orcus | ece849a1ae5c71db8aaac5ad98d2022e05448083120ff3f1f758c2c020d1d03e

Resubmissions

23-11-2022 16:58

221123-vhcetsha73 10

23-11-2022 15:40

221123-s4g64aga7w 10

Analysis

max time kernel
166s
max time network
175s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 15:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

newResultprot.exe
Size

3.3MB
MD5

3ee4cc4a7fe52761e3cb486a6c2d8e3e
SHA1

c96c9bcdcc57cfc497f4b831398145b307c42b73
SHA256

ece849a1ae5c71db8aaac5ad98d2022e05448083120ff3f1f758c2c020d1d03e
SHA512

848e1a6dde72c3e3bdecdfb9bbe8e8e9d126fed1996a95b0294f18aee19f23c61a0d8a8947294a3a01f587edf37a59df11ce249611effd54832cbad940398515
SSDEEP

98304:F49p/IqTL48s8QLbr4jYgc3TZyd2H+L05kJj9878I:Fm5xzgLQjYg6NsvrGQ

Score

10^/10

orcus isehaaa collection persistence rat spyware stealer

Malware Config

Extracted

Family

orcus

Botnet

Isehaaa

graphics-absorption.at.ply.gg:34218

Mutex

0dae1eed35bd43dc93a1d73544aa5ccf

Attributes

autostart_method
Registry
enable_keylogger
true
install_path
C:\Program Files\Java\jdk-19\lib\javaw.exe
reconnect_delay
10000
registry_keyname
javaww
taskscheduler_taskname
javawww
watchdog_path
Temp\Runtime Broker.exe

Signatures

Orcus
Orcus is a Remote Access Trojan that is being sold on underground forums.
rat spyware stealer orcus

Orcus main payload 5 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\javaw.exe	family_orcus
C:\Users\Admin\AppData\Local\Temp\javaw.exe	family_orcus
C:\Program Files\Java\jdk-19\lib\javaw.exe	family_orcus
C:\Program Files\Java\jdk-19\lib\javaw.exe	family_orcus
C:\Program Files\Java\jdk-19\lib\javaw.exe	family_orcus

Orcurs Rat Executable 7 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\javaw.exe	orcus
C:\Users\Admin\AppData\Local\Temp\javaw.exe	orcus
behavioral1/memory/1316-139-0x0000000000400000-0x0000000000A04000-memory.dmp	orcus
C:\Program Files\Java\jdk-19\lib\javaw.exe	orcus
C:\Program Files\Java\jdk-19\lib\javaw.exe	orcus
behavioral1/memory/544-166-0x0000000000B90000-0x0000000000C80000-memory.dmp	orcus
C:\Program Files\Java\jdk-19\lib\javaw.exe	orcus

Executes dropped EXE 8 IoCs

Processes:

javaw.exebuild.exeWindowsInput.exeWindowsInput.exejavaw.exejavaw.exeRuntime Broker.exeRuntime Broker.exe

pid process

4720 javaw.exe
4660 build.exe
4444 WindowsInput.exe
2240 WindowsInput.exe
544 javaw.exe
508 javaw.exe
2304 Runtime Broker.exe
4128 Runtime Broker.exe

pid	process
4720	javaw.exe
4660	build.exe
4444	WindowsInput.exe
2240	WindowsInput.exe
544	javaw.exe
508	javaw.exe
2304	Runtime Broker.exe
4128	Runtime Broker.exe

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

javaw.exeRuntime Broker.exenewResultprot.exejavaw.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	javaw.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	Runtime Broker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	newResultprot.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	javaw.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

build.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	build.exe
Key opened	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	build.exe
Key opened	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	build.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

javaw.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\javaww = "\"C:\\Program Files\\Java\\jdk-19\\lib\\javaw.exe\""	javaw.exe

Drops desktop.ini file(s) 2 IoCs

Processes:

javaw.exe

description ioc process

File created C:\Windows\assembly\Desktop.ini javaw.exe
File opened for modification C:\Windows\assembly\Desktop.ini javaw.exe
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

20 ip-api.com
29 icanhazip.com
Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.

