333194cfa62775ba7721a1a327f270c9fea9302ce575f3affc49098a0da0f961

Analysis

max time kernel
174s
max time network
179s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 19:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

333194cfa62775ba7721a1a327f270c9fea9302ce575f3affc49098a0da0f961.exe
Size

65KB
MD5

52d8201a238c77c64d11cba3777aa960
SHA1

944f334de509f682a5afa483275ddfea1ddd9319
SHA256

333194cfa62775ba7721a1a327f270c9fea9302ce575f3affc49098a0da0f961
SHA512

13864b55dac155221f5bd33914cee2748b1095a42b8031946db0a8aa36994cd90e17086da7f023ad840a759dd81caa8f3fb75979ade149dd7a0e1c5084fe6a38
SSDEEP

768:4a4r+PpHfXGLOFCk6SLARI+WEkFfsEjUPIOuJI5R7xuMAnXMcMaJIWmS2zIzV9xD:sr+Fum5LMI+WTJjcsnXMcpm/zOxJXKJw

Score

8^/10

Malware Config

Signatures

Drops file in Drivers directory 6 IoCs

Processes:

winlogon.exewinlogon.exewinlogon.exe333194cfa62775ba7721a1a327f270c9fea9302ce575f3affc49098a0da0f961.exe

description	ioc	process
File created	C:\Windows\SysWOW64\drivers\Msvbvm60.dll	winlogon.exe
File opened for modification	C:\Windows\SysWOW64\drivers\Msvbvm60.dll	winlogon.exe
File opened for modification	C:\Windows\SysWOW64\drivers\winlogon.exe	winlogon.exe
File opened for modification	C:\Windows\SysWOW64\drivers\winlogon.exe	winlogon.exe
File opened for modification	C:\Windows\SysWOW64\drivers\winlogon.exe	333194cfa62775ba7721a1a327f270c9fea9302ce575f3affc49098a0da0f961.exe
File opened for modification	C:\Windows\SysWOW64\drivers\winlogon.exe	winlogon.exe

Executes dropped EXE 4 IoCs

Processes:

winlogon.exeAE 0124 BE.exewinlogon.exewinlogon.exe

pid process

632 winlogon.exe
4248 AE 0124 BE.exe
3756 winlogon.exe
3916 winlogon.exe

pid	process
632	winlogon.exe
4248	AE 0124 BE.exe
3756	winlogon.exe
3916	winlogon.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

333194cfa62775ba7721a1a327f270c9fea9302ce575f3affc49098a0da0f961.exewinlogon.exeAE 0124 BE.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	333194cfa62775ba7721a1a327f270c9fea9302ce575f3affc49098a0da0f961.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	winlogon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	AE 0124 BE.exe

Loads dropped DLL 3 IoCs

Processes:

AE 0124 BE.exewinlogon.exewinlogon.exe

pid process

4248 AE 0124 BE.exe
3756 winlogon.exe
3916 winlogon.exe

pid	process
4248	AE 0124 BE.exe
3756	winlogon.exe
3916	winlogon.exe

Drops desktop.ini file(s) 2 IoCs

Processes:

AE 0124 BE.exe

description	ioc	process
File opened for modification	C:\Windows\Fonts\desktop.ini	AE 0124 BE.exe
File opened for modification	C:\Windows\Downloaded Program Files\desktop.ini	AE 0124 BE.exe

Drops autorun.inf file 1 TTPs 25 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

Processes:

