Analysis
-
max time kernel
150s -
max time network
165s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
25-11-2022 22:36
Static task
static1
Behavioral task
behavioral1
Sample
1c50e360f80a83b9e31ffb0594094f9da55c37b0f49eefdd5ea2a978360fde49.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
1c50e360f80a83b9e31ffb0594094f9da55c37b0f49eefdd5ea2a978360fde49.exe
Resource
win10v2004-20220901-en
General
-
Target
1c50e360f80a83b9e31ffb0594094f9da55c37b0f49eefdd5ea2a978360fde49.exe
-
Size
817KB
-
MD5
2081d437e182ae1206c8536144650aed
-
SHA1
290f54279ccef388db484a3111f4100decdd66a0
-
SHA256
1c50e360f80a83b9e31ffb0594094f9da55c37b0f49eefdd5ea2a978360fde49
-
SHA512
c4edce1b095f28fb879c6b673e65a832f6b177d6365ed6675e0f6bc928aceb8091ed3e1c39b6694efd49c25ffcce3c1849f56f5b480f7f93c045e0d44fdc523e
-
SSDEEP
24576:iFszWS5ZkKpLURv9Ss8yuUBYxbTGFL0RHSiCh7AmxH2:iVKZ0v9mcp6g2
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
Processes:
resource yara_rule \Windows\SysWOW64\JECsCq.dll acprotect -
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\CDClient.exe aspack_v212_v242 C:\Users\Admin\AppData\Local\Temp\CDClient.exe aspack_v212_v242 \Users\Admin\AppData\Local\Temp\C67B42\xvprtHm.dll aspack_v212_v242 \Users\Admin\AppData\Local\Temp\C67B42\yImxlus.dll aspack_v212_v242 C:\Users\Admin\AppData\Local\Temp\CDClient.exe aspack_v212_v242 -
Executes dropped EXE 1 IoCs
Processes:
CDClient.exepid process 896 CDClient.exe -
Sets service image path in registry 2 TTPs 1 IoCs
Processes:
CDClient.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\CDClient64.sys\ImagePath = "\\??\\C:\\Windows\\CDClient64.sys" CDClient.exe -
Processes:
resource yara_rule \Windows\SysWOW64\JECsCq.dll upx behavioral1/memory/896-77-0x0000000074090000-0x00000000740B3000-memory.dmp upx -
Loads dropped DLL 4 IoCs
Processes:
1c50e360f80a83b9e31ffb0594094f9da55c37b0f49eefdd5ea2a978360fde49.exeCDClient.exepid process 968 1c50e360f80a83b9e31ffb0594094f9da55c37b0f49eefdd5ea2a978360fde49.exe 896 CDClient.exe 896 CDClient.exe 896 CDClient.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 4 IoCs
Processes:
CDClient.exedescription ioc process File created C:\Windows\SysWOW64\JECsCq.dll CDClient.exe File created C:\Windows\SysWOW64\C6A53.dat CDClient.exe File created C:\Windows\SysWOW64\100512.bat CDClient.exe File created C:\Windows\SysWOW64\100524.bat CDClient.exe -
Drops file in Windows directory 1 IoCs
Processes:
CDClient.exedescription ioc process File created C:\Windows\CDClient64.sys CDClient.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Processes:
IEXPLORE.EXEIEXPLORE.EXECDClient.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\InternetRegistry IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\PageSetup IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DOMStorage\so.com IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.so.com\ = "26" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Toolbar IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DOMStorage\so.com\NumberOfSubdomains = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\IntelliForms IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "26" IEXPLORE.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extensions CDClient.