description	ioc	process
File created	C:\Windows\assembly\Desktop.ini	javaw.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	javaw.exe

flow	ioc
20	ip-api.com
29	icanhazip.com

Drops file in System32 directory 3 IoCs

Processes:

javaw.exeWindowsInput.exe

description	ioc	process
File created	C:\Windows\SysWOW64\WindowsInput.exe	javaw.exe
File created	C:\Windows\SysWOW64\WindowsInput.exe.config	javaw.exe
File created	C:\Windows\SysWOW64\WindowsInput.InstallState	WindowsInput.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

newResultprot.exe

pid process

1316 newResultprot.exe
1316 newResultprot.exe

Drops file in Program Files directory 3 IoCs

Processes:

javaw.exe

description	ioc	process
File created	C:\Program Files\Java\jdk-19\lib\javaw.exe	javaw.exe
File opened for modification	C:\Program Files\Java\jdk-19\lib\javaw.exe	javaw.exe
File created	C:\Program Files\Java\jdk-19\lib\javaw.exe.config	javaw.exe

Drops file in Windows directory 3 IoCs

Processes:

javaw.exe

description	ioc	process
File opened for modification	C:\Windows\assembly	javaw.exe
File created	C:\Windows\assembly\Desktop.ini	javaw.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	javaw.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

taskmgr.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

build.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	build.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	build.exe

Modifies registry class 5 IoCs

Processes:

taskmgr.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings	taskmgr.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	taskmgr.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	taskmgr.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	taskmgr.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	taskmgr.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

newResultprot.exebuild.exejavaw.exeRuntime Broker.exetaskmgr.exe

pid	process
1316	newResultprot.exe
1316	newResultprot.exe
4660	build.exe
544	javaw.exe
544	javaw.exe
4128	Runtime Broker.exe
4128	Runtime Broker.exe
544	javaw.exe
4128	Runtime Broker.exe
544	javaw.exe
4128	Runtime Broker.exe
4128	Runtime Broker.exe
544	javaw.exe
544	javaw.exe
4128	Runtime Broker.exe
4128	Runtime Broker.exe
544	javaw.exe
4128	Runtime Broker.exe
544	javaw.exe
4128	Runtime Broker.exe
544	javaw.exe
4660	build.exe
4660	build.exe
4128	Runtime Broker.exe
544	javaw.exe
544	javaw.exe
4128	Runtime Broker.exe
544	javaw.exe
4128	Runtime Broker.exe
4660	build.exe
4660	build.exe
4128	Runtime Broker.exe
544	javaw.exe
4660	build.exe
4660	build.exe
544	javaw.exe
4128	Runtime Broker.exe
4660	build.exe
4660	build.exe
4660	build.exe
4660	build.exe
544	javaw.exe
4128	Runtime Broker.exe
4660	build.exe
4660	build.exe
4660	build.exe
4128	Runtime Broker.exe
544	javaw.exe
4660	build.exe
4660	build.exe
544	javaw.exe
4128	Runtime Broker.exe
3100	taskmgr.exe
3100	taskmgr.exe
4660	build.exe
4660	build.exe
544	javaw.exe
4128	Runtime Broker.exe
4660	build.exe
4660	build.exe
3100	taskmgr.exe
4128	Runtime Broker.exe
544	javaw.exe
4660	build.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

Processes:

javaw.exetaskmgr.exe

pid process

544 javaw.exe
3100 taskmgr.exe

pid	process
544	javaw.exe
3100	taskmgr.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

Processes:

build.exejavaw.exeRuntime Broker.exeRuntime Broker.exemsiexec.exetaskmgr.exe

description	pid	process
Token: SeDebugPrivilege	4660	build.exe
Token: SeDebugPrivilege	544	javaw.exe
Token: SeDebugPrivilege	2304	Runtime Broker.exe
Token: SeDebugPrivilege	4128	Runtime Broker.exe
Token: SeSecurityPrivilege	936	msiexec.exe
Token: SeDebugPrivilege	3100	taskmgr.exe
Token: SeSystemProfilePrivilege	3100	taskmgr.exe
Token: SeCreateGlobalPrivilege	3100	taskmgr.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

taskmgr.exe

pid	process
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

Processes:

taskmgr.exe

pid	process
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe
3100	taskmgr.exe

Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

newResultprot.exejavaw.exebuild.exe

pid process

1316 newResultprot.exe
544 javaw.exe
4660 build.exe

Suspicious use of WriteProcessMemory 40 IoCs

Processes:

newResultprot.exejavaw.execsc.exejavaw.exeRuntime Broker.exebuild.execmd.execmd.exe

description	pid	process	target process
PID 1316 wrote to memory of 4720	1316	newResultprot.exe	javaw.exe
PID 1316 wrote to memory of 4720	1316	newResultprot.exe	javaw.exe
PID 1316 wrote to memory of 4660	1316	newResultprot.exe	build.exe
PID 1316 wrote to memory of 4660	1316	newResultprot.exe	build.exe
PID 1316 wrote to memory of 4660	1316	newResultprot.exe	build.exe
PID 4720 wrote to memory of 4252	4720	javaw.exe	csc.exe
PID 4720 wrote to memory of 4252	4720	javaw.exe	csc.exe
PID 4252 wrote to memory of 4552	4252	csc.exe	cvtres.exe
PID 4252 wrote to memory of 4552	4252	csc.exe	cvtres.exe
PID 4720 wrote to memory of 4444	4720	javaw.exe	WindowsInput.exe
PID 4720 wrote to memory of 4444	4720	javaw.exe	WindowsInput.exe
PID 4720 wrote to memory of 544	4720	javaw.exe	javaw.exe
PID 4720 wrote to memory of 544	4720	javaw.exe	javaw.exe
PID 544 wrote to memory of 2304	544	javaw.exe	Runtime Broker.exe
PID 544 wrote to memory of 2304	544	javaw.exe	Runtime Broker.exe
PID 544 wrote to memory of 2304	544	javaw.exe	Runtime Broker.exe
PID 2304 wrote to memory of 4128	2304	Runtime Broker.exe	Runtime Broker.exe
PID 2304 wrote to memory of 4128	2304	Runtime Broker.exe	Runtime Broker.exe
PID 2304 wrote to memory of 4128	2304	Runtime Broker.exe	Runtime Broker.exe
PID 4660 wrote to memory of 4900	4660	build.exe	cmd.exe
PID 4660 wrote to memory of 4900	4660	build.exe	cmd.exe
PID 4660 wrote to memory of 4900	4660	build.exe	cmd.exe
PID 4900 wrote to memory of 2864	4900	cmd.exe	chcp.com
PID 4900 wrote to memory of 2864	4900	cmd.exe	chcp.com
PID 4900 wrote to memory of 2864	4900	cmd.exe	chcp.com
PID 4900 wrote to memory of 1532	4900	cmd.exe	netsh.exe
PID 4900 wrote to memory of 1532	4900	cmd.exe	netsh.exe
PID 4900 wrote to memory of 1532	4900	cmd.exe	netsh.exe
PID 4900 wrote to memory of 1780	4900	cmd.exe	findstr.exe
PID 4900 wrote to memory of 1780	4900	cmd.exe	findstr.exe
PID 4900 wrote to memory of 1780	4900	cmd.exe	findstr.exe
PID 4660 wrote to memory of 1368	4660	build.exe	cmd.exe
PID 4660 wrote to memory of 1368	4660	build.exe	cmd.exe
PID 4660 wrote to memory of 1368	4660	build.exe	cmd.exe
PID 1368 wrote to memory of 1956	1368	cmd.exe	chcp.com
PID 1368 wrote to memory of 1956	1368	cmd.exe	chcp.com
PID 1368 wrote to memory of 1956	1368	cmd.exe	chcp.com
PID 1368 wrote to memory of 2320	1368	cmd.exe	netsh.exe
PID 1368 wrote to memory of 2320	1368	cmd.exe	netsh.exe
PID 1368 wrote to memory of 2320	1368	cmd.exe	netsh.exe

outlook_office_path 1 IoCs

Processes:

build.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	build.exe

outlook_win_path 1 IoCs

Processes:

build.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	build.exe

C:\Users\Admin\AppData\Local\Temp\newResultprot.exe
"C:\Users\Admin\AppData\Local\Temp\newResultprot.exe"
1⤵
- Checks computer location settings
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1316