winlogon.exeAE 0124 BE.exe

description	ioc	process
File opened for modification	\??\R:\Autorun.inf	winlogon.exe
File opened for modification	\??\T:\Autorun.inf	winlogon.exe
File opened for modification	\??\U:\Autorun.inf	winlogon.exe
File opened for modification	C:\Windows\BitLockerDiscoveryVolumeContents\autorun.inf	AE 0124 BE.exe
File opened for modification	\??\I:\Autorun.inf	winlogon.exe
File opened for modification	\??\K:\Autorun.inf	winlogon.exe
File opened for modification	\??\M:\Autorun.inf	winlogon.exe
File opened for modification	\??\L:\Autorun.inf	winlogon.exe
File opened for modification	\??\O:\Autorun.inf	winlogon.exe
File opened for modification	\??\Q:\Autorun.inf	winlogon.exe
File opened for modification	\??\W:\Autorun.inf	winlogon.exe
File opened for modification	\??\Z:\Autorun.inf	winlogon.exe
File opened for modification	\??\E:\Autorun.inf	winlogon.exe
File opened for modification	\??\F:\Autorun.inf	winlogon.exe
File opened for modification	\??\G:\Autorun.inf	winlogon.exe
File opened for modification	\??\V:\Autorun.inf	winlogon.exe
File opened for modification	\??\X:\Autorun.inf	winlogon.exe
File opened for modification	D:\Autorun.inf	winlogon.exe
File opened for modification	\??\H:\Autorun.inf	winlogon.exe
File opened for modification	\??\N:\Autorun.inf	winlogon.exe
File opened for modification	\??\S:\Autorun.inf	winlogon.exe
File opened for modification	\??\Y:\Autorun.inf	winlogon.exe
File opened for modification	C:\Autorun.inf	winlogon.exe
File opened for modification	\??\J:\Autorun.inf	winlogon.exe
File opened for modification	\??\P:\Autorun.inf	winlogon.exe

Drops file in System32 directory 1 IoCs

Processes:

AE 0124 BE.exe

description ioc process

File opened for modification C:\Windows\SysWOW64\regedit.exe AE 0124 BE.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\regedit.exe	AE 0124 BE.exe

Drops file in Windows directory 64 IoCs

Processes:

