Analysis
-
max time kernel
159s -
max time network
168s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
22-11-2022 21:44
Behavioral task
behavioral1
Sample
61fbe4b8e8a709e683785ed2aa7ac2c83bba53092cfed941b9c04ae0c0c6048d.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
61fbe4b8e8a709e683785ed2aa7ac2c83bba53092cfed941b9c04ae0c0c6048d.exe
Resource
win10v2004-20221111-en
General
-
Target
61fbe4b8e8a709e683785ed2aa7ac2c83bba53092cfed941b9c04ae0c0c6048d.exe
-
Size
364KB
-
MD5
3dd1cf4790cd31af28bcff1aef503671
-
SHA1
c58fd96841c2eaf0ff07bcb6ac116e18310fc383
-
SHA256
61fbe4b8e8a709e683785ed2aa7ac2c83bba53092cfed941b9c04ae0c0c6048d
-
SHA512
0984a0b5ab08a98923af75dc201df0623f1c3c96472c61eb5f26c11a8d8140aafe37a0795c4e11d887a2fa7b36b904ba865507ac02e23bae4d85ccc769a65ebc
-
SSDEEP
6144:k9qETTZ+4TBpvjLCousWZtPZvXEs5/ev6ZU2pvGOIxXdSK0G:/EnU4T/vjL8BXE2GCZzIdXoLG
Malware Config
Signatures
-
Modifies system executable filetype association 2 TTPs 1 IoCs
Processes:
61fbe4b8e8a709e683785ed2aa7ac2c83bba53092cfed941b9c04ae0c0c6048d.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" 61fbe4b8e8a709e683785ed2aa7ac2c83bba53092cfed941b9c04ae0c0c6048d.exe -
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
-
Executes dropped EXE 1 IoCs
Processes:
61fbe4b8e8a709e683785ed2aa7ac2c83bba53092cfed941b9c04ae0c0c6048d.exepid process 1092 61fbe4b8e8a709e683785ed2aa7ac2c83bba53092cfed941b9c04ae0c0c6048d.exe -
Loads dropped DLL 2 IoCs
Processes:
61fbe4b8e8a709e683785ed2aa7ac2c83bba53092cfed941b9c04ae0c0c6048d.exepid process 1452 61fbe4b8e8a709e683785ed2aa7ac2c83bba53092cfed941b9c04ae0c0c6048d.exe 1452 61fbe4b8e8a709e683785ed2aa7ac2c83bba53092cfed941b9c04ae0c0c6048d.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 64 IoCs
Processes:
61fbe4b8e8a709e683785ed2aa7ac2c83bba53092cfed941b9c04ae0c0c6048d.exedescription ioc process File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DW20.EXE 61fbe4b8e8a709e683785ed2aa7ac2c83bba53092cfed941b9c04ae0c0c6048d.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\CNFNOT32.EXE 61fbe4b8e8a709e683785ed2aa7ac2c83bba53092cfed941b9c04ae0c0c6048d.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\INFOPATH.EXE 61fbe4b8e8a709e683785ed2aa7ac2c83bba53092cfed941b9c04ae0c0c6048d.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOUC.EXE 61fbe4b8e8a709e683785ed2aa7ac2c83bba53092cfed941b9c04ae0c0c6048d.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSQRY32.EXE 61fbe4b8e8a709e683785ed2aa7ac2c83bba53092cfed941b9c04ae0c0c6048d.exe File opened for modification C:\PROGRA~2\WINDOW~2\ACCESS~1\wordpad.exe 61fbe4b8e8a709e683785ed2aa7ac2c83bba53092cfed941b9c04ae0c0c6048d.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBEU~1.EXE 61fbe4b8e8a709e683785ed2aa7ac2c83bba53092cfed941b9c04ae0c0c6048d.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\Eula.exe 61fbe4b8e8a709e683785ed2aa7ac2c83bba53092cfed941b9c04ae0c0c6048d.