C:\Users\Admin\AppData\Local\Temp\javaw.exe
"C:\Users\Admin\AppData\Local\Temp\javaw.exe"
2⤵
- Executes dropped EXE
- Checks computer location settings
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4720

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\jk1bengw.cmdline"
3⤵
- Suspicious use of WriteProcessMemory
PID:4252

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC365.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCC364.tmp"
4⤵
PID:4552

C:\Windows\SysWOW64\WindowsInput.exe
"C:\Windows\SysWOW64\WindowsInput.exe" --install
3⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4444

C:\Program Files\Java\jdk-19\lib\javaw.exe
"C:\Program Files\Java\jdk-19\lib\javaw.exe"
3⤵
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:544

C:\Users\Admin\AppData\Local\Temp\Runtime Broker.exe
"C:\Users\Admin\AppData\Local\Temp\Runtime Broker.exe" /launchSelfAndExit "C:\Program Files\Java\jdk-19\lib\javaw.exe" 544 /protectFile
4⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2304

C:\Users\Admin\AppData\Local\Temp\Runtime Broker.exe
"C:\Users\Admin\AppData\Local\Temp\Runtime Broker.exe" /watchProcess "C:\Program Files\Java\jdk-19\lib\javaw.exe" 544 "/protectFile"
5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4128

C:\Users\Admin\AppData\Local\Temp\build.exe
"C:\Users\Admin\AppData\Local\Temp\build.exe"
2⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
PID:4660

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All
3⤵
- Suspicious use of WriteProcessMemory
PID:4900

C:\Windows\SysWOW64\chcp.com
chcp 65001
4⤵
PID:2864

C:\Windows\SysWOW64\netsh.exe
netsh wlan show profile
4⤵
PID:1532

C:\Windows\SysWOW64\findstr.exe
findstr All
4⤵
PID:1780

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid
3⤵
- Suspicious use of WriteProcessMemory
PID:1368

C:\Windows\SysWOW64\chcp.com
chcp 65001
4⤵
PID:1956

C:\Windows\SysWOW64\netsh.exe
netsh wlan show networks mode=bssid
4⤵
PID:2320

C:\Windows\SysWOW64\WindowsInput.exe
"C:\Windows\SysWOW64\WindowsInput.exe"
1⤵
- Executes dropped EXE
PID:2240

C:\Program Files\Java\jdk-19\lib\javaw.exe
"C:\Program Files\Java\jdk-19\lib\javaw.exe"
1⤵
- Executes dropped EXE
PID:508

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:936

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3100

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3584

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Peripheral Device Discovery

T1120

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Exfiltration

Command and Control

Web Service

T1102

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Java\jdk-19\lib\javaw.exe
Filesize
938KB

MD5
63e784f82ebd4a7daa66c3478970f36b

SHA1
f319bcf48e9f647fc79aa084de027228444966e6

SHA256
282679b3e43b8c5be4671268eb8808c72f987e1977ef685a21ff7b230dab9b51

SHA512
d3ab5b2699c2fb955bda21de2e7715478ea5498c650c3219585ab623bec957da7e5398cb0d9a52a8fe021053e157a615e1d5e575ce514a140e10b565bb72a9df

Download Submit
C:\Program Files\Java\jdk-19\lib\javaw.exe
Filesize
938KB

MD5
63e784f82ebd4a7daa66c3478970f36b

SHA1
f319bcf48e9f647fc79aa084de027228444966e6

SHA256
282679b3e43b8c5be4671268eb8808c72f987e1977ef685a21ff7b230dab9b51

SHA512
d3ab5b2699c2fb955bda21de2e7715478ea5498c650c3219585ab623bec957da7e5398cb0d9a52a8fe021053e157a615e1d5e575ce514a140e10b565bb72a9df

