Analysis
-
max time kernel
153s -
max time network
182s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
25-11-2022 06:52
Static task
static1
Behavioral task
behavioral1
Sample
e78811d76d6c154f8c3be8339339d5b460ae75e20c30d5f8359b5ac62974dd22.exe
Resource
win7-20220812-en
General
-
Target
e78811d76d6c154f8c3be8339339d5b460ae75e20c30d5f8359b5ac62974dd22.exe
-
Size
1.8MB
-
MD5
e4228a678244df4158509751680f4585
-
SHA1
47d0d9f3d70461d058090843f0e93a3a8fd93f10
-
SHA256
e78811d76d6c154f8c3be8339339d5b460ae75e20c30d5f8359b5ac62974dd22
-
SHA512
6f34ae2aec27f5b23f5bbe05df1dcbb65c5409a9b5dde11fb7b356a4b56ea65245fef1281482c7208b1096e97ca59417b42adac0af94ba117be356b4f431e493
-
SSDEEP
49152:SsDsqkEOVf7bZWVg4sZi2DLOFKMsoHIW5vVsUOO:QqSZRWO8xvsyvVsfO
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
Processes:
e78811d76d6c154f8c3be8339339d5b460ae75e20c30d5f8359b5ac62974dd22.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ e78811d76d6c154f8c3be8339339d5b460ae75e20c30d5f8359b5ac62974dd22.exe -
Registers COM server for autorun 1 TTPs 3 IoCs
Processes:
regsvr32.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{598AC71E-BE58-3981-B78A-5C138F423AD6}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Roaming\\VolIE\\FoxPro_64.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{598AC71E-BE58-3981-B78A-5C138F423AD6}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{598AC71E-BE58-3981-B78A-5C138F423AD6}\InprocServer32 regsvr32.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
e78811d76d6c154f8c3be8339339d5b460ae75e20c30d5f8359b5ac62974dd22.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion e78811d76d6c154f8c3be8339339d5b460ae75e20c30d5f8359b5ac62974dd22.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion e78811d76d6c154f8c3be8339339d5b460ae75e20c30d5f8359b5ac62974dd22.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
e78811d76d6c154f8c3be8339339d5b460ae75e20c30d5f8359b5ac62974dd22.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation e78811d76d6c154f8c3be8339339d5b460ae75e20c30d5f8359b5ac62974dd22.exe -
Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
Processes:
e78811d76d6c154f8c3be8339339d5b460ae75e20c30d5f8359b5ac62974dd22.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Wine e78811d76d6c154f8c3be8339339d5b460ae75e20c30d5f8359b5ac62974dd22.exe -
Loads dropped DLL 3 IoCs
Processes:
regsvr32.exeregsvr32.exeregsvr32.exepid process 3136 regsvr32.exe 3040 regsvr32.exe 4572 regsvr32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
e78811d76d6c154f8c3be8339339d5b460ae75e20c30d5f8359b5ac62974dd22.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA e78811d76d6c154f8c3be8339339d5b460ae75e20c30d5f8359b5ac62974dd22.exe -
Installs/modifies Browser Helper Object 2 TTPs 14 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
Processes:
regsvr32.exeregsvr32.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{598AC71E-BE58-3981-B78A-5C138F423AD6}\NoExplorer = "1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{598AC71E-BE58-3981-B78A-5C138F423AD6} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{598AC71E-BE58-3981-B78A-5C138F423AD6}\ = "FoxPro" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{598AC71E-BE58-3981-B78A-5C138F423AD6}\ = "FoxPro" regsvr32.exe Key deleted \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{598AC71E-BE58-3981-B78A-5C138F423AD6} regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{598AC71E-BE58-3981-B78A-5C138F423AD6} regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{598AC71E-BE58-3981-B78A-5C138F423AD6}\NoExplorer = "1" regsvr32.