Analysis
-
max time kernel
151s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
25-11-2022 09:20
Static task
static1
Behavioral task
behavioral1
Sample
909c914fde5c6b6467d40735d4b6a87930ab5dd23e858a7b2f5c3a69b84a6e8a.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
909c914fde5c6b6467d40735d4b6a87930ab5dd23e858a7b2f5c3a69b84a6e8a.exe
Resource
win10v2004-20220812-en
General
-
Target
909c914fde5c6b6467d40735d4b6a87930ab5dd23e858a7b2f5c3a69b84a6e8a.exe
-
Size
415KB
-
MD5
dcc9555edcdcecf3a3cd60aba7b0875e
-
SHA1
187fa9303a16fd85d6349dbd938136e8afaa59da
-
SHA256
909c914fde5c6b6467d40735d4b6a87930ab5dd23e858a7b2f5c3a69b84a6e8a
-
SHA512
1d62dcb14c8a52237e5cf209566cee69a7f8ad079d4e6698d019473ee27ac973dc7eb2e405f532fe00cedd31fc2aa3b9e63417521c0a72b4881e25444ec9088f
-
SSDEEP
3072:aSsvihLlTQz9z71iURo2SJJmY6uFNcgifDbmeTXwVdBR:rsqhJMxzJiU5SeLmNSbmebW1
Malware Config
Signatures
-
Adds policy Run key to start application 2 TTPs 7 IoCs
Processes:
EMEEBW7cwQODLDDk1BeQezdD.bat909c914fde5c6b6467d40735d4b6a87930ab5dd23e858a7b2f5c3a69b84a6e8a.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ = "\"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\7-Zip\\6QHKFyRdYHl0Vll5ht8GmbSkFbXUi7DO611LQtKCS7fLLBgUPzMgErO3qOsIRbd4Ua7IV.exe\" O" EMEEBW7cwQODLDDk1BeQezdD.bat Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run 909c914fde5c6b6467d40735d4b6a87930ab5dd23e858a7b2f5c3a69b84a6e8a.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ = "\"C:\\ProgramData\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\YpNdVq1C82mB5BuwuxZ.exe\" O" 909c914fde5c6b6467d40735d4b6a87930ab5dd23e858a7b2f5c3a69b84a6e8a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run 909c914fde5c6b6467d40735d4b6a87930ab5dd23e858a7b2f5c3a69b84a6e8a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ = "\"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\VideoLAN\\O2gFxbuet8WsafK2naE54xd31kkh5Qa93sRJTczFDfD1.exe\" O" 909c914fde5c6b6467d40735d4b6a87930ab5dd23e858a7b2f5c3a69b84a6e8a.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ = "\"C:\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\\LocalState\\uAQo2mo4y6Zn4ep4yEG8yeRKslDzM54EurwRto3l.exe\" O" 909c914fde5c6b6467d40735d4b6a87930ab5dd23e858a7b2f5c3a69b84a6e8a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run EMEEBW7cwQODLDDk1BeQezdD.bat -
Executes dropped EXE 1 IoCs
Processes:
EMEEBW7cwQODLDDk1BeQezdD.batpid process 3676 EMEEBW7cwQODLDDk1BeQezdD.bat -
Sets file execution options in registry 2 TTPs 4 IoCs
Processes:
EMEEBW7cwQODLDDk1BeQezdD.batdescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MpCmdRun.exe EMEEBW7cwQODLDDk1BeQezdD.bat Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MpCmdRun.exe\Debugger = " " EMEEBW7cwQODLDDk1BeQezdD.bat Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MsMpEng.exe EMEEBW7cwQODLDDk1BeQezdD.bat Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MsMpEng.exe\Debugger = " " EMEEBW7cwQODLDDk1BeQezdD.bat -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies data under HKEY_USERS 64 IoCs
Processes:
