35424f2a7588880cd318c667729b0217fa8ae592accef251b9713a396ed653a2

Analysis

max time kernel
151s
max time network
147s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
24/11/2022, 08:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

35424f2a7588880cd318c667729b0217fa8ae592accef251b9713a396ed653a2.exe
Size

935KB
MD5

499f9f1ef96f7ceaff8822a219e2d721
SHA1

a653e05a45f9f47651af89e34b1f856dbde82820
SHA256

35424f2a7588880cd318c667729b0217fa8ae592accef251b9713a396ed653a2
SHA512

d0e1aab02508455afb453feb0e9e940d107951e4de30a27c00b12c188d0446b34adf985310822e46d6a5b625930881cc7750c66876e96d30f818ffd3c098e5f5
SSDEEP

12288:ELnhM2vZsZ2NDSgB/ZVL5WxewJB6LOgPe2ubegiUAyNiRnj17+o7QLZrvXxNcs:E6WZsgVSqxVLEewn6PPSribR7+hNTXB

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1352	csrssv.exe
1080	DCN_PRO_FREE_5_11_2557.exe

Loads dropped DLL 9 IoCs

pid	Process
1144	35424f2a7588880cd318c667729b0217fa8ae592accef251b9713a396ed653a2.exe
1352	csrssv.exe
1352	csrssv.exe
1144	35424f2a7588880cd318c667729b0217fa8ae592accef251b9713a396ed653a2.exe
1144	35424f2a7588880cd318c667729b0217fa8ae592accef251b9713a396ed653a2.exe
1080	DCN_PRO_FREE_5_11_2557.exe
1080	DCN_PRO_FREE_5_11_2557.exe
1080	DCN_PRO_FREE_5_11_2557.exe
1080	DCN_PRO_FREE_5_11_2557.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\botweb = "C:\\Users\\Admin\\AppData\\Local\\Temp\\csrssv.exe"	csrssv.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Kills process with taskkill 2 IoCs

