Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
23-09-2022 03:05
Static task
static1
Behavioral task
behavioral1
Sample
a791a3df5df1270933e7071f5a4bf316f6adef0a2132ddcf01d3cf45b3acca19.exe
Resource
win10v2004-20220812-en
General
-
Target
a791a3df5df1270933e7071f5a4bf316f6adef0a2132ddcf01d3cf45b3acca19.exe
-
Size
280KB
-
MD5
8f44440a6cacfe13786b15d75d40f569
-
SHA1
809aad4cf68962a5626d5488432dae719fbab3cd
-
SHA256
a791a3df5df1270933e7071f5a4bf316f6adef0a2132ddcf01d3cf45b3acca19
-
SHA512
b9c58e5181ef3229cbc0b247ee95c797665b2460143ba23451a31bce9bdd8e5c0bbf2f5d3b868a872141a8836339b41b6af7e93cd31bd2445f22ed9e6982cfc2
-
SSDEEP
6144:DoA6eRMLs0wyxiPQMmlqLM30YGS9igavwVf:DoAT+o0wyxvMmszSA
Malware Config
Extracted
danabot
198.15.112.179:443
185.62.56.245:443
153.92.223.225:443
192.119.70.159:443
49.0.50.0:57
51.0.52.0:0
53.0.54.0:1200
55.0.56.0:65535
-
embedded_hash
6618C163D57D6441FCCA65D86C4D380D
-
type
loader
Extracted
asyncrat
VenomAngel 5.0.7
Venom Clients
91.134.214.15:4449
Venom_RAT_HVNC_Mutex_Venom RAT_HVNC
-
delay
1
-
install
false
-
install_folder
%AppData%
Signatures
-
Detects Smokeloader packer 1 IoCs
Processes:
resource yara_rule behavioral1/memory/1740-133-0x00000000009E0000-0x00000000009E9000-memory.dmp family_smokeloader -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Async RAT payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/3700-180-0x0000000000400000-0x0000000000416000-memory.dmp asyncrat -
Blocklisted process makes network request 2 IoCs
Processes:
rundll32.exerundll32.exeflow pid process 80 4560 rundll32.exe 83 1452 rundll32.exe -
Downloads MZ/PE file
-
Executes dropped EXE 3 IoCs
Processes:
242.exe569D.exe569D.exepid process 1036 242.exe 4848 569D.exe 3700 569D.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
569D.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation 569D.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
569D.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Zgnbvnyk = "\"C:\\Users\\Admin\\AppData\\Roaming\\Uuajkgir\\Zgnbvnyk.exe\"" 569D.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
569D.exe242.exedescription pid process target process PID 4848 set thread context of 3700 4848 569D.exe 569D.exe PID 1036 set thread context of 1452 1036 242.exe rundll32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 992 3700 WerFault.exe 569D.exe -
Checks SCSI registry key(s) 3 TTPs 39 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
svchost.exea791a3df5df1270933e7071f5a4bf316f6adef0a2132ddcf01d3cf45b3acca19.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A svchost.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI a791a3df5df1270933e7071f5a4bf316f6adef0a2132ddcf01d3cf45b3acca19.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI a791a3df5df1270933e7071f5a4bf316f6adef0a2132ddcf01d3cf45b3acca19.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI a791a3df5df1270933e7071f5a4bf316f6adef0a2132ddcf01d3cf45b3acca19.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName svchost.exe -
Checks processor information in registry 2 TTPs 47 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
242.exerundll32.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Status 242.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor 242.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor 242.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\VendorIdentifier 242.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\FeatureSet 242.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Status rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Revision rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Status 242.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz 242.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 242.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\VendorIdentifier rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Status rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Platform Specific Field 1 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz 242.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Previous Update Revision 242.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet 242.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Identifier 242.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Component Information rundll32.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 242.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Platform Specific Field 1 242.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 rundll32.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data rundll32.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 242.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision 242.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information 242.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier 242.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Previous Update Revision 242.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Previous Update Revision rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 242.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 242.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString 242.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier 242.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Component Information 242.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Revision 242.exe -
Processes:
description ioc process Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Toolbar Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1" Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser Set value (data) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 -
Modifies registry class 19 IoCs
Processes:
rundll32.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1 Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 Set value (data) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff Set value (data) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 19002f433a5c000000000000000000000000000000000000000000 Set value (data) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1" Set value (data) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff Set value (data) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff Set value (data) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU Set value (data) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic" Set value (data) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000 -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
pid process 380 -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
a791a3df5df1270933e7071f5a4bf316f6adef0a2132ddcf01d3cf45b3acca19.exepid process 1740 a791a3df5df1270933e7071f5a4bf316f6adef0a2132ddcf01d3cf45b3acca19.exe 1740 a791a3df5df1270933e7071f5a4bf316f6adef0a2132ddcf01d3cf45b3acca19.exe 380 380 380 380 380 380 380 380 380 380 380 380 380 380 380 380 380 380 380 380 380 380 380 380 380 380 380 380 380 380 380 380 380 380 380 380 380 380 380 380 380 380 380 380 380 380 380 380 380 380 380 380 380 380 380 380 380 380 380 380 380 380 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 380 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