EMEEBW7cwQODLDDk1BeQezdD.bat909c914fde5c6b6467d40735d4b6a87930ab5dd23e858a7b2f5c3a69b84a6e8a.exeLogonUI.exegpscript.exedescription ioc process Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{35786D3C-B075-49B9-88DD-029876E11C01} {ADD8BA80-002B-11D0-8F0F-00C04FD7D062} 0xFFFF = 0100000000000000b9307767eb00d901 EMEEBW7cwQODLDDk1BeQezdD.bat Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ = "\"C:\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\AC\\INetCookies\\ESE\\VDW76VDHduPyzD1snR1S37BtmIie6.exe\" O" 909c914fde5c6b6467d40735d4b6a87930ab5dd23e858a7b2f5c3a69b84a6e8a.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer 909c914fde5c6b6467d40735d4b6a87930ab5dd23e858a7b2f5c3a69b84a6e8a.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM LogonUI.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\SlowContextMenuEntries = 6024b221ea3a6910a2dc08002b30309d9d0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 gpscript.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Command Processor\AutoRun = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\input\\sr-Cyrl-RS\\ZEWfR3cDY3rMhDuCIeQkhN3HuRoLem.exe\" O 2>NUL" EMEEBW7cwQODLDDk1BeQezdD.bat Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{289AF617-1CC3-42A6-926C-E6A863F0E3BA} {ADD8BA80-002B-11D0-8F0F-00C04FD7D062} 0xFFFF = 0100000000000000816d7267eb00d901 EMEEBW7cwQODLDDk1BeQezdD.bat Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run 909c914fde5c6b6467d40735d4b6a87930ab5dd23e858a7b2f5c3a69b84a6e8a.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Command Processor EMEEBW7cwQODLDDk1BeQezdD.bat Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ = "\"C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\fr-FR\\BTe4ZJqSFzpHSEsMAh4ex3jZ41nf.exe\" O" EMEEBW7cwQODLDDk1BeQezdD.bat Set value (str) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ = "\"C:\\Users\\Admin\\AppData\\Local\\PeerDistRepub\\CAToGaUMOFlwktJJj18cPKDGP3rgUO6X0AaXg0b4AQrNdLZxXy.exe\" O" EMEEBW7cwQODLDDk1BeQezdD.bat Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FF393560-C2A7-11CF-BFF4-444553540000} {000214E6-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000dd9b5a67eb00d901 EMEEBW7cwQODLDDk1BeQezdD.bat Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Command Processor 909c914fde5c6b6467d40735d4b6a87930ab5dd23e858a7b2f5c3a69b84a6e8a.exe Set value (str) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Command Processor\AutoRun = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\18.151.0729.0013\\adm\\zh-TW\\3eELysmbwXaH8jRsKaw3yd2EFY5yLFP7HAGYH3AkfShKeDhWmx8RpSGvwBn.exe\" O 2>NUL" 909c914fde5c6b6467d40735d4b6a87930ab5dd23e858a7b2f5c3a69b84a6e8a.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run 909c914fde5c6b6467d40735d4b6a87930ab5dd23e858a7b2f5c3a69b84a6e8a.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run 909c914fde5c6b6467d40735d4b6a87930ab5dd23e858a7b2f5c3a69b84a6e8a.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run EMEEBW7cwQODLDDk1BeQezdD.bat Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Command Processor\AutoRun = "\"C:\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\\AC\\INetHistory\\qoNskbQEkB0P5ivZzvwZaDc6eGu8HjJtdsnsn5RtKsqkd84Oh8XTvtDnSNfPfM3kyItRVU.exe\" O 2>NUL" 909c914fde5c6b6467d40735d4b6a87930ab5dd23e858a7b2f5c3a69b84a6e8a.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft 909c914fde5c6b6467d40735d4b6a87930ab5dd23e858a7b2f5c3a69b84a6e8a.exe Key created \REGISTRY\USER\S-1-5-20 909c914fde5c6b6467d40735d4b6a87930ab5dd23e858a7b2f5c3a69b84a6e8a.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89" LogonUI.exe Set value (str) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Command Processor\AutoRun = "\"C:\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.BioEnrollment_cw5n1h2txyewy\\AC\\INetCookies\\ruVtPFsyN5lDXRG47aQrD1iF94Q1pJPRBiuO.exe\" O 2>NUL" EMEEBW7cwQODLDDk1BeQezdD.bat Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Command Processor\AutoRun = "\"C:\\Users\\Public\\Documents\\JpBVbz2AnkUPXpYWiCmolxZG2ZjSCCPxcqHQlhpw1pPepOmzqIOPyrsOfjDzbiTP.exe\" O 2>NUL" EMEEBW7cwQODLDDk1BeQezdD.bat Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies 909c914fde5c6b6467d40735d4b6a87930ab5dd23e858a7b2f5c3a69b84a6e8a.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History LogonUI.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Command Processor\AutoRun = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn\\MzLijVv3KWm5GkKOs7YRT5pjbYeaHMK0aM5M4DEp85iPpwggB6nORN6Gy.exe\" O 2>NUL" EMEEBW7cwQODLDDk1BeQezdD.bat Key created \REGISTRY\USER\S-1-5-19 909c914fde5c6b6467d40735d4b6a87930ab5dd23e858a7b2f5c3a69b84a6e8a.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\0fx48ci0.default-release\\storage\\permanent\\chrome\\PMB8RBKxCJFvs9H4HRlS1GKe7EHvz7rZyGotMGZB.exe\" O" 909c914fde5c6b6467d40735d4b6a87930ab5dd23e858a7b2f5c3a69b84a6e8a.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" LogonUI.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Command Processor EMEEBW7cwQODLDDk1BeQezdD.bat Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{4234D49B-0245-4DF3-B780-3893943456E1} {000214E6-0000-0000-C000-000000000046} 0xFFFF = 010000000000000023a3b34eeb00d901 EMEEBW7cwQODLDDk1BeQezdD.bat Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Command Processor\AutoRun = "\"C:\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.BioEnrollment_cw5n1h2txyewy\\SystemAppData\\vQ8NAkD8YUfZYmqBDZUm1XmEzjnt90iCVj7OzoQnAQxAKGxjrHaGJuzN.exe\" O 2>NUL" 909c914fde5c6b6467d40735d4b6a87930ab5dd23e858a7b2f5c3a69b84a6e8a.exe Key created \REGISTRY\USER\.DEFAULT 909c914fde5c6b6467d40735d4b6a87930ab5dd23e858a7b2f5c3a69b84a6e8a.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion 909c914fde5c6b6467d40735d4b6a87930ab5dd23e858a7b2f5c3a69b84a6e8a.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\input\\ar-IQ\\omr1PyzWYg8jSx4Or6kif27zz.exe\" O" EMEEBW7cwQODLDDk1BeQezdD.bat Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Command Processor\AutoRun = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\XoFo5ibMrP2jsHkGZrJN.exe\" O 2>NUL" EMEEBW7cwQODLDDk1BeQezdD.bat Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows 909c914fde5c6b6467d40735d4b6a87930ab5dd23e858a7b2f5c3a69b84a6e8a.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer 909c914fde5c6b6467d40735d4b6a87930ab5dd23e858a7b2f5c3a69b84a6e8a.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE 909c914fde5c6b6467d40735d4b6a87930ab5dd23e858a7b2f5c3a69b84a6e8a.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion 909c914fde5c6b6467d40735d4b6a87930ab5dd23e858a7b2f5c3a69b84a6e8a.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Command Processor EMEEBW7cwQODLDDk1BeQezdD.bat Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run EMEEBW7cwQODLDDk1BeQezdD.bat Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run 909c914fde5c6b6467d40735d4b6a87930ab5dd23e858a7b2f5c3a69b84a6e8a.exe Set value (str) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ = "\"C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts\\qZjR8R54w5tf9YBZTdH1E1dZyRZjHiKWBIVGpFq3pQRY54cuPeDrjNORG8wgPwXjfU6LCCO.exe\" O" 909c914fde5c6b6467d40735d4b6a87930ab5dd23e858a7b2f5c3a69b84a6e8a.