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe 61fbe4b8e8a709e683785ed2aa7ac2c83bba53092cfed941b9c04ae0c0c6048d.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\TextConv\WksConv\Wkconv.exe 61fbe4b8e8a709e683785ed2aa7ac2c83bba53092cfed941b9c04ae0c0c6048d.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmpshare.exe 61fbe4b8e8a709e683785ed2aa7ac2c83bba53092cfed941b9c04ae0c0c6048d.exe File opened for modification C:\PROGRA~2\WI4223~1\sidebar.exe 61fbe4b8e8a709e683785ed2aa7ac2c83bba53092cfed941b9c04ae0c0c6048d.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ADOBEC~1.EXE 61fbe4b8e8a709e683785ed2aa7ac2c83bba53092cfed941b9c04ae0c0c6048d.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~1.EXE 61fbe4b8e8a709e683785ed2aa7ac2c83bba53092cfed941b9c04ae0c0c6048d.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\POWERPNT.EXE 61fbe4b8e8a709e683785ed2aa7ac2c83bba53092cfed941b9c04ae0c0c6048d.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\VPREVIEW.EXE 61fbe4b8e8a709e683785ed2aa7ac2c83bba53092cfed941b9c04ae0c0c6048d.exe File opened for modification C:\PROGRA~2\MOZILL~1\UNINST~1.EXE 61fbe4b8e8a709e683785ed2aa7ac2c83bba53092cfed941b9c04ae0c0c6048d.exe File opened for modification C:\PROGRA~2\WI54FB~1\setup_wm.exe 61fbe4b8e8a709e683785ed2aa7ac2c83bba53092cfed941b9c04ae0c0c6048d.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmprph.exe 61fbe4b8e8a709e683785ed2aa7ac2c83bba53092cfed941b9c04ae0c0c6048d.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE 61fbe4b8e8a709e683785ed2aa7ac2c83bba53092cfed941b9c04ae0c0c6048d.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\SOURCE~1\OSE.EXE 61fbe4b8e8a709e683785ed2aa7ac2c83bba53092cfed941b9c04ae0c0c6048d.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~3.EXE 61fbe4b8e8a709e683785ed2aa7ac2c83bba53092cfed941b9c04ae0c0c6048d.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSTORDB.EXE 61fbe4b8e8a709e683785ed2aa7ac2c83bba53092cfed941b9c04ae0c0c6048d.exe File opened for modification C:\PROGRA~2\WINDOW~1\wab.exe 61fbe4b8e8a709e683785ed2aa7ac2c83bba53092cfed941b9c04ae0c0c6048d.exe File opened for modification C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE 61fbe4b8e8a709e683785ed2aa7ac2c83bba53092cfed941b9c04ae0c0c6048d.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\A3DUTI~1.EXE 61fbe4b8e8a709e683785ed2aa7ac2c83bba53092cfed941b9c04ae0c0c6048d.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~4.EXE 61fbe4b8e8a709e683785ed2aa7ac2c83bba53092cfed941b9c04ae0c0c6048d.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\WINWORD.EXE 61fbe4b8e8a709e683785ed2aa7ac2c83bba53092cfed941b9c04ae0c0c6048d.exe File opened for modification C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE 61fbe4b8e8a709e683785ed2aa7ac2c83bba53092cfed941b9c04ae0c0c6048d.