Analysis
-
max time kernel
204s -
max time network
31s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
25-11-2022 09:20
Static task
static1
Behavioral task
behavioral1
Sample
909c914fde5c6b6467d40735d4b6a87930ab5dd23e858a7b2f5c3a69b84a6e8a.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
909c914fde5c6b6467d40735d4b6a87930ab5dd23e858a7b2f5c3a69b84a6e8a.exe
Resource
win10v2004-20220812-en
General
-
Target
909c914fde5c6b6467d40735d4b6a87930ab5dd23e858a7b2f5c3a69b84a6e8a.exe
-
Size
415KB
-
MD5
dcc9555edcdcecf3a3cd60aba7b0875e
-
SHA1
187fa9303a16fd85d6349dbd938136e8afaa59da
-
SHA256
909c914fde5c6b6467d40735d4b6a87930ab5dd23e858a7b2f5c3a69b84a6e8a
-
SHA512
1d62dcb14c8a52237e5cf209566cee69a7f8ad079d4e6698d019473ee27ac973dc7eb2e405f532fe00cedd31fc2aa3b9e63417521c0a72b4881e25444ec9088f
-
SSDEEP
3072:aSsvihLlTQz9z71iURo2SJJmY6uFNcgifDbmeTXwVdBR:rsqhJMxzJiU5SeLmNSbmebW1
Malware Config
Signatures
-
Adds policy Run key to start application 2 TTPs 7 IoCs
Processes:
909c914fde5c6b6467d40735d4b6a87930ab5dd23e858a7b2f5c3a69b84a6e8a.exe0oJde6gox9bxm.batdescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Adobe\\Flash Player\\fGL1nJB0p7EusywQWLFaKfFreHG.exe\" O" 909c914fde5c6b6467d40735d4b6a87930ab5dd23e858a7b2f5c3a69b84a6e8a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run 0oJde6gox9bxm.bat Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\new\\AsNXhxhCk5mx.exe\" O" 0oJde6gox9bxm.bat Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run 909c914fde5c6b6467d40735d4b6a87930ab5dd23e858a7b2f5c3a69b84a6e8a.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ = "\"C:\\Users\\Admin\\AppData\\Local\\Google\\Chrome\\User Data\\TLSDeprecationConfig\\vJo782rJdZ9E.exe\" O" 909c914fde5c6b6467d40735d4b6a87930ab5dd23e858a7b2f5c3a69b84a6e8a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run 909c914fde5c6b6467d40735d4b6a87930ab5dd23e858a7b2f5c3a69b84a6e8a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ = "\"C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18\\ODOC9coUBNFlkjp8XR4qIIpCQq.exe\" O" 909c914fde5c6b6467d40735d4b6a87930ab5dd23e858a7b2f5c3a69b84a6e8a.exe -
Executes dropped EXE 1 IoCs
Processes:
0oJde6gox9bxm.batpid process 1052 0oJde6gox9bxm.bat -
Sets file execution options in registry 2 TTPs 4 IoCs
Processes:
0oJde6gox9bxm.batdescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MpCmdRun.exe 0oJde6gox9bxm.bat Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MpCmdRun.exe\Debugger = " " 0oJde6gox9bxm.bat Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MsMpEng.exe 0oJde6gox9bxm.bat Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MsMpEng.exe\Debugger = " " 0oJde6gox9bxm.bat -
Loads dropped DLL 2 IoCs
Processes:
gpscript.exepid process 1572 gpscript.exe 1572 gpscript.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies data under HKEY_USERS 56 IoCs
Processes:
0oJde6gox9bxm.bat909c914fde5c6b6467d40735d4b6a87930ab5dd23e858a7b2f5c3a69b84a6e8a.exegpscript.exedescription ioc process Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run 0oJde6gox9bxm.bat Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ = "\"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\VideoLAN\\KyurQdqpFvtC0RchvbAHyNKfN6ogYthvbf6b6VYgmitolrLGIvyY.exe\" O" 909c914fde5c6b6467d40735d4b6a87930ab5dd23e858a7b2f5c3a69b84a6e8a.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft 909c914fde5c6b6467d40735d4b6a87930ab5dd23e858a7b2f5c3a69b84a6e8a.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft 909c914fde5c6b6467d40735d4b6a87930ab5dd23e858a7b2f5c3a69b84a6e8a.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer 909c914fde5c6b6467d40735d4b6a87930ab5dd23e858a7b2f5c3a69b84a6e8a.exe Set value (str) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ = "\"C:\\Users\\Admin\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Storage\\ext\\gfdkimpbcpahaombhbimeihdjnejgicl\\def\\Code Cache\\wasm\\index-dir\\apFDNOLii7Nt.exe\" O" 909c914fde5c6b6467d40735d4b6a87930ab5dd23e858a7b2f5c3a69b84a6e8a.exe Set value (str) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ = "\"C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\ja-JP\\abmcoSiFET5oFRBlpT1qI3CFXjwUzN3HMhyJesiJNz4cqkfq3R.exe\" O" 0oJde6gox9bxm.bat Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\EcEarWXcXcEjfcGO0mzgsbYKLVKC80aJv6VRXF9eOood9t.exe\" O" 0oJde6gox9bxm.bat Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached gpscript.exe Key created \REGISTRY\USER\.DEFAULT 909c914fde5c6b6467d40735d4b6a87930ab5dd23e858a7b2f5c3a69b84a6e8a.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion 909c914fde5c6b6467d40735d4b6a87930ab5dd23e858a7b2f5c3a69b84a6e8a.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ = "\"C:\\Users\\Admin\\AppData\\LocalLow\\Sun\\Java\\Deployment\\security\\p4bqXukVLX2Uj0ldR9uxfY21VL9Ks.exe\" O" 909c914fde5c6b6467d40735d4b6a87930ab5dd23e858a7b2f5c3a69b84a6e8a.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@"%windir%\System32\ie4uinit.exe",-738 = "Start Internet Explorer without ActiveX controls or browser extensions." 0oJde6gox9bxm.bat Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Command Processor 909c914fde5c6b6467d40735d4b6a87930ab5dd23e858a7b2f5c3a69b84a6e8a.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Command Processor 0oJde6gox9bxm.bat Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ = "\"C:\\ProgramData\\Microsoft\\Windows NT\\ywPGsJuhfzgH0G9AR0PPFE1.exe\" O" 0oJde6gox9bxm.bat Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run 0oJde6gox9bxm.bat Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Command Processor\AutoRun = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Crypto\\f9EbNOXEoO2hF.exe\" O 2>NUL" 909c914fde5c6b6467d40735d4b6a87930ab5dd23e858a7b2f5c3a69b84a6e8a.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run 909c914fde5c6b6467d40735d4b6a87930ab5dd23e858a7b2f5c3a69b84a6e8a.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run 909c914fde5c6b6467d40735d4b6a87930ab5dd23e858a7b2f5c3a69b84a6e8a.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{6C467336-8281-4E60-8204-430CED96822D} {000214E4-0000-0000-C000-000000000046} 0xFFFF = 010000000000000000300257eb00d901 gpscript.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows Mail\\ZnydFVO5oBZciwO0gmk94CCv2PgZAfCZMU.exe\" O" 909c914fde5c6b6467d40735d4b6a87930ab5dd23e858a7b2f5c3a69b84a6e8a.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies 909c914fde5c6b6467d40735d4b6a87930ab5dd23e858a7b2f5c3a69b84a6e8a.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 0oJde6gox9bxm.bat Set value (str) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Command Processor\AutoRun = "\"C:\\ProgramData\\Microsoft\\Windows\\AIT\\6It7iBHwxU.exe\" O 2>NUL" 909c914fde5c6b6467d40735d4b6a87930ab5dd23e858a7b2f5c3a69b84a6e8a.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ = "\"C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\Backup\\AvUySG1u7b3sbHJcYPzNBChgUUlCpmz76Cux2VYFI4oHNWoRJRF1V0.exe\" O" 0oJde6gox9bxm.bat Key created \REGISTRY\USER\S-1-5-19 909c914fde5c6b6467d40735d4b6a87930ab5dd23e858a7b2f5c3a69b84a6e8a.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft 909c914fde5c6b6467d40735d4b6a87930ab5dd23e858a7b2f5c3a69b84a6e8a.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies 909c914fde5c6b6467d40735d4b6a87930ab5dd23e858a7b2f5c3a69b84a6e8a.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Command Processor 909c914fde5c6b6467d40735d4b6a87930ab5dd23e858a7b2f5c3a69b84a6e8a.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows 909c914fde5c6b6467d40735d4b6a87930ab5dd23e858a7b2f5c3a69b84a6e8a.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE 909c914fde5c6b6467d40735d4b6a87930ab5dd23e858a7b2f5c3a69b84a6e8a.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows 909c914fde5c6b6467d40735d4b6a87930ab5dd23e858a7b2f5c3a69b84a6e8a.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies 909c914fde5c6b6467d40735d4b6a87930ab5dd23e858a7b2f5c3a69b84a6e8a.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Command Processor\AutoRun = "\"C:\\ProgramData\\Microsoft Help\\KhbzeOesAjGaR3.exe\" O 2>NUL" 0oJde6gox9bxm.bat Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Command Processor\AutoRun = "\"C:\\Users\\Admin\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Data\\0kjEGjFBgCc9UVnZy6bf71j6PXsPiUbDZDBr6.exe\" O 2>NUL" 909c914fde5c6b6467d40735d4b6a87930ab5dd23e858a7b2f5c3a69b84a6e8a.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer 909c914fde5c6b6467d40735d4b6a87930ab5dd23e858a7b2f5c3a69b84a6e8a.exe Key created \REGISTRY\USER\S-1-5-20 909c914fde5c6b6467d40735d4b6a87930ab5dd23e858a7b2f5c3a69b84a6e8a.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@"%windir%\System32\ie4uinit.exe",-732 = "Finds and displays information and Web sites on the Internet." 0oJde6gox9bxm.bat Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Command Processor 909c914fde5c6b6467d40735d4b6a87930ab5dd23e858a7b2f5c3a69b84a6e8a.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion 909c914fde5c6b6467d40735d4b6a87930ab5dd23e858a7b2f5c3a69b84a6e8a.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows 909c914fde5c6b6467d40735d4b6a87930ab5dd23e858a7b2f5c3a69b84a6e8a.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer 909c914fde5c6b6467d40735d4b6a87930ab5dd23e858a7b2f5c3a69b84a6e8a.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE 909c914fde5c6b6467d40735d4b6a87930ab5dd23e858a7b2f5c3a69b84a6e8a.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Command Processor\AutoRun = "\"C:\\Users\\Admin\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\ae6vytmk.default-release\\extensions\\1j8bw0fvvdHLjviNcwxAOj7Z.exe\" O 2>NUL" 0oJde6gox9bxm.bat Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\ae6vytmk.default-release\\storage\\permanent\\chrome\\idb\\2918063365piupsah.files\\AIRwEOMe5N8MZYUQIRyztZhLbrF7ofrmtAG5eI.exe\" O" 0oJde6gox9bxm.bat Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run 909c914fde5c6b6467d40735d4b6a87930ab5dd23e858a7b2f5c3a69b84a6e8a.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Command Processor 0oJde6gox9bxm.bat Set value (str) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Command Processor\AutoRun = "\"C:\\ProgramData\\Microsoft\\xk3SxzG0tFrZPK4qC.exe\" O 2>NUL" 0oJde6gox9bxm.bat Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run 0oJde6gox9bxm.bat Key created \REGISTRY\USER\S-1-5-20\SOFTWARE 909c914fde5c6b6467d40735d4b6a87930ab5dd23e858a7b2f5c3a69b84a6e8a.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion 909c914fde5c6b6467d40735d4b6a87930ab5dd23e858a7b2f5c3a69b84a6e8a.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Command Processor\AutoRun = "\"C:\\ProgramData\\Package Cache\\{7DAD0258-515C-3DD4-8964-BD714199E0F7}v12.0.40660\\packages\\vcRuntimeAdditional_x86\\wlYW7hcjZ0HkJiqkTdFBnBBfPoZN1Awp6VMseM4YYhZXgANrvMz.exe\" O 2>NUL" 0oJde6gox9bxm.bat Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Command Processor 0oJde6gox9bxm.bat Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Command Processor\AutoRun = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\F33oL1eg9MOkElLgtXy03KD.exe\" O 2>NUL" 0oJde6gox9bxm.bat Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Command Processor\AutoRun = "\"C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\SentItems\\JTz6XYC4weo5ZpXoUcDDkeZoPfZhkZqtnd.exe\" O 2>NUL" 909c914fde5c6b6467d40735d4b6a87930ab5dd23e858a7b2f5c3a69b84a6e8a.exe -
Modifies registry class 12 IoCs
Processes:
909c914fde5c6b6467d40735d4b6a87930ab5dd23e858a7b2f5c3a69b84a6e8a.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\SOFTWARE 909c914fde5c6b6467d40735d4b6a87930ab5dd23e858a7b2f5c3a69b84a6e8a.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\SOFTWARE\Microsoft\Command Processor 909c914fde5c6b6467d40735d4b6a87930ab5dd23e858a7b2f5c3a69b84a6e8a.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_Classes\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run 909c914fde5c6b6467d40735d4b6a87930ab5dd23e858a7b2f5c3a69b84a6e8a.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\SOFTWARE\Microsoft\Windows 909c914fde5c6b6467d40735d4b6a87930ab5dd23e858a7b2f5c3a69b84a6e8a.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\SOFTWARE\Microsoft\Windows\CurrentVersion 909c914fde5c6b6467d40735d4b6a87930ab5dd23e858a7b2f5c3a69b84a6e8a.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies 909c914fde5c6b6467d40735d4b6a87930ab5dd23e858a7b2f5c3a69b84a6e8a.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run 909c914fde5c6b6467d40735d4b6a87930ab5dd23e858a7b2f5c3a69b84a6e8a.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ = "\"C:\\ProgramData\\Package Cache\\{6DB765A8-05AF-49A1-A71D-6F645EE3CE41}v14.30.30704\\packages\\wvfyDTFrATRxvLxyUeqP4gjhrgEsYga63hvsuolB4mIjT6Lq7.exe\" O" 909c914fde5c6b6467d40735d4b6a87930ab5dd23e858a7b2f5c3a69b84a6e8a.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_Classes\SOFTWARE\Microsoft\Command Processor 909c914fde5c6b6467d40735d4b6a87930ab5dd23e858a7b2f5c3a69b84a6e8a.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\SOFTWARE\Microsoft 909c914fde5c6b6467d40735d4b6a87930ab5dd23e858a7b2f5c3a69b84a6e8a.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\SOFTWARE\Microsoft\Command Processor\AutoRun = "\"C:\\Users\\Admin\\AppData\\LocalLow\\Sun\\Java\\Deployment\\cache\\6.0\\22\\VXBaTQeehTgMgpL9wnAF1VuIEd0a6nBKwPjm74DjBH2jji5DJcKvO4Nj0zMyoY0O.exe\" O 2>NUL" 909c914fde5c6b6467d40735d4b6a87930ab5dd23e858a7b2f5c3a69b84a6e8a.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer 909c914fde5c6b6467d40735d4b6a87930ab5dd23e858a7b2f5c3a69b84a6e8a.exe -
Suspicious use of AdjustPrivilegeToken 9 IoCs
Processes:
909c914fde5c6b6467d40735d4b6a87930ab5dd23e858a7b2f5c3a69b84a6e8a.exeAUDIODG.EXE0oJde6gox9bxm.batdescription pid process Token: SeBackupPrivilege 1420 909c914fde5c6b6467d40735d4b6a87930ab5dd23e858a7b2f5c3a69b84a6e8a.exe Token: SeRestorePrivilege 1420 909c914fde5c6b6467d40735d4b6a87930ab5dd23e858a7b2f5c3a69b84a6e8a.exe Token: SeShutdownPrivilege 1420 909c914fde5c6b6467d40735d4b6a87930ab5dd23e858a7b2f5c3a69b84a6e8a.exe Token: 33 1072 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1072 AUDIODG.EXE Token: 33 1072 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1072 AUDIODG.EXE Token: SeDebugPrivilege 1052 0oJde6gox9bxm.bat Token: SeRestorePrivilege 1052 0oJde6gox9bxm.bat -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
gpscript.exedescription pid process target process PID 1572 wrote to memory of 1052 1572 gpscript.exe 0oJde6gox9bxm.bat PID 1572 wrote to memory of 1052 1572 gpscript.exe 0oJde6gox9bxm.bat PID 1572 wrote to memory of 1052 1572 gpscript.exe 0oJde6gox9bxm.bat
Processes
-
C:\Users\Admin\AppData\Local\Temp\909c914fde5c6b6467d40735d4b6a87930ab5dd23e858a7b2f5c3a69b84a6e8a.exe"C:\Users\Admin\AppData\Local\Temp\909c914fde5c6b6467d40735d4b6a87930ab5dd23e858a7b2f5c3a69b84a6e8a.exe"1⤵
- Adds policy Run key to start application
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x01⤵
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x5401⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x11⤵
-
C:\Windows\system32\gpscript.exegpscript.exe /Shutdown1⤵
- Loads dropped DLL
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\My\CTLs\0oJde6gox9bxm.bat"C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\My\CTLs\0oJde6gox9bxm.bat" 12⤵
- Adds policy Run key to start application
- Executes dropped EXE
- Sets file execution options in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Microsoft\Crypto\RSA\S-1-5-18\ODOC9coUBNFlkjp8XR4qIIpCQq.exeFilesize
552KB
MD5cc8497e3627d5f700aea2acaa98e7c1e
SHA1120a53e6c4fec92d07b3f2e8d9033d97c66574fa
SHA256789e15ef46ff7451b1b6a2ff6e02ea8b619fa03410cb096b102ae923aff86aeb
SHA51225284cd096e0b866ad52f68bd3a43b86aa703f13e8cffefd4e6b239dd5897a3d05bfe0268ad95d3b484af8a972d9f25804811ee168d38df62aa0ce19089bf33e
-
C:\ProgramData\Microsoft\Windows\AIT\6It7iBHwxU.exeFilesize
421KB
MD546ce6d197b5d2e7b0a850a9e2b5df4da
SHA1dc4a0f159222e978d99a4e9303cfba3c8686234e
SHA25687db07dfb8e44abdb0f50ba53361405e15f7f7c6485c4acd37ea983d2e50ad50
SHA5125ed1184cca1985e37927158a5db3b2795f41693077030a58a32cd8abd9c22d18656d9df7eba7e4d3161bbba361ce3fe21ab21e9374a885398352dff44243e270
-
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN\KyurQdqpFvtC0RchvbAHyNKfN6ogYthvbf6b6VYgmitolrLGIvyY.exeFilesize
665KB
MD5c10521422ec61046a89ce1998fe26848
SHA18a405946837b0a63cde91400ad7e1a54fac140f1
SHA25630f634a6cecd4ed6c250ef69056455c4deb94e15383b1bc61bdde2efa10d836e
SHA5128e11acfb902e651d483c35e2f16785feff49311610f7c83ac9a37e8cd71627b86665fb9ef342b7a13350d663a288e6cbb7ea063081288f2a3ad3081aaec1face
-
C:\ProgramData\Package Cache\{7DAD0258-515C-3DD4-8964-BD714199E0F7}v12.0.40660\packages\OooIi55qKPAHby46ytDBEDFHpCwh8VT3.exeFilesize
632KB
MD5001e40bddc6e0628f4bfa6840bc002df
SHA1b4cd33e21697fb02bf6765f3f63a0dfceb5e2b84
SHA2568c5ff46bb51ef9068488e3c7be7fee00a18d0138a59cbfd1553587365b00e504
SHA51276830ab141bb607844d7a8a6a010cfbaf102c4745ac7c02ee0f220ab1e06703796d250036398afd55030a423e44cb5597908518aed81c4609ae3d85e9181ccbc
-
C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\security\p4bqXukVLX2Uj0ldR9uxfY21VL9Ks.exeFilesize
539KB
MD52025e08b152c90a85f4abd783342e2ab
SHA16eeb18a1dccde79cef9aa828c84dbe1d72340d34
SHA256a5a294fb4eba4901615fab01838819de0e0b553ff045c9f6f4833173eef350b5
SHA512bc2fb03fb95bf3f90058258813b05886f4dc920e342083a447dcc19494068191a3711b5708fcaffced8fce8b9029610a708dc0a40893f56d338e357c0e052461
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\Code Cache\wasm\index-dir\apFDNOLii7Nt.exeFilesize
793KB
MD589f1c71acfae979fb9d0a24514043df2
SHA1967f313ba73e8dccdee737377e71c4373bba6a99
SHA2568fd75d0df5e0533a361d82384313a4ca087ecc784ce21e97c88234a9f61e2d5e
SHA51247eaf8eb77ffc33dbb289e7d7ebfdb80f2704236c147b27dfb2a55f823d9da7a493cfe5ecb8145d8db975af0dcb44aec3f2ab67c32108a41e00ca09d11961464
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\0kjEGjFBgCc9UVnZy6bf71j6PXsPiUbDZDBr6.exeFilesize
720KB
MD5041c2d174b0408d3daef40652f9788c3
SHA10defc39b2f9d92bb29d6e3e8e14a6ee9bd2f90c5
SHA2568d685231c19cb72088521a2a464169f0c43aebdf70a641063859445b452518e7
SHA512b312cde1339b6eb6125ca8b4a2b195a9100288c8e8b6b52e36fc31d697e29b64455f9d1737717f27bd5f2e67a93020f1f87b6d4be548aeb710624e31cd894f81
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\f9EbNOXEoO2hF.exeFilesize
692KB
MD50a79f0e0b94ee863fd61e9d1792cf184
SHA1cea512f5287bbf657d10dd3caf02b7e3c4bcb64f
SHA2563353bc682900e0f7c941d942d0ba447f9f223b0930e57d001cbf6c92dbfa67c6
SHA512e61ee2c125aa7bd5b638e63a94d85648c9e0cc491d02f87a0c6469912656ceda8681775db725ddda3db6af934024d1bd3f38fbcb72b5fe1039906aede7856af3
-
C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\My\CTLs\0oJde6gox9bxm.batFilesize
591KB
MD53158047b4719257de53d7b75fa6b03ee
SHA1fc9eb12ce9323d282b1c88a8070d3e80a4dbad11
SHA2565fc3fc684893651c6f52b7427bc727141317eb7ed31af86bbd99e2c6a6c75af1
SHA5121bfeaa3767d2668307cd33178d009b0c212b002ccfb7c38b6e1fc28b54716d82bc12a5c40edad5fd09642f9500687c8a8040a74869297a575f4b6c2c276d2442
-
C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\My\CTLs\0oJde6gox9bxm.batFilesize
591KB
MD53158047b4719257de53d7b75fa6b03ee
SHA1fc9eb12ce9323d282b1c88a8070d3e80a4dbad11
SHA2565fc3fc684893651c6f52b7427bc727141317eb7ed31af86bbd99e2c6a6c75af1
SHA5121bfeaa3767d2668307cd33178d009b0c212b002ccfb7c38b6e1fc28b54716d82bc12a5c40edad5fd09642f9500687c8a8040a74869297a575f4b6c2c276d2442
-
\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\My\CTLs\0oJde6gox9bxm.batFilesize
591KB
MD53158047b4719257de53d7b75fa6b03ee
SHA1fc9eb12ce9323d282b1c88a8070d3e80a4dbad11
SHA2565fc3fc684893651c6f52b7427bc727141317eb7ed31af86bbd99e2c6a6c75af1
SHA5121bfeaa3767d2668307cd33178d009b0c212b002ccfb7c38b6e1fc28b54716d82bc12a5c40edad5fd09642f9500687c8a8040a74869297a575f4b6c2c276d2442
-
\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\My\CTLs\0oJde6gox9bxm.batFilesize
591KB
MD53158047b4719257de53d7b75fa6b03ee
SHA1fc9eb12ce9323d282b1c88a8070d3e80a4dbad11
SHA2565fc3fc684893651c6f52b7427bc727141317eb7ed31af86bbd99e2c6a6c75af1
SHA5121bfeaa3767d2668307cd33178d009b0c212b002ccfb7c38b6e1fc28b54716d82bc12a5c40edad5fd09642f9500687c8a8040a74869297a575f4b6c2c276d2442
-
memory/844-55-0x000007FEFBA41000-0x000007FEFBA43000-memory.dmpFilesize
8KB
-
memory/1052-62-0x0000000000000000-mapping.dmp
-
memory/1052-70-0x0000000000400000-0x000000000042D000-memory.dmpFilesize
180KB
-
memory/1052-78-0x0000000000400000-0x000000000042D000-memory.dmpFilesize
180KB
-
memory/1420-54-0x0000000000400000-0x000000000042D000-memory.dmpFilesize
180KB
-
memory/1420-56-0x0000000000400000-0x000000000042D000-memory.dmpFilesize
180KB
-
memory/1572-68-0x0000000000F30000-0x0000000000F5D000-memory.dmpFilesize
180KB
-
memory/1572-69-0x0000000000F30000-0x0000000000F5D000-memory.dmpFilesize
180KB
-
memory/1572-76-0x0000000000F30000-0x0000000000F5D000-memory.dmpFilesize
180KB
-
memory/1572-77-0x0000000000F30000-0x0000000000F5D000-memory.dmpFilesize
180KB