8b98c124625b19151c5569650683e5866717ac35a7985d61d8dcae787be37df3

Analysis

max time kernel
150s
max time network
143s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
24-11-2022 01:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8b98c124625b19151c5569650683e5866717ac35a7985d61d8dcae787be37df3.exe
Size

197KB
MD5

35a759742c1488915a2d53ee24c72be0
SHA1

3a1788a9aade82d00e75153a03801160b0802362
SHA256

8b98c124625b19151c5569650683e5866717ac35a7985d61d8dcae787be37df3
SHA512

e9b9d8136b66b75d5ccf1d4dcd18fda53f68108361224067fee7bd50de1c6ec01adc2833b8eaaeed94e94c39c18d888dc4704862b2d4042ebe9e5ace4f37f7b9
SSDEEP

3072:h4XzBf/g79e0lQOqbE3NvlZvXxHMGIe1wPsZvHLpOD/HknnGYu6L0/6+DUV:h4XzZPbE3N9vHce1A8HufsnV0/6+DUV

Score

9^/10

evasion persistence trojan upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 6 IoCs

Detects file using ACProtect software.

Processes:

resource	yara_rule
\Windows\SysWOW64\dnsq.dll	acprotect
C:\Windows\SysWOW64\com\netcfg.dll	acprotect
\Windows\SysWOW64\com\netcfg.dll	acprotect
C:\Windows\SysWOW64\dnsq.dll	acprotect
\Windows\SysWOW64\dnsq.dll	acprotect
\Windows\SysWOW64\dnsq.dll	acprotect

Executes dropped EXE 5 IoCs

Processes:

8b98c124625b19151c5569650683e5866717ac35a7985d61d8dcae787be37df3.exe.loglsass.exelsass.exe8b98c124625b19151c5569650683e5866717ac35a7985d61d8dcae787be37df3.exesmss.exe

pid	process
1080	8b98c124625b19151c5569650683e5866717ac35a7985d61d8dcae787be37df3.exe.log
1632	lsass.exe
1908	lsass.exe
1060	8b98c124625b19151c5569650683e5866717ac35a7985d61d8dcae787be37df3.exe
1152	smss.exe

Sets file execution options in registry 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

8b98c124625b19151c5569650683e5866717ac35a7985d61d8dcae787be37df3.exe8b98c124625b19151c5569650683e5866717ac35a7985d61d8dcae787be37df3.exe.loglsass.exe

description	ioc	process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options	8b98c124625b19151c5569650683e5866717ac35a7985d61d8dcae787be37df3.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options	8b98c124625b19151c5569650683e5866717ac35a7985d61d8dcae787be37df3.exe.log
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options	lsass.exe

UPX packed file 27 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/1696-58-0x0000000000400000-0x000000000042C000-memory.dmp	upx
\Users\Admin\AppData\Local\Temp\8b98c124625b19151c5569650683e5866717ac35a7985d61d8dcae787be37df3.exe.log	upx
\Users\Admin\AppData\Local\Temp\8b98c124625b19151c5569650683e5866717ac35a7985d61d8dcae787be37df3.exe.log	upx
C:\Users\Admin\AppData\Local\Temp\8b98c124625b19151c5569650683e5866717ac35a7985d61d8dcae787be37df3.exe.log	upx
behavioral1/memory/1696-64-0x0000000000400000-0x000000000042C000-memory.dmp	upx
behavioral1/memory/1080-72-0x0000000000400000-0x000000000042C000-memory.dmp	upx
\??\c:\users\admin\appdata\local\temp\8b98c124625b19151c5569650683e5866717ac35a7985d61d8dcae787be37df3.exe.log	upx
\Windows\SysWOW64\com\lsass.exe	upx
\Windows\SysWOW64\com\lsass.exe	upx
C:\Windows\SysWOW64\com\lsass.exe	upx
\Windows\SysWOW64\com\lsass.exe	upx
C:\Windows\SysWOW64\com\lsass.exe	upx
\Windows\SysWOW64\com\lsass.exe	upx
behavioral1/memory/1080-90-0x0000000000400000-0x000000000042C000-memory.dmp	upx
behavioral1/memory/1908-91-0x0000000000400000-0x000000000042C000-memory.dmp	upx
C:\Windows\SysWOW64\com\lsass.exe	upx
behavioral1/memory/1632-103-0x0000000000400000-0x000000000042C000-memory.dmp	upx
\Windows\SysWOW64\dnsq.dll	upx
C:\Windows\SysWOW64\com\netcfg.dll	upx
\Windows\SysWOW64\com\netcfg.dll	upx
behavioral1/memory/1632-115-0x0000000010000000-0x0000000010019000-memory.dmp	upx
C:\Windows\SysWOW64\dnsq.dll	upx
\Windows\SysWOW64\dnsq.dll	upx
\Windows\SysWOW64\dnsq.dll	upx
behavioral1/memory/1060-119-0x0000000010000000-0x0000000010019000-memory.dmp	upx
behavioral1/memory/1152-120-0x0000000010000000-0x0000000010019000-memory.dmp	upx
behavioral1/memory/1632-123-0x0000000000400000-0x000000000042C000-memory.dmp	upx

Loads dropped DLL 14 IoCs

Processes:

8b98c124625b19151c5569650683e5866717ac35a7985d61d8dcae787be37df3.exe8b98c124625b19151c5569650683e5866717ac35a7985d61d8dcae787be37df3.exe.loglsass.exeregsvr32.exesmss.exe8b98c124625b19151c5569650683e5866717ac35a7985d61d8dcae787be37df3.exe

pid	process
1696	8b98c124625b19151c5569650683e5866717ac35a7985d61d8dcae787be37df3.exe
1696	8b98c124625b19151c5569650683e5866717ac35a7985d61d8dcae787be37df3.exe
1080	8b98c124625b19151c5569650683e5866717ac35a7985d61d8dcae787be37df3.exe.log
1080	8b98c124625b19151c5569650683e5866717ac35a7985d61d8dcae787be37df3.exe.log
1080	8b98c124625b19151c5569650683e5866717ac35a7985d61d8dcae787be37df3.exe.log
1080	8b98c124625b19151c5569650683e5866717ac35a7985d61d8dcae787be37df3.exe.log
1080	8b98c124625b19151c5569650683e5866717ac35a7985d61d8dcae787be37df3.exe.log
1080	8b98c124625b19151c5569650683e5866717ac35a7985d61d8dcae787be37df3.exe.log
1632	lsass.exe
1632	lsass.exe
1632	lsass.exe
2004	regsvr32.exe
1152	smss.exe
1060	8b98c124625b19151c5569650683e5866717ac35a7985d61d8dcae787be37df3.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

8b98c124625b19151c5569650683e5866717ac35a7985d61d8dcae787be37df3.exe

description	ioc	process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\OptionalComponents	8b98c124625b19151c5569650683e5866717ac35a7985d61d8dcae787be37df3.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	8b98c124625b19151c5569650683e5866717ac35a7985d61d8dcae787be37df3.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS	8b98c124625b19151c5569650683e5866717ac35a7985d61d8dcae787be37df3.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI	8b98c124625b19151c5569650683e5866717ac35a7985d61d8dcae787be37df3.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL	8b98c124625b19151c5569650683e5866717ac35a7985d61d8dcae787be37df3.exe

Checks for any installed AV software in registry 1 TTPs 3 IoCs

Security Software Discovery

T1063

Processes:

lsass.exe8b98c124625b19151c5569650683e5866717ac35a7985d61d8dcae787be37df3.exe8b98c124625b19151c5569650683e5866717ac35a7985d61d8dcae787be37df3.exe.log

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\AntiVirService	lsass.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\AntiVirService	8b98c124625b19151c5569650683e5866717ac35a7985d61d8dcae787be37df3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\AntiVirService	8b98c124625b19151c5569650683e5866717ac35a7985d61d8dcae787be37df3.exe.log

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

lsass.exelsass.exe8b98c124625b19151c5569650683e5866717ac35a7985d61d8dcae787be37df3.exe8b98c124625b19151c5569650683e5866717ac35a7985d61d8dcae787be37df3.exe.log

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	lsass.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	lsass.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	8b98c124625b19151c5569650683e5866717ac35a7985d61d8dcae787be37df3.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	8b98c124625b19151c5569650683e5866717ac35a7985d61d8dcae787be37df3.exe.log

Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.

Query Registry
T1012

Peripheral Device Discovery
T1120

System Information Discovery
T1082

Processes:

lsass.exe

description ioc process

File opened (read-only) \??\e: lsass.exe
File opened (read-only) \??\E: lsass.exe

description	ioc	process
File opened (read-only)	\??\e:	lsass.exe
File opened (read-only)	\??\E:	lsass.exe

Drops autorun.inf file 1 TTPs 7 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

Processes:

lsass.exe

description	ioc	process
File opened for modification	\??\E:\AUTORUN.INF	lsass.exe
File opened for modification	C:\autorun.inf	lsass.exe
File opened for modification	D:\autorun.inf	lsass.exe
File opened for modification	\??\E:\autorun.inf	lsass.exe
File opened for modification	C:\AUTORUN.INF	lsass.exe
File created	C:\AUTORUN.INF	lsass.exe
File opened for modification	D:\AUTORUN.INF	lsass.exe

Drops file in System32 directory 23 IoCs

Processes:

8b98c124625b19151c5569650683e5866717ac35a7985d61d8dcae787be37df3.exelsass.exe8b98c124625b19151c5569650683e5866717ac35a7985d61d8dcae787be37df3.exe.log

description	ioc	process
File created	C:\Windows\SysWOW64\com\smss.exe	8b98c124625b19151c5569650683e5866717ac35a7985d61d8dcae787be37df3.exe
File opened for modification	C:\Windows\SysWOW64\com\smss.exe	lsass.exe
File created	C:\Windows\SysWOW64\com\netcfg.dll	lsass.exe
File opened for modification	C:\Windows\SysWOW64\7085018.log	lsass.exe
File opened for modification	C:\Windows\SysWOW64\com\smss.exe	8b98c124625b19151c5569650683e5866717ac35a7985d61d8dcae787be37df3.exe
File opened for modification	C:\Windows\SysWOW64\com\lsass.exe	8b98c124625b19151c5569650683e5866717ac35a7985d61d8dcae787be37df3.exe.log
File opened for modification	C:\Windows\SysWOW64\com\netcfg.dll	lsass.exe
File opened for modification	\??\c:\windows\SysWOW64\com\lsass.exe	lsass.exe
File created	C:\Windows\SysWOW64\com\lsass.exe	lsass.exe
File opened for modification	C:\Windows\SysWOW64\com\bak	lsass.exe
File created	C:\Windows\SysWOW64\00302.log	8b98c124625b19151c5569650683e5866717ac35a7985d61d8dcae787be37df3.exe
File created	C:\Windows\SysWOW64\00302.log	8b98c124625b19151c5569650683e5866717ac35a7985d61d8dcae787be37df3.exe.log
File created	C:\Windows\SysWOW64\00302.log	lsass.exe
File opened for modification	C:\Windows\SysWOW64\com\lsass.exe	lsass.exe
File opened for modification	C:\Windows\SysWOW64\com\netcfg.000	lsass.exe
File created	C:\Windows\SysWOW64\7085018.log	lsass.exe
File created	C:\Windows\SysWOW64\dnsq.dll	lsass.exe
File opened for modification	C:\Windows\SysWOW64\dnsq.dll	lsass.exe
File created	C:\Windows\SysWOW64\7085065.log	lsass.exe
File opened for modification	C:\Windows\SysWOW64\com\smss.exe	8b98c124625b19151c5569650683e5866717ac35a7985d61d8dcae787be37df3.exe.log
File created	C:\Windows\SysWOW64\com\lsass.exe	8b98c124625b19151c5569650683e5866717ac35a7985d61d8dcae787be37df3.exe.log
File created	C:\Windows\SysWOW64\com\netcfg.000	lsass.exe
File opened for modification	C:\Windows\SysWOW64\7085065.log	lsass.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 64 IoCs

Processes:

regsvr32.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D9901239-34A2-448D-A000-3705544ECE9D}\Implemented Categories\{7DD95802-9882-11CF-9FA9-00AA006C42C4}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{814293BA-8708-42E9-A6B7-1BD3172B9DDF}\1.0\0\win32\ = "C:\\Windows\\SysWow64\\com\\netcfg.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AAC17985-187F-4457-A841-E60BAE6359C2}\ = "_DIfObj"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{2D96C4BF-8DCA-4A97-A24A-896FF841AE2D}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{450EC9C4-0F7F-407F-B084-D1147FE9DDCC}\ = "IfObj Property Page"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D9901239-34A2-448D-A000-3705544ECE9D}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{814293BA-8708-42E9-A6B7-1BD3172B9DDF}\1.0\0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{450EC9C4-0F7F-407F-B084-D1147FE9DDCC}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D9901239-34A2-448D-A000-3705544ECE9D}\ = "IfObj Control"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{814293BA-8708-42E9-A6B7-1BD3172B9DDF}\1.0\HELPDIR\ = "C:\\Windows\\SysWow64\\com"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2D96C4BF-8DCA-4A97-A24A-896FF841AE2D}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D9901239-34A2-448D-A000-3705544ECE9D}\InprocServer32\ = "C:\\Windows\\SysWow64\\com\\netcfg.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{814293BA-8708-42E9-A6B7-1BD3172B9DDF}\1.0\FLAGS	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AAC17985-187F-4457-A841-E60BAE6359C2}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{450EC9C4-0F7F-407F-B084-D1147FE9DDCC}\InprocServer32\ = "C:\\Windows\\SysWow64\\com\\netcfg.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IFOBJ.IfObjCtrl.1\CLSID\ = "{D9901239-34A2-448D-A000-3705544ECE9D}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D9901239-34A2-448D-A000-3705544ECE9D}\Implemented Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{814293BA-8708-42E9-A6B7-1BD3172B9DDF}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AAC17985-187F-4457-A841-E60BAE6359C2}\TypeLib\ = "{814293BA-8708-42E9-A6B7-1BD3172B9DDF}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{2D96C4BF-8DCA-4A97-A24A-896FF841AE2D}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{2D96C4BF-8DCA-4A97-A24A-896FF841AE2D}\TypeLib\ = "{814293BA-8708-42E9-A6B7-1BD3172B9DDF}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D9901239-34A2-448D-A000-3705544ECE9D}\ToolboxBitmap32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{814293BA-8708-42E9-A6B7-1BD3172B9DDF}\1.0\FLAGS\ = "2"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{AAC17985-187F-4457-A841-E60BAE6359C2}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2D96C4BF-8DCA-4A97-A24A-896FF841AE2D}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D9901239-34A2-448D-A000-3705544ECE9D}\MiscStatus\1\ = "131473"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D9901239-34A2-448D-A000-3705544ECE9D}\Control	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{AAC17985-187F-4457-A841-E60BAE6359C2}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D9901239-34A2-448D-A000-3705544ECE9D}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D9901239-34A2-448D-A000-3705544ECE9D}\Version	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AAC17985-187F-4457-A841-E60BAE6359C2}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{2D96C4BF-8DCA-4A97-A24A-896FF841AE2D}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2D96C4BF-8DCA-4A97-A24A-896FF841AE2D}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D9901239-34A2-448D-A000-3705544ECE9D}\ProgID\ = "IFOBJ.IfObjCtrl.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D9901239-34A2-448D-A000-3705544ECE9D}\Implemented Categories	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2D96C4BF-8DCA-4A97-A24A-896FF841AE2D}\TypeLib\ = "{814293BA-8708-42E9-A6B7-1BD3172B9DDF}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Component Categories\{7DD95802-9882-11CF-9FA9-00AA006C42C4}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Component Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{814293BA-8708-42E9-A6B7-1BD3172B9DDF}\1.0\HELPDIR	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2D96C4BF-8DCA-4A97-A24A-896FF841AE2D}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D9901239-34A2-448D-A000-3705544ECE9D}\ProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D9901239-34A2-448D-A000-3705544ECE9D}\MiscStatus	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D9901239-34A2-448D-A000-3705544ECE9D}\MiscStatus\ = "0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{AAC17985-187F-4457-A841-E60BAE6359C2}\TypeLib\ = "{814293BA-8708-42E9-A6B7-1BD3172B9DDF}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2D96C4BF-8DCA-4A97-A24A-896FF841AE2D}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IFOBJ.IfObjCtrl.1	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D9901239-34A2-448D-A000-3705544ECE9D}\MiscStatus\1	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D9901239-34A2-448D-A000-3705544ECE9D}\Version\ = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{AAC17985-187F-4457-A841-E60BAE6359C2}\ = "_DIfObj"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{2D96C4BF-8DCA-4A97-A24A-896FF841AE2D}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2D96C4BF-8DCA-4A97-A24A-896FF841AE2D}\ = "_DIfObjEvents"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IFOBJ.IfObjCtrl.1\ = "IfObj Control"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D9901239-34A2-448D-A000-3705544ECE9D}\Control\	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{814293BA-8708-42E9-A6B7-1BD3172B9DDF}\1.0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AAC17985-187F-4457-A841-E60BAE6359C2}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D9901239-34A2-448D-A000-3705544ECE9D}\ToolboxBitmap32\ = "C:\\Windows\\SysWow64\\com\\netcfg.dll, 1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D9901239-34A2-448D-A000-3705544ECE9D}\TypeLib\ = "{814293BA-8708-42E9-A6B7-1BD3172B9DDF}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AAC17985-187F-4457-A841-E60BAE6359C2}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{450EC9C4-0F7F-407F-B084-D1147FE9DDCC}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D9901239-34A2-448D-A000-3705544ECE9D}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IFOBJ.IfObjCtrl.1\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AAC17985-187F-4457-A841-E60BAE6359C2}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{2D96C4BF-8DCA-4A97-A24A-896FF841AE2D}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{2D96C4BF-8DCA-4A97-A24A-896FF841AE2D}\ = "_DIfObjEvents"	regsvr32.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

ping.exe

pid process

1628 ping.exe

pid	process
1628	ping.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

8b98c124625b19151c5569650683e5866717ac35a7985d61d8dcae787be37df3.exe8b98c124625b19151c5569650683e5866717ac35a7985d61d8dcae787be37df3.exe.loglsass.exe

pid	process
1696	8b98c124625b19151c5569650683e5866717ac35a7985d61d8dcae787be37df3.exe
1080	8b98c124625b19151c5569650683e5866717ac35a7985d61d8dcae787be37df3.exe.log
1632	lsass.exe

Suspicious behavior: LoadsDriver 3 IoCs

Processes:

pid process

468
468
468

pid	process
468
468
468

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

8b98c124625b19151c5569650683e5866717ac35a7985d61d8dcae787be37df3.exe8b98c124625b19151c5569650683e5866717ac35a7985d61d8dcae787be37df3.exe.loglsass.exe

description	pid	process
Token: SeDebugPrivilege	1696	8b98c124625b19151c5569650683e5866717ac35a7985d61d8dcae787be37df3.exe
Token: SeDebugPrivilege	1080	8b98c124625b19151c5569650683e5866717ac35a7985d61d8dcae787be37df3.exe.log
Token: SeDebugPrivilege	1632	lsass.exe

Suspicious use of SetWindowsHookEx 18 IoCs

Processes:

8b98c124625b19151c5569650683e5866717ac35a7985d61d8dcae787be37df3.exe8b98c124625b19151c5569650683e5866717ac35a7985d61d8dcae787be37df3.exe.loglsass.exelsass.exe8b98c124625b19151c5569650683e5866717ac35a7985d61d8dcae787be37df3.exe

pid	process
1696	8b98c124625b19151c5569650683e5866717ac35a7985d61d8dcae787be37df3.exe
1696	8b98c124625b19151c5569650683e5866717ac35a7985d61d8dcae787be37df3.exe
1696	8b98c124625b19151c5569650683e5866717ac35a7985d61d8dcae787be37df3.exe
1696	8b98c124625b19151c5569650683e5866717ac35a7985d61d8dcae787be37df3.exe
1080	8b98c124625b19151c5569650683e5866717ac35a7985d61d8dcae787be37df3.exe.log
1080	8b98c124625b19151c5569650683e5866717ac35a7985d61d8dcae787be37df3.exe.log
1080	8b98c124625b19151c5569650683e5866717ac35a7985d61d8dcae787be37df3.exe.log
1080	8b98c124625b19151c5569650683e5866717ac35a7985d61d8dcae787be37df3.exe.log
1632	lsass.exe
1632	lsass.exe
1632	lsass.exe
1632	lsass.exe
1908	lsass.exe
1908	lsass.exe
1908	lsass.exe
1908	lsass.exe
1060	8b98c124625b19151c5569650683e5866717ac35a7985d61d8dcae787be37df3.exe
1632	lsass.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