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{598AC71E-BE58-3981-B78A-5C138F423AD6}\NoExplorer = "1" regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{598AC71E-BE58-3981-B78A-5C138F423AD6}\NoExplorer = "1" regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects regsvr32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{598AC71E-BE58-3981-B78A-5C138F423AD6}\ = "FoxPro" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{598AC71E-BE58-3981-B78A-5C138F423AD6} regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{598AC71E-BE58-3981-B78A-5C138F423AD6} regsvr32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{598AC71E-BE58-3981-B78A-5C138F423AD6}\ = "FoxPro" regsvr32.exe -
Drops file in System32 directory 5 IoCs
Processes:
e78811d76d6c154f8c3be8339339d5b460ae75e20c30d5f8359b5ac62974dd22.exedescription ioc process File opened for modification C:\Windows\System32\GroupPolicy\GPT.INI e78811d76d6c154f8c3be8339339d5b460ae75e20c30d5f8359b5ac62974dd22.exe File opened for modification C:\Windows\System32\GroupPolicy\Machine\Registry.pol e78811d76d6c154f8c3be8339339d5b460ae75e20c30d5f8359b5ac62974dd22.exe File opened for modification C:\Windows\System32\GroupPolicy e78811d76d6c154f8c3be8339339d5b460ae75e20c30d5f8359b5ac62974dd22.exe File opened for modification C:\Windows\SysWOW64\GroupPolicy\gpt.ini e78811d76d6c154f8c3be8339339d5b460ae75e20c30d5f8359b5ac62974dd22.exe File created C:\Windows\System32\GroupPolicy\Machine\Registry.pol e78811d76d6c154f8c3be8339339d5b460ae75e20c30d5f8359b5ac62974dd22.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
e78811d76d6c154f8c3be8339339d5b460ae75e20c30d5f8359b5ac62974dd22.exepid process 4880 e78811d76d6c154f8c3be8339339d5b460ae75e20c30d5f8359b5ac62974dd22.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 4 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exepid process 4724 schtasks.exe 2924 schtasks.exe 3032 schtasks.exe 2324 schtasks.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Modifies registry class 64 IoCs
Processes:
regsvr32.exeregsvr32.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FoxPro.FoxPro\CurVer regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{598AC71E-BE58-3981-B78A-5C138F423AD6}\Programmable regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3FC2D59A-5C76-1E97-30DC-1EC6784419E5}\1.0\FLAGS\ = "0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3FC2D59A-5C76-1E97-30DC-1EC6784419E5}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Roaming\\VolIE" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{63D2A451-3351-178C-7BC4-13C4D58A7652}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FoxPro.FoxPro.1\CLSID\ = "{598AC71E-BE58-3981-B78A-5C138F423AD6}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FoxPro.FoxPro\CLSID\ = "{598AC71E-BE58-3981-B78A-5C138F423AD6}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{598AC71E-BE58-3981-B78A-5C138F423AD6}\VersionIndependentProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{63D2A451-3351-178C-7BC4-13C4D58A7652}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\FoxPro.DLL\AppID = "{6DD1B906-45FA-4A57-9AC6-01108C25067F}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{598AC71E-BE58-3981-B78A-5C138F423AD6}\ProgID\ = "FoxPro.FoxPro.1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{63D2A451-3351-178C-7BC4-13C4D58A7652}\ = "IFoxProBHO" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{63D2A451-3351-178C-7BC4-13C4D58A7652}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{63D2A451-3351-178C-7BC4-13C4D58A7652}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{598AC71E-BE58-3981-B78A-5C138F423AD6}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FoxPro.FoxPro\CurVer\ = "FoxPro.FoxPro.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{598AC71E-BE58-3981-B78A-5C138F423AD6}\VersionIndependentProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3FC2D59A-5C76-1E97-30DC-1EC6784419E5}\1.0\FLAGS regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3FC2D59A-5C76-1E97-30DC-1EC6784419E5}\1.0\HELPDIR regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{63D2A451-3351-178C-7BC4-13C4D58A7652}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{63D2A451-3351-178C-7BC4-13C4D58A7652}\TypeLib\ = "{3FC2D59A-5C76-1E97-30DC-1EC6784419E5}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{598AC71E-BE58-3981-B78A-5C138F423AD6}\ProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{598AC71E-BE58-3981-B78A-5C138F423AD6}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{598AC71E-BE58-3981-B78A-5C138F423AD6}\ = "FoxPro Class" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{598AC71E-BE58-3981-B78A-5C138F423AD6}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Roaming\\VolIE\\FoxPro_32.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3FC2D59A-5C76-1E97-30DC-1EC6784419E5}\1.0 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{63D2A451-3351-178C-7BC4-13C4D58A7652}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3FC2D59A-5C76-1E97-30DC-1EC6784419E5} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{63D2A451-3351-178C-7BC4-13C4D58A7652}\ = "IFoxProBHO" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{63D2A451-3351-178C-7BC4-13C4D58A7652}\TypeLib\ = "{3FC2D59A-5C76-1E97-30DC-1EC6784419E5}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FoxPro.FoxPro.1\ = "FoxPro Class" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\FoxPro.DLL regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{598AC71E-BE58-3981-B78A-5C138F423AD6}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{598AC71E-BE58-3981-B78A-5C138F423AD6}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3FC2D59A-5C76-1E97-30DC-1EC6784419E5}\1.0\0 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3FC2D59A-5C76-1E97-30DC-1EC6784419E5}\1.0\0\win32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FoxPro.FoxPro\CLSID\ = "{598AC71E-BE58-3981-B78A-5C138F423AD6}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{63D2A451-3351-178C-7BC4-13C4D58A7652}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{63D2A451-3351-178C-7BC4-13C4D58A7652}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FoxPro.FoxPro\ = "FoxPro Class" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\FoxPro.DLL\AppID = "{6DD1B906-45FA-4A57-9AC6-01108C25067F}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FoxPro.FoxPro\ = "FoxPro Class" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{598AC71E-BE58-3981-B78A-5C138F423AD6}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{63D2A451-3351-178C-7BC4-13C4D58A7652} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{598AC71E-BE58-3981-B78A-5C138F423AD6}\TypeLib\ = "{3FC2D59A-5C76-1E97-30DC-1EC6784419E5}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{6DD1B906-45FA-4A57-9AC6-01108C25067F}\ = "FoxPro" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{598AC71E-BE58-3981-B78A-5C138F423AD6}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{6DD1B906-45FA-4A57-9AC6-01108C25067F} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{6DD1B906-45FA-4A57-9AC6-01108C25067F}\ = "FoxPro" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FoxPro.FoxPro\CLSID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{598AC71E-BE58-3981-B78A-5C138F423AD6} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3FC2D59A-5C76-1E97-30DC-1EC6784419E5}\1.0\ = "FoxPro 3.0 Type Library" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{598AC71E-BE58-3981-B78A-5C138F423AD6}\TypeLib\ = "{3FC2D59A-5C76-1E97-30DC-1EC6784419E5}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FoxPro.FoxPro.1\ = "FoxPro Class" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{598AC71E-BE58-3981-B78A-5C138F423AD6}\VersionIndependentProgID\ = "FoxPro.FoxPro" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{598AC71E-BE58-3981-B78A-5C138F423AD6}\Programmable regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{598AC71E-BE58-3981-B78A-5C138F423AD6}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Roaming\\VolIE\\FoxPro_64.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3FC2D59A-5C76-1E97-30DC-1EC6784419E5}\1.0\0\win64\ = "C:\\Users\\Admin\\AppData\\Roaming\\VolIE\\FoxPro_64.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FoxPro.FoxPro.1\CLSID\ = "{598AC71E-BE58-3981-B78A-5C138F423AD6}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{63D2A451-3351-178C-7BC4-13C4D58A7652} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FoxPro.FoxPro\CurVer\ = "FoxPro.FoxPro.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{598AC71E-BE58-3981-B78A-5C138F423AD6} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{598AC71E-BE58-3981-B78A-5C138F423AD6}\VersionIndependentProgID\ = "FoxPro.FoxPro" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FoxPro.FoxPro.1 regsvr32.exe -
Modifies registry key 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
e78811d76d6c154f8c3be8339339d5b460ae75e20c30d5f8359b5ac62974dd22.exemsedge.exemsedge.exemsedge.exepid process 4880 e78811d76d6c154f8c3be8339339d5b460ae75e20c30d5f8359b5ac62974dd22.exe 4880 e78811d76d6c154f8c3be8339339d5b460ae75e20c30d5f8359b5ac62974dd22.exe 2644 msedge.exe 2644 msedge.exe 4252 msedge.exe 4252 msedge.exe 3976 msedge.exe 3976 msedge.exe 3976 msedge.exe 3976 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
Processes:
msedge.exepid process 4252 msedge.exe 4252 msedge.exe 4252 msedge.exe 4252 msedge.exe 4252 msedge.exe 4252 msedge.exe 4252 msedge.exe 4252 msedge.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
e78811d76d6c154f8c3be8339339d5b460ae75e20c30d5f8359b5ac62974dd22.exedescription pid process Token: SeIncBasePriorityPrivilege 4880 e78811d76d6c154f8c3be8339339d5b460ae75e20c30d5f8359b5ac62974dd22.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
Processes:
msedge.exepid process 4252 msedge.exe 4252 msedge.exe 4252 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
e78811d76d6c154f8c3be8339339d5b460ae75e20c30d5f8359b5ac62974dd22.exeregsvr32.exemsedge.exedescription pid process target process PID 4880 wrote to memory of 688 4880 e78811d76d6c154f8c3be8339339d5b460ae75e20c30d5f8359b5ac62974dd22.exe schtasks.exe PID 4880 wrote to memory of 688 4880 e78811d76d6c154f8c3be8339339d5b460ae75e20c30d5f8359b5ac62974dd22.exe schtasks.exe PID 4880 wrote to memory of 688 4880 e78811d76d6c154f8c3be8339339d5b460ae75e20c30d5f8359b5ac62974dd22.exe schtasks.exe PID 4880 wrote to memory of 4724 4880 e78811d76d6c154f8c3be8339339d5b460ae75e20c30d5f8359b5ac62974dd22.exe schtasks.exe PID 4880 wrote to memory of 4724 4880 e78811d76d6c154f8c3be8339339d5b460ae75e20c30d5f8359b5ac62974dd22.exe schtasks.exe PID 4880 wrote to memory of 4724 4880 e78811d76d6c154f8c3be8339339d5b460ae75e20c30d5f8359b5ac62974dd22.exe schtasks.exe PID 4880 wrote to memory of 2308 4880 e78811d76d6c154f8c3be8339339d5b460ae75e20c30d5f8359b5ac62974dd22.exe schtasks.exe PID 4880 wrote to memory of 2308 4880 e78811d76d6c154f8c3be8339339d5b460ae75e20c30d5f8359b5ac62974dd22.exe schtasks.exe PID 4880 wrote to memory of 2308 4880 e78811d76d6c154f8c3be8339339d5b460ae75e20c30d5f8359b5ac62974dd22.exe schtasks.exe PID 4880 wrote to memory of 2924 4880 e78811d76d6c154f8c3be8339339d5b460ae75e20c30d5f8359b5ac62974dd22.exe schtasks.exe PID 4880 wrote to memory of 2924 4880 e78811d76d6c154f8c3be8339339d5b460ae75e20c30d5f8359b5ac62974dd22.exe schtasks.exe PID 4880 wrote to memory of 2924 4880 e78811d76d6c154f8c3be8339339d5b460ae75e20c30d5f8359b5ac62974dd22.exe schtasks.exe PID 4880 wrote to memory of 3136 4880 e78811d76d6c154f8c3be8339339d5b460ae75e20c30d5f8359b5ac62974dd22.exe regsvr32.exe PID 4880 wrote to memory of 3136 4880 e78811d76d6c154f8c3be8339339d5b460ae75e20c30d5f8359b5ac62974dd22.exe regsvr32.exe PID 4880 wrote to memory of 3136 4880 e78811d76d6c154f8c3be8339339d5b460ae75e20c30d5f8359b5ac62974dd22.exe regsvr32.exe PID 4880 wrote to memory of 3040 4880 e78811d76d6c154f8c3be8339339d5b460ae75e20c30d5f8359b5ac62974dd22.exe regsvr32.exe PID 4880 wrote to memory of 3040 4880 e78811d76d6c154f8c3be8339339d5b460ae75e20c30d5f8359b5ac62974dd22.exe regsvr32.exe PID 4880 wrote to memory of 3040 4880 e78811d76d6c154f8c3be8339339d5b460ae75e20c30d5f8359b5ac62974dd22.exe regsvr32.exe PID 4880 wrote to memory of 2416 4880 e78811d76d6c154f8c3be8339339d5b460ae75e20c30d5f8359b5ac62974dd22.exe reg.exe PID 4880 wrote to memory of 2416 4880 e78811d76d6c154f8c3be8339339d5b460ae75e20c30d5f8359b5ac62974dd22.exe reg.exe PID 4880 wrote to memory of 2416 4880 e78811d76d6c154f8c3be8339339d5b460ae75e20c30d5f8359b5ac62974dd22.exe reg.exe PID 3040 wrote to memory of 4572 3040 regsvr32.exe regsvr32.exe PID 3040 wrote to memory of 4572 3040 regsvr32.exe regsvr32.exe PID 4880 wrote to memory of 4252 4880 e78811d76d6c154f8c3be8339339d5b460ae75e20c30d5f8359b5ac62974dd22.exe msedge.exe PID 4880 wrote to memory of 4252 4880 e78811d76d6c154f8c3be8339339d5b460ae75e20c30d5f8359b5ac62974dd22.exe msedge.exe PID 4880 wrote to memory of 3372 4880 e78811d76d6c154f8c3be8339339d5b460ae75e20c30d5f8359b5ac62974dd22.exe schtasks.exe PID 4880 wrote to memory of 3372 4880 e78811d76d6c154f8c3be8339339d5b460ae75e20c30d5f8359b5ac62974dd22.exe schtasks.exe PID 4880 wrote to memory of 3372 4880 e78811d76d6c154f8c3be8339339d5b460ae75e20c30d5f8359b5ac62974dd22.exe schtasks.exe PID 4252 wrote to memory of 2060 4252 msedge.exe msedge.exe PID 4252 wrote to memory of 2060 4252 msedge.exe msedge.exe PID 4880 wrote to memory of 3032 4880 e78811d76d6c154f8c3be8339339d5b460ae75e20c30d5f8359b5ac62974dd22.exe schtasks.exe PID 4880 wrote to memory of 3032 4880 e78811d76d6c154f8c3be8339339d5b460ae75e20c30d5f8359b5ac62974dd22.exe schtasks.exe PID 4880 wrote to memory of 3032 4880 e78811d76d6c154f8c3be8339339d5b460ae75e20c30d5f8359b5ac62974dd22.exe schtasks.exe PID 4880 wrote to memory of 3104 4880 e78811d76d6c154f8c3be8339339d5b460ae75e20c30d5f8359b5ac62974dd22.exe schtasks.exe PID 4880 wrote to memory of 3104 4880 e78811d76d6c154f8c3be8339339d5b460ae75e20c30d5f8359b5ac62974dd22.exe schtasks.exe PID 4880 wrote to memory of 3104 4880 e78811d76d6c154f8c3be8339339d5b460ae75e20c30d5f8359b5ac62974dd22.exe schtasks.exe PID 4252 wrote to memory of 2400 4252 msedge.exe msedge.exe PID 4252 wrote to memory of 2400 4252 msedge.exe msedge.exe PID 4252 wrote to memory of 2400 4252 msedge.exe msedge.exe PID 4252 wrote to memory of 2400 4252 msedge.exe msedge.exe PID 4252 wrote to memory of 2400 4252 msedge.exe msedge.exe PID 4252 wrote to memory of 2400 4252 msedge.exe msedge.exe PID 4252 wrote to memory of 2400 4252 msedge.exe msedge.exe PID 4252 wrote to memory of 2400 4252 msedge.exe msedge.exe PID 4252 wrote to memory of 2400 4252 msedge.exe msedge.exe PID 4252 wrote to memory of 2400 4252 msedge.exe msedge.exe PID 4252 wrote to memory of 2400 4252 msedge.exe msedge.exe PID 4252 wrote to memory of 2400 4252 msedge.exe msedge.exe PID 4252 wrote to memory of 2400 4252 msedge.exe msedge.exe PID 4252 wrote to memory of 2400 4252 msedge.exe msedge.exe PID 4252 wrote to memory of 2400 4252 msedge.exe msedge.exe PID 4252 wrote to memory of 2400 4252 msedge.exe msedge.exe PID 4252 wrote to memory of 2400 4252 msedge.exe msedge.exe PID 4252 wrote to memory of 2400 4252 msedge.exe msedge.exe PID 4252 wrote to memory of 2400 4252 msedge.exe msedge.exe PID 4252 wrote to memory of 2400 4252 msedge.exe msedge.exe PID 4252 wrote to memory of 2400 4252 msedge.exe msedge.exe PID 4252 wrote to memory of 2400 4252 msedge.exe msedge.exe PID 4252 wrote to memory of 2400 4252 msedge.exe msedge.exe PID 4252 wrote to memory of 2400 4252 msedge.exe msedge.exe PID 4252 wrote to memory of 2400 4252 msedge.exe msedge.exe PID 4252 wrote to memory of 2400 4252 msedge.exe msedge.exe PID 4252 wrote to memory of 2400 4252 msedge.exe msedge.exe PID 4252 wrote to memory of 2400 4252 msedge.exe msedge.exe -
System policy modification 1 TTPs 1 IoCs
Processes:
e78811d76d6c154f8c3be8339339d5b460ae75e20c30d5f8359b5ac62974dd22.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\{598AC71E-BE58-3981-B78A-5C138F423AD6} = "1" e78811d76d6c154f8c3be8339339d5b460ae75e20c30d5f8359b5ac62974dd22.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e78811d76d6c154f8c3be8339339d5b460ae75e20c30d5f8359b5ac62974dd22.exe"C:\Users\Admin\AppData\Local\Temp\e78811d76d6c154f8c3be8339339d5b460ae75e20c30d5f8359b5ac62974dd22.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Identifies Wine through registry keys
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /Delete /tn "4CEFD9B73D6C-1CRMOI2" /f2⤵
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /Create /TR "C:\Users\Admin\AppData\Roaming\ARHome\Updater.exe" /SC DAILY /TN "4CEFD9B73D6C-1CRMOI2" /ST 15:50:00 /du 0024:00 /RI 360 /RL HIGHEST /f2⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /Delete /tn "5FOFD9B73D6C-2CRMOI6" /f2⤵
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /Create /TR "C:\Users\Admin\AppData\Roaming\ARHome\Updater.exe" /SC ONIDLE /TN "5FOFD9B73D6C-2CRMOI6" /I 1 /RL HIGHEST /f2⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\SysWOW64\regsvr32.exe" /s "C:\Users\Admin\AppData\Roaming\VolIE\FoxPro_32.dll"2⤵
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Modifies registry class
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\SysWOW64\regsvr32.exe" /s "C:\Users\Admin\AppData\Roaming\VolIE\FoxPro_64.dll"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exe/s "C:\Users\Admin\AppData\Roaming\VolIE\FoxPro_64.dll"3⤵