evasion

pid	Process
432	taskkill.exe
588	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 59 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DOMStorage\dcn-mode.blogspot.com\ = "87"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "29"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DOMStorage\dcn-mode.blogspot.com	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DOMStorage\dcn-mode.blogspot.com\ = "29"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 801c95ad0400d901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DOMStorage\blogspot.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DOMStorage\dcn-mode.blogspot.com\ = "55"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000fbec07815684004d899a318f710de6af00000000020000000000106600000001000020000000a2d308545a538726a2be06a6a046eec8eded16de2ca072dc46758ab5b0304b58000000000e8000000002000020000000bf7e1552472464b3dc5cd3c8b447d38c6705506bf26ec2560839ecae36bb115f20000000c8cde5802eeb7eefea54ebfef7d1ee0c5d110f7282dd92c0752a3faf660df8cb4000000062de95801861674e6f706577a5546a2a1b34ea8cf7be95de9186457b471949ed51ba985fa18678b9553ae4b1dcd212c3ab760f9d906a80ae0187f44c78927520	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CF5A5FB1-6BF7-11ED-BF99-4ED4A804E0FC} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DOMStorage\blogspot.com	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "87"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DOMStorage\neexulro.net\NumberOfSubdomains = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DOMStorage\blogspot.com\Total = "55"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DOMStorage\neexulro.net	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DOMStorage\adf.ly\NumberOfSubdomains = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DOMStorage\adf.ly	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "376059746"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main	csrssv.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "55"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000fbec07815684004d899a318f710de6af00000000020000000000106600000001000020000000b67aec332c0fdac58519e2bbc0896991b456125208f93e8230aaabad555d0dcd000000000e8000000002000020000000690ed2d083dc478c5ae8f744a0a9cff6d9abb2d5094d3496a0184a4a7c55c53490000000817de8b42b6f4e749865229b5942b5b57dcf33885c821ce66b64e0ca20fcbe8eb81de060feb56566546583db63153600c4232ac39545757b43da211f430072b6a09c5a659093aa70167efa1b9994263b409ba4687fd2ed0776ec77f9d1fd0833e7ebe5965b03edfc881f8d8c1a8166a8f362a932ea4604990c0193e71f057bdc636c20e55f84ac5f2e7ce27a22ac13ed400000003207ba587d0e3be828dd79ec4041c46cab5d01c27c29ea55d4840e47ff630d8a5b410cf8f68e1f1b75935df889d98bad7f440ee6871e3b07c5b9626a13455acb	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DOMStorage\blogspot.com\Total = "29"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DOMStorage\blogspot.com\Total = "87"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1080	DCN_PRO_FREE_5_11_2557.exe
1080	DCN_PRO_FREE_5_11_2557.exe
1352	csrssv.exe
1352	csrssv.exe
1352	csrssv.exe
1080	DCN_PRO_FREE_5_11_2557.exe
1080	DCN_PRO_FREE_5_11_2557.exe
1080	DCN_PRO_FREE_5_11_2557.exe
1080	DCN_PRO_FREE_5_11_2557.exe
1080	DCN_PRO_FREE_5_11_2557.exe
1080	DCN_PRO_FREE_5_11_2557.exe
1080	DCN_PRO_FREE_5_11_2557.exe
1080	DCN_PRO_FREE_5_11_2557.exe
1080	DCN_PRO_FREE_5_11_2557.exe
1080	DCN_PRO_FREE_5_11_2557.exe
1080	DCN_PRO_FREE_5_11_2557.exe
1080	DCN_PRO_FREE_5_11_2557.exe
1080	DCN_PRO_FREE_5_11_2557.exe
1080	DCN_PRO_FREE_5_11_2557.exe
1080	DCN_PRO_FREE_5_11_2557.exe
1080	DCN_PRO_FREE_5_11_2557.exe
1080	DCN_PRO_FREE_5_11_2557.exe
1080	DCN_PRO_FREE_5_11_2557.exe
1080	DCN_PRO_FREE_5_11_2557.exe
1080	DCN_PRO_FREE_5_11_2557.exe
1080	DCN_PRO_FREE_5_11_2557.exe
1080	DCN_PRO_FREE_5_11_2557.exe
1080	DCN_PRO_FREE_5_11_2557.exe
1080	DCN_PRO_FREE_5_11_2557.exe
1080	DCN_PRO_FREE_5_11_2557.exe
1080	DCN_PRO_FREE_5_11_2557.exe
1080	DCN_PRO_FREE_5_11_2557.exe
1080	DCN_PRO_FREE_5_11_2557.exe
1080	DCN_PRO_FREE_5_11_2557.exe
1080	DCN_PRO_FREE_5_11_2557.exe
1080	DCN_PRO_FREE_5_11_2557.exe
1080	DCN_PRO_FREE_5_11_2557.exe
1080	DCN_PRO_FREE_5_11_2557.exe
1080	DCN_PRO_FREE_5_11_2557.exe
1080	DCN_PRO_FREE_5_11_2557.exe
1080	DCN_PRO_FREE_5_11_2557.exe
1080	DCN_PRO_FREE_5_11_2557.exe
1080	DCN_PRO_FREE_5_11_2557.exe
1080	DCN_PRO_FREE_5_11_2557.exe
1080	DCN_PRO_FREE_5_11_2557.exe
1080	DCN_PRO_FREE_5_11_2557.exe
1080	DCN_PRO_FREE_5_11_2557.exe
1080	DCN_PRO_FREE_5_11_2557.exe
1080	DCN_PRO_FREE_5_11_2557.exe
1080	DCN_PRO_FREE_5_11_2557.exe
1080	DCN_PRO_FREE_5_11_2557.exe
1080	DCN_PRO_FREE_5_11_2557.exe
1080	DCN_PRO_FREE_5_11_2557.exe
1080	DCN_PRO_FREE_5_11_2557.exe
1080	DCN_PRO_FREE_5_11_2557.exe
1080	DCN_PRO_FREE_5_11_2557.exe
1080	DCN_PRO_FREE_5_11_2557.exe
1080	DCN_PRO_FREE_5_11_2557.exe
1080	DCN_PRO_FREE_5_11_2557.exe
1080	DCN_PRO_FREE_5_11_2557.exe
1080	DCN_PRO_FREE_5_11_2557.exe
1080	DCN_PRO_FREE_5_11_2557.exe
1080	DCN_PRO_FREE_5_11_2557.exe
1080	DCN_PRO_FREE_5_11_2557.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	588	taskkill.exe
Token: SeDebugPrivilege	432	taskkill.exe
Token: SeDebugPrivilege	1352	csrssv.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
840	iexplore.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
1080	DCN_PRO_FREE_5_11_2557.exe
840	iexplore.exe
840	iexplore.exe
1880	IEXPLORE.EXE
1880	IEXPLORE.EXE
1352	csrssv.exe
1352	csrssv.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 1144 wrote to memory of 1352	1144	35424f2a7588880cd318c667729b0217fa8ae592accef251b9713a396ed653a2.exe	28
PID 1144 wrote to memory of 1352	1144	35424f2a7588880cd318c667729b0217fa8ae592accef251b9713a396ed653a2.exe	28
PID 1144 wrote to memory of 1352	1144	35424f2a7588880cd318c667729b0217fa8ae592accef251b9713a396ed653a2.exe	28
PID 1144 wrote to memory of 1352	1144	35424f2a7588880cd318c667729b0217fa8ae592accef251b9713a396ed653a2.exe	28
PID 1144 wrote to memory of 1352	1144	35424f2a7588880cd318c667729b0217fa8ae592accef251b9713a396ed653a2.exe	28
PID 1144 wrote to memory of 1352	1144	35424f2a7588880cd318c667729b0217fa8ae592accef251b9713a396ed653a2.exe	28
PID 1144 wrote to memory of 1352	1144	35424f2a7588880cd318c667729b0217fa8ae592accef251b9713a396ed653a2.exe	28
PID 1144 wrote to memory of 1080	1144	35424f2a7588880cd318c667729b0217fa8ae592accef251b9713a396ed653a2.exe	29
PID 1144 wrote to memory of 1080	1144	35424f2a7588880cd318c667729b0217fa8ae592accef251b9713a396ed653a2.exe	29
PID 1144 wrote to memory of 1080	1144	35424f2a7588880cd318c667729b0217fa8ae592accef251b9713a396ed653a2.exe	29
PID 1144 wrote to memory of 1080	1144	35424f2a7588880cd318c667729b0217fa8ae592accef251b9713a396ed653a2.exe	29
PID 1144 wrote to memory of 1080	1144	35424f2a7588880cd318c667729b0217fa8ae592accef251b9713a396ed653a2.exe	29
PID 1144 wrote to memory of 1080	1144	35424f2a7588880cd318c667729b0217fa8ae592accef251b9713a396ed653a2.exe	29
PID 1144 wrote to memory of 1080	1144	35424f2a7588880cd318c667729b0217fa8ae592accef251b9713a396ed653a2.exe	29
PID 1080 wrote to memory of 432	1080	DCN_PRO_FREE_5_11_2557.exe	30
PID 1080 wrote to memory of 432	1080	DCN_PRO_FREE_5_11_2557.exe	30
PID 1080 wrote to memory of 432	1080	DCN_PRO_FREE_5_11_2557.exe	30
PID 1080 wrote to memory of 432	1080	DCN_PRO_FREE_5_11_2557.exe	30
PID 1080 wrote to memory of 432	1080	DCN_PRO_FREE_5_11_2557.exe	30
PID 1080 wrote to memory of 432	1080	DCN_PRO_FREE_5_11_2557.exe	30
PID 1080 wrote to memory of 432	1080	DCN_PRO_FREE_5_11_2557.exe	30
PID 1080 wrote to memory of 588	1080	DCN_PRO_FREE_5_11_2557.exe	31
PID 1080 wrote to memory of 588	1080	DCN_PRO_FREE_5_11_2557.exe	31
PID 1080 wrote to memory of 588	1080	DCN_PRO_FREE_5_11_2557.exe	31
PID 1080 wrote to memory of 588	1080	DCN_PRO_FREE_5_11_2557.exe	31
PID 1080 wrote to memory of 588	1080	DCN_PRO_FREE_5_11_2557.exe	31
PID 1080 wrote to memory of 588	1080	DCN_PRO_FREE_5_11_2557.exe	31
PID 1080 wrote to memory of 588	1080	DCN_PRO_FREE_5_11_2557.exe	31
PID 1080 wrote to memory of 840	1080	DCN_PRO_FREE_5_11_2557.exe	34
PID 1080 wrote to memory of 840	1080	DCN_PRO_FREE_5_11_2557.exe	34
PID 1080 wrote to memory of 840	1080	DCN_PRO_FREE_5_11_2557.exe	34
PID 1080 wrote to memory of 840	1080	DCN_PRO_FREE_5_11_2557.exe	34
PID 840 wrote to memory of 1880	840	iexplore.exe	37
PID 840 wrote to memory of 1880	840	iexplore.exe	37
PID 840 wrote to memory of 1880	840	iexplore.exe	37
PID 840 wrote to memory of 1880	840	iexplore.exe	37
PID 840 wrote to memory of 1880	840	iexplore.exe	37
PID 840 wrote to memory of 1880	840	iexplore.exe	37
PID 840 wrote to memory of 1880	840	iexplore.exe	37

C:\Users\Admin\AppData\Local\Temp\35424f2a7588880cd318c667729b0217fa8ae592accef251b9713a396ed653a2.exe
"C:\Users\Admin\AppData\Local\Temp\35424f2a7588880cd318c667729b0217fa8ae592accef251b9713a396ed653a2.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1144
- C:\Users\Admin\AppData\Local\Temp\csrssv.exe
  "C:\Users\Admin\AppData\Local\Temp\csrssv.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:1352
- C:\Users\Admin\AppData\Local\Temp\DCN_PRO_FREE_5_11_2557.exe
  "C:\Users\Admin\AppData\Local\Temp\DCN_PRO_FREE_5_11_2557.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1080
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill.exe /f /t /im PointBlank.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:432
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill.exe /f /t /im HSUpdate.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:588
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" http://dcn-mode.blogspot.com/
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:840
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:840 CREDAT:275457 /prefetch:2
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:1880

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Web Service

T1102

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
735f8c983261ae17c3b090bdd13b340c

SHA1
d6640fbf2c7a22c7de877b47a65a17bff287ea16

SHA256
7c748a46daab271f0abfb2ba569c1ebf01cc7cc9a8287226eabbc6131afb541a

SHA512
397db7e712081c17d3eff943db4df4f869c5f8d21a71af176c80cba3815c5c8ff563edfdc5044c8a4710fa36f79612d572dbeb796d2da9f82b85889c996bd53d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6adadd1700d34fafec05c2b45b8242b8

SHA1
952dc2cf4f271d725848befb3b969a714602e742

SHA256
0161bc13f52f11c8bdb6b3cb84f80ac80d23865ad54411133f7ac105751cd476

SHA512
d0e3d14cacf80d6bb914bb19a56198483b10964955d2fc19caf4d9beed5329681c7120ef0d807275dbceb27be15426fcafbfbbc250c0fa4d710703dd6f4e019b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
833c207edc2348b218a358474e80c333

SHA1
f072ce2c37e57853fb5aa8e9d6b7f27fade71b68

SHA256
a1e7bf22d5c13dce8afa81004c9be43aa57a86943b0ac83cc269ffa58e5e1ae5

SHA512
bd1065cedc75c77d6cf7c567e10ae09c9b4477767fb27dee658c358dabaf4bff5a4ee9031c3cc1ce3baa1bc9c6d9506951671eb98bcebf0b600507b3000786aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\try74lz\imagestore.dat

Filesize
1KB

MD5
fbf776bb3a6532ba443bb65767e74e58

SHA1
6a154f88fc49467932daf503d9ed24b5937f3731

SHA256
8209678fbbefa2e76f12e7ae6a43f33ec03fc35dbf51405a30e47c53ef63f0a5

SHA512
972e6169fdffec5c16133be31f1bffe90de42a1acdf23b023195c60140159757539fd15b038e0143cb0526e6cd95f13c9c8e6f6cd79f11d0373c3262ee574d99

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\try74lz\imagestore.dat

Filesize
2KB

MD5
be753a8a78f817daee022f55d62605d2

SHA1
126c5ccc2e885df604ef605794ffefff62192a31

SHA256
739b684f284e1a1bc9f9ac940aac058558dbe875e2bea60f11a34a3fdf9e985e

SHA512
e3eace8a8b40e6a5b24a5097f1bcbdcf90c8237908a0ce82deb5e773adc172bd0db0c97768a369506eef15ffe96ae4ffe7f5b3858862151d633a4d7e4beb810c

Download Submit
C:\Users\Admin\AppData\Local\Temp\DCN_PRO_FREE_5_11_2557.exe

Filesize
928KB

MD5
0eaadd57af672c96ef783e2cdde33e22

SHA1
94976680286acc8e2ef58aae4a48571ea99401c4

SHA256
69d39b50c4097abd42873137fe44da9b3302495ab9dfab4862e6b4aafb7e7204

SHA512
85c9f67daac5b087bbc4e91adc6a40a20467d528c3a768dcd43aff395eebe5e1f4c9f1ff24b041ce7a2acbd8fb7c8faca077a7b17b5018a60a24829d53071d31

