cc4f7a1ba1b4157667a4f1e55592aa31a0b3b1cddc0650fb415787d685003257e9ab1b
-
SSDEEP
24576:unbMx0o7kyBNdZBPMHObIi74MUGcKio3rLaGkLGoG8GhIGGQNC6CmTQWPLId+2GC:unKk4EHAIZdArLaGkraKlC9CAeats
Malware Config
Extracted
danabot
23.254.226.20:443
198.15.112.179:443
66.85.147.23:443
-
embedded_hash
8AA34A6CD5B6C9D509DB2C72E1AE6D88
-
type
loader
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "0" rundll32.exe -
Blocklisted process makes network request 5 IoCs
flow pid Process 2 1548 rundll32.exe 3 1548 rundll32.exe 34 1548 rundll32.exe 40 1548 rundll32.exe 41 1548 rundll32.exe -
Loads dropped DLL 4 IoCs
pid Process 1548 rundll32.exe 1548 rundll32.exe 1548 rundll32.exe 1548 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts rundll32.exe -
Accesses Microsoft Outlook profiles 1 TTPs 4 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook rundll32.exe Key opened \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 rundll32.exe Key opened \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 rundll32.exe Key opened \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 rundll32.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops desktop.ini file(s) 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Desktop.ini rundll32.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 1548 set thread context of 2044 1548 rundll32.exe 30 PID 1548 set thread context of 1440 1548 rundll32.exe 34 -
Drops file in Program Files directory 9 IoCs
description ioc Process File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe rundll32.exe File opened for modification C:\Program Files\Mozilla Firefox\AccessibleHandler.dll rundll32.exe File opened for modification C:\Program Files\7-Zip\Lang\bg.txt rundll32.exe File opened for modification C:\Program Files\7-Zip\Lang\io.txt rundll32.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe.sig rundll32.exe File opened for modification C:\Program Files\Mozilla Firefox\api-ms-win-crt-process-l1-1-0.dll rundll32.exe File opened for modification C:\Program Files\Mozilla Firefox\api-ms-win-crt-conio-l1-1-0.dll rundll32.exe File opened for modification C:\Program Files\Mozilla Firefox\api-ms-win-core-localization-l1-2-0.dll rundll32.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.cfg rundll32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 27 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Identifier rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Previous Update Signature rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Component Information rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 rundll32.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Status rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Status rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Signature rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Configuration Data rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Platform ID rundll32.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 rundll32.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform ID rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\FeatureSet rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Previous Update Signature rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature rundll32.exe -
Modifies registry class 33 IoCs
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff rundll32.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\NodeSlot = "1" rundll32.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\MRUListEx = ffffffff rundll32.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 7e0074001c0043465346160031000000000000000000100041707044617461000000741a595e96dfd3488d671733bcee28bac5cdfadf9f6756418947c5c76bc0b67f3c0008000400efbe00000000000000002a000000000000000000000000000000000000000000000000004100700070004400610074006100000042000000 rundll32.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f44471a0359723fa74489c55595fe6b30ee0000 rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 rundll32.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff rundll32.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 = 4a0031000000000000000000102054656d700000360008000400efbe00000000000000002a00000000000000000000000000000000000000000000000000540065006d007000000014000000 rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\KnownFolderDerivedFolderType = "{57807898-8C4F-4462-BB63-71042380B109}" rundll32.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1 rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 rundll32.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 4c003100000000000000000010004c6f63616c00380008000400efbe00000000000000002a000000000000000000000000000000000000000000000000004c006f00630061006c00000014000000 rundll32.