Analysis
-
max time kernel
47s -
max time network
52s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
25-11-2022 09:24
Static task
static1
Behavioral task
behavioral1
Sample
194ce016322f59f52ff8311a77b81847e8330667ddbb476862104e72e6fcb818.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
194ce016322f59f52ff8311a77b81847e8330667ddbb476862104e72e6fcb818.exe
Resource
win10v2004-20220901-en
Errors
General
-
Target
194ce016322f59f52ff8311a77b81847e8330667ddbb476862104e72e6fcb818.exe
-
Size
1.7MB
-
MD5
4a50ebb7357ed7ad2bdd2aa0b7adb247
-
SHA1
e95ead1ef996937878dafbc63ec1e2840dbc7b78
-
SHA256
194ce016322f59f52ff8311a77b81847e8330667ddbb476862104e72e6fcb818
-
SHA512
b0d3edfe5903bc5a02b2ca264c03e0100b82f69260ee6cc68588e8f88346ed38b1ac17b9505c11255dd44d89c45bc0b4ae90e6ba846c9fb48c278692101b098e
-
SSDEEP
3072:aSsvihLlTQz9z71iURo2SJJmY6uFNcgifDbmeTXwVdBR:rsqhJMxzJiU5SeLmNSbmebW1
Malware Config
Signatures
-
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
Processes:
GNRleclld8xyldfV1qw1DseqgPUjZ9J2rb.exedescription pid process target process PID 396 created 668 396 GNRleclld8xyldfV1qw1DseqgPUjZ9J2rb.exe lsass.exe -
Adds policy Run key to start application 2 TTPs 7 IoCs
Processes:
194ce016322f59f52ff8311a77b81847e8330667ddbb476862104e72e6fcb818.exeGNRleclld8xyldfV1qw1DseqgPUjZ9J2rb.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run 194ce016322f59f52ff8311a77b81847e8330667ddbb476862104e72e6fcb818.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\input\\nl-BE\\7bEvt1sq3WJtAFzwXgEUqkkR7ayznynyXQql7TNqTr3UcCH97mJEMzQyQV2iKT9gj.exe\" O" 194ce016322f59f52ff8311a77b81847e8330667ddbb476862104e72e6fcb818.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\QHQxoFrk3DwAWMz3gRn9iBUvf84VGnv5x58wWH9GhZa3sRMEDINIlFhTz1M6R5ZjCKTedX5.exe\" O" 194ce016322f59f52ff8311a77b81847e8330667ddbb476862104e72e6fcb818.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run GNRleclld8xyldfV1qw1DseqgPUjZ9J2rb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ = "\"C:\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ParentalControls_cw5n1h2txyewy\\SystemAppData\\gj5HbegW2P9sMLy2i2uYeaUW6PKU3Uepywmr10hrhQogy.exe\" O" GNRleclld8xyldfV1qw1DseqgPUjZ9J2rb.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run 194ce016322f59f52ff8311a77b81847e8330667ddbb476862104e72e6fcb818.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ = "\"C:\\Users\\Admin\\AppData\\Local\\Packages\\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\\AppData\\sCLdOz1wJ81BuME2KPrt8hxFbteQyzyqnGI8CNpyQWp1IodWaEvsEwDqmdglqgcmjzMT30.exe\" O" 194ce016322f59f52ff8311a77b81847e8330667ddbb476862104e72e6fcb818.exe -
Executes dropped EXE 2 IoCs
Processes:
GNRleclld8xyldfV1qw1DseqgPUjZ9J2rb.exeGNRleclld8xyldfV1qw1DseqgPUjZ9J2rb.exepid process 396 GNRleclld8xyldfV1qw1DseqgPUjZ9J2rb.exe 4768 GNRleclld8xyldfV1qw1DseqgPUjZ9J2rb.exe -
Sets file execution options in registry 2 TTPs 8 IoCs
Processes:
GNRleclld8xyldfV1qw1DseqgPUjZ9J2rb.exeGNRleclld8xyldfV1qw1DseqgPUjZ9J2rb.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MpCmdRun.exe\Debugger = " " GNRleclld8xyldfV1qw1DseqgPUjZ9J2rb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MsMpEng.exe GNRleclld8xyldfV1qw1DseqgPUjZ9J2rb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MsMpEng.exe\Debugger = " " GNRleclld8xyldfV1qw1DseqgPUjZ9J2rb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MpCmdRun.exe GNRleclld8xyldfV1qw1DseqgPUjZ9J2rb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MpCmdRun.exe\Debugger = " " GNRleclld8xyldfV1qw1DseqgPUjZ9J2rb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MsMpEng.exe GNRleclld8xyldfV1qw1DseqgPUjZ9J2rb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MsMpEng.exe\Debugger = " " GNRleclld8xyldfV1qw1DseqgPUjZ9J2rb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MpCmdRun.exe GNRleclld8xyldfV1qw1DseqgPUjZ9J2rb.exe -
