danabot | 765fc6ddc8f0ab84b5962463da803492dbaa86d28879e32d155cba3fb278546d

Analysis

max time kernel
150s
max time network
135s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
04/10/2022, 23:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 266KB
Sample221004-3c47nachb2
SHA256 765fc6ddc8f0ab84b5962463da803492dbaa86d28879e32d155cba3fb278546d
MD5 ef9f791a77086f28100f4e72e1be4054
SHA1 0b0b038bcad24399735d3c85ad96b8adc23a0799
SHA512 b5966a173b815174eaf6423884807d160ac0714b62ff32e77ec4b5fd82f51596e71b716d78ed04b1c0319f5734f1bd2243c9742819bc5bfa535cef238ca7a6b8
SSDEEP 6144:R4j0KLWBIzM63J22tWeiVDLeIuzbgwuyXd18wVf:RA6ByMgJ22tWeCunnbt
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

danabot smokeloader backdoor banker trojan

Malware Config

Extracted

Family

danabot

49.0.50.0:57
51.0.52.0:0
53.0.54.0:1200
55.0.56.0:65535

Attributes

embedded_hash
EAD30BF58E340E9E105B328F524565E0
type
loader

Signatures

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot

Detects Smokeloader packer 1 IoCs

resource	yara_rule
behavioral2/memory/3368-133-0x00000000004C0000-0x00000000004C9000-memory.dmp	family_smokeloader

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

Blocklisted process makes network request 1 IoCs

flow	pid	Process
78	1440	rundll32.exe

Downloads MZ/PE file

Executes dropped EXE 1 IoCs

pid	Process
108	10B9.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 108 set thread context of 1440	108	10B9.exe	100

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 4 IoCs

pid	pid_target	Process	procid_target
4804	108	WerFault.exe	89
4276	108	WerFault.exe	89
1720	108	WerFault.exe	89
856	108	WerFault.exe	89

Checks SCSI registry key(s) 3 TTPs 39 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	svchost.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	file.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	svchost.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	file.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	file.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	svchost.exe

Checks processor information in registry 2 TTPs 49 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	10B9.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Previous Update Revision	10B9.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	10B9.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Previous Update Revision	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Status	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	10B9.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	10B9.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Previous Update Revision	10B9.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Component Information	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\VendorIdentifier	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	10B9.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\FeatureSet	10B9.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	10B9.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	10B9.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Status	10B9.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Component Information	10B9.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Platform Specific Field 1	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data	10B9.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Identifier	10B9.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information	10B9.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Identifier	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Configuration Data	rundll32.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	10B9.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Revision	10B9.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	10B9.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	10B9.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Configuration Data	10B9.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Status	10B9.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet	10B9.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Revision	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	rundll32.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	10B9.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	10B9.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	10B9.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	10B9.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Previous Update Revision	rundll32.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Toolbar	Process not Found
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser	Process not Found
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	Process not Found

Modifies registry class 19 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 19002f433a5c000000000000000000000000000000000000000000	Process not Found
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	Process not Found
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	Process not Found
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	Process not Found
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	Process not Found
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	Process not Found
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	Process not Found
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	Process not Found
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	Process not Found
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic"	Process not Found
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	Process not Found

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2576	Process not Found

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3368	file.exe
3368	file.exe
2576	Process not Found
2576	Process not Found
2576	Process not Found
2576	Process not Found
2576	Process not Found
2576	Process not Found
2576	Process not Found
2576	Process not Found
2576	Process not Found
2576	Process not Found
2576	Process not Found
2576	Process not Found
2576	Process not Found
2576	Process not Found
2576	Process not Found
2576	Process not Found
2576	Process not Found
2576	Process not Found
2576	Process not Found
2576	Process not Found
2576	Process not Found
2576	Process not Found
2576	Process not Found
2576	Process not Found
2576	Process not Found
2576	Process not Found
2576	Process not Found
2576	Process not Found
2576	Process not Found
2576	Process not Found
2576	Process not Found
2576	Process not Found
2576	Process not Found
2576	Process not Found
2576	Process not Found
2576	Process not Found
2576	Process not Found
2576	Process not Found
2576	Process not Found
2576	Process not Found
2576	Process not Found
2576	Process not Found
2576	Process not Found
2576	Process not Found
2576	Process not Found
2576	Process not Found
2576	Process not Found
2576	Process not Found
2576	Process not Found
2576	Process not Found
2576	Process not Found
2576	Process not Found
2576	Process not Found
2576	Process not Found
2576	Process not Found
2576	Process not Found
2576	Process not Found
2576	Process not Found
2576	Process not Found
2576	Process not Found
2576	Process not Found
2576	Process not Found