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion 909c914fde5c6b6467d40735d4b6a87930ab5dd23e858a7b2f5c3a69b84a6e8a.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies 909c914fde5c6b6467d40735d4b6a87930ab5dd23e858a7b2f5c3a69b84a6e8a.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows 909c914fde5c6b6467d40735d4b6a87930ab5dd23e858a7b2f5c3a69b84a6e8a.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows 909c914fde5c6b6467d40735d4b6a87930ab5dd23e858a7b2f5c3a69b84a6e8a.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808" LogonUI.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ = "\"C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\1527c705-839a-4832-9118-54d4Bd6a0c89_10.0.19041.1023_neutral_neutral_cw5n1h2txyewy\\Ox9ditBVbJKOhOuIB11xYmSZEto1bv2pBkwsjxNVm.exe\" O" EMEEBW7cwQODLDDk1BeQezdD.bat Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached EMEEBW7cwQODLDDk1BeQezdD.bat Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Command Processor 909c914fde5c6b6467d40735d4b6a87930ab5dd23e858a7b2f5c3a69b84a6e8a.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Command Processor\AutoRun = "\"C:\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\\AppData\\DhQAiFi44Dk8Bi2hDC9WBzwXVUvnQycyqfdQ5uwDByezu7K1RB3.exe\" O 2>NUL" 909c914fde5c6b6467d40735d4b6a87930ab5dd23e858a7b2f5c3a69b84a6e8a.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft 909c914fde5c6b6467d40735d4b6a87930ab5dd23e858a7b2f5c3a69b84a6e8a.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "174" LogonUI.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies 909c914fde5c6b6467d40735d4b6a87930ab5dd23e858a7b2f5c3a69b84a6e8a.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent LogonUI.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ = "\"C:\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe\\RoamingState\\7CEgANRBcTAPKaQxeyIoth.exe\" O" EMEEBW7cwQODLDDk1BeQezdD.bat Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run EMEEBW7cwQODLDDk1BeQezdD.bat -
Modifies registry class 10 IoCs
Processes:
909c914fde5c6b6467d40735d4b6a87930ab5dd23e858a7b2f5c3a69b84a6e8a.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\SOFTWARE\Microsoft\Windows 909c914fde5c6b6467d40735d4b6a87930ab5dd23e858a7b2f5c3a69b84a6e8a.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\SOFTWARE\Microsoft 909c914fde5c6b6467d40735d4b6a87930ab5dd23e858a7b2f5c3a69b84a6e8a.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\SOFTWARE\Microsoft\Command Processor\AutoRun = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\input\\es-CL\\UmLRNoWXm0RmxK3J74qS8fyU5lZdZYf3hn6oRcHXkaM2R2LomSxQEqvgSJPn.exe\" O 2>NUL" 909c914fde5c6b6467d40735d4b6a87930ab5dd23e858a7b2f5c3a69b84a6e8a.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run 909c914fde5c6b6467d40735d4b6a87930ab5dd23e858a7b2f5c3a69b84a6e8a.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\SOFTWARE\Microsoft\Windows\CurrentVersion 909c914fde5c6b6467d40735d4b6a87930ab5dd23e858a7b2f5c3a69b84a6e8a.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies 909c914fde5c6b6467d40735d4b6a87930ab5dd23e858a7b2f5c3a69b84a6e8a.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer 909c914fde5c6b6467d40735d4b6a87930ab5dd23e858a7b2f5c3a69b84a6e8a.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ = "\"C:\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.Search_cw5n1h2txyewy\\AC\\INetCache\\1KEIXP2L\\wWMxx1JufyMJDbkefeeShVhJzw8DOjJIpzTUo4Lu15l6jHMNoKpSchWmPyHG.exe\" O" 909c914fde5c6b6467d40735d4b6a87930ab5dd23e858a7b2f5c3a69b84a6e8a.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\SOFTWARE\Microsoft\Command Processor 909c914fde5c6b6467d40735d4b6a87930ab5dd23e858a7b2f5c3a69b84a6e8a.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\SOFTWARE 909c914fde5c6b6467d40735d4b6a87930ab5dd23e858a7b2f5c3a69b84a6e8a.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
