0bcfcc85e6a2de500bf258d91e6767ba41beaaa34832128b626cf601a514af30

General

Target

0bcfcc85e6a2de500bf258d91e6767ba41beaaa34832128b626cf601a514af30.exe
Size

610KB
MD5

a7c9dea231011cd6e2c93fa3a4bea93e
SHA1

16553927551ad794671994e8b98029424e8403ac
SHA256

0bcfcc85e6a2de500bf258d91e6767ba41beaaa34832128b626cf601a514af30
SHA512

97aa210eb380aa86463daacf55761e0b5e521a0e0b026e01479f55cf951cc46c9d9e4b6ef7eb5aefdf9b8cc7bc15415347e30892972f21de0d6acbc6f6aca496
SSDEEP

12288:AKQitq/nbnk7GNU03N3xeYCNihX8nr31sg5p+p4r5oObQOldoNt48:AK8/jrUOkYfXArT0kAt

Score

7^/10

persistence

Malware Config

Signatures

Loads dropped DLL 1 IoCs

Processes:

0bcfcc85e6a2de500bf258d91e6767ba41beaaa34832128b626cf601a514af30.exe

pid process

2032 0bcfcc85e6a2de500bf258d91e6767ba41beaaa34832128b626cf601a514af30.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

reg.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\GoogleUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\WinApp\\GoogleUpdate.exe.lnk"	reg.exe

Suspicious use of SetThreadContext 7 IoCs

Processes:

0bcfcc85e6a2de500bf258d91e6767ba41beaaa34832128b626cf601a514af30.exe

description	pid	process	target process
PID 2032 set thread context of 1068	2032	0bcfcc85e6a2de500bf258d91e6767ba41beaaa34832128b626cf601a514af30.exe	AppLaunch.exe
PID 2032 set thread context of 1140	2032	0bcfcc85e6a2de500bf258d91e6767ba41beaaa34832128b626cf601a514af30.exe	AppLaunch.exe
PID 2032 set thread context of 1040	2032	0bcfcc85e6a2de500bf258d91e6767ba41beaaa34832128b626cf601a514af30.exe	AppLaunch.exe
PID 2032 set thread context of 676	2032	0bcfcc85e6a2de500bf258d91e6767ba41beaaa34832128b626cf601a514af30.exe	AppLaunch.exe
PID 2032 set thread context of 2016	2032	0bcfcc85e6a2de500bf258d91e6767ba41beaaa34832128b626cf601a514af30.exe	AppLaunch.exe
PID 2032 set thread context of 1184	2032	0bcfcc85e6a2de500bf258d91e6767ba41beaaa34832128b626cf601a514af30.exe	AppLaunch.exe
PID 2032 set thread context of 2288	2032	0bcfcc85e6a2de500bf258d91e6767ba41beaaa34832128b626cf601a514af30.exe	AppLaunch.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000022479657e088004da1082bf0a80850d10000000002000000000010660000000100002000000071819018d577514a4b8065af6a6c137d97a215d651d9133ffc94548509ee38ae000000000e8000000002000020000000315aef86d866460df6575f8da9f74fa6c90d384c07b5dd942f66c068daaffa6020000000be0f04e69462bb8647639eb0a77b23f8e22940b28779b6f84ff28afe598d4574400000006869becfc906f3fa38ddffd8d844d418085001534d75218d510cda906c97cbd7389439a8c3abfb6602d85d25af62d32b327b60ba4c6049b4700d568786118f68	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F2C547B1-6B59-11ED-85E0-FE41811C61F5} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000022479657e088004da1082bf0a80850d100000000020000000000106600000001000020000000011bd9dcaf802ca26ea5b214c9e9cbb2ba77fd6659a7895dada33aad635ad723000000000e80000000020000200000008c94a82044ed82864434d517889d921505273d6dde58c9d66346e65f04c3a7699000000019fc0357c7603bd327dbdf034faa9222f82fe8e3f01aef8d6fe465985a1aba58848d5280372c27c61c386e7d1a04f38efddfc6c1c362ff7fa47fa5d79d030a87f353cc65c31f2474b4c0428a7ef3233e7259276de8a0c1bf56d4f2d59af96fd41a4288603b629f98e2ee059cf5e7ad2fbd03d864736fa3da9678a9a1f0ac8a16ab60a92722d2c6a68fc337c76713cd1340000000e83a86aa8218b9e323488e2eab1f7546944e244c9a2739971dbda3277f336aa6b6116c1eec476ca6712569e7917816f9a0db78f25b422e903a2782807d5f42e9	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0a75dc066ffd801	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe

Suspicious behavior: EnumeratesProcesses 19 IoCs

Processes:

0bcfcc85e6a2de500bf258d91e6767ba41beaaa34832128b626cf601a514af30.exeiexplore.exe

pid	process
2032	0bcfcc85e6a2de500bf258d91e6767ba41beaaa34832128b626cf601a514af30.exe
2032	0bcfcc85e6a2de500bf258d91e6767ba41beaaa34832128b626cf601a514af30.exe
2032	0bcfcc85e6a2de500bf258d91e6767ba41beaaa34832128b626cf601a514af30.exe
2032	0bcfcc85e6a2de500bf258d91e6767ba41beaaa34832128b626cf601a514af30.exe
2032	0bcfcc85e6a2de500bf258d91e6767ba41beaaa34832128b626cf601a514af30.exe
2032	0bcfcc85e6a2de500bf258d91e6767ba41beaaa34832128b626cf601a514af30.exe
2032	0bcfcc85e6a2de500bf258d91e6767ba41beaaa34832128b626cf601a514af30.exe
2032	0bcfcc85e6a2de500bf258d91e6767ba41beaaa34832128b626cf601a514af30.exe
2032	0bcfcc85e6a2de500bf258d91e6767ba41beaaa34832128b626cf601a514af30.exe
2032	0bcfcc85e6a2de500bf258d91e6767ba41beaaa34832128b626cf601a514af30.exe
2032	0bcfcc85e6a2de500bf258d91e6767ba41beaaa34832128b626cf601a514af30.exe
2032	0bcfcc85e6a2de500bf258d91e6767ba41beaaa34832128b626cf601a514af30.exe
2032	0bcfcc85e6a2de500bf258d91e6767ba41beaaa34832128b626cf601a514af30.exe
2032	0bcfcc85e6a2de500bf258d91e6767ba41beaaa34832128b626cf601a514af30.exe
1772	iexplore.exe
1772	iexplore.exe
1772	iexplore.exe
2032	0bcfcc85e6a2de500bf258d91e6767ba41beaaa34832128b626cf601a514af30.exe
2032	0bcfcc85e6a2de500bf258d91e6767ba41beaaa34832128b626cf601a514af30.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

0bcfcc85e6a2de500bf258d91e6767ba41beaaa34832128b626cf601a514af30.exe

description pid process

Token: SeDebugPrivilege 2032 0bcfcc85e6a2de500bf258d91e6767ba41beaaa34832128b626cf601a514af30.exe
Suspicious use of FindShellTrayWindow 3 IoCs

Processes:

DllHost.exeiexplore.exe

pid process

392 DllHost.exe
1772 iexplore.exe
1772 iexplore.exe

description	pid	process
Token: SeDebugPrivilege	2032	0bcfcc85e6a2de500bf258d91e6767ba41beaaa34832128b626cf601a514af30.exe

pid	process
392	DllHost.exe
1772	iexplore.exe
1772	iexplore.exe

Suspicious use of SetWindowsHookEx 20 IoCs

Processes:

iexplore.exeIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXE

pid	process
1772	iexplore.exe
1772	iexplore.exe
764	IEXPLORE.EXE
764	IEXPLORE.EXE
840	IEXPLORE.EXE
840	IEXPLORE.EXE
840	IEXPLORE.EXE
840	IEXPLORE.EXE
1400	IEXPLORE.EXE
1400	IEXPLORE.EXE
1772	iexplore.exe
1772	iexplore.exe
1780	IEXPLORE.EXE
1780	IEXPLORE.EXE
640	IEXPLORE.EXE
640	IEXPLORE.EXE
640	IEXPLORE.EXE
640	IEXPLORE.EXE
764	IEXPLORE.EXE
764	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