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2576	Process not Found

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
3368	file.exe

Suspicious use of AdjustPrivilegeToken 23 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2116	svchost.exe
Token: SeShutdownPrivilege	2116	svchost.exe
Token: SeCreatePagefilePrivilege	2116	svchost.exe
Token: SeShutdownPrivilege	2576	Process not Found
Token: SeCreatePagefilePrivilege	2576	Process not Found
Token: SeShutdownPrivilege	2576	Process not Found
Token: SeCreatePagefilePrivilege	2576	Process not Found
Token: SeShutdownPrivilege	2576	Process not Found
Token: SeCreatePagefilePrivilege	2576	Process not Found
Token: SeShutdownPrivilege	2576	Process not Found
Token: SeCreatePagefilePrivilege	2576	Process not Found
Token: SeShutdownPrivilege	2576	Process not Found
Token: SeCreatePagefilePrivilege	2576	Process not Found
Token: SeShutdownPrivilege	2576	Process not Found
Token: SeCreatePagefilePrivilege	2576	Process not Found
Token: SeShutdownPrivilege	2576	Process not Found
Token: SeCreatePagefilePrivilege	2576	Process not Found
Token: SeShutdownPrivilege	2576	Process not Found
Token: SeCreatePagefilePrivilege	2576	Process not Found
Token: SeShutdownPrivilege	2576	Process not Found
Token: SeCreatePagefilePrivilege	2576	Process not Found
Token: SeShutdownPrivilege	2576	Process not Found
Token: SeCreatePagefilePrivilege	2576	Process not Found

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1440	rundll32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2576	Process not Found
2576	Process not Found

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2576 wrote to memory of 108	2576	Process not Found	89
PID 2576 wrote to memory of 108	2576	Process not Found	89
PID 2576 wrote to memory of 108	2576	Process not Found	89
PID 108 wrote to memory of 316	108	10B9.exe	90
PID 108 wrote to memory of 316	108	10B9.exe	90
PID 108 wrote to memory of 316	108	10B9.exe	90
PID 108 wrote to memory of 1440	108	10B9.exe	100
PID 108 wrote to memory of 1440	108	10B9.exe	100
PID 108 wrote to memory of 1440	108	10B9.exe	100
PID 108 wrote to memory of 1440	108	10B9.exe	100

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:3368

C:\Users\Admin\AppData\Local\Temp\10B9.exe
C:\Users\Admin\AppData\Local\Temp\10B9.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:108
- C:\Windows\SysWOW64\agentactivationruntimestarter.exe
  C:\Windows\system32\agentactivationruntimestarter.exe
  2⤵
  PID:316
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 108 -s 880
  2⤵
  - Program crash
  PID:4804
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 108 -s 880
  2⤵
  - Program crash
  PID:4276
- C:\Windows\SysWOW64\rundll32.exe
  "C:\Windows\syswow64\rundll32.exe" "C:\Windows\syswow64\shell32.dll",#61
  2⤵
  - Blocklisted process makes network request
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of FindShellTrayWindow
  PID:1440
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 108 -s 908
  2⤵
  - Program crash
  PID:1720
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 108 -s 1016
  2⤵
  - Program crash
  PID:856

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k AarSvcGroup -p -s AarSvc
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:2116

