5b25ef51a2a70e11d3e37c95099b522e61fd64f8a382ff2516a69a8584b74b16

Analysis

max time kernel
151s
max time network
149s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
25-11-2022 22:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5b25ef51a2a70e11d3e37c95099b522e61fd64f8a382ff2516a69a8584b74b16.exe
Size

819KB
MD5

3fabe8f4e16f5e8b3df2992d4ba71c47
SHA1

c156a8928ddff7c1009cfcb6c87bca6a788d8d0a
SHA256

5b25ef51a2a70e11d3e37c95099b522e61fd64f8a382ff2516a69a8584b74b16
SHA512

a033a8e1b74daf7adfbe797373e1c1a9ff9a761538377de855655fc8e4350e3646e25cf870b9a4f5c16d45d5e43f7742c80ec46b8a175c84959944564cb3fa2a
SSDEEP

24576:v2O/GliJMDVMZpqa/brHkNbuvrl+YXOUs:ZUpEbzkN4xdOp

Score

9^/10

aspackv2 persistence spyware stealer upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

Processes:

resource	yara_rule
\Windows\SysWOW64\JFyGwy.dll	acprotect

ASPack v2.12-2.42 8 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

Processes:

resource	yara_rule
\Windows\Web\CDClient.exe	aspack_v212_v242
\Windows\Web\CDClient.exe	aspack_v212_v242
\Windows\Web\CDClient.exe	aspack_v212_v242
\Windows\Web\CDClient.exe	aspack_v212_v242
C:\Windows\Web\CDClient.exe	aspack_v212_v242
\Users\Admin\AppData\Local\Temp\E22450\AGCIsJw.dll	aspack_v212_v242
\Users\Admin\AppData\Local\Temp\E22450\mrtGvEH.dll	aspack_v212_v242
C:\Windows\Web\CDClient.exe	aspack_v212_v242

Executes dropped EXE 1 IoCs

Processes:

CDClient.exe

pid process

956 CDClient.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

CDClient.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\CDClient64.sys\ImagePath = "\\??\\C:\\Windows\\CDClient64.sys"	CDClient.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
\Windows\SysWOW64\JFyGwy.dll	upx
behavioral1/memory/956-80-0x0000000074A50000-0x0000000074A73000-memory.dmp	upx

Loads dropped DLL 7 IoCs

Processes:

5b25ef51a2a70e11d3e37c95099b522e61fd64f8a382ff2516a69a8584b74b16.exeCDClient.exe

pid	process
604	5b25ef51a2a70e11d3e37c95099b522e61fd64f8a382ff2516a69a8584b74b16.exe
604	5b25ef51a2a70e11d3e37c95099b522e61fd64f8a382ff2516a69a8584b74b16.exe
604	5b25ef51a2a70e11d3e37c95099b522e61fd64f8a382ff2516a69a8584b74b16.exe
604	5b25ef51a2a70e11d3e37c95099b522e61fd64f8a382ff2516a69a8584b74b16.exe
956	CDClient.exe
956	CDClient.exe
956	CDClient.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Drops file in System32 directory 4 IoCs

Processes:

CDClient.exe

description	ioc	process
File created	C:\Windows\SysWOW64\JFyGwy.dll	CDClient.exe
File created	C:\Windows\SysWOW64\89000.dat	CDClient.exe
File created	C:\Windows\SysWOW64\091301.bat	CDClient.exe
File created	C:\Windows\SysWOW64\091308.bat	CDClient.exe

Drops file in Windows directory 6 IoCs

Processes:

