Analysis
-
max time kernel
131s -
max time network
163s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
25-11-2022 06:52
Static task
static1
Behavioral task
behavioral1
Sample
e78811d76d6c154f8c3be8339339d5b460ae75e20c30d5f8359b5ac62974dd22.exe
Resource
win7-20220812-en
General
-
Target
e78811d76d6c154f8c3be8339339d5b460ae75e20c30d5f8359b5ac62974dd22.exe
-
Size
1.8MB
-
MD5
e4228a678244df4158509751680f4585
-
SHA1
47d0d9f3d70461d058090843f0e93a3a8fd93f10
-
SHA256
e78811d76d6c154f8c3be8339339d5b460ae75e20c30d5f8359b5ac62974dd22
-
SHA512
6f34ae2aec27f5b23f5bbe05df1dcbb65c5409a9b5dde11fb7b356a4b56ea65245fef1281482c7208b1096e97ca59417b42adac0af94ba117be356b4f431e493
-
SSDEEP
49152:SsDsqkEOVf7bZWVg4sZi2DLOFKMsoHIW5vVsUOO:QqSZRWO8xvsyvVsfO
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
Processes:
e78811d76d6c154f8c3be8339339d5b460ae75e20c30d5f8359b5ac62974dd22.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ e78811d76d6c154f8c3be8339339d5b460ae75e20c30d5f8359b5ac62974dd22.exe -
Registers COM server for autorun 1 TTPs 3 IoCs
Processes:
regsvr32.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{598AC71E-BE58-3981-B78A-5C138F423AD6}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Roaming\\VolIE\\FoxPro_64.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{598AC71E-BE58-3981-B78A-5C138F423AD6}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{598AC71E-BE58-3981-B78A-5C138F423AD6}\InprocServer32 regsvr32.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
e78811d76d6c154f8c3be8339339d5b460ae75e20c30d5f8359b5ac62974dd22.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion e78811d76d6c154f8c3be8339339d5b460ae75e20c30d5f8359b5ac62974dd22.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion e78811d76d6c154f8c3be8339339d5b460ae75e20c30d5f8359b5ac62974dd22.exe -
Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
Processes:
e78811d76d6c154f8c3be8339339d5b460ae75e20c30d5f8359b5ac62974dd22.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Wine e78811d76d6c154f8c3be8339339d5b460ae75e20c30d5f8359b5ac62974dd22.exe -
Loads dropped DLL 3 IoCs
Processes:
regsvr32.exeregsvr32.exeregsvr32.exepid process 1760 regsvr32.exe 1756 regsvr32.exe 1496 regsvr32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
e78811d76d6c154f8c3be8339339d5b460ae75e20c30d5f8359b5ac62974dd22.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA e78811d76d6c154f8c3be8339339d5b460ae75e20c30d5f8359b5ac62974dd22.exe -
Installs/modifies Browser Helper Object 2 TTPs 14 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
Processes:
regsvr32.exeregsvr32.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{598AC71E-BE58-3981-B78A-5C138F423AD6}\NoExplorer = "1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{598AC71E-BE58-3981-B78A-5C138F423AD6} regsvr32.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{598AC71E-BE58-3981-B78A-5C138F423AD6}\NoExplorer = "1" regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{598AC71E-BE58-3981-B78A-5C138F423AD6}\NoExplorer = "1" regsvr32.exe Key deleted \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{598AC71E-BE58-3981-B78A-5C138F423AD6} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{598AC71E-BE58-3981-B78A-5C138F423AD6} regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{598AC71E-BE58-3981-B78A-5C138F423AD6}\NoExplorer = "1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{598AC71E-BE58-3981-B78A-5C138F423AD6}\ = "FoxPro" regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{598AC71E-BE58-3981-B78A-5C138F423AD6} regsvr32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{598AC71E-BE58-3981-B78A-5C138F423AD6}\ = "FoxPro" regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{598AC71E-BE58-3981-B78A-5C138F423AD6} regsvr32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{598AC71E-BE58-3981-B78A-5C138F423AD6}\ = "FoxPro" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{598AC71E-BE58-3981-B78A-5C138F423AD6}\ = "FoxPro" regsvr32.exe -