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4e8 0x508
1⤵
PID:3904

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 108 -ip 108
1⤵
PID:2936

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 108 -ip 108
1⤵
PID:1504

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 108 -ip 108
1⤵
PID:1168

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 108 -ip 108
1⤵
PID:4088

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

10B9.exe

Path C:\Users\Admin\AppData\Local\Temp\10B9.exe
Size 4.6MB
SHA256 50cdd9abfc4a979ffe1bfb02e003226fc70520310948ead2961319922a5821a9
MD5 8852e2abce5778d3a6f2d30b58b2a169
SHA1 9708c6ded8283fd52155ab9e2d40b6d9c9d21f2e
SHA512 9b70a35f40c1415e713409a50eef7bc8a9c8b2cb0ad51f65e9f1be78f13a1adaa5384b05e8a1a29d6e4168d59cde0946ab87f26fbc090a8ae7a216e32b6f6e0a
SSDEEP 98304:3n6jA4LFl5avSO8rdyCysGXpkbm+V9AICr3p7/9rtDNEF4p9:q89vSn9yCbH9Ajp7xeS
MD5 SHA1 SHA512 SSDEEP

Submit Download

10B9.exe

Path C:\Users\Admin\AppData\Local\Temp\10B9.exe
Size 4.6MB
SHA256 50cdd9abfc4a979ffe1bfb02e003226fc70520310948ead2961319922a5821a9
MD5 8852e2abce5778d3a6f2d30b58b2a169
SHA1 9708c6ded8283fd52155ab9e2d40b6d9c9d21f2e
SHA512 9b70a35f40c1415e713409a50eef7bc8a9c8b2cb0ad51f65e9f1be78f13a1adaa5384b05e8a1a29d6e4168d59cde0946ab87f26fbc090a8ae7a216e32b6f6e0a
SSDEEP 98304:3n6jA4LFl5avSO8rdyCysGXpkbm+V9AICr3p7/9rtDNEF4p9:q89vSn9yCbH9Ajp7xeS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Microsoft .NET Framework 4.7.2 Setup_20220812_191749306.html

Path C:\Users\Admin\AppData\Local\Temp\Microsoft .NET Framework 4.7.2 Setup_20220812_191749306.html
Size 94KB
SHA256 fe6525b8436cfb0df02ae2cd7e7054bd706b3fa6f68ba4ded69308ed0bbfc350
MD5 da6b45af25ddc7d9a34a5a425b253bb2
SHA1 b94cc8311d176c735ef39586086ba5293808c3a9
SHA512 6a56d232768ad1f999bea5c61c58561e870c26c5de539d73e84984c0a806093251d060a359c55de71f46442f0752e96f6375ac8d8a79d7f957486c1e0e4c6e23
SSDEEP 768:fdsOTLyUFJFEWUxFzvWvcKvQfpOxdx/DQT:fdsWyUr+WUxpvWkKvQHT
MD5 SHA1 SHA512 SSDEEP

Submit Download

Uapaipuuih.tmp

Path C:\Users\Admin\AppData\Local\Temp\Uapaipuuih.tmp
Size 3.3MB
SHA256 e473b9afa947ef211c7e7cad6521687d504ec244a22f5ea5381f7020f947fc7d
MD5 963024ce4b5518f20619bdcb2998a789
SHA1 bbce53b5aa2beeff5c9f1555a1e32350bba479b2
SHA512 468f341fb7c284f0024ad5d13a72264d60e77b9ea724a770b4d45856dc0aaedd30e51263ea266e6979d7db1079703a9bc1358c5562aac6761ee45c06436baae8
SSDEEP 49152:uBDRx3xq9F1QL+8wq74fDayjuTJBc3SYI6cwm/p2h2l9MSUOsrV9XGHb:Kdb+Fd8E7auWQbI6VFh2vMH27
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_installer.log

Path C:\Users\Admin\AppData\Local\Temp\chrome_installer.log
Size 3KB
SHA256 40788006e1a1ef42a7c2739f7e8dd4389efe1a6b107f50580e70e8ebe5f40272
MD5 7b261553ba3c610999059f63c2c8ee6a
SHA1 1f1ae0dc6f3f3e510745074a0455078d33908562
SHA512 a7df1e078a58a39f8b4cb14bacd027825c5ec8a6ca58070dd5e8e98837c1e1fd9206471777f8e144edd43ea380e12259caa5e95b5d77a2deb5fb29a43cdddef1
MD5 SHA1 SHA512