8b98c124625b19151c5569650683e5866717ac35a7985d61d8dcae787be37df3.exe8b98c124625b19151c5569650683e5866717ac35a7985d61d8dcae787be37df3.exe.loglsass.exe

description	pid	process	target process
PID 1696 wrote to memory of 644	1696	8b98c124625b19151c5569650683e5866717ac35a7985d61d8dcae787be37df3.exe	cmd.exe
PID 1696 wrote to memory of 644	1696	8b98c124625b19151c5569650683e5866717ac35a7985d61d8dcae787be37df3.exe	cmd.exe
PID 1696 wrote to memory of 644	1696	8b98c124625b19151c5569650683e5866717ac35a7985d61d8dcae787be37df3.exe	cmd.exe
PID 1696 wrote to memory of 644	1696	8b98c124625b19151c5569650683e5866717ac35a7985d61d8dcae787be37df3.exe	cmd.exe
PID 1696 wrote to memory of 1204	1696	8b98c124625b19151c5569650683e5866717ac35a7985d61d8dcae787be37df3.exe	cacls.exe
PID 1696 wrote to memory of 1204	1696	8b98c124625b19151c5569650683e5866717ac35a7985d61d8dcae787be37df3.exe	cacls.exe
PID 1696 wrote to memory of 1204	1696	8b98c124625b19151c5569650683e5866717ac35a7985d61d8dcae787be37df3.exe	cacls.exe
PID 1696 wrote to memory of 1204	1696	8b98c124625b19151c5569650683e5866717ac35a7985d61d8dcae787be37df3.exe	cacls.exe
PID 1696 wrote to memory of 1884	1696	8b98c124625b19151c5569650683e5866717ac35a7985d61d8dcae787be37df3.exe	cacls.exe
PID 1696 wrote to memory of 1884	1696	8b98c124625b19151c5569650683e5866717ac35a7985d61d8dcae787be37df3.exe	cacls.exe
PID 1696 wrote to memory of 1884	1696	8b98c124625b19151c5569650683e5866717ac35a7985d61d8dcae787be37df3.exe	cacls.exe
PID 1696 wrote to memory of 1884	1696	8b98c124625b19151c5569650683e5866717ac35a7985d61d8dcae787be37df3.exe	cacls.exe
PID 1696 wrote to memory of 1080	1696	8b98c124625b19151c5569650683e5866717ac35a7985d61d8dcae787be37df3.exe	8b98c124625b19151c5569650683e5866717ac35a7985d61d8dcae787be37df3.exe.log
PID 1696 wrote to memory of 1080	1696	8b98c124625b19151c5569650683e5866717ac35a7985d61d8dcae787be37df3.exe	8b98c124625b19151c5569650683e5866717ac35a7985d61d8dcae787be37df3.exe.log
PID 1696 wrote to memory of 1080	1696	8b98c124625b19151c5569650683e5866717ac35a7985d61d8dcae787be37df3.exe	8b98c124625b19151c5569650683e5866717ac35a7985d61d8dcae787be37df3.exe.log
PID 1696 wrote to memory of 1080	1696	8b98c124625b19151c5569650683e5866717ac35a7985d61d8dcae787be37df3.exe	8b98c124625b19151c5569650683e5866717ac35a7985d61d8dcae787be37df3.exe.log
PID 1080 wrote to memory of 696	1080	8b98c124625b19151c5569650683e5866717ac35a7985d61d8dcae787be37df3.exe.log	cmd.exe
PID 1080 wrote to memory of 696	1080	8b98c124625b19151c5569650683e5866717ac35a7985d61d8dcae787be37df3.exe.log	cmd.exe
PID 1080 wrote to memory of 696	1080	8b98c124625b19151c5569650683e5866717ac35a7985d61d8dcae787be37df3.exe.log	cmd.exe
PID 1080 wrote to memory of 696	1080	8b98c124625b19151c5569650683e5866717ac35a7985d61d8dcae787be37df3.exe.log	cmd.exe
PID 1080 wrote to memory of 1792	1080	8b98c124625b19151c5569650683e5866717ac35a7985d61d8dcae787be37df3.exe.log	cacls.exe
PID 1080 wrote to memory of 1792	1080	8b98c124625b19151c5569650683e5866717ac35a7985d61d8dcae787be37df3.exe.log	cacls.exe
PID 1080 wrote to memory of 1792	1080	8b98c124625b19151c5569650683e5866717ac35a7985d61d8dcae787be37df3.exe.log	cacls.exe
PID 1080 wrote to memory of 1792	1080	8b98c124625b19151c5569650683e5866717ac35a7985d61d8dcae787be37df3.exe.log	cacls.exe
PID 1080 wrote to memory of 1828	1080	8b98c124625b19151c5569650683e5866717ac35a7985d61d8dcae787be37df3.exe.log	cacls.exe
PID 1080 wrote to memory of 1828	1080	8b98c124625b19151c5569650683e5866717ac35a7985d61d8dcae787be37df3.exe.log	cacls.exe
PID 1080 wrote to memory of 1828	1080	8b98c124625b19151c5569650683e5866717ac35a7985d61d8dcae787be37df3.exe.log	cacls.exe
PID 1080 wrote to memory of 1828	1080	8b98c124625b19151c5569650683e5866717ac35a7985d61d8dcae787be37df3.exe.log	cacls.exe
PID 1080 wrote to memory of 596	1080	8b98c124625b19151c5569650683e5866717ac35a7985d61d8dcae787be37df3.exe.log	cacls.exe
PID 1080 wrote to memory of 596	1080	8b98c124625b19151c5569650683e5866717ac35a7985d61d8dcae787be37df3.exe.log	cacls.exe
PID 1080 wrote to memory of 596	1080	8b98c124625b19151c5569650683e5866717ac35a7985d61d8dcae787be37df3.exe.log	cacls.exe
PID 1080 wrote to memory of 596	1080	8b98c124625b19151c5569650683e5866717ac35a7985d61d8dcae787be37df3.exe.log	cacls.exe
PID 1080 wrote to memory of 1428	1080	8b98c124625b19151c5569650683e5866717ac35a7985d61d8dcae787be37df3.exe.log	cacls.exe
PID 1080 wrote to memory of 1428	1080	8b98c124625b19151c5569650683e5866717ac35a7985d61d8dcae787be37df3.exe.log	cacls.exe
PID 1080 wrote to memory of 1428	1080	8b98c124625b19151c5569650683e5866717ac35a7985d61d8dcae787be37df3.exe.log	cacls.exe
PID 1080 wrote to memory of 1428	1080	8b98c124625b19151c5569650683e5866717ac35a7985d61d8dcae787be37df3.exe.log	cacls.exe
PID 1080 wrote to memory of 1996	1080	8b98c124625b19151c5569650683e5866717ac35a7985d61d8dcae787be37df3.exe.log	cmd.exe
PID 1080 wrote to memory of 1996	1080	8b98c124625b19151c5569650683e5866717ac35a7985d61d8dcae787be37df3.exe.log	cmd.exe
PID 1080 wrote to memory of 1996	1080	8b98c124625b19151c5569650683e5866717ac35a7985d61d8dcae787be37df3.exe.log	cmd.exe
PID 1080 wrote to memory of 1996	1080	8b98c124625b19151c5569650683e5866717ac35a7985d61d8dcae787be37df3.exe.log	cmd.exe
PID 1080 wrote to memory of 1936	1080	8b98c124625b19151c5569650683e5866717ac35a7985d61d8dcae787be37df3.exe.log	cmd.exe
PID 1080 wrote to memory of 1936	1080	8b98c124625b19151c5569650683e5866717ac35a7985d61d8dcae787be37df3.exe.log	cmd.exe
PID 1080 wrote to memory of 1936	1080	8b98c124625b19151c5569650683e5866717ac35a7985d61d8dcae787be37df3.exe.log	cmd.exe
PID 1080 wrote to memory of 1936	1080	8b98c124625b19151c5569650683e5866717ac35a7985d61d8dcae787be37df3.exe.log	cmd.exe
PID 1080 wrote to memory of 1632	1080	8b98c124625b19151c5569650683e5866717ac35a7985d61d8dcae787be37df3.exe.log	lsass.exe
PID 1080 wrote to memory of 1632	1080	8b98c124625b19151c5569650683e5866717ac35a7985d61d8dcae787be37df3.exe.log	lsass.exe
PID 1080 wrote to memory of 1632	1080	8b98c124625b19151c5569650683e5866717ac35a7985d61d8dcae787be37df3.exe.log	lsass.exe
PID 1080 wrote to memory of 1632	1080	8b98c124625b19151c5569650683e5866717ac35a7985d61d8dcae787be37df3.exe.log	lsass.exe
PID 1080 wrote to memory of 1060	1080	8b98c124625b19151c5569650683e5866717ac35a7985d61d8dcae787be37df3.exe.log	8b98c124625b19151c5569650683e5866717ac35a7985d61d8dcae787be37df3.exe
PID 1080 wrote to memory of 1060	1080	8b98c124625b19151c5569650683e5866717ac35a7985d61d8dcae787be37df3.exe.log	8b98c124625b19151c5569650683e5866717ac35a7985d61d8dcae787be37df3.exe
PID 1080 wrote to memory of 1060	1080	8b98c124625b19151c5569650683e5866717ac35a7985d61d8dcae787be37df3.exe.log	8b98c124625b19151c5569650683e5866717ac35a7985d61d8dcae787be37df3.exe
PID 1080 wrote to memory of 1060	1080	8b98c124625b19151c5569650683e5866717ac35a7985d61d8dcae787be37df3.exe.log	8b98c124625b19151c5569650683e5866717ac35a7985d61d8dcae787be37df3.exe
PID 1632 wrote to memory of 1704	1632	lsass.exe	cmd.exe
PID 1632 wrote to memory of 1704	1632	lsass.exe	cmd.exe
PID 1632 wrote to memory of 1704	1632	lsass.exe	cmd.exe
PID 1632 wrote to memory of 1704	1632	lsass.exe	cmd.exe
PID 1080 wrote to memory of 1908	1080	8b98c124625b19151c5569650683e5866717ac35a7985d61d8dcae787be37df3.exe.log	lsass.exe
PID 1080 wrote to memory of 1908	1080	8b98c124625b19151c5569650683e5866717ac35a7985d61d8dcae787be37df3.exe.log	lsass.exe
PID 1080 wrote to memory of 1908	1080	8b98c124625b19151c5569650683e5866717ac35a7985d61d8dcae787be37df3.exe.log	lsass.exe
PID 1080 wrote to memory of 1908	1080	8b98c124625b19151c5569650683e5866717ac35a7985d61d8dcae787be37df3.exe.log	lsass.exe
PID 1632 wrote to memory of 1184	1632	lsass.exe	cacls.exe
PID 1632 wrote to memory of 1184	1632	lsass.exe	cacls.exe
PID 1632 wrote to memory of 1184	1632	lsass.exe	cacls.exe
PID 1632 wrote to memory of 1184	1632	lsass.exe	cacls.exe

C:\Users\Admin\AppData\Local\Temp\8b98c124625b19151c5569650683e5866717ac35a7985d61d8dcae787be37df3.exe
"C:\Users\Admin\AppData\Local\Temp\8b98c124625b19151c5569650683e5866717ac35a7985d61d8dcae787be37df3.exe"
1⤵
- Sets file execution options in registry
- Loads dropped DLL
- Adds Run key to start application
- Checks for any installed AV software in registry
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1696

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c echo ok
2⤵
PID:644

C:\Windows\SysWOW64\cacls.exe
"C:\Windows\System32\cacls.exe" C:\Windows\system32\com /e /t /g Admin:F
2⤵
PID:1204

C:\Windows\SysWOW64\cacls.exe
"C:\Windows\System32\cacls.exe" C:\Windows\system32\com /e /t /g Everyone:F
2⤵
PID:1884

\??\c:\users\admin\appdata\local\temp\8b98c124625b19151c5569650683e5866717ac35a7985d61d8dcae787be37df3.exe.log
"c:\users\admin\appdata\local\temp\8b98c124625b19151c5569650683e5866717ac35a7985d61d8dcae787be37df3.exe.log"
2⤵
- Executes dropped EXE
- Sets file execution options in registry
- Loads dropped DLL
- Checks for any installed AV software in registry
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1080

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c echo ok
3⤵
PID:696

C:\Windows\SysWOW64\cacls.exe
"C:\Windows\System32\cacls.exe" C:\Windows\system32\com /e /t /g Admin:F
3⤵
PID:1792

C:\Windows\SysWOW64\cacls.exe
"C:\Windows\System32\cacls.exe" C:\Windows\system32\com /e /t /g Everyone:F
3⤵
PID:1828

C:\Windows\SysWOW64\cacls.exe
"C:\Windows\System32\cacls.exe" C:\Windows\system32\com\smss.exe /e /t /g Admin:F
3⤵
PID:596

C:\Windows\SysWOW64\cacls.exe
"C:\Windows\System32\cacls.exe" C:\Windows\system32\com\smss.exe /e /t /g Everyone:F
3⤵
PID:1428

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c rd /s /q "C:\Windows\system32\com\smss.exe"
3⤵
PID:1996

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c del /F /Q "C:\Windows\system32\com\lsass.exe"
3⤵
PID:1936

C:\Windows\SysWOW64\com\lsass.exe
"C:\Windows\system32\com\lsass.exe"
3⤵
- Executes dropped EXE
- Sets file execution options in registry
- Loads dropped DLL
- Checks for any installed AV software in registry
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1632

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c echo ok
4⤵
PID:1704

C:\Windows\SysWOW64\cacls.exe
"C:\Windows\System32\cacls.exe" C:\Windows\system32\com /e /t /g Admin:F
4⤵
PID:1184

C:\Windows\SysWOW64\cacls.exe
"C:\Windows\System32\cacls.exe" C:\Windows\system32\com /e /t /g Everyone:F
4⤵
PID:1160

C:\Windows\SysWOW64\cacls.exe
"C:\Windows\System32\cacls.exe" C:\Windows\system32\com\lsass.exe /e /t /g Admin:F
4⤵
PID:560

C:\Windows\SysWOW64\cacls.exe
"C:\Windows\System32\cacls.exe" C:\Windows\system32\com\lsass.exe /e /t /g Everyone:F
4⤵
PID:1204

C:\Windows\SysWOW64\cacls.exe
"C:\Windows\System32\cacls.exe" C:\Windows\system32\com\smss.exe /e /t /g Admin:F
4⤵
PID:1580

C:\Windows\SysWOW64\cacls.exe
"C:\Windows\System32\cacls.exe" C:\Windows\system32\com\smss.exe /e /t /g Everyone:F
4⤵
PID:580

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c rd /s /q "C:\Windows\system32\com\smss.exe"
4⤵
PID:1764

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c rd /s /q "C:\Windows\system32\com\lsass.exe"
4⤵
PID:304

C:\Windows\SysWOW64\regsvr32.exe
"C:\Windows\System32\regsvr32.exe" C:\Windows\system32\com\netcfg.dll /s
4⤵
- Loads dropped DLL
- Modifies registry class
PID:2004

C:\Windows\SysWOW64\com\smss.exe
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\~.exe
4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1152

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c rd /s /q "C:\Windows\system32\dnsq.dll"
4⤵
PID:1956

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c rd /s /q "C:\Windows\system32\com\bak"
4⤵
PID:1296

C:\Windows\SysWOW64\ping.exe
ping.exe -f -n 1 www.baidu.com
4⤵
- Runs ping.exe
PID:1628

C:\Users\Admin\appdata\local\temp\8b98c124625b19151c5569650683e5866717ac35a7985d61d8dcae787be37df3.exe
"C:\Users\Admin\appdata\local\temp\8b98c124625b19151c5569650683e5866717ac35a7985d61d8dcae787be37df3.exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1060

C:\Windows\SysWOW64\com\lsass.exe
^c:\users\admin\appdata\local\temp\8b98c124625b19151c5569650683e5866717ac35a7985d61d8dcae787be37df3.exe.log
3⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of SetWindowsHookEx
PID:1908

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Security Software Discovery

T1063

System Information Discovery

T1082

Query Registry

T1012

Peripheral Device Discovery

T1120

Remote System Discovery

T1018

Lateral Movement

Replication Through Removable Media

T1091

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\8b98c124625b19151c5569650683e5866717ac35a7985d61d8dcae787be37df3.exe
Filesize
13KB

MD5
b8e7e90dae5dcb96e0081a209bda9d3e

SHA1
e1c1e4037e41bf0cefd0557aa065501973a12c4a

SHA256
d8e377a83508b166013226faf34f2566caadc85263e9334f1d1c23c3b809982c

SHA512
6bd641ef1035ec9d6239e71275dea734c8e137af67b4d970e4e4eb4efb50eb8e39c43d662d502679e82167af84c9152eb796520a724e21bc1218dde442f1c78d

Download Submit
C:\Users\Admin\AppData\Local\Temp\8b98c124625b19151c5569650683e5866717ac35a7985d61d8dcae787be37df3.exe.log
Filesize
197KB

MD5
35a759742c1488915a2d53ee24c72be0

SHA1
3a1788a9aade82d00e75153a03801160b0802362

SHA256
8b98c124625b19151c5569650683e5866717ac35a7985d61d8dcae787be37df3

SHA512
e9b9d8136b66b75d5ccf1d4dcd18fda53f68108361224067fee7bd50de1c6ec01adc2833b8eaaeed94e94c39c18d888dc4704862b2d4042ebe9e5ace4f37f7b9

Download Submit
C:\Windows\SysWOW64\com\lsass.exe
Filesize
92KB

MD5
620f520e99115c5ba8990663a2e17e30

SHA1
e6bd2b558ee632c38aeca05a01f9ecc1a2339c8c

SHA256
a7e009b7c3a20c864366e15e2d6f0d60f448a503f5d89111d18084655b273eae

SHA512
b703209cd5d3124977199e64e9da42083d7c97d8ebbbe35e167655278e1b827fc8a2a77824d44353a789e17619e92cc1940c5ca445887b3ea5c352e069b5e31d

Download Submit
C:\Windows\SysWOW64\com\lsass.exe
Filesize
92KB

MD5
620f520e99115c5ba8990663a2e17e30

SHA1
e6bd2b558ee632c38aeca05a01f9ecc1a2339c8c

SHA256
a7e009b7c3a20c864366e15e2d6f0d60f448a503f5d89111d18084655b273eae

SHA512
b703209cd5d3124977199e64e9da42083d7c97d8ebbbe35e167655278e1b827fc8a2a77824d44353a789e17619e92cc1940c5ca445887b3ea5c352e069b5e31d

Download Submit
C:\Windows\SysWOW64\com\lsass.exe
Filesize
92KB

MD5
620f520e99115c5ba8990663a2e17e30

SHA1
e6bd2b558ee632c38aeca05a01f9ecc1a2339c8c

SHA256
a7e009b7c3a20c864366e15e2d6f0d60f448a503f5d89111d18084655b273eae

SHA512
b703209cd5d3124977199e64e9da42083d7c97d8ebbbe35e167655278e1b827fc8a2a77824d44353a789e17619e92cc1940c5ca445887b3ea5c352e069b5e31d

Download Submit
C:\Windows\SysWOW64\com\netcfg.dll
Filesize
16KB

MD5
d1f6b9273cbb2e23aeed11346d0072c5

SHA1
0d012a7c7b37082dcbd5e1688f72eeade705f825

SHA256
dfb2d7cdc6ea056948d09fe139255af2dcc58f3581f4a50f4e5ee0f5a03c39fc

SHA512
4c3ab878131ad38a54d04cf0d268430ab98a67df474a18ee7858c62561d90ec14c34ed63dd973fdf24115ebf17ef65a6a9fc9ac612c247903e881e584dc3b77e

Download Submit
C:\Windows\SysWOW64\com\smss.exe
Filesize
40KB

MD5
ae1cd1d740c265b7f18f827f9e37afab

SHA1
6b976bc56e4021e7237b3cd4dbe412b6949fb0a0

SHA256
a961e4f09ebcf11e1e384361d20d4ac031b3c159b9e6d50e3b4612102bef2a11

SHA512
c8f973cbece698f0701171be501c5c24fb77345c05c136ba992b97f74b81c0487e4039c5bb9b43176cc3815e8f2181377811a8a4d8fb08f741fa304767b50571

Download Submit
C:\Windows\SysWOW64\com\smss.exe
Filesize
40KB

MD5
ae1cd1d740c265b7f18f827f9e37afab

SHA1
6b976bc56e4021e7237b3cd4dbe412b6949fb0a0

SHA256
a961e4f09ebcf11e1e384361d20d4ac031b3c159b9e6d50e3b4612102bef2a11

SHA512
c8f973cbece698f0701171be501c5c24fb77345c05c136ba992b97f74b81c0487e4039c5bb9b43176cc3815e8f2181377811a8a4d8fb08f741fa304767b50571

Download Submit
C:\Windows\SysWOW64\com\smss.exe
Filesize
40KB

MD5
ae1cd1d740c265b7f18f827f9e37afab

SHA1
6b976bc56e4021e7237b3cd4dbe412b6949fb0a0

SHA256
a961e4f09ebcf11e1e384361d20d4ac031b3c159b9e6d50e3b4612102bef2a11

SHA512
c8f973cbece698f0701171be501c5c24fb77345c05c136ba992b97f74b81c0487e4039c5bb9b43176cc3815e8f2181377811a8a4d8fb08f741fa304767b50571

Download Submit
C:\Windows\SysWOW64\dnsq.dll
Filesize
31KB

MD5
f515bd3278588b6d58a316d059e2778f

SHA1
ae8d987f33930d305b9d60685549dcabefa8e932

SHA256
5c8d02e0398882cb177fe91068fb31cf28fa401c7c060692ca2fda86479f9310

SHA512
688227aa4355cc7c156327992ae855b2aae294f12bb786bc71fb30690af3f46ad32ae360f004b899a575d833636b0c546005c85313c325e1893e5e67c9d1121c

Download Submit
\??\c:\users\admin\appdata\local\temp\8b98c124625b19151c5569650683e5866717ac35a7985d61d8dcae787be37df3.exe.log
Filesize
197KB

MD5
35a759742c1488915a2d53ee24c72be0

SHA1
3a1788a9aade82d00e75153a03801160b0802362

SHA256
8b98c124625b19151c5569650683e5866717ac35a7985d61d8dcae787be37df3

SHA512
e9b9d8136b66b75d5ccf1d4dcd18fda53f68108361224067fee7bd50de1c6ec01adc2833b8eaaeed94e94c39c18d888dc4704862b2d4042ebe9e5ace4f37f7b9

Download Submit
\Users\Admin\AppData\Local\Temp\8b98c124625b19151c5569650683e5866717ac35a7985d61d8dcae787be37df3.exe
Filesize
13KB

MD5
b8e7e90dae5dcb96e0081a209bda9d3e

SHA1
e1c1e4037e41bf0cefd0557aa065501973a12c4a

SHA256
d8e377a83508b166013226faf34f2566caadc85263e9334f1d1c23c3b809982c

SHA512
6bd641ef1035ec9d6239e71275dea734c8e137af67b4d970e4e4eb4efb50eb8e39c43d662d502679e82167af84c9152eb796520a724e21bc1218dde442f1c78d

Download Submit
\Users\Admin\AppData\Local\Temp\8b98c124625b19151c5569650683e5866717ac35a7985d61d8dcae787be37df3.exe
Filesize
13KB

MD5
b8e7e90dae5dcb96e0081a209bda9d3e

SHA1
e1c1e4037e41bf0cefd0557aa065501973a12c4a

SHA256
d8e377a83508b166013226faf34f2566caadc85263e9334f1d1c23c3b809982c

SHA512
6bd641ef1035ec9d6239e71275dea734c8e137af67b4d970e4e4eb4efb50eb8e39c43d662d502679e82167af84c9152eb796520a724e21bc1218dde442f1c78d

Download Submit
\Users\Admin\AppData\Local\Temp\8b98c124625b19151c5569650683e5866717ac35a7985d61d8dcae787be37df3.exe.log
Filesize
197KB

MD5
35a759742c1488915a2d53ee24c72be0

SHA1
3a1788a9aade82d00e75153a03801160b0802362

SHA256
8b98c124625b19151c5569650683e5866717ac35a7985d61d8dcae787be37df3

SHA512
e9b9d8136b66b75d5ccf1d4dcd18fda53f68108361224067fee7bd50de1c6ec01adc2833b8eaaeed94e94c39c18d888dc4704862b2d4042ebe9e5ace4f37f7b9

Download Submit
\Users\Admin\AppData\Local\Temp\8b98c124625b19151c5569650683e5866717ac35a7985d61d8dcae787be37df3.exe.log
Filesize
197KB

MD5
35a759742c1488915a2d53ee24c72be0

SHA1
3a1788a9aade82d00e75153a03801160b0802362

SHA256
8b98c124625b19151c5569650683e5866717ac35a7985d61d8dcae787be37df3

SHA512
e9b9d8136b66b75d5ccf1d4dcd18fda53f68108361224067fee7bd50de1c6ec01adc2833b8eaaeed94e94c39c18d888dc4704862b2d4042ebe9e5ace4f37f7b9

Download Submit
\Windows\SysWOW64\com\lsass.exe
Filesize
92KB

MD5
620f520e99115c5ba8990663a2e17e30

SHA1
e6bd2b558ee632c38aeca05a01f9ecc1a2339c8c

SHA256
a7e009b7c3a20c864366e15e2d6f0d60f448a503f5d89111d18084655b273eae

SHA512
b703209cd5d3124977199e64e9da42083d7c97d8ebbbe35e167655278e1b827fc8a2a77824d44353a789e17619e92cc1940c5ca445887b3ea5c352e069b5e31d

Download Submit
\Windows\SysWOW64\com\lsass.exe
Filesize
92KB

MD5
620f520e99115c5ba8990663a2e17e30

SHA1
e6bd2b558ee632c38aeca05a01f9ecc1a2339c8c

SHA256
a7e009b7c3a20c864366e15e2d6f0d60f448a503f5d89111d18084655b273eae

SHA512
b703209cd5d3124977199e64e9da42083d7c97d8ebbbe35e167655278e1b827fc8a2a77824d44353a789e17619e92cc1940c5ca445887b3ea5c352e069b5e31d

