d7612df93b873f6944f32afb524ebf71bb5cc03edbee35cb3ea2fa5baec58aa2

Analysis

max time kernel
203s
max time network
35s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
25-11-2022 08:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d7612df93b873f6944f32afb524ebf71bb5cc03edbee35cb3ea2fa5baec58aa2.exe
Size

682KB
MD5

185f57273dd9adc50aafe536423e391a
SHA1

53d6c4cb3431685cad6013415e0efd8be9570c19
SHA256

d7612df93b873f6944f32afb524ebf71bb5cc03edbee35cb3ea2fa5baec58aa2
SHA512

181a7d9b237119298c44c31739c609af6569cd91b2cb79d90a52fa68b4f1cac4a9c473d79b179f7e2691748a5ff5722600d2f2b1ee3d743895c471521f7b7c25
SSDEEP

3072:aSsvihLlTQz9z71iURo2SJJmY6uFNcgifDbmeTXwVdBR:rsqhJMxzJiU5SeLmNSbmebW1

Score

8^/10

persistence spyware stealer

Malware Config

Signatures

Adds policy Run key to start application 2 TTPs 7 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

d7612df93b873f6944f32afb524ebf71bb5cc03edbee35cb3ea2fa5baec58aa2.exerx5vjYLPDeQv8h2O1tzpSaZampHs49wHu8IyfWL2mtiv.bat

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\612334118\\iLMeXsl9oKtoIsQc3AMev1.exe\" O"	d7612df93b873f6944f32afb524ebf71bb5cc03edbee35cb3ea2fa5baec58aa2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ = "\"C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\1RJ5x6TQKwB0caNZ5aYlGCWkjb942Gkaq6oXELikx9vAb.exe\" O"	d7612df93b873f6944f32afb524ebf71bb5cc03edbee35cb3ea2fa5baec58aa2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	rx5vjYLPDeQv8h2O1tzpSaZampHs49wHu8IyfWL2mtiv.bat
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ = "\"C:\\Users\\Admin\\Desktop\\HJdpfEou.exe\" O"	rx5vjYLPDeQv8h2O1tzpSaZampHs49wHu8IyfWL2mtiv.bat
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	d7612df93b873f6944f32afb524ebf71bb5cc03edbee35cb3ea2fa5baec58aa2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ = "\"C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tZPkBar2GivvN3.exe\" O"	d7612df93b873f6944f32afb524ebf71bb5cc03edbee35cb3ea2fa5baec58aa2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	d7612df93b873f6944f32afb524ebf71bb5cc03edbee35cb3ea2fa5baec58aa2.exe

Executes dropped EXE 1 IoCs

Processes:

rx5vjYLPDeQv8h2O1tzpSaZampHs49wHu8IyfWL2mtiv.bat

pid process

2028 rx5vjYLPDeQv8h2O1tzpSaZampHs49wHu8IyfWL2mtiv.bat

pid	process
2028	rx5vjYLPDeQv8h2O1tzpSaZampHs49wHu8IyfWL2mtiv.bat

Sets file execution options in registry 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

rx5vjYLPDeQv8h2O1tzpSaZampHs49wHu8IyfWL2mtiv.bat

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MsMpEng.exe	rx5vjYLPDeQv8h2O1tzpSaZampHs49wHu8IyfWL2mtiv.bat
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MsMpEng.exe\Debugger = " "	rx5vjYLPDeQv8h2O1tzpSaZampHs49wHu8IyfWL2mtiv.bat
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MpCmdRun.exe	rx5vjYLPDeQv8h2O1tzpSaZampHs49wHu8IyfWL2mtiv.bat
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MpCmdRun.exe\Debugger = " "	rx5vjYLPDeQv8h2O1tzpSaZampHs49wHu8IyfWL2mtiv.bat

