danabot | 5cf8d15847cbc4f3be8686db95dc918fc01e53ce9e74cd7cc7e189d474d4e989

Analysis

max time kernel
151s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
04/10/2022, 16:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 265KB
Sample221004-vcs6dsbeg5
SHA256 5cf8d15847cbc4f3be8686db95dc918fc01e53ce9e74cd7cc7e189d474d4e989
MD5 7a0c77ee41e10851af68272f00b6dbff
SHA1 2883acf384b50634149072b3d1aff8333ffa456d
SHA512 cbe16bdafbef3a2d07438116778ba31d316166e1309e6f56763aefe5739c2a01de08c6f2b7d4206ec6d731a1439d3fb1f5fba935feb008c97a6dc69d8f95a646
SSDEEP 6144:ZtF93LLd1WlnWbPrfXJuCuzbgwuO1+wVf:Z5vdUJqrXBunnx
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

danabot smokeloader backdoor banker trojan

Malware Config

Extracted

Family

danabot

49.0.50.0:57
51.0.52.0:0
53.0.54.0:1200
55.0.56.0:65535

Attributes

embedded_hash
EAD30BF58E340E9E105B328F524565E0
type
loader

Signatures

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot

Detects Smokeloader packer 1 IoCs

resource	yara_rule
behavioral2/memory/2548-133-0x0000000002040000-0x0000000002049000-memory.dmp	family_smokeloader

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

Blocklisted process makes network request 1 IoCs

flow	pid	Process
81	3196	rundll32.exe

Downloads MZ/PE file

Executes dropped EXE 1 IoCs

pid	Process
732	6D9E.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 732 set thread context of 3196	732	6D9E.exe	103

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 3 IoCs

pid	pid_target	Process	procid_target
4540	732	WerFault.exe	91
1536	732	WerFault.exe	91
3804	732	WerFault.exe	91

Checks SCSI registry key(s) 3 TTPs 39 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	svchost.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	file.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	file.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	file.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName	svchost.exe

Checks processor information in registry 2 TTPs 45 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information	6D9E.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	6D9E.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	6D9E.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	rundll32.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	6D9E.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Platform Specific Field 1	6D9E.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	6D9E.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Status	6D9E.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Revision	6D9E.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Status	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	6D9E.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	6D9E.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\VendorIdentifier	6D9E.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\VendorIdentifier	rundll32.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	6D9E.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	6D9E.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	6D9E.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	6D9E.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\FeatureSet	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Previous Update Revision	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Previous Update Revision	6D9E.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Platform Specific Field 1	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Status	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	6D9E.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	rundll32.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	6D9E.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet	6D9E.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Previous Update Revision	6D9E.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	6D9E.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Revision	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	6D9E.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\FeatureSet	6D9E.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	rundll32.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Toolbar	Process not Found
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser	Process not Found

Modifies registry class 19 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	Process not Found
Set value (data)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	Process not Found
Set value (data)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	Process not Found
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic"	Process not Found
Set value (data)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	Process not Found
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	Process not Found
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	Process not Found
Set value (data)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	Process not Found
Set value (data)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	Process not Found
Set value (data)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 19002f433a5c000000000000000000000000000000000000000000	Process not Found
Set value (data)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	Process not Found

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2864	Process not Found

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2548	file.exe
2548	file.exe
2864	Process not Found
2864	Process not Found
2864	Process not Found
2864	Process not Found
2864	Process not Found
2864	Process not Found
2864	Process not Found
2864	Process not Found
2864	Process not Found
2864	Process not Found
2864	Process not Found
2864	Process not Found
2864	Process not Found
2864	Process not Found
2864	Process not Found
2864	Process not Found
2864	Process not Found
2864	Process not Found
2864	Process not Found
2864	Process not Found
2864	Process not Found
2864	Process not Found
2864	Process not Found
2864	Process not Found
2864	Process not Found
2864	Process not Found
2864	Process not Found
2864	Process not Found
2864	Process not Found
2864	Process not Found
2864	Process not Found
2864	Process not Found
2864	Process not Found
2864	Process not Found
2864	Process not Found
2864	Process not Found
2864	Process not Found
2864	Process not Found
2864	Process not Found
2864	Process not Found
2864	Process not Found
2864	Process not Found
2864	Process not Found
2864	Process not Found
2864	Process not Found
2864	Process not Found
2864	Process not Found
2864	Process not Found
2864	Process not Found
2864	Process not Found
2864	Process not Found
2864	Process not Found
2864	Process not Found
2864	Process not Found
2864	Process not Found
2864	Process not Found
2864	Process not Found
2864	Process not Found
2864	Process not Found
2864	Process not Found
2864	Process not Found
2864	Process not Found