Drops file in System32 directory 5 IoCs
Processes:
e78811d76d6c154f8c3be8339339d5b460ae75e20c30d5f8359b5ac62974dd22.exedescription ioc process File opened for modification C:\Windows\System32\GroupPolicy e78811d76d6c154f8c3be8339339d5b460ae75e20c30d5f8359b5ac62974dd22.exe File opened for modification C:\Windows\SysWOW64\GroupPolicy\gpt.ini e78811d76d6c154f8c3be8339339d5b460ae75e20c30d5f8359b5ac62974dd22.exe File created C:\Windows\System32\GroupPolicy\Machine\Registry.pol e78811d76d6c154f8c3be8339339d5b460ae75e20c30d5f8359b5ac62974dd22.exe File opened for modification C:\Windows\System32\GroupPolicy\GPT.INI e78811d76d6c154f8c3be8339339d5b460ae75e20c30d5f8359b5ac62974dd22.exe File opened for modification C:\Windows\System32\GroupPolicy\Machine\Registry.pol e78811d76d6c154f8c3be8339339d5b460ae75e20c30d5f8359b5ac62974dd22.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
e78811d76d6c154f8c3be8339339d5b460ae75e20c30d5f8359b5ac62974dd22.exepid process 1604 e78811d76d6c154f8c3be8339339d5b460ae75e20c30d5f8359b5ac62974dd22.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 4 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exepid process 1324 schtasks.exe 1248 schtasks.exe 584 schtasks.exe 1216 schtasks.exe -
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a04b47f6d200d901 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008472597a57a4e64c891790c7227afb1d00000000020000000000106600000001000020000000dfce92dc9e229ab936e7df7022d29d64b3d77b91543d83c52a78aa699e162602000000000e800000000200002000000027db5144deb7d071c08f2a514b786c4f8bee07e703f8103ef3e036f3995bc2ae5001000079d1cde140ab6633534a8a3ac43234e5ab1819e5526c8550c77cb0d450a9d27a6fb65c5685849a93b8f2da1c14c9a6c8b96f3225066f3151cc51d3b095602300530a3e448792f1da0d512b1ed65d4d5659a44cd0f36eef74d25b211e30e80a10a2d660d2e094603812027cddf04aa794ce82c85236d761826e6bb237f920688f99ea55911e4137b97fd5c17cda27c1cbda4402199adfdd36369020b02d839a5cf8c852c275e2c01516cb91fbbdbf3cd64a909264bdfc8e18a33ca7319804ecfb7059f705fc85a8be790ba72f93b3466eda433cfd32a9b255898c518c5be1da55fb1f306a598a03152baa983be197f8256e7b4c1bc1e3a8dafed01beb3e67aea747f6d6f70179bcb7e50476ecd897121df9225f73a9be023d23dcc4270501c55ab1b45b9a559c2b58aab24c6494a9ef90e27a9a34790ea1b4b9d2996a8a76ed33deaf7e225ea4440c135a6952d57f77f140000000b28ba29affaf8a5014acfa18158885b08b94f49cfbd285e5ff911de055252bca0f226e75d8f14a84d27ea6cae2a70b347372da2f8e5717e8dae52cdd376863e3 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{050AED41-6CC6-11ED-8FA4-466E2F293893} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "376148304" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008472597a57a4e64c891790c7227afb1d00000000020000000000106600000001000020000000adbf9e3cd5add026feee995173851dcc21d8a8f256a96311d7be43d298bc798f000000000e800000000200002000000012384a9b24cf3e0f4eab91908e54683d8220a5f21f6efdbe567f6e39e79d8416200000000c1eb6d3b7e5484f0f9caa8868181b68e91395e23a4a5b28054ceac91f91c82540000000e58b3af00b7ee2911b5e8c702755951d853131ec5abd95291a8c4d6e92b534cdaf35a3df182b3749ed19c553d6f0bc3098cc46c45795a97cd8d6d31cb4bc2669 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe -
Modifies registry class 64 IoCs
Processes:
regsvr32.exeregsvr32.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FoxPro.FoxPro\CurVer\ = "FoxPro.FoxPro.1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3FC2D59A-5C76-1E97-30DC-1EC6784419E5}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Roaming\\VolIE\\FoxPro_32.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{63D2A451-3351-178C-7BC4-13C4D58A7652}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{63D2A451-3351-178C-7BC4-13C4D58A7652}\TypeLib\ = "{3FC2D59A-5C76-1E97-30DC-1EC6784419E5}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FoxPro.FoxPro\ = "FoxPro Class" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3FC2D59A-5C76-1E97-30DC-1EC6784419E5}\1.0\FLAGS\ = "0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{63D2A451-3351-178C-7BC4-13C4D58A7652}\ = "IFoxProBHO" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{598AC71E-BE58-3981-B78A-5C138F423AD6}\ = "FoxPro Class" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{598AC71E-BE58-3981-B78A-5C138F423AD6}\Programmable regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{598AC71E-BE58-3981-B78A-5C138F423AD6}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Roaming\\VolIE\\FoxPro_64.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FoxPro.FoxPro.1\CLSID\ = "{598AC71E-BE58-3981-B78A-5C138F423AD6}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{598AC71E-BE58-3981-B78A-5C138F423AD6}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3FC2D59A-5C76-1E97-30DC-1EC6784419E5}\1.0\ = "FoxPro 3.0 Type Library" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{63D2A451-3351-178C-7BC4-13C4D58A7652}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{598AC71E-BE58-3981-B78A-5C138F423AD6}\VersionIndependentProgID\ = "FoxPro.FoxPro" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{6DD1B906-45FA-4A57-9AC6-01108C25067F}\ = "FoxPro" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FoxPro.FoxPro\CLSID\ = "{598AC71E-BE58-3981-B78A-5C138F423AD6}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{598AC71E-BE58-3981-B78A-5C138F423AD6}\TypeLib\ = "{3FC2D59A-5C76-1E97-30DC-1EC6784419E5}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{63D2A451-3351-178C-7BC4-13C4D58A7652} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{63D2A451-3351-178C-7BC4-13C4D58A7652}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3FC2D59A-5C76-1E97-30DC-1EC6784419E5}\1.0\0\win64\ = "C:\\Users\\Admin\\AppData\\Roaming\\VolIE\\FoxPro_64.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{63D2A451-3351-178C-7BC4-13C4D58A7652}\ = "IFoxProBHO" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FoxPro.FoxPro\CurVer\ = "FoxPro.FoxPro.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{598AC71E-BE58-3981-B78A-5C138F423AD6} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{598AC71E-BE58-3981-B78A-5C138F423AD6}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3FC2D59A-5C76-1E97-30DC-1EC6784419E5}\1.0\FLAGS regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3FC2D59A-5C76-1E97-30DC-1EC6784419E5}\1.0\HELPDIR regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{598AC71E-BE58-3981-B78A-5C138F423AD6}\VersionIndependentProgID\ = "FoxPro.FoxPro" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{598AC71E-BE58-3981-B78A-5C138F423AD6}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Roaming\\VolIE\\FoxPro_32.