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 rundll32.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell rundll32.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff rundll32.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots rundll32.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = 00000000ffffffff rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 rundll32.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff rundll32.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\2F4BFC6B5B4313171977D2BA043D029901648F73 rundll32.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\2F4BFC6B5B4313171977D2BA043D029901648F73\Blob = 0300000001000000140000002f4bfc6b5b4313171977d2ba043d029901648f732000000001000000610200003082025d308201c6a003020102020836a832d23b564b90300d06092a864886f70d01010b05003057311b301906035504030c1247716f62616c5369676e20526f6f742043413110300e060355040b0c07526f6f7420434131193017060355040a0c10476c6f62616c5369676e206e762d7361310b3009060355040613024245301e170d3230303932303038303135305a170d3234303931393038303135305a3057311b301906035504030c1247716f62616c5369676e20526f6f742043413110300e060355040b0c07526f6f7420434131193017060355040a0c10476c6f62616c5369676e206e762d7361310b300906035504061302424530819f300d06092a864886f70d010101050003818d0030818902818100c4949033f4a41e9ec328d8c657e1bd9bcbbfbe647ee01e43d654275d9846ec12d8ce07556299b5f0d910d1259028b3d8642526988cc188ace61956acd79966446f3427319c555253eb1778a4ad9a7c38160cdbf1b4b5be67295903b32c7061590fe069d6b734cd1e2e95b8762768946a4661d2ab939a0d506c72974059e17a390203010001a3323030300f0603551d130101ff040530030101ff301d0603551d1104163014821247716f62616c5369676e20526f6f74204341300d06092a864886f70d01010b0500038181007765bf9afd111d3c1314b98e3362e2c28b7e7edba87355c036da0eedcf52e1c2a3e89c60ad35a3651a264e26b7c2cae21344f72a9893f206bcb0a4772cbc72b8cb6fdbe198c79fa5febdfd17f118acd7e009ab694b75d6bb371c6178f9d9bd8b60825787405073280d6c8772b5714ae2fdcbac368ed714ea7b4ee29d769f0b81 rundll32.exe -
Suspicious behavior: EnumeratesProcesses 17 IoCs
pid Process 1548 rundll32.exe 1548 rundll32.exe 1548 rundll32.exe 1548 rundll32.exe 1548 rundll32.exe 1548 rundll32.exe 1548 rundll32.exe 1548 rundll32.exe 1548 rundll32.exe 1548 rundll32.exe 1548 rundll32.exe 1548 rundll32.exe 1548 rundll32.exe 1548 rundll32.exe 1548 rundll32.exe 1548 rundll32.exe 1548 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1548 rundll32.exe -
Suspicious use of FindShellTrayWindow 6 IoCs
pid Process 2044 rundll32.exe 1548 rundll32.exe 1440 rundll32.exe 1548 rundll32.exe 1548 rundll32.exe 1548 rundll32.exe -
Suspicious use of WriteProcessMemory 49 IoCs
description pid Process procid_target PID 1676 wrote to memory of 1548 1676 BB11B196D32DF32F5DC5F41447031A54168ADFA66BA4F828F988E58260DB48E0.exe 28 PID 1676 wrote to memory of 1548 1676 BB11B196D32DF32F5DC5F41447031A54168ADFA66BA4F828F988E58260DB48E0.exe 28 PID 1676 wrote to memory of 1548 1676 BB11B196D32DF32F5DC5F41447031A54168ADFA66BA4F828F988E58260DB48E0.exe 28 PID 1676 wrote to memory of 1548 1676 BB11B196D32DF32F5DC5F41447031A54168ADFA66BA4F828F988E58260DB48E0.exe 28 PID 1676 wrote to memory of 1548 1676 BB11B196D32DF32F5DC5F41447031A54168ADFA66BA4F828F988E58260DB48E0.exe 28 PID 1676 wrote to memory of 1548 1676 BB11B196D32DF32F5DC5F41447031A54168ADFA66BA4F828F988E58260DB48E0.exe 28 PID 1676 wrote to memory of 1548 1676 BB11B196D32DF32F5DC5F41447031A54168ADFA66BA4F828F988E58260DB48E0.exe 28 PID 1548 wrote to memory of 2044 1548 rundll32.exe 30 PID 1548 wrote to memory of 2044 1548 rundll32.exe 30 PID 1548 wrote to memory of 2044 1548 rundll32.exe 30 PID 1548 wrote to memory of 2044 1548 rundll32.exe 30 PID 1548 wrote to memory of 2044 1548 rundll32.exe 30 PID 1548 wrote to memory of 1968 1548 rundll32.exe 32 PID 1548 wrote to memory of 1968 1548 rundll32.exe 32 PID 1548 wrote to memory of 1968 1548 rundll32.exe 32 PID 1548 wrote to memory of 1968 1548 rundll32.exe 32 PID 1548 wrote to memory of 1440 1548 rundll32.exe 34 PID 1548 wrote to memory of 1440 1548 rundll32.exe 34 PID 1548 wrote to memory of 1440 1548 rundll32.exe 34 PID 1548 wrote to memory of 1440 1548 rundll32.exe 34 PID 1548 wrote to memory of 1440 1548 rundll32.exe 34 PID 1548 wrote to memory of 1676 1548 rundll32.exe 35 PID 1548 wrote to memory of 1676 1548 rundll32.exe 35 PID 1548 wrote to memory of 1676 1548 rundll32.exe 35 PID 1548 wrote to memory of 1676 1548 rundll32.exe 35 PID 1548 wrote to memory of 1180 1548 rundll32.exe 37 PID 1548 wrote to memory of 1180 1548 rundll32.exe 37 PID 1548 wrote to memory of 1180 1548 rundll32.exe 37 PID 1548 wrote to memory of 1180 1548 rundll32.exe 37 