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2864	Process not Found

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2548	file.exe

Suspicious use of AdjustPrivilegeToken 21 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4584	svchost.exe
Token: SeShutdownPrivilege	4584	svchost.exe
Token: SeCreatePagefilePrivilege	4584	svchost.exe
Token: SeShutdownPrivilege	2864	Process not Found
Token: SeCreatePagefilePrivilege	2864	Process not Found
Token: SeShutdownPrivilege	2864	Process not Found
Token: SeCreatePagefilePrivilege	2864	Process not Found
Token: SeShutdownPrivilege	2864	Process not Found
Token: SeCreatePagefilePrivilege	2864	Process not Found
Token: SeShutdownPrivilege	2864	Process not Found
Token: SeCreatePagefilePrivilege	2864	Process not Found
Token: SeShutdownPrivilege	2864	Process not Found
Token: SeCreatePagefilePrivilege	2864	Process not Found
Token: SeShutdownPrivilege	2864	Process not Found
Token: SeCreatePagefilePrivilege	2864	Process not Found
Token: SeShutdownPrivilege	2864	Process not Found
Token: SeCreatePagefilePrivilege	2864	Process not Found
Token: SeShutdownPrivilege	2864	Process not Found
Token: SeCreatePagefilePrivilege	2864	Process not Found
Token: SeShutdownPrivilege	2864	Process not Found
Token: SeCreatePagefilePrivilege	2864	Process not Found

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3196	rundll32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2864	Process not Found
2864	Process not Found

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2864 wrote to memory of 732	2864	Process not Found	91
PID 2864 wrote to memory of 732	2864	Process not Found	91
PID 2864 wrote to memory of 732	2864	Process not Found	91
PID 732 wrote to memory of 3696	732	6D9E.exe	92
PID 732 wrote to memory of 3696	732	6D9E.exe	92
PID 732 wrote to memory of 3696	732	6D9E.exe	92
PID 732 wrote to memory of 3196	732	6D9E.exe	103
PID 732 wrote to memory of 3196	732	6D9E.exe	103
PID 732 wrote to memory of 3196	732	6D9E.exe	103
PID 732 wrote to memory of 3196	732	6D9E.exe	103

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2548

C:\Users\Admin\AppData\Local\Temp\6D9E.exe
C:\Users\Admin\AppData\Local\Temp\6D9E.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:732
- C:\Windows\SysWOW64\agentactivationruntimestarter.exe
  C:\Windows\system32\agentactivationruntimestarter.exe
  2⤵
  PID:3696
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 732 -s 836
  2⤵
  - Program crash
  PID:4540
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 732 -s 916
  2⤵
  - Program crash
  PID:1536
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 732 -s 984
  2⤵
  - Program crash
  PID:3804
- C:\Windows\SysWOW64\rundll32.exe
  "C:\Windows\syswow64\rundll32.exe" "C:\Windows\syswow64\shell32.dll",#61
  2⤵
  - Blocklisted process makes network request
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of FindShellTrayWindow
  PID:3196

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k AarSvcGroup -p -s AarSvc
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4584

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x328 0x418
1⤵
PID:4456

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 732 -ip 732
1⤵
PID:3504

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 732 -ip 732
1⤵
PID:1312

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 732 -ip 732
1⤵
PID:484

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

6D9E.exe

Path C:\Users\Admin\AppData\Local\Temp\6D9E.exe
Size 4.6MB
SHA256 e4a8d0c5ce7c8b1e943c671968614dd40059bd2ccfb9112affe65f80aae1f1d8
MD5 96a464cd2b17c188539df98a59927069
SHA1 7ea4a621e3aece14ea53944a7656321f0cc23ba6
SHA512 95a25ca0919d33283dbfe082f8b236e7072c6ef1fd6efe7042fff17995b28ad68d324b0d09ac0d09e421eeac0b1c1bd6514954e2aa8925f8532bf212f7a0ab50
SSDEEP 98304:ORabJYMgvIEiatU7cEd15poP17ssKrD/Cd+qOkeg8lW8Pal61QDtV:r6MggEiAR252UrDq+qQg8SA1w
MD5 SHA1 SHA512 SSDEEP

