Analysis
-
max time kernel
152s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
11/10/2022, 07:45
Static task
static1
Behavioral task
behavioral1
Sample
55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe
Resource
win7-20220901-en
General
-
Target
55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe
-
Size
2.3MB
-
MD5
692213b2c7610cdb5656fb1f138e181e
-
SHA1
1581c44c08e239417d1904a4b706fa2a7a742f71
-
SHA256
55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b
-
SHA512
55705633ef5c769b0618dc20f2d716535846e00d71ea7f727f079969353410561a4b85f6f5eca0be8a36eeb02b71a931c56fcd1d0c4b64658ad69912f417d9ff
-
SSDEEP
49152:OBrlCNnO0x9qk4QLH2mUrQOyH6A1retpOls:OBBoOa9UKWm0262y
Malware Config
Signatures
-
Checks for common network interception software 1 TTPs
Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
-
Enumerates VirtualBox registry keys 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe -
Blocks application from running via registry modification 18 IoCs
Adds application to list of disallowed applications.
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\ 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\0 = "msseces.exe" 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\1 = "MSASCui.exe" 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\3 = "egui.exe" 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\5 = "avcenter.exe" 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\10 = "avgscanx.exe" 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\9 = "avgtray.exe" 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1" 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\2 = "ekrn.exe" 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\7 = "avgfrw.exe" 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\14 = "avgcmgr.exe" 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\4 = "avgnt.exe" 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\6 = "avscan.exe" 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\8 = "avgui.exe" 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\11 = "avgcfgex.exe" 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\12 = "avgemc.exe" 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\13 = "avgchsvx.exe" 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\15 = "avgwdsvc.exe" 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe -
Drops file in Drivers directory 5 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\etc\hosts 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe File opened for modification C:\Windows\system32\drivers\etc\host_new 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe File created C:\Windows\system32\drivers\etc\host_new 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe File created C:\Windows\System32\drivers\etc\hosts 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe File opened for modification C:\Windows\System32\drivers\etc\hosts 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe -
Sets file execution options in registry 2 TTPs 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\smrtdefp.exe 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\f-agnt95.exe\Debugger = "svchost.exe" 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\portmonitor.exe 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sh.exe 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ss3edit.exe 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tc.exe 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\window.exe\Debugger = "svchost.exe" 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\csc.exe 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\crashrep.exe 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmdagent.exe 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cssurf.exe 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cfinet32.exe 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fsgk32.exe 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\inetlnfo.exe 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\srng.exe 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pavsrv51.exe 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\defwatch.exe\Debugger = "svchost.exe" 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fp-win.exe\Debugger = "svchost.exe" 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\portmonitor.exe\Debugger = "svchost.exe" 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vsmon.exe\Debugger = "svchost.exe" 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\personalguard.exe 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rwg.exe\Debugger = "svchost.exe" 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VisthLic.exe 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ashServ.exe\Debugger = "svchost.exe" 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bidserver.exe 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cleaner.exe 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mapisvc32.exe\Debugger = "svchost.exe" 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\platin.exe\Debugger = "svchost.exe" 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ssgrate.exe 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tds-3.exe\Debugger = "svchost.exe" 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ashDisp.exe\Debugger = "svchost.exe" 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\autotrace.exe 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avptc32.exe 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\blink.exe 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cdp.exe 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dpps2.exe 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mrflux.exe\Debugger = "svchost.exe" 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\scan95.exe 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PC_Antispyware2010.exe 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SaveKeep.exe\Debugger = "svchost.exe" 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AluSchedulerSvc.exe 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\escanhnt.exe\Debugger = "svchost.exe" 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\expert.exe\Debugger = "svchost.exe" 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\icload95.exe\Debugger = "svchost.exe" 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\icsupp95.exe\Debugger = "svchost.exe" 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rav7win.exe\Debugger = "svchost.exe" 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sc.exe\Debugger = "svchost.exe" 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\xpf202en.exe\Debugger = "svchost.exe" 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\frw.exe\Debugger = "svchost.exe" 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ostronet.exe\Debugger = "svchost.exe" 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\scanpm.exe 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\frmwrk32.exe 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fsgk32.exe\Debugger = "svchost.exe" 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rtvscn95.exe 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sbserv.exe 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\symtray.exe\Debugger = "svchost.exe" 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\poproxy.exe 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cfpupdat.exe 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\istsvc.exe 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\navnt.exe\Debugger = "svchost.exe" 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\npscheck.exe 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\protectx.exe\Debugger = "svchost.exe" 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rapapp.exe 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cpfnt206.exe 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe -
resource yara_rule behavioral2/memory/4208-133-0x0000000013140000-0x000000001372E000-memory.dmp upx behavioral2/memory/4208-135-0x0000000013140000-0x000000001372E000-memory.dmp upx behavioral2/memory/4208-136-0x0000000013140000-0x000000001372E000-memory.dmp upx behavioral2/memory/4208-137-0x0000000013140000-0x000000001372E000-memory.dmp upx behavioral2/memory/4208-138-0x0000000013140000-0x000000001372E000-memory.dmp upx behavioral2/memory/4208-144-0x0000000013140000-0x000000001372E000-memory.dmp upx -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Unexpected DNS network traffic destination 36 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 208.67.220.220 Destination IP 208.67.220.220 Destination IP 208.67.222.222 Destination IP 208.67.220.220 Destination IP 208.67.220.220 Destination IP 208.67.220.220 Destination IP 208.67.222.222 Destination IP 208.67.222.222 Destination IP 208.67.222.222 Destination IP 208.67.220.220 Destination IP 208.67.220.220 Destination IP 208.67.222.222 Destination IP 208.67.222.222 Destination IP 208.67.222.222 Destination IP 208.67.220.220 Destination IP 208.67.220.220 Destination IP 208.67.222.222 Destination IP 208.67.220.220 Destination IP 208.67.222.222 Destination IP 208.67.220.220 Destination IP 208.67.222.222 Destination IP 208.67.222.222 Destination IP 208.67.220.220 Destination IP 208.67.222.222 Destination IP 208.67.222.222 Destination IP 208.67.220.220 Destination IP 208.67.220.220 Destination IP 208.67.222.222 Destination IP 208.67.220.220 Destination IP 208.67.222.222 Destination IP 208.67.220.220 Destination IP 208.67.222.222 Destination IP 208.67.220.220 Destination IP 208.67.220.220 Destination IP 208.67.222.222 Destination IP 208.67.222.222 -
Adds Run key to start application 2 TTPs 5 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows\CurrentVersion\Run 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Key deleted \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System Smart Security = "\"C:\\ProgramData\\e73ad\\SS6de.exe\" /s /d" 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe -
Checks for any installed AV software in registry 1 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Eset\Nod\ 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\P: 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe File opened (read-only) \??\R: 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe File opened (read-only) \??\H: 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe File opened (read-only) \??\J: 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe File opened (read-only) \??\M: 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe File opened (read-only) \??\O: 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe File opened (read-only) \??\V: 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe File opened (read-only) \??\W: 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe File opened (read-only) \??\K: 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe File opened (read-only) \??\L: 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe File opened (read-only) \??\Q: 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe File opened (read-only) \??\T: 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe File opened (read-only) \??\F: 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe File opened (read-only) \??\U: 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe File opened (read-only) \??\Z: 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe File opened (read-only) \??\S: 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe File opened (read-only) \??\X: 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe File opened (read-only) \??\Y: 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe File opened (read-only) \??