a791a3df5df1270933e7071f5a4bf316f6adef0a2132ddcf01d3cf45b3acca19.exepid process 1740 a791a3df5df1270933e7071f5a4bf316f6adef0a2132ddcf01d3cf45b3acca19.exe -
Suspicious use of AdjustPrivilegeToken 28 IoCs
Processes:
svchost.exe569D.exepowershell.exe569D.exedescription pid process Token: SeShutdownPrivilege 1220 svchost.exe Token: SeShutdownPrivilege 1220 svchost.exe Token: SeCreatePagefilePrivilege 1220 svchost.exe Token: SeDebugPrivilege 4848 569D.exe Token: SeDebugPrivilege 3848 powershell.exe Token: SeShutdownPrivilege 380 Token: SeCreatePagefilePrivilege 380 Token: SeDebugPrivilege 3700 569D.exe Token: SeShutdownPrivilege 380 Token: SeCreatePagefilePrivilege 380 Token: SeShutdownPrivilege 380 Token: SeCreatePagefilePrivilege 380 Token: SeShutdownPrivilege 380 Token: SeCreatePagefilePrivilege 380 Token: SeShutdownPrivilege 380 Token: SeCreatePagefilePrivilege 380 Token: SeShutdownPrivilege 380 Token: SeCreatePagefilePrivilege 380 Token: SeShutdownPrivilege 380 Token: SeCreatePagefilePrivilege 380 Token: SeShutdownPrivilege 380 Token: SeCreatePagefilePrivilege 380 Token: SeShutdownPrivilege 380 Token: SeCreatePagefilePrivilege 380 Token: SeShutdownPrivilege 380 Token: SeCreatePagefilePrivilege 380 Token: SeShutdownPrivilege 380 Token: SeCreatePagefilePrivilege 380 -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
rundll32.exepid process 1452 rundll32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
pid process 380 380 -
Suspicious use of WriteProcessMemory 57 IoCs
Processes:
242.exe569D.exedescription pid process target process PID 380 wrote to memory of 1036 380 242.exe PID 380 wrote to memory of 1036 380 242.exe PID 380 wrote to memory of 1036 380 242.exe PID 1036 wrote to memory of 4244 1036 242.exe agentactivationruntimestarter.exe PID 1036 wrote to memory of 4244 1036 242.exe agentactivationruntimestarter.exe PID 1036 wrote to memory of 4244 1036 242.exe agentactivationruntimestarter.exe PID 380 wrote to memory of 4848 380 569D.exe PID 380 wrote to memory of 4848 380 569D.exe PID 380 wrote to memory of 4848 380 569D.exe PID 4848 wrote to memory of 3848 4848 569D.exe powershell.exe PID 4848 wrote to memory of 3848 4848 569D.exe powershell.exe PID 4848 wrote to memory of 3848 4848 569D.exe powershell.exe PID 1036 wrote to memory of 4560 1036 242.exe rundll32.exe PID 1036 wrote to memory of 4560 1036 242.exe rundll32.exe PID 1036 wrote to memory of 4560 1036 242.exe rundll32.exe PID 1036 wrote to memory of 4560 1036 242.exe rundll32.exe PID 1036 wrote to memory of 4560 1036 242.exe rundll32.exe PID 1036 wrote to memory of 4560 1036 242.exe rundll32.exe PID 1036 wrote to memory of 4560 1036 242.exe rundll32.exe PID 1036 wrote to memory of 4560 1036 242.exe rundll32.exe PID 1036 wrote to memory of 4560 1036 242.exe rundll32.exe PID 1036 wrote to memory of 4560 1036 242.exe rundll32.exe PID 1036 wrote to memory of 4560 1036 242.exe rundll32.exe PID 1036 wrote to memory of 4560 1036 242.exe rundll32.exe PID 1036 wrote to memory of 4560 1036 242.exe rundll32.exe PID 1036 wrote to memory of 4560 1036 242.exe rundll32.exe PID 1036 wrote to memory of 4560 1036 242.exe rundll32.exe PID 1036 wrote to memory of 4560 1036 242.exe rundll32.exe PID 1036 wrote to memory of 4560 1036 242.exe rundll32.exe PID 1036 wrote to memory of 4560 1036 242.exe rundll32.exe PID 1036 wrote to memory of 4560 1036 242.exe rundll32.exe PID 1036 wrote to memory of 4560 1036 242.exe rundll32.exe PID 1036 wrote to