Analysis
-
max time kernel
55s -
max time network
49s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
25-11-2022 09:17
Static task
static1
Behavioral task
behavioral1
Sample
90645c98826d0a5b416357943b8d05ce983c233a6834018c0fcb69bf08474cfe.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
90645c98826d0a5b416357943b8d05ce983c233a6834018c0fcb69bf08474cfe.exe
Resource
win10v2004-20220812-en
Errors
General
-
Target
90645c98826d0a5b416357943b8d05ce983c233a6834018c0fcb69bf08474cfe.exe
-
Size
973KB
-
MD5
c66f140df79c28dbcb79511467400d7e
-
SHA1
5ef2b80388644c8c3e7cf4a30190531a0398ddfc
-
SHA256
90645c98826d0a5b416357943b8d05ce983c233a6834018c0fcb69bf08474cfe
-
SHA512
3567e045f0258a0698dceeebfa3be11c7ced260d3e5c393b62a761ea0d7833ce291cc1827672627b26e096866bc78b48667d53db6d268118dc8fcfb4302c9ed2
-
SSDEEP
3072:aSsvihLlTQz9z71iURo2SJJmY6uFNcgifDbmeTXwVdBR:rsqhJMxzJiU5SeLmNSbmebW1
Malware Config
Signatures
-
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
Processes:
MeRbFe5wZWB1I8P.batdescription pid process target process PID 1072 created 668 1072 MeRbFe5wZWB1I8P.bat lsass.exe -
Adds policy Run key to start application 2 TTPs 7 IoCs
Processes:
MeRbFe5wZWB1I8P.bat90645c98826d0a5b416357943b8d05ce983c233a6834018c0fcb69bf08474cfe.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ = "\"C:\\Users\\Admin\\AppData\\LocalLow\\Sun\\Java\\Deployment\\cache\\6.0\\63\\hEOZdrVomgcAcPzbRoEHQ92Z1sI0VA2j0.exe\" O" MeRbFe5wZWB1I8P.bat Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run 90645c98826d0a5b416357943b8d05ce983c233a6834018c0fcb69bf08474cfe.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ = "\"C:\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\\LocalState\\XJwueWic5r5UMcb70MHY7Q36aEHbAcMJ1OfIx9uan33p8H9xjgeUT67uNR.exe\" O" 90645c98826d0a5b416357943b8d05ce983c233a6834018c0fcb69bf08474cfe.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run 90645c98826d0a5b416357943b8d05ce983c233a6834018c0fcb69bf08474cfe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\input\\fr-ML\\uWsA5tuCZlaFLvXTRlGgmzT35ZIBCXsPgK2gk3oIa.exe\" O" 90645c98826d0a5b416357943b8d05ce983c233a6834018c0fcb69bf08474cfe.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts\\EHsbCzcyisVsj6RdSIuEEiot460TujFSe5SelJUz6w.exe\" O" 90645c98826d0a5b416357943b8d05ce983c233a6834018c0fcb69bf08474cfe.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run MeRbFe5wZWB1I8P.bat -
Executes dropped EXE 2 IoCs
Processes:
MeRbFe5wZWB1I8P.batMeRbFe5wZWB1I8P.batpid process 1072 MeRbFe5wZWB1I8P.bat 1952 MeRbFe5wZWB1I8P.bat -
Sets file execution options in registry 2 TTPs 8 IoCs
Processes:
MeRbFe5wZWB1I8P.batMeRbFe5wZWB1I8P.batdescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MsMpEng.exe MeRbFe5wZWB1I8P.bat Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MsMpEng.exe\Debugger = " " MeRbFe5wZWB1I8P.bat Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MpCmdRun.exe MeRbFe5wZWB1I8P.bat Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MpCmdRun.exe\Debugger = " " MeRbFe5wZWB1I8P.bat Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MsMpEng.exe MeRbFe5wZWB1I8P.bat Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MsMpEng.exe\Debugger = " " MeRbFe5wZWB1I8P.bat Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MpCmdRun.exe MeRbFe5wZWB1I8P.bat Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MpCmdRun.exe\Debugger = " " MeRbFe5wZWB1I8P.bat -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies data under HKEY_USERS 64 IoCs
Processes:
90645c98826d0a5b416357943b8d05ce983c233a6834018c0fcb69bf08474cfe.exegpscript.exeMeRbFe5wZWB1I8P.batLogonUI.exedescription ioc process Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft 90645c98826d0a5b416357943b8d05ce983c233a6834018c0fcb69bf08474cfe.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows 90645c98826d0a5b416357943b8d05ce983c233a6834018c0fcb69bf08474cfe.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer gpscript.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Command Processor\AutoRun = "\"C:\\ProgramData\\Microsoft\\Diagnosis\\TenantStorage\\QGeM6RNwV7ssrplrUVFghafIQzu2Jzcee8aAIl6mt95LofXEOkJhqa1qnS.exe\" O 2>NUL" MeRbFe5wZWB1I8P.bat Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Command Processor 90645c98826d0a5b416357943b8d05ce983c233a6834018c0fcb69bf08474cfe.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer 90645c98826d0a5b416357943b8d05ce983c233a6834018c0fcb69bf08474cfe.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ = "\"C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\Archive\\KeyHolder\\0cOBew2X7PQGk2cKDGsc39UEZWSH6sklpJECqie.exe\" O" MeRbFe5wZWB1I8P.bat Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Command Processor 90645c98826d0a5b416357943b8d05ce983c233a6834018c0fcb69bf08474cfe.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies 90645c98826d0a5b416357943b8d05ce983c233a6834018c0fcb69bf08474cfe.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion 90645c98826d0a5b416357943b8d05ce983c233a6834018c0fcb69bf08474cfe.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\input\\es-SV\\NKqbAFMWuuYei6czd48rBYYHbi4GWNGQG22L.exe\" O" 90645c98826d0a5b416357943b8d05ce983c233a6834018c0fcb69bf08474cfe.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion 90645c98826d0a5b416357943b8d05ce983c233a6834018c0fcb69bf08474cfe.exe Key created \REGISTRY\USER\S-1-5-19 90645c98826d0a5b416357943b8d05ce983c233a6834018c0fcb69bf08474cfe.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040" LogonUI.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ = "\"C:\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\AppData\\mwqQw5T2ulyJJQH2YGGYVjUwr2ZszlzcfWUyYBnbUcr86X3k0EiKjGPb.exe\" O" MeRbFe5wZWB1I8P.bat Set value (str) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Command Processor\AutoRun = "\"C:\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\\SystemAppData\\9O2FG8Bu7QmgN0F6LS2h7x6TpL0Q6RFWPw8cg58.exe\" O 2>NUL" 90645c98826d0a5b416357943b8d05ce983c233a6834018c0fcb69bf08474cfe.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run 90645c98826d0a5b416357943b8d05ce983c233a6834018c0fcb69bf08474cfe.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Command Processor MeRbFe5wZWB1I8P.bat Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Command Processor\AutoRun = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\AppCache\\SDVAWEL2\\VLCaE0X5o5hf3Wsg4qT0.exe\" O 2>NUL" 90645c98826d0a5b416357943b8d05ce983c233a6834018c0fcb69bf08474cfe.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run 90645c98826d0a5b416357943b8d05ce983c233a6834018c0fcb69bf08474cfe.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00 LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89" LogonUI.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run MeRbFe5wZWB1I8P.bat Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Command Processor 90645c98826d0a5b416357943b8d05ce983c233a6834018c0fcb69bf08474cfe.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows 90645c98826d0a5b416357943b8d05ce983c233a6834018c0fcb69bf08474cfe.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ = "\"C:\\Users\\Admin\\AppData\\Local\\Packages\\c5e2524a-ea46-4f67-841f-6a9465d9d515_cw5n1h2txyewy\\LocalState\\kWkPO8JtURiGDrx4.exe\" O" 90645c98826d0a5b416357943b8d05ce983c233a6834018c0fcb69bf08474cfe.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer 90645c98826d0a5b416357943b8d05ce983c233a6834018c0fcb69bf08474cfe.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "182" LogonUI.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ = "\"C:\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.CallingShellApp_cw5n1h2txyewy\\SystemAppData\\ouBLvbIzndzfsTCKWYY4d1wFykretdZPKx8ueMQzKBSjFOAIE7GbD1q0HBCFwisBImxhK.exe\" O" MeRbFe5wZWB1I8P.bat Key created \REGISTRY\USER\S-1-5-20 90645c98826d0a5b416357943b8d05ce983c233a6834018c0fcb69bf08474cfe.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Command Processor MeRbFe5wZWB1I8P.bat Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft 90645c98826d0a5b416357943b8d05ce983c233a6834018c0fcb69bf08474cfe.exe Set value (str) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\QHN2mCgvuTWuilvgfRsk6sh4qdrnLcfp9imqfTb78jxcc6.exe\" O" 90645c98826d0a5b416357943b8d05ce983c233a6834018c0fcb69bf08474cfe.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run MeRbFe5wZWB1I8P.bat Set value (str) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\18.151.0729.0013\\sd-Arab-PK\\drSPPno7mmMISkZyfjSp3.exe\" O" MeRbFe5wZWB1I8P.bat Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Command Processor\AutoRun = "\"C:\\Users\\Admin\\AppData\\Local\\Packages\\E2A4F912-2574-4A75-9BB0-0D023378592B_cw5n1h2txyewy\\AC\\INetHistory\\xfP9dBbOggaQmVVYNbs3rYCgObrwxA0kFwoHcpGvIi.exe\" O 2>NUL" 90645c98826d0a5b416357943b8d05ce983c233a6834018c0fcb69bf08474cfe.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft 90645c98826d0a5b416357943b8d05ce983c233a6834018c0fcb69bf08474cfe.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM LogonUI.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Command Processor\AutoRun = "\"C:\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.VCLibs.140.00_8wekyb3d8bbwe\\AC\\INetCookies\\1LIMXCfXjR5EZXoEmP.exe\" O 2>NUL" MeRbFe5wZWB1I8P.bat Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Command Processor\AutoRun = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\input\\ms-BN\\QZgXvlUtJg2q1EkbTB.exe\" O 2>NUL" 90645c98826d0a5b416357943b8d05ce983c233a6834018c0fcb69bf08474cfe.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run 90645c98826d0a5b416357943b8d05ce983c233a6834018c0fcb69bf08474cfe.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows 90645c98826d0a5b416357943b8d05ce983c233a6834018c0fcb69bf08474cfe.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion 90645c98826d0a5b416357943b8d05ce983c233a6834018c0fcb69bf08474cfe.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ = "\"C:\\Users\\Admin\\AppData\\Local\\Packages\\c5e2524a-ea46-4f67-841f-6a9465d9d515_cw5n1h2txyewy\\lxjGJWxNZdmwFsHynWzxom8v2W5B6zXkcnqyVP1fPueZmCuQeWFJUaueP2R0jQ.exe\" O" 90645c98826d0a5b416357943b8d05ce983c233a6834018c0fcb69bf08474cfe.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached MeRbFe5wZWB1I8P.bat Key created \REGISTRY\USER\.DEFAULT 90645c98826d0a5b416357943b8d05ce983c233a6834018c0fcb69bf08474cfe.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run 90645c98826d0a5b416357943b8d05ce983c233a6834018c0fcb69bf08474cfe.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies 90645c98826d0a5b416357943b8d05ce983c233a6834018c0fcb69bf08474cfe.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10" LogonUI.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Command Processor\AutoRun = "\"C:\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ParentalControls_cw5n1h2txyewy\\AC\\INetCookies\\cr8DKnAWv8lJdQRsmk74Jzm6Cn1HH1ZnOu659ZUOVztVKodl4XqoMzX4.exe\" O 2>NUL" MeRbFe5wZWB1I8P.bat Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer 90645c98826d0a5b416357943b8d05ce983c233a6834018c0fcb69bf08474cfe.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE 90645c98826d0a5b416357943b8d05ce983c233a6834018c0fcb69bf08474cfe.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808" LogonUI.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Command Processor MeRbFe5wZWB1I8P.bat Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run MeRbFe5wZWB1I8P.bat Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Command Processor\AutoRun = "\"C:\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\\AC\\Temp\\dKrzVvFkmBKwYsOkaoSV7vYNKWxRK.exe\" O 2>NUL" MeRbFe5wZWB1I8P.bat -
Modifies registry class 10 IoCs
Processes:
90645c98826d0a5b416357943b8d05ce983c233a6834018c0fcb69bf08474cfe.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run 90645c98826d0a5b416357943b8d05ce983c233a6834018c0fcb69bf08474cfe.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\SOFTWARE\Microsoft\Windows 90645c98826d0a5b416357943b8d05ce983c233a6834018c0fcb69bf08474cfe.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\SOFTWARE\Microsoft\Windows\CurrentVersion 90645c98826d0a5b416357943b8d05ce983c233a6834018c0fcb69bf08474cfe.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\SOFTWARE\Microsoft\Command Processor\AutoRun = "\"C:\\Users\\Admin\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Storage\\ext\\gfdkimpbcpahaombhbimeihdjnejgicl\\def\\YpzuO2creM7hRkWjH0CZ4pSEsDQeZu5Hfcn.exe\" O 2>NUL" 90645c98826d0a5b416357943b8d05ce983c233a6834018c0fcb69bf08474cfe.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\SOFTWARE 90645c98826d0a5b416357943b8d05ce983c233a6834018c0fcb69bf08474cfe.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\SOFTWARE\Microsoft 90645c98826d0a5b416357943b8d05ce983c233a6834018c0fcb69bf08474cfe.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies 90645c98826d0a5b416357943b8d05ce983c233a6834018c0fcb69bf08474cfe.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer 90645c98826d0a5b416357943b8d05ce983c233a6834018c0fcb69bf08474cfe.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ = "\"C:\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ParentalControls_cw5n1h2txyewy\\LocalCache\\uydViQTVR60Aoh7YbtCm5kQDiTlc1kYg5Uwgi5Srl6VhjsXgRtpcBCPxfwXR9orpXXWL0.exe\" O" 90645c98826d0a5b416357943b8d05ce983c233a6834018c0fcb69bf08474cfe.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\SOFTWARE\Microsoft\Command Processor 90645c98826d0a5b416357943b8d05ce983c233a6834018c0fcb69bf08474cfe.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
MeRbFe5wZWB1I8P.batpid process 1952 MeRbFe5wZWB1I8P.bat 1952 MeRbFe5wZWB1I8P.bat -
Suspicious use of AdjustPrivilegeToken 7 IoCs
Processes:
90645c98826d0a5b416357943b8d05ce983c233a6834018c0fcb69bf08474cfe.exeMeRbFe5wZWB1I8P.batMeRbFe5wZWB1I8P.batdescription pid process Token: SeBackupPrivilege 1656 90645c98826d0a5b416357943b8d05ce983c233a6834018c0fcb69bf08474cfe.exe Token: SeRestorePrivilege 1656 90645c98826d0a5b416357943b8d05ce983c233a6834018c0fcb69bf08474cfe.exe Token: SeShutdownPrivilege 1656 90645c98826d0a5b416357943b8d05ce983c233a6834018c0fcb69bf08474cfe.exe Token: SeDebugPrivilege 1072 MeRbFe5wZWB1I8P.bat Token: SeRestorePrivilege 1072 MeRbFe5wZWB1I8P.bat Token: SeDebugPrivilege 1952 MeRbFe5wZWB1I8P.bat Token: SeRestorePrivilege 1952 MeRbFe5wZWB1I8P.bat -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
LogonUI.exepid process 3904 LogonUI.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
gpscript.exeMeRbFe5wZWB1I8P.batdescription pid process target process PID 3360 wrote to memory of 1072 3360 gpscript.exe MeRbFe5wZWB1I8P.bat PID 3360 wrote to memory of 1072 3360 gpscript.exe MeRbFe5wZWB1I8P.bat PID 1072 wrote to memory of 1952 1072 MeRbFe5wZWB1I8P.bat MeRbFe5wZWB1I8P.bat PID 1072 wrote to memory of 1952 1072 MeRbFe5wZWB1I8P.bat MeRbFe5wZWB1I8P.bat
Processes
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe1⤵
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.BioEnrollment_cw5n1h2txyewy\AppData\MeRbFe5wZWB1I8P.bat"C:\Users\Admin\AppData\Local\Packages\Microsoft.BioEnrollment_cw5n1h2txyewy\AppData\MeRbFe5wZWB1I8P.bat" 22⤵
- Executes dropped EXE
- Sets file execution options in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\90645c98826d0a5b416357943b8d05ce983c233a6834018c0fcb69bf08474cfe.exe"C:\Users\Admin\AppData\Local\Temp\90645c98826d0a5b416357943b8d05ce983c233a6834018c0fcb69bf08474cfe.exe"1⤵
- Adds policy Run key to start application
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa3980855 /state1:0x41c64e6d1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\gpscript.exegpscript.exe /Shutdown1⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.BioEnrollment_cw5n1h2txyewy\AppData\MeRbFe5wZWB1I8P.bat"C:\Users\Admin\AppData\Local\Packages\Microsoft.BioEnrollment_cw5n1h2txyewy\AppData\MeRbFe5wZWB1I8P.bat" 12⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Adds policy Run key to start application
- Executes dropped EXE
- Sets file execution options in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\Session Storage\TMy8mo7KdSk4udRUhWVUw64O2OujQRp3oSupXIf6lA4LQwg661YcMjqDoLEV.cmdFilesize
1.9MB
MD5aada0cc515208e5812c369884f58cceb
SHA18ad567dc10a1e69af001e70fbf145097ccfdd614
SHA2565bc61b493431f5aaf5c6989d8ebb6a7d0443c709c6463965860124b2c4d5bdb0
SHA512a3f26ff54e350b4b7aca7899e9b4ca91b5a21c82ecedc6e13b6ab175b7100d39160afa94f00c94b151236f59706008ff270aa9b85f96b2957a5ce56b75332bca
-
C:\Users\Admin\AppData\Local\Microsoft\input\es-SV\NKqbAFMWuuYei6czd48rBYYHbi4GWNGQG22L.exeFilesize
1.6MB
MD5f40a67767e3f878caf457cac4ddb7b0a
SHA17823fcdf86dae998c355fabf43df15cf90a3c2dd
SHA25695b21f12b54127a3793783f3951ed87858016ed1f12d3b1cf8151ebaca2179ee
SHA512311e94c94ea25440e206edbb6bb5ccefc436f15958b2c44c86d5f25b6e6784a6248ba2f1fd42c258bead13e959ab03c615adbab84970b9077636a94781df5357
-
C:\Users\Admin\AppData\Local\Microsoft\input\fr-ML\uWsA5tuCZlaFLvXTRlGgmzT35ZIBCXsPgK2gk3oIa.exeFilesize
1.3MB
MD5e6e5e61d8e9eceabebc67676ebdf8215
SHA18ec558746c60a7bd246b6ccd872b8e9f66f38468
SHA2561f6badd6a2a8dafd733a1e92619f37b7e5ecc102aa82c28f0bdacfc46f3d63b1
SHA512802461ee064702b240588cbbabd964e9c3aab117858777e495d30dc6c3c821613fdaa9decfb92c1862ce160a5b1d4cbe054d6b85557731f880381d8dc50c923a
-
C:\Users\Admin\AppData\Local\Microsoft\input\ms-BN\QZgXvlUtJg2q1EkbTB.exeFilesize
1.5MB
MD5c40bb1360aa1843b9313be40a96af453
SHA146e7c86ba0fe4ba43ea4b1061320ece00ecd26bd
SHA256fb4b92d8dd781588c38286d1ccdca05d6f27199af82e00272f1e59b566a32e0f
SHA512298229bea2803a6a7cf9684d5d9a4ab620c2288aea3eabd6f9b13866685392cacd3b95ac0a52514759fc1bd8bdb8f90cdb4523861769dbea07ee358143a8e834
-
C:\Users\Admin\AppData\Local\Packages\E2A4F912-2574-4A75-9BB0-0D023378592B_cw5n1h2txyewy\AC\INetHistory\xfP9dBbOggaQmVVYNbs3rYCgObrwxA0kFwoHcpGvIi.exeFilesize
1.3MB
MD54058e530ef90ad776a23890c1cc1bf8b
SHA1ba5689ac8c4be9d424444a417c4e75f0e6be9e30
SHA25662578faf9bcc1310475c93182fced42f394728fe3274c179f9c6eebaf6273cdc
SHA5122ef0a07411925db85234591ba65a7b1983509794cdc4be78c8290dd73da45b6842b4e43b84110464a9fa0494e2bbf360f80f618ee2b73d70af06d16a0149b331
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.BioEnrollment_cw5n1h2txyewy\AppData\MeRbFe5wZWB1I8P.batFilesize
1.8MB
MD575e27f919e9ec3f72604870f93241640
SHA1388ea420c2a88840edefccda20bac5f5ba4fbe8d
SHA256b2cd421743c4f89459746d9153199a4e0284b1ccdd3850bcabe7f370195f448f
SHA512a3f4c45d2ec79f1be8278e703fd675ad7538aebbe99148ad965e65c90f9150ef2a1f0510189a45e8a27ddc55df8cabb8b2ce50268b6f2db44998d797edb6ad2a
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.BioEnrollment_cw5n1h2txyewy\AppData\MeRbFe5wZWB1I8P.batFilesize
1.8MB
MD575e27f919e9ec3f72604870f93241640
SHA1388ea420c2a88840edefccda20bac5f5ba4fbe8d
SHA256b2cd421743c4f89459746d9153199a4e0284b1ccdd3850bcabe7f370195f448f
SHA512a3f4c45d2ec79f1be8278e703fd675ad7538aebbe99148ad965e65c90f9150ef2a1f0510189a45e8a27ddc55df8cabb8b2ce50268b6f2db44998d797edb6ad2a
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.BioEnrollment_cw5n1h2txyewy\AppData\MeRbFe5wZWB1I8P.batFilesize
1.8MB
MD575e27f919e9ec3f72604870f93241640
SHA1388ea420c2a88840edefccda20bac5f5ba4fbe8d
SHA256b2cd421743c4f89459746d9153199a4e0284b1ccdd3850bcabe7f370195f448f
SHA512a3f4c45d2ec79f1be8278e703fd675ad7538aebbe99148ad965e65c90f9150ef2a1f0510189a45e8a27ddc55df8cabb8b2ce50268b6f2db44998d797edb6ad2a
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\SystemAppData\9O2FG8Bu7QmgN0F6LS2h7x6TpL0Q6RFWPw8cg58.exeFilesize
1.1MB
MD506590bced6d797e96d5ec37009b59fde
SHA128a5780b4518d377cad665be6434cc0584dca6c8
SHA25696baa46b55bf39b6e6262debff805cf968014a3c54492871bd6304ac6c2decd3
SHA512b5fc2fa5ab2d31f4b72dee148b76b0a8751322861e0340f6ef049944c1af599d4a294e7b9bb80e50e8bc6ba95a669f9ccc255b3a86169d43a5e94588900b68a3
-
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\RoamingState\Yrga0m4NdfzIpUmTbgPzESwC.batFilesize
2.1MB
MD594bda872d04c84fe3d6b6fbade974d73
SHA121c4313ac0ad000df8c9b1fdfef79f3592f8c395
SHA2560f634488988fed19f3ef6f2e48271b2dde5ea44e0b42ebc95df1c4ea227d3bae
SHA512408ffa2f3d347ed8eec7a85f813824ebc1fa756bfeba565bb402ab72b536943ee706bdf145c6bb634f0fdfd804eca6559b2e4f39ca2c4d4899ed47fd854c2bfc
-
C:\Users\Admin\AppData\Local\Packages\c5e2524a-ea46-4f67-841f-6a9465d9d515_cw5n1h2txyewy\lxjGJWxNZdmwFsHynWzxom8v2W5B6zXkcnqyVP1fPueZmCuQeWFJUaueP2R0jQ.exeFilesize
989KB
MD5d840f8d00565f7ab042884bfe23eb0a7
SHA160dc5e2b0e15788f466da4aee77e22b9e28e4a47
SHA25616e6d348b7a7289bdfdfdf096545c16a2bdc8a5322d96116a1152a9984bf1edb
SHA5124cd8c6295276518df9fd882d797a99be270201666c8c2a8c4fa8369fb4e88a950d5c0d1c629893655d45deddae8cb7cab1b602c5fba17e5113fd3fe5f58a7438
-
C:\Users\Admin\AppData\Roaming\Microsoft\UProof\4SfJHfwmCZWN9smHUj.exeFilesize
1.5MB
MD5618ec196b4b2d2114c7e15267e009f7a
SHA1a4538458931f75ad3ce7a79a5dd3cb4847a686d8
SHA256e36b2c245d454aa78d4678812b72a32e69eaf3cb2907101baedd7579d4914966
SHA512b418b5bb8e33b6a06c01ea6d2126617d62e43ec7ceb2eacc3ff171e6e50d1dc597b399db08842aa8f400a878a57d7eaa026fb9c206b51a85663290224b32a35a
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\QHN2mCgvuTWuilvgfRsk6sh4qdrnLcfp9imqfTb78jxcc6.exeFilesize
1.6MB
MD5368b59cbf4025fed3967134a7696bc7b
SHA1d85c21d8f7fab74f0695df4e5d740e5f84008475
SHA256eeeb24a38742d8a3a6a1bfe9ad14f87cc71aaf2d7941562ffddb27890dcebce0
SHA512d41c4a2d2a7074426fe6b6ad75661c5f5e313c6502c9e0bc79a0a52274218a7653d604a6e38c07880c989d4f13c6935d6f6401c9d560d676abf25c5e0328b36d
-
memory/1072-137-0x0000000000400000-0x000000000042D000-memory.dmpFilesize
180KB
-
memory/1072-146-0x0000000000400000-0x000000000042D000-memory.dmpFilesize
180KB
-
memory/1072-149-0x0000000000400000-0x000000000042D000-memory.dmpFilesize
180KB
-
memory/1072-134-0x0000000000000000-mapping.dmp
-
memory/1656-132-0x0000000000400000-0x000000000042D000-memory.dmpFilesize
180KB
-
memory/1656-133-0x0000000000400000-0x000000000042D000-memory.dmpFilesize
180KB
-
memory/1952-147-0x0000000000000000-mapping.dmp
-
memory/1952-152-0x0000000000400000-0x000000000042D000-memory.dmpFilesize
180KB
-
memory/1952-153-0x0000000000400000-0x000000000042D000-memory.dmpFilesize
180KB