Download Submit
C:\Program Files\Java\jdk-19\lib\javaw.exe
Filesize
938KB

MD5
63e784f82ebd4a7daa66c3478970f36b

SHA1
f319bcf48e9f647fc79aa084de027228444966e6

SHA256
282679b3e43b8c5be4671268eb8808c72f987e1977ef685a21ff7b230dab9b51

SHA512
d3ab5b2699c2fb955bda21de2e7715478ea5498c650c3219585ab623bec957da7e5398cb0d9a52a8fe021053e157a615e1d5e575ce514a140e10b565bb72a9df

Download Submit
C:\Program Files\Java\jdk-19\lib\javaw.exe.config
Filesize
357B

MD5
a2b76cea3a59fa9af5ea21ff68139c98

SHA1
35d76475e6a54c168f536e30206578babff58274

SHA256
f99ef5bf79a7c43701877f0bb0b890591885bb0a3d605762647cc8ffbf10c839

SHA512
b52608b45153c489419228864ecbcb92be24c644d470818dfe15f8c7e661a7bcd034ea13ef401f2b84ad5c29a41c9b4c7d161cc33ae3ef71659bc2bca1a8c4ad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Runtime Broker.exe.log
Filesize
425B

MD5
4eaca4566b22b01cd3bc115b9b0b2196

SHA1
e743e0792c19f71740416e7b3c061d9f1336bf94

SHA256
34ba0ab8d1850e7825763f413142a333ccbc05fa2b5499a28a7d27b8a1c5b4bb

SHA512
bc2b1bf45203e3bb3009a7d37617b8f0f7ffa613680b32de2b963e39d2cf1650614d7035a0cf78f35a4f5cb17a2a439e2e07deaefd2a4275a62efd0a5c0184a1

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESC365.tmp
Filesize
1KB

MD5
30f4e9d46684863ee55f45af63e128dd

SHA1
4cc7d6bb3409349e88c4503392f8ac04e5b5d9ca

SHA256
ca1f21445440280ef4c3ba5c36df81fa978a8d7ec42165cf081314a70e60b24a

SHA512
b41fd184d188b013a7257eedc15ea29d6bbf1ca1823c0d6f21b13f9ca0827d46997c4c0edf10a9ef8140428e65dba716cb339e042dd1959318eb09be28d4ffdf

Download Submit
C:\Users\Admin\AppData\Local\Temp\Runtime Broker.exe
Filesize
9KB

MD5
913967b216326e36a08010fb70f9dba3

SHA1
7b6f8c2eb5b443e03c212b85c2f0edb9c76ad2bf

SHA256
8d880758549220154d2ff4ee578f2b49527c5fb76a07d55237b61e30bcc09e3a

SHA512
c6fcb98d9fd509e9834fc3fba143bd36d41869cc104fbce5354951f0a6756156e34a30796baaa130dd45de3ed96e039ec14716716f6da4569915c7ef2d2b6c33

Download Submit
C:\Users\Admin\AppData\Local\Temp\Runtime Broker.exe
Filesize
9KB

MD5
913967b216326e36a08010fb70f9dba3

SHA1
7b6f8c2eb5b443e03c212b85c2f0edb9c76ad2bf

SHA256
8d880758549220154d2ff4ee578f2b49527c5fb76a07d55237b61e30bcc09e3a

SHA512
c6fcb98d9fd509e9834fc3fba143bd36d41869cc104fbce5354951f0a6756156e34a30796baaa130dd45de3ed96e039ec14716716f6da4569915c7ef2d2b6c33

Download Submit
C:\Users\Admin\AppData\Local\Temp\Runtime Broker.exe
Filesize
9KB

MD5
913967b216326e36a08010fb70f9dba3

SHA1
7b6f8c2eb5b443e03c212b85c2f0edb9c76ad2bf

SHA256
8d880758549220154d2ff4ee578f2b49527c5fb76a07d55237b61e30bcc09e3a

SHA512
c6fcb98d9fd509e9834fc3fba143bd36d41869cc104fbce5354951f0a6756156e34a30796baaa130dd45de3ed96e039ec14716716f6da4569915c7ef2d2b6c33

