Analysis
-
max time kernel
152s -
max time network
70s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
07-11-2022 11:16
Behavioral task
behavioral1
Sample
a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe
Resource
win7-20220812-en
windows7-x64
13 signatures
150 seconds
General
-
Target
a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe
-
Size
647KB
-
MD5
0e870a0e9fe930cd3a02d02ddf0d7ad0
-
SHA1
01c7e22d895d9cd69e3ed50e81124f285ca42f02
-
SHA256
a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8
-
SHA512
cac78730d0e609d32bbde9ed28387c274d2dcaf8c42b7749591905564137386a7d7b272e8b9d8e6c105932f2598ff8f40808d4b1aa702abac503e284d953364e
-
SSDEEP
12288:1pSrU96Qtnh2IUuyba+GbubYwAEkAVnQgqiaSgWQgVzLP2+2FDX1G:1mU9hthfaW+Iub7mAVnQ3XpDmzLP2PXo
Malware Config
Signatures
-
resource yara_rule behavioral1/files/0x00090000000134d5-54.dat aspack_v212_v242 behavioral1/files/0x00070000000139fe-55.dat aspack_v212_v242 -
Loads dropped DLL 2 IoCs
pid Process 1536 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 1536 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\CDClog.txt a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{39806461-5F0B-11ED-AB20-4A12BD72B3C7} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.baidu.com\ = "8" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.baidu.com\ = "0" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "100" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\baidu.com\Total = "100" IEXPLORE.EXE Key deleted \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TypedURLs a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "0" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "57" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.baidu.com\ = "49" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\baidu.com\Total = "111" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\baidu.com\NumberOfSubdomains = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "111" IEXPLORE.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extensions\{2670000A-7350-4f3c-8081-5663EE0C6C49} a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\baidu.com IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "49" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "89" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "8" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.baidu.com\ = "89" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.baidu.com IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\baidu.com\Total = "0" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.baidu.com\ = "35" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.baidu.com\ = "57" IEXPLORE.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extensions\{789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Local Page = "http://www.sogou.com/index.htm?pid=sogou-netb-5ac8bb8a7d745102-0001" a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\baidu.com\Total = "545" IEXPLORE.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extensions a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "3" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.baidu.com\ = "5" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "35" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "545" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\baidu.com\Total = "8" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\baidu.com\Total = "3" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.baidu.com\ = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\baidu.com\Total = "35" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.baidu.com\ = "545" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.baidu.com\ = "3" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.baidu.com\ = "111" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "5" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\baidu.com\Total = "5" IEXPLORE.EXE -
Modifies Internet Explorer start page 1 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Start Page = "http://www.sogou.com/index.htm?pid=sogou-netb-5ac8bb8a7d745102-0001" a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://www.sogou.com/index.htm?pid=sogou-netb-5ac8bb8a7d745102-0001" a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe -
Modifies registry class 7 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\OpenHomePage a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0002DF01-0000-0000-C000-000000000046}\LocalServer32 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0002DF01-0000-0000-C000-000000000046} a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\OpenHomePage\Command a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1536 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 1536 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 1536 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 1536 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 1536 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 1536 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 1536 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 1536 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 1536 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 1536 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 1536 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 1536 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 1536 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 1536 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 1536 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 1536 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 1536 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 1536 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 1536 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 1536 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 1536 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 1536 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 1536 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 1536 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 1536 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 1536 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 1536 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 1536 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 1536 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 1536 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 1536 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 1536 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 1536 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 1536 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 1536 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 1536 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 1536 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 1536 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 1536 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 1536 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 1536 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 1536 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 1536 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 1536 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 1536 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 1536 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 1536 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 1536 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 1536 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 1536 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 1536 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 1536 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 1536 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 1536 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 1536 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 1536 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 1536 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 1536 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 1536 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 1536 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 1536 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 1536 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 1536 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 1536 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 1536 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe Token: 33 1536 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe Token: SeIncBasePriorityPrivilege 1536 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe Token: 33 1536 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe Token: SeIncBasePriorityPrivilege 1536 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1492 iexplore.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 1492 iexplore.exe 1492 iexplore.exe 1472 IEXPLORE.EXE 1472 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1536 wrote to memory of 1976 1536 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 28 PID 1536 wrote to memory of 1976 1536 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 28 PID 1536 wrote to memory of 1976 1536 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 28 PID 1536 wrote to memory of 1976 1536 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 28 PID 1536 wrote to memory of 1396 1536 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 7 PID 1536 wrote to memory of 1396 1536 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 7 PID 1536 wrote to memory of 1396 1536 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 7 PID 1536 wrote to memory of 1396 1536 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 7 PID 1536 wrote to memory of 1396 1536 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 7 PID 1536 wrote to memory of 1396 1536 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 7 PID 1536 wrote to memory of 1396 1536 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 7 PID 1536 wrote to memory of 1396 1536 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 7 PID 1536 wrote to memory of 1396 1536 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 7 PID 1536 wrote to memory of 1396 1536 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 7 PID 1536 wrote to memory of 1396 1536 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 7 PID 1536 wrote to memory of 1396 1536 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 7 PID 1536 wrote to memory of 1396 1536 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 7 PID 1536 wrote to memory of 1396 1536 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 7 PID 1536 wrote to memory of 1396 1536 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 7 PID 1536 wrote to memory of 1396 1536 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 7 PID 1536 wrote to memory of 1396 1536 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 7 PID 1536 wrote to memory of 1396 1536 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 7 PID 1536 wrote to memory of 1396 1536 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 7 PID 1536 wrote to memory of 1396 1536 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 7 PID 1536 wrote to memory of 1396 1536 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 7 PID 1536 wrote to memory of 1396 1536 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 7 PID 1536 wrote to memory of 1396 1536 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 7 PID 1536 wrote to memory of 1396 1536 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 7 PID 1536 wrote to memory of 1396 1536 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 7 PID 1536 wrote to memory of 1396 1536 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 7 PID 1536 wrote to memory of 1396 1536 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 7 PID 1976 wrote to memory of 1884 1976 cmd.exe 30 PID 1976 wrote to memory of 1884 1976 cmd.exe 30 PID 1976 wrote to memory of 1884 1976 cmd.exe 30 PID 1976 wrote to memory of 1884 1976 cmd.exe 30 PID 1536 wrote to memory of 1396 1536 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 7 PID 1536 wrote to memory of 1396 1536 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 7 PID 1976 wrote to memory of 1080 1976 cmd.exe 31 PID 1976 wrote to memory of 1080 1976 cmd.exe 31 PID 1976 wrote to memory of 1080 1976 cmd.exe 31 PID 1976 wrote to memory of 1080 1976 cmd.exe 31 PID 1536 wrote to memory of 1396 1536 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 7 PID 1536 wrote to memory of 1396 1536 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 7 PID 1492 wrote to memory of 1472 1492 iexplore.exe 33 PID 1492 wrote to memory of 1472 1492 iexplore.exe 33 PID 1492 wrote to memory of 1472 1492 iexplore.exe 33 PID 1492 wrote to memory of 1472 1492 iexplore.exe 33 PID 1536 wrote to memory of 1396 1536 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 7 PID 1536 wrote to memory of 1396 1536 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 7 PID 1536 wrote to memory of 1396 1536 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 7 PID 1536 wrote to memory of 1396 1536 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 7 PID 1536 wrote to memory of 1396 1536 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 7 PID 1536 wrote to memory of 1396 1536 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 7 PID 1536 wrote to memory of 1396 1536 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 7 PID 1536 wrote to memory of 1396 1536 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 7 PID 1536 wrote to memory of 1396 1536 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 7 PID 1536 wrote to memory of 1396 1536 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 7 PID 1536 wrote to memory of 1396 1536 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 7 PID 1536 wrote to memory of 1396 1536 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 7 PID 1536 wrote to memory of 1396 1536 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 7 PID 1536 wrote to memory of 1396 1536 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 7 PID 1536 wrote to memory of 1396 1536 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 7 PID 1536 wrote to memory of 1396 1536 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 7 PID 1536 wrote to memory of 1396 1536 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 7
Processes
-
C:\Users\Admin\AppData\Local\Temp\a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe"C:\Users\Admin\AppData\Local\Temp\a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1536 -
C:\Windows\SysWOW64\cmd.execmd /c C:\021533.bat2⤵
- Suspicious use of WriteProcessMemory
PID:1976 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c dir "C:\Users\Admin\Local Settings\Application Data\Mozilla\Firefox\Profiles\*.default" /B3⤵PID:1884
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c dir "C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\*.default" /B3⤵PID:1080
-
-
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1396
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1492 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1492 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1472
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5KB
MD5ad0d80bf6b4292dbada25f7f8fd6556c
SHA140133d1dea9905bf406fb88efcb57cd693e6cf43
SHA256081f45a04b555b2406e5b63afbcdba4e564c3157e7d3720d21e8f53d2127bae1
SHA51276eaacabecaaed7b4eb53fbc5db4d53b15ccdbe6526119346dc444e932cc1ebfffb74b0df3f54c85168d72082f9017802e9775bc178a58fcac0ab3c1ddb519cb
-
Filesize
481KB
MD5d8c8c9cac9130725ffbe0da3c6af9650
SHA1b9c64e2f573ea97e47987e90726ca53da655d9f7
SHA25678b9bce612935ef0306cc37b7922f321044b0a67f6842b1d628710b66779cdaa
SHA512d7579560c22d1def17b14b23de8527aef0228f219e9c3bcd0cd0f71d53158f4abfca97119ca2f1bf09c3999904fb971d711d250e3323fd01f94815daf68dbbb7
-
Filesize
531KB
MD5d5fd0b6ea7362eeadaea2c6e26bb655c
SHA138e1d4f73b95a065a24759a1888da01ab34a979d
SHA2566735551f6f0e3fd2dacb889c02a6bbf229760bb1110f3859a0f1c334ea9e5d24
SHA5121e6f3661626ac13fe0592902564d83939f7b5c4a34fb25cbce928c52c9989acffe8e701c905d45cc1a0030dd6185799109d560665eaa6f73cc749316ce1b91aa