memory of 4560 1036 242.exe rundll32.exe PID 1036 wrote to memory of 4560 1036 242.exe rundll32.exe PID 1036 wrote to memory of 4560 1036 242.exe rundll32.exe PID 1036 wrote to memory of 4560 1036 242.exe rundll32.exe PID 1036 wrote to memory of 4560 1036 242.exe rundll32.exe PID 1036 wrote to memory of 4560 1036 242.exe rundll32.exe PID 1036 wrote to memory of 4560 1036 242.exe rundll32.exe PID 1036 wrote to memory of 4560 1036 242.exe rundll32.exe PID 1036 wrote to memory of 4560 1036 242.exe rundll32.exe PID 1036 wrote to memory of 4560 1036 242.exe rundll32.exe PID 1036 wrote to memory of 4560 1036 242.exe rundll32.exe PID 1036 wrote to memory of 4560 1036 242.exe rundll32.exe PID 1036 wrote to memory of 4560 1036 242.exe rundll32.exe PID 4848 wrote to memory of 3700 4848 569D.exe 569D.exe PID 4848 wrote to memory of 3700 4848 569D.exe 569D.exe PID 4848 wrote to memory of 3700 4848 569D.exe 569D.exe PID 4848 wrote to memory of 3700 4848 569D.exe 569D.exe PID 4848 wrote to memory of 3700 4848 569D.exe 569D.exe PID 4848 wrote to memory of 3700 4848 569D.exe 569D.exe PID 4848 wrote to memory of 3700 4848 569D.exe 569D.exe PID 4848 wrote to memory of 3700 4848 569D.exe 569D.exe PID 1036 wrote to memory of 1452 1036 242.exe rundll32.exe PID 1036 wrote to memory of 1452 1036 242.exe rundll32.exe PID 1036 wrote to memory of 1452 1036 242.exe rundll32.exe PID 1036 wrote to memory of 1452 1036 242.exe rundll32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a791a3df5df1270933e7071f5a4bf316f6adef0a2132ddcf01d3cf45b3acca19.exe"C:\Users\Admin\AppData\Local\Temp\a791a3df5df1270933e7071f5a4bf316f6adef0a2132ddcf01d3cf45b3acca19.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\242.exeC:\Users\Admin\AppData\Local\Temp\242.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\agentactivationruntimestarter.exeC:\Windows\system32\agentactivationruntimestarter.exe2⤵
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\syswow64\rundll32.exe" "C:\Windows\syswow64\shell32.dll",#612⤵
- Blocklisted process makes network request
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\syswow64\rundll32.exe" "C:\Windows\syswow64\shell32.dll",#612⤵
- Blocklisted process makes network request
- Checks processor information in registry
- Modifies registry class
- Suspicious use of FindShellTrayWindow
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k AarSvcGroup -p -s AarSvc1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x408 0x5081⤵
-
C:\Users\Admin\AppData\Local\Temp\569D.exeC:\Users\Admin\AppData\Local\Temp\569D.exe1⤵
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAANQAwAA==2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\569D.exeC:\Users\Admin\AppData\Local\Temp\569D.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3700 -s 24723⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3700 -ip 37001⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\569D.exe.logFilesize
1KB
MD5e87e48b105757e1c7563d1c719059733
SHA128a3f2b2e0672da2b531f4757d2b20b53032dafc
SHA2560aaf22dc84cc3fcfe53de7ccfed8e662247dfb7f1a9967032c88790d0c663461
SHA512bf19c5743143aee914a453c41189c722c9b90a5b8bf299cecf3e1f97656d32cd209ecb74da8aebc89bb41c27d189f73aaaabbc64fe383410c95dc76ad4218968
-
C:\Users\Admin\AppData\Local\Temp\242.exeFilesize
1.4MB
MD5dd278021d4befee05819674cd25dc52c
SHA1256ebcebbea47d28315b123288521e05440fee9f
SHA2562d64c6a83c0d9c0fbde7ce9440e48fd540c923c4712fb66d8b06f8dcb549efe1
SHA51200cb2d3525251fc084cc5180cab3d2b5a16f42e27d4726f86e1a90c3b5fba2b0d7390e716c013c43eee56e16f91e11f02103ab12787c1956a28bd82bad55d8cd