Drops startup file 1 IoCs
Processes:
GNRleclld8xyldfV1qw1DseqgPUjZ9J2rb.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\jwonJg7vNYjfLZcTHtB3Yv86tSUQ4CMcZGFCpKTuBsodWcZCXkaOXFCl.exe GNRleclld8xyldfV1qw1DseqgPUjZ9J2rb.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies data under HKEY_USERS 64 IoCs
Processes:
194ce016322f59f52ff8311a77b81847e8330667ddbb476862104e72e6fcb818.exegpscript.exeGNRleclld8xyldfV1qw1DseqgPUjZ9J2rb.exeLogonUI.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ = "\"C:\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.ECApp_8wekyb3d8bbwe\\LocalCache\\YMCkoZZ0dryH.exe\" O" 194ce016322f59f52ff8311a77b81847e8330667ddbb476862104e72e6fcb818.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\SlowContextMenuEntries = 6024b221ea3a6910a2dc08002b30309d9d0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 gpscript.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Command Processor\AutoRun = "\"C:\\Users\\Admin\\AppData\\LocalLow\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Wr6ei4hkDwTLJ5hPRAqqrMhaduRyiyw92nwDDhQb209OnELYp6mzd5v8bBuLUtRoyGKe23.exe\" O 2>NUL" GNRleclld8xyldfV1qw1DseqgPUjZ9J2rb.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ = "\"C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\uMzG25G55yL1.exe\" O" 194ce016322f59f52ff8311a77b81847e8330667ddbb476862104e72e6fcb818.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies 194ce016322f59f52ff8311a77b81847e8330667ddbb476862104e72e6fcb818.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run 194ce016322f59f52ff8311a77b81847e8330667ddbb476862104e72e6fcb818.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows 194ce016322f59f52ff8311a77b81847e8330667ddbb476862104e72e6fcb818.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer 194ce016322f59f52ff8311a77b81847e8330667ddbb476862104e72e6fcb818.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion 194ce016322f59f52ff8311a77b81847e8330667ddbb476862104e72e6fcb818.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1" LogonUI.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Command Processor GNRleclld8xyldfV1qw1DseqgPUjZ9J2rb.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Command Processor 194ce016322f59f52ff8311a77b81847e8330667ddbb476862104e72e6fcb818.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Command Processor 194ce016322f59f52ff8311a77b81847e8330667ddbb476862104e72e6fcb818.exe Set value (str) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ = "\"C:\\ProgramData\\Microsoft\\Diagnosis\\ETLLogs\\pYCcQuM6iYMUTKG2EiQPhALxAYNt8NQuYBHkGWDi4UKnCjtvNMc8qmQLsGG.exe\" O" GNRleclld8xyldfV1qw1DseqgPUjZ9J2rb.exe Key created \REGISTRY\USER\S-1-5-19 194ce016322f59f52ff8311a77b81847e8330667ddbb476862104e72e6fcb818.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE 194ce016322f59f52ff8311a77b81847e8330667ddbb476862104e72e6fcb818.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run 194ce016322f59f52ff8311a77b81847e8330667ddbb476862104e72e6fcb818.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE 194ce016322f59f52ff8311a77b81847e8330667ddbb476862104e72e6fcb818.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271" LogonUI.