Submit Download

6D9E.exe

Path C:\Users\Admin\AppData\Local\Temp\6D9E.exe
Size 4.6MB
SHA256 e4a8d0c5ce7c8b1e943c671968614dd40059bd2ccfb9112affe65f80aae1f1d8
MD5 96a464cd2b17c188539df98a59927069
SHA1 7ea4a621e3aece14ea53944a7656321f0cc23ba6
SHA512 95a25ca0919d33283dbfe082f8b236e7072c6ef1fd6efe7042fff17995b28ad68d324b0d09ac0d09e421eeac0b1c1bd6514954e2aa8925f8532bf212f7a0ab50
SSDEEP 98304:ORabJYMgvIEiatU7cEd15poP17ssKrD/Cd+qOkeg8lW8Pal61QDtV:r6MggEiAR252UrDq+qQg8SA1w
MD5 SHA1 SHA512 SSDEEP

Submit Download

Microsoft .NET Framework 4.7.2 Setup_20220901_111028643.html

Path C:\Users\Admin\AppData\Local\Temp\Microsoft .NET Framework 4.7.2 Setup_20220901_111028643.html
Size 93KB
SHA256 e214a59029c370790b51dbfe163cbb8461452b37f78ad54a271167711b50c38b
MD5 6dd53c3f60cd066e0c815544b8160958
SHA1 45331e49599554dfb4c87fa1ca9c40c68832f593
SHA512 4f02e5c81e8bdf4133a4d80e5f7289f1be41b0a33f948215bffb06bf7531a6c324a105c203d4fdee0c13000f7bea12f7cbe0b049f2f77fd412390af2d146a6d0
SSDEEP 768:fdsOTLyUFJFEWUxFzv1l5UQKhGJ85K7Yu:fdsWyUr+WUxpv1l5UQcu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Uapaipuuih.tmp

Path C:\Users\Admin\AppData\Local\Temp\Uapaipuuih.tmp
Size 3.3MB
SHA256 e473b9afa947ef211c7e7cad6521687d504ec244a22f5ea5381f7020f947fc7d
MD5 963024ce4b5518f20619bdcb2998a789
SHA1 bbce53b5aa2beeff5c9f1555a1e32350bba479b2
SHA512 468f341fb7c284f0024ad5d13a72264d60e77b9ea724a770b4d45856dc0aaedd30e51263ea266e6979d7db1079703a9bc1358c5562aac6761ee45c06436baae8
SSDEEP 49152:uBDRx3xq9F1QL+8wq74fDayjuTJBc3SYI6cwm/p2h2l9MSUOsrV9XGHb:Kdb+Fd8E7auWQbI6VFh2vMH27
MD5 SHA1 SHA512 SSDEEP

Submit Download

dd_vcredistMSI7626.txt

Path C:\Users\Admin\AppData\Local\Temp\dd_vcredistMSI7626.txt
Size 414KB
SHA256 29ae5501fbe82cf6ca45bc724e22db29fe115d5ee4ff67c1fac3055eaec04816
MD5 1665e1695efb8cff7253aa22d3b8d1af
SHA1 bb5cfec3bfdba7957199595d25dc5871ba1e55d9
SHA512 c9abb0bc028617a4152a27ce89a1b92f973d23fcc7cc6d2893c4a714f65ffd36255c9874c5bfacad4d514e7b67ecf5c37dd9cf017a25584c925c9bc490d0e9aa
SSDEEP 1536:o+pGwxXz5N6CtvWxAfib+kFsyJ+cqPz7U/7Bvl7ogIsbrwam9dJ6JxfsOWWoNgSX:o+LcjCGkhu40XywOn
MD5 SHA1 SHA512 SSDEEP

Submit Download

dd_vcredistUI7626.txt

Path C:\Users\Admin\AppData\Local\Temp\dd_vcredistUI7626.txt
Size 11KB
SHA256 c1806d15c75249bf5c76a2119add70bc35932fa352195e869336c875729fd91b
MD5 3c93e285f3bbe6e86160089a0a7ecc11
SHA1 8de0d9f28e092e4cc12a343c1a01331b3c83901b
SHA512 027e65e768f04c310b094e9dd029ac59bda27aef30605856336354b5490f0982267a8e5743a15bd7cfebe60dfe169f7c1d8ec7b5b492dd9008a15521023b55b2
SSDEEP 192:RQBt1of6YhXn/nDln/ntM4pnNns/QP8pxDr8VP:RQBt1of6YhX/Z/tM4pNBEMVP
MD5 SHA1 SHA512 SSDEEP