Loads dropped DLL 2 IoCs

Processes:

gpscript.exe

pid process

1332 gpscript.exe
1332 gpscript.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

pid	process
1332	gpscript.exe
1332	gpscript.exe

Modifies data under HKEY_USERS 55 IoCs

Processes:

d7612df93b873f6944f32afb524ebf71bb5cc03edbee35cb3ea2fa5baec58aa2.exerx5vjYLPDeQv8h2O1tzpSaZampHs49wHu8IyfWL2mtiv.batgpscript.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion	d7612df93b873f6944f32afb524ebf71bb5cc03edbee35cb3ea2fa5baec58aa2.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies	d7612df93b873f6944f32afb524ebf71bb5cc03edbee35cb3ea2fa5baec58aa2.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	rx5vjYLPDeQv8h2O1tzpSaZampHs49wHu8IyfWL2mtiv.bat
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Command Processor\AutoRun = "\"C:\\ProgramData\\Package Cache\\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\\hTBaFIyRx1V95OmKcMotETbw7UUujLaCvmMekbUHFiqd6WD1PNNGcffY.exe\" O 2>NUL"	d7612df93b873f6944f32afb524ebf71bb5cc03edbee35cb3ea2fa5baec58aa2.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	d7612df93b873f6944f32afb524ebf71bb5cc03edbee35cb3ea2fa5baec58aa2.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows	d7612df93b873f6944f32afb524ebf71bb5cc03edbee35cb3ea2fa5baec58aa2.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Command Processor	rx5vjYLPDeQv8h2O1tzpSaZampHs49wHu8IyfWL2mtiv.bat
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	d7612df93b873f6944f32afb524ebf71bb5cc03edbee35cb3ea2fa5baec58aa2.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows	d7612df93b873f6944f32afb524ebf71bb5cc03edbee35cb3ea2fa5baec58aa2.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion	d7612df93b873f6944f32afb524ebf71bb5cc03edbee35cb3ea2fa5baec58aa2.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	rx5vjYLPDeQv8h2O1tzpSaZampHs49wHu8IyfWL2mtiv.bat
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	rx5vjYLPDeQv8h2O1tzpSaZampHs49wHu8IyfWL2mtiv.bat
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@"%windir%\System32\ie4uinit.exe",-732 = "Finds and displays information and Web sites on the Internet."	rx5vjYLPDeQv8h2O1tzpSaZampHs49wHu8IyfWL2mtiv.bat
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows	d7612df93b873f6944f32afb524ebf71bb5cc03edbee35cb3ea2fa5baec58aa2.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ = "\"C:\\Users\\Admin\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Storage\\ext\\gfdkimpbcpahaombhbimeihdjnejgicl\\def\\GPUCache\\OQ096TZKVkeViW8oQFWEAIUojX.exe\" O"	d7612df93b873f6944f32afb524ebf71bb5cc03edbee35cb3ea2fa5baec58aa2.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ = "\"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java Development Kit\\A6o30asMCqRBJLES6zhhGeyN6kMjdCrHsAksitmEqDtDM5Rqu.exe\" O"	rx5vjYLPDeQv8h2O1tzpSaZampHs49wHu8IyfWL2mtiv.bat
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	gpscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ = "\"C:\\ProgramData\\Microsoft\\Windows Defender\\Support\\moq3n5OLdfJk43as7mICEX.exe\" O"	rx5vjYLPDeQv8h2O1tzpSaZampHs49wHu8IyfWL2mtiv.bat
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Command Processor	d7612df93b873f6944f32afb524ebf71bb5cc03edbee35cb3ea2fa5baec58aa2.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Command Processor	d7612df93b873f6944f32afb524ebf71bb5cc03edbee35cb3ea2fa5baec58aa2.exe
Set value (str)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Command Processor\AutoRun = "\"C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\lUXYyQ9yScezH8c0Ho8NlKkJRkcg5ynleKc2S56RT6QJ6l5sKUPNNpJ.exe\" O 2>NUL"	d7612df93b873f6944f32afb524ebf71bb5cc03edbee35cb3ea2fa5baec58aa2.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Command Processor\AutoRun = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Feeds Cache\\A08CGSZX\\murFifokranlG3S8f07.exe\" O 2>NUL"	rx5vjYLPDeQv8h2O1tzpSaZampHs49wHu8IyfWL2mtiv.bat
Key created	\REGISTRY\USER\.DEFAULT	d7612df93b873f6944f32afb524ebf71bb5cc03edbee35cb3ea2fa5baec58aa2.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies	d7612df93b873f6944f32afb524ebf71bb5cc03edbee35cb3ea2fa5baec58aa2.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	d7612df93b873f6944f32afb524ebf71bb5cc03edbee35cb3ea2fa5baec58aa2.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\hsperfdata_Admin\\dPTxslehh3EsBGChv8swPTm8eLUnacVuvBjHklohPAWDe1c9cSsdmdqd.exe\" O"	rx5vjYLPDeQv8h2O1tzpSaZampHs49wHu8IyfWL2mtiv.bat