909c914fde5c6b6467d40735d4b6a87930ab5dd23e858a7b2f5c3a69b84a6e8a.exeEMEEBW7cwQODLDDk1BeQezdD.batdescription pid process Token: SeBackupPrivilege 3460 909c914fde5c6b6467d40735d4b6a87930ab5dd23e858a7b2f5c3a69b84a6e8a.exe Token: SeRestorePrivilege 3460 909c914fde5c6b6467d40735d4b6a87930ab5dd23e858a7b2f5c3a69b84a6e8a.exe Token: SeShutdownPrivilege 3460 909c914fde5c6b6467d40735d4b6a87930ab5dd23e858a7b2f5c3a69b84a6e8a.exe Token: SeDebugPrivilege 3676 EMEEBW7cwQODLDDk1BeQezdD.bat Token: SeRestorePrivilege 3676 EMEEBW7cwQODLDDk1BeQezdD.bat -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
LogonUI.exepid process 2488 LogonUI.exe -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
gpscript.exedescription pid process target process PID 3892 wrote to memory of 3676 3892 gpscript.exe EMEEBW7cwQODLDDk1BeQezdD.bat PID 3892 wrote to memory of 3676 3892 gpscript.exe EMEEBW7cwQODLDDk1BeQezdD.bat
Processes
-
C:\Users\Admin\AppData\Local\Temp\909c914fde5c6b6467d40735d4b6a87930ab5dd23e858a7b2f5c3a69b84a6e8a.exe"C:\Users\Admin\AppData\Local\Temp\909c914fde5c6b6467d40735d4b6a87930ab5dd23e858a7b2f5c3a69b84a6e8a.exe"1⤵
- Adds policy Run key to start application
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa39cb855 /state1:0x41c64e6d1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\gpscript.exegpscript.exe /Shutdown1⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\EMEEBW7cwQODLDDk1BeQezdD.bat"C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\EMEEBW7cwQODLDDk1BeQezdD.bat" 12⤵
- Adds policy Run key to start application
- Executes dropped EXE
- Sets file execution options in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN\O2gFxbuet8WsafK2naE54xd31kkh5Qa93sRJTczFDfD1.exeFilesize
795KB
MD582d40dcefa72af315be3c9fbd590766d
SHA1266b7db115ea36d1ad035458d1181d4a5d5713e2
SHA2567bf319ea908b98399f7dbbc4fad8dc4d24b46299401a3b78e79a472e99b28927
SHA512f0b8c90a21ad8a971d54ed5508f3ffb61ea2e8cd57e6f9e6ecc03708511ce6c22f728100050cf98ad9da520d913dc5a07d1ab549f6af3e1aaf8a47c8d38a7c23
-
C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\v7bNXle8FqwEIHYDP7R5zkI76vIDUMWphQ7MbiZkO08LszoGKWs4pr1IEEuir4t.exeFilesize
712KB
MD50d598529e040dd3197b3ebf1167b612d
SHA1443f383c67fa7a851d402a1aae4587eee6e4d572
SHA256c7dec7ec9f351e2f23ae6a40af9604af620f9079f19099469b3176fa4403bb09
SHA51263e3df1f488492d65f9001061d8b6ea5bb653b12c2b930ab1ddcf1e5755d52f1cb746a9d81769d589a45ae5d899c7d5ef0ff4f18e7aed3a9058946719da00d07
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\EMEEBW7cwQODLDDk1BeQezdD.batFilesize
753KB
MD530080edaac46d571f563551cbf434969
SHA1d17282225cdfa54d26421f1c0f5a1016d8f07412
SHA25644e7d6681d2ddeb2b7ca99928d041c4923e0fe6d66a8f39ca03b1b19a1f901e2
SHA512987de3485777fe43152790731f15039fe46aa0e6cb530734c154b09cfab5ccf9a57120b9bf16f0c9bc648b9dd2e2b682b73d5c0eb5279863b454bb44e671ee60
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\EMEEBW7cwQODLDDk1BeQezdD.batFilesize