AE 0124 BE.exe

description	ioc	process
File opened for modification	C:\Windows\assembly\GAC_MSIL\System.Web.Services.Resources\2.0.0.0_it_b03f5f7f11d50a3a\System.Web.Services.Resources.dll	AE 0124 BE.exe
File opened for modification	C:\Windows\Cursors\cross_i.cur	AE 0124 BE.exe
File opened for modification	C:\Windows\diagnostics\system\Audio\VF_LowVolume.ps1	AE 0124 BE.exe
File opened for modification	C:\Windows\assembly\GAC_32\System.Web\2.0.0.0__b03f5f7f11d50a3a\System.Web.dll	AE 0124 BE.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\System.Deployment.Resources\2.0.0.0_de_b03f5f7f11d50a3a\System.Deployment.resources.dll	AE 0124 BE.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\indexc.dat	AE 0124 BE.exe
File opened for modification	C:\Windows\Boot\EFI\zh-TW\bootmgr.efi.mui	AE 0124 BE.exe
File opened for modification	C:\Windows\diagnostics\system\Printer\en-US	AE 0124 BE.exe
File opened for modification	C:\Windows\Fonts\85855.fon	AE 0124 BE.exe
File opened for modification	C:\Windows\PrintDialog	AE 0124 BE.exe
File opened for modification	C:\Windows\apppatch\ja-JP\AcRes.dll.mui	AE 0124 BE.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\Policy.12.0.Microsoft.Office.Interop.Excel\15.0.0.0__71e9bce111e9429c\Policy.12.0.Microsoft.Office.Interop.Excel.config	AE 0124 BE.exe
File opened for modification	C:\Windows\Migration	AE 0124 BE.exe
File opened for modification	C:\Windows\apppatch\frxmain.sdb	AE 0124 BE.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\System.Web.Resources\2.0.0.0_ja_b03f5f7f11d50a3a	AE 0124 BE.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\AspNetMMCExt.Resources\2.0.0.0_fr_b03f5f7f11d50a3a	AE 0124 BE.exe
File opened for modification	C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\445e1976593e6b3b2072e606af9be0ae\System.Xml.ni.dll	AE 0124 BE.exe
File opened for modification	C:\Windows\diagnostics\system\IEBrowseWeb\de-DE\RS_DisableAddon.psd1	AE 0124 BE.exe
File opened for modification	C:\Windows\diagnostics\scheduled\Maintenance	AE 0124 BE.exe
File opened for modification	C:\Windows\diagnostics\system\IESecurity\TS_Blockpopups.ps1	AE 0124 BE.exe
File opened for modification	C:\Windows\assembly\NativeImages_v4.0.30319_64\System	AE 0124 BE.exe
File opened for modification	C:\Windows\Fonts\timesbd.ttf	AE 0124 BE.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\System.Data.Resources	AE 0124 BE.exe
File opened for modification	C:\Windows\diagnostics\system\IEBrowseWeb\ja-JP	AE 0124 BE.exe
File opened for modification	C:\Windows\WinSxS	AE 0124 BE.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\System.Data.SqlXml.Resources\2.0.0.0_fr_b77a5c561934e089\system.data.sqlxml.resources.dll	AE 0124 BE.exe
File opened for modification	C:\Windows\Boot\EFI\kd_07_1415.dll	AE 0124 BE.exe
File opened for modification	C:\Windows\Fonts\seguibl.ttf	AE 0124 BE.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WindowsFormsIntegration	AE 0124 BE.exe
File opened for modification	C:\Windows\diagnostics\system\BITS\CL_Registry.ps1	AE 0124 BE.exe
File opened for modification	C:\Windows\diagnostics\system\Bluetooth\RC_DriverProblem.ps1	AE 0124 BE.exe
File opened for modification	C:\Windows\Fonts\app936.fon	AE 0124 BE.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\System.Xml	AE 0124 BE.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\System.Data.Entity.Design.Resources\3.5.0.0_ja_b77a5c561934e089\System.Data.Entity.Design.Resources.dll	AE 0124 BE.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\System.Data.Services.Design.Resources\3.5.0.0_de_b77a5c561934e089	AE 0124 BE.exe
File opened for modification	C:\Windows\diagnostics\system	AE 0124 BE.exe
File opened for modification	C:\Windows\assembly\GAC	AE 0124 BE.exe
File opened for modification	C:\Windows\assembly\GAC_32\Microsoft.Interop.Security.AzRoles\2.0.0.0__31bf3856ad364e35\Microsoft.Interop.Security.AzRoles.dll	AE 0124 BE.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Utilities.Resources	AE 0124 BE.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\Policy.14.0.office\15.0.0.0__71e9bce111e9429c	AE 0124 BE.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.PowerShel#\47e786300d57b2248515da5569427c4e\Microsoft.PowerShell.Commands.Management.ni.dll	AE 0124 BE.exe
File opened for modification	C:\Windows\diagnostics\system\Apps\fr-FR	AE 0124 BE.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\System.DirectoryServices.AccountManagement.Resources\3.5.0.0_ja_b77a5c561934e089	AE 0124 BE.exe
File opened for modification	C:\Windows\diagnostics\system\WindowsMediaPlayerConfiguration\de-DE\DiagPackage.dll.mui	AE 0124 BE.exe
File opened for modification	C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.P521220ea#	AE 0124 BE.exe
File opened for modification	C:\Windows\assembly\NativeImages_v4.0.30319_64\AuditPolicy42d3d2cc#\4bf48e6215e868c5f15ab3cf5e717b90\AuditPolicyGPManagedStubs.Interop.ni.dll.aux	AE 0124 BE.exe
File opened for modification	C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.D0ff51f83#\4de3858b9394861311e54b68def9b9f1\Microsoft.Dtc.PowerShell.ni.dll	AE 0124 BE.exe
File opened for modification	C:\Windows\Boot\PCAT\hu-HU	AE 0124 BE.exe
File opened for modification	C:\Windows\diagnostics\system\WindowsMediaPlayerConfiguration\en-US\CL_LocalizationData.psd1	AE 0124 BE.exe
File opened for modification	C:\Windows\Fonts\serifee.fon	AE 0124 BE.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\Microsoft.Transactions.Bridge.Resources\3.0.0.0_es_b03f5f7f11d50a3a	AE 0124 BE.exe
File opened for modification	C:\Windows\diagnostics\system\Audio\TS_NotDefault.ps1	AE 0124 BE.exe
File opened for modification	C:\Windows\assembly\GAC\MSDATASRC\7.0.3300.0__b03f5f7f11d50a3a\msdatasrc.dll	AE 0124 BE.exe
File opened for modification	C:\Windows\diagnostics\system\Device\en-US	AE 0124 BE.exe
File opened for modification	C:\Windows\Fonts\ega40737.fon	AE 0124 BE.exe
File opened for modification	C:\Windows\Fonts\vgafixt.fon	AE 0124 BE.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\System.DirectoryServices.Protocols\2.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.Protocols.dll	AE 0124 BE.exe
File opened for modification	C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xaml\a0c4e776b9d01dd5fe5da7fd2edd1f6f	AE 0124 BE.exe
File opened for modification	C:\Windows\Boot\EFI\cs-CZ\bootmgr.efi.mui	AE 0124 BE.exe
File opened for modification	C:\Windows\diagnostics\system\BITS	AE 0124 BE.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\System.Web.Services.Resources\2.0.0.0_de_b03f5f7f11d50a3a	AE 0124 BE.exe
File opened for modification	C:\Windows\Cursors\size2_rl.cur	AE 0124 BE.exe
File opened for modification	C:\Windows\diagnostics\system\Apps\VF_WSReset.ps1	AE 0124 BE.exe
File opened for modification	C:\Windows\diagnostics\system\Video\RS_viddrv_displaytopology.ps1	AE 0124 BE.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 29 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "376007110"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 7066d8288affd801	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000eef4ddb70fa9964f8bf69d510f57c1eb000000000200000000001066000000010000200000001ac61193ee64b9f07e44ed45adaaedc40b809af6e43282fcdf767271a5faaab0000000000e80000000020000200000008343ce843fcc22e6e9a37f24ae254f22179ed6e408dbe20e0f5bd0a815ce6e9a20000000bf8f262571581f5759a900a98e96be10a02081779778477f6df022a7e00cc1b340000000e6a09f29251d58047620069beeee72ffdb4404cf687bbc841c4239a11831b59e7d529bdfc971302205949bed45e715f919a21c35488db0baf3d6e98c90178c44	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{44440CD0-6B7D-11ED-BF5F-5EDCA19B148A} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80653e278affd801	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000eef4ddb70fa9964f8bf69d510f57c1eb0000000002000000000010660000000100002000000027249aa0e1c3379593cf0fe2540524dcc14611b81756a354ff474b923dbeaa32000000000e80000000020000200000000bb6dc98cff3b418a5ad575b2ebe648eb2b4d7fd62f5d50e58d94222fb0d50f72000000075fd8fdf78badb5055424da17ec9d4967f932f5d1eb10a7d6f39f50ae6bb638e400000007bae756eb65cd45aca67744e19201f8c43bb74bb48621a9f2da27e0ae581565f4c9b46a4bfc76b40dda61b84d4a3df6b82f09c263aa4564a6448f58738ca2afb	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE

Modifies registry class 4 IoCs

Processes:

333194cfa62775ba7721a1a327f270c9fea9302ce575f3affc49098a0da0f961.exewinlogon.exeAE 0124 BE.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings	333194cfa62775ba7721a1a327f270c9fea9302ce575f3affc49098a0da0f961.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	333194cfa62775ba7721a1a327f270c9fea9302ce575f3affc49098a0da0f961.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	AE 0124 BE.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

4548 iexplore.exe

pid	process
4548	iexplore.exe

Suspicious use of SetWindowsHookEx 11 IoCs

Processes:

333194cfa62775ba7721a1a327f270c9fea9302ce575f3affc49098a0da0f961.exeiexplore.exeIEXPLORE.EXEwinlogon.exeAE 0124 BE.exewinlogon.exewinlogon.exe

pid	process
3660	333194cfa62775ba7721a1a327f270c9fea9302ce575f3affc49098a0da0f961.exe
4548	iexplore.exe
4548	iexplore.exe
2140	IEXPLORE.EXE
2140	IEXPLORE.EXE
632	winlogon.exe
4248	AE 0124 BE.exe
3916	winlogon.exe
3756	winlogon.exe
2140	IEXPLORE.EXE
2140	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

333194cfa62775ba7721a1a327f270c9fea9302ce575f3affc49098a0da0f961.exeiexplore.exewinlogon.exeAE 0124 BE.exe

description	pid	process	target process
PID 3660 wrote to memory of 4548	3660	333194cfa62775ba7721a1a327f270c9fea9302ce575f3affc49098a0da0f961.exe	iexplore.exe
PID 3660 wrote to memory of 4548	3660	333194cfa62775ba7721a1a327f270c9fea9302ce575f3affc49098a0da0f961.exe	iexplore.exe
PID 4548 wrote to memory of 2140	4548	iexplore.exe	IEXPLORE.EXE
PID 4548 wrote to memory of 2140	4548	iexplore.exe	IEXPLORE.EXE
PID 4548 wrote to memory of 2140	4548	iexplore.exe	IEXPLORE.EXE
PID 3660 wrote to memory of 632	3660	333194cfa62775ba7721a1a327f270c9fea9302ce575f3affc49098a0da0f961.exe	winlogon.exe
PID 3660 wrote to memory of 632	3660	333194cfa62775ba7721a1a327f270c9fea9302ce575f3affc49098a0da0f961.exe	winlogon.exe
PID 3660 wrote to memory of 632	3660	333194cfa62775ba7721a1a327f270c9fea9302ce575f3affc49098a0da0f961.exe	winlogon.exe
PID 632 wrote to memory of 4248	632	winlogon.exe	AE 0124 BE.exe
PID 632 wrote to memory of 4248	632	winlogon.exe	AE 0124 BE.exe
PID 632 wrote to memory of 4248	632	winlogon.exe	AE 0124 BE.exe
PID 632 wrote to memory of 3756	632	winlogon.exe	winlogon.exe
PID 632 wrote to memory of 3756	632	winlogon.exe	winlogon.exe
PID 632 wrote to memory of 3756	632	winlogon.exe	winlogon.exe
PID 4248 wrote to memory of 3916	4248	AE 0124 BE.exe	winlogon.exe
PID 4248 wrote to memory of 3916	4248	AE 0124 BE.exe	winlogon.exe
PID 4248 wrote to memory of 3916	4248	AE 0124 BE.exe	winlogon.exe

C:\Users\Admin\AppData\Local\Temp\333194cfa62775ba7721a1a327f270c9fea9302ce575f3affc49098a0da0f961.exe
"C:\Users\Admin\AppData\Local\Temp\333194cfa62775ba7721a1a327f270c9fea9302ce575f3affc49098a0da0f961.exe"
1⤵
- Drops file in Drivers directory
- Checks computer location settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3660

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Windows\AE 0124 BE.gif
2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4548

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4548 CREDAT:17410 /prefetch:2
3⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2140

C:\Windows\SysWOW64\drivers\winlogon.exe
"C:\Windows\System32\drivers\winlogon.exe"
2⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Checks computer location settings
- Drops autorun.inf file
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:632

C:\Windows\AE 0124 BE.exe
"C:\Windows\AE 0124 BE.exe"
3⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
- Drops desktop.ini file(s)
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4248

C:\Windows\SysWOW64\drivers\winlogon.exe
"C:\Windows\System32\drivers\winlogon.exe"
4⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:3916

C:\Windows\SysWOW64\drivers\winlogon.exe
"C:\Windows\System32\drivers\winlogon.exe"
3⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:3756

Network

MITRE ATT&CK Enterprise v6

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\AE 0124 BE.exe

Filesize
130KB

MD5
d6b12929a06e14684711881bc0f5b3b4

SHA1
1ec2919c0c5e08420251251264a64a4aebd81ce2

SHA256
a27e8211f8b90a853264621ed322ecfe4544f99c118e99ec22d9691eeb2a561b

SHA512
54363a4b1f3b5336a924fa831b5eabb02fbee05ecb2936ba6959fceb09faaa0852355de8c9b9b19ec2522971e3f9938cbda6f6ad9fa9f587f1ce0f79b2a3b96e

Download Submit
C:\Windows\AE 0124 BE.exe

Filesize
130KB

MD5
d6b12929a06e14684711881bc0f5b3b4

SHA1
1ec2919c0c5e08420251251264a64a4aebd81ce2

SHA256
a27e8211f8b90a853264621ed322ecfe4544f99c118e99ec22d9691eeb2a561b

SHA512
54363a4b1f3b5336a924fa831b5eabb02fbee05ecb2936ba6959fceb09faaa0852355de8c9b9b19ec2522971e3f9938cbda6f6ad9fa9f587f1ce0f79b2a3b96e

Download Submit
C:\Windows\AE 0124 BE.gif

Filesize
65KB

MD5
2ca37bef72e5f44ea6c30dd2e17edb6f

SHA1
2a32d3e87ccf682e927ac429c508449a8620c0fc

SHA256
3c5d191f508d067d98074d848cdcae8c9c82d284241496bacd31a4131fe979ad

SHA512
74e99254da9b90fd08c2a47535424881a47e5fc02d680281d58bb977d1056decf527cc005e89e2d975c5816599e1f910051ab0ac1957a3f12e84ab94f363d426

Download Submit
C:\Windows\AE 0124 BE.gif

Filesize
130KB

MD5
1d5a9a45500483e64c379994b8409e2a

SHA1
3c8cde1f1df609747c8c459555dcf97fa810019a

SHA256
ef77fcd2bf62e21807be49f6dcda0aecd611f1b728cdf06fef87459e8393d722

SHA512
1554bad1b3420bf444f5e49269cf7c8ca6616dd62d2ba7ebf84b2b1a128d8e47f8a72a21721149a32ae0148965e71dac73fbc7ffee1fbb16ded5ce66cc4ccfc5

Download Submit
C:\Windows\Msvbvm60.dll

Filesize
1.4MB

MD5
25f62c02619174b35851b0e0455b3d94

SHA1
4e8ee85157f1769f6e3f61c0acbe59072209da71

SHA256
898288bd3b21d0e7d5f406df2e0b69a5bbfa4f241baf29a2cdf8a3cf4d4619f2

SHA512
f4529fd9eca4e4696f7f06874866ff98a1447a9b0d3a20ef0de54d4d694e2497fd39c452f73fab9b8a02962a7b2b88d1e85f6e35c7cbcb9555003c6828bebc3a

Download Submit
C:\Windows\Msvbvm60.dll

Filesize
1.4MB

MD5
25f62c02619174b35851b0e0455b3d94

SHA1
4e8ee85157f1769f6e3f61c0acbe59072209da71

SHA256
898288bd3b21d0e7d5f406df2e0b69a5bbfa4f241baf29a2cdf8a3cf4d4619f2

SHA512
f4529fd9eca4e4696f7f06874866ff98a1447a9b0d3a20ef0de54d4d694e2497fd39c452f73fab9b8a02962a7b2b88d1e85f6e35c7cbcb9555003c6828bebc3a

Download Submit
C:\Windows\SysWOW64\drivers\MSVBVM60.DLL

Filesize
1.4MB

MD5
25f62c02619174b35851b0e0455b3d94

SHA1
4e8ee85157f1769f6e3f61c0acbe59072209da71

SHA256
898288bd3b21d0e7d5f406df2e0b69a5bbfa4f241baf29a2cdf8a3cf4d4619f2

SHA512
f4529fd9eca4e4696f7f06874866ff98a1447a9b0d3a20ef0de54d4d694e2497fd39c452f73fab9b8a02962a7b2b88d1e85f6e35c7cbcb9555003c6828bebc3a

Download Submit
C:\Windows\SysWOW64\drivers\Msvbvm60.dll

Filesize
1.4MB

MD5
25f62c02619174b35851b0e0455b3d94

SHA1
4e8ee85157f1769f6e3f61c0acbe59072209da71

SHA256
898288bd3b21d0e7d5f406df2e0b69a5bbfa4f241baf29a2cdf8a3cf4d4619f2

SHA512
f4529fd9eca4e4696f7f06874866ff98a1447a9b0d3a20ef0de54d4d694e2497fd39c452f73fab9b8a02962a7b2b88d1e85f6e35c7cbcb9555003c6828bebc3a

Download Submit
C:\Windows\SysWOW64\drivers\Msvbvm60.dll

Filesize
1.4MB

MD5
25f62c02619174b35851b0e0455b3d94

SHA1
4e8ee85157f1769f6e3f61c0acbe59072209da71

SHA256
898288bd3b21d0e7d5f406df2e0b69a5bbfa4f241baf29a2cdf8a3cf4d4619f2

SHA512
f4529fd9eca4e4696f7f06874866ff98a1447a9b0d3a20ef0de54d4d694e2497fd39c452f73fab9b8a02962a7b2b88d1e85f6e35c7cbcb9555003c6828bebc3a

Download Submit
C:\Windows\SysWOW64\drivers\winlogon.exe

Filesize
130KB

MD5
d6b12929a06e14684711881bc0f5b3b4

SHA1
1ec2919c0c5e08420251251264a64a4aebd81ce2

SHA256
a27e8211f8b90a853264621ed322ecfe4544f99c118e99ec22d9691eeb2a561b

SHA512
54363a4b1f3b5336a924fa831b5eabb02fbee05ecb2936ba6959fceb09faaa0852355de8c9b9b19ec2522971e3f9938cbda6f6ad9fa9f587f1ce0f79b2a3b96e

Download Submit
C:\Windows\SysWOW64\drivers\winlogon.exe

Filesize
130KB

MD5
d6b12929a06e14684711881bc0f5b3b4

SHA1
1ec2919c0c5e08420251251264a64a4aebd81ce2

SHA256
a27e8211f8b90a853264621ed322ecfe4544f99c118e99ec22d9691eeb2a561b

SHA512
54363a4b1f3b5336a924fa831b5eabb02fbee05ecb2936ba6959fceb09faaa0852355de8c9b9b19ec2522971e3f9938cbda6f6ad9fa9f587f1ce0f79b2a3b96e

Download Submit
C:\Windows\SysWOW64\drivers\winlogon.exe

Filesize
130KB

MD5
d6b12929a06e14684711881bc0f5b3b4

SHA1
1ec2919c0c5e08420251251264a64a4aebd81ce2

SHA256
a27e8211f8b90a853264621ed322ecfe4544f99c118e99ec22d9691eeb2a561b

SHA512
54363a4b1f3b5336a924fa831b5eabb02fbee05ecb2936ba6959fceb09faaa0852355de8c9b9b19ec2522971e3f9938cbda6f6ad9fa9f587f1ce0f79b2a3b96e

Download Submit
C:\Windows\SysWOW64\drivers\winlogon.exe

Filesize
130KB

MD5
d6b12929a06e14684711881bc0f5b3b4

SHA1
1ec2919c0c5e08420251251264a64a4aebd81ce2

SHA256
a27e8211f8b90a853264621ed322ecfe4544f99c118e99ec22d9691eeb2a561b

SHA512
54363a4b1f3b5336a924fa831b5eabb02fbee05ecb2936ba6959fceb09faaa0852355de8c9b9b19ec2522971e3f9938cbda6f6ad9fa9f587f1ce0f79b2a3b96e

Download Submit
\??\c:\B1uv3nth3x1.diz

Filesize
21B

MD5
9cceaa243c5d161e1ce41c7dad1903dd

SHA1
e3da72675df53fffa781d4377d1d62116eafb35b

SHA256
814649b436ea43dd2abb99693e06019d4079ee74d02a0395913add0ba92d0189

SHA512
af9b75dc9a0b39d12d48bf6d40eb7d778eb9dd976302792271d8d4245a916027cf4e705d6cd7a5e6582ba94953346f291122f27d377b2c1a86e45f49e92efb5b

Download Submit
\??\c:\B1uv3nth3x1.diz

Filesize
21B

MD5
9cceaa243c5d161e1ce41c7dad1903dd

SHA1
e3da72675df53fffa781d4377d1d62116eafb35b

SHA256
814649b436ea43dd2abb99693e06019d4079ee74d02a0395913add0ba92d0189

SHA512
af9b75dc9a0b39d12d48bf6d40eb7d778eb9dd976302792271d8d4245a916027cf4e705d6cd7a5e6582ba94953346f291122f27d377b2c1a86e45f49e92efb5b

Download Submit
memory/632-135-0x0000000000000000-mapping.dmp

Download
memory/3756-147-0x0000000000000000-mapping.dmp

Download
memory/3916-151-0x0000000000000000-mapping.dmp

Download
memory/4248-140-0x0000000000000000-mapping.dmp

Download