Analysis
-
max time kernel
150s -
max time network
58s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
21/11/2022, 14:16
Behavioral task
behavioral1
Sample
f70d87a9d7ed40437815b3dcfa23f4b92c24751904dc765c7e0ab90efa353eb3.exe
Resource
win7-20220812-en
windows7-x64
13 signatures
150 seconds
General
-
Target
f70d87a9d7ed40437815b3dcfa23f4b92c24751904dc765c7e0ab90efa353eb3.exe
-
Size
647KB
-
MD5
1180e3622577ef5698bda1e8d5ac8ac0
-
SHA1
644d4ea0f44fa157793ce6729b9052253f677723
-
SHA256
f70d87a9d7ed40437815b3dcfa23f4b92c24751904dc765c7e0ab90efa353eb3
-
SHA512
b51b572af3a4faee031900957b449ad448d7bd8b4f0226393787d71d7732ce87b986033bfd26428ef1ec01476c5ecd1780270453398c7fc3e4f09f5a84962ffc
-
SSDEEP
12288:npSrU96Qtnb3e6w6UKegFEWkXR2HtBwBDoIfeNRkyNGeEIABFjI1vp:nmU9htb3E67egFbkXR2NBw3feNRfUeEA
Malware Config
Signatures
-
resource yara_rule behavioral1/files/0x00090000000122f9-54.dat aspack_v212_v242 behavioral1/files/0x0008000000012303-55.dat aspack_v212_v242 -
Loads dropped DLL 2 IoCs
pid Process 1372 f70d87a9d7ed40437815b3dcfa23f4b92c24751904dc765c7e0ab90efa353eb3.exe 1372 f70d87a9d7ed40437815b3dcfa23f4b92c24751904dc765c7e0ab90efa353eb3.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\CDClog.txt f70d87a9d7ed40437815b3dcfa23f4b92c24751904dc765c7e0ab90efa353eb3.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\baidu.com\Total = "8" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "3" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\baidu.com\Total = "35" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\baidu.com\Total = "3" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "8" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.baidu.com\ = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\baidu.com IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "5" IEXPLORE.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extensions\{789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} f70d87a9d7ed40437815b3dcfa23f4b92c24751904dc765c7e0ab90efa353eb3.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "35" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.baidu.com\ = "35" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.baidu.com IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.baidu.com\ = "8" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.baidu.com\ = "3" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\baidu.com\Total = "0" IEXPLORE.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extensions f70d87a9d7ed40437815b3dcfa23f4b92c24751904dc765c7e0ab90efa353eb3.exe Key deleted \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TypedURLs f70d87a9d7ed40437815b3dcfa23f4b92c24751904dc765c7e0ab90efa353eb3.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{89E8AD51-69AF-11ED-8AB9-FAB5137186BE} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extensions\{2670000A-7350-4f3c-8081-5663EE0C6C49} f70d87a9d7ed40437815b3dcfa23f4b92c24751904dc765c7e0ab90efa353eb3.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\baidu.com\NumberOfSubdomains = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.baidu.com\ = "5" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\baidu.com\Total = "5" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Local Page = "http://www.sogou.com/index.htm?pid=sogou-netb-5ac8bb8a7d745102-0001" f70d87a9d7ed40437815b3dcfa23f4b92c24751904dc765c7e0ab90efa353eb3.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe -
Modifies Internet Explorer start page 1 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Start Page = "http://www.sogou.com/index.htm?pid=sogou-netb-5ac8bb8a7d745102-0001" f70d87a9d7ed40437815b3dcfa23f4b92c24751904dc765c7e0ab90efa353eb3.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://www.sogou.com/index.htm?pid=sogou-netb-5ac8bb8a7d745102-0001" f70d87a9d7ed40437815b3dcfa23f4b92c24751904dc765c7e0ab90efa353eb3.exe -
Modifies registry class 7 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell f70d87a9d7ed40437815b3dcfa23f4b92c24751904dc765c7e0ab90efa353eb3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\OpenHomePage f70d87a9d7ed40437815b3dcfa23f4b92c24751904dc765c7e0ab90efa353eb3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0002DF01-0000-0000-C000-000000000046}\LocalServer32 f70d87a9d7ed40437815b3dcfa23f4b92c24751904dc765c7e0ab90efa353eb3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID f70d87a9d7ed40437815b3dcfa23f4b92c24751904dc765c7e0ab90efa353eb3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0002DF01-0000-0000-C000-000000000046} f70d87a9d7ed40437815b3dcfa23f4b92c24751904dc765c7e0ab90efa353eb3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\OpenHomePage\Command f70d87a9d7ed40437815b3dcfa23f4b92c24751904dc765c7e0ab90efa353eb3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} f70d87a9d7ed40437815b3dcfa23f4b92c24751904dc765c7e0ab90efa353eb3.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1372 f70d87a9d7ed40437815b3dcfa23f4b92c24751904dc765c7e0ab90efa353eb3.exe 1372 f70d87a9d7ed40437815b3dcfa23f4b92c24751904dc765c7e0ab90efa353eb3.exe 1372 f70d87a9d7ed40437815b3dcfa23f4b92c24751904dc765c7e0ab90efa353eb3.exe 1372 f70d87a9d7ed40437815b3dcfa23f4b92c24751904dc765c7e0ab90efa353eb3.exe 1372 f70d87a9d7ed40437815b3dcfa23f4b92c24751904dc765c7e0ab90efa353eb3.exe 1372 f70d87a9d7ed40437815b3dcfa23f4b92c24751904dc765c7e0ab90efa353eb3.exe 1372 f70d87a9d7ed40437815b3dcfa23f4b92c24751904dc765c7e0ab90efa353eb3.exe 1372 f70d87a9d7ed40437815b3dcfa23f4b92c24751904dc765c7e0ab90efa353eb3.exe 1372 f70d87a9d7ed40437815b3dcfa23f4b92c24751904dc765c7e0ab90efa353eb3.exe 1372 f70d87a9d7ed40437815b3dcfa23f4b92c24751904dc765c7e0ab90efa353eb3.exe 1372 f70d87a9d7ed40437815b3dcfa23f4b92c24751904dc765c7e0ab90efa353eb3.exe 1372 f70d87a9d7ed40437815b3dcfa23f4b92c24751904dc765c7e0ab90efa353eb3.exe 1372 f70d87a9d7ed40437815b3dcfa23f4b92c24751904dc765c7e0ab90efa353eb3.exe 1372 f70d87a9d7ed40437815b3dcfa23f4b92c24751904dc765c7e0ab90efa353eb3.exe 1372 f70d87a9d7ed40437815b3dcfa23f4b92c24751904dc765c7e0ab90efa353eb3.exe 1372 f70d87a9d7ed40437815b3dcfa23f4b92c24751904dc765c7e0ab90efa353eb3.exe 1372 f70d87a9d7ed40437815b3dcfa23f4b92c24751904dc765c7e0ab90efa353eb3.exe 1372 