Submit Download

jawshtml.html

Path C:\Users\Admin\AppData\Local\Temp\jawshtml.html
Size 13B
SHA256 7b4f72a40bd21934680f085afe8a30bf85acff1a8365af43102025c4ccf52b73
MD5 b2a4bc176e9f29b0c439ef9a53a62a1a
SHA1 1ae520cbbf7e14af867232784194366b3d1c3f34
SHA512 e04b85d8d45d43479abbbe34f57265b64d1d325753ec3d2ecadb5f83fa5822b1d999b39571801ca39fa32e4a0a7caab073ccd003007e5b86dac7b1c892a5de3f
MD5 SHA1 SHA512

Submit Download

wmsetup.log

Path C:\Users\Admin\AppData\Local\Temp\wmsetup.log
Size 697B
SHA256 5ffbef5b65d7969e912ccdad478d225a1927480b6da0f6fa30156ca5eddb7ef5
MD5 fe4f6a24e5ab9d2d90051411307cf3a8
SHA1 a65b12b4d8e225eda13862b7ed6f30f56abb9569
SHA512 6e6159b5b13f21a2c13cffd92496d384aad7871fc2af079870b12068f9b646a785841b486c94993076cd25638ec8a0abb4aee5451d9602f05469e220f0747c0d
MD5 SHA1 SHA512

Submit Download

memory/732-152-0x0000000004350000-0x0000000004490000-memory.dmp

Download

memory/732-155-0x0000000004350000-0x0000000004490000-memory.dmp

Download

memory/732-142-0x0000000000400000-0x0000000000A22000-memory.dmp

Download

memory/732-143-0x0000000000400000-0x0000000000A22000-memory.dmp

Download

memory/732-144-0x0000000000400000-0x0000000000A22000-memory.dmp

Download

memory/732-145-0x0000000000400000-0x0000000000A22000-memory.dmp

Download

memory/732-146-0x0000000003880000-0x0000000004347000-memory.dmp

Download

memory/732-147-0x0000000003880000-0x0000000004347000-memory.dmp

Download

memory/732-148-0x0000000003880000-0x0000000004347000-memory.dmp

Download

memory/732-149-0x0000000004350000-0x0000000004490000-memory.dmp

Download

memory/732-150-0x0000000004350000-0x0000000004490000-memory.dmp

Download

memory/732-151-0x0000000004350000-0x0000000004490000-memory.dmp

Download

memory/732-171-0x0000000003880000-0x0000000004347000-memory.dmp

Download

memory/732-153-0x0000000004350000-0x0000000004490000-memory.dmp

Download

memory/732-154-0x0000000004350000-0x0000000004490000-memory.dmp

Download

memory/732-141-0x0000000002C30000-0x0000000003246000-memory.dmp

Download

memory/732-156-0x0000000004350000-0x0000000004490000-memory.dmp

Download

memory/732-169-0x0000000000400000-0x0000000000A22000-memory.dmp

Download

memory/732-139-0x00000000027B6000-0x0000000002C20000-memory.dmp

Download

memory/2548-135-0x0000000000400000-0x0000000000448000-memory.dmp

Download

memory/2548-134-0x0000000000400000-0x0000000000448000-memory.dmp

Download

memory/2548-133-0x0000000002040000-0x0000000002049000-memory.dmp

Download

memory/2548-132-0x00000000006AC000-0x00000000006BD000-memory.dmp

Download

memory/3196-160-0x00000000038A0000-0x00000000039E0000-memory.dmp

Download

memory/3196-167-0x0000000001010000-0x00000000019B8000-memory.dmp

Download

memory/3196-159-0x00000000038A0000-0x00000000039E0000-memory.dmp

Download

memory/3196-158-0x0000000002DD0000-0x0000000003897000-memory.dmp

Download

memory/3196-168-0x0000000002DD0000-0x0000000003897000-memory.dmp

Download

memory/3196-170-0x0000000002DD0000-0x0000000003897000-memory.dmp

Download