772645517a7cf06224b855da2a5e27273ef93c1e7b77073476c8637c11b8cdca

Analysis

max time kernel
141s
max time network
145s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
02/10/2022, 20:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

772645517a7cf06224b855da2a5e27273ef93c1e7b77073476c8637c11b8cdca.exe
Size

312KB
MD5

3bf32adc801cc53d9514cd981acea15f
SHA1

bf4466f30b4d4a4ea0b484704a6deb37a2113482
SHA256

772645517a7cf06224b855da2a5e27273ef93c1e7b77073476c8637c11b8cdca
SHA512

35de859ffbc7eeda9b28358eb9f4ef7d39fe1d824c996663e97ec12eacff405af1f75728d1c61d6e1a99f2fb9ab4617151cb002849dbec6179bce9e26561396f
SSDEEP

6144:zcIhoXH+MWDoLybih7heY0Av9SO/qAvQ0S:oIhyWDoLth7MYPv9r/VvnS

Score

8^/10

upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1080	772645517a7cf06224b855da2a5e27273ef93c1e7b77073476c8637c11b8cdcamgr.exe

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0008000000005c51-55.dat	upx
behavioral1/files/0x0008000000005c51-56.dat	upx
behavioral1/files/0x0008000000005c51-58.dat	upx
behavioral1/files/0x0008000000005c51-60.dat	upx
behavioral1/files/0x0008000000005c51-63.dat	upx
behavioral1/files/0x0008000000005c51-62.dat	upx
behavioral1/files/0x0008000000005c51-61.dat	upx
behavioral1/memory/1080-69-0x0000000000400000-0x0000000000464000-memory.dmp	upx
behavioral1/memory/1080-72-0x0000000000400000-0x0000000000464000-memory.dmp	upx

Loads dropped DLL 5 IoCs

pid	Process
1056	772645517a7cf06224b855da2a5e27273ef93c1e7b77073476c8637c11b8cdca.exe
1056	772645517a7cf06224b855da2a5e27273ef93c1e7b77073476c8637c11b8cdca.exe
1080	772645517a7cf06224b855da2a5e27273ef93c1e7b77073476c8637c11b8cdcamgr.exe
1080	772645517a7cf06224b855da2a5e27273ef93c1e7b77073476c8637c11b8cdcamgr.exe
1080	772645517a7cf06224b855da2a5e27273ef93c1e7b77073476c8637c11b8cdcamgr.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 53 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{98053DE1-42A9-11ED-AD72-5E7A81A7298C} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "371518151"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9805DA21-42A9-11ED-AD72-5E7A81A7298C} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Modifies registry class 20 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	772645517a7cf06224b855da2a5e27273ef93c1e7b77073476c8637c11b8cdca.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	772645517a7cf06224b855da2a5e27273ef93c1e7b77073476c8637c11b8cdca.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	772645517a7cf06224b855da2a5e27273ef93c1e7b77073476c8637c11b8cdca.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f4225481e03947bc34db131e946b44c8dd50000	772645517a7cf06224b855da2a5e27273ef93c1e7b77073476c8637c11b8cdca.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 9e0000001a00eebbfe23000010007db10d7bd29c934a973346cc89022e7c00002a0000000000efbe000000200000000000000000000000000000000000000000000000000100000020002a0000000000efbe7e47b3fbe4c93b4ba2bad3f5d3cd46f98207ba827a5b6945b5d7ec83085f08cc20002a0000000000efbe000000200000000000000000000000000000000000000000000000000100000020000000	772645517a7cf06224b855da2a5e27273ef93c1e7b77073476c8637c11b8cdca.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg	772645517a7cf06224b855da2a5e27273ef93c1e7b77073476c8637c11b8cdca.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	772645517a7cf06224b855da2a5e27273ef93c1e7b77073476c8637c11b8cdca.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\TV_FolderType = "{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}"	772645517a7cf06224b855da2a5e27273ef93c1e7b77073476c8637c11b8cdca.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_Classes\Local Settings	772645517a7cf06224b855da2a5e27273ef93c1e7b77073476c8637c11b8cdca.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	772645517a7cf06224b855da2a5e27273ef93c1e7b77073476c8637c11b8cdca.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	772645517a7cf06224b855da2a5e27273ef93c1e7b77073476c8637c11b8cdca.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags	772645517a7cf06224b855da2a5e27273ef93c1e7b77073476c8637c11b8cdca.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\TV_TopViewID = "{82BA0782-5B7A-4569-B5D7-EC83085F08CC}"	772645517a7cf06224b855da2a5e27273ef93c1e7b77073476c8637c11b8cdca.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\TV_TopViewVersion = "0"	772645517a7cf06224b855da2a5e27273ef93c1e7b77073476c8637c11b8cdca.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell	772645517a7cf06224b855da2a5e27273ef93c1e7b77073476c8637c11b8cdca.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	772645517a7cf06224b855da2a5e27273ef93c1e7b77073476c8637c11b8cdca.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	772645517a7cf06224b855da2a5e27273ef93c1e7b77073476c8637c11b8cdca.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	772645517a7cf06224b855da2a5e27273ef93c1e7b77073476c8637c11b8cdca.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	772645517a7cf06224b855da2a5e27273ef93c1e7b77073476c8637c11b8cdca.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	772645517a7cf06224b855da2a5e27273ef93c1e7b77073476c8637c11b8cdca.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1080	772645517a7cf06224b855da2a5e27273ef93c1e7b77073476c8637c11b8cdcamgr.exe
1080	772645517a7cf06224b855da2a5e27273ef93c1e7b77073476c8637c11b8cdcamgr.exe
1080	772645517a7cf06224b855da2a5e27273ef93c1e7b77073476c8637c11b8cdcamgr.exe
1080	772645517a7cf06224b855da2a5e27273ef93c1e7b77073476c8637c11b8cdcamgr.exe
1080	772645517a7cf06224b855da2a5e27273ef93c1e7b77073476c8637c11b8cdcamgr.exe
1080	772645517a7cf06224b855da2a5e27273ef93c1e7b77073476c8637c11b8cdcamgr.exe
1080	772645517a7cf06224b855da2a5e27273ef93c1e7b77073476c8637c11b8cdcamgr.exe
1080	772645517a7cf06224b855da2a5e27273ef93c1e7b77073476c8637c11b8cdcamgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1056	772645517a7cf06224b855da2a5e27273ef93c1e7b77073476c8637c11b8cdca.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1080	772645517a7cf06224b855da2a5e27273ef93c1e7b77073476c8637c11b8cdcamgr.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
940	iexplore.exe
972	iexplore.exe

Suspicious use of SetWindowsHookEx 9 IoCs

pid	Process
1056	772645517a7cf06224b855da2a5e27273ef93c1e7b77073476c8637c11b8cdca.exe
940	iexplore.exe
940	iexplore.exe
972	iexplore.exe
972	iexplore.exe
1472	IEXPLORE.EXE
1380	IEXPLORE.EXE
1380	IEXPLORE.EXE
1472	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 1056 wrote to memory of 1080	1056	772645517a7cf06224b855da2a5e27273ef93c1e7b77073476c8637c11b8cdca.exe	26
PID 1056 wrote to memory of 1080	1056	772645517a7cf06224b855da2a5e27273ef93c1e7b77073476c8637c11b8cdca.exe	26
PID 1056 wrote to memory of 1080	1056	772645517a7cf06224b855da2a5e27273ef93c1e7b77073476c8637c11b8cdca.exe	26
PID 1056 wrote to memory of 1080	1056	772645517a7cf06224b855da2a5e27273ef93c1e7b77073476c8637c11b8cdca.exe	26
PID 1056 wrote to memory of 1080	1056	772645517a7cf06224b855da2a5e27273ef93c1e7b77073476c8637c11b8cdca.exe	26
PID 1056 wrote to memory of 1080	1056	772645517a7cf06224b855da2a5e27273ef93c1e7b77073476c8637c11b8cdca.exe	26
PID 1056 wrote to memory of 1080	1056	772645517a7cf06224b855da2a5e27273ef93c1e7b77073476c8637c11b8cdca.exe	26
PID 1080 wrote to memory of 972	1080	772645517a7cf06224b855da2a5e27273ef93c1e7b77073476c8637c11b8cdcamgr.exe	27
PID 1080 wrote to memory of 972	1080	772645517a7cf06224b855da2a5e27273ef93c1e7b77073476c8637c11b8cdcamgr.exe	27
PID 1080 wrote to memory of 972	1080	772645517a7cf06224b855da2a5e27273ef93c1e7b77073476c8637c11b8cdcamgr.exe	27
PID 1080 wrote to memory of 972	1080	772645517a7cf06224b855da2a5e27273ef93c1e7b77073476c8637c11b8cdcamgr.exe	27
PID 1080 wrote to memory of 940	1080	772645517a7cf06224b855da2a5e27273ef93c1e7b77073476c8637c11b8cdcamgr.exe	28
PID 1080 wrote to memory of 940	1080	772645517a7cf06224b855da2a5e27273ef93c1e7b77073476c8637c11b8cdcamgr.exe	28
PID 1080 wrote to memory of 940	1080	772645517a7cf06224b855da2a5e27273ef93c1e7b77073476c8637c11b8cdcamgr.exe	28
PID 1080 wrote to memory of 940	1080	772645517a7cf06224b855da2a5e27273ef93c1e7b77073476c8637c11b8cdcamgr.exe	28
PID 972 wrote to memory of 1380	972	iexplore.exe	30
PID 972 wrote to memory of 1380	972	iexplore.exe	30
PID 972 wrote to memory of 1380	972	iexplore.exe	30
PID 972 wrote to memory of 1380	972	iexplore.exe	30
PID 972 wrote to memory of 1380	972	iexplore.exe	30
PID 972 wrote to memory of 1380	972	iexplore.exe	30
PID 972 wrote to memory of 1380	972	iexplore.exe	30
PID 940 wrote to memory of 1472	940	iexplore.exe	31
PID 940 wrote to memory of 1472	940	iexplore.exe	31
PID 940 wrote to memory of 1472	940	iexplore.exe	31
PID 940 wrote to memory of 1472	940	iexplore.exe	31
PID 940 wrote to memory of 1472	940	iexplore.exe	31
PID 940 wrote to memory of 1472	940	iexplore.exe	31
PID 940 wrote to memory of 1472	940	iexplore.exe	31

C:\Users\Admin\AppData\Local\Temp\772645517a7cf06224b855da2a5e27273ef93c1e7b77073476c8637c11b8cdca.exe
"C:\Users\Admin\AppData\Local\Temp\772645517a7cf06224b855da2a5e27273ef93c1e7b77073476c8637c11b8cdca.exe"
1⤵
- Loads dropped DLL
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1056
- C:\Users\Admin\AppData\Local\Temp\772645517a7cf06224b855da2a5e27273ef93c1e7b77073476c8637c11b8cdcamgr.exe
  C:\Users\Admin\AppData\Local\Temp\772645517a7cf06224b855da2a5e27273ef93c1e7b77073476c8637c11b8cdcamgr.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1080
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe"
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:972
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:972 CREDAT:275457 /prefetch:2
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:1380
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe"
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:940
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:940 CREDAT:275457 /prefetch:2
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:1472

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{98053DE1-42A9-11ED-AD72-5E7A81A7298C}.dat

Filesize
3KB

MD5
3ea734b9dd9989cee8765877f0b73020

SHA1
3d65c68a899bb5a15b04bf5464b393662fb76f10

SHA256
3de27cc47d0d174898d954dbbb7f15d3cd28bf21fe755323c177bb2a4b61b9b8

SHA512
434af8124479df91a1169c39c01cc40c297d016220c7df05f831287453de1c61143facd0a8b4850ee528ed72e0762acec3c3e3333cb31e360c0c64167079430b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{9805DA21-42A9-11ED-AD72-5E7A81A7298C}.dat

Filesize
3KB

MD5
08999f7fd5799548330e982a59f14a34

SHA1
e70f47412765e0790f160b1c25d56120ec95cb29

SHA256
ebcdd79aa04fc443e032414c7a0913af0f0ed02e37dd121962ae2cc690b6258f

SHA512
f28a237a2c581ff3691175e50425363392bd36340b52fc3100e088567edeee4079052d35f11993521ddb5b74adc0c1b681ebda3e98ab3c30ed4fae4c6b1ce839

Download Submit
C:\Users\Admin\AppData\Local\Temp\772645517a7cf06224b855da2a5e27273ef93c1e7b77073476c8637c11b8cdcamgr.exe

Filesize
160KB

MD5
def246ecc4f00381b6b1acf8463831fb

SHA1
864cb109f819a7929fb000490f7628a91d751b28

SHA256
b87b2ab451238dbe16ece999631a662c3efefd20ef9a5339d3f7955d768acb5c

SHA512
8770c4275911ba2537a635cccfbe66e8ea08051250c9837d2ea5bd49c22519a4fe72bc48261e687e60a34a08e8a08fe38f8ed7632bed9098a851fcd8f27b56bd

Download Submit
C:\Users\Admin\AppData\Local\Temp\772645517a7cf06224b855da2a5e27273ef93c1e7b77073476c8637c11b8cdcamgr.exe

Filesize
160KB

MD5
def246ecc4f00381b6b1acf8463831fb

SHA1
864cb109f819a7929fb000490f7628a91d751b28

SHA256
b87b2ab451238dbe16ece999631a662c3efefd20ef9a5339d3f7955d768acb5c

SHA512
8770c4275911ba2537a635cccfbe66e8ea08051250c9837d2ea5bd49c22519a4fe72bc48261e687e60a34a08e8a08fe38f8ed7632bed9098a851fcd8f27b56bd

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\UE89IUBP.txt

Filesize
603B

MD5
28e5c92e1340e18997ab0b02034b880f

SHA1
2d3f7cffb3b3463169162beab1be5c2d2abbabc8

SHA256
77c96adf727d9967e5811cb754ff42f8250c3c581a78329d837eba50a172451b

SHA512
4c18d9a36cbd1fc1f803c0acbfae2f197e37899c285603ea86faee1f3f5ec5a647e9bc44cbb0fa588b435754a4fd832cfd7672ceab638beb144f3c7aa6bc3586

Download Submit
\Users\Admin\AppData\Local\Temp\772645517a7cf06224b855da2a5e27273ef93c1e7b77073476c8637c11b8cdcamgr.exe

Filesize
160KB

MD5
def246ecc4f00381b6b1acf8463831fb

SHA1
864cb109f819a7929fb000490f7628a91d751b28

SHA256
b87b2ab451238dbe16ece999631a662c3efefd20ef9a5339d3f7955d768acb5c

SHA512
8770c4275911ba2537a635cccfbe66e8ea08051250c9837d2ea5bd49c22519a4fe72bc48261e687e60a34a08e8a08fe38f8ed7632bed9098a851fcd8f27b56bd

Download Submit
\Users\Admin\AppData\Local\Temp\772645517a7cf06224b855da2a5e27273ef93c1e7b77073476c8637c11b8cdcamgr.exe

Filesize
160KB

MD5
def246ecc4f00381b6b1acf8463831fb

SHA1
864cb109f819a7929fb000490f7628a91d751b28

SHA256
b87b2ab451238dbe16ece999631a662c3efefd20ef9a5339d3f7955d768acb5c

SHA512
8770c4275911ba2537a635cccfbe66e8ea08051250c9837d2ea5bd49c22519a4fe72bc48261e687e60a34a08e8a08fe38f8ed7632bed9098a851fcd8f27b56bd

Download Submit
\Users\Admin\AppData\Local\Temp\772645517a7cf06224b855da2a5e27273ef93c1e7b77073476c8637c11b8cdcamgr.exe

Filesize
160KB

MD5
def246ecc4f00381b6b1acf8463831fb

SHA1
864cb109f819a7929fb000490f7628a91d751b28

SHA256
b87b2ab451238dbe16ece999631a662c3efefd20ef9a5339d3f7955d768acb5c

SHA512
8770c4275911ba2537a635cccfbe66e8ea08051250c9837d2ea5bd49c22519a4fe72bc48261e687e60a34a08e8a08fe38f8ed7632bed9098a851fcd8f27b56bd

Download Submit
\Users\Admin\AppData\Local\Temp\772645517a7cf06224b855da2a5e27273ef93c1e7b77073476c8637c11b8cdcamgr.exe

Filesize
160KB

MD5
def246ecc4f00381b6b1acf8463831fb

SHA1
864cb109f819a7929fb000490f7628a91d751b28

SHA256
b87b2ab451238dbe16ece999631a662c3efefd20ef9a5339d3f7955d768acb5c

SHA512
8770c4275911ba2537a635cccfbe66e8ea08051250c9837d2ea5bd49c22519a4fe72bc48261e687e60a34a08e8a08fe38f8ed7632bed9098a851fcd8f27b56bd

Download Submit
\Users\Admin\AppData\Local\Temp\772645517a7cf06224b855da2a5e27273ef93c1e7b77073476c8637c11b8cdcamgr.exe

Filesize
160KB

MD5
def246ecc4f00381b6b1acf8463831fb

SHA1
864cb109f819a7929fb000490f7628a91d751b28

SHA256
b87b2ab451238dbe16ece999631a662c3efefd20ef9a5339d3f7955d768acb5c

SHA512
8770c4275911ba2537a635cccfbe66e8ea08051250c9837d2ea5bd49c22519a4fe72bc48261e687e60a34a08e8a08fe38f8ed7632bed9098a851fcd8f27b56bd

Download Submit
memory/1056-64-0x0000000074CA1000-0x0000000074CA3000-memory.dmp

Filesize
8KB

Download
memory/1056-65-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/1056-66-0x0000000000850000-0x00000000008A2000-memory.dmp

Filesize
328KB

Download
memory/1056-67-0x0000000000850000-0x00000000008A2000-memory.dmp

Filesize
328KB

Download
memory/1056-68-0x00000000007A0000-0x0000000000804000-memory.dmp

Filesize
400KB

Download
memory/1056-54-0x0000000075A71000-0x0000000075A73000-memory.dmp

Filesize
8KB

Download
memory/1056-74-0x0000000000850000-0x00000000008A2000-memory.dmp

Filesize
328KB

Download
memory/1080-69-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/1080-72-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download