Analysis
-
max time kernel
151s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
07-11-2022 11:16
Behavioral task
behavioral1
Sample
a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe
Resource
win7-20220812-en
windows7-x64
13 signatures
150 seconds
General
-
Target
a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe
-
Size
647KB
-
MD5
0e870a0e9fe930cd3a02d02ddf0d7ad0
-
SHA1
01c7e22d895d9cd69e3ed50e81124f285ca42f02
-
SHA256
a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8
-
SHA512
cac78730d0e609d32bbde9ed28387c274d2dcaf8c42b7749591905564137386a7d7b272e8b9d8e6c105932f2598ff8f40808d4b1aa702abac503e284d953364e
-
SSDEEP
12288:1pSrU96Qtnh2IUuyba+GbubYwAEkAVnQgqiaSgWQgVzLP2+2FDX1G:1mU9hthfaW+Iub7mAVnQ3XpDmzLP2PXo
Malware Config
Signatures
-
resource yara_rule behavioral2/files/0x0008000000022e3d-135.dat aspack_v212_v242 behavioral2/files/0x0008000000022e4b-138.dat aspack_v212_v242 behavioral2/files/0x0008000000022e4b-137.dat aspack_v212_v242 behavioral2/files/0x0008000000022e3d-136.dat aspack_v212_v242 -
Loads dropped DLL 4 IoCs
pid Process 528 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 528 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 528 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 528 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\CDClog.txt a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.baidu.com IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "3" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "0" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.baidu.com\ = "97" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\baidu.com\Total = "100" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Local Page = "http://www.sogou.com/index.htm?pid=sogou-netb-5ac8bb8a7d745102-0001" a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\baidu.com\Total = "8" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "35" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.baidu.com\ = "35" IEXPLORE.EXE Key deleted \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\TypedURLs a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.baidu.com\ = "545" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\baidu.com\Total = "545" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\baidu.com\NumberOfSubdomains = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{2670000A-7350-4f3c-8081-5663EE0C6C49} a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "100" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\baidu.com\Total = "75" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "5" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "545" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.baidu.com\ = "3" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "8" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\baidu.com IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.baidu.com\ = "0" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.baidu.com\ = "75" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "97" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\baidu.com\Total = "89" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.baidu.com\ = "100" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\baidu.com\Total = "97" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA} a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{385B08B5-5F0B-11ED-89AC-E64E24383C5C} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\baidu.com\Total = "3" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\baidu.com\Total = "5" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "89" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\baidu.com\Total = "0" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.baidu.com\ = "5" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\baidu.com\Total = "35" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "75" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.baidu.com\ = "89" IEXPLORE.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\DOMStorage\baidu.com IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.baidu.com\ = "8" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe -
Modifies Internet Explorer start page 1 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Start Page = "http://www.sogou.com/index.htm?pid=sogou-netb-5ac8bb8a7d745102-0001" a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://www.sogou.com/index.htm?pid=sogou-netb-5ac8bb8a7d745102-0001" a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe -
Modifies registry class 8 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\OpenHomePage a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2295526160-1155304984-640977766-1000\{263195EE-9C0C-48D1-AEEC-FCA7C5AF5247} IEXPLORE.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0002DF01-0000-0000-C000-000000000046}\LocalServer32 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0002DF01-0000-0000-C000-000000000046} a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\OpenHomePage\Command a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 528 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 528 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 528 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 528 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 528 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 528 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 528 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 528 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 528 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 528 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 528 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 528 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 528 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 528 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 528 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 528 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 528 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 528 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 528 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 528 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 528 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 528 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 528 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 528 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 528 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 528 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 528 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 528 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 528 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 528 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 528 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 528 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 528 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 528 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 528 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 528 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 528 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 528 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 528 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 528 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 528 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 528 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 528 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 528 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 528 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 528 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 528 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 528 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 528 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 528 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 528 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 528 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 528 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 528 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 528 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 528 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 528 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 528 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 528 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 528 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 528 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 528 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 528 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 528 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 528 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe Token: 33 528 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe Token: SeIncBasePriorityPrivilege 528 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe Token: 33 528 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe Token: SeIncBasePriorityPrivilege 528 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2116 iexplore.