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Zoom IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\Local Page = "http://www.sogou.com/index.htm?pid=sogou-netb-5ac8bb8a7d745102-0001" CDClient.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total IEXPLORE.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extensions\{789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} CDClient.exe Key deleted \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\TypedURLs CDClient.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\LowRegistry IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main CDClient.exe Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E9B87F60-6D71-11ED-96D2-EEBA1A0FFCD1} = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extensions\{2670000A-7350-4f3c-8081-5663EE0C6C49} CDClient.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DOMStorage IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.so.com IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\IETld\LowMic IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DOMStorage\so.com\Total = "26" IEXPLORE.EXE -
Modifies Internet Explorer start page 1 TTPs 2 IoCs
Processes:
CDClient.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Start Page = "http://www.sogou.com/index.htm?pid=sogou-netb-5ac8bb8a7d745102-0001" CDClient.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://www.sogou.com/index.htm?pid=sogou-netb-5ac8bb8a7d745102-0001" CDClient.exe -
Modifies registry class 7 IoCs
Processes:
CDClient.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\OpenHomePage CDClient.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0002DF01-0000-0000-C000-000000000046}\LocalServer32 CDClient.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID CDClient.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0002DF01-0000-0000-C000-000000000046} CDClient.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\OpenHomePage\Command CDClient.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} CDClient.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell CDClient.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
CDClient.exepid process 896 CDClient.exe 896 CDClient.exe 896 CDClient.exe 896 CDClient.exe 896 CDClient.exe 896 CDClient.exe 896 CDClient.exe 896 CDClient.exe 896 CDClient.exe 896 CDClient.exe 896 CDClient.exe 896 CDClient.exe 896 CDClient.exe 896 CDClient.exe 896 CDClient.exe 896 CDClient.exe 896 CDClient.exe 896 CDClient.exe 896 CDClient.exe 896 CDClient.exe 896 CDClient.exe 896 CDClient.exe 896 CDClient.exe 896 CDClient.exe 896 CDClient.exe 896 CDClient.exe 896 CDClient.exe 896 CDClient.exe 896 CDClient.exe 896 CDClient.exe 896 CDClient.exe 896 CDClient.exe 896 CDClient.exe 896 CDClient.exe 896 CDClient.exe 896 CDClient.exe 896 CDClient.exe 896 CDClient.exe 896 CDClient.exe 896 CDClient.exe 896 CDClient.exe 896 CDClient.exe 896 CDClient.exe 896 CDClient.exe 896 CDClient.exe 896 CDClient.exe 896 CDClient.exe 896 CDClient.exe 896 CDClient.exe 896 CDClient.exe 896 CDClient.exe 896 CDClient.exe 896 CDClient.exe 896 CDClient.exe 896 CDClient.exe 896 CDClient.exe 896 CDClient.exe 896 CDClient.exe 896 CDClient.exe 896 CDClient.exe 896 CDClient.exe 896 CDClient.exe 896 CDClient.exe 896 CDClient.exe -
Suspicious behavior: LoadsDriver 1 IoCs
Processes:
CDClient.exepid process 896 CDClient.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
CDClient.exedescription pid process Token: SeDebugPrivilege 896 CDClient.exe Token: SeLoadDriverPrivilege 896 CDClient.exe Token: 33 896 CDClient.exe Token: SeIncBasePriorityPrivilege 896 CDClient.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
IEXPLORE.EXEpid process 1868 IEXPLORE.EXE -
Suspicious use of SetWindowsHookEx 8 IoCs
Processes:
CDClient.exeIEXPLORE.EXEIEXPLORE.EXEpid process 896 CDClient.exe 896 CDClient.exe 1868 IEXPLORE.EXE 1868 IEXPLORE.EXE 1184 IEXPLORE.EXE 1184 IEXPLORE.EXE 1184 IEXPLORE.EXE 1184 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
1c50e360f80a83b9e31ffb0594094f9da55c37b0f49eefdd5ea2a978360fde49.exeCDClient.execmd.exedescription pid process target process PID 968 wrote to memory of 896 968 1c50e360f80a83b9e31ffb0594094f9da55c37b0f49eefdd5ea2a978360fde49.exe CDClient.exe PID 968 wrote to memory of 896 968 1c50e360f80a83b9e31ffb0594094f9da55c37b0f49eefdd5ea2a978360fde49.exe CDClient.exe PID 968 wrote to memory of 896 968 1c50e360f80a83b9e31ffb0594094f9da55c37b0f49eefdd5ea2a978360fde49.exe CDClient.exe PID 968 wrote to memory of 896 968 1c50e360f80a83b9e31ffb0594094f9da55c37b0f49eefdd5ea2a978360fde49.exe CDClient.exe PID 968 wrote to memory of 896 968 1c50e360f80a83b9e31ffb0594094f9da55c37b0f49eefdd5ea2a978360fde49.exe CDClient.exe PID 968 wrote to memory of 896 968 1c50e360f80a83b9e31ffb0594094f9da55c37b0f49eefdd5ea2a978360fde49.exe CDClient.exe PID 968 wrote to memory of 896 968 1c50e360f80a83b9e31ffb0594094f9da55c37b0f49eefdd5ea2a978360fde49.exe CDClient.exe PID 896 wrote to memory of 1548 896 CDClient.exe cmd.exe PID 896 wrote to memory of 1548 896 CDClient.exe cmd.exe PID 896 wrote to memory of 1548 896 CDClient.exe cmd.exe PID 896 wrote to memory of 1548 896 CDClient.exe cmd.exe PID 896 wrote to memory of 1548 896 CDClient.exe cmd.exe PID 896 wrote to memory of 1548 896 CDClient.exe cmd.exe PID 896 wrote to memory of 1548 896 CDClient.exe cmd.exe PID 896 wrote to memory of 1312 896 CDClient.exe Explorer.EXE PID 896 wrote to memory of 1312 896 CDClient.exe Explorer.EXE PID 896 wrote to memory of 1312 896 CDClient.exe Explorer.EXE PID 896 wrote to memory of 1312 896 CDClient.exe Explorer.EXE PID 896 wrote to memory of 1312 896 CDClient.exe Explorer.EXE PID 896 wrote to memory of 1312 896 CDClient.exe Explorer.EXE PID 896 wrote to memory of 1312 896 CDClient.exe Explorer.EXE PID 896 wrote to memory of 1312 896 CDClient.exe Explorer.EXE PID 896 wrote to memory of 1312 896 CDClient.exe Explorer.EXE PID 896 wrote to memory of 1312 896 CDClient.exe Explorer.EXE PID 896 wrote to memory of 1312 896 CDClient.exe Explorer.EXE PID 896 wrote to memory of 1312 896 CDClient.exe Explorer.EXE PID 896 wrote to memory of 1312 896 CDClient.exe Explorer.EXE PID 896 wrote to memory of 1312 896 CDClient.exe Explorer.EXE PID 896 wrote to memory of 1312 896 CDClient.exe Explorer.EXE PID 896 wrote to memory of 1312 896 CDClient.exe Explorer.EXE PID 896 wrote to memory of 1312 896 CDClient.exe Explorer.EXE PID 896 wrote to memory of 1312 896 CDClient.exe Explorer.EXE PID 896 wrote to memory of 1312 896 CDClient.exe Explorer.EXE PID 896 wrote to memory of 1312 896 CDClient.exe Explorer.EXE PID 896 wrote to memory of 1312 896 CDClient.exe Explorer.EXE PID 896 wrote to memory of 1312 896 CDClient.exe Explorer.EXE PID 896 wrote to memory of 1312 896 CDClient.exe Explorer.EXE PID 896 wrote to memory of 1312 896 CDClient.exe Explorer.EXE PID 896 wrote to memory of 1312 896 CDClient.exe Explorer.EXE PID 896 wrote to memory of 1312 896 CDClient.exe Explorer.EXE PID 896 wrote to memory of 1312 896 CDClient.exe Explorer.EXE PID 896 wrote to memory of 1312 896 CDClient.exe Explorer.EXE PID 896 wrote to memory of 1312 896 CDClient.exe Explorer.EXE PID 896 wrote to memory of 1312 896 CDClient.exe Explorer.EXE PID 896 wrote to memory of 1312 896 CDClient.exe Explorer.EXE PID 896 wrote to memory of 1312 896 CDClient.exe Explorer.EXE PID 896 wrote to memory of 1312 896 CDClient.exe Explorer.EXE PID 896 wrote to memory of 1312 896 CDClient.exe Explorer.EXE PID 1548 wrote to memory of 1992 1548 cmd.exe cmd.exe PID 1548 wrote to memory of 1992 1548 cmd.exe cmd.exe PID 1548 wrote to memory of 1992 1548 cmd.exe cmd.exe PID 1548 wrote to memory of 1992 1548 cmd.exe cmd.exe PID 1548 wrote to memory of 1992 1548 cmd.exe cmd.exe PID 1548 wrote to memory of 1992 1548 cmd.exe cmd.exe PID 1548 wrote to memory of 1992 1548 cmd.exe cmd.exe PID 896 wrote to memory of 1312 896 CDClient.exe Explorer.EXE PID 1548 wrote to memory of 432 1548 cmd.exe cmd.exe PID 1548 wrote to memory of 432 1548 cmd.exe cmd.exe PID 1548 wrote to memory of 432 1548 cmd.exe cmd.exe PID 1548 wrote to memory of 432 1548 cmd.exe cmd.exe PID 1548 wrote to memory of 432 1548 cmd.exe cmd.exe PID 1548 wrote to memory of 432 1548 cmd.exe cmd.exe PID 1548 wrote to memory of 432 1548 cmd.exe cmd.exe PID 896 wrote to memory of 1312 896 CDClient.exe Explorer.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\1c50e360f80a83b9e31ffb0594094f9da55c37b0f49eefdd5ea2a978360fde49.exe"C:\Users\Admin\AppData\Local\Temp\1c50e360f80a83b9e31ffb0594094f9da55c37b0f49eefdd5ea2a978360fde49.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\CDClient.exe"C:\Users\Admin\AppData\Local\Temp\CDClient.exe"2⤵
- Executes dropped EXE
- Sets service image path in registry
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Windows\SysWOW64\100512.bat3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c dir "C:\Users\Admin\Local Settings\Application Data\Mozilla\Firefox\Profiles\*.default" /B4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c dir "C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\*.default" /B4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Windows\SysWOW64\100524.bat3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c dir "C:\Users\Admin\Local Settings\Application Data\Mozilla\Firefox\Profiles\*.default" /B4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c dir "C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\*.default" /B4⤵
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXEhttp://www.so.com3⤵
-
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE" http://www.so.com4⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1868 CREDAT:275457 /prefetch:25⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\try74lz\imagestore.datFilesize
1KB
MD5125fa4fbe6c35b2ed5fe5919be9c4539
SHA1b966a8058fe6a56183f2896b42362bbd0aa9eb2c
SHA256dafbeaf847d83bec030ef1705fbe06f090f0a1cc9a339df7e41b93b3f3257c0f
SHA51288a225941bcfceaed01baed55927670c1df4789e888954a9f3536cf6b06a67a2c4b7ceb66149c52e885c01b6a214bd6fcbaf83109c3c5c7e40a21e6ec4b1f492
-
C:\Users\Admin\AppData\Local\Temp\CDClient.exeFilesize
726KB
MD57fc1aea7e0dfbcc01a66d71d40361526
SHA159e013d6e8057040617863fa8e608c06aa2a89db
SHA256de887f3306edd61d58683e294b807812080099d8c6d16fc63fcae06f13f5403f
SHA512d02821910683489d65ab9f267cb7a9d8dada96b930d40f1e5072681c2b3b7db56f539d0376027d073a8712f36d9e15a55cf7518bba3f10df171dfb559d42afa6
-
C:\Users\Admin\AppData\Local\Temp\CDClient.exeFilesize
726KB
MD57fc1aea7e0dfbcc01a66d71d40361526
SHA159e013d6e8057040617863fa8e608c06aa2a89db
SHA256de887f3306edd61d58683e294b807812080099d8c6d16fc63fcae06f13f5403f
SHA512d02821910683489d65ab9f267cb7a9d8dada96b930d40f1e5072681c2b3b7db56f539d0376027d073a8712f36d9e15a55cf7518bba3f10df171dfb559d42afa6
-
C:\Windows\SysWOW64\100512.batFilesize
5KB
MD5ad0d80bf6b4292dbada25f7f8fd6556c
SHA140133d1dea9905bf406fb88efcb57cd693e6cf43
SHA256081f45a04b555b2406e5b63afbcdba4e564c3157e7d3720d21e8f53d2127bae1
SHA51276eaacabecaaed7b4eb53fbc5db4d53b15ccdbe6526119346dc444e932cc1ebfffb74b0df3f54c85168d72082f9017802e9775bc178a58fcac0ab3c1ddb519cb
-
C:\Windows\SysWOW64\100524.batFilesize
5KB
MD5ad0d80bf6b4292dbada25f7f8fd6556c
SHA140133d1dea9905bf406fb88efcb57cd693e6cf43
SHA256081f45a04b555b2406e5b63afbcdba4e564c3157e7d3720d21e8f53d2127bae1
SHA51276eaacabecaaed7b4eb53fbc5db4d53b15ccdbe6526119346dc444e932cc1ebfffb74b0df3f54c85168d72082f9017802e9775bc178a58fcac0ab3c1ddb519cb
-
\Users\Admin\AppData\Local\Temp\C67B42\xvprtHm.dllFilesize
594KB
MD54b236ba3d674066e792a9d51700a3ce9
SHA1079cded909cfe7d7c73a39d22e514f8af060a1ed
SHA256eae10dd2beca649bbfd1c8f41028fb24eaa2e7406ba4aca9e93c7e7791bd31de
SHA5120c7685b1063d0556bb1b6a29d9ce1b2d92fdce50c1b690d48e9528791a1bc3e83c79258e12a1c1a5412bd21dd2bb0fc9de991ae2de831bdde08bf3c1f5d29a8c
-
\Users\Admin\AppData\Local\Temp\C67B42\yImxlus.dllFilesize
545KB
MD5cb2bef431de55af9a7a89e34685f11d2
SHA17dd2bad9c51428b078f2652020de7b16bd8863eb
SHA256961cdf8d6e7a4328637ff7626aec0961bb383d4aa0af28517661ac54a4db85fa
SHA512178ea54e4cd120a95900eacf56b0da294690d635f0c063d2565d81fdfac1040b1b44d1c66df39e45d57678e9a979b2e59f62c76f0be31c30e06d11e102c82b4c
-
\Users\Admin\AppData\Local\Temp\CDClient.exeFilesize
726KB
MD57fc1aea7e0dfbcc01a66d71d40361526
SHA159e013d6e8057040617863fa8e608c06aa2a89db
SHA256de887f3306edd61d58683e294b807812080099d8c6d16fc63fcae06f13f5403f
SHA512d02821910683489d65ab9f267cb7a9d8dada96b930d40f1e5072681c2b3b7db56f539d0376027d073a8712f36d9e15a55cf7518bba3f10df171dfb559d42afa6
-
\Windows\SysWOW64\JECsCq.dllFilesize
63KB
MD5fd8d4e1d20d085593e26e4fb879aac1f
SHA1dd233f681bd4807851963736fe4554e152d06793
SHA25639c865da0e189d296eae8838d9240aefadfd63507b070fa0e6803910a51202f3
SHA512dee6185217cf4b9bfc1fb526ec365de67294f8ddeea95eaa5f72628731b52136cc2fa703a84cf35a22a32b870bbeb1f068192336474880c03c879380e7eac317
-
memory/432-66-0x0000000000000000-mapping.dmp
-
memory/896-56-0x0000000000000000-mapping.dmp
-
memory/896-77-0x0000000074090000-0x00000000740B3000-memory.dmpFilesize
140KB
-
memory/968-54-0x0000000075F21000-0x0000000075F23000-memory.dmpFilesize
8KB
-
memory/1016-71-0x0000000000000000-mapping.dmp
-
memory/1548-61-0x0000000000000000-mapping.dmp
-
memory/1744-73-0x0000000000000000-mapping.dmp
-
memory/1952-68-0x0000000000000000-mapping.dmp
-
memory/1992-64-0x0000000000000000-mapping.dmp