f70d87a9d7ed40437815b3dcfa23f4b92c24751904dc765c7e0ab90efa353eb3.exe 1372 f70d87a9d7ed40437815b3dcfa23f4b92c24751904dc765c7e0ab90efa353eb3.exe 1372 f70d87a9d7ed40437815b3dcfa23f4b92c24751904dc765c7e0ab90efa353eb3.exe 1372 f70d87a9d7ed40437815b3dcfa23f4b92c24751904dc765c7e0ab90efa353eb3.exe 1372 f70d87a9d7ed40437815b3dcfa23f4b92c24751904dc765c7e0ab90efa353eb3.exe 1372 f70d87a9d7ed40437815b3dcfa23f4b92c24751904dc765c7e0ab90efa353eb3.exe 1372 f70d87a9d7ed40437815b3dcfa23f4b92c24751904dc765c7e0ab90efa353eb3.exe 1372 f70d87a9d7ed40437815b3dcfa23f4b92c24751904dc765c7e0ab90efa353eb3.exe 1372 f70d87a9d7ed40437815b3dcfa23f4b92c24751904dc765c7e0ab90efa353eb3.exe 1372 f70d87a9d7ed40437815b3dcfa23f4b92c24751904dc765c7e0ab90efa353eb3.exe 1372 f70d87a9d7ed40437815b3dcfa23f4b92c24751904dc765c7e0ab90efa353eb3.exe 1372 f70d87a9d7ed40437815b3dcfa23f4b92c24751904dc765c7e0ab90efa353eb3.exe 1372 f70d87a9d7ed40437815b3dcfa23f4b92c24751904dc765c7e0ab90efa353eb3.exe 1372 f70d87a9d7ed40437815b3dcfa23f4b92c24751904dc765c7e0ab90efa353eb3.exe 1372 f70d87a9d7ed40437815b3dcfa23f4b92c24751904dc765c7e0ab90efa353eb3.exe 1372 f70d87a9d7ed40437815b3dcfa23f4b92c24751904dc765c7e0ab90efa353eb3.exe 1372 f70d87a9d7ed40437815b3dcfa23f4b92c24751904dc765c7e0ab90efa353eb3.exe 1372 f70d87a9d7ed40437815b3dcfa23f4b92c24751904dc765c7e0ab90efa353eb3.exe 1372 f70d87a9d7ed40437815b3dcfa23f4b92c24751904dc765c7e0ab90efa353eb3.exe 1372 f70d87a9d7ed40437815b3dcfa23f4b92c24751904dc765c7e0ab90efa353eb3.exe 1372 f70d87a9d7ed40437815b3dcfa23f4b92c24751904dc765c7e0ab90efa353eb3.exe 1372 f70d87a9d7ed40437815b3dcfa23f4b92c24751904dc765c7e0ab90efa353eb3.exe 1372 f70d87a9d7ed40437815b3dcfa23f4b92c24751904dc765c7e0ab90efa353eb3.exe 1372 f70d87a9d7ed40437815b3dcfa23f4b92c24751904dc765c7e0ab90efa353eb3.exe 1372 f70d87a9d7ed40437815b3dcfa23f4b92c24751904dc765c7e0ab90efa353eb3.exe 1372 f70d87a9d7ed40437815b3dcfa23f4b92c24751904dc765c7e0ab90efa353eb3.exe 1372 f70d87a9d7ed40437815b3dcfa23f4b92c24751904dc765c7e0ab90efa353eb3.exe 1372 f70d87a9d7ed40437815b3dcfa23f4b92c24751904dc765c7e0ab90efa353eb3.exe 1372 f70d87a9d7ed40437815b3dcfa23f4b92c24751904dc765c7e0ab90efa353eb3.exe 1372 f70d87a9d7ed40437815b3dcfa23f4b92c24751904dc765c7e0ab90efa353eb3.exe 1372 f70d87a9d7ed40437815b3dcfa23f4b92c24751904dc765c7e0ab90efa353eb3.exe 1372 f70d87a9d7ed40437815b3dcfa23f4b92c24751904dc765c7e0ab90efa353eb3.exe 1372 f70d87a9d7ed40437815b3dcfa23f4b92c24751904dc765c7e0ab90efa353eb3.exe 1372 f70d87a9d7ed40437815b3dcfa23f4b92c24751904dc765c7e0ab90efa353eb3.exe 1372 f70d87a9d7ed40437815b3dcfa23f4b92c24751904dc765c7e0ab90efa353eb3.exe 1372 f70d87a9d7ed40437815b3dcfa23f4b92c24751904dc765c7e0ab90efa353eb3.exe 1372 f70d87a9d7ed40437815b3dcfa23f4b92c24751904dc765c7e0ab90efa353eb3.exe 1372 f70d87a9d7ed40437815b3dcfa23f4b92c24751904dc765c7e0ab90efa353eb3.exe 1372 f70d87a9d7ed40437815b3dcfa23f4b92c24751904dc765c7e0ab90efa353eb3.exe 1372 f70d87a9d7ed40437815b3dcfa23f4b92c24751904dc765c7e0ab90efa353eb3.exe 1372 f70d87a9d7ed40437815b3dcfa23f4b92c24751904dc765c7e0ab90efa353eb3.exe 1372 f70d87a9d7ed40437815b3dcfa23f4b92c24751904dc765c7e0ab90efa353eb3.exe 1372 f70d87a9d7ed40437815b3dcfa23f4b92c24751904dc765c7e0ab90efa353eb3.exe 1372 f70d87a9d7ed40437815b3dcfa23f4b92c24751904dc765c7e0ab90efa353eb3.exe 1372 f70d87a9d7ed40437815b3dcfa23f4b92c24751904dc765c7e0ab90efa353eb3.exe 1372 f70d87a9d7ed40437815b3dcfa23f4b92c24751904dc765c7e0ab90efa353eb3.exe 1372 f70d87a9d7ed40437815b3dcfa23f4b92c24751904dc765c7e0ab90efa353eb3.