Download Submit
C:\Users\Admin\AppData\Local\Temp\Runtime Broker.exe.config
Filesize
357B

MD5
a2b76cea3a59fa9af5ea21ff68139c98

SHA1
35d76475e6a54c168f536e30206578babff58274

SHA256
f99ef5bf79a7c43701877f0bb0b890591885bb0a3d605762647cc8ffbf10c839

SHA512
b52608b45153c489419228864ecbcb92be24c644d470818dfe15f8c7e661a7bcd034ea13ef401f2b84ad5c29a41c9b4c7d161cc33ae3ef71659bc2bca1a8c4ad

Download Submit
C:\Users\Admin\AppData\Local\Temp\build.exe
Filesize
1.5MB

MD5
e9124859247c5c5cae6190c03fa36cb7

SHA1
c2d39eee48cb315cae5e3d038b1db2a6ec909bd6

SHA256
0106f2d291f51aabb8f97cb63bf1be337616018c7788faefc64b609dff3a5a33

SHA512
53fee718152c51c276ea468943eeea9b61c1f14c420b054af914b3500375998cfc556b29eec518a14556e0cc77bfd4221ef7448bbbcedacce4f8cce5949a8683

Download Submit
C:\Users\Admin\AppData\Local\Temp\build.exe
Filesize
1.5MB

MD5
e9124859247c5c5cae6190c03fa36cb7

SHA1
c2d39eee48cb315cae5e3d038b1db2a6ec909bd6

SHA256
0106f2d291f51aabb8f97cb63bf1be337616018c7788faefc64b609dff3a5a33

SHA512
53fee718152c51c276ea468943eeea9b61c1f14c420b054af914b3500375998cfc556b29eec518a14556e0cc77bfd4221ef7448bbbcedacce4f8cce5949a8683

Download Submit
C:\Users\Admin\AppData\Local\Temp\err_0dae1eed35bd43dc93a1d73544aa5ccf.dat
Filesize
1KB

MD5
f62f19b74508ea7b9c88c5bf77d9ed59

SHA1
a3095d07f2c0aea0b37ec89bedccd2110c924f07

SHA256
5f5271b88cb08c109c1160acb43485aa5b504b759c8b924fd8ef864bdac7a832

SHA512
0dc0765825df4e73430ae5762e3e49bfbe80dbe24705499fa56581422105fa4979e6e17ad12e49e5b15a5bab1a53ada258f2d0e12902c8807d545c933cbcbdf5

Download Submit
C:\Users\Admin\AppData\Local\Temp\javaw.exe
Filesize
938KB

MD5
63e784f82ebd4a7daa66c3478970f36b

SHA1
f319bcf48e9f647fc79aa084de027228444966e6

SHA256
282679b3e43b8c5be4671268eb8808c72f987e1977ef685a21ff7b230dab9b51

SHA512
d3ab5b2699c2fb955bda21de2e7715478ea5498c650c3219585ab623bec957da7e5398cb0d9a52a8fe021053e157a615e1d5e575ce514a140e10b565bb72a9df

Download Submit
C:\Users\Admin\AppData\Local\Temp\javaw.exe
Filesize
938KB

MD5
63e784f82ebd4a7daa66c3478970f36b

SHA1
f319bcf48e9f647fc79aa084de027228444966e6

SHA256
282679b3e43b8c5be4671268eb8808c72f987e1977ef685a21ff7b230dab9b51

SHA512
d3ab5b2699c2fb955bda21de2e7715478ea5498c650c3219585ab623bec957da7e5398cb0d9a52a8fe021053e157a615e1d5e575ce514a140e10b565bb72a9df

Download Submit
C:\Users\Admin\AppData\Local\Temp\jk1bengw.dll
Filesize
76KB

MD5
242ca9a3abd478d45c0164a5733c7db3

SHA1
bdb110fff50ef50869a4aa097fc727f7d893ef2f

SHA256
dde792457bb429082e4b60665f06bbfe29cdd1bf8d63053a905d8926143eb3eb

SHA512
c50787bfec380627f764ad025b7c6d4e6eadbd8daae1c9e013f7470bd05c48c536be2928a70caa125c79bdb500ed79367f567af53a45a4fd9f8fbf923255d285