Download Submit
\Windows\SysWOW64\com\lsass.exe
Filesize
92KB

MD5
620f520e99115c5ba8990663a2e17e30

SHA1
e6bd2b558ee632c38aeca05a01f9ecc1a2339c8c

SHA256
a7e009b7c3a20c864366e15e2d6f0d60f448a503f5d89111d18084655b273eae

SHA512
b703209cd5d3124977199e64e9da42083d7c97d8ebbbe35e167655278e1b827fc8a2a77824d44353a789e17619e92cc1940c5ca445887b3ea5c352e069b5e31d

Download Submit
\Windows\SysWOW64\com\lsass.exe
Filesize
92KB

MD5
620f520e99115c5ba8990663a2e17e30

SHA1
e6bd2b558ee632c38aeca05a01f9ecc1a2339c8c

SHA256
a7e009b7c3a20c864366e15e2d6f0d60f448a503f5d89111d18084655b273eae

SHA512
b703209cd5d3124977199e64e9da42083d7c97d8ebbbe35e167655278e1b827fc8a2a77824d44353a789e17619e92cc1940c5ca445887b3ea5c352e069b5e31d

Download Submit
\Windows\SysWOW64\com\netcfg.dll
Filesize
16KB

MD5
d1f6b9273cbb2e23aeed11346d0072c5

SHA1
0d012a7c7b37082dcbd5e1688f72eeade705f825

SHA256
dfb2d7cdc6ea056948d09fe139255af2dcc58f3581f4a50f4e5ee0f5a03c39fc

SHA512
4c3ab878131ad38a54d04cf0d268430ab98a67df474a18ee7858c62561d90ec14c34ed63dd973fdf24115ebf17ef65a6a9fc9ac612c247903e881e584dc3b77e

Download Submit
\Windows\SysWOW64\com\smss.exe
Filesize
40KB

MD5
ae1cd1d740c265b7f18f827f9e37afab

SHA1
6b976bc56e4021e7237b3cd4dbe412b6949fb0a0

SHA256
a961e4f09ebcf11e1e384361d20d4ac031b3c159b9e6d50e3b4612102bef2a11

SHA512
c8f973cbece698f0701171be501c5c24fb77345c05c136ba992b97f74b81c0487e4039c5bb9b43176cc3815e8f2181377811a8a4d8fb08f741fa304767b50571

Download Submit
\Windows\SysWOW64\com\smss.exe
Filesize
40KB

MD5
ae1cd1d740c265b7f18f827f9e37afab

SHA1
6b976bc56e4021e7237b3cd4dbe412b6949fb0a0

SHA256
a961e4f09ebcf11e1e384361d20d4ac031b3c159b9e6d50e3b4612102bef2a11

SHA512
c8f973cbece698f0701171be501c5c24fb77345c05c136ba992b97f74b81c0487e4039c5bb9b43176cc3815e8f2181377811a8a4d8fb08f741fa304767b50571

Download Submit
\Windows\SysWOW64\dnsq.dll
Filesize
31KB

MD5
f515bd3278588b6d58a316d059e2778f

SHA1
ae8d987f33930d305b9d60685549dcabefa8e932

SHA256
5c8d02e0398882cb177fe91068fb31cf28fa401c7c060692ca2fda86479f9310

SHA512
688227aa4355cc7c156327992ae855b2aae294f12bb786bc71fb30690af3f46ad32ae360f004b899a575d833636b0c546005c85313c325e1893e5e67c9d1121c

Download Submit
\Windows\SysWOW64\dnsq.dll
Filesize
31KB

MD5
f515bd3278588b6d58a316d059e2778f

SHA1
ae8d987f33930d305b9d60685549dcabefa8e932

SHA256
5c8d02e0398882cb177fe91068fb31cf28fa401c7c060692ca2fda86479f9310

SHA512
688227aa4355cc7c156327992ae855b2aae294f12bb786bc71fb30690af3f46ad32ae360f004b899a575d833636b0c546005c85313c325e1893e5e67c9d1121c

Download Submit
\Windows\SysWOW64\dnsq.dll
Filesize
31KB

MD5
f515bd3278588b6d58a316d059e2778f

SHA1
ae8d987f33930d305b9d60685549dcabefa8e932

SHA256
5c8d02e0398882cb177fe91068fb31cf28fa401c7c060692ca2fda86479f9310

SHA512
688227aa4355cc7c156327992ae855b2aae294f12bb786bc71fb30690af3f46ad32ae360f004b899a575d833636b0c546005c85313c325e1893e5e67c9d1121c

Download Submit
memory/304-104-0x0000000000000000-mapping.dmp

Download
memory/560-94-0x0000000000000000-mapping.dmp

Download
memory/580-98-0x0000000000000000-mapping.dmp

Download
memory/596-68-0x0000000000000000-mapping.dmp

Download
memory/644-55-0x0000000000000000-mapping.dmp

Download
memory/696-65-0x0000000000000000-mapping.dmp

Download
memory/1060-82-0x0000000000000000-mapping.dmp

Download
memory/1060-119-0x0000000010000000-0x0000000010019000-memory.dmp

Filesize
100KB

Download
memory/1060-105-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/1080-90-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/1080-61-0x0000000000000000-mapping.dmp

Download
memory/1080-72-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/1152-111-0x0000000000000000-mapping.dmp

Download
memory/1152-120-0x0000000010000000-0x0000000010019000-memory.dmp

Filesize
100KB

Download
memory/1160-93-0x0000000000000000-mapping.dmp

Download
memory/1184-92-0x0000000000000000-mapping.dmp

Download
memory/1204-56-0x0000000000000000-mapping.dmp

Download
memory/1204-95-0x0000000000000000-mapping.dmp

Download
memory/1296-122-0x0000000000000000-mapping.dmp

Download
memory/1428-69-0x0000000000000000-mapping.dmp

Download
memory/1580-96-0x0000000000000000-mapping.dmp

Download
memory/1628-124-0x0000000000000000-mapping.dmp

Download
memory/1632-123-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/1632-115-0x0000000010000000-0x0000000010019000-memory.dmp

Filesize
100KB

Download
memory/1632-103-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/1632-77-0x0000000000000000-mapping.dmp

Download
memory/1696-54-0x00000000766D1000-0x00000000766D3000-memory.dmp

Filesize
8KB

Download
memory/1696-64-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/1696-58-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/1704-83-0x0000000000000000-mapping.dmp

Download
memory/1764-101-0x0000000000000000-mapping.dmp

Download
memory/1792-66-0x0000000000000000-mapping.dmp

Download
memory/1828-67-0x0000000000000000-mapping.dmp

Download
memory/1884-57-0x0000000000000000-mapping.dmp

Download
memory/1908-91-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/1908-86-0x0000000000000000-mapping.dmp

Download
memory/1936-74-0x0000000000000000-mapping.dmp

Download
memory/1956-121-0x0000000000000000-mapping.dmp

Download
memory/1996-70-0x0000000000000000-mapping.dmp

Download
memory/2004-106-0x0000000000000000-mapping.dmp

Download