7c8f58bb7974cff2e0d229b908cd4c965e4d3768a6d61750d9a372eec869d165

Analysis

max time kernel
175s
max time network
222s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
25-11-2022 08:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7c8f58bb7974cff2e0d229b908cd4c965e4d3768a6d61750d9a372eec869d165.exe
Size

244KB
MD5

dd51cec3367e6a339dd3449a8c23b988
SHA1

39d9ed513b0374b0e2333bf6db13c8fa524d7608
SHA256

7c8f58bb7974cff2e0d229b908cd4c965e4d3768a6d61750d9a372eec869d165
SHA512

a2f149ed40cd2662955565c5ef186c1f213ec8921013e729e7cc9fb081184f4c82b4c639ce6c8cb541626e02724b3a2749038175d0f4e7560b5613825ce02785
SSDEEP

3072:dSsvihLlTQz9z71iURo2SJJmY6uFNcgifDbMtJyVdyw:ssqhJMxzJiU5SeLmNSbMtJU5

Score

8^/10

persistence spyware stealer

Malware Config

Signatures

Adds policy Run key to start application 2 TTPs 7 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

7c8f58bb7974cff2e0d229b908cd4c965e4d3768a6d61750d9a372eec869d165.exeA2mYizvSiIz5hsoSP.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ = "\"C:\\Users\\Admin\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.10_0\\_locales\\cs\\jLudoTmyz2lJDpjJoxmMPqZBDEqIK5UqmC8rDEBL744Z4r63L4U2XfhFo.exe\" O"	7c8f58bb7974cff2e0d229b908cd4c965e4d3768a6d61750d9a372eec869d165.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ = "\"C:\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.Search_cw5n1h2txyewy\\LocalState\\ConstraintIndex\\Settings_{3c87030d-4870-4ffd-b2b1-04535a86842b}\\JQT5R5fqWWTF.exe\" O"	7c8f58bb7974cff2e0d229b908cd4c965e4d3768a6d61750d9a372eec869d165.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	A2mYizvSiIz5hsoSP.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Adobe\\Flash Player\\NativeCache\\FfmNEdYeFcMnei9.exe\" O"	A2mYizvSiIz5hsoSP.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	7c8f58bb7974cff2e0d229b908cd4c965e4d3768a6d61750d9a372eec869d165.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\18.151.0729.0013\\adm\\ru\\wD4r0PTSmbGuCk7yjVzEwv0KsHOE8PWcqgAcwFabq9JPacNLkriqwqDdaY6bjuEtxW8.exe\" O"	7c8f58bb7974cff2e0d229b908cd4c965e4d3768a6d61750d9a372eec869d165.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	7c8f58bb7974cff2e0d229b908cd4c965e4d3768a6d61750d9a372eec869d165.exe

Executes dropped EXE 1 IoCs

Processes:

A2mYizvSiIz5hsoSP.exe

pid process

384 A2mYizvSiIz5hsoSP.exe

pid	process
384	A2mYizvSiIz5hsoSP.exe

Sets file execution options in registry 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

A2mYizvSiIz5hsoSP.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MsMpEng.exe	A2mYizvSiIz5hsoSP.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MsMpEng.exe\Debugger = " "	A2mYizvSiIz5hsoSP.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MpCmdRun.exe	A2mYizvSiIz5hsoSP.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MpCmdRun.exe\Debugger = " "	A2mYizvSiIz5hsoSP.exe

Drops startup file 1 IoCs

Processes:

A2mYizvSiIz5hsoSP.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\su8fmf83z4Z34RxtrsPev.exe	A2mYizvSiIz5hsoSP.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies data under HKEY_USERS 64 IoCs

Processes:

7c8f58bb7974cff2e0d229b908cd4c965e4d3768a6d61750d9a372eec869d165.exeA2mYizvSiIz5hsoSP.exeLogonUI.exegpscript.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Command Processor\AutoRun = "\"C:\\Users\\Admin\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.49.1_0\\_locales\\nl\\dGHMJ66brEw2Bq7cr1KYfPuLfLmMdsyxoS7nhuo6JQQm2fEbVl7THQCuQzzLL.exe\" O 2>NUL"	7c8f58bb7974cff2e0d229b908cd4c965e4d3768a6d61750d9a372eec869d165.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	7c8f58bb7974cff2e0d229b908cd4c965e4d3768a6d61750d9a372eec869d165.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft	7c8f58bb7974cff2e0d229b908cd4c965e4d3768a6d61750d9a372eec869d165.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Command Processor	A2mYizvSiIz5hsoSP.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Command Processor\AutoRun = "\"C:\\Users\\Admin\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.6_0\\_locales\\sk\\J3TIFsyrYgqHvmiEacJIdQg0nSZoPZln1WbO7UGO9QyI8iR.exe\" O 2>NUL"	7c8f58bb7974cff2e0d229b908cd4c965e4d3768a6d61750d9a372eec869d165.exe
Key created	\REGISTRY\USER\.DEFAULT	7c8f58bb7974cff2e0d229b908cd4c965e4d3768a6d61750d9a372eec869d165.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	7c8f58bb7974cff2e0d229b908cd4c965e4d3768a6d61750d9a372eec869d165.exe
Set value (str)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ = "\"C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US\\Sl2ZqEHxb5ALTLR92pqZBD0fU8.exe\" O"	7c8f58bb7974cff2e0d229b908cd4c965e4d3768a6d61750d9a372eec869d165.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	7c8f58bb7974cff2e0d229b908cd4c965e4d3768a6d61750d9a372eec869d165.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE	7c8f58bb7974cff2e0d229b908cd4c965e4d3768a6d61750d9a372eec869d165.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ = "\"C:\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\TempState\\qLb9zvcvYQPF.exe\" O"	A2mYizvSiIz5hsoSP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	A2mYizvSiIz5hsoSP.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	A2mYizvSiIz5hsoSP.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Command Processor	7c8f58bb7974cff2e0d229b908cd4c965e4d3768a6d61750d9a372eec869d165.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Edge\\User Data\\ShaderCache\\2pGRHe3ojMhBc9vbUfdJcaS1H7q6Dt19Gt6Kf88lZBNySPBNXxLeugfPBD.exe\" O"	7c8f58bb7974cff2e0d229b908cd4c965e4d3768a6d61750d9a372eec869d165.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Command Processor\AutoRun = "\"C:\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\CW1wqtd2IztuRw0xIVkmKF2nyNIWkMWFU2xBBH6oVhxZftRV6VR648BoHiEJs.exe\" O 2>NUL"	A2mYizvSiIz5hsoSP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	7c8f58bb7974cff2e0d229b908cd4c965e4d3768a6d61750d9a372eec869d165.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft	7c8f58bb7974cff2e0d229b908cd4c965e4d3768a6d61750d9a372eec869d165.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	gpscript.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Command Processor\AutoRun = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\TJOZxwu8Xl0cbT0BqNzgnZkLUuvCVXydi5pIf3IiMYj6XMhtFXeBAEffY6IhOQcj4P.exe\" O 2>NUL"	A2mYizvSiIz5hsoSP.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\SlowContextMenuEntries = 6024b221ea3a6910a2dc08002b30309d8c0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	gpscript.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{4234D49B-0245-4DF3-B780-3893943456E1} {000214E6-0000-0000-C000-000000000046} 0xFFFF = 01000000000000008a05dba3e400d901	A2mYizvSiIz5hsoSP.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows	7c8f58bb7974cff2e0d229b908cd4c965e4d3768a6d61750d9a372eec869d165.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion	7c8f58bb7974cff2e0d229b908cd4c965e4d3768a6d61750d9a372eec869d165.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ = "\"C:\\Users\\Admin\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.2_0\\_locales\\sr\\ukmLSuxDzmnXIUkSuknewfZftQ0vbFabStdnZCMZHmnbZ3XycKAJuOmZ8PbdimzKq0.exe\" O"	A2mYizvSiIz5hsoSP.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Command Processor\AutoRun = "\"C:\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe\\Settings\\WeCAe2nP9mKJeMGhZ5iPWRrX5OzUwBR6jV8kfyLFG3ENEV.exe\" O 2>NUL"	7c8f58bb7974cff2e0d229b908cd4c965e4d3768a6d61750d9a372eec869d165.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	7c8f58bb7974cff2e0d229b908cd4c965e4d3768a6d61750d9a372eec869d165.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	7c8f58bb7974cff2e0d229b908cd4c965e4d3768a6d61750d9a372eec869d165.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ = "\"C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\P92k3Kq3YMX4ZFRbrQmcv1Kpo0TCJ5OxDLhpYYMwiCCRUm5Rp.exe\" O"	7c8f58bb7974cff2e0d229b908cd4c965e4d3768a6d61750d9a372eec869d165.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	7c8f58bb7974cff2e0d229b908cd4c965e4d3768a6d61750d9a372eec869d165.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies	7c8f58bb7974cff2e0d229b908cd4c965e4d3768a6d61750d9a372eec869d165.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "147"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Command Processor	A2mYizvSiIz5hsoSP.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Command Processor	7c8f58bb7974cff2e0d229b908cd4c965e4d3768a6d61750d9a372eec869d165.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer	7c8f58bb7974cff2e0d229b908cd4c965e4d3768a6d61750d9a372eec869d165.exe
Key created	\REGISTRY\USER\S-1-5-20	7c8f58bb7974cff2e0d229b908cd4c965e4d3768a6d61750d9a372eec869d165.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows	7c8f58bb7974cff2e0d229b908cd4c965e4d3768a6d61750d9a372eec869d165.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Command Processor\AutoRun = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\18.151.0729.0013\\rw\\LYfmeh9lAVLY89xZXwYXoBhu2fapBBwPRsRhrNaNe7L9.exe\" O 2>NUL"	A2mYizvSiIz5hsoSP.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ = "\"C:\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Win32WebViewHost_cw5n1h2txyewy\\AC\\INetCache\\vLPBZ6K8Z6UhvF4rh4AI20TAGPlVm.exe\" O"	A2mYizvSiIz5hsoSP.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ = "\"C:\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\\RoamingState\\mgvB2fYKTp7Jm5DM12rM.exe\" O"	A2mYizvSiIz5hsoSP.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	A2mYizvSiIz5hsoSP.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Command Processor\AutoRun = "\"C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\ja-JP\\PYynBpka1mjsKYLhLbYz.exe\" O 2>NUL"	A2mYizvSiIz5hsoSP.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Command Processor	7c8f58bb7974cff2e0d229b908cd4c965e4d3768a6d61750d9a372eec869d165.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	7c8f58bb7974cff2e0d229b908cd4c965e4d3768a6d61750d9a372eec869d165.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	7c8f58bb7974cff2e0d229b908cd4c965e4d3768a6d61750d9a372eec869d165.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies	7c8f58bb7974cff2e0d229b908cd4c965e4d3768a6d61750d9a372eec869d165.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (str)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Command Processor\AutoRun = "\"C:\\ProgramData\\Packages\\e1u7rLIzrWisQ7ttGH80yjASX4scLWq2uwdulyp6qnZHtO.exe\" O 2>NUL"	A2mYizvSiIz5hsoSP.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	7c8f58bb7974cff2e0d229b908cd4c965e4d3768a6d61750d9a372eec869d165.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	7c8f58bb7974cff2e0d229b908cd4c965e4d3768a6d61750d9a372eec869d165.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ = "\"C:\\Users\\Admin\\AppData\\Local\\Packages\\Windows.CBSPreview_cw5n1h2txyewy\\LocalCache\\gOXNEUAYgFDNlJ544EmobbPwOsWeTuyggveXi5cfFpMwBPhrfojahyrOkjZzdSorrmqzVF.exe\" O"	7c8f58bb7974cff2e0d229b908cd4c965e4d3768a6d61750d9a372eec869d165.exe
Key created	\REGISTRY\USER\S-1-5-19	7c8f58bb7974cff2e0d229b908cd4c965e4d3768a6d61750d9a372eec869d165.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Command Processor	A2mYizvSiIz5hsoSP.exe

Modifies registry class 10 IoCs

Processes:

7c8f58bb7974cff2e0d229b908cd4c965e4d3768a6d61750d9a372eec869d165.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies	7c8f58bb7974cff2e0d229b908cd4c965e4d3768a6d61750d9a372eec869d165.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\SOFTWARE\Microsoft\Command Processor	7c8f58bb7974cff2e0d229b908cd4c965e4d3768a6d61750d9a372eec869d165.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\SOFTWARE\Microsoft\Command Processor\AutoRun = "\"C:\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.Search_cw5n1h2txyewy\\AC\\TokenBroker\\ln0H3QI6ZrS5O0inHxHTYcqhAA.exe\" O 2>NUL"	7c8f58bb7974cff2e0d229b908cd4c965e4d3768a6d61750d9a372eec869d165.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	7c8f58bb7974cff2e0d229b908cd4c965e4d3768a6d61750d9a372eec869d165.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\SOFTWARE\Microsoft\Windows\CurrentVersion	7c8f58bb7974cff2e0d229b908cd4c965e4d3768a6d61750d9a372eec869d165.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	7c8f58bb7974cff2e0d229b908cd4c965e4d3768a6d61750d9a372eec869d165.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\input\\es-CL\\hzgkWQi3xZOfml7WIAwQhww7dd8qzJmunmIi0NmABV0cPmf7H9vreE.exe\" O"	7c8f58bb7974cff2e0d229b908cd4c965e4d3768a6d61750d9a372eec869d165.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\SOFTWARE	7c8f58bb7974cff2e0d229b908cd4c965e4d3768a6d61750d9a372eec869d165.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\SOFTWARE\Microsoft	7c8f58bb7974cff2e0d229b908cd4c965e4d3768a6d61750d9a372eec869d165.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\SOFTWARE\Microsoft\Windows	7c8f58bb7974cff2e0d229b908cd4c965e4d3768a6d61750d9a372eec869d165.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

7c8f58bb7974cff2e0d229b908cd4c965e4d3768a6d61750d9a372eec869d165.exeA2mYizvSiIz5hsoSP.exe

description	pid	process
Token: SeBackupPrivilege	1388	7c8f58bb7974cff2e0d229b908cd4c965e4d3768a6d61750d9a372eec869d165.exe
Token: SeRestorePrivilege	1388	7c8f58bb7974cff2e0d229b908cd4c965e4d3768a6d61750d9a372eec869d165.exe
Token: SeShutdownPrivilege	1388	7c8f58bb7974cff2e0d229b908cd4c965e4d3768a6d61750d9a372eec869d165.exe
Token: SeDebugPrivilege	384	A2mYizvSiIz5hsoSP.exe
Token: SeRestorePrivilege	384	A2mYizvSiIz5hsoSP.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

LogonUI.exe

pid process

440 LogonUI.exe

pid	process
440	LogonUI.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

gpscript.exe

description	pid	process	target process
PID 3744 wrote to memory of 384	3744	gpscript.exe	A2mYizvSiIz5hsoSP.exe
PID 3744 wrote to memory of 384	3744	gpscript.exe	A2mYizvSiIz5hsoSP.exe

C:\Users\Admin\AppData\Local\Temp\7c8f58bb7974cff2e0d229b908cd4c965e4d3768a6d61750d9a372eec869d165.exe
"C:\Users\Admin\AppData\Local\Temp\7c8f58bb7974cff2e0d229b908cd4c965e4d3768a6d61750d9a372eec869d165.exe"
1⤵
- Adds policy Run key to start application
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:1388

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3994055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:440

C:\Windows\system32\gpscript.exe
gpscript.exe /Shutdown
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:3744

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\sr-Latn-RS\A2mYizvSiIz5hsoSP.exe
"C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\sr-Latn-RS\A2mYizvSiIz5hsoSP.exe" 1
2⤵
- Adds policy Run key to start application
- Executes dropped EXE
- Sets file execution options in registry
- Drops startup file
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:384

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Microsoft\ClickToRun\MachineData\Catalog\P92k3Kq3YMX4ZFRbrQmcv1Kpo0TCJ5OxDLhpYYMwiCCRUm5Rp.exe
Filesize
324KB

MD5
a18688bbacd30c24677463c45d0e7a68

SHA1
4714878da349af0d04d785f3c2ca8467b12bd52f

SHA256
3646dd2b78987a6b2b04fc8d3b76c3f58733ee8400a955110cffe1686086412a

SHA512
4f03fb8578fed373b3a9e4393944b1016beff1e14bc6a3efd6b8b797bafb34e5306ef5e4a9e872244d3441b0fa0b5c1f45af71fcfdde7fc8805135a3b8ec1ee0

Download Submit
C:\ProgramData\Microsoft\Windows NT\MSFax\Common Coverpages\en-US\Sl2ZqEHxb5ALTLR92pqZBD0fU8.exe
Filesize
403KB

MD5
23b6043f3f1e95617b985110e46c8f67

SHA1
92720cc20c4eda8644896aa23807a2b1aad95ba7

SHA256
0f8d2551378cce36e17d8f05b48ed2cc610df9a8ce62bed012517961c8e36280

SHA512
dff246231a7effe2c3e5c4f35561862ae7bf2dbbdabcfaff169f231d5e76462d9b196a45856176605f1a8a2a9ba4c3cc31ca681f45acf94f9f70a68c8bdaa105

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.10_0\_locales\cs\jLudoTmyz2lJDpjJoxmMPqZBDEqIK5UqmC8rDEBL744Z4r63L4U2XfhFo.exe
Filesize
447KB

MD5
0e8d4dd7f8c00d15ccc4061798184799

SHA1
f2b8b1419019df16846323b411e96237139c2073

SHA256
b9b37e73ce2362d29ede2a2132e6a21ffd0808d703951c2942b91e986b40625d

SHA512
d8383a18df369740b80e3ca65f3d2bc324e3740326dc8e59db5907a9ed32a4048b3b5a4ea8508a92f5cc35ed509881a3094713ad698b9c1f33affdc5406ff690

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.8_0\_locales\nl\cgX7Tsc5dGyTRrYvhWoUYXCJ7rflYXcuO5a.exe
Filesize
298KB

MD5
434cf0c8093d785788929b4532fb09a9

SHA1
11104bf6c5da301ff358a564e975e4d436db1445

SHA256
c0b831fdf99ee43b72edd7e07250984927747792d51bdb54693704312a12aa3d

SHA512
46e17e94c7e7c52829ef3d9f97a8816af64653a77977a622ca547699896be51fd84d7e7bdb13af1b23103f29b13e25c28d840b25ea29fe04b1b1622a87dc24ac

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.49.1_0\_locales\ne\dTvstSnpuYitl3ZSbco4oBATwZsxAbVFadfb3cF.exe
Filesize
387KB

MD5
03f85dc241a692e00c493a5f2db73839

SHA1
e48fe9cf675bfd536c8f4fb151d13829b2916b30

SHA256
863b1c921f868b57359e79aeeb13c4f505721969f576cb86a6409ec5de4e6171

SHA512
6c7c73844dbd0dc8349d1e6a3730960549dadf66f827b19e4f01b147c5e63e70e391d155e0f8dcd140f42605a32af9b9ec6d9e94ffee77224cb039b63960b232

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.49.1_0\_locales\nl\dGHMJ66brEw2Bq7cr1KYfPuLfLmMdsyxoS7nhuo6JQQm2fEbVl7THQCuQzzLL.exe
Filesize
258KB

MD5
6ef61c8c0e128e8a5740829d79aa9ac2

SHA1
39b686a6c48adba1f27face00234c65f461125a1

SHA256
4cf5aa603ae6fadf1dd71dc435d30b3676bc0ab13f624efb0d6d6130677bbed3

SHA512
d20cce8688a95973d70a662d13a775d38ae3534324b94c1f7db45aa1afce5f3e12a928f10f33d1621e0e99990900d8839adf0856bd81bb896b5e2ff154e3bbbf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\2pGRHe3ojMhBc9vbUfdJcaS1H7q6Dt19Gt6Kf88lZBNySPBNXxLeugfPBD.exe
Filesize
349KB

MD5
869a7d940732651f8964334b91b303fe

SHA1
e40cdd84fc375f3ed5261a2652d046e7ce5a8bde

SHA256
8320c375a2ef64b98ee2f126179e56b9c0668c65f98ca25d9361dd065820900a

SHA512
30c01eacf50947c30a951872780aa7ab12c27b0a6b04120ce2ac2b2b9edb7bc3c73f87a9dde887334304c4014c5397ed0b8f90753474c30433ec7601746a039e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\sr-Latn-RS\A2mYizvSiIz5hsoSP.exe
Filesize
426KB

MD5
3eb9e4a57ad818c90e5e5f4bb97b26e3

SHA1
b81ebdc99fa7a8eaf2873a2b0b0f27248ecee1c2

SHA256
ce055fa7fcccdce2191980e0d429c9095cfd32ae138848c848d7453b83b38603

SHA512
a60c22a2c8b892e34e2be4e13a22cd84401bcae8665b2d2458d88c863ff5056245eec4211c01d49de2e03cf14757c47fc1fafe970d7a79036dad2ba0e9a5a670

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\sr-Latn-RS\A2mYizvSiIz5hsoSP.exe
Filesize
426KB

MD5
3eb9e4a57ad818c90e5e5f4bb97b26e3

SHA1
b81ebdc99fa7a8eaf2873a2b0b0f27248ecee1c2

SHA256
ce055fa7fcccdce2191980e0d429c9095cfd32ae138848c848d7453b83b38603

SHA512
a60c22a2c8b892e34e2be4e13a22cd84401bcae8665b2d2458d88c863ff5056245eec4211c01d49de2e03cf14757c47fc1fafe970d7a79036dad2ba0e9a5a670

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe\Settings\WeCAe2nP9mKJeMGhZ5iPWRrX5OzUwBR6jV8kfyLFG3ENEV.exe
Filesize
324KB

MD5
971ad8e9bef3279aefe281c7ff984516

SHA1
f18740865d1109d3aaf5300d8ffba3ffa7c70ad8

SHA256
695bdd887810406fa4ce2965da486a96d9c736d6c399587084ec2fe939258724

SHA512
293f410d1410fd6400db2e5c55647c1dec87453c2f751e28fe93244bda756d0591cd9fc65a8c67ed44b7a8c7cfa8a34952104475981e8524468a5a1beda09c7b

Download Submit
memory/384-136-0x0000000000000000-mapping.dmp

Download
memory/384-141-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/384-147-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/1388-132-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/1388-134-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/1388-133-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download