- Registers COM server for autorun
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Modifies registry class
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" add HKCU\Software\NoVooITSet /v default /t reg_sz /d 12⤵
- Modifies registry key
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.acdcads.com/aff/thanks/updater-thanks.php?t=1386580451&wti=1000&s=1000&sta=1&av=None2⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd8,0x104,0x7ffd7f9746f8,0x7ffd7f974708,0x7ffd7f9747183⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,3051326807099337596,15400661944098260517,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2176 /prefetch:23⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,3051326807099337596,15400661944098260517,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 /prefetch:33⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,3051326807099337596,15400661944098260517,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2728 /prefetch:83⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,3051326807099337596,15400661944098260517,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,3051326807099337596,15400661944098260517,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2100,3051326807099337596,15400661944098260517,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5564 /prefetch:83⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,3051326807099337596,15400661944098260517,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5528 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,3051326807099337596,15400661944098260517,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5620 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2100,3051326807099337596,15400661944098260517,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5552 /prefetch:83⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,3051326807099337596,15400661944098260517,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2024 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,3051326807099337596,15400661944098260517,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5808 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,3051326807099337596,15400661944098260517,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3684 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,3051326807099337596,15400661944098260517,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4424 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,3051326807099337596,15400661944098260517,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6148 /prefetch:23⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /Delete /tn "mium0d" /f2⤵
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /Create /TR "C:\Users\Admin\AppData\Roaming\miaul\RJFC.exe" /SC ONLOGON /TN "mium0d" /RL HIGHEST /f2⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /Delete /tn "keepup" /f2⤵
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /Create /TR "C:\Users\Admin\AppData\Roaming\miaul\RJFC.exe" /SC DAILY /TN "keepup" /ST 13:39:00 /du 0024:00 /RI 10 /RL HIGHEST /f2⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\E78811~1.EXE > nul2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\VolIE\FoxPro_32.dllFilesize
182KB
MD5ce31a05ee7c72fea9ea74dcc1a16e8d6
SHA1e524c0f68b735138174137a034f5b5f7878917fb
SHA2561a66dab0e452c64fca4ae8f976c8fd4b790926d246db9de88c95453c7cda255f
SHA512a285766e17888135ba468a69bf460fc03b2fa5fdf64d479e6767e653abe5366dfd5d9ac319f39413559a1e496db18219c8f10fa22dc49fe0fd391c1c82b146c3
-
C:\Users\Admin\AppData\Roaming\VolIE\FoxPro_32.dllFilesize
182KB
MD5ce31a05ee7c72fea9ea74dcc1a16e8d6
SHA1e524c0f68b735138174137a034f5b5f7878917fb
SHA2561a66dab0e452c64fca4ae8f976c8fd4b790926d246db9de88c95453c7cda255f
SHA512a285766e17888135ba468a69bf460fc03b2fa5fdf64d479e6767e653abe5366dfd5d9ac319f39413559a1e496db18219c8f10fa22dc49fe0fd391c1c82b146c3
-
C:\Users\Admin\AppData\Roaming\VolIE\FoxPro_64.dllFilesize
218KB
MD550d22dadb851a45d0594f23b23b9bc13
SHA12e042aed9b0aa3adc3c9e5b9728f6e8ee0c5d2a6
SHA256a742c4aa880a36eac02e3cb2a3d07f0edc5a9f7c94c7c53e88264ec16594a07b
SHA51290f2af018d03db1c9aa17f7fa98b4aa9d39c5a8de4433ab4e305a2212fa53581630c5d39061d22dabb73fe4b848a0d0973357521655b19c700ada574cc71242e
-
C:\Users\Admin\AppData\Roaming\VolIE\FoxPro_64.dllFilesize
218KB
MD550d22dadb851a45d0594f23b23b9bc13
SHA12e042aed9b0aa3adc3c9e5b9728f6e8ee0c5d2a6
SHA256a742c4aa880a36eac02e3cb2a3d07f0edc5a9f7c94c7c53e88264ec16594a07b
SHA51290f2af018d03db1c9aa17f7fa98b4aa9d39c5a8de4433ab4e305a2212fa53581630c5d39061d22dabb73fe4b848a0d0973357521655b19c700ada574cc71242e
-
C:\Users\Admin\AppData\Roaming\VolIE\FoxPro_64.dllFilesize
218KB
MD550d22dadb851a45d0594f23b23b9bc13
SHA12e042aed9b0aa3adc3c9e5b9728f6e8ee0c5d2a6
SHA256a742c4aa880a36eac02e3cb2a3d07f0edc5a9f7c94c7c53e88264ec16594a07b
SHA51290f2af018d03db1c9aa17f7fa98b4aa9d39c5a8de4433ab4e305a2212fa53581630c5d39061d22dabb73fe4b848a0d0973357521655b19c700ada574cc71242e
-
\??\pipe\LOCAL\crashpad_4252_WAOZEMGPQQNQQBSLMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/688-134-0x0000000000000000-mapping.dmp
-
memory/2060-150-0x0000000000000000-mapping.dmp
-
memory/2132-168-0x0000000000000000-mapping.dmp
-
memory/2308-137-0x0000000000000000-mapping.dmp
-
memory/2320-172-0x0000000000000000-mapping.dmp
-
memory/2324-156-0x0000000000000000-mapping.dmp
-
memory/2400-154-0x0000000000000000-mapping.dmp
-
memory/2416-142-0x0000000000000000-mapping.dmp
-
memory/2532-182-0x0000000000000000-mapping.dmp
-
memory/2644-155-0x0000000000000000-mapping.dmp
-
memory/2860-170-0x0000000000000000-mapping.dmp
-
memory/2924-138-0x0000000000000000-mapping.dmp
-
memory/3032-151-0x0000000000000000-mapping.dmp
-
memory/3040-140-0x0000000000000000-mapping.dmp
-
memory/3104-152-0x0000000000000000-mapping.dmp
-
memory/3136-139-0x0000000000000000-mapping.dmp
-
memory/3372-149-0x0000000000000000-mapping.dmp
-
memory/3420-166-0x0000000000000000-mapping.dmp
-
memory/3508-162-0x0000000000000000-mapping.dmp
-
memory/3640-158-0x0000000000000000-mapping.dmp
-
memory/3976-183-0x0000000000000000-mapping.dmp
-
memory/4144-164-0x0000000000000000-mapping.dmp
-
memory/4252-148-0x0000000000000000-mapping.dmp
-
memory/4472-180-0x0000000000000000-mapping.dmp
-
memory/4572-146-0x0000000000000000-mapping.dmp
-
memory/4692-174-0x0000000000000000-mapping.dmp
-
memory/4724-136-0x0000000000000000-mapping.dmp
-
memory/4780-178-0x0000000000000000-mapping.dmp
-
memory/4824-176-0x0000000000000000-mapping.dmp
-
memory/4880-159-0x0000000076EA0000-0x0000000077043000-memory.dmpFilesize
1.6MB
-
memory/4880-135-0x0000000076EA0000-0x0000000077043000-memory.dmpFilesize
1.6MB
-
memory/4880-161-0x0000000000400000-0x00000000017FB000-memory.dmpFilesize
20.0MB
-
memory/4880-133-0x0000000000400000-0x00000000017FB000-memory.dmpFilesize
20.0MB
-
memory/4880-132-0x0000000000400000-0x00000000017FB000-memory.dmpFilesize
20.0MB