PID 1548 wrote to memory of 784 1548 rundll32.exe 39 PID 1548 wrote to memory of 784 1548 rundll32.exe 39 PID 1548 wrote to memory of 784 1548 rundll32.exe 39 PID 1548 wrote to memory of 784 1548 rundll32.exe 39 PID 1548 wrote to memory of 188 1548 rundll32.exe 41 PID 1548 wrote to memory of 188 1548 rundll32.exe 41 PID 1548 wrote to memory of 188 1548 rundll32.exe 41 PID 1548 wrote to memory of 188 1548 rundll32.exe 41 PID 1548 wrote to memory of 1956 1548 rundll32.exe 43 PID 1548 wrote to memory of 1956 1548 rundll32.exe 43 PID 1548 wrote to memory of 1956 1548 rundll32.exe 43 PID 1548 wrote to memory of 1956 1548 rundll32.exe 43 PID 1548 wrote to memory of 2036 1548 rundll32.exe 45 PID 1548 wrote to memory of 2036 1548 rundll32.exe 45 PID 1548 wrote to memory of 2036 1548 rundll32.exe 45 PID 1548 wrote to memory of 2036 1548 rundll32.exe 45 PID 1548 wrote to memory of 1076 1548 rundll32.exe 48 PID 1548 wrote to memory of 1076 1548 rundll32.exe 48 PID 1548 wrote to memory of 1076 1548 rundll32.exe 48 PID 1548 wrote to memory of 1076 1548 rundll32.exe 48 -
outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 rundll32.exe -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 rundll32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\BB11B196D32DF32F5DC5F41447031A54168ADFA66BA4F828F988E58260DB48E0.exe"C:\Users\Admin\AppData\Local\Temp\BB11B196D32DF32F5DC5F41447031A54168ADFA66BA4F828F988E58260DB48E0.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1676 -
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\Dhfrwpy.dll,start C:\Users\Admin\AppData\Local\Temp\BB11B1~1.EXE2⤵
- Modifies visibility of file extensions in Explorer
- Blocklisted process makes network request
- Loads dropped DLL
- Accesses Microsoft Outlook accounts
- Accesses Microsoft Outlook profiles
- Drops desktop.ini file(s)
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Checks processor information in registry
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
PID:1548 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61 184193⤵
- Modifies registry class
- Suspicious use of FindShellTrayWindow
PID:2044
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /End /tn \Microsoft\Windows\Wininet\CacheTask3⤵PID:1968
-
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61 184193⤵
- Modifies registry class
- Suspicious use of FindShellTrayWindow
PID:1440
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Run /tn \Microsoft\Windows\Wininet\CacheTask3⤵PID:1676
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /End /tn \Microsoft\Windows\Wininet\CacheTask3⤵PID:1180
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Run /tn \Microsoft\Windows\Wininet\CacheTask3⤵PID:784
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /End /tn \Microsoft\Windows\Wininet\CacheTask3⤵PID:188
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Run /tn \Microsoft\Windows\Wininet\CacheTask3⤵PID:1956
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /End /tn \Microsoft\Windows\Wininet\CacheTask3⤵PID:2036
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Run /tn \Microsoft\Windows\Wininet\CacheTask3⤵PID:1076
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.6MB
MD503528423ab726a2474cbfb386d14817e
SHA15e973a84f864e0f0313f11c7f381faf443c42017
SHA256b137893c1a7d264e51479a9f4b73ba8a0322d4a62a0834750b04bf43574087d1
SHA512866f26f2d7e4e219f3178bf0ea927751c5a151d6f0573f33ab40ae80b426ee891dd0af28ff0a2c558b72b4a24adf73026a0e8345a3707c597a109576724c30f4
-
Filesize
2.6MB
MD503528423ab726a2474cbfb386d14817e
SHA15e973a84f864e0f0313f11c7f381faf443c42017
SHA256b137893c1a7d264e51479a9f4b73ba8a0322d4a62a0834750b04bf43574087d1
SHA512866f26f2d7e4e219f3178bf0ea927751c5a151d6f0573f33ab40ae80b426ee891dd0af28ff0a2c558b72b4a24adf73026a0e8345a3707c597a109576724c30f4
-
Filesize
2.6MB
MD503528423ab726a2474cbfb386d14817e
SHA15e973a84f864e0f0313f11c7f381faf443c42017
SHA256b137893c1a7d264e51479a9f4b73ba8a0322d4a62a0834750b04bf43574087d1
SHA512866f26f2d7e4e219f3178bf0ea927751c5a151d6f0573f33ab40ae80b426ee891dd0af28ff0a2c558b72b4a24adf73026a0e8345a3707c597a109576724c30f4
-
Filesize
2.6MB
MD503528423ab726a2474cbfb386d14817e
SHA15e973a84f864e0f0313f11c7f381faf443c42017
SHA256b137893c1a7d264e51479a9f4b73ba8a0322d4a62a0834750b04bf43574087d1
SHA512866f26f2d7e4e219f3178bf0ea927751c5a151d6f0573f33ab40ae80b426ee891dd0af28ff0a2c558b72b4a24adf73026a0e8345a3707c597a109576724c30f4
-
Filesize
2.6MB
MD503528423ab726a2474cbfb386d14817e
SHA15e973a84f864e0f0313f11c7f381faf443c42017
SHA256b137893c1a7d264e51479a9f4b73ba8a0322d4a62a0834750b04bf43574087d1
SHA512866f26f2d7e4e219f3178bf0ea927751c5a151d6f0573f33ab40ae80b426ee891dd0af28ff0a2c558b72b4a24adf73026a0e8345a3707c597a109576724c30f4