Download Submit
C:\Windows\SysWOW64\WindowsInput.exe
Filesize
21KB

MD5
e6fcf516d8ed8d0d4427f86e08d0d435

SHA1
c7691731583ab7890086635cb7f3e4c22ca5e409

SHA256
8dbe814359391ed6b0b5b182039008cf1d00964da9fbc4747f46242a95c24337

SHA512
c496cf8e2e222fe1e19051b291e6860f31aae39f54369c1c5e8c9758c4b56e8af904e3e536e743a0a6fdbbf8478afba4baee92e13fc1b3073376ac6bf4a7948e

Download Submit
C:\Windows\SysWOW64\WindowsInput.exe
Filesize
21KB

MD5
e6fcf516d8ed8d0d4427f86e08d0d435

SHA1
c7691731583ab7890086635cb7f3e4c22ca5e409

SHA256
8dbe814359391ed6b0b5b182039008cf1d00964da9fbc4747f46242a95c24337

SHA512
c496cf8e2e222fe1e19051b291e6860f31aae39f54369c1c5e8c9758c4b56e8af904e3e536e743a0a6fdbbf8478afba4baee92e13fc1b3073376ac6bf4a7948e

Download Submit
C:\Windows\SysWOW64\WindowsInput.exe
Filesize
21KB

MD5
e6fcf516d8ed8d0d4427f86e08d0d435

SHA1
c7691731583ab7890086635cb7f3e4c22ca5e409

SHA256
8dbe814359391ed6b0b5b182039008cf1d00964da9fbc4747f46242a95c24337

SHA512
c496cf8e2e222fe1e19051b291e6860f31aae39f54369c1c5e8c9758c4b56e8af904e3e536e743a0a6fdbbf8478afba4baee92e13fc1b3073376ac6bf4a7948e

Download Submit
C:\Windows\SysWOW64\WindowsInput.exe.config
Filesize
357B

MD5
a2b76cea3a59fa9af5ea21ff68139c98

SHA1
35d76475e6a54c168f536e30206578babff58274

SHA256
f99ef5bf79a7c43701877f0bb0b890591885bb0a3d605762647cc8ffbf10c839

SHA512
b52608b45153c489419228864ecbcb92be24c644d470818dfe15f8c7e661a7bcd034ea13ef401f2b84ad5c29a41c9b4c7d161cc33ae3ef71659bc2bca1a8c4ad

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\CSCC364.tmp
Filesize
676B

MD5
93178636a24d9a855a8cbdddc874fbed

SHA1
04c55aca5ea32a25e1adda89b1e230d07c1942fc

SHA256
c88e096fc0a27d1c817227739fba67f43df2fbc1283bceb335b0feaeecbdcb2b

SHA512
d0fa32dd5d2fd77ad16472dcf2241991d6ffb8351b15e306fe5a9e98980a8d84b7ae258d43624253a91b5fe80c106929e5b72d0aecaad095dee4feb64933eea1

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\jk1bengw.0.cs
Filesize
208KB

MD5
492e06e3f1bfa5fa2239724b5a337c8b

SHA1
a83dff9bbf8b0cbe4d1b6360e70f69d1df385dfa

SHA256
4495a3d45e6a24836a9da8142e431b9cc3600cd6b3aedf328eb4ffea27e84340

SHA512
faa25d3e5d8cb93fac955447b670bc1b905e3d2132039e92c18394cbafa718b5a162b612ccc7c4c4124d3950bfa0706f925e9ab1bda1e0c318f2d85527955d53

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\jk1bengw.cmdline
Filesize
349B

MD5
0f02ca4f74bfb6c6fe4a96906c535de8

SHA1
70295356b3d5f39613a2e23b7dc19a3b80db7360

SHA256
270c9e9f9998f37b2b52a18df1d299e73853dd90c66840b4dfbf86476eb36cbd

SHA512
db1e76096693e45d4cd4b163923de2d456d621af201ae61a9430517289395c66a5975830552dd914c20d7c392f6da3b99ccf470c016b9e9b38a7bb1e79b0a689