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\AcroRd32.exe 61fbe4b8e8a709e683785ed2aa7ac2c83bba53092cfed941b9c04ae0c0c6048d.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOBD5D~1.EXE 61fbe4b8e8a709e683785ed2aa7ac2c83bba53092cfed941b9c04ae0c0c6048d.exe File opened for modification C:\PROGRA~2\INTERN~1\ielowutil.exe 61fbe4b8e8a709e683785ed2aa7ac2c83bba53092cfed941b9c04ae0c0c6048d.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\XLICONS.EXE 61fbe4b8e8a709e683785ed2aa7ac2c83bba53092cfed941b9c04ae0c0c6048d.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\Oarpmany.exe 61fbe4b8e8a709e683785ed2aa7ac2c83bba53092cfed941b9c04ae0c0c6048d.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GO664E~1.EXE 61fbe4b8e8a709e683785ed2aa7ac2c83bba53092cfed941b9c04ae0c0c6048d.exe File opened for modification C:\PROGRA~2\Google\Update\DISABL~1.EXE 61fbe4b8e8a709e683785ed2aa7ac2c83bba53092cfed941b9c04ae0c0c6048d.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\1033\ONELEV.EXE 61fbe4b8e8a709e683785ed2aa7ac2c83bba53092cfed941b9c04ae0c0c6048d.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ACCICONS.EXE 61fbe4b8e8a709e683785ed2aa7ac2c83bba53092cfed941b9c04ae0c0c6048d.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\misc.exe 61fbe4b8e8a709e683785ed2aa7ac2c83bba53092cfed941b9c04ae0c0c6048d.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOSYNC.EXE 61fbe4b8e8a709e683785ed2aa7ac2c83bba53092cfed941b9c04ae0c0c6048d.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\OIS.EXE 61fbe4b8e8a709e683785ed2aa7ac2c83bba53092cfed941b9c04ae0c0c6048d.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBE_~1.EXE 61fbe4b8e8a709e683785ed2aa7ac2c83bba53092cfed941b9c04ae0c0c6048d.exe File opened for modification C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE 61fbe4b8e8a709e683785ed2aa7ac2c83bba53092cfed941b9c04ae0c0c6048d.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\SELFCERT.EXE 61fbe4b8e8a709e683785ed2aa7ac2c83bba53092cfed941b9c04ae0c0c6048d.exe File opened for modification C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE 61fbe4b8e8a709e683785ed2aa7ac2c83bba53092cfed941b9c04ae0c0c6048d.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmplayer.exe 61fbe4b8e8a709e683785ed2aa7ac2c83bba53092cfed941b9c04ae0c0c6048d.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\Setup.exe 61fbe4b8e8a709e683785ed2aa7ac2c83bba53092cfed941b9c04ae0c0c6048d.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\EQUATION\EQNEDT32.EXE 61fbe4b8e8a709e683785ed2aa7ac2c83bba53092cfed941b9c04ae0c0c6048d.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOXMLED.EXE 61fbe4b8e8a709e683785ed2aa7ac2c83bba53092cfed941b9c04ae0c0c6048d.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\NAMECO~1.EXE 61fbe4b8e8a709e683785ed2aa7ac2c83bba53092cfed941b9c04ae0c0c6048d.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ONENOTE.EXE 61fbe4b8e8a709e683785ed2aa7ac2c83bba53092cfed941b9c04ae0c0c6048d.exe File opened for modification C:\PROGRA~2\WINDOW~1\WinMail.exe 61fbe4b8e8a709e683785ed2aa7ac2c83bba53092cfed941b9c04ae0c0c6048d.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmpconfig.exe 61fbe4b8e8a709e683785ed2aa7ac2c83bba53092cfed941b9c04ae0c0c6048d.exe File opened for modification C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE 61fbe4b8e8a709e683785ed2aa7ac2c83bba53092cfed941b9c04ae0c0c6048d.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\SETUPF~1\{AC76B~1\Setup.exe 61fbe4b8e8a709e683785ed2aa7ac2c83bba53092cfed941b9c04ae0c0c6048d.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ONENOTEM.EXE 61fbe4b8e8a709e683785ed2aa7ac2c83bba53092cfed941b9c04ae0c0c6048d.exe File opened for modification C:\PROGRA~2\WINDOW~1\wabmig.exe 61fbe4b8e8a709e683785ed2aa7ac2c83bba53092cfed941b9c04ae0c0c6048d.exe File opened for modification C:\PROGRA~2\COMMON~1\ADOBEA~1\Versions\1.0\ADOBEA~1.EXE 61fbe4b8e8a709e683785ed2aa7ac2c83bba53092cfed941b9c04ae0c0c6048d.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmlaunch.exe 61fbe4b8e8a709e683785ed2aa7ac2c83bba53092cfed941b9c04ae0c0c6048d.exe File opened for modification C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE 61fbe4b8e8a709e683785ed2aa7ac2c83bba53092cfed941b9c04ae0c0c6048d.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\GROOVEMN.EXE 61fbe4b8e8a709e683785ed2aa7ac2c83bba53092cfed941b9c04ae0c0c6048d.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\ink\mip.exe 61fbe4b8e8a709e683785ed2aa7ac2c83bba53092cfed941b9c04ae0c0c6048d.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\FLTLDR.EXE 61fbe4b8e8a709e683785ed2aa7ac2c83bba53092cfed941b9c04ae0c0c6048d.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\ODeploy.exe 61fbe4b8e8a709e683785ed2aa7ac2c83bba53092cfed941b9c04ae0c0c6048d.exe -
Drops file in Windows directory 1 IoCs
Processes:
61fbe4b8e8a709e683785ed2aa7ac2c83bba53092cfed941b9c04ae0c0c6048d.exedescription ioc process File opened for modification C:\Windows\svchost.com 61fbe4b8e8a709e683785ed2aa7ac2c83bba53092cfed941b9c04ae0c0c6048d.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000fbec07815684004d899a318f710de6af0000000002000000000010660000000100002000000047ef36a58cc018ecb22d79bc52770c843d8652f50c7f2b310d35c3abed9eb154000000000e8000000002000020000000f1a0552c55f687bf202492a1f2603155a5b7cdbc1bfd9a3bbb42937aa79945c2200000001cfe5e6e87c244fd99d302bea28b0c6f6b9cf85fbefdd309a826befd7fd53c884000000016c13ac5b3a13a22ae76b3dc88aecf5a118ef9ad1edcf665292b98c11f61998f76b714f87c8cb09c5d7f2fb80567e913289edde0a8e82fcb8dac76cc303b5d6b iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "375922103" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5AA3E7E1-6AB7-11ED-91F2-D2F8C2B78FDE} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 401dd336c4fed801 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000fbec07815684004d899a318f710de6af00000000020000000000106600000001000020000000fa5589323a9ffe4697eb14df3c1947096c81af1a37d9ec538cc45326fbfc3271000000000e800000000200002000000054a0ffa57d2a2c186481bf6ed94b39ed34cc88fc47e32f18b8d07b109edcd7f190000000f60f196170b232891c43b10888ef661905637334d95e3f25c7189c6a58c7731619fa8cbd4f76a8c7ad8785bebecc976a8e217201dc08d8ad2406713a65011e3a0032680e5ecfabab5e2365189f686a8ffa68046156eba15dd4a4b65bdebd504478b7d73f4d9f83577212f8d3b238df3c4e34e062b2ebc2a760bbe191649b0bb7167dc7cbf22a6768cfee784954eefd3f40000000533b163f5478f19a7e3938a4afb051c60be1c35036347b19d5d354c5e319902833a1a1c4a8272b273c8a9f76cf62fe6be1614e32f49b53cdbdd573ac6e6599ad iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe -
Modifies registry class 1 IoCs
Processes:
61fbe4b8e8a709e683785ed2aa7ac2c83bba53092cfed941b9c04ae0c0c6048d.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" 61fbe4b8e8a709e683785ed2aa7ac2c83bba53092cfed941b9c04ae0c0c6048d.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
61fbe4b8e8a709e683785ed2aa7ac2c83bba53092cfed941b9c04ae0c0c6048d.exepid process 1092 61fbe4b8e8a709e683785ed2aa7ac2c83bba53092cfed941b9c04ae0c0c6048d.exe 1092 61fbe4b8e8a709e683785ed2aa7ac2c83bba53092cfed941b9c04ae0c0c6048d.exe 1092 61fbe4b8e8a709e683785ed2aa7ac2c83bba53092cfed941b9c04ae0c0c6048d.exe 1092 61fbe4b8e8a709e683785ed2aa7ac2c83bba53092cfed941b9c04ae0c0c6048d.exe 1092 61fbe4b8e8a709e683785ed2aa7ac2c83bba53092cfed941b9c04ae0c0c6048d.exe 1092 61fbe4b8e8a709e683785ed2aa7ac2c83bba53092cfed941b9c04ae0c0c6048d.exe 1092 61fbe4b8e8a709e683785ed2aa7ac2c83bba53092cfed941b9c04ae0c0c6048d.exe 1092 61fbe4b8e8a709e683785ed2aa7ac2c83bba53092cfed941b9c04ae0c0c6048d.exe 1092 61fbe4b8e8a709e683785ed2aa7ac2c83bba53092cfed941b9c04ae0c0c6048d.exe 1092 61fbe4b8e8a709e683785ed2aa7ac2c83bba53092cfed941b9c04ae0c0c6048d.exe 1092 61fbe4b8e8a709e683785ed2aa7ac2c83bba53092cfed941b9c04ae0c0c6048d.exe 1092 61fbe4b8e8a709e683785ed2aa7ac2c83bba53092cfed941b9c04ae0c0c6048d.exe 1092 61fbe4b8e8a709e683785ed2aa7ac2c83bba53092cfed941b9c04ae0c0c6048d.exe 1092 61fbe4b8e8a709e683785ed2aa7ac2c83bba53092cfed941b9c04ae0c0c6048d.exe 1092 61fbe4b8e8a709e683785ed2aa7ac2c83bba53092cfed941b9c04ae0c0c6048d.exe 1092 61fbe4b8e8a709e683785ed2aa7ac2c83bba53092cfed941b9c04ae0c0c6048d.exe 1092 61fbe4b8e8a709e683785ed2aa7ac2c83bba53092cfed941b9c04ae0c0c6048d.exe 1092 61fbe4b8e8a709e683785ed2aa7ac2c83bba53092cfed941b9c04ae0c0c6048d.exe 1092 61fbe4b8e8a709e683785ed2aa7ac2c83bba53092cfed941b9c04ae0c0c6048d.exe 1092 61fbe4b8e8a709e683785ed2aa7ac2c83bba53092cfed941b9c04ae0c0c6048d.exe 1092 61fbe4b8e8a709e683785ed2aa7ac2c83bba53092cfed941b9c04ae0c0c6048d.exe 1092 61fbe4b8e8a709e683785ed2aa7ac2c83bba53092cfed941b9c04ae0c0c6048d.exe 1092 61fbe4b8e8a709e683785ed2aa7ac2c83bba53092cfed941b9c04ae0c0c6048d.exe 1092 61fbe4b8e8a709e683785ed2aa7ac2c83bba53092cfed941b9c04ae0c0c6048d.exe 1092 61fbe4b8e8a709e683785ed2aa7ac2c83bba53092cfed941b9c04ae0c0c6048d.exe 1092 61fbe4b8e8a709e683785ed2aa7ac2c83bba53092cfed941b9c04ae0c0c6048d.exe 1092 61fbe4b8e8a709e683785ed2aa7ac2c83bba53092cfed941b9c04ae0c0c6048d.exe 1092 61fbe4b8e8a709e683785ed2aa7ac2c83bba53092cfed941b9c04ae0c0c6048d.exe 1092 61fbe4b8e8a709e683785ed2aa7ac2c83bba53092cfed941b9c04ae0c0c6048d.exe 1092 61fbe4b8e8a709e683785ed2aa7ac2c83bba53092cfed941b9c04ae0c0c6048d.exe 1092 61fbe4b8e8a709e683785ed2aa7ac2c83bba53092cfed941b9c04ae0c0c6048d.exe 1092 61fbe4b8e8a709e683785ed2aa7ac2c83bba53092cfed941b9c04ae0c0c6048d.exe 1092 61fbe4b8e8a709e683785ed2aa7ac2c83bba53092cfed941b9c04ae0c0c6048d.exe 1092 61fbe4b8e8a709e683785ed2aa7ac2c83bba53092cfed941b9c04ae0c0c6048d.exe 1092 61fbe4b8e8a709e683785ed2aa7ac2c83bba53092cfed941b9c04ae0c0c6048d.exe 1092 61fbe4b8e8a709e683785ed2aa7ac2c83bba53092cfed941b9c04ae0c0c6048d.exe 1092 61fbe4b8e8a709e683785ed2aa7ac2c83bba53092cfed941b9c04ae0c0c6048d.exe 1092 61fbe4b8e8a709e683785ed2aa7ac2c83bba53092cfed941b9c04ae0c0c6048d.exe 1092 61fbe4b8e8a709e683785ed2aa7ac2c83bba53092cfed941b9c04ae0c0c6048d.exe 1092 61fbe4b8e8a709e683785ed2aa7ac2c83bba53092cfed941b9c04ae0c0c6048d.exe 1092 61fbe4b8e8a709e683785ed2aa7ac2c83bba53092cfed941b9c04ae0c0c6048d.exe 1092 61fbe4b8e8a709e683785ed2aa7ac2c83bba53092cfed941b9c04ae0c0c6048d.exe 1092 61fbe4b8e8a709e683785ed2aa7ac2c83bba53092cfed941b9c04ae0c0c6048d.exe 1092 61fbe4b8e8a709e683785ed2aa7ac2c83bba53092cfed941b9c04ae0c0c6048d.exe 1092 61fbe4b8e8a709e683785ed2aa7ac2c83bba53092cfed941b9c04ae0c0c6048d.exe 1092 61fbe4b8e8a709e683785ed2aa7ac2c83bba53092cfed941b9c04ae0c0c6048d.exe 1092 61fbe4b8e8a709e683785ed2aa7ac2c83bba53092cfed941b9c04ae0c0c6048d.exe 1092 61fbe4b8e8a709e683785ed2aa7ac2c83bba53092cfed941b9c04ae0c0c6048d.exe 1092 61fbe4b8e8a709e683785ed2aa7ac2c83bba53092cfed941b9c04ae0c0c6048d.exe 1092 61fbe4b8e8a709e683785ed2aa7ac2c83bba53092cfed941b9c04ae0c0c6048d.exe 1092 61fbe4b8e8a709e683785ed2aa7ac2c83bba53092cfed941b9c04ae0c0c6048d.exe 1092 61fbe4b8e8a709e683785ed2aa7ac2c83bba53092cfed941b9c04ae0c0c6048d.exe 1092 61fbe4b8e8a709e683785ed2aa7ac2c83bba53092cfed941b9c04ae0c0c6048d.exe 1092 61fbe4b8e8a709e683785ed2aa7ac2c83bba53092cfed941b9c04ae0c0c6048d.exe 1092 61fbe4b8e8a709e683785ed2aa7ac2c83bba53092cfed941b9c04ae0c0c6048d.exe 1092 61fbe4b8e8a709e683785ed2aa7ac2c83bba53092cfed941b9c04ae0c0c6048d.exe 1092 61fbe4b8e8a709e683785ed2aa7ac2c83bba53092cfed941b9c04ae0c0c6048d.exe 1092 61fbe4b8e8a709e683785ed2aa7ac2c83bba53092cfed941b9c04ae0c0c6048d.exe 1092 61fbe4b8e8a709e683785ed2aa7ac2c83bba53092cfed941b9c04ae0c0c6048d.exe 1092 61fbe4b8e8a709e683785ed2aa7ac2c83bba53092cfed941b9c04ae0c0c6048d.exe 1092 61fbe4b8e8a709e683785ed2aa7ac2c83bba53092cfed941b9c04ae0c0c6048d.exe 1092 61fbe4b8e8a709e683785ed2aa7ac2c83bba53092cfed941b9c04ae0c0c6048d.exe 1092 61fbe4b8e8a709e683785ed2aa7ac2c83bba53092cfed941b9c04ae0c0c6048d.exe 1092 61fbe4b8e8a709e683785ed2aa7ac2c83bba53092cfed941b9c04ae0c0c6048d.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
61fbe4b8e8a709e683785ed2aa7ac2c83bba53092cfed941b9c04ae0c0c6048d.exedescription pid process Token: SeDebugPrivilege 1092 61fbe4b8e8a709e683785ed2aa7ac2c83bba53092cfed941b9c04ae0c0c6048d.exe Token: SeDebugPrivilege 1092 61fbe4b8e8a709e683785ed2aa7ac2c83bba53092cfed941b9c04ae0c0c6048d.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 1480 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 1480 iexplore.exe 1480 iexplore.exe 1624 IEXPLORE.EXE 1624 IEXPLORE.EXE 1624 IEXPLORE.EXE 1624 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
61fbe4b8e8a709e683785ed2aa7ac2c83bba53092cfed941b9c04ae0c0c6048d.exe61fbe4b8e8a709e683785ed2aa7ac2c83bba53092cfed941b9c04ae0c0c6048d.exeiexplore.exedescription pid process target process PID 1452 wrote to memory of 1092 1452 61fbe4b8e8a709e683785ed2aa7ac2c83bba53092cfed941b9c04ae0c0c6048d.exe 61fbe4b8e8a709e683785ed2aa7ac2c83bba53092cfed941b9c04ae0c0c6048d.exe PID 1452 wrote to memory of 1092 1452 61fbe4b8e8a709e683785ed2aa7ac2c83bba53092cfed941b9c04ae0c0c6048d.exe 61fbe4b8e8a709e683785ed2aa7ac2c83bba53092cfed941b9c04ae0c0c6048d.exe PID 1452 wrote to memory of 1092 1452 61fbe4b8e8a709e683785ed2aa7ac2c83bba53092cfed941b9c04ae0c0c6048d.exe 61fbe4b8e8a709e683785ed2aa7ac2c83bba53092cfed941b9c04ae0c0c6048d.exe PID 1452 wrote to memory of 1092 1452 61fbe4b8e8a709e683785ed2aa7ac2c83bba53092cfed941b9c04ae0c0c6048d.exe 61fbe4b8e8a709e683785ed2aa7ac2c83bba53092cfed941b9c04ae0c0c6048d.exe PID 1092 wrote to memory of 1480 1092 61fbe4b8e8a709e683785ed2aa7ac2c83bba53092cfed941b9c04ae0c0c6048d.exe iexplore.exe PID 1092 wrote to memory of 1480 1092 61fbe4b8e8a709e683785ed2aa7ac2c83bba53092cfed941b9c04ae0c0c6048d.exe iexplore.exe PID 1092 wrote to memory of 1480 1092 61fbe4b8e8a709e683785ed2aa7ac2c83bba53092cfed941b9c04ae0c0c6048d.exe iexplore.exe PID 1092 wrote to memory of 1480 1092 61fbe4b8e8a709e683785ed2aa7ac2c83bba53092cfed941b9c04ae0c0c6048d.exe iexplore.exe PID 1480 wrote to memory of 1624 1480 iexplore.exe IEXPLORE.EXE PID 1480 wrote to memory of 1624 1480 iexplore.exe IEXPLORE.EXE PID 1480 wrote to memory of 1624 1480 iexplore.exe IEXPLORE.EXE PID 1480 wrote to memory of 1624 1480 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\61fbe4b8e8a709e683785ed2aa7ac2c83bba53092cfed941b9c04ae0c0c6048d.exe"C:\Users\Admin\AppData\Local\Temp\61fbe4b8e8a709e683785ed2aa7ac2c83bba53092cfed941b9c04ae0c0c6048d.exe"1⤵
- Modifies system executable filetype association
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1452 -
C:\Users\Admin\AppData\Local\Temp\3582-490\61fbe4b8e8a709e683785ed2aa7ac2c83bba53092cfed941b9c04ae0c0c6048d.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\61fbe4b8e8a709e683785ed2aa7ac2c83bba53092cfed941b9c04ae0c0c6048d.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1092 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://www.vk.com/mp_20143⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1480 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1480 CREDAT:275457 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1624
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
342B
MD58cef83a38ba541e4c7e0210bb16961bf
SHA1e940711cce718d1cee081fdf42d8a91518506482
SHA25675e93ab2d80de7ec154571e041370b7dbac01e6378acc5a750e99858a0c59932
SHA51299a4e4910615b77beaeb747dd04e6b87ef5ebadcf46d89d0bf8987b958d9e4a35b4b0ed83ba94eaec5bd733e37e81add8b9b2c93b5187021a092c19a6542b92d
-
C:\Users\Admin\AppData\Local\Temp\3582-490\61fbe4b8e8a709e683785ed2aa7ac2c83bba53092cfed941b9c04ae0c0c6048d.exeFilesize
323KB
MD575641dc082324d65d59802689e6f03ac
SHA1b4edb414e70c7842c1d6330914830523042f76c5
SHA2560702b546094f7d7b904c553a90fb63fcde077b13369353ddfb439cec5b121b45
SHA5124267e30723b894278adaa37ff277dbd72055be8445f28768f1dbcd207cd7f86f5b72cae7b6fd2dc6e9a3ae3b3e6e8178282f0719e12485f46d8e74f1dbd86df9
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\K69DYUKW.txtFilesize
608B
MD506185abfe99795714ed813b8a29ea91c
SHA144912f570f60c891a0c4169e6701b2dcb1373b5a
SHA2565ec6d7c110d26f70437b1a86058e0f67c52b4d3ccb2a8bacc02caf49da21e02c
SHA512491ddd8a70414bd8bcf5fd961fe64a3615891ee84c259051cce711870ea365c917c0a6e1d54c0caef6f345fe9e9edc35b2efb848a19742349b360e2e1e3cf094
-
\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXEFilesize
252KB
MD59e2b9928c89a9d0da1d3e8f4bd96afa7
SHA1ec66cda99f44b62470c6930e5afda061579cde35
SHA2568899b4ed3446b7d55b54defbc1acb7c5392a4b3bc8ec2cdc7c31171708965043
SHA5122ca5ad1d0e12a8049de885b90b7f56fe77c868e0d6dae4ec4b6f3bc0bf7b2e73295cc9b1328c2b45357ffb0d7804622ab3f91a56140b098e93b691032d508156
-
\Users\Admin\AppData\Local\Temp\3582-490\61fbe4b8e8a709e683785ed2aa7ac2c83bba53092cfed941b9c04ae0c0c6048d.exeFilesize
323KB
MD575641dc082324d65d59802689e6f03ac
SHA1b4edb414e70c7842c1d6330914830523042f76c5
SHA2560702b546094f7d7b904c553a90fb63fcde077b13369353ddfb439cec5b121b45
SHA5124267e30723b894278adaa37ff277dbd72055be8445f28768f1dbcd207cd7f86f5b72cae7b6fd2dc6e9a3ae3b3e6e8178282f0719e12485f46d8e74f1dbd86df9
-
memory/1092-56-0x0000000000000000-mapping.dmp
-
memory/1092-59-0x0000000073E90000-0x000000007443B000-memory.dmpFilesize
5.7MB
-
memory/1092-61-0x00000000020BE000-0x00000000020CF000-memory.dmpFilesize
68KB
-
memory/1092-62-0x0000000073E90000-0x000000007443B000-memory.dmpFilesize
5.7MB
-
memory/1092-63-0x00000000020BE000-0x00000000020CF000-memory.dmpFilesize
68KB
-
memory/1452-54-0x0000000075291000-0x0000000075293000-memory.dmpFilesize
8KB