5b25ef51a2a70e11d3e37c95099b522e61fd64f8a382ff2516a69a8584b74b16.exeCDClient.exe

description	ioc	process
File created	C:\Windows\Web\CDClient.exe	5b25ef51a2a70e11d3e37c95099b522e61fd64f8a382ff2516a69a8584b74b16.exe
File opened for modification	C:\Windows\Web\CDClient.exe	5b25ef51a2a70e11d3e37c95099b522e61fd64f8a382ff2516a69a8584b74b16.exe
File created	C:\Windows\CDClient64.sys	CDClient.exe
File created	C:\Windows\Web\__tmp_rar_sfx_access_check_7102819	5b25ef51a2a70e11d3e37c95099b522e61fd64f8a382ff2516a69a8584b74b16.exe
File created	C:\Windows\Web\配置.txt	5b25ef51a2a70e11d3e37c95099b522e61fd64f8a382ff2516a69a8584b74b16.exe
File opened for modification	C:\Windows\Web\配置.txt	5b25ef51a2a70e11d3e37c95099b522e61fd64f8a382ff2516a69a8584b74b16.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 50 IoCs

adware spyware

Modify Registry

T1112

Processes:

CDClient.exeIEXPLORE.EXEIEXPLORE.EXE

description	ioc	process
Key deleted	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TypedURLs	CDClient.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\IntelliForms	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main	CDClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008eabd94cfba0634cb91252fd615784ae00000000020000000000106600000001000020000000de00be98bc816ee48ccd26557812ced7802aa04a27d856704e5dd9415478dd00000000000e8000000002000020000000d6a562e322127238a04af498334161693d404a7cf2014f7fadd3d5e3a293191d20000000c0802e6ae32a085838553145c8aef892007b94f470673658141dd8badc95170540000000ff8d569aa09369bba011323e935f2ae70f0acb15320ee1f8d50f090f53d74495fa8f5683634529be31c56a8d42a8f7b8b9f70eb9ef5ac8e9b47fa1989291a026	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Toolbar	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DOMStorage\so.com	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.so.com\ = "26"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008eabd94cfba0634cb91252fd615784ae000000000200000000001066000000010000200000003ea6a4fce946504225297aa4807cd1cc70cf4a5da714f1c4d1ce896f0f5c2d04000000000e8000000002000020000000c2dbaf00d4d2539a37cdb91f22979f9ee99fb03398cc1bf929680f9d8c048a1390000000d4f56d856de77065b55471e2d42583ebc740fd05cf39d5ff71a2ba359b84a4d68192157a2db65acb16cbf27a19b204dd9e4793e4b6a12425744e30007727b22fe009ff33e1d86a712fec971afbcffdb2cab1352e79d256605f2a878e5c195357be7ea6d6d5e31fe5341d5bea38a3d12f206f041c6bb3394327ceeefb9d5408b1de5f32f9b9017aa801d408204905c56b40000000963c315b2c20ca845ef0aa47789a1bd8e817314a4992873b5b45fc51930a963123b50c6f4c4ec76e9f186f8de81a4c84959c4c659c2481ba37e572c77234d68c	IEXPLORE.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extensions\{789FE86F-6FC4-46A1-9849-EDE0DB0C95CA}	CDClient.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\Local Page = "http://www.sogou.com/index.htm?pid=sogou-netb-5ac8bb8a7d745102-0001"	CDClient.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 3019f6717701d901	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8D98B671-6D6A-11ED-B40B-E20468906380} = "0"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	IEXPLORE.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extensions\{2670000A-7350-4f3c-8081-5663EE0C6C49}	CDClient.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extensions	CDClient.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\PageSetup	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "376218971"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.so.com	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DOMStorage\so.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "26"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\LowRegistry	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DOMStorage\so.com\Total = "26"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\InternetRegistry	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Zoom	IEXPLORE.EXE

Modifies Internet Explorer start page 1 TTPs 2 IoCs

stealer

Modify Registry

T1112

Processes:

CDClient.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Start Page = "http://www.sogou.com/index.htm?pid=sogou-netb-5ac8bb8a7d745102-0001"	CDClient.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://www.sogou.com/index.htm?pid=sogou-netb-5ac8bb8a7d745102-0001"	CDClient.exe

Modifies registry class 7 IoCs

Processes:

