Analysis
- max time kernel
112s - max time network
140s - platform
windows10-2004_x64 - resource
win10v2004-20220901-en - resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system - submitted
07/11/2022, 22:51
Behavioral task
behavioral1
Sample
e7b81196130cbeaf457190262617a1c1bf42ab54fab13d8d60e4c9ec3f09911a.exe
Resource
win7-20220812-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
e7b81196130cbeaf457190262617a1c1bf42ab54fab13d8d60e4c9ec3f09911a.exe
Resource
win10v2004-20220901-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target e7b81196130cbeaf457190262617a1c1bf42ab54fab13d8d60e4c9ec3f09911a.exe
- Size 5.3MB
- Sample221107-2stv7adcc2
- SHA256 e7b81196130cbeaf457190262617a1c1bf42ab54fab13d8d60e4c9ec3f09911a
- MD5 0231d50d86d9b0ab8efecf9944b5bb4d
- SHA1 504cb8fa7d81110af58800a21560b1938c11eeb3
- SHA512 9680593431045af371fc0b040bc0fc317e9e15f99778e3fe04b6716da7215bf64011de34a914c21ec7bb4936e8f711f39260e98043ef282ec55293278f8f659e
- SSDEEP 98304:x+xscOFq6kIUeOhoTbF9k5zAqGnrZUnf1MFkpkr7fBf64pDMK:QOFq6kf3K8nYqf1MKk5P
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- joker
Joker is an Android malware that targets billing and SMS fraud.
-
resource yara_rule behavioral2/memory/1780-132-0x0000000000400000-0x0000000000F2E000-memory.dmp vmprotect behavioral2/memory/1780-133-0x0000000000400000-0x0000000000F2E000-memory.dmp vmprotect behavioral2/memory/1780-134-0x0000000000400000-0x0000000000F2E000-memory.dmp vmprotect behavioral2/memory/1780-139-0x0000000000400000-0x0000000000F2E000-memory.dmp vmprotect - Loads dropped DLL 2 IoCs
pid Process 1780 e7b81196130cbeaf457190262617a1c1bf42ab54fab13d8d60e4c9ec3f09911a.exe 1780 e7b81196130cbeaf457190262617a1c1bf42ab54fab13d8d60e4c9ec3f09911a.exe - Drops file in System32 directory 3 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\dllhost.exe e7b81196130cbeaf457190262617a1c1bf42ab54fab13d8d60e4c9ec3f09911a.exe File opened for modification C:\Windows\SysWOW64\backgroundTaskHost.exe e7b81196130cbeaf457190262617a1c1bf42ab54fab13d8d60e4c9ec3f09911a.exe File opened for modification C:\Windows\SysWOW64\svchost.exe e7b81196130cbeaf457190262617a1c1bf42ab54fab13d8d60e4c9ec3f09911a.exe - Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\explorer.exe e7b81196130cbeaf457190262617a1c1bf42ab54fab13d8d60e4c9ec3f09911a.exe File opened for modification C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe e7b81196130cbeaf457190262617a1c1bf42ab54fab13d8d60e4c9ec3f09911a.exe File opened for modification C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe e7b81196130cbeaf457190262617a1c1bf42ab54fab13d8d60e4c9ec3f09911a.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{48E59293-9880-11CF-9754-00AA00C00908} e7b81196130cbeaf457190262617a1c1bf42ab54fab13d8d60e4c9ec3f09911a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{48E59293-9880-11CF-9754-00AA00C00908}\Compatibility Flags = "1024" e7b81196130cbeaf457190262617a1c1bf42ab54fab13d8d60e4c9ec3f09911a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{48E59293-9880-11CF-9754-00AA00C00908}\AlternateCLSID = "{E2D211D5-11E4-4D9E-B6DB-1E902C851A49}" e7b81196130cbeaf457190262617a1c1bf42ab54fab13d8d60e4c9ec3f09911a.exe - Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E2D211D5-11E4-4D9E-B6DB-1E902C851A49}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MSINET.OCX" e7b81196130cbeaf457190262617a1c1bf42ab54fab13d8d60e4c9ec3f09911a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}\MiscStatus\1\ = "132497" e7b81196130cbeaf457190262617a1c1bf42ab54fab13d8d60e4c9ec3f09911a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59294-9880-11CF-9754-00AA00C00908}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MSINET.OCX" e7b81196130cbeaf457190262617a1c1bf42ab54fab13d8d60e4c9ec3f09911a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{48E59291-9880-11CF-9754-00AA00C00908}\ProxyStubClsid32 e7b81196130cbeaf457190262617a1c1bf42ab54fab13d8d60e4c9ec3f09911a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\InetCtls.Inet.1\ = "Microsoft Internet Transfer Control 6.0 (SP6)" e7b81196130cbeaf457190262617a1c1bf42ab54fab13d8d60e4c9ec3f09911a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E2D211D5-11E4-4D9E-B6DB-1E902C851A49}\Implemented Categories\{40FC6ED4-2438-11CF-A3DB-080036F12502} e7b81196130cbeaf457190262617a1c1bf42ab54fab13d8d60e4c9ec3f09911a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{48E59290-9880-11CF-9754-00AA00C00908}\1.0\ = "Microsoft Internet Transfer Control 6.0 (SP6)" e7b81196130cbeaf457190262617a1c1bf42ab54fab13d8d60e4c9ec3f09911a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{48E59292-9880-11CF-9754-00AA00C00908}\TypeLib\ = "{48E59290-9880-11CF-9754-00AA00C00908}" e7b81196130cbeaf457190262617a1c1bf42ab54fab13d8d60e4c9ec3f09911a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}\Implemented Categories\{0DE86A53-2BAA-11CF-A229-00AA003D7352} e7b81196130cbeaf457190262617a1c1bf42ab54fab13d8d60e4c9ec3f09911a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59294-9880-11CF-9754-00AA00C00908}\InprocServer32 e7b81196130cbeaf457190262617a1c1bf42ab54fab13d8d60e4c9ec3f09911a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{48E59291-9880-11CF-9754-00AA00C00908}\TypeLib\Version = "1.0" e7b81196130cbeaf457190262617a1c1bf42ab54fab13d8d60e4c9ec3f09911a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E2D211D5-11E4-4D9E-B6DB-1E902C851A49}\ProgID e7b81196130cbeaf457190262617a1c1bf42ab54fab13d8d60e4c9ec3f09911a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E2D211D5-11E4-4D9E-B6DB-1E902C851A49}\ProgID\ = "InetCtls.Inet.1" e7b81196130cbeaf457190262617a1c1bf42ab54fab13d8d60e4c9ec3f09911a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E2D211D5-11E4-4D9E-B6DB-1E902C851A49}\Implemented Categories\{0DE86A57-2BAA-11CF-A229-00AA003D7352} e7b81196130cbeaf457190262617a1c1bf42ab54fab13d8d60e4c9ec3f09911a.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59295-9880-11CF-9754-00AA00C00908} e7b81196130cbeaf457190262617a1c1bf42ab54fab13d8d60e4c9ec3f09911a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{48E59291-9880-11CF-9754-00AA00C00908} e7b81196130cbeaf457190262617a1c1bf42ab54fab13d8d60e4c9ec3f09911a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\InetCtls.Inet.1\CLSID e7b81196130cbeaf457190262617a1c1bf42ab54fab13d8d60e4c9ec3f09911a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E2D211D5-11E4-4D9E-B6DB-1E902C851A49}\Programmable e7b81196130cbeaf457190262617a1c1bf42ab54fab13d8d60e4c9ec3f09911a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E2D211D5-11E4-4D9E-B6DB-1E902C851A49}\Implemented Categories\{40FC6ED5-2438-11CF-A3DB-080036F12502} e7b81196130cbeaf457190262617a1c1bf42ab54fab13d8d60e4c9ec3f09911a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}\Implemented Categories\{40FC6ED5-2438-11CF-A3DB-080036F12502} e7b81196130cbeaf457190262617a1c1bf42ab54fab13d8d60e4c9ec3f09911a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{48E59290-9880-11CF-9754-00AA00C00908}\1.0\0 e7b81196130cbeaf457190262617a1c1bf42ab54fab13d8d60e4c9ec3f09911a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E2D211D5-11E4-4D9E-B6DB-1E902C851A49}\Implemented Categories\{0DE86A52-2BAA-11CF-A229-00AA003D7352} e7b81196130cbeaf457190262617a1c1bf42ab54fab13d8d60e4c9ec3f09911a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59294-9880-11CF-9754-00AA00C00908} e7b81196130cbeaf457190262617a1c1bf42ab54fab13d8d60e4c9ec3f09911a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{48E59291-9880-11CF-9754-00AA00C00908}\ = "IInet" e7b81196130cbeaf457190262617a1c1bf42ab54fab13d8d60e4c9ec3f09911a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{48E59292-9880-11CF-9754-00AA00C00908}\ = "DInetEvents" e7b81196130cbeaf457190262617a1c1bf42ab54fab13d8d60e4c9ec3f09911a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E2D211D5-11E4-4D9E-B6DB-1E902C851A49}\ToolboxBitmap32 e7b81196130cbeaf457190262617a1c1bf42ab54fab13d8d60e4c9ec3f09911a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{48E59291-9880-11CF-9754-00AA00C00908}\TypeLib\ = "{48E59290-9880-11CF-9754-00AA00C00908}" e7b81196130cbeaf457190262617a1c1bf42ab54fab13d8d60e4c9ec3f09911a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\InetCtls.Inet\ = "Microsoft Internet Transfer Control 6.0 (SP6)" e7b81196130cbeaf457190262617a1c1bf42ab54fab13d8d60e4c9ec3f09911a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}\MiscStatus\ = "0" e7b81196130cbeaf457190262617a1c1bf42ab54fab13d8d60e4c9ec3f09911a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}\MiscStatus\1 e7b81196130cbeaf457190262617a1c1bf42ab54fab13d8d60e4c9ec3f09911a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}\ = "Microsoft Internet Transfer Control 6.0 (SP6)" e7b81196130cbeaf457190262617a1c1bf42ab54fab13d8d60e4c9ec3f09911a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}\TypeLib\ = "{48E59290-9880-11CF-9754-00AA00C00908}" e7b81196130cbeaf457190262617a1c1bf42ab54fab13d8d60e4c9ec3f09911a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}\ToolboxBitmap32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MSINET.OCX, 1" e7b81196130cbeaf457190262617a1c1bf42ab54fab13d8d60e4c9ec3f09911a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{48E59291-9880-11CF-9754-00AA00C00908} e7b81196130cbeaf457190262617a1c1bf42ab54fab13d8d60e4c9ec3f09911a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}\InprocServer32\ThreadingModel = "Apartment" e7b81196130cbeaf457190262617a1c1bf42ab54fab13d8d60e4c9ec3f09911a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59295-9880-11CF-9754-00AA00C00908}\InprocServer32 e7b81196130cbeaf457190262617a1c1bf42ab54fab13d8d60e4c9ec3f09911a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\InetCtls.Inet.1\CLSID\ = "{48E59293-9880-11CF-9754-00AA00C00908}" e7b81196130cbeaf457190262617a1c1bf42ab54fab13d8d60e4c9ec3f09911a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{48E59290-9880-11CF-9754-00AA00C00908}\1.0\FLAGS\ = "2" e7b81196130cbeaf457190262617a1c1bf42ab54fab13d8d60e4c9ec3f09911a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{48E59291-9880-11CF-9754-00AA00C00908}\TypeLib\Version = "1.0" e7b81196130cbeaf457190262617a1c1bf42ab54fab13d8d60e4c9ec3f09911a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E2D211D5-11E4-4D9E-B6DB-1E902C851A49}\InprocServer32 e7b81196130cbeaf457190262617a1c1bf42ab54fab13d8d60e4c9ec3f09911a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\InetCtls.Inet\CurVer\ = "InetCtls.Inet.1" e7b81196130cbeaf457190262617a1c1bf42ab54fab13d8d60e4c9ec3f09911a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E2D211D5-11E4-4D9E-B6DB-1E902C851A49}\TypeLib e7b81196130cbeaf457190262617a1c1bf42ab54fab13d8d60e4c9ec3f09911a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}\InprocServer32 e7b81196130cbeaf457190262617a1c1bf42ab54fab13d8d60e4c9ec3f09911a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59295-9880-11CF-9754-00AA00C00908} e7b81196130cbeaf457190262617a1c1bf42ab54fab13d8d60e4c9ec3f09911a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\InetCtls.Inet\CLSID\ = "{E2D211D5-11E4-4D9E-B6DB-1E902C851A49}" e7b81196130cbeaf457190262617a1c1bf42ab54fab13d8d60e4c9ec3f09911a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MSINET.OCX" e7b81196130cbeaf457190262617a1c1bf42ab54fab13d8d60e4c9ec3f09911a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}\Implemented Categories e7b81196130cbeaf457190262617a1c1bf42ab54fab13d8d60e4c9ec3f09911a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\InetCtls.Inet\CLSID\ = "{48E59293-9880-11CF-9754-00AA00C00908}" e7b81196130cbeaf457190262617a1c1bf42ab54fab13d8d60e4c9ec3f09911a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{48E59291-9880-11CF-9754-00AA00C00908}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" e7b81196130cbeaf457190262617a1c1bf42ab54fab13d8d60e4c9ec3f09911a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}\Control e7b81196130cbeaf457190262617a1c1bf42ab54fab13d8d60e4c9ec3f09911a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59294-9880-11CF-9754-00AA00C00908}\ = "Internet Control General Property Page Object" e7b81196130cbeaf457190262617a1c1bf42ab54fab13d8d60e4c9ec3f09911a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{48E59292-9880-11CF-9754-00AA00C00908}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" e7b81196130cbeaf457190262617a1c1bf42ab54fab13d8d60e4c9ec3f09911a.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E2D211D5-11E4-4D9E-B6DB-1E902C851A49} e7b81196130cbeaf457190262617a1c1bf42ab54fab13d8d60e4c9ec3f09911a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\InetCtls.Inet.1 e7b81196130cbeaf457190262617a1c1bf42ab54fab13d8d60e4c9ec3f09911a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E2D211D5-11E4-4D9E-B6DB-1E902C851A49}\Implemented Categories\{0DE86A53-2BAA-11CF-A229-00AA003D7352} e7b81196130cbeaf457190262617a1c1bf42ab54fab13d8d60e4c9ec3f09911a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}\VersionIndependentProgID e7b81196130cbeaf457190262617a1c1bf42ab54fab13d8d60e4c9ec3f09911a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}\Version\ = "1.0" e7b81196130cbeaf457190262617a1c1bf42ab54fab13d8d60e4c9ec3f09911a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}\Implemented Categories\{0DE86A57-2BAA-11CF-A229-00AA003D7352} e7b81196130cbeaf457190262617a1c1bf42ab54fab13d8d60e4c9ec3f09911a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{48E59290-9880-11CF-9754-00AA00C00908}\1.0 e7b81196130cbeaf457190262617a1c1bf42ab54fab13d8d60e4c9ec3f09911a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\InetCtls.Inet\CLSID e7b81196130cbeaf457190262617a1c1bf42ab54fab13d8d60e4c9ec3f09911a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E2D211D5-11E4-4D9E-B6DB-1E902C851A49}\MiscStatus\1 e7b81196130cbeaf457190262617a1c1bf42ab54fab13d8d60e4c9ec3f09911a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}\ProgID\ = "InetCtls.Inet.1" e7b81196130cbeaf457190262617a1c1bf42ab54fab13d8d60e4c9ec3f09911a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}\TypeLib e7b81196130cbeaf457190262617a1c1bf42ab54fab13d8d60e4c9ec3f09911a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}\Programmable e7b81196130cbeaf457190262617a1c1bf42ab54fab13d8d60e4c9ec3f09911a.exe - Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 1780 e7b81196130cbeaf457190262617a1c1bf42ab54fab13d8d60e4c9ec3f09911a.exe 1780 e7b81196130cbeaf457190262617a1c1bf42ab54fab13d8d60e4c9ec3f09911a.exe 1780 e7b81196130cbeaf457190262617a1c1bf42ab54fab13d8d60e4c9ec3f09911a.exe 1780 e7b81196130cbeaf457190262617a1c1bf42ab54fab13d8d60e4c9ec3f09911a.exe 1780 e7b81196130cbeaf457190262617a1c1bf42ab54fab13d8d60e4c9ec3f09911a.exe 1780 e7b81196130cbeaf457190262617a1c1bf42ab54fab13d8d60e4c9ec3f09911a.exe 1780 e7b81196130cbeaf457190262617a1c1bf42ab54fab13d8d60e4c9ec3f09911a.exe 1780 e7b81196130cbeaf457190262617a1c1bf42ab54fab13d8d60e4c9ec3f09911a.exe 1780 e7b81196130cbeaf457190262617a1c1bf42ab54fab13d8d60e4c9ec3f09911a.exe 1780 e7b81196130cbeaf457190262617a1c1bf42ab54fab13d8d60e4c9ec3f09911a.exe 1780 e7b81196130cbeaf457190262617a1c1bf42ab54fab13d8d60e4c9ec3f09911a.exe 1780 e7b81196130cbeaf457190262617a1c1bf42ab54fab13d8d60e4c9ec3f09911a.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1780 e7b81196130cbeaf457190262617a1c1bf42ab54fab13d8d60e4c9ec3f09911a.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e7b81196130cbeaf457190262617a1c1bf42ab54fab13d8d60e4c9ec3f09911a.exe"C:\Users\Admin\AppData\Local\Temp\e7b81196130cbeaf457190262617a1c1bf42ab54fab13d8d60e4c9ec3f09911a.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1780
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\MSINET.OCX
- Size 128KB
- SHA256 c11615f4561755632da7469e6c5fbf3ead40e0d9747030c90077b70115692ce3
- MD5 bed46f55af9a7b495ec0f2de0cb5ad3f
- SHA1 e9c47a7cabbf62e154dca7dba2301cc8eac1047e
- SHA512 4938f4e4007e63d990d6b18907b71b7108d9f1d5cbeab194bdf3c25226da20b2995102d79daa262b433f6a4479a9cceafea6c8f5b6f86bd190c751e7c0bd788b
- SSDEEP 3072:kfKgLosCFoyVOyWoMb9K4P/nGBBSSzr3+8s:kiaao8MbdYRY
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\MSINET.OCX
- Size 128KB
- SHA256 c11615f4561755632da7469e6c5fbf3ead40e0d9747030c90077b70115692ce3
- MD5 bed46f55af9a7b495ec0f2de0cb5ad3f
- SHA1 e9c47a7cabbf62e154dca7dba2301cc8eac1047e
- SHA512 4938f4e4007e63d990d6b18907b71b7108d9f1d5cbeab194bdf3c25226da20b2995102d79daa262b433f6a4479a9cceafea6c8f5b6f86bd190c751e7c0bd788b
- SSDEEP 3072:kfKgLosCFoyVOyWoMb9K4P/nGBBSSzr3+8s:kiaao8MbdYRY
- MD5 SHA1 SHA512 SSDEEP