Download Submit
memory/508-183-0x00007FF903400000-0x00007FF903EC1000-memory.dmp

Filesize
10.8MB

Download
memory/508-173-0x00007FF903400000-0x00007FF903EC1000-memory.dmp

Filesize
10.8MB

Download
memory/544-166-0x0000000000B90000-0x0000000000C80000-memory.dmp

Filesize
960KB

Download
memory/544-174-0x00007FF903400000-0x00007FF903EC1000-memory.dmp

Filesize
10.8MB

Download
memory/544-162-0x0000000000000000-mapping.dmp

Download
memory/544-167-0x00007FF903400000-0x00007FF903EC1000-memory.dmp

Filesize
10.8MB

Download
memory/544-171-0x000000001CFB0000-0x000000001D172000-memory.dmp

Filesize
1.8MB

Download
memory/1316-132-0x0000000000400000-0x0000000000A04000-memory.dmp

Filesize
6.0MB

Download
memory/1316-139-0x0000000000400000-0x0000000000A04000-memory.dmp

Filesize
6.0MB

Download
memory/1368-190-0x0000000000000000-mapping.dmp

Download
memory/1532-188-0x0000000000000000-mapping.dmp

Download
memory/1780-189-0x0000000000000000-mapping.dmp

Download
memory/1956-191-0x0000000000000000-mapping.dmp

Download
memory/2240-161-0x00007FF903400000-0x00007FF903EC1000-memory.dmp

Filesize
10.8MB

Download
memory/2240-172-0x00007FF903400000-0x00007FF903EC1000-memory.dmp

Filesize
10.8MB

Download
memory/2240-160-0x000000001A7B0000-0x000000001A8BA000-memory.dmp

Filesize
1.0MB

Download
memory/2304-179-0x0000000000310000-0x0000000000318000-memory.dmp

Filesize
32KB

Download
memory/2304-175-0x0000000000000000-mapping.dmp

Download
memory/2320-192-0x0000000000000000-mapping.dmp

Download
memory/2864-187-0x0000000000000000-mapping.dmp

Download
memory/4128-180-0x0000000000000000-mapping.dmp

Download
memory/4252-143-0x0000000000000000-mapping.dmp

Download
memory/4444-151-0x0000000000000000-mapping.dmp

Download
memory/4444-156-0x0000000000FD0000-0x0000000000FE2000-memory.dmp

Filesize
72KB

Download
memory/4444-157-0x0000000002B20000-0x0000000002B5C000-memory.dmp

Filesize
240KB

Download
memory/4444-158-0x00007FF903400000-0x00007FF903EC1000-memory.dmp

Filesize
10.8MB

Download
memory/4444-155-0x0000000000980000-0x000000000098C000-memory.dmp

Filesize
48KB

Download
memory/4552-146-0x0000000000000000-mapping.dmp

Download
memory/4660-186-0x0000000007FC0000-0x0000000008564000-memory.dmp

Filesize
5.6MB

Download
memory/4660-185-0x0000000007970000-0x0000000007A02000-memory.dmp

Filesize
584KB

Download
memory/4660-140-0x0000000000E80000-0x0000000001004000-memory.dmp

Filesize
1.5MB

Download
memory/4660-136-0x0000000000000000-mapping.dmp

Download
memory/4660-142-0x0000000005850000-0x00000000058B6000-memory.dmp

Filesize
408KB

Download
memory/4660-193-0x0000000006E00000-0x0000000006E22000-memory.dmp

Filesize
136KB

Download
memory/4660-194-0x0000000007060000-0x000000000706A000-memory.dmp

Filesize
40KB

Download
memory/4720-168-0x000000000144A000-0x000000000144F000-memory.dmp

Filesize
20KB

Download
memory/4720-150-0x000000000144A000-0x000000000144F000-memory.dmp

Filesize
20KB

Download
memory/4720-133-0x0000000000000000-mapping.dmp

Download
memory/4720-141-0x00007FF9042D0000-0x00007FF904D06000-memory.dmp

Filesize
10.2MB

Download
memory/4900-184-0x0000000000000000-mapping.dmp

Download