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 2116 iexplore.exe 2116 iexplore.exe 3560 IEXPLORE.EXE 3560 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 528 wrote to memory of 4084 528 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 80 PID 528 wrote to memory of 4084 528 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 80 PID 528 wrote to memory of 4084 528 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 80 PID 528 wrote to memory of 2596 528 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 47 PID 528 wrote to memory of 2596 528 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 47 PID 528 wrote to memory of 2596 528 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 47 PID 528 wrote to memory of 2596 528 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 47 PID 528 wrote to memory of 2596 528 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 47 PID 528 wrote to memory of 2596 528 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 47 PID 528 wrote to memory of 2596 528 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 47 PID 528 wrote to memory of 2596 528 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 47 PID 528 wrote to memory of 2596 528 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 47 PID 528 wrote to memory of 2596 528 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 47 PID 528 wrote to memory of 2596 528 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 47 PID 528 wrote to memory of 2596 528 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 47 PID 528 wrote to memory of 2596 528 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 47 PID 528 wrote to memory of 2596 528 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 47 PID 528 wrote to memory of 2596 528 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 47 PID 528 wrote to memory of 2596 528 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 47 PID 528 wrote to memory of 2596 528 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 47 PID 528 wrote to memory of 2596 528 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 47 PID 528 wrote to memory of 2596 528 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 47 PID 528 wrote to memory of 2596 528 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 47 PID 528 wrote to memory of 2596 528 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 47 PID 528 wrote to memory of 2596 528 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 47 PID 528 wrote to memory of 2596 528 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 47 PID 528 wrote to memory of 2596 528 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 47 PID 528 wrote to memory of 2596 528 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 47 PID 528 wrote to memory of 2596 528 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 47 PID 528 wrote to memory of 2596 528 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 47 PID 528 wrote to memory of 2596 528 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 47 PID 528 wrote to memory of 2596 528 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 47 PID 528 wrote to memory of 2596 528 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 47 PID 528 wrote to memory of 2596 528 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 47 PID 528 wrote to memory of 2596 528 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 47 PID 528 wrote to memory of 2596 528 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 47 PID 528 wrote to memory of 2596 528 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 47 PID 528 wrote to memory of 2596 528 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 47 PID 528 wrote to memory of 2596 528 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 47 PID 528 wrote to memory of 2596 528 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 47 PID 528 wrote to memory of 2596 528 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 47 PID 4084 wrote to memory of 384 4084 cmd.exe 84 PID 4084 wrote to memory of 384 4084 cmd.exe 84 PID 4084 wrote to memory of 384 4084 cmd.exe 84 PID 528 wrote to memory of 2596 528 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 47 PID 528 wrote to memory of 2596 528 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 47 PID 4084 wrote to memory of 1080 4084 cmd.exe 85 PID 4084 wrote to memory of 1080 4084 cmd.exe 85 PID 4084 wrote to memory of 1080 4084 cmd.exe 85 PID 2116 wrote to memory of 3560 2116 iexplore.exe 86 PID 2116 wrote to memory of 3560 2116 iexplore.exe 86 PID 2116 wrote to memory of 3560 2116 iexplore.exe 86 PID 528 wrote to memory of 2596 528 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 47 PID 528 wrote to memory of 2596 528 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 47 PID 528 wrote to memory of 2596 528 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 47 PID 528 wrote to memory of 2596 528 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 47 PID 528 wrote to memory of 2596 528 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 47 PID 528 wrote to memory of 2596 528 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 47 PID 528 wrote to memory of 2596 528 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 47 PID 528 wrote to memory of 2596 528 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 47 PID 528 wrote to memory of 2596 528 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 47 PID 528 wrote to memory of 2596 528 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 47 PID 528 wrote to memory of 2596 528 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 47 PID 528 wrote to memory of 2596 528 a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe 47
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:2596
-
C:\Users\Admin\AppData\Local\Temp\a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe"C:\Users\Admin\AppData\Local\Temp\a6fb51f37c5d93e55bd0fdf2e40a3cb63f87c7600f0e528a6f3f992ff204a4d8.exe"2⤵
- Loads dropped DLL
- Drops file in System32 directory
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:528 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\021531.bat3⤵
- Suspicious use of WriteProcessMemory
PID:4084 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c dir "C:\Users\Admin\Local Settings\Application Data\Mozilla\Firefox\Profiles\*.default" /B4⤵PID:384
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c dir "C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\*.default" /B4⤵PID:1080
-
-
-
-
C:\Program Files (x86)\Internet Explorer\ielowutil.exe"C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding1⤵PID:4940
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2116 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2116 CREDAT:17410 /prefetch:22⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3560
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5KB
MD5ad0d80bf6b4292dbada25f7f8fd6556c
SHA140133d1dea9905bf406fb88efcb57cd693e6cf43
SHA256081f45a04b555b2406e5b63afbcdba4e564c3157e7d3720d21e8f53d2127bae1
SHA51276eaacabecaaed7b4eb53fbc5db4d53b15ccdbe6526119346dc444e932cc1ebfffb74b0df3f54c85168d72082f9017802e9775bc178a58fcac0ab3c1ddb519cb
-
Filesize
481KB
MD5d8c8c9cac9130725ffbe0da3c6af9650
SHA1b9c64e2f573ea97e47987e90726ca53da655d9f7
SHA25678b9bce612935ef0306cc37b7922f321044b0a67f6842b1d628710b66779cdaa
SHA512d7579560c22d1def17b14b23de8527aef0228f219e9c3bcd0cd0f71d53158f4abfca97119ca2f1bf09c3999904fb971d711d250e3323fd01f94815daf68dbbb7
-
Filesize
481KB
MD5d8c8c9cac9130725ffbe0da3c6af9650
SHA1b9c64e2f573ea97e47987e90726ca53da655d9f7
SHA25678b9bce612935ef0306cc37b7922f321044b0a67f6842b1d628710b66779cdaa
SHA512d7579560c22d1def17b14b23de8527aef0228f219e9c3bcd0cd0f71d53158f4abfca97119ca2f1bf09c3999904fb971d711d250e3323fd01f94815daf68dbbb7
-
Filesize
531KB
MD5d5fd0b6ea7362eeadaea2c6e26bb655c
SHA138e1d4f73b95a065a24759a1888da01ab34a979d
SHA2566735551f6f0e3fd2dacb889c02a6bbf229760bb1110f3859a0f1c334ea9e5d24
SHA5121e6f3661626ac13fe0592902564d83939f7b5c4a34fb25cbce928c52c9989acffe8e701c905d45cc1a0030dd6185799109d560665eaa6f73cc749316ce1b91aa
-
Filesize
531KB
MD5d5fd0b6ea7362eeadaea2c6e26bb655c
SHA138e1d4f73b95a065a24759a1888da01ab34a979d
SHA2566735551f6f0e3fd2dacb889c02a6bbf229760bb1110f3859a0f1c334ea9e5d24
SHA5121e6f3661626ac13fe0592902564d83939f7b5c4a34fb25cbce928c52c9989acffe8e701c905d45cc1a0030dd6185799109d560665eaa6f73cc749316ce1b91aa