753KB
MD530080edaac46d571f563551cbf434969
SHA1d17282225cdfa54d26421f1c0f5a1016d8f07412
SHA25644e7d6681d2ddeb2b7ca99928d041c4923e0fe6d66a8f39ca03b1b19a1f901e2
SHA512987de3485777fe43152790731f15039fe46aa0e6cb530734c154b09cfab5ccf9a57120b9bf16f0c9bc648b9dd2e2b682b73d5c0eb5279863b454bb44e671ee60
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\adm\zh-TW\3eELysmbwXaH8jRsKaw3yd2EFY5yLFP7HAGYH3AkfShKeDhWmx8RpSGvwBn.exeFilesize
422KB
MD555e076ea5ab6769306888d24676ef8e3
SHA119dc6d18925f31fb1f507d1cd76cbef4576f0fde
SHA25662d8a614a53f6e87d8b06327d0413327b65eeaa08405bed5062c364c6cccca39
SHA512ec4d1426c9b6918d6e20af2444890afba5a6f3b26e0b89d18a51c59ef635d414f955a157507635112d6b4503577f4a57692cefbebb74de2974a425d14b79aaa3
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.BioEnrollment_cw5n1h2txyewy\SystemAppData\vQ8NAkD8YUfZYmqBDZUm1XmEzjnt90iCVj7OzoQnAQxAKGxjrHaGJuzN.exeFilesize
776KB
MD59e4122ee2c29c93dd09cbdd861d3aaa4
SHA1a6175eea73678bc22caf47d1440c97568eec7df4
SHA25664755c838023be76469043ac88b77c7ecebdde67826d11c933536fd7d695d755
SHA512ae280206628e2908db8972a14c3e65ee326e93157f236045edad1728bd1269b9ec2eed5a5c986daef1159d534c05c7d4c8a023af399f553d003b688774f6ae9f
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\AppData\DhQAiFi44Dk8Bi2hDC9WBzwXVUvnQycyqfdQ5uwDByezu7K1RB3.exeFilesize
473KB
MD5a3c22d743b9cbf773d912a6cc3d0b67e
SHA109307a851b4c2a9bb3e4dfd2acdc9d9dc1a66c43
SHA256acbb98421cdc9f153a8d83cba60f04856d0da5ad2e8f38474a32412988770817
SHA51201e02ffdcef2a7a2ede130069eafe1e03831889e32983810141f6e6dfdcc3a2f2f22286eb245225ee70fd50916c9092e25cd8f4acf27db1cc266e9a4e2acad4e
-
C:\Users\Admin\AppData\Local\Packages\windows.immersivecontrolpanel_cw5n1h2txyewy\TempState\VJChJjQLelG2OOrG4svTPDCpbLxc8ITVSG6dhh9U.exeFilesize
691KB
MD5437c1d0355bebda0a184039a14bc97b7
SHA146561c4399729860603285cc773663b2db90bde5
SHA256eb5a29a749601fb2398089ae78d7b8b267c1a35fe83c77e47635cd8f73ee9af2
SHA5125fd345f3ce168b39a27f4298a4913eacc6eaf2721a5c4f8844d594a8738fb67ee9dda85907fdb799bd14868c5875052c2fc2c839b8b4462d738bce941c1f6679
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0fx48ci0.default-release\storage\permanent\chrome\PMB8RBKxCJFvs9H4HRlS1GKe7EHvz7rZyGotMGZB.exeFilesize
440KB
MD58d1e184e0f0d6a590176e59dd3d967f9
SHA10d4f0b07a9c235f3b56978d1ac367b88769557ca
SHA256aad8f1caf6053280811f53eb096a33beb1ca840fbbe0efd3121913770e4c15ce
SHA512eb028bbd9f7d5caf10063b6cdcfbfdd0324ac104716989f45076d1b86e3e1edee20ffdea0252cc7c67ab09b29e70e23e0b23c1ecdfc9e392a5dd3c75081267ab
-
C:\Users\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\qZjR8R54w5tf9YBZTdH1E1dZyRZjHiKWBIVGpFq3pQRY54cuPeDrjNORG8wgPwXjfU6LCCO.exeFilesize
608KB
MD5b90eda74d88bc549eb35eb229e9045d0
SHA12cf066e7947c73971bbc664abc94492b74cce275
SHA2568fb1978b246783a0490b62879f2c7dbb57b098e9a6c91777eb52ebcba6d6090f
SHA512dec74feac016f62f92c7c7da1e6cc6b8ea8ff433315485b7c2488837ebc42dd20eacbf16af18665144646f35bb7b6f8dea87ae5de04f30267adc982aa2917bb9
-
memory/3460-134-0x0000000000400000-0x000000000042D000-memory.dmpFilesize
180KB
-
memory/3460-132-0x0000000000400000-0x000000000042D000-memory.dmpFilesize
180KB
-
memory/3460-133-0x0000000000400000-0x000000000042D000-memory.dmpFilesize
180KB
-
memory/3676-135-0x0000000000000000-mapping.dmp
-
memory/3676-138-0x0000000000400000-0x000000000042D000-memory.dmpFilesize
180KB
-
memory/3676-147-0x0000000000400000-0x000000000042D000-memory.dmpFilesize
180KB