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run GNRleclld8xyldfV1qw1DseqgPUjZ9J2rb.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE 194ce016322f59f52ff8311a77b81847e8330667ddbb476862104e72e6fcb818.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows 194ce016322f59f52ff8311a77b81847e8330667ddbb476862104e72e6fcb818.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" LogonUI.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run GNRleclld8xyldfV1qw1DseqgPUjZ9J2rb.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Command Processor\AutoRun = "\"C:\\Users\\Admin\\AppData\\Local\\Google\\Chrome\\User Data\\pnacl\\tk7OQBYuJsp8IQlXfID8zuza54wuXD3YKNfjLCsm1CufPrdgj.exe\" O 2>NUL" 194ce016322f59f52ff8311a77b81847e8330667ddbb476862104e72e6fcb818.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent LogonUI.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs\\wwOpixcDFvJU5HGTcN1mokOrXU1IZul54sZx9nLd33hHUHNjgKf2B5eop.exe\" O" GNRleclld8xyldfV1qw1DseqgPUjZ9J2rb.exe Set value (str) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Command Processor\AutoRun = "\"C:\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.Search_cw5n1h2txyewy\\AC\\INetCache\\PNXHMZV0\\ZpCKGRG8GzayuPZkgaCU8XGz.exe\" O 2>NUL" 194ce016322f59f52ff8311a77b81847e8330667ddbb476862104e72e6fcb818.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer gpscript.exe Key created \REGISTRY\USER\.DEFAULT 194ce016322f59f52ff8311a77b81847e8330667ddbb476862104e72e6fcb818.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\18.151.0729.0013\\adm\\zh-CN\\wWf3s3YS3yFd2Z.exe\" O" GNRleclld8xyldfV1qw1DseqgPUjZ9J2rb.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM LogonUI.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Command Processor\AutoRun = "\"C:\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\\SystemAppData\\NuWh8CUi.exe\" O 2>NUL" GNRleclld8xyldfV1qw1DseqgPUjZ9J2rb.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ = "\"C:\\Users\\Admin\\AppData\\LocalLow\\Sun\\Java\\Deployment\\cache\\6.0\\14\\r14fIGgwTEck5ZmHz5qC4pxZNoo.exe\" O" GNRleclld8xyldfV1qw1DseqgPUjZ9J2rb.exe Key created \REGISTRY\USER\S-1-5-20 194ce016322f59f52ff8311a77b81847e8330667ddbb476862104e72e6fcb818.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Command Processor GNRleclld8xyldfV1qw1DseqgPUjZ9J2rb.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Command Processor\AutoRun = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\input\\ca-ES\\gTGMll9yLgVyGuohvujak9x6h8g0iLFWMRb8h.exe\" O 2>NUL" GNRleclld8xyldfV1qw1DseqgPUjZ9J2rb.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run 194ce016322f59f52ff8311a77b81847e8330667ddbb476862104e72e6fcb818.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft 194ce016322f59f52ff8311a77b81847e8330667ddbb476862104e72e6fcb818.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808" LogonUI.exe Set value (str) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Command Processor\AutoRun = "\"C:\\Users\\Admin\\AppData\\Local\\Packages\\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\\AC\\INetCookies\\JpGpKOsHonaerMEnD.exe\" O 2>NUL" GNRleclld8xyldfV1qw1DseqgPUjZ9J2rb.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion 194ce016322f59f52ff8311a77b81847e8330667ddbb476862104e72e6fcb818.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run 194ce016322f59f52ff8311a77b81847e8330667ddbb476862104e72e6fcb818.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run GNRleclld8xyldfV1qw1DseqgPUjZ9J2rb.