0bcfcc85e6a2de500bf258d91e6767ba41beaaa34832128b626cf601a514af30.execmd.exeAppLaunch.exeiexplore.exe

description	pid	process	target process
PID 2032 wrote to memory of 1924	2032	0bcfcc85e6a2de500bf258d91e6767ba41beaaa34832128b626cf601a514af30.exe	cmd.exe
PID 2032 wrote to memory of 1924	2032	0bcfcc85e6a2de500bf258d91e6767ba41beaaa34832128b626cf601a514af30.exe	cmd.exe
PID 2032 wrote to memory of 1924	2032	0bcfcc85e6a2de500bf258d91e6767ba41beaaa34832128b626cf601a514af30.exe	cmd.exe
PID 2032 wrote to memory of 1924	2032	0bcfcc85e6a2de500bf258d91e6767ba41beaaa34832128b626cf601a514af30.exe	cmd.exe
PID 1924 wrote to memory of 636	1924	cmd.exe	reg.exe
PID 1924 wrote to memory of 636	1924	cmd.exe	reg.exe
PID 1924 wrote to memory of 636	1924	cmd.exe	reg.exe
PID 1924 wrote to memory of 636	1924	cmd.exe	reg.exe
PID 2032 wrote to memory of 1068	2032	0bcfcc85e6a2de500bf258d91e6767ba41beaaa34832128b626cf601a514af30.exe	AppLaunch.exe
PID 2032 wrote to memory of 1068	2032	0bcfcc85e6a2de500bf258d91e6767ba41beaaa34832128b626cf601a514af30.exe	AppLaunch.exe
PID 2032 wrote to memory of 1068	2032	0bcfcc85e6a2de500bf258d91e6767ba41beaaa34832128b626cf601a514af30.exe	AppLaunch.exe
PID 2032 wrote to memory of 1068	2032	0bcfcc85e6a2de500bf258d91e6767ba41beaaa34832128b626cf601a514af30.exe	AppLaunch.exe
PID 2032 wrote to memory of 1068	2032	0bcfcc85e6a2de500bf258d91e6767ba41beaaa34832128b626cf601a514af30.exe	AppLaunch.exe
PID 2032 wrote to memory of 1068	2032	0bcfcc85e6a2de500bf258d91e6767ba41beaaa34832128b626cf601a514af30.exe	AppLaunch.exe
PID 2032 wrote to memory of 1068	2032	0bcfcc85e6a2de500bf258d91e6767ba41beaaa34832128b626cf601a514af30.exe	AppLaunch.exe
PID 2032 wrote to memory of 1068	2032	0bcfcc85e6a2de500bf258d91e6767ba41beaaa34832128b626cf601a514af30.exe	AppLaunch.exe
PID 2032 wrote to memory of 1068	2032	0bcfcc85e6a2de500bf258d91e6767ba41beaaa34832128b626cf601a514af30.exe	AppLaunch.exe
PID 2032 wrote to memory of 1068	2032	0bcfcc85e6a2de500bf258d91e6767ba41beaaa34832128b626cf601a514af30.exe	AppLaunch.exe
PID 2032 wrote to memory of 1068	2032	0bcfcc85e6a2de500bf258d91e6767ba41beaaa34832128b626cf601a514af30.exe	AppLaunch.exe
PID 2032 wrote to memory of 1068	2032	0bcfcc85e6a2de500bf258d91e6767ba41beaaa34832128b626cf601a514af30.exe	AppLaunch.exe
PID 1068 wrote to memory of 1772	1068	AppLaunch.exe	iexplore.exe
PID 1068 wrote to memory of 1772	1068	AppLaunch.exe	iexplore.exe
PID 1068 wrote to memory of 1772	1068	AppLaunch.exe	iexplore.exe
PID 1068 wrote to memory of 1772	1068	AppLaunch.exe	iexplore.exe
PID 2032 wrote to memory of 1140	2032	0bcfcc85e6a2de500bf258d91e6767ba41beaaa34832128b626cf601a514af30.exe	AppLaunch.exe
PID 2032 wrote to memory of 1140	2032	0bcfcc85e6a2de500bf258d91e6767ba41beaaa34832128b626cf601a514af30.exe	AppLaunch.exe
PID 2032 wrote to memory of 1140	2032	0bcfcc85e6a2de500bf258d91e6767ba41beaaa34832128b626cf601a514af30.exe	AppLaunch.exe
PID 2032 wrote to memory of 1140	2032	0bcfcc85e6a2de500bf258d91e6767ba41beaaa34832128b626cf601a514af30.exe	AppLaunch.exe
PID 2032 wrote to memory of 1140	2032	0bcfcc85e6a2de500bf258d91e6767ba41beaaa34832128b626cf601a514af30.exe	AppLaunch.exe
PID 2032 wrote to memory of 1140	2032	0bcfcc85e6a2de500bf258d91e6767ba41beaaa34832128b626cf601a514af30.exe	AppLaunch.exe
PID 2032 wrote to memory of 1140	2032	0bcfcc85e6a2de500bf258d91e6767ba41beaaa34832128b626cf601a514af30.exe	AppLaunch.exe
PID 2032 wrote to memory of 1140	2032	0bcfcc85e6a2de500bf258d91e6767ba41beaaa34832128b626cf601a514af30.exe	AppLaunch.exe
PID 2032 wrote to memory of 1140	2032	0bcfcc85e6a2de500bf258d91e6767ba41beaaa34832128b626cf601a514af30.exe	AppLaunch.exe
PID 2032 wrote to memory of 1140	2032	0bcfcc85e6a2de500bf258d91e6767ba41beaaa34832128b626cf601a514af30.exe	AppLaunch.exe
PID 2032 wrote to memory of 1140	2032	0bcfcc85e6a2de500bf258d91e6767ba41beaaa34832128b626cf601a514af30.exe	AppLaunch.exe
PID 2032 wrote to memory of 1140	2032	0bcfcc85e6a2de500bf258d91e6767ba41beaaa34832128b626cf601a514af30.exe	AppLaunch.exe
PID 1772 wrote to memory of 764	1772	iexplore.exe	IEXPLORE.EXE
PID 1772 wrote to memory of 764	1772	iexplore.exe	IEXPLORE.EXE
PID 1772 wrote to memory of 764	1772	iexplore.exe	IEXPLORE.EXE
PID 1772 wrote to memory of 764	1772	iexplore.exe	IEXPLORE.EXE
PID 1772 wrote to memory of 764	1772	iexplore.exe	IEXPLORE.EXE
PID 1772 wrote to memory of 764	1772	iexplore.exe	IEXPLORE.EXE
PID 1772 wrote to memory of 764	1772	iexplore.exe	IEXPLORE.EXE
PID 2032 wrote to memory of 1040	2032	0bcfcc85e6a2de500bf258d91e6767ba41beaaa34832128b626cf601a514af30.exe	AppLaunch.exe
PID 2032 wrote to memory of 1040	2032	0bcfcc85e6a2de500bf258d91e6767ba41beaaa34832128b626cf601a514af30.exe	AppLaunch.exe
PID 2032 wrote to memory of 1040	2032	0bcfcc85e6a2de500bf258d91e6767ba41beaaa34832128b626cf601a514af30.exe	AppLaunch.exe
PID 2032 wrote to memory of 1040	2032	0bcfcc85e6a2de500bf258d91e6767ba41beaaa34832128b626cf601a514af30.exe	AppLaunch.exe
PID 2032 wrote to memory of 1040	2032	0bcfcc85e6a2de500bf258d91e6767ba41beaaa34832128b626cf601a514af30.exe	AppLaunch.exe
PID 2032 wrote to memory of 1040	2032	0bcfcc85e6a2de500bf258d91e6767ba41beaaa34832128b626cf601a514af30.exe	AppLaunch.exe
PID 2032 wrote to memory of 1040	2032	0bcfcc85e6a2de500bf258d91e6767ba41beaaa34832128b626cf601a514af30.exe	AppLaunch.exe
PID 2032 wrote to memory of 1040	2032	0bcfcc85e6a2de500bf258d91e6767ba41beaaa34832128b626cf601a514af30.exe	AppLaunch.exe
PID 2032 wrote to memory of 1040	2032	0bcfcc85e6a2de500bf258d91e6767ba41beaaa34832128b626cf601a514af30.exe	AppLaunch.exe
PID 2032 wrote to memory of 1040	2032	0bcfcc85e6a2de500bf258d91e6767ba41beaaa34832128b626cf601a514af30.exe	AppLaunch.exe
PID 2032 wrote to memory of 1040	2032	0bcfcc85e6a2de500bf258d91e6767ba41beaaa34832128b626cf601a514af30.exe	AppLaunch.exe
PID 2032 wrote to memory of 1040	2032	0bcfcc85e6a2de500bf258d91e6767ba41beaaa34832128b626cf601a514af30.exe	AppLaunch.exe
PID 1772 wrote to memory of 840	1772	iexplore.exe	IEXPLORE.EXE
PID 1772 wrote to memory of 840	1772	iexplore.exe	IEXPLORE.EXE
PID 1772 wrote to memory of 840	1772	iexplore.exe	IEXPLORE.EXE
PID 1772 wrote to memory of 840	1772	iexplore.exe	IEXPLORE.EXE
PID 1772 wrote to memory of 840	1772	iexplore.exe	IEXPLORE.EXE
PID 1772 wrote to memory of 840	1772	iexplore.exe	IEXPLORE.EXE
PID 1772 wrote to memory of 840	1772	iexplore.exe	IEXPLORE.EXE
PID 1772 wrote to memory of 1400	1772	iexplore.exe	IEXPLORE.EXE
PID 1772 wrote to memory of 1400	1772	iexplore.exe	IEXPLORE.EXE