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 1372 f70d87a9d7ed40437815b3dcfa23f4b92c24751904dc765c7e0ab90efa353eb3.exe Token: 33 1372 f70d87a9d7ed40437815b3dcfa23f4b92c24751904dc765c7e0ab90efa353eb3.exe Token: SeIncBasePriorityPrivilege 1372 f70d87a9d7ed40437815b3dcfa23f4b92c24751904dc765c7e0ab90efa353eb3.exe Token: 33 1372 f70d87a9d7ed40437815b3dcfa23f4b92c24751904dc765c7e0ab90efa353eb3.exe Token: SeIncBasePriorityPrivilege 1372 f70d87a9d7ed40437815b3dcfa23f4b92c24751904dc765c7e0ab90efa353eb3.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 316 iexplore.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 316 iexplore.exe 316 iexplore.exe 856 IEXPLORE.EXE 856 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1372 wrote to memory of 1172 1372 f70d87a9d7ed40437815b3dcfa23f4b92c24751904dc765c7e0ab90efa353eb3.exe 29 PID 1372 wrote to memory of 1172 1372 f70d87a9d7ed40437815b3dcfa23f4b92c24751904dc765c7e0ab90efa353eb3.exe 29 PID 1372 wrote to memory of 1172 1372 f70d87a9d7ed40437815b3dcfa23f4b92c24751904dc765c7e0ab90efa353eb3.exe 29 PID 1372 wrote to memory of 1172 1372 f70d87a9d7ed40437815b3dcfa23f4b92c24751904dc765c7e0ab90efa353eb3.exe 29 PID 1372 wrote to memory of 1384 1372 f70d87a9d7ed40437815b3dcfa23f4b92c24751904dc765c7e0ab90efa353eb3.exe 16 PID 1372 wrote to memory of 1384 1372 f70d87a9d7ed40437815b3dcfa23f4b92c24751904dc765c7e0ab90efa353eb3.exe 16 PID 1372 wrote to memory of 1384 1372 f70d87a9d7ed40437815b3dcfa23f4b92c24751904dc765c7e0ab90efa353eb3.exe 16 PID 1372 wrote to memory of 1384 1372 f70d87a9d7ed40437815b3dcfa23f4b92c24751904dc765c7e0ab90efa353eb3.exe 16 PID 1372 wrote to memory of 1384 1372 f70d87a9d7ed40437815b3dcfa23f4b92c24751904dc765c7e0ab90efa353eb3.exe 16 PID 1372 wrote to memory of 1384 1372 f70d87a9d7ed40437815b3dcfa23f4b92c24751904dc765c7e0ab90efa353eb3.exe 16 PID 1372 wrote to memory of 1384 1372 f70d87a9d7ed40437815b3dcfa23f4b92c24751904dc765c7e0ab90efa353eb3.exe 16 PID 1372 wrote to memory of 1384 1372 f70d87a9d7ed40437815b3dcfa23f4b92c24751904dc765c7e0ab90efa353eb3.exe 16 PID 1372 wrote to memory of 1384 1372 f70d87a9d7ed40437815b3dcfa23f4b92c24751904dc765c7e0ab90efa353eb3.exe 16 PID 1372 wrote to memory of 1384 1372 f70d87a9d7ed40437815b3dcfa23f4b92c24751904dc765c7e0ab90efa353eb3.exe 16 PID 1372 wrote to memory of 1384 1372 f70d87a9d7ed40437815b3dcfa23f4b92c24751904dc765c7e0ab90efa353eb3.exe 16 PID 1372 wrote to memory of 1384 1372 f70d87a9d7ed40437815b3dcfa23f4b92c24751904dc765c7e0ab90efa353eb3.exe 16 PID 1372 wrote to memory of 1384 1372 f70d87a9d7ed40437815b3dcfa23f4b92c24751904dc765c7e0ab90efa353eb3.exe 16 PID 1372 wrote to memory of 1384 1372 f70d87a9d7ed40437815b3dcfa23f4b92c24751904dc765c7e0ab90efa353eb3.exe 16 PID 1372 wrote to memory of 1384 1372 f70d87a9d7ed40437815b3dcfa23f4b92c24751904dc765c7e0ab90efa353eb3.exe 16 PID 1372 wrote to memory of 1384 1372 f70d87a9d7ed40437815b3dcfa23f4b92c24751904dc765c7e0ab90efa353eb3.exe 16 PID 1372 wrote to memory of 1384 1372 f70d87a9d7ed40437815b3dcfa23f4b92c24751904dc765c7e0ab90efa353eb3.exe 16 PID 1372 wrote to memory of 1384 1372 f70d87a9d7ed40437815b3dcfa23f4b92c24751904dc765c7e0ab90efa353eb3.exe 16 PID 1372 wrote to memory of 1384 1372 f70d87a9d7ed40437815b3dcfa23f4b92c24751904dc765c7e0ab90efa353eb3.exe 16 PID 1372 wrote to memory of 1384 1372 f70d87a9d7ed40437815b3dcfa23f4b92c24751904dc765c7e0ab90efa353eb3.exe 16 PID 1372 wrote to memory of 1384 1372 f70d87a9d7ed40437815b3dcfa23f4b92c24751904dc765c7e0ab90efa353eb3.exe 16 PID 1372 wrote to memory of 1384 1372 f70d87a9d7ed40437815b3dcfa23f4b92c24751904dc765c7e0ab90efa353eb3.exe 16 PID 1372 wrote to memory of 1384 1372 f70d87a9d7ed40437815b3dcfa23f4b92c24751904dc765c7e0ab90efa353eb3.exe 16 PID 1372 wrote to memory of 1384 1372 f70d87a9d7ed40437815b3dcfa23f4b92c24751904dc765c7e0ab90efa353eb3.exe 16 PID 1372 wrote to memory of 1384 1372 f70d87a9d7ed40437815b3dcfa23f4b92c24751904dc765c7e0ab90efa353eb3.exe 16 PID 1372 wrote to memory of 1384 1372 f70d87a9d7ed40437815b3dcfa23f4b92c24751904dc765c7e0ab90efa353eb3.exe 16 PID 1372 wrote to memory of 1384 1372 f70d87a9d7ed40437815b3dcfa23f4b92c24751904dc765c7e0ab90efa353eb3.exe 16 PID 1172 wrote to memory of 564 1172 cmd.exe 31 PID 1172 wrote to memory of 564 1172 cmd.exe 31 PID 1172 wrote to memory of 564 1172 cmd.exe 31 PID 1172 wrote to memory of 564 1172 cmd.exe 31 PID 1372 wrote to memory of 1384 1372 f70d87a9d7ed40437815b3dcfa23f4b92c24751904dc765c7e0ab90efa353eb3.exe 16 PID 1372 wrote to memory of 1384 1372 f70d87a9d7ed40437815b3dcfa23f4b92c24751904dc765c7e0ab90efa353eb3.exe 16 PID 1172 wrote to memory of 1948 1172 cmd.exe 32 PID 1172 wrote to memory of 1948 1172 cmd.exe 32 PID 1172 wrote to memory of 1948 1172 cmd.exe 32 PID 1172 wrote to memory of 1948 1172 cmd.exe 32 PID 1372 wrote to memory of 1384 1372 f70d87a9d7ed40437815b3dcfa23f4b92c24751904dc765c7e0ab90efa353eb3.exe 16 PID 1372 wrote to memory of 1384 1372 f70d87a9d7ed40437815b3dcfa23f4b92c24751904dc765c7e0ab90efa353eb3.exe 16 PID 316 wrote to memory of 856 316 iexplore.exe 34 PID 316 wrote to memory of 856 316 iexplore.exe 34 PID 316 wrote to memory of 856 316 iexplore.exe 34 PID 316 wrote to memory of 856 316 iexplore.exe 34 PID 1372 wrote to memory of 1384 1372 f70d87a9d7ed40437815b3dcfa23f4b92c24751904dc765c7e0ab90efa353eb3.exe 16 PID 1372 wrote to memory of 1384 1372 f70d87a9d7ed40437815b3dcfa23f4b92c24751904dc765c7e0ab90efa353eb3.exe 16 PID 1372 wrote to memory of 1384 1372 f70d87a9d7ed40437815b3dcfa23f4b92c24751904dc765c7e0ab90efa353eb3.exe 16 PID 1372 wrote to memory of 1384 1372 f70d87a9d7ed40437815b3dcfa23f4b92c24751904dc765c7e0ab90efa353eb3.exe 16 PID 1372 wrote to memory of 1384 1372 f70d87a9d7ed40437815b3dcfa23f4b92c24751904dc765c7e0ab90efa353eb3.exe 16 PID 1372 wrote to memory of 1384 1372 f70d87a9d7ed40437815b3dcfa23f4b92c24751904dc765c7e0ab90efa353eb3.exe 16 PID 1372 wrote to memory of 1384 1372 f70d87a9d7ed40437815b3dcfa23f4b92c24751904dc765c7e0ab90efa353eb3.exe 16 PID 1372 wrote to memory of 1384 1372 f70d87a9d7ed40437815b3dcfa23f4b92c24751904dc765c7e0ab90efa353eb3.exe 16 PID 1372 wrote to memory of 1384 1372 f70d87a9d7ed40437815b3dcfa23f4b92c24751904dc765c7e0ab90efa353eb3.exe 16 PID 1372 wrote to memory of 1384 1372 f70d87a9d7ed40437815b3dcfa23f4b92c24751904dc765c7e0ab90efa353eb3.exe 16 PID 1372 wrote to memory of 1384 1372 f70d87a9d7ed40437815b3dcfa23f4b92c24751904dc765c7e0ab90efa353eb3.exe 16 PID 1372 wrote to memory of 1384 1372 f70d87a9d7ed40437815b3dcfa23f4b92c24751904dc765c7e0ab90efa353eb3.exe 16 PID 1372 wrote to memory of 1384 1372 f70d87a9d7ed40437815b3dcfa23f4b92c24751904dc765c7e0ab90efa353eb3.exe 16 PID 1372 wrote to memory of 1384 1372 f70d87a9d7ed40437815b3dcfa23f4b92c24751904dc765c7e0ab90efa353eb3.exe 16 PID 1372 wrote to memory of 1384 1372 f70d87a9d7ed40437815b3dcfa23f4b92c24751904dc765c7e0ab90efa353eb3.exe 16 PID 1372 wrote to memory of 1384 1372 f70d87a9d7ed40437815b3dcfa23f4b92c24751904dc765c7e0ab90efa353eb3.exe 16 PID 1372 wrote to memory of 1384 1372 f70d87a9d7ed40437815b3dcfa23f4b92c24751904dc765c7e0ab90efa353eb3.exe 16
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1384
-
C:\Users\Admin\AppData\Local\Temp\f70d87a9d7ed40437815b3dcfa23f4b92c24751904dc765c7e0ab90efa353eb3.exe"C:\Users\Admin\AppData\Local\Temp\f70d87a9d7ed40437815b3dcfa23f4b92c24751904dc765c7e0ab90efa353eb3.exe"2⤵
- Loads dropped DLL
- Drops file in System32 directory
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1372 -
C:\Windows\SysWOW64\cmd.execmd /c C:\151657.bat3⤵
- Suspicious use of WriteProcessMemory
PID:1172 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c dir "C:\Users\Admin\Local Settings\Application Data\Mozilla\Firefox\Profiles\*.default" /B4⤵PID:564
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c dir "C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\*.default" /B4⤵PID:1948
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:316 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:316 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:856
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5KB
MD5ad0d80bf6b4292dbada25f7f8fd6556c
SHA140133d1dea9905bf406fb88efcb57cd693e6cf43
SHA256081f45a04b555b2406e5b63afbcdba4e564c3157e7d3720d21e8f53d2127bae1
SHA51276eaacabecaaed7b4eb53fbc5db4d53b15ccdbe6526119346dc444e932cc1ebfffb74b0df3f54c85168d72082f9017802e9775bc178a58fcac0ab3c1ddb519cb
-
Filesize
532KB
MD5fa780de5b7b511628e30f836f8aca93f
SHA149e7669dbda1f899e7c818b03950cdda1254f97e
SHA256924774da419210b689e7a5afa1862b2802ecd450e0630c6471a5f277a6a40d27
SHA51228947b76c3d5f56a8ac88585165ebebd50503c9e796b0c5318e2101f018993c28bd5c5bdb39dad35bcefebd7b84e126c40c224bd3636813a350d0c8894fa5d2d
-
Filesize
481KB
MD5acc460e14e76cd7df7c3aea7fcf25e7d
SHA1689664b83e468468d5179b6428c571686328394b
SHA256898e410ea79efda9e6b5c89340ffa7eb337047d46ab12cf281d7e11de09c0ff4
SHA51243511a969ab5ce2679a5161aa576f1c9e80e22cddc8ac2993f00a02bdfa290436f005301a44be136051740629f0d5a0ef389747f4baee1eb343c532327ff9c54