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{4234D49B-0245-4DF3-B780-3893943456E1} {000214E6-0000-0000-C000-000000000046} 0xFFFF = 010000000000000066c3b81ae200d901 GNRleclld8xyldfV1qw1DseqgPUjZ9J2rb.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies 194ce016322f59f52ff8311a77b81847e8330667ddbb476862104e72e6fcb818.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "223" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer 194ce016322f59f52ff8311a77b81847e8330667ddbb476862104e72e6fcb818.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft 194ce016322f59f52ff8311a77b81847e8330667ddbb476862104e72e6fcb818.exe Set value (str) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ = "\"C:\\ProgramData\\Package Cache\\{CB0836EC-B072-368D-82B2-D3470BF95707}v12.0.40660\\7vNVlscOuRh6nRnca8zzOfCumXZxdrAyGfk7EwBlq9FBkkPJYXlZCqCh8b.exe\" O" 194ce016322f59f52ff8311a77b81847e8330667ddbb476862104e72e6fcb818.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows 194ce016322f59f52ff8311a77b81847e8330667ddbb476862104e72e6fcb818.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ = "\"C:\\Users\\Admin\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Storage\\ext\\gfdkimpbcpahaombhbimeihdjnejgicl\\def\\Code Cache\\2MCdvnsCx7TvX3yW.exe\" O" 194ce016322f59f52ff8311a77b81847e8330667ddbb476862104e72e6fcb818.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00 LogonUI.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Command Processor 194ce016322f59f52ff8311a77b81847e8330667ddbb476862104e72e6fcb818.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies 194ce016322f59f52ff8311a77b81847e8330667ddbb476862104e72e6fcb818.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1" LogonUI.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Command Processor\AutoRun = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Vault\\RYXoBpTfFepwhoJCnPH4zlWZL9c9DlPIfRUUmdCNxixvhB.exe\" O 2>NUL" GNRleclld8xyldfV1qw1DseqgPUjZ9J2rb.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89" LogonUI.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Command Processor GNRleclld8xyldfV1qw1DseqgPUjZ9J2rb.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271" LogonUI.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ = "\"C:\\Users\\Admin\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\reports\\rW2OKutZ9LNiU3M3w9qAfuv7oN4YQFThq.exe\" O" GNRleclld8xyldfV1qw1DseqgPUjZ9J2rb.exe -
Modifies registry class 10 IoCs
Processes:
194ce016322f59f52ff8311a77b81847e8330667ddbb476862104e72e6fcb818.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\SOFTWARE\Microsoft 194ce016322f59f52ff8311a77b81847e8330667ddbb476862104e72e6fcb818.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\SOFTWARE\Microsoft\Command Processor\AutoRun = "\"C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Sidebar\\NmS7ePgj8Qg4gAaaboGUmIZjy.exe\" O 2>NUL" 194ce016322f59f52ff8311a77b81847e8330667ddbb476862104e72e6fcb818.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\SOFTWARE\Microsoft\Windows 194ce016322f59f52ff8311a77b81847e8330667ddbb476862104e72e6fcb818.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\SOFTWARE\Microsoft\Windows\CurrentVersion 194ce016322f59f52ff8311a77b81847e8330667ddbb476862104e72e6fcb818.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies 194ce016322f59f52ff8311a77b81847e8330667ddbb476862104e72e6fcb818.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer 194ce016322f59f52ff8311a77b81847e8330667ddbb476862104e72e6fcb818.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Edge\\User Data\\Default\\Sync Data\\ECVVykQ7ujJtc1ZIc.exe\" O" 194ce016322f59f52ff8311a77b81847e8330667ddbb476862104e72e6fcb818.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\SOFTWARE 194ce016322f59f52ff8311a77b81847e8330667ddbb476862104e72e6fcb818.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run 194ce016322f59f52ff8311a77b81847e8330667ddbb476862104e72e6fcb818.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\SOFTWARE\Microsoft\Command Processor 194ce016322f59f52ff8311a77b81847e8330667ddbb476862104e72e6fcb818.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
GNRleclld8xyldfV1qw1DseqgPUjZ9J2rb.exepid process 4768 GNRleclld8xyldfV1qw1DseqgPUjZ9J2rb.exe 4768 GNRleclld8xyldfV1qw1DseqgPUjZ9J2rb.exe -
Suspicious use of AdjustPrivilegeToken 7 IoCs
Processes:
194ce016322f59f52ff8311a77b81847e8330667ddbb476862104e72e6fcb818.exeGNRleclld8xyldfV1qw1DseqgPUjZ9J2rb.exeGNRleclld8xyldfV1qw1DseqgPUjZ9J2rb.exedescription pid process Token: SeBackupPrivilege 1352 194ce016322f59f52ff8311a77b81847e8330667ddbb476862104e72e6fcb818.exe Token: SeRestorePrivilege 1352 194ce016322f59f52ff8311a77b81847e8330667ddbb476862104e72e6fcb818.exe Token: SeShutdownPrivilege 1352 194ce016322f59f52ff8311a77b81847e8330667ddbb476862104e72e6fcb818.exe Token: SeDebugPrivilege 396 GNRleclld8xyldfV1qw1DseqgPUjZ9J2rb.exe Token: SeRestorePrivilege 396 GNRleclld8xyldfV1qw1DseqgPUjZ9J2rb.exe Token: SeDebugPrivilege 4768 GNRleclld8xyldfV1qw1DseqgPUjZ9J2rb.exe Token: SeRestorePrivilege 4768 GNRleclld8xyldfV1qw1DseqgPUjZ9J2rb.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
LogonUI.exepid process 1620 LogonUI.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
gpscript.exeGNRleclld8xyldfV1qw1DseqgPUjZ9J2rb.exedescription pid process target process PID 4796 wrote to memory of 396 4796 gpscript.exe GNRleclld8xyldfV1qw1DseqgPUjZ9J2rb.exe PID 4796 wrote to memory of 396 4796 gpscript.exe GNRleclld8xyldfV1qw1DseqgPUjZ9J2rb.exe PID 396 wrote to memory of 4768 396 GNRleclld8xyldfV1qw1DseqgPUjZ9J2rb.exe GNRleclld8xyldfV1qw1DseqgPUjZ9J2rb.exe PID 396 wrote to memory of 4768 396 GNRleclld8xyldfV1qw1DseqgPUjZ9J2rb.exe GNRleclld8xyldfV1qw1DseqgPUjZ9J2rb.exe
Processes
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe1⤵
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.ECApp_8wekyb3d8bbwe\LocalState\GNRleclld8xyldfV1qw1DseqgPUjZ9J2rb.exe"C:\Users\Admin\AppData\Local\Packages\Microsoft.ECApp_8wekyb3d8bbwe\LocalState\GNRleclld8xyldfV1qw1DseqgPUjZ9J2rb.exe" 22⤵
- Executes dropped EXE
- Sets file execution options in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\194ce016322f59f52ff8311a77b81847e8330667ddbb476862104e72e6fcb818.exe"C:\Users\Admin\AppData\Local\Temp\194ce016322f59f52ff8311a77b81847e8330667ddbb476862104e72e6fcb818.exe"1⤵
- Adds policy Run key to start application
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa39c7855 /state1:0x41c64e6d1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\gpscript.exegpscript.exe /Shutdown1⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.ECApp_8wekyb3d8bbwe\LocalState\GNRleclld8xyldfV1qw1DseqgPUjZ9J2rb.exe"C:\Users\Admin\AppData\Local\Packages\Microsoft.ECApp_8wekyb3d8bbwe\LocalState\GNRleclld8xyldfV1qw1DseqgPUjZ9J2rb.exe" 12⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Adds policy Run key to start application
- Executes dropped EXE
- Sets file execution options in registry
- Drops startup file
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Microsoft\Windows\Ringtones\It3QuRGuiK1zmKHcOiChdIwRWcvcInRZMp1Eu05D2rTW8j3rp3Acm3UkEDHYgGI.exeFilesize
2.7MB
MD534e5b340c655e18a6c5