\E: 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe File opened (read-only) \??\G: 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe File opened (read-only) \??\I: 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe File opened (read-only) \??\N: 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4344 set thread context of 4208 4344 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 82 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Download\CheckExeSignatures = "no" 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Download\RunInvalidSignatures = "1" 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\BrowserEmulation 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\SearchScopes 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\PRS = "http://127.0.0.1:27777/?inj=%ORIGINAL%" 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\IIL = "0" 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\ltTST = "47843" 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\URL = "http://findgala.com/?&uid=287&q={searchTerms}" 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\ltHI = "0" 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\BrowserEmulation\MSCompatibilityMode = "0" 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe -
Modifies data under HKEY_USERS 6 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\Internet Explorer\SearchScopes 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\URL = "http://findgala.com/?&uid=287&q={searchTerms}" 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\SearchScopes 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\SearchScopes\URL = "http://findgala.com/?&uid=287&q={searchTerms}" 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Internet Explorer\SearchScopes 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Set value (str) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\URL = "http://findgala.com/?&uid=287&q={searchTerms}" 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe -
Modifies registry class 15 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe" 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.DocHostUIHandler\Clsid 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Software 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Software\Microsoft 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF}\LocalServer32 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Software\Microsoft\Internet Explorer 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.DocHostUIHandler\Clsid\ = "{3F2BBC05-40DF-11D2-9455-00104BC936FF}" 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.DocHostUIHandler 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.DocHostUIHandler\ = "Implements DocHostUIHandler" 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF}\ProgID 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF}\ProgID\ = "55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.DocHostUIHandler" 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Software\Microsoft\Internet Explorer\SearchScopes 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Software\Microsoft\Internet Explorer\SearchScopes\URL = "http://findgala.com/?&uid=287&q={searchTerms}" 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF}\ = "Implements DocHostUIHandler" 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF} 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4208 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 4208 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 4208 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 4208 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 4208 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 4208 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 4208 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 4208 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 4208 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 4208 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 4208 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 4208 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 4208 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 4208 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 4208 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 4208 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 4208 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 4208 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 4208 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 4208 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 4208 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 4208 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 4208 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 4208 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 4208 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 4208 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 4208 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 4208 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 4208 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 4208 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 4208 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 4208 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 4208 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 4208 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 4208 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 4208 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 4208 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 4208 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 4208 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 4208 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 4208 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 4208 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 4208 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 4208 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 4208 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 4208 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 4208 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 4208 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 4208 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 4208 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 4208 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 4208 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 4208 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 4208 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 4208 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 4208 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 4208 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 4208 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 4208 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 4208 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 4208 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 4208 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 4208 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 4208 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeSecurityPrivilege 2088 mofcomp.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 4208 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 4208 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe -
Suspicious use of SendNotifyMessage 2 IoCs
pid Process 4208 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 4208 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4208 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 4208 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4344 wrote to memory of 4208 4344 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 82 PID 4344 wrote to memory of 4208 4344 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 82 PID 4344 wrote to memory of 4208 4344 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 82 PID 4344 wrote to memory of 4208 4344 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 82 PID 4344 wrote to memory of 4208 4344 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 82 PID 4208 wrote to memory of 2088 4208 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 85 PID 4208 wrote to memory of 2088 4208 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 85 PID 4208 wrote to memory of 2088 4208 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 85 PID 4208 wrote to memory of 2060 4208 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 87 PID 4208 wrote to memory of 2060 4208 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 87 PID 4208 wrote to memory of 2060 4208 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 87 PID 4208 wrote to memory of 3752 4208 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 89 PID 4208 wrote to memory of 3752 4208 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 89 PID 4208 wrote to memory of 3752 4208 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 89 PID 4208 wrote to memory of 220 4208 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 91 PID 4208 wrote to memory of 220 4208 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 91 PID 4208 wrote to memory of 220 4208 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 91 PID 4208 wrote to memory of 3540 4208 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 94 PID 4208 wrote to memory of 3540 4208 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 94 PID 4208 wrote to memory of 3540 4208 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 94 PID 4208 wrote to memory of 4908 4208 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 96 PID 4208 wrote to memory of 4908 4208 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 96 PID 4208 wrote to memory of 4908 4208 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 96 PID 4208 wrote to memory of 4360 4208 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 98 PID 4208 wrote to memory of 4360 4208 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 98 PID 4208 wrote to memory of 4360 4208 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 98 PID 4208 wrote to memory of 436 4208 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 100 PID 4208 wrote to memory of 436 4208 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 100 PID 4208 wrote to memory of 436 4208 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 100 PID 4208 wrote to memory of 3964 4208 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 102 PID 4208 wrote to memory of 3964 4208 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 102 PID 4208 wrote to memory of 3964 4208 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 102 PID 4208 wrote to memory of 5116 4208 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 104 PID 4208 wrote to memory of 5116 4208 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 104 PID 4208 wrote to memory of 5116 4208 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 104 PID 4208 wrote to memory of 1584 4208 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 106 PID 4208 wrote to memory of 1584 4208 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 106 PID 4208 wrote to memory of 1584 4208 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 106 PID 4208 wrote to memory of 2320 4208 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 108 PID 4208 wrote to memory of 2320 4208 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 108 PID 4208 wrote to memory of 2320 4208 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 108 PID 4208 wrote to memory of 2660 4208 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 110 PID 4208 wrote to memory of 2660 4208 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 110 PID 4208 wrote to memory of 2660 4208 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 110 PID 4208 wrote to memory of 3344 4208 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 112 PID 4208 wrote to memory of 3344 4208 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 112 PID 4208 wrote to memory of 3344 4208 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 112 PID 4208 wrote to memory of 3188 4208 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 114 PID 4208 wrote to memory of 3188 4208 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 114 PID 4208 wrote to memory of 3188 4208 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 114 PID 4208 wrote to memory of 4852 4208 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 116 PID 4208 wrote to memory of 4852 4208 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 116 PID 4208 wrote to memory of 4852 4208 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 116 PID 4208 wrote to memory of 3404 4208 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 118 PID 4208 wrote to memory of 3404 4208 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 118 PID 4208 wrote to memory of 3404 4208 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 118 PID 4208 wrote to memory of 4516 4208 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 120 PID 4208 wrote to memory of 4516 4208 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 120 PID 4208 wrote to memory of 4516 4208 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 120 PID 4208 wrote to memory of 1332 4208 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 122 PID 4208 wrote to memory of 1332 4208 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 122 PID 4208 wrote to memory of 1332 4208 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 122 PID 4208 wrote to memory of 3976 4208 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 124 PID 4208 wrote to memory of 3976 4208 55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe 124
Processes
-
C:\Users\Admin\AppData\Local\Temp\55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe"C:\Users\Admin\AppData\Local\Temp\55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4344 -
C:\Users\Admin\AppData\Local\Temp\55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe"C:\Users\Admin\AppData\Local\Temp\55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe" "C:\Users\Admin\AppData\Local\Temp\55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe"2⤵
- Enumerates VirtualBox registry keys
- Blocks application from running via registry modification
- Drops file in Drivers directory
- Sets file execution options in registry
- Adds Run key to start application
- Checks for any installed AV software in registry
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4208 -
C:\Windows\SysWOW64\Wbem\mofcomp.exemofcomp "C:\Users\Admin\AppData\Local\Temp\5371.mof"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2088
-
-
C:\Windows\SysWOW64\netsh.exenetsh "firewall" add allowedprogram "C:\Users\Admin\AppData\Local\Temp\55d1c26e13418119bfb2ea0d7f25b50e3e1799e21abe98408b3593d85c405a7b.exe" "System Smart Security" ENABLE3⤵PID:2060
-
-
C:\Windows\SysWOW64\nslookup.exenslookup -q=txt jj153svdksafjnqv.com 8.8.8.83⤵PID:3752
-
-
C:\Windows\SysWOW64\nslookup.exenslookup -q=txt jj153svdksafjnqv.net 8.8.8.83⤵PID:220
-
-
C:\Windows\SysWOW64\nslookup.exenslookup -q=txt jj153svdksafjnqv.com 208.67.222.2223⤵PID:3540
-
-
C:\Windows\SysWOW64\nslookup.exenslookup -q=txt jj153svdksafjnqv.net 208.67.222.2223⤵PID:4908
-
-
C:\Windows\SysWOW64\nslookup.exenslookup -q=txt jj153svdksafjnqv.com 8.8.4.43⤵PID:4360
-
-
C:\Windows\SysWOW64\nslookup.exenslookup -q=txt jj153svdksafjnqv.net 8.8.4.43⤵PID:436
-
-
C:\Windows\SysWOW64\nslookup.exenslookup -q=txt jj153svdksafjnqv.com 208.67.220.2203⤵PID:3964
-
-
C:\Windows\SysWOW64\nslookup.exenslookup -q=txt jj153svdksafjnqv.net 208.67.220.2203⤵PID:5116
-
-
C:\Windows\SysWOW64\nslookup.exenslookup -q=txt eejllo680ooxggl.com 8.8.8.83⤵PID:1584
-
-
C:\Windows\SysWOW64\nslookup.exenslookup -q=txt eejllo680ooxggl.net 8.8.8.83⤵PID:2320
-
-
C:\Windows\SysWOW64\nslookup.exenslookup -q=txt eejllo680ooxggl.com 208.67.222.2223⤵PID:2660
-
-
C:\Windows\SysWOW64\nslookup.exenslookup -q=txt eejllo680ooxggl.net 208.67.222.2223⤵PID:3344
-
-
C:\Windows\SysWOW64\nslookup.exenslookup -q=txt eejllo680ooxggl.com 8.8.4.43⤵PID:3188
-
-
C:\Windows\SysWOW64\nslookup.exenslookup -q=txt eejllo680ooxggl.net 8.8.4.43⤵PID:4852
-
-
C:\Windows\SysWOW64\nslookup.exenslookup -q=txt eejllo680ooxggl.com 208.67.220.2203⤵PID:3404
-
-
C:\Windows\SysWOW64\nslookup.exenslookup -q=txt eejllo680ooxggl.net 208.67.220.2203⤵PID:4516
-
-
C:\Windows\SysWOW64\nslookup.exenslookup -q=txt joqzeltvzhm1615r.com 8.8.8.83⤵PID:1332
-
-
C:\Windows\SysWOW64\nslookup.exenslookup -q=txt joqzeltvzhm1615r.net 8.8.8.83⤵PID:3976
-
-
C:\Windows\SysWOW64\nslookup.exenslookup -q=txt joqzeltvzhm1615r.com 208.67.222.2223⤵PID:528
-
-
C:\Windows\SysWOW64\nslookup.exenslookup -q=txt joqzeltvzhm1615r.net 208.67.222.2223⤵PID:5004
-
-
C:\Windows\SysWOW64\nslookup.exenslookup -q=txt joqzeltvzhm1615r.com 8.8.4.43⤵PID:3532
-
-
C:\Windows\SysWOW64\nslookup.exenslookup -q=txt joqzeltvzhm1615r.net 8.8.4.43⤵PID:1424
-
-
C:\Windows\SysWOW64\nslookup.exenslookup -q=txt joqzeltvzhm1615r.com 208.67.220.2203⤵PID:380
-
-
C:\Windows\SysWOW64\nslookup.exenslookup -q=txt joqzeltvzhm1615r.net 208.67.220.2203⤵PID:3092
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
340B
MD5d37b493814e9f43c0d7a9461b2bf6315
SHA1045d3cb6cbde9893d670d3c1742ccc1f6fff0387
SHA25607acf96a1e3f0474c5d6a9e51dbf26967a0328186b382fdc9bbeb702527277ad
SHA512fb4ca0ecf430ed14b401eb54ba01276c4d9592c51a2e4daa8490593f06c768ffa867107bf86f56a66400078239c98f5218c4c45bec2410b70216df9d8a82bc3f