CDClient.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID	CDClient.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0002DF01-0000-0000-C000-000000000046}	CDClient.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\OpenHomePage\Command	CDClient.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}	CDClient.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell	CDClient.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\OpenHomePage	CDClient.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0002DF01-0000-0000-C000-000000000046}\LocalServer32	CDClient.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

CDClient.exe

pid	process
956	CDClient.exe
956	CDClient.exe
956	CDClient.exe
956	CDClient.exe
956	CDClient.exe
956	CDClient.exe
956	CDClient.exe
956	CDClient.exe
956	CDClient.exe
956	CDClient.exe
956	CDClient.exe
956	CDClient.exe
956	CDClient.exe
956	CDClient.exe
956	CDClient.exe
956	CDClient.exe
956	CDClient.exe
956	CDClient.exe
956	CDClient.exe
956	CDClient.exe
956	CDClient.exe
956	CDClient.exe
956	CDClient.exe
956	CDClient.exe
956	CDClient.exe
956	CDClient.exe
956	CDClient.exe
956	CDClient.exe
956	CDClient.exe
956	CDClient.exe
956	CDClient.exe
956	CDClient.exe
956	CDClient.exe
956	CDClient.exe
956	CDClient.exe
956	CDClient.exe
956	CDClient.exe
956	CDClient.exe
956	CDClient.exe
956	CDClient.exe
956	CDClient.exe
956	CDClient.exe
956	CDClient.exe
956	CDClient.exe
956	CDClient.exe
956	CDClient.exe
956	CDClient.exe
956	CDClient.exe
956	CDClient.exe
956	CDClient.exe
956	CDClient.exe
956	CDClient.exe
956	CDClient.exe
956	CDClient.exe
956	CDClient.exe
956	CDClient.exe
956	CDClient.exe
956	CDClient.exe
956	CDClient.exe
956	CDClient.exe
956	CDClient.exe
956	CDClient.exe
956	CDClient.exe
956	CDClient.exe

Suspicious behavior: LoadsDriver 1 IoCs

Processes:

CDClient.exe

pid process

956 CDClient.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

CDClient.exe

description	pid	process
Token: SeDebugPrivilege	956	CDClient.exe
Token: SeLoadDriverPrivilege	956	CDClient.exe
Token: 33	956	CDClient.exe
Token: SeIncBasePriorityPrivilege	956	CDClient.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

IEXPLORE.EXE

pid process

960 IEXPLORE.EXE
Suspicious use of SetWindowsHookEx 8 IoCs

Processes:

CDClient.exeIEXPLORE.EXEIEXPLORE.EXE

pid process

956 CDClient.exe
956 CDClient.exe
960 IEXPLORE.EXE
960 IEXPLORE.EXE
928 IEXPLORE.EXE
928 IEXPLORE.EXE
928 IEXPLORE.EXE
928 IEXPLORE.EXE

pid	process
960	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

5b25ef51a2a70e11d3e37c95099b522e61fd64f8a382ff2516a69a8584b74b16.exeCDClient.execmd.exe