-
C:\Users\Admin\AppData\Local\Temp\242.exeFilesize
1.4MB
MD5dd278021d4befee05819674cd25dc52c
SHA1256ebcebbea47d28315b123288521e05440fee9f
SHA2562d64c6a83c0d9c0fbde7ce9440e48fd540c923c4712fb66d8b06f8dcb549efe1
SHA51200cb2d3525251fc084cc5180cab3d2b5a16f42e27d4726f86e1a90c3b5fba2b0d7390e716c013c43eee56e16f91e11f02103ab12787c1956a28bd82bad55d8cd
-
C:\Users\Admin\AppData\Local\Temp\569D.exeFilesize
43KB
MD54564be4787db12defc324abfa04cafd9
SHA1386ab347428eeb89ed13cf790e39524348486f00
SHA256f528cb477d88a73c8b46e860275bf5d76a5174958a0f0b6ef0d710847fc0f7b4
SHA5125dcf0892e17d04bb6620f5b32021599ae822c0a8e3c5cf04f9524faf68d6078fb5a42bc60f5219273d55573cea97bcd5e5f70b82243ea0648ce3619e4afe1dea
-
C:\Users\Admin\AppData\Local\Temp\569D.exeFilesize
43KB
MD54564be4787db12defc324abfa04cafd9
SHA1386ab347428eeb89ed13cf790e39524348486f00
SHA256f528cb477d88a73c8b46e860275bf5d76a5174958a0f0b6ef0d710847fc0f7b4
SHA5125dcf0892e17d04bb6620f5b32021599ae822c0a8e3c5cf04f9524faf68d6078fb5a42bc60f5219273d55573cea97bcd5e5f70b82243ea0648ce3619e4afe1dea
-
C:\Users\Admin\AppData\Local\Temp\569D.exeFilesize
43KB
MD54564be4787db12defc324abfa04cafd9
SHA1386ab347428eeb89ed13cf790e39524348486f00
SHA256f528cb477d88a73c8b46e860275bf5d76a5174958a0f0b6ef0d710847fc0f7b4
SHA5125dcf0892e17d04bb6620f5b32021599ae822c0a8e3c5cf04f9524faf68d6078fb5a42bc60f5219273d55573cea97bcd5e5f70b82243ea0648ce3619e4afe1dea
-
C:\Users\Admin\AppData\Local\Temp\Fiuepr.tmpFilesize
3.3MB
MD5be03bd71d3ba639632b50cb9a3931d56
SHA1bcf03bb5c228044abd984485b0e10fc4e16c0c6c
SHA2561e50f193c8e645a6c93feb42b1ffd46dec68738106dec79014815ac444612234
SHA512fc0eada90ff1b4c5c805fd38c1bfade389f8b1d58c45611fdaa6a0c303a56cf4d78a49dabb1de0b9eb7458d952b65589256a82262a84c5914b6b7f974336bc8d
-
memory/1036-201-0x0000000000400000-0x00000000006E8000-memory.dmpFilesize
2.9MB
-
memory/1036-140-0x0000000002279000-0x000000000239F000-memory.dmpFilesize
1.1MB
-
memory/1036-141-0x00000000024A0000-0x000000000277B000-memory.dmpFilesize
2.9MB
-
memory/1036-142-0x0000000000400000-0x00000000006E8000-memory.dmpFilesize
2.9MB
-
memory/1036-143-0x0000000000400000-0x00000000006E8000-memory.dmpFilesize
2.9MB
-
memory/1036-187-0x00000000031C0000-0x0000000003C7E000-memory.dmpFilesize
10.7MB
-
memory/1036-208-0x00000000031C0000-0x0000000003C7E000-memory.dmpFilesize
10.7MB
-
memory/1036-136-0x0000000000000000-mapping.dmp
-
memory/1036-188-0x00000000031C0000-0x0000000003C7E000-memory.dmpFilesize
10.7MB
-
memory/1036-192-0x0000000003C80000-0x0000000003DC0000-memory.dmpFilesize
1.2MB
-
memory/1036-189-0x0000000003C80000-0x0000000003DC0000-memory.dmpFilesize
1.2MB
-
memory/1036-190-0x0000000003C80000-0x0000000003DC0000-memory.dmpFilesize
1.2MB
-
memory/1036-191-0x0000000003C80000-0x0000000003DC0000-memory.dmpFilesize
1.2MB
-
memory/1036-193-0x00000000031C0000-0x0000000003C7E000-memory.dmpFilesize
10.7MB
-
memory/1036-198-0x0000000003C80000-0x0000000003DC0000-memory.dmpFilesize
1.2MB
-
memory/1036-194-0x0000000003C80000-0x0000000003DC0000-memory.dmpFilesize
1.2MB
-
memory/1036-199-0x0000000003C80000-0x0000000003DC0000-memory.dmpFilesize
1.2MB
-
memory/1036-195-0x0000000003C80000-0x0000000003DC0000-memory.dmpFilesize
1.2MB
-
memory/1036-157-0x0000000000400000-0x00000000006E8000-memory.dmpFilesize
2.9MB
-
memory/1036-158-0x0000000000400000-0x00000000006E8000-memory.dmpFilesize
2.9MB
-
memory/1452-205-0x0000000004130000-0x0000000004270000-memory.dmpFilesize
1.2MB
-
memory/1452-202-0x0000000001030000-0x00000000019CE000-memory.dmpFilesize
9.6MB
-
memory/1452-207-0x00000000035B0000-0x000000000406E000-memory.dmpFilesize
10.7MB
-
memory/1452-200-0x0000000000000000-mapping.dmp
-
memory/1452-206-0x0000000004130000-0x0000000004270000-memory.dmpFilesize
1.2MB
-
memory/1452-204-0x00000000035B0000-0x000000000406E000-memory.dmpFilesize
10.7MB
-
memory/1740-135-0x0000000000400000-0x000000000044B000-memory.dmpFilesize
300KB
-
memory/1740-132-0x000000000053E000-0x000000000054F000-memory.dmpFilesize
68KB
-
memory/1740-134-0x0000000000400000-0x000000000044B000-memory.dmpFilesize
300KB
-
memory/1740-133-0x00000000009E0000-0x00000000009E9000-memory.dmpFilesize
36KB
-
memory/3700-179-0x0000000000000000-mapping.dmp
-
memory/3700-197-0x0000000007120000-0x000000000713E000-memory.dmpFilesize
120KB
-
memory/3700-196-0x0000000007140000-0x00000000071B6000-memory.dmpFilesize
472KB
-
memory/3700-185-0x00000000061D0000-0x0000000006774000-memory.dmpFilesize
5.6MB
-
memory/3700-184-0x0000000005B80000-0x0000000005C1C000-memory.dmpFilesize
624KB
-
memory/3700-180-0x0000000000400000-0x0000000000416000-memory.dmpFilesize
88KB
-
memory/3848-151-0x0000000005810000-0x0000000005E38000-memory.dmpFilesize
6.2MB
-
memory/3848-156-0x00000000075B0000-0x00000000075CA000-memory.dmpFilesize
104KB
-
memory/3848-149-0x0000000000000000-mapping.dmp
-
memory/3848-150-0x0000000002BD0000-0x0000000002C06000-memory.dmpFilesize
216KB
-
memory/3848-152-0x00000000056E0000-0x0000000005746000-memory.dmpFilesize
408KB
-
memory/3848-153-0x0000000005750000-0x00000000057B6000-memory.dmpFilesize
408KB
-
memory/3848-154-0x0000000006530000-0x000000000654E000-memory.dmpFilesize
120KB
-
memory/3848-155-0x0000000007D40000-0x00000000083BA000-memory.dmpFilesize
6.5MB
-
memory/4244-139-0x0000000000000000-mapping.dmp
-
memory/4560-171-0x0000000000800000-0x0000000000803000-memory.dmpFilesize
12KB
-
memory/4560-160-0x0000000000550000-0x0000000000553000-memory.dmpFilesize
12KB
-
memory/4560-169-0x00000000005E0000-0x00000000005E3000-memory.dmpFilesize
12KB
-
memory/4560-168-0x00000000005D0000-0x00000000005D3000-memory.dmpFilesize
12KB
-
memory/4560-167-0x00000000005C0000-0x00000000005C3000-memory.dmpFilesize
12KB
-
memory/4560-166-0x00000000005B0000-0x00000000005B3000-memory.dmpFilesize
12KB
-
memory/4560-165-0x00000000005A0000-0x00000000005A3000-memory.dmpFilesize
12KB
-
memory/4560-164-0x0000000000590000-0x0000000000593000-memory.dmpFilesize
12KB
-
memory/4560-163-0x0000000000580000-0x0000000000583000-memory.dmpFilesize
12KB
-
memory/4560-162-0x0000000000570000-0x0000000000573000-memory.dmpFilesize
12KB
-
memory/4560-161-0x0000000000560000-0x0000000000563000-memory.dmpFilesize
12KB
-
memory/4560-170-0x00000000005F0000-0x00000000005F3000-memory.dmpFilesize
12KB
-
memory/4560-159-0x0000000000000000-mapping.dmp
-
memory/4560-177-0x0000000000860000-0x0000000000863000-memory.dmpFilesize
12KB
-
memory/4560-183-0x0000000000870000-0x0000000000873000-memory.dmpFilesize
12KB
-
memory/4560-172-0x0000000000810000-0x0000000000813000-memory.dmpFilesize
12KB
-
memory/4560-173-0x0000000000820000-0x0000000000823000-memory.dmpFilesize
12KB
-
memory/4560-174-0x0000000000830000-0x0000000000833000-memory.dmpFilesize
12KB
-
memory/4560-175-0x0000000000840000-0x0000000000843000-memory.dmpFilesize
12KB
-
memory/4560-178-0x0000000000870000-0x0000000000873000-memory.dmpFilesize
12KB
-
memory/4560-176-0x0000000000850000-0x0000000000853000-memory.dmpFilesize
12KB
-
memory/4848-147-0x0000000000F50000-0x0000000000F60000-memory.dmpFilesize
64KB
-
memory/4848-144-0x0000000000000000-mapping.dmp
-
memory/4848-148-0x00000000093D0000-0x00000000093F2000-memory.dmpFilesize
136KB