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{63D2A451-3351-178C-7BC4-13C4D58A7652}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{63D2A451-3351-178C-7BC4-13C4D58A7652}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{63D2A451-3351-178C-7BC4-13C4D58A7652}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3FC2D59A-5C76-1E97-30DC-1EC6784419E5}\1.0\0\win64 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\FoxPro.DLL\AppID = "{6DD1B906-45FA-4A57-9AC6-01108C25067F}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FoxPro.FoxPro\CLSID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FoxPro.FoxPro\CurVer regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{598AC71E-BE58-3981-B78A-5C138F423AD6}\Programmable regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\FoxPro.DLL\AppID = "{6DD1B906-45FA-4A57-9AC6-01108C25067F}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{598AC71E-BE58-3981-B78A-5C138F423AD6}\VersionIndependentProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{598AC71E-BE58-3981-B78A-5C138F423AD6}\ProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\FoxPro.DLL regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FoxPro.FoxPro.1\ = "FoxPro Class" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FoxPro.FoxPro regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3FC2D59A-5C76-1E97-30DC-1EC6784419E5}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Roaming\\VolIE" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{63D2A451-3351-178C-7BC4-13C4D58A7652}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{598AC71E-BE58-3981-B78A-5C138F423AD6}\TypeLib\ = "{3FC2D59A-5C76-1E97-30DC-1EC6784419E5}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FoxPro.FoxPro.1\CLSID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{598AC71E-BE58-3981-B78A-5C138F423AD6}\VersionIndependentProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3FC2D59A-5C76-1E97-30DC-1EC6784419E5}\1.0 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{598AC71E-BE58-3981-B78A-5C138F423AD6}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{598AC71E-BE58-3981-B78A-5C138F423AD6}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{598AC71E-BE58-3981-B78A-5C138F423AD6}\ProgID\ = "FoxPro.FoxPro.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FoxPro.FoxPro.1 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{598AC71E-BE58-3981-B78A-5C138F423AD6} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3FC2D59A-5C76-1E97-30DC-1EC6784419E5}\1.0\0\win32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FoxPro.FoxPro.1\CLSID\ = "{598AC71E-BE58-3981-B78A-5C138F423AD6}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FoxPro.FoxPro\CLSID\ = "{598AC71E-BE58-3981-B78A-5C138F423AD6}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{598AC71E-BE58-3981-B78A-5C138F423AD6}\ProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{598AC71E-BE58-3981-B78A-5C138F423AD6}\ProgID\ = "FoxPro.FoxPro.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{598AC71E-BE58-3981-B78A-5C138F423AD6}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{63D2A451-3351-178C-7BC4-13C4D58A7652} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{63D2A451-3351-178C-7BC4-13C4D58A7652}\TypeLib\ = "{3FC2D59A-5C76-1E97-30DC-1EC6784419E5}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FoxPro.FoxPro.1\ = "FoxPro Class" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FoxPro.FoxPro\ = "FoxPro Class" regsvr32.exe -