Download Submit
C:\Users\Admin\AppData\Local\Temp\DCN_PRO_FREE_5_11_2557.exe

Filesize
928KB

MD5
0eaadd57af672c96ef783e2cdde33e22

SHA1
94976680286acc8e2ef58aae4a48571ea99401c4

SHA256
69d39b50c4097abd42873137fe44da9b3302495ab9dfab4862e6b4aafb7e7204

SHA512
85c9f67daac5b087bbc4e91adc6a40a20467d528c3a768dcd43aff395eebe5e1f4c9f1ff24b041ce7a2acbd8fb7c8faca077a7b17b5018a60a24829d53071d31

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrssv.exe

Filesize
20KB

MD5
7f5831d9f3d7b1ad4965fc726a9ddf92

SHA1
b60a6f053bfc9b86f26e0c8004c21cf83ccd63f5

SHA256
841d7779224e9a3a96a712b040586be5928f3f1646fe6ce187a9f080a40be3a5

SHA512
75dabd08271bc490553c8d0cd8a624a391cb222cbbea7df55d883f21b820fc844d89b9d18b1c39600469c4beae33da46d2c0fd095328ad7020bb9e32a478014c

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrssv.exe

Filesize
20KB

MD5
7f5831d9f3d7b1ad4965fc726a9ddf92

SHA1
b60a6f053bfc9b86f26e0c8004c21cf83ccd63f5

SHA256
841d7779224e9a3a96a712b040586be5928f3f1646fe6ce187a9f080a40be3a5

SHA512
75dabd08271bc490553c8d0cd8a624a391cb222cbbea7df55d883f21b820fc844d89b9d18b1c39600469c4beae33da46d2c0fd095328ad7020bb9e32a478014c

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\JJB82Q65.txt

Filesize
608B

MD5
e7da0ce50be13c63b104e88cdfcf7596

SHA1
8b0f3527d805af5982107d91e22fc4ccb791f7e3

SHA256
bcddc644c7a3d7b784964d6ac84b49cee6ebde2d7ca3ed750b26f6f30eb039c1

SHA512
01753bf20402ea09dd2222096b7ed97f5116e89d66f9231ac14488466f2d32cd576a4bec0e8add62d83c6fdce65f80fd16db209b5e1be1309f70fa8b0b1dd0e8

Download Submit
\Users\Admin\AppData\Local\Temp\DCN_PRO_FREE_5_11_2557.exe

Filesize
928KB

MD5
0eaadd57af672c96ef783e2cdde33e22

SHA1
94976680286acc8e2ef58aae4a48571ea99401c4

SHA256
69d39b50c4097abd42873137fe44da9b3302495ab9dfab4862e6b4aafb7e7204

SHA512
85c9f67daac5b087bbc4e91adc6a40a20467d528c3a768dcd43aff395eebe5e1f4c9f1ff24b041ce7a2acbd8fb7c8faca077a7b17b5018a60a24829d53071d31

Download Submit
\Users\Admin\AppData\Local\Temp\DCN_PRO_FREE_5_11_2557.exe

Filesize
928KB

MD5
0eaadd57af672c96ef783e2cdde33e22

SHA1
94976680286acc8e2ef58aae4a48571ea99401c4

SHA256
69d39b50c4097abd42873137fe44da9b3302495ab9dfab4862e6b4aafb7e7204

SHA512
85c9f67daac5b087bbc4e91adc6a40a20467d528c3a768dcd43aff395eebe5e1f4c9f1ff24b041ce7a2acbd8fb7c8faca077a7b17b5018a60a24829d53071d31

Download Submit
\Users\Admin\AppData\Local\Temp\DCN_PRO_FREE_5_11_2557.exe

Filesize
928KB

MD5
0eaadd57af672c96ef783e2cdde33e22

SHA1
94976680286acc8e2ef58aae4a48571ea99401c4

SHA256
69d39b50c4097abd42873137fe44da9b3302495ab9dfab4862e6b4aafb7e7204

SHA512
85c9f67daac5b087bbc4e91adc6a40a20467d528c3a768dcd43aff395eebe5e1f4c9f1ff24b041ce7a2acbd8fb7c8faca077a7b17b5018a60a24829d53071d31

Download Submit
\Users\Admin\AppData\Local\Temp\DCN_PRO_FREE_5_11_2557.exe

Filesize
928KB

MD5
0eaadd57af672c96ef783e2cdde33e22

SHA1
94976680286acc8e2ef58aae4a48571ea99401c4

SHA256
69d39b50c4097abd42873137fe44da9b3302495ab9dfab4862e6b4aafb7e7204

SHA512
85c9f67daac5b087bbc4e91adc6a40a20467d528c3a768dcd43aff395eebe5e1f4c9f1ff24b041ce7a2acbd8fb7c8faca077a7b17b5018a60a24829d53071d31

Download Submit
\Users\Admin\AppData\Local\Temp\DCN_PRO_FREE_5_11_2557.exe

Filesize
928KB

MD5
0eaadd57af672c96ef783e2cdde33e22

SHA1
94976680286acc8e2ef58aae4a48571ea99401c4

SHA256
69d39b50c4097abd42873137fe44da9b3302495ab9dfab4862e6b4aafb7e7204

SHA512
85c9f67daac5b087bbc4e91adc6a40a20467d528c3a768dcd43aff395eebe5e1f4c9f1ff24b041ce7a2acbd8fb7c8faca077a7b17b5018a60a24829d53071d31

Download Submit
\Users\Admin\AppData\Local\Temp\DCN_PRO_FREE_5_11_2557.exe

Filesize
928KB

MD5
0eaadd57af672c96ef783e2cdde33e22

SHA1
94976680286acc8e2ef58aae4a48571ea99401c4

SHA256
69d39b50c4097abd42873137fe44da9b3302495ab9dfab4862e6b4aafb7e7204

SHA512
85c9f67daac5b087bbc4e91adc6a40a20467d528c3a768dcd43aff395eebe5e1f4c9f1ff24b041ce7a2acbd8fb7c8faca077a7b17b5018a60a24829d53071d31

Download Submit
\Users\Admin\AppData\Local\Temp\csrssv.exe

Filesize
20KB

MD5
7f5831d9f3d7b1ad4965fc726a9ddf92

SHA1
b60a6f053bfc9b86f26e0c8004c21cf83ccd63f5

SHA256
841d7779224e9a3a96a712b040586be5928f3f1646fe6ce187a9f080a40be3a5

SHA512
75dabd08271bc490553c8d0cd8a624a391cb222cbbea7df55d883f21b820fc844d89b9d18b1c39600469c4beae33da46d2c0fd095328ad7020bb9e32a478014c

Download Submit
\Users\Admin\AppData\Local\Temp\csrssv.exe

Filesize
20KB

MD5
7f5831d9f3d7b1ad4965fc726a9ddf92

SHA1
b60a6f053bfc9b86f26e0c8004c21cf83ccd63f5

SHA256
841d7779224e9a3a96a712b040586be5928f3f1646fe6ce187a9f080a40be3a5

SHA512
75dabd08271bc490553c8d0cd8a624a391cb222cbbea7df55d883f21b820fc844d89b9d18b1c39600469c4beae33da46d2c0fd095328ad7020bb9e32a478014c

Download Submit
\Users\Admin\AppData\Local\Temp\csrssv.exe

Filesize
20KB

MD5
7f5831d9f3d7b1ad4965fc726a9ddf92

SHA1
b60a6f053bfc9b86f26e0c8004c21cf83ccd63f5

SHA256
841d7779224e9a3a96a712b040586be5928f3f1646fe6ce187a9f080a40be3a5

SHA512
75dabd08271bc490553c8d0cd8a624a391cb222cbbea7df55d883f21b820fc844d89b9d18b1c39600469c4beae33da46d2c0fd095328ad7020bb9e32a478014c

Download Submit
memory/1144-54-0x0000000075091000-0x0000000075093000-memory.dmp

Filesize
8KB

Download
memory/1352-81-0x0000000000CD9000-0x0000000000CEA000-memory.dmp

Filesize
68KB

Download
memory/1352-80-0x0000000073D70000-0x000000007431B000-memory.dmp

Filesize
5.7MB

Download
memory/1352-79-0x0000000000CD9000-0x0000000000CEA000-memory.dmp

Filesize
68KB

Download
memory/1352-78-0x0000000073D70000-0x000000007431B000-memory.dmp

Filesize
5.7MB

Download