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	d7612df93b873f6944f32afb524ebf71bb5cc03edbee35cb3ea2fa5baec58aa2.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ = "\"C:\\Users\\Admin\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Storage\\ext\\sf0gzSCsEoJDQ8PO26ttlS8Bx9SyEQwzrcvRgv7hXzEweT8.exe\" O"	rx5vjYLPDeQv8h2O1tzpSaZampHs49wHu8IyfWL2mtiv.bat
Key created	\REGISTRY\USER\S-1-5-19	d7612df93b873f6944f32afb524ebf71bb5cc03edbee35cb3ea2fa5baec58aa2.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Command Processor\AutoRun = "\"C:\\Users\\Admin\\AppData\\Local\\Adobe\\Acrobat\\9.0\\dQYJlRFK68az6pBweePMtWslIXL03DBG31.exe\" O 2>NUL"	d7612df93b873f6944f32afb524ebf71bb5cc03edbee35cb3ea2fa5baec58aa2.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Command Processor	rx5vjYLPDeQv8h2O1tzpSaZampHs49wHu8IyfWL2mtiv.bat
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft	d7612df93b873f6944f32afb524ebf71bb5cc03edbee35cb3ea2fa5baec58aa2.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft	d7612df93b873f6944f32afb524ebf71bb5cc03edbee35cb3ea2fa5baec58aa2.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Command Processor	rx5vjYLPDeQv8h2O1tzpSaZampHs49wHu8IyfWL2mtiv.bat
Set value (str)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Command Processor\AutoRun = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\OzHRkISySzdR9DrijXg1JdEW.exe\" O 2>NUL"	rx5vjYLPDeQv8h2O1tzpSaZampHs49wHu8IyfWL2mtiv.bat
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	rx5vjYLPDeQv8h2O1tzpSaZampHs49wHu8IyfWL2mtiv.bat
Set value (str)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ = "\"C:\\Users\\Public\\Pictures\\Sample Pictures\\LrQr9IYcDSktVVkyNHfg4QZEhuxD7M3DXuycPRXkV2jpVLZJeMf6pFyudgbjDulF4y4UNSh.exe\" O"	d7612df93b873f6944f32afb524ebf71bb5cc03edbee35cb3ea2fa5baec58aa2.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Command Processor\AutoRun = "\"C:\\ProgramData\\Microsoft\\RAC\\3FvkMD37sc8pxKV4PUYTk6CzjFUEKlUqyHCIcSuK.exe\" O 2>NUL"	rx5vjYLPDeQv8h2O1tzpSaZampHs49wHu8IyfWL2mtiv.bat
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Command Processor\AutoRun = "\"C:\\Users\\Admin\\AppData\\Roaming\\oRBs8uECXAUtSS0SHKe93reAQt3racqZJdw4Fgs7ITqKEZ8r9fWoChYIRN0ClMhkufjIT.exe\" O 2>NUL"	rx5vjYLPDeQv8h2O1tzpSaZampHs49wHu8IyfWL2mtiv.bat
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\SystemCertificates\\NAxmfEfTpNFbbEcLPVawI6ZY.exe\" O"	d7612df93b873f6944f32afb524ebf71bb5cc03edbee35cb3ea2fa5baec58aa2.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies	d7612df93b873f6944f32afb524ebf71bb5cc03edbee35cb3ea2fa5baec58aa2.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	d7612df93b873f6944f32afb524ebf71bb5cc03edbee35cb3ea2fa5baec58aa2.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Command Processor\AutoRun = "\"C:\\ProgramData\\Microsoft\\WwanSvc\\hKLceDSWc1u4FGaFv5KjxYkucSAprXmGrdiuDH3gOQvTlzkYj4GdV68edjiotLg2.exe\" O 2>NUL"	rx5vjYLPDeQv8h2O1tzpSaZampHs49wHu8IyfWL2mtiv.bat
Set value (str)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\ae6vytmk.default-release\\datareporting\\archived\\cXYYlM5R1jHgI.exe\" O"	rx5vjYLPDeQv8h2O1tzpSaZampHs49wHu8IyfWL2mtiv.bat
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Command Processor\AutoRun = "\"C:\\Users\\Admin\\AppData\\LocalLow\\Sun\\Java\\Deployment\\cache\\6.0\\20\\SlIZs1Z45CMuftx0m447oJ.exe\" O 2>NUL"	d7612df93b873f6944f32afb524ebf71bb5cc03edbee35cb3ea2fa5baec58aa2.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion	d7612df93b873f6944f32afb524ebf71bb5cc03edbee35cb3ea2fa5baec58aa2.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	d7612df93b873f6944f32afb524ebf71bb5cc03edbee35cb3ea2fa5baec58aa2.exe
Key created	\REGISTRY\USER\S-1-5-20	d7612df93b873f6944f32afb524ebf71bb5cc03edbee35cb3ea2fa5baec58aa2.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE	d7612df93b873f6944f32afb524ebf71bb5cc03edbee35cb3ea2fa5baec58aa2.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft	d7612df93b873f6944f32afb524ebf71bb5cc03edbee35cb3ea2fa5baec58aa2.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Command Processor	d7612df93b873f6944f32afb524ebf71bb5cc03edbee35cb3ea2fa5baec58aa2.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	d7612df93b873f6944f32afb524ebf71bb5cc03edbee35cb3ea2fa5baec58aa2.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	d7612df93b873f6944f32afb524ebf71bb5cc03edbee35cb3ea2fa5baec58aa2.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Identities\\{74A2ADB8-758C-4A03-AB80-FD816571C991}\\0LcDK7mWPzJeUydql0TMAbb5cN5OVW1i3357u1jwmBd9Z.exe\" O"	d7612df93b873f6944f32afb524ebf71bb5cc03edbee35cb3ea2fa5baec58aa2.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{6C467336-8281-4E60-8204-430CED96822D} {000214E4-0000-0000-C000-000000000046} 0xFFFF = 010000000000000030237006e700d901	gpscript.exe

Modifies registry class 12 IoCs

Processes:

d7612df93b873f6944f32afb524ebf71bb5cc03edbee35cb3ea2fa5baec58aa2.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\SOFTWARE\Microsoft\Windows	d7612df93b873f6944f32afb524ebf71bb5cc03edbee35cb3ea2fa5baec58aa2.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\SOFTWARE\Microsoft\Windows\CurrentVersion	d7612df93b873f6944f32afb524ebf71bb5cc03edbee35cb3ea2fa5baec58aa2.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	d7612df93b873f6944f32afb524ebf71bb5cc03edbee35cb3ea2fa5baec58aa2.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	d7612df93b873f6944f32afb524ebf71bb5cc03edbee35cb3ea2fa5baec58aa2.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_Classes\SOFTWARE\Microsoft\Command Processor	d7612df93b873f6944f32afb524ebf71bb5cc03edbee35cb3ea2fa5baec58aa2.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\SOFTWARE	d7612df93b873f6944f32afb524ebf71bb5cc03edbee35cb3ea2fa5baec58aa2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\SOFTWARE\Microsoft\Command Processor\AutoRun = "\"C:\\Users\\Admin\\AppData\\LocalLow\\Sun\\Java\\Deployment\\cache\\6.0\\47\\IEA3gmzP3oubFHjSlQDgl2aZ8U4bfExCpeyOmONBvhLI.exe\" O 2>NUL"	d7612df93b873f6944f32afb524ebf71bb5cc03edbee35cb3ea2fa5baec58aa2.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies	d7612df93b873f6944f32afb524ebf71bb5cc03edbee35cb3ea2fa5baec58aa2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\YNl71SygGoB8fO7pOJXwSgdbcujQiNM1ivtwEZrMYE8iUYHy9yJfB13BqEI43.exe\" O"	d7612df93b873f6944f32afb524ebf71bb5cc03edbee35cb3ea2fa5baec58aa2.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\SOFTWARE\Microsoft	d7612df93b873f6944f32afb524ebf71bb5cc03edbee35cb3ea2fa5baec58aa2.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\SOFTWARE\Microsoft\Command Processor	d7612df93b873f6944f32afb524ebf71bb5cc03edbee35cb3ea2fa5baec58aa2.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_Classes\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	d7612df93b873f6944f32afb524ebf71bb5cc03edbee35cb3ea2fa5baec58aa2.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

Processes:

d7612df93b873f6944f32afb524ebf71bb5cc03edbee35cb3ea2fa5baec58aa2.exeAUDIODG.EXErx5vjYLPDeQv8h2O1tzpSaZampHs49wHu8IyfWL2mtiv.bat

description	pid	process
Token: SeBackupPrivilege	1140	d7612df93b873f6944f32afb524ebf71bb5cc03edbee35cb3ea2fa5baec58aa2.exe
Token: SeRestorePrivilege	1140	d7612df93b873f6944f32afb524ebf71bb5cc03edbee35cb3ea2fa5baec58aa2.exe
Token: SeShutdownPrivilege	1140	d7612df93b873f6944f32afb524ebf71bb5cc03edbee35cb3ea2fa5baec58aa2.exe
Token: 33	1436	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1436	AUDIODG.EXE
Token: 33	1436	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1436	AUDIODG.EXE
Token: SeDebugPrivilege	2028	rx5vjYLPDeQv8h2O1tzpSaZampHs49wHu8IyfWL2mtiv.bat
Token: SeRestorePrivilege	2028	rx5vjYLPDeQv8h2O1tzpSaZampHs49wHu8IyfWL2mtiv.bat

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

gpscript.exe

description	pid	process	target process
PID 1332 wrote to memory of 2028	1332	gpscript.exe	rx5vjYLPDeQv8h2O1tzpSaZampHs49wHu8IyfWL2mtiv.bat
PID 1332 wrote to memory of 2028	1332	gpscript.exe	rx5vjYLPDeQv8h2O1tzpSaZampHs49wHu8IyfWL2mtiv.bat
PID 1332 wrote to memory of 2028	1332	gpscript.exe	rx5vjYLPDeQv8h2O1tzpSaZampHs49wHu8IyfWL2mtiv.bat

C:\Users\Admin\AppData\Local\Temp\d7612df93b873f6944f32afb524ebf71bb5cc03edbee35cb3ea2fa5baec58aa2.exe
"C:\Users\Admin\AppData\Local\Temp\d7612df93b873f6944f32afb524ebf71bb5cc03edbee35cb3ea2fa5baec58aa2.exe"
1⤵
- Adds policy Run key to start application
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:1140

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0
1⤵
PID:1520

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x56c
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1436

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x1
1⤵
PID:676

C:\Windows\system32\gpscript.exe
gpscript.exe /Shutdown
1⤵
- Loads dropped DLL
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:1332

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ae6vytmk.default-release\crashes\events\rx5vjYLPDeQv8h2O1tzpSaZampHs49wHu8IyfWL2mtiv.bat
"C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ae6vytmk.default-release\crashes\events\rx5vjYLPDeQv8h2O1tzpSaZampHs49wHu8IyfWL2mtiv.bat" 1
2⤵
- Adds policy Run key to start application
- Executes dropped EXE
- Sets file execution options in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2028

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Microsoft\Assistance\Client\1.0\en-US\lUXYyQ9yScezH8c0Ho8NlKkJRkcg5ynleKc2S56RT6QJ6l5sKUPNNpJ.exe
Filesize
1.1MB

MD5
be3ce1882e2ad5383436b40b7dfeec51

SHA1
79b5c623f7220d244b3327cb73a3b466679a8f45

SHA256
c013ba9e83b40ea345a6880c69a1c4400af45154672165f5866327accf8dce48

SHA512
bce90022beb2f1bb9666c0ee2cb06677d2ca78195b7399206ad2aa14e6776897e30e52d7556ea28d1b1b2d2a230f53b9f48ad9d895cc2f9c223adc6c57847e83

Download Submit
C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\hTBaFIyRx1V95OmKcMotETbw7UUujLaCvmMekbUHFiqd6WD1PNNGcffY.exe
Filesize
703KB

MD5
1dcbf8d1889fb2d8d78aeb433f823a44

SHA1
8f44a605ecc48759fb9017a7f43c2a80eab2ed4a

SHA256
077f1bb01678794f099e7bf1b66d6251d2f9e78a2037709c5b27369f015e96ae

SHA512
dbc7817d45bf6ee80fc96be5772a078a6231882aadc56101b8d0339231ea3d265b05acac3cc2b472f14c85dc5f1068fa477842302c397883b3d2317ff98582e9

Download Submit
C:\Users\Admin\AppData\Local\Adobe\Acrobat\9.0\dQYJlRFK68az6pBweePMtWslIXL03DBG31.exe
Filesize
995KB

MD5
acdb866affdce280c6c0cf577a448ff6

SHA1
2db874c4e5468d3fe82d9f2afb47c2c23827f734

SHA256
04cbffcdbce4c6ef311677ea99320cf2396fbd460c6cb42c9ac631c4c8c6a130

SHA512
e620798299dcc002a7da38b7a3fbd605b2fb799541894957ff7f9001a3258bf2534f23de16cec5815790f867a6f5d5dcb528e9a42daa05655f07c5f964b97d15

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\GPUCache\OQ096TZKVkeViW8oQFWEAIUojX.exe
Filesize
741KB

MD5
e76fc46be0ae458d120cc219deb3857a

SHA1
c08ec6aadbd29cc52c0d9b962dd17647cd7e7098

SHA256
7e6ec1ac2674fd55f829b8475533fbd45ee7d1928961060ebb1e0db9e6b390cd

SHA512
18abd24fa6a41114b3fbd96ddc71e4f8978071af50ccb8966d235c36c77948eb41ab5014834ebef81aa3e74f3f6597d2a89f546c7d18062e0683518c8619d957

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\KvpilkimOMq55.exe
Filesize
781KB

MD5
99b2356217f576edcf76d80b47b846d5

SHA1
fe97815120bfbf5ff6307e9a81bd5605b82b056d

SHA256
de748436c5c4997b7c2318907605f267a66ebf526488c8f8d48cd7a3e024fbaa

SHA512
a9199597de01046cb35034ae9ee75270df1fe31bdef7023864a60129935c691514a331a6c8f4f3b7acef6aff19347c8f85f8d59a50502a2024f29a4c5d53b039

Download Submit
C:\Users\Admin\AppData\Local\Temp\612334118\iLMeXsl9oKtoIsQc3AMev1.exe
Filesize
841KB

MD5
cbcb15d2b878e9e3dde043b87a700c22

SHA1
e27c87fc578ecef8a014551c8c19089a2c647876

SHA256
65e1701c702d7103e167c5316442811f8b31b82e91a06ab717f562786db28acc

SHA512
8c6721847832964f56b6cf133a9e68e4b8d6156041d198761e67c8e9bbfffa4d050d5d4eb1390f0a8b6bbe0fff999742694054850c3b6343c896eaeaa6813b65

Download Submit
C:\Users\Admin\AppData\Roaming\Identities\{74A2ADB8-758C-4A03-AB80-FD816571C991}\0LcDK7mWPzJeUydql0TMAbb5cN5OVW1i3357u1jwmBd9Z.exe
Filesize
861KB

MD5
12e4f0505b83f980df22910aa360ad07

SHA1
08448468bc1ed1ca0806f905f37096922e94d2bf

SHA256
e8a5c32fb5cc41d7fb01717b8add96449b37e1d928b57142b7b79fec6a0ca43b

SHA512
9d2e02d0942db5b1737d04450e6911aefaea9855fcff948026b6f0e2d0ce3b1efce6c3275284e3de6cf45aa8d90c72d1a1422466391ff566b6237df7ed9d7471

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ae6vytmk.default-release\crashes\events\rx5vjYLPDeQv8h2O1tzpSaZampHs49wHu8IyfWL2mtiv.bat
Filesize
746KB

MD5
51ceb19a53961383886211a3541b6e0e

SHA1
50c5c40bf28bec237378c811aca8d61b15c07ff3

SHA256
0d65dee47fcc52b9d78d5790d518c727f535d678046891dba80f5a6dfbe50f51

SHA512
9c94108e8e08d31c4a3a53e1c609e00b8d9ec517d557f9a81ac384ec7b75d0ed90bedc5f230a44f8f2e41c07b52291d631b80acb0f2807c177e4356e8672b662

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ae6vytmk.default-release\crashes\events\rx5vjYLPDeQv8h2O1tzpSaZampHs49wHu8IyfWL2mtiv.bat
Filesize
746KB

MD5
51ceb19a53961383886211a3541b6e0e

SHA1
50c5c40bf28bec237378c811aca8d61b15c07ff3

SHA256
0d65dee47fcc52b9d78d5790d518c727f535d678046891dba80f5a6dfbe50f51

SHA512
9c94108e8e08d31c4a3a53e1c609e00b8d9ec517d557f9a81ac384ec7b75d0ed90bedc5f230a44f8f2e41c07b52291d631b80acb0f2807c177e4356e8672b662

Download Submit
C:\Users\Public\Pictures\Sample Pictures\LrQr9IYcDSktVVkyNHfg4QZEhuxD7M3DXuycPRXkV2jpVLZJeMf6pFyudgbjDulF4y4UNSh.exe
Filesize
748KB

MD5
6405aca1d6197da0c1017979fde8d64f

SHA1
4a0c095ab633d3293d2b5bbf78dbf7d647b64436

SHA256
169ccafd76f298b16c50d1cd2f3463cbaa881189295e87a608c0edd04ef5854e

SHA512
693b4e598d3826f5879c9e4c61dba3d4eb2349e6fe43a9328cb27bf0d4656597dec22a6e2b9d881cfc04f464974d5dac39348c85cad43cb334f5108922a8559b

Download Submit
\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ae6vytmk.default-release\crashes\events\rx5vjYLPDeQv8h2O1tzpSaZampHs49wHu8IyfWL2mtiv.bat
Filesize
746KB

MD5
51ceb19a53961383886211a3541b6e0e

SHA1
50c5c40bf28bec237378c811aca8d61b15c07ff3

SHA256
0d65dee47fcc52b9d78d5790d518c727f535d678046891dba80f5a6dfbe50f51

SHA512
9c94108e8e08d31c4a3a53e1c609e00b8d9ec517d557f9a81ac384ec7b75d0ed90bedc5f230a44f8f2e41c07b52291d631b80acb0f2807c177e4356e8672b662

Download Submit
\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ae6vytmk.default-release\crashes\events\rx5vjYLPDeQv8h2O1tzpSaZampHs49wHu8IyfWL2mtiv.bat
Filesize
746KB

MD5
51ceb19a53961383886211a3541b6e0e

SHA1
50c5c40bf28bec237378c811aca8d61b15c07ff3

SHA256
0d65dee47fcc52b9d78d5790d518c727f535d678046891dba80f5a6dfbe50f51

SHA512
9c94108e8e08d31c4a3a53e1c609e00b8d9ec517d557f9a81ac384ec7b75d0ed90bedc5f230a44f8f2e41c07b52291d631b80acb0f2807c177e4356e8672b662

Download Submit
memory/1140-54-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/1140-56-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/1332-65-0x00000000011B0000-0x00000000011DD000-memory.dmp

Filesize
180KB

Download
memory/1332-67-0x00000000011B0000-0x00000000011DD000-memory.dmp

Filesize
180KB

Download
memory/1332-68-0x00000000011B0000-0x00000000011DD000-memory.dmp

Filesize
180KB

Download
memory/1332-64-0x00000000011B0000-0x00000000011DD000-memory.dmp

Filesize
180KB

Download
memory/1520-55-0x000007FEFC201000-0x000007FEFC203000-memory.dmp

Filesize
8KB

Download
memory/2028-66-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/2028-62-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads