Analysis
-
max time kernel
61s -
max time network
137s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
04-11-2022 20:39
Behavioral task
behavioral1
Sample
24309b2ba65b27c007918670dd4deb6e90ddc9e629303d8c92efc04f34e16c77.exe
Resource
win7-20220812-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
24309b2ba65b27c007918670dd4deb6e90ddc9e629303d8c92efc04f34e16c77.exe
Resource
win10v2004-20220901-en
windows10-2004-x64
10 signatures
150 seconds
General
-
Target
24309b2ba65b27c007918670dd4deb6e90ddc9e629303d8c92efc04f34e16c77.exe
-
Size
5.3MB
-
MD5
7978902246a0c485295d89f408f37cfc
-
SHA1
ec0a15b66771f87066e4639d5139037fcd8a56d7
-
SHA256
24309b2ba65b27c007918670dd4deb6e90ddc9e629303d8c92efc04f34e16c77
-
SHA512
5db9379140c32458cd8e158e48e2dbdeb06cce7d83d7f21686f9c659ef6087c605250d6f45d2644d8bba2fec81b26dc4ca1265a19686a8c367a46536a4460fd1
-
SSDEEP
98304:ro/zlSaCeKvz1pIguaSvAiC949yFWoWcVR8kxtUbE34CgX1:rezrCTb1ugua7T0CpHmoY
Score
10/10
Malware Config
Signatures
-
joker
Joker is an Android malware that targets billing and SMS fraud.
-
resource yara_rule behavioral2/memory/3540-132-0x0000000000400000-0x0000000000F1C000-memory.dmp vmprotect behavioral2/memory/3540-133-0x0000000000400000-0x0000000000F1C000-memory.dmp vmprotect behavioral2/memory/3540-136-0x0000000000400000-0x0000000000F1C000-memory.dmp vmprotect behavioral2/memory/3540-139-0x0000000000400000-0x0000000000F1C000-memory.dmp vmprotect -
Loads dropped DLL 2 IoCs
pid Process 3540 24309b2ba65b27c007918670dd4deb6e90ddc9e629303d8c92efc04f34e16c77.exe 3540 24309b2ba65b27c007918670dd4deb6e90ddc9e629303d8c92efc04f34e16c77.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\dllhost.exe 24309b2ba65b27c007918670dd4deb6e90ddc9e629303d8c92efc04f34e16c77.exe File opened for modification C:\Windows\SysWOW64\svchost.exe 24309b2ba65b27c007918670dd4deb6e90ddc9e629303d8c92efc04f34e16c77.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\explorer.exe 24309b2ba65b27c007918670dd4deb6e90ddc9e629303d8c92efc04f34e16c77.exe File opened for modification C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe 24309b2ba65b27c007918670dd4deb6e90ddc9e629303d8c92efc04f34e16c77.exe File opened for modification C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe 24309b2ba65b27c007918670dd4deb6e90ddc9e629303d8c92efc04f34e16c77.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{48E59293-9880-11CF-9754-00AA00C00908} 24309b2ba65b27c007918670dd4deb6e90ddc9e629303d8c92efc04f34e16c77.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{48E59293-9880-11CF-9754-00AA00C00908}\Compatibility Flags = "1024" 24309b2ba65b27c007918670dd4deb6e90ddc9e629303d8c92efc04f34e16c77.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{48E59293-9880-11CF-9754-00AA00C00908}\AlternateCLSID = "{E2D211D5-11E4-4D9E-B6DB-1E902C851A49}" 24309b2ba65b27c007918670dd4deb6e90ddc9e629303d8c92efc04f34e16c77.exe -
Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E2D211D5-11E4-4D9E-B6DB-1E902C851A49}\TypeLib\ = "{48E59290-9880-11CF-9754-00AA00C00908}" 24309b2ba65b27c007918670dd4deb6e90ddc9e629303d8c92efc04f34e16c77.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59295-9880-11CF-9754-00AA00C00908} 24309b2ba65b27c007918670dd4deb6e90ddc9e629303d8c92efc04f34e16c77.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{48E59290-9880-11CF-9754-00AA00C00908}\1.0\FLAGS 24309b2ba65b27c007918670dd4deb6e90ddc9e629303d8c92efc04f34e16c77.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E2D211D5-11E4-4D9E-B6DB-1E902C851A49}\ToolboxBitmap32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MSINET.OCX, 1" 24309b2ba65b27c007918670dd4deb6e90ddc9e629303d8c92efc04f34e16c77.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{48E59291-9880-11CF-9754-00AA00C00908} 24309b2ba65b27c007918670dd4deb6e90ddc9e629303d8c92efc04f34e16c77.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{48E59292-9880-11CF-9754-00AA00C00908}\ProxyStubClsid32 24309b2ba65b27c007918670dd4deb6e90ddc9e629303d8c92efc04f34e16c77.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E2D211D5-11E4-4D9E-B6DB-1E902C851A49}\ToolboxBitmap32 24309b2ba65b27c007918670dd4deb6e90ddc9e629303d8c92efc04f34e16c77.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59293-9880-11CF-9754-00AA00C00908} 24309b2ba65b27c007918670dd4deb6e90ddc9e629303d8c92efc04f34e16c77.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}\MiscStatus 24309b2ba65b27c007918670dd4deb6e90ddc9e629303d8c92efc04f34e16c77.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E2D211D5-11E4-4D9E-B6DB-1E902C851A49}\Implemented Categories\{40FC6ED4-2438-11CF-A3DB-080036F12502} 24309b2ba65b27c007918670dd4deb6e90ddc9e629303d8c92efc04f34e16c77.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\InetCtls.Inet.1\CLSID\ = "{48E59293-9880-11CF-9754-00AA00C00908}" 24309b2ba65b27c007918670dd4deb6e90ddc9e629303d8c92efc04f34e16c77.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59294-9880-11CF-9754-00AA00C00908}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MSINET.OCX" 24309b2ba65b27c007918670dd4deb6e90ddc9e629303d8c92efc04f34e16c77.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{48E59290-9880-11CF-9754-00AA00C00908}\1.0\0\win32 24309b2ba65b27c007918670dd4deb6e90ddc9e629303d8c92efc04f34e16c77.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{48E59292-9880-11CF-9754-00AA00C00908}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" 24309b2ba65b27c007918670dd4deb6e90ddc9e629303d8c92efc04f34e16c77.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{E2D211D5-11E4-4D9E-B6DB-1E902C851A49}\CONTROL 24309b2ba65b27c007918670dd4deb6e90ddc9e629303d8c92efc04f34e16c77.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E2D211D5-11E4-4D9E-B6DB-1E902C851A49} 24309b2ba65b27c007918670dd4deb6e90ddc9e629303d8c92efc04f34e16c77.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\InetCtls.Inet.1 24309b2ba65b27c007918670dd4deb6e90ddc9e629303d8c92efc04f34e16c77.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}\ToolboxBitmap32 24309b2ba65b27c007918670dd4deb6e90ddc9e629303d8c92efc04f34e16c77.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59294-9880-11CF-9754-00AA00C00908}\InprocServer32 24309b2ba65b27c007918670dd4deb6e90ddc9e629303d8c92efc04f34e16c77.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E2D211D5-11E4-4D9E-B6DB-1E902C851A49}\ = "Microsoft Internet Transfer Control 6.0 (SP6)" 24309b2ba65b27c007918670dd4deb6e90ddc9e629303d8c92efc04f34e16c77.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59294-9880-11CF-9754-00AA00C00908} 24309b2ba65b27c007918670dd4deb6e90ddc9e629303d8c92efc04f34e16c77.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{48E59291-9880-11CF-9754-00AA00C00908}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" 24309b2ba65b27c007918670dd4deb6e90ddc9e629303d8c92efc04f34e16c77.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{48E59291-9880-11CF-9754-00AA00C00908}\TypeLib\ = "{48E59290-9880-11CF-9754-00AA00C00908}" 24309b2ba65b27c007918670dd4deb6e90ddc9e629303d8c92efc04f34e16c77.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}\TypeLib\ = "{48E59290-9880-11CF-9754-00AA00C00908}" 24309b2ba65b27c007918670dd4deb6e90ddc9e629303d8c92efc04f34e16c77.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E2D211D5-11E4-4D9E-B6DB-1E902C851A49}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MSINET.OCX" 24309b2ba65b27c007918670dd4deb6e90ddc9e629303d8c92efc04f34e16c77.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59295-9880-11CF-9754-00AA00C00908}\ = "Internet Control URL Property Page Object" 24309b2ba65b27c007918670dd4deb6e90ddc9e629303d8c92efc04f34e16c77.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\InetCtls.Inet\ = "Microsoft Internet Transfer Control 6.0 (SP6)" 24309b2ba65b27c007918670dd4deb6e90ddc9e629303d8c92efc04f34e16c77.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\InetCtls.Inet.1\CLSID\ = "{E2D211D5-11E4-4D9E-B6DB-1E902C851A49}" 24309b2ba65b27c007918670dd4deb6e90ddc9e629303d8c92efc04f34e16c77.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E2D211D5-11E4-4D9E-B6DB-1E902C851A49}\Control 24309b2ba65b27c007918670dd4deb6e90ddc9e629303d8c92efc04f34e16c77.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MSINET.OCX" 24309b2ba65b27c007918670dd4deb6e90ddc9e629303d8c92efc04f34e16c77.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}\InprocServer32 24309b2ba65b27c007918670dd4deb6e90ddc9e629303d8c92efc04f34e16c77.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}\Implemented Categories\{40FC6ED5-2438-11CF-A3DB-080036F12502} 24309b2ba65b27c007918670dd4deb6e90ddc9e629303d8c92efc04f34e16c77.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{48E59290-9880-11CF-9754-00AA00C00908}\1.0\0 24309b2ba65b27c007918670dd4deb6e90ddc9e629303d8c92efc04f34e16c77.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\InetCtls.Inet\CurVer 24309b2ba65b27c007918670dd4deb6e90ddc9e629303d8c92efc04f34e16c77.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\InetCtls.Inet.1\ = "Microsoft Internet Transfer Control 6.0 (SP6)" 24309b2ba65b27c007918670dd4deb6e90ddc9e629303d8c92efc04f34e16c77.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E2D211D5-11E4-4D9E-B6DB-1E902C851A49}\Programmable 24309b2ba65b27c007918670dd4deb6e90ddc9e629303d8c92efc04f34e16c77.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E2D211D5-11E4-4D9E-B6DB-1E902C851A49}\MiscStatus\ = "0" 24309b2ba65b27c007918670dd4deb6e90ddc9e629303d8c92efc04f34e16c77.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E2D211D5-11E4-4D9E-B6DB-1E902C851A49}\Implemented Categories\{0DE86A57-2BAA-11CF-A229-00AA003D7352} 24309b2ba65b27c007918670dd4deb6e90ddc9e629303d8c92efc04f34e16c77.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}\Implemented Categories\{0DE86A57-2BAA-11CF-A229-00AA003D7352} 24309b2ba65b27c007918670dd4deb6e90ddc9e629303d8c92efc04f34e16c77.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E2D211D5-11E4-4D9E-B6DB-1E902C851A49}\MiscStatus\1 24309b2ba65b27c007918670dd4deb6e90ddc9e629303d8c92efc04f34e16c77.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}\ = "Microsoft Internet Transfer Control 6.0 (SP6)" 24309b2ba65b27c007918670dd4deb6e90ddc9e629303d8c92efc04f34e16c77.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59295-9880-11CF-9754-00AA00C00908} 24309b2ba65b27c007918670dd4deb6e90ddc9e629303d8c92efc04f34e16c77.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{48E59292-9880-11CF-9754-00AA00C00908}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" 24309b2ba65b27c007918670dd4deb6e90ddc9e629303d8c92efc04f34e16c77.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{48E59292-9880-11CF-9754-00AA00C00908}\TypeLib\Version = "1.0" 24309b2ba65b27c007918670dd4deb6e90ddc9e629303d8c92efc04f34e16c77.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}\TypeLib 24309b2ba65b27c007918670dd4deb6e90ddc9e629303d8c92efc04f34e16c77.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}\MiscStatus\1 24309b2ba65b27c007918670dd4deb6e90ddc9e629303d8c92efc04f34e16c77.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}\ToolboxBitmap32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MSINET.OCX, 1" 24309b2ba65b27c007918670dd4deb6e90ddc9e629303d8c92efc04f34e16c77.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{48E59291-9880-11CF-9754-00AA00C00908}\ProxyStubClsid32 24309b2ba65b27c007918670dd4deb6e90ddc9e629303d8c92efc04f34e16c77.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\InetCtls.Inet\CLSID\ = "{48E59293-9880-11CF-9754-00AA00C00908}" 24309b2ba65b27c007918670dd4deb6e90ddc9e629303d8c92efc04f34e16c77.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}\ProgID 24309b2ba65b27c007918670dd4deb6e90ddc9e629303d8c92efc04f34e16c77.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59295-9880-11CF-9754-00AA00C00908}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MSINET.OCX" 24309b2ba65b27c007918670dd4deb6e90ddc9e629303d8c92efc04f34e16c77.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{48E59290-9880-11CF-9754-00AA00C00908}\1.0\HELPDIR 24309b2ba65b27c007918670dd4deb6e90ddc9e629303d8c92efc04f34e16c77.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{48E59292-9880-11CF-9754-00AA00C00908} 24309b2ba65b27c007918670dd4deb6e90ddc9e629303d8c92efc04f34e16c77.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\InetCtls.Inet\CLSID 24309b2ba65b27c007918670dd4deb6e90ddc9e629303d8c92efc04f34e16c77.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{48E59292-9880-11CF-9754-00AA00C00908}\TypeLib 24309b2ba65b27c007918670dd4deb6e90ddc9e629303d8c92efc04f34e16c77.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E2D211D5-11E4-4D9E-B6DB-1E902C851A49}\VersionIndependentProgID\ = "InetCtls.Inet" 24309b2ba65b27c007918670dd4deb6e90ddc9e629303d8c92efc04f34e16c77.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E2D211D5-11E4-4D9E-B6DB-1E902C851A49}\ProgID 24309b2ba65b27c007918670dd4deb6e90ddc9e629303d8c92efc04f34e16c77.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E2D211D5-11E4-4D9E-B6DB-1E902C851A49}\Implemented Categories\{40FC6ED5-2438-11CF-A3DB-080036F12502} 24309b2ba65b27c007918670dd4deb6e90ddc9e629303d8c92efc04f34e16c77.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E2D211D5-11E4-4D9E-B6DB-1E902C851A49}\Implemented Categories\{0DE86A52-2BAA-11CF-A229-00AA003D7352} 24309b2ba65b27c007918670dd4deb6e90ddc9e629303d8c92efc04f34e16c77.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}\InprocServer32\ThreadingModel = "Apartment" 24309b2ba65b27c007918670dd4deb6e90ddc9e629303d8c92efc04f34e16c77.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E2D211D5-11E4-4D9E-B6DB-1E902C851A49}\VersionIndependentProgID 24309b2ba65b27c007918670dd4deb6e90ddc9e629303d8c92efc04f34e16c77.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E2D211D5-11E4-4D9E-B6DB-1E902C851A49}\Version\ = "1.0" 24309b2ba65b27c007918670dd4deb6e90ddc9e629303d8c92efc04f34e16c77.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E2D211D5-11E4-4D9E-B6DB-1E902C851A49}\Implemented Categories\{0DE86A53-2BAA-11CF-A229-00AA003D7352} 24309b2ba65b27c007918670dd4deb6e90ddc9e629303d8c92efc04f34e16c77.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}\Control 24309b2ba65b27c007918670dd4deb6e90ddc9e629303d8c92efc04f34e16c77.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 3540 24309b2ba65b27c007918670dd4deb6e90ddc9e629303d8c92efc04f34e16c77.exe 3540 24309b2ba65b27c007918670dd4deb6e90ddc9e629303d8c92efc04f34e16c77.exe 3540 24309b2ba65b27c007918670dd4deb6e90ddc9e629303d8c92efc04f34e16c77.exe 3540 24309b2ba65b27c007918670dd4deb6e90ddc9e629303d8c92efc04f34e16c77.exe 3540 24309b2ba65b27c007918670dd4deb6e90ddc9e629303d8c92efc04f34e16c77.exe 3540 24309b2ba65b27c007918670dd4deb6e90ddc9e629303d8c92efc04f34e16c77.exe 3540 24309b2ba65b27c007918670dd4deb6e90ddc9e629303d8c92efc04f34e16c77.exe 3540 24309b2ba65b27c007918670dd4deb6e90ddc9e629303d8c92efc04f34e16c77.exe 3540 24309b2ba65b27c007918670dd4deb6e90ddc9e629303d8c92efc04f34e16c77.exe 3540 24309b2ba65b27c007918670dd4deb6e90ddc9e629303d8c92efc04f34e16c77.exe 3540 24309b2ba65b27c007918670dd4deb6e90ddc9e629303d8c92efc04f34e16c77.exe 3540 24309b2ba65b27c007918670dd4deb6e90ddc9e629303d8c92efc04f34e16c77.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3540 24309b2ba65b27c007918670dd4deb6e90ddc9e629303d8c92efc04f34e16c77.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\24309b2ba65b27c007918670dd4deb6e90ddc9e629303d8c92efc04f34e16c77.exe"C:\Users\Admin\AppData\Local\Temp\24309b2ba65b27c007918670dd4deb6e90ddc9e629303d8c92efc04f34e16c77.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3540
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
128KB
MD5bed46f55af9a7b495ec0f2de0cb5ad3f
SHA1e9c47a7cabbf62e154dca7dba2301cc8eac1047e
SHA256c11615f4561755632da7469e6c5fbf3ead40e0d9747030c90077b70115692ce3
SHA5124938f4e4007e63d990d6b18907b71b7108d9f1d5cbeab194bdf3c25226da20b2995102d79daa262b433f6a4479a9cceafea6c8f5b6f86bd190c751e7c0bd788b
-
Filesize
128KB
MD5bed46f55af9a7b495ec0f2de0cb5ad3f
SHA1e9c47a7cabbf62e154dca7dba2301cc8eac1047e
SHA256c11615f4561755632da7469e6c5fbf3ead40e0d9747030c90077b70115692ce3
SHA5124938f4e4007e63d990d6b18907b71b7108d9f1d5cbeab194bdf3c25226da20b2995102d79daa262b433f6a4479a9cceafea6c8f5b6f86bd190c751e7c0bd788b