Modifies registry key 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
e78811d76d6c154f8c3be8339339d5b460ae75e20c30d5f8359b5ac62974dd22.exepid process 1604 e78811d76d6c154f8c3be8339339d5b460ae75e20c30d5f8359b5ac62974dd22.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
e78811d76d6c154f8c3be8339339d5b460ae75e20c30d5f8359b5ac62974dd22.exedescription pid process Token: SeIncBasePriorityPrivilege 1604 e78811d76d6c154f8c3be8339339d5b460ae75e20c30d5f8359b5ac62974dd22.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 824 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 824 iexplore.exe 824 iexplore.exe 1628 IEXPLORE.EXE 1628 IEXPLORE.EXE 1628 IEXPLORE.EXE 1628 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
e78811d76d6c154f8c3be8339339d5b460ae75e20c30d5f8359b5ac62974dd22.exeregsvr32.exeiexplore.exedescription pid process target process PID 1604 wrote to memory of 472 1604 e78811d76d6c154f8c3be8339339d5b460ae75e20c30d5f8359b5ac62974dd22.exe schtasks.exe PID 1604 wrote to memory of 472 1604 e78811d76d6c154f8c3be8339339d5b460ae75e20c30d5f8359b5ac62974dd22.exe schtasks.exe PID 1604 wrote to memory of 472 1604 e78811d76d6c154f8c3be8339339d5b460ae75e20c30d5f8359b5ac62974dd22.exe schtasks.exe PID 1604 wrote to memory of 472 1604 e78811d76d6c154f8c3be8339339d5b460ae75e20c30d5f8359b5ac62974dd22.exe schtasks.exe PID 1604 wrote to memory of 1324 1604 e78811d76d6c154f8c3be8339339d5b460ae75e20c30d5f8359b5ac62974dd22.exe schtasks.exe PID 1604 wrote to memory of 1324 1604 e78811d76d6c154f8c3be8339339d5b460ae75e20c30d5f8359b5ac62974dd22.exe schtasks.exe PID 1604 wrote to memory of 1324 1604 e78811d76d6c154f8c3be8339339d5b460ae75e20c30d5f8359b5ac62974dd22.exe schtasks.exe PID 1604 wrote to memory of 1324 1604 e78811d76d6c154f8c3be8339339d5b460ae75e20c30d5f8359b5ac62974dd22.exe schtasks.exe PID 1604 wrote to memory of 1356 1604 e78811d76d6c154f8c3be8339339d5b460ae75e20c30d5f8359b5ac62974dd22.exe schtasks.exe PID 1604 wrote to memory of 1356 1604 e78811d76d6c154f8c3be8339339d5b460ae75e20c30d5f8359b5ac62974dd22.exe schtasks.exe PID 1604 wrote to memory of 1356 1604 e78811d76d6c154f8c3be8339339d5b460ae75e20c30d5f8359b5ac62974dd22.exe schtasks.exe PID 1604 wrote to memory of 1356 1604 e78811d76d6c154f8c3be8339339d5b460ae75e20c30d5f8359b5ac62974dd22.exe schtasks.exe PID 1604 wrote to memory of 1248 1604 e78811d76d6c154f8c3be8339339d5b460ae75e20c30d5f8359b5ac62974dd22.exe schtasks.exe PID 1604 wrote to memory of 1248 1604 e78811d76d6c154f8c3be8339339d5b460ae75e20c30d5f8359b5ac62974dd22.exe schtasks.exe PID 1604 wrote to memory of 1248 1604 e78811d76d6c154f8c3be8339339d5b460ae75e20c30d5f8359b5ac62974dd22.exe schtasks.exe PID 1604 wrote to memory of 1248 1604 e78811d76d6c154f8c3be8339339d5b460ae75e20c30d5f8359b5ac62974dd22.exe schtasks.exe PID 1604 wrote to memory of 1756 1604 e78811d76d6c154f8c3be8339339d5b460ae75e20c30d5f8359b5ac62974dd22.exe regsvr32.exe PID 1604 wrote to memory of 1756 1604 e78811d76d6c154f8c3be8339339d5b460ae75e20c30d5f8359b5ac62974dd22.exe regsvr32.exe PID 1604 wrote to memory of 1756 1604 e78811d76d6c154f8c3be8339339d5b460ae75e20c30d5f8359b5ac62974dd22.exe regsvr32.exe PID 1604 wrote to memory of 1756 1604 e78811d76d6c154f8c3be8339339d5b460ae75e20c30d5f8359b5ac62974dd22.exe regsvr32.exe PID 1604 wrote to memory of 1756 1604 e78811d76d6c154f8c3be8339339d5b460ae75e20c30d5f8359b5ac62974dd22.exe regsvr32.exe PID 1604 wrote to memory of 1756 1604 