Submit Download

dd_vcredistMSI50B8.txt

Path C:\Users\Admin\AppData\Local\Temp\dd_vcredistMSI50B8.txt
Size 426KB
SHA256 37c69c02974b85d856e00765ff6b978bc55f03f1254b5f50754d5acd7c32c296
MD5 cd406b2d2202bec1d657b0042c2a2cb8
SHA1 87d639c4dc350106f0e2cd2364d78df223aac7e4
SHA512 09a482f2fe99f4b6a45f8acb8953705cc834a8e92be2f579f62e5aa784d972b63e1dc8d0a4bf25442623a3f251f9a675121c3a402e1b5748424acceeaf547ee0
SSDEEP 1536:D0LrTEvCMI7DIWv2+2fDGw1NWNw8wzfnFNeYTJ3ERsIvPEm6JJNlZ+KdzbjZsRL9:D0NTj7XprZUoBNr
MD5 SHA1 SHA512 SSDEEP

Submit Download

dd_vcredistUI50E6.txt

Path C:\Users\Admin\AppData\Local\Temp\dd_vcredistUI50E6.txt
Size 11KB
SHA256 ea98fcd19ab84934ea13c76c8062613b8aab53eba191f617154ad1ad6de9541d
MD5 2f49658dc85c711be46b9811a82265d5
SHA1 160dbd9b872224a83f7c9d508d6184513738b82a
SHA512 09fd53d0f0d8fed289a76b22b516a73532d965984af6fa48e8fcdaf196517d38a95fcd9af8aaf1120eadba6eb0dfb3e78ba91286a5041208d85296012e39e5c4
SSDEEP 192:Ufjklq544XhnpnzDnpnLMOPnbnG5mJ8PB3P8ZP:Ufjklq544Xhp/pLMOPbXCWZP
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/108-142-0x0000000002B80000-0x0000000003196000-memory.dmp

Download

memory/108-156-0x00000000043F0000-0x0000000004530000-memory.dmp

Download

memory/108-141-0x000000000270D000-0x0000000002B77000-memory.dmp

Download

memory/108-170-0x0000000003860000-0x0000000004327000-memory.dmp

Download

memory/108-143-0x0000000000400000-0x0000000000A22000-memory.dmp

Download

memory/108-144-0x0000000000400000-0x0000000000A22000-memory.dmp

Download

memory/108-145-0x0000000000400000-0x0000000000A22000-memory.dmp

Download

memory/108-146-0x0000000000400000-0x0000000000A22000-memory.dmp

Download

memory/108-147-0x0000000003860000-0x0000000004327000-memory.dmp

Download

memory/108-148-0x0000000003860000-0x0000000004327000-memory.dmp

Download

memory/108-149-0x0000000003860000-0x0000000004327000-memory.dmp

Download

memory/108-150-0x00000000043F0000-0x0000000004530000-memory.dmp

Download

memory/108-151-0x00000000043F0000-0x0000000004530000-memory.dmp

Download

memory/108-153-0x00000000043F0000-0x0000000004530000-memory.dmp

Download

memory/108-154-0x00000000043F0000-0x0000000004530000-memory.dmp

Download

memory/108-155-0x00000000043F0000-0x0000000004530000-memory.dmp

Download

memory/108-152-0x00000000043F0000-0x0000000004530000-memory.dmp

Download

memory/108-169-0x0000000000400000-0x0000000000A22000-memory.dmp

Download

memory/108-157-0x00000000043F0000-0x0000000004530000-memory.dmp

Download

memory/1440-168-0x0000000002B90000-0x0000000003657000-memory.dmp

Download

memory/1440-161-0x00000000036C0000-0x0000000003800000-memory.dmp

Download

memory/1440-167-0x0000000000DD0000-0x0000000001778000-memory.dmp

Download

memory/1440-159-0x0000000002B90000-0x0000000003657000-memory.dmp

Download

memory/1440-160-0x00000000036C0000-0x0000000003800000-memory.dmp

Download

memory/1440-171-0x0000000002B90000-0x0000000003657000-memory.dmp

Download

memory/3368-135-0x00000000006BC000-0x00000000006CC000-memory.dmp

Download

memory/3368-136-0x0000000000400000-0x0000000000448000-memory.dmp

Download

memory/3368-134-0x0000000000400000-0x0000000000448000-memory.dmp

Download

memory/3368-133-0x00000000004C0000-0x00000000004C9000-memory.dmp

Download

memory/3368-132-0x00000000006BC000-0x00000000006CC000-memory.dmp

Download