description	pid	process	target process
PID 604 wrote to memory of 956	604	5b25ef51a2a70e11d3e37c95099b522e61fd64f8a382ff2516a69a8584b74b16.exe	CDClient.exe
PID 604 wrote to memory of 956	604	5b25ef51a2a70e11d3e37c95099b522e61fd64f8a382ff2516a69a8584b74b16.exe	CDClient.exe
PID 604 wrote to memory of 956	604	5b25ef51a2a70e11d3e37c95099b522e61fd64f8a382ff2516a69a8584b74b16.exe	CDClient.exe
PID 604 wrote to memory of 956	604	5b25ef51a2a70e11d3e37c95099b522e61fd64f8a382ff2516a69a8584b74b16.exe	CDClient.exe
PID 604 wrote to memory of 956	604	5b25ef51a2a70e11d3e37c95099b522e61fd64f8a382ff2516a69a8584b74b16.exe	CDClient.exe
PID 604 wrote to memory of 956	604	5b25ef51a2a70e11d3e37c95099b522e61fd64f8a382ff2516a69a8584b74b16.exe	CDClient.exe
PID 604 wrote to memory of 956	604	5b25ef51a2a70e11d3e37c95099b522e61fd64f8a382ff2516a69a8584b74b16.exe	CDClient.exe
PID 956 wrote to memory of 520	956	CDClient.exe	cmd.exe
PID 956 wrote to memory of 520	956	CDClient.exe	cmd.exe
PID 956 wrote to memory of 520	956	CDClient.exe	cmd.exe
PID 956 wrote to memory of 520	956	CDClient.exe	cmd.exe
PID 956 wrote to memory of 520	956	CDClient.exe	cmd.exe
PID 956 wrote to memory of 520	956	CDClient.exe	cmd.exe
PID 956 wrote to memory of 520	956	CDClient.exe	cmd.exe
PID 520 wrote to memory of 1628	520	cmd.exe	cmd.exe
PID 520 wrote to memory of 1628	520	cmd.exe	cmd.exe
PID 520 wrote to memory of 1628	520	cmd.exe	cmd.exe
PID 520 wrote to memory of 1628	520	cmd.exe	cmd.exe
PID 520 wrote to memory of 1628	520	cmd.exe	cmd.exe
PID 520 wrote to memory of 1628	520	cmd.exe	cmd.exe
PID 520 wrote to memory of 1628	520	cmd.exe	cmd.exe
PID 956 wrote to memory of 1340	956	CDClient.exe	Explorer.EXE
PID 956 wrote to memory of 1340	956	CDClient.exe	Explorer.EXE
PID 956 wrote to memory of 1340	956	CDClient.exe	Explorer.EXE
PID 956 wrote to memory of 1340	956	CDClient.exe	Explorer.EXE
PID 956 wrote to memory of 1340	956	CDClient.exe	Explorer.EXE
PID 956 wrote to memory of 1340	956	CDClient.exe	Explorer.EXE
PID 956 wrote to memory of 1340	956	CDClient.exe	Explorer.EXE
PID 956 wrote to memory of 1340	956	CDClient.exe	Explorer.EXE
PID 956 wrote to memory of 1340	956	CDClient.exe	Explorer.EXE
PID 956 wrote to memory of 1340	956	CDClient.exe	Explorer.EXE
PID 956 wrote to memory of 1340	956	CDClient.exe	Explorer.EXE
PID 956 wrote to memory of 1340	956	CDClient.exe	Explorer.EXE
PID 956 wrote to memory of 1340	956	CDClient.exe	Explorer.EXE
PID 956 wrote to memory of 1340	956	CDClient.exe	Explorer.EXE
PID 956 wrote to memory of 1340	956	CDClient.exe	Explorer.EXE
PID 956 wrote to memory of 1340	956	CDClient.exe	Explorer.EXE
PID 956 wrote to memory of 1340	956	CDClient.exe	Explorer.EXE
PID 956 wrote to memory of 1340	956	CDClient.exe	Explorer.EXE
PID 956 wrote to memory of 1340	956	CDClient.exe	Explorer.EXE
PID 956 wrote to memory of 1340	956	CDClient.exe	Explorer.EXE
PID 956 wrote to memory of 1340	956	CDClient.exe	Explorer.EXE
PID 956 wrote to memory of 1340	956	CDClient.exe	Explorer.EXE
PID 956 wrote to memory of 1340	956	CDClient.exe	Explorer.EXE
PID 956 wrote to memory of 1340	956	CDClient.exe	Explorer.EXE
PID 956 wrote to memory of 1340	956	CDClient.exe	Explorer.EXE
PID 956 wrote to memory of 1340	956	CDClient.exe	Explorer.EXE
PID 956 wrote to memory of 1340	956	CDClient.exe	Explorer.EXE
PID 956 wrote to memory of 1340	956	CDClient.exe	Explorer.EXE
PID 956 wrote to memory of 1340	956	CDClient.exe	Explorer.EXE
PID 956 wrote to memory of 1340	956	CDClient.exe	Explorer.EXE
PID 956 wrote to memory of 1340	956	CDClient.exe	Explorer.EXE
PID 956 wrote to memory of 1340	956	CDClient.exe	Explorer.EXE
PID 520 wrote to memory of 1768	520	cmd.exe	cmd.exe
PID 520 wrote to memory of 1768	520	cmd.exe	cmd.exe
PID 520 wrote to memory of 1768	520	cmd.exe	cmd.exe
PID 520 wrote to memory of 1768	520	cmd.exe	cmd.exe
PID 520 wrote to memory of 1768	520	cmd.exe	cmd.exe
PID 520 wrote to memory of 1768	520	cmd.exe	cmd.exe
PID 520 wrote to memory of 1768	520	cmd.exe	cmd.exe
PID 956 wrote to memory of 1340	956	CDClient.exe	Explorer.EXE
PID 956 wrote to memory of 1340	956	CDClient.exe	Explorer.EXE
PID 956 wrote to memory of 1340	956	CDClient.exe	Explorer.EXE
PID 956 wrote to memory of 1340	956	CDClient.exe	Explorer.EXE

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1340

C:\Users\Admin\AppData\Local\Temp\5b25ef51a2a70e11d3e37c95099b522e61fd64f8a382ff2516a69a8584b74b16.exe
"C:\Users\Admin\AppData\Local\Temp\5b25ef51a2a70e11d3e37c95099b522e61fd64f8a382ff2516a69a8584b74b16.exe"
2⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:604

C:\windows\WEB\CDClient.exe
"C:\windows\WEB\CDClient.exe"
3⤵
- Executes dropped EXE
- Sets service image path in registry
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:956

C:\Windows\SysWOW64\cmd.exe
cmd /c C:\Windows\SysWOW64\091301.bat
4⤵
- Suspicious use of WriteProcessMemory
PID:520

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c dir "C:\Users\Admin\Local Settings\Application Data\Mozilla\Firefox\Profiles\*.default" /B
5⤵
PID:1628

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c dir "C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\*.default" /B
5⤵
PID:1768

C:\Windows\SysWOW64\cmd.exe
cmd /c C:\Windows\SysWOW64\091308.bat
4⤵
PID:988

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c dir "C:\Users\Admin\Local Settings\Application Data\Mozilla\Firefox\Profiles\*.default" /B
5⤵
PID:1972

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c dir "C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\*.default" /B
5⤵
PID:1780

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
http://www.so.com
4⤵
PID:1996

C:\Program Files\Internet Explorer\IEXPLORE.EXE
"C:\Program Files\Internet Explorer\IEXPLORE.EXE" http://www.so.com
5⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:960

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:960 CREDAT:275457 /prefetch:2
6⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:928

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
Filesize
61KB

MD5
3dcf580a93972319e82cafbc047d34d5

SHA1
8528d2a1363e5de77dc3b1142850e51ead0f4b6b

SHA256
40810e31f1b69075c727e6d557f9614d5880112895ff6f4df1767e87ae5640d1

SHA512
98384be7218340f95dae88d1cb865f23a0b4e12855beb6e74a3752274c9b4c601e493864db777bca677a370d0a9dbffd68d94898a82014537f3a801cce839c42

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
42407474c1f77126fb8f38bd7cd7bdd9

SHA1
79a3c1519c1b09340798c737655baf3e2394b025

SHA256
b1b849ad0745052aa0578cd2733acf3177c6b962ee95bf7cdf49e95ffa40fd8a

SHA512
28c84ab58acfabf87ed723cbda211619265bba66e31ba621b02f9b1ce4e0f4cdb965e541fb539e5a4653c99125a50d571126f0507880551a7cee3e73ba831144

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\1evexod\imagestore.dat
Filesize
5KB

MD5
3219d2e33d48d371917755c9488a8092

SHA1
21389b772b59adc9e935bc783d0b8c9ceadb3049

SHA256
514394861d5029a6f788337a5ad2d87f16043898fa56c145a4d38f65b7d6bee9

SHA512
87bba0be61bb8b5c4c492e4ad618df284f4304125acbba2a563c1bedf55292e988498b46b92b39379f38900c9b2530a9f9354e33bc0a01fdc675e8d044382b41

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\Z101RX2F.txt
Filesize
608B

MD5
e67f6720a7b6c3951a27f2eae1d99ff8

SHA1
5e21ed1a7ba5f300cb49b560a1e1f2d7b2ed81b3

SHA256
2f064d1e8c38e95f6fa665b26e6e17950a1f757ae6abe036df2741fed8f39892

SHA512
05b29253188b46fb3905617c294c33c364f5f157d4ceb4590ec5bfc2e62718d3668082927fd8fb0a8cef1899601ac64d427933d512838e4f757a5fd7e22a93f4

Download Submit
C:\Windows\SysWOW64\091301.bat
Filesize
5KB

MD5
ad0d80bf6b4292dbada25f7f8fd6556c

SHA1
40133d1dea9905bf406fb88efcb57cd693e6cf43

SHA256
081f45a04b555b2406e5b63afbcdba4e564c3157e7d3720d21e8f53d2127bae1

SHA512
76eaacabecaaed7b4eb53fbc5db4d53b15ccdbe6526119346dc444e932cc1ebfffb74b0df3f54c85168d72082f9017802e9775bc178a58fcac0ab3c1ddb519cb

Download Submit
C:\Windows\SysWOW64\091308.bat
Filesize
5KB

MD5
ad0d80bf6b4292dbada25f7f8fd6556c

SHA1
40133d1dea9905bf406fb88efcb57cd693e6cf43

SHA256
081f45a04b555b2406e5b63afbcdba4e564c3157e7d3720d21e8f53d2127bae1

SHA512
76eaacabecaaed7b4eb53fbc5db4d53b15ccdbe6526119346dc444e932cc1ebfffb74b0df3f54c85168d72082f9017802e9775bc178a58fcac0ab3c1ddb519cb

Download Submit
C:\Windows\Web\CDClient.exe
Filesize
727KB

MD5
bae36106febed2468b3d14685936ff56

SHA1
3bbb2aa6e3fa878bd3aee18a8012073b25687b13

SHA256
68733661aa094199142075c2dc58bff437fc689c87123382ccad8fdce21f55db

SHA512
a9dc33ea5ef4e5b2a86b16f50ef97d83deb6f4461dd17c666106589126cf00ae4f877d8c2ec3ed5dd5c41c5301567ae790b6ef9b71ffeb7c2ab35fda15d61c36

Download Submit
C:\Windows\Web\CDClient.exe
Filesize
727KB

MD5
bae36106febed2468b3d14685936ff56

SHA1
3bbb2aa6e3fa878bd3aee18a8012073b25687b13

SHA256
68733661aa094199142075c2dc58bff437fc689c87123382ccad8fdce21f55db

SHA512
a9dc33ea5ef4e5b2a86b16f50ef97d83deb6f4461dd17c666106589126cf00ae4f877d8c2ec3ed5dd5c41c5301567ae790b6ef9b71ffeb7c2ab35fda15d61c36

Download Submit
\Users\Admin\AppData\Local\Temp\E22450\AGCIsJw.dll
Filesize
595KB

MD5
2f152f59468ec96a89d87c072b9cd521

SHA1
9e0bc1d43d8d5c5a97e5e72e473c682802cb092a

SHA256
085c4dd097865609fadc4aa87cd7dff89d6aca6b1bbff722abcebcde7828a453

SHA512
009973dd7ecc3d24b78b5b4536e9aeb95dee9a34a8f35006423c86cbe6b619d050b1a50a6fa2b28a160842a9738ae7e2934eb6dc30e126530d55afd2b6d1fa8a

Download Submit
\Users\Admin\AppData\Local\Temp\E22450\mrtGvEH.dll
Filesize
546KB

MD5
f60d60bf6a5bc518f0630857d8d602da

SHA1
810a18bacb7a2a15f056c7305f1ea4ce8a802c3b

SHA256
209b797fb8786e6b60261d3ff2bbfcb8b1cdd9698fe4707ea28f0b475bdec0a8

SHA512
9ce67959d703131837e3fe29de4dd945aa6062226a277200974c3567fbc0145b24584c13b68757fe77ce33872c5b5b42f5afc193fe4c0dc3f7e764b1218f155f

Download Submit
\Windows\SysWOW64\JFyGwy.dll
Filesize
63KB

MD5
fd8d4e1d20d085593e26e4fb879aac1f

SHA1
dd233f681bd4807851963736fe4554e152d06793

SHA256
39c865da0e189d296eae8838d9240aefadfd63507b070fa0e6803910a51202f3

SHA512
dee6185217cf4b9bfc1fb526ec365de67294f8ddeea95eaa5f72628731b52136cc2fa703a84cf35a22a32b870bbeb1f068192336474880c03c879380e7eac317

Download Submit
\Windows\Web\CDClient.exe
Filesize
727KB

MD5
bae36106febed2468b3d14685936ff56

SHA1
3bbb2aa6e3fa878bd3aee18a8012073b25687b13

SHA256
68733661aa094199142075c2dc58bff437fc689c87123382ccad8fdce21f55db

SHA512
a9dc33ea5ef4e5b2a86b16f50ef97d83deb6f4461dd17c666106589126cf00ae4f877d8c2ec3ed5dd5c41c5301567ae790b6ef9b71ffeb7c2ab35fda15d61c36

Download Submit
\Windows\Web\CDClient.exe
Filesize
727KB

MD5
bae36106febed2468b3d14685936ff56

SHA1
3bbb2aa6e3fa878bd3aee18a8012073b25687b13

SHA256
68733661aa094199142075c2dc58bff437fc689c87123382ccad8fdce21f55db

SHA512
a9dc33ea5ef4e5b2a86b16f50ef97d83deb6f4461dd17c666106589126cf00ae4f877d8c2ec3ed5dd5c41c5301567ae790b6ef9b71ffeb7c2ab35fda15d61c36

Download Submit
\Windows\Web\CDClient.exe
Filesize
727KB

MD5
bae36106febed2468b3d14685936ff56

SHA1
3bbb2aa6e3fa878bd3aee18a8012073b25687b13

SHA256
68733661aa094199142075c2dc58bff437fc689c87123382ccad8fdce21f55db

SHA512
a9dc33ea5ef4e5b2a86b16f50ef97d83deb6f4461dd17c666106589126cf00ae4f877d8c2ec3ed5dd5c41c5301567ae790b6ef9b71ffeb7c2ab35fda15d61c36

Download Submit
\Windows\Web\CDClient.exe
Filesize
727KB

MD5
bae36106febed2468b3d14685936ff56

SHA1
3bbb2aa6e3fa878bd3aee18a8012073b25687b13

SHA256
68733661aa094199142075c2dc58bff437fc689c87123382ccad8fdce21f55db

SHA512
a9dc33ea5ef4e5b2a86b16f50ef97d83deb6f4461dd17c666106589126cf00ae4f877d8c2ec3ed5dd5c41c5301567ae790b6ef9b71ffeb7c2ab35fda15d61c36

Download Submit
memory/520-64-0x0000000000000000-mapping.dmp

Download
memory/604-54-0x0000000075F81000-0x0000000075F83000-memory.dmp

Filesize
8KB

Download
memory/956-80-0x0000000074A50000-0x0000000074A73000-memory.dmp

Filesize
140KB

Download
memory/956-59-0x0000000000000000-mapping.dmp

Download
memory/988-72-0x0000000000000000-mapping.dmp

Download
memory/1628-67-0x0000000000000000-mapping.dmp

Download
memory/1768-69-0x0000000000000000-mapping.dmp

Download
memory/1780-77-0x0000000000000000-mapping.dmp

Download
memory/1972-75-0x0000000000000000-mapping.dmp

Download