e78811d76d6c154f8c3be8339339d5b460ae75e20c30d5f8359b5ac62974dd22.exe regsvr32.exe PID 1604 wrote to memory of 1756 1604 e78811d76d6c154f8c3be8339339d5b460ae75e20c30d5f8359b5ac62974dd22.exe regsvr32.exe PID 1604 wrote to memory of 1760 1604 e78811d76d6c154f8c3be8339339d5b460ae75e20c30d5f8359b5ac62974dd22.exe regsvr32.exe PID 1604 wrote to memory of 1760 1604 e78811d76d6c154f8c3be8339339d5b460ae75e20c30d5f8359b5ac62974dd22.exe regsvr32.exe PID 1604 wrote to memory of 1760 1604 e78811d76d6c154f8c3be8339339d5b460ae75e20c30d5f8359b5ac62974dd22.exe regsvr32.exe PID 1604 wrote to memory of 1760 1604 e78811d76d6c154f8c3be8339339d5b460ae75e20c30d5f8359b5ac62974dd22.exe regsvr32.exe PID 1604 wrote to memory of 1760 1604 e78811d76d6c154f8c3be8339339d5b460ae75e20c30d5f8359b5ac62974dd22.exe regsvr32.exe PID 1604 wrote to memory of 1760 1604 e78811d76d6c154f8c3be8339339d5b460ae75e20c30d5f8359b5ac62974dd22.exe regsvr32.exe PID 1604 wrote to memory of 1760 1604 e78811d76d6c154f8c3be8339339d5b460ae75e20c30d5f8359b5ac62974dd22.exe regsvr32.exe PID 1760 wrote to memory of 1496 1760 regsvr32.exe regsvr32.exe PID 1760 wrote to memory of 1496 1760 regsvr32.exe regsvr32.exe PID 1760 wrote to memory of 1496 1760 regsvr32.exe regsvr32.exe PID 1760 wrote to memory of 1496 1760 regsvr32.exe regsvr32.exe PID 1760 wrote to memory of 1496 1760 regsvr32.exe regsvr32.exe PID 1760 wrote to memory of 1496 1760 regsvr32.exe regsvr32.exe PID 1760 wrote to memory of 1496 1760 regsvr32.exe regsvr32.exe PID 1604 wrote to memory of 1544 1604 e78811d76d6c154f8c3be8339339d5b460ae75e20c30d5f8359b5ac62974dd22.exe reg.exe PID 1604 wrote to memory of 1544 1604 e78811d76d6c154f8c3be8339339d5b460ae75e20c30d5f8359b5ac62974dd22.exe reg.exe PID 1604 wrote to memory of 1544 1604 e78811d76d6c154f8c3be8339339d5b460ae75e20c30d5f8359b5ac62974dd22.exe reg.exe PID 1604 wrote to memory of 1544 1604 e78811d76d6c154f8c3be8339339d5b460ae75e20c30d5f8359b5ac62974dd22.exe reg.exe PID 1604 wrote to memory of 824 1604 e78811d76d6c154f8c3be8339339d5b460ae75e20c30d5f8359b5ac62974dd22.exe iexplore.exe PID 1604 wrote to memory of 824 1604 e78811d76d6c154f8c3be8339339d5b460ae75e20c30d5f8359b5ac62974dd22.exe iexplore.exe PID 1604 wrote to memory of 824 1604 e78811d76d6c154f8c3be8339339d5b460ae75e20c30d5f8359b5ac62974dd22.exe iexplore.exe PID 1604 wrote to memory of 824 1604 e78811d76d6c154f8c3be8339339d5b460ae75e20c30d5f8359b5ac62974dd22.exe iexplore.exe PID 1604 wrote to memory of 1504 1604 e78811d76d6c154f8c3be8339339d5b460ae75e20c30d5f8359b5ac62974dd22.exe schtasks.exe PID 1604 wrote to memory of 1504 1604 e78811d76d6c154f8c3be8339339d5b460ae75e20c30d5f8359b5ac62974dd22.exe schtasks.exe PID 1604 wrote to memory of 1504 1604 e78811d76d6c154f8c3be8339339d5b460ae75e20c30d5f8359b5ac62974dd22.exe schtasks.exe PID 1604 wrote to memory of 1504 1604 e78811d76d6c154f8c3be8339339d5b460ae75e20c30d5f8359b5ac62974dd22.exe schtasks.exe PID 824 wrote to memory of 1628 824 iexplore.exe IEXPLORE.EXE PID 824 wrote to memory of 1628 824 iexplore.exe IEXPLORE.EXE PID 824 wrote to memory of 1628 824 iexplore.exe IEXPLORE.EXE PID 824 wrote to memory of 1628 824 iexplore.exe IEXPLORE.EXE PID 1604 wrote to memory of 584 1604 e78811d76d6c154f8c3be8339339d5b460ae75e20c30d5f8359b5ac62974dd22.exe schtasks.exe PID 1604 wrote to memory of 584 1604 e78811d76d6c154f8c3be8339339d5b460ae75e20c30d5f8359b5ac62974dd22.exe schtasks.exe PID 1604 wrote to memory of 584 1604 e78811d76d6c154f8c3be8339339d5b460ae75e20c30d5f8359b5ac62974dd22.exe schtasks.exe PID 1604 wrote to memory of 584 1604 e78811d76d6c154f8c3be8339339d5b460ae75e20c30d5f8359b5ac62974dd22.exe schtasks.exe PID 1604 wrote to memory of 2008 1604 e78811d76d6c154f8c3be8339339d5b460ae75e20c30d5f8359b5ac62974dd22.exe schtasks.exe PID 1604 wrote to memory of 2008 1604 e78811d76d6c154f8c3be8339339d5b460ae75e20c30d5f8359b5ac62974dd22.exe schtasks.exe PID 1604 wrote to memory of 2008 1604 e78811d76d6c154f8c3be8339339d5b460ae75e20c30d5f8359b5ac62974dd22.exe schtasks.exe PID 1604 wrote to memory of 2008 1604 e78811d76d6c154f8c3be8339339d5b460ae75e20c30d5f8359b5ac62974dd22.exe schtasks.exe PID 1604 wrote to memory of 1216 1604 e78811d76d6c154f8c3be8339339d5b460ae75e20c30d5f8359b5ac62974dd22.exe schtasks.exe PID 1604 wrote to memory of 1216 1604 e78811d76d6c154f8c3be8339339d5b460ae75e20c30d5f8359b5ac62974dd22.exe schtasks.exe PID 1604 wrote to memory of 1216 1604 e78811d76d6c154f8c3be8339339d5b460ae75e20c30d5f8359b5ac62974dd22.exe schtasks.exe -
System policy modification 1 TTPs 2 IoCs
Processes:
e78811d76d6c154f8c3be8339339d5b460ae75e20c30d5f8359b5ac62974dd22.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID e78811d76d6c154f8c3be8339339d5b460ae75e20c30d5f8359b5ac62974dd22.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\{598AC71E-BE58-3981-B78A-5C138F423AD6} = "1" e78811d76d6c154f8c3be8339339d5b460ae75e20c30d5f8359b5ac62974dd22.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e78811d76d6c154f8c3be8339339d5b460ae75e20c30d5f8359b5ac62974dd22.exe"C:\Users\Admin\AppData\Local\Temp\e78811d76d6c154f8c3be8339339d5b460ae75e20c30d5f8359b5ac62974dd22.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /Delete /tn "4CEFD9B73D6C-1CRMOI2" /f2⤵
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /Create /TR "C:\Users\Admin\AppData\Roaming\ARHome\Updater.exe" /SC DAILY /TN "4CEFD9B73D6C-1CRMOI2" /ST 19:09:00 /du 0024:00 /RI 360 /RL HIGHEST /f2⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /Delete /tn "5FOFD9B73D6C-2CRMOI6" /f2⤵
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /Create /TR "C:\Users\Admin\AppData\Roaming\ARHome\Updater.exe" /SC ONIDLE /TN "5FOFD9B73D6C-2CRMOI6" /I 1 /RL HIGHEST /f2⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\SysWOW64\regsvr32.exe" /s "C:\Users\Admin\AppData\Roaming\VolIE\FoxPro_32.dll"2⤵
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Modifies registry class
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\SysWOW64\regsvr32.exe" /s "C:\Users\Admin\AppData\Roaming\VolIE\FoxPro_64.dll"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exe/s "C:\Users\Admin\AppData\Roaming\VolIE\FoxPro_64.dll"3⤵
- Registers COM server for autorun
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Modifies registry class
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" add HKCU\Software\NoVooITSet /v default /t reg_sz /d 12⤵
- Modifies registry key
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://www.acdcads.com/aff/thanks/updater-thanks.php?t=1386580451&wti=1000&s=1000&sta=1&av=None2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:824 CREDAT:275457 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /Delete /tn "mium0d" /f2⤵
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /Create /TR "C:\Users\Admin\AppData\Roaming\miaul\RJFC.exe" /SC ONLOGON /TN "mium0d" /RL HIGHEST /f2⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /Delete /tn "keepup" /f2⤵
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /Create /TR "C:\Users\Admin\AppData\Roaming\miaul\RJFC.exe" /SC DAILY /TN "keepup" /ST 13:38:00 /du 0024:00 /RI 10 /RL HIGHEST /f2⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\E78811~1.EXE > nul2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\IPR9Y7WK.txtFilesize
603B
MD5442f3c1a5f6279d458031aea71fc20de
SHA10bad23bdf5416cc80bdde0b1cd35c0073f1f4968
SHA256d7eb5474bfaa6ce058cd2db13ece513d6eafc64045faff178a7a86fd84939330
SHA5125227b7433060ace6eb1f380d75b65e58943bfb283be2c86d1521fe60c1b9063f0eddf93c8af6903dbd5a516df6ca7ce9229757786c4a5427d9a4e07e31e3e0b5
-
C:\Users\Admin\AppData\Roaming\VolIE\FoxPro_32.dllFilesize
182KB
MD5ce31a05ee7c72fea9ea74dcc1a16e8d6
SHA1e524c0f68b735138174137a034f5b5f7878917fb
SHA2561a66dab0e452c64fca4ae8f976c8fd4b790926d246db9de88c95453c7cda255f
SHA512a285766e17888135ba468a69bf460fc03b2fa5fdf64d479e6767e653abe5366dfd5d9ac319f39413559a1e496db18219c8f10fa22dc49fe0fd391c1c82b146c3
-
C:\Users\Admin\AppData\Roaming\VolIE\FoxPro_64.dllFilesize
218KB
MD550d22dadb851a45d0594f23b23b9bc13
SHA12e042aed9b0aa3adc3c9e5b9728f6e8ee0c5d2a6
SHA256a742c4aa880a36eac02e3cb2a3d07f0edc5a9f7c94c7c53e88264ec16594a07b
SHA51290f2af018d03db1c9aa17f7fa98b4aa9d39c5a8de4433ab4e305a2212fa53581630c5d39061d22dabb73fe4b848a0d0973357521655b19c700ada574cc71242e
-
\Users\Admin\AppData\Roaming\VolIE\FoxPro_32.dllFilesize
182KB
MD5ce31a05ee7c72fea9ea74dcc1a16e8d6
SHA1e524c0f68b735138174137a034f5b5f7878917fb
SHA2561a66dab0e452c64fca4ae8f976c8fd4b790926d246db9de88c95453c7cda255f
SHA512a285766e17888135ba468a69bf460fc03b2fa5fdf64d479e6767e653abe5366dfd5d9ac319f39413559a1e496db18219c8f10fa22dc49fe0fd391c1c82b146c3
-
\Users\Admin\AppData\Roaming\VolIE\FoxPro_64.dllFilesize
218KB
MD550d22dadb851a45d0594f23b23b9bc13
SHA12e042aed9b0aa3adc3c9e5b9728f6e8ee0c5d2a6
SHA256a742c4aa880a36eac02e3cb2a3d07f0edc5a9f7c94c7c53e88264ec16594a07b
SHA51290f2af018d03db1c9aa17f7fa98b4aa9d39c5a8de4433ab4e305a2212fa53581630c5d39061d22dabb73fe4b848a0d0973357521655b19c700ada574cc71242e
-
\Users\Admin\AppData\Roaming\VolIE\FoxPro_64.dllFilesize
218KB
MD550d22dadb851a45d0594f23b23b9bc13
SHA12e042aed9b0aa3adc3c9e5b9728f6e8ee0c5d2a6
SHA256a742c4aa880a36eac02e3cb2a3d07f0edc5a9f7c94c7c53e88264ec16594a07b
SHA51290f2af018d03db1c9aa17f7fa98b4aa9d39c5a8de4433ab4e305a2212fa53581630c5d39061d22dabb73fe4b848a0d0973357521655b19c700ada574cc71242e
-
memory/472-59-0x0000000000000000-mapping.dmp
-
memory/584-76-0x0000000000000000-mapping.dmp
-
memory/860-79-0x0000000000000000-mapping.dmp
-
memory/1216-78-0x0000000000000000-mapping.dmp
-
memory/1248-62-0x0000000000000000-mapping.dmp
-
memory/1324-60-0x0000000000000000-mapping.dmp
-
memory/1356-61-0x0000000000000000-mapping.dmp
-
memory/1496-71-0x0000000000000000-mapping.dmp
-
memory/1496-73-0x000007FEFC481000-0x000007FEFC483000-memory.dmpFilesize
8KB
-
memory/1504-75-0x0000000000000000-mapping.dmp
-
memory/1544-72-0x0000000000000000-mapping.dmp
-
memory/1604-54-0x0000000000400000-0x00000000017FB000-memory.dmpFilesize
20.0MB
-
memory/1604-58-0x0000000000400000-0x00000000017FB000-memory.dmpFilesize
20.0MB
-
memory/1604-57-0x0000000077E10000-0x0000000077F90000-memory.dmpFilesize
1.5MB
-
memory/1604-80-0x0000000000400000-0x00000000017FB000-memory.dmpFilesize
20.0MB
-
memory/1604-81-0x0000000077E10000-0x0000000077F90000-memory.dmpFilesize
1.5MB
-
memory/1604-55-0x0000000076DC1000-0x0000000076DC3000-memory.dmpFilesize
8KB
-
memory/1756-63-0x0000000000000000-mapping.dmp
-
memory/1760-64-0x0000000000000000-mapping.dmp
-
memory/2008-77-0x0000000000000000-mapping.dmp