C:\Users\Admin\AppData\Local\Temp\0bcfcc85e6a2de500bf258d91e6767ba41beaaa34832128b626cf601a514af30.exe
"C:\Users\Admin\AppData\Local\Temp\0bcfcc85e6a2de500bf258d91e6767ba41beaaa34832128b626cf601a514af30.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2032

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "GoogleUpdate" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\WinApp\GoogleUpdate.exe.lnk"
2⤵
- Suspicious use of WriteProcessMemory
PID:1924

C:\Windows\SysWOW64\reg.exe
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "GoogleUpdate" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\WinApp\GoogleUpdate.exe.lnk"
3⤵
- Adds Run key to start application
PID:636

C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:1068

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=AppLaunch.exe&platform=0009&osver=5&isServer=0&shimver=4.0.30319.0
3⤵
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1772

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1772 CREDAT:275457 /prefetch:2
4⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:764

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1772 CREDAT:275461 /prefetch:2
4⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:840

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1772 CREDAT:799754 /prefetch:2
4⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1400

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1772 CREDAT:603161 /prefetch:2
4⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1780

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1772 CREDAT:275482 /prefetch:2
4⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:640

C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe"
2⤵
PID:1140

C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe"
2⤵
PID:1040

C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe"
2⤵
PID:676

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=AppLaunch.exe&platform=0009&osver=5&isServer=0&shimver=4.0.30319.0
3⤵
PID:964

C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe"
2⤵
PID:2016

C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe"
2⤵
PID:1184

C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe"
2⤵
PID:2288

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}
1⤵
- Suspicious use of FindShellTrayWindow
PID:392

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\foto.jpg
Filesize
61KB

MD5
5b69b874373869f21ba11d0adee96a4d

SHA1
5e9e66fe374ce3c6612f7c29c74e0d8c286a5f8e

SHA256
5f2559a6c6eabf7ac862e4e44e7364109fb0784ca3b4512827b9a37c5b44739c

SHA512
a366fc122d2102dd31438af54ad8ea987b2cde867781f1f94ac2a4bbda9d3083f58db53aa880e63bd428b9b527e9652cfa0ecf3f219fd215b22d42173d6ce698

Download Submit
\Users\Admin\AppData\Roaming\WinApp\GoogleUpdate.exe
Filesize
610KB

MD5
a7c9dea231011cd6e2c93fa3a4bea93e

SHA1
16553927551ad794671994e8b98029424e8403ac

SHA256
0bcfcc85e6a2de500bf258d91e6767ba41beaaa34832128b626cf601a514af30

SHA512
97aa210eb380aa86463daacf55761e0b5e521a0e0b026e01479f55cf951cc46c9d9e4b6ef7eb5aefdf9b8cc7bc15415347e30892972f21de0d6acbc6f6aca496

Download Submit
memory/636-61-0x0000000000000000-mapping.dmp

Download
memory/676-106-0x000000000044503E-mapping.dmp

Download
memory/1040-94-0x000000000044503E-mapping.dmp

Download
memory/1068-65-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/1068-62-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/1068-63-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/1068-66-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/1068-68-0x000000000044503E-mapping.dmp

Download
memory/1068-67-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/1068-70-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/1068-72-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/1140-82-0x000000000044503E-mapping.dmp

Download
memory/1184-130-0x000000000044503E-mapping.dmp

Download
memory/1924-60-0x0000000000000000-mapping.dmp

Download
memory/2016-118-0x000000000044503E-mapping.dmp

Download
memory/2032-54-0x0000000075DF1000-0x0000000075DF3000-memory.dmp

Filesize
8KB

Download
memory/2032-56-0x0000000000B76000-0x0000000000B87000-memory.dmp

Filesize
68KB

Download
memory/2032-55-0x00000000740B0000-0x000000007465B000-memory.dmp

Filesize
5.7MB

Download
memory/2032-57-0x00000000740B0000-0x000000007465B000-memory.dmp

Filesize
5.7MB

Download
memory/2032-58-0x0000000000B76000-0x0000000000B87000-memory.dmp

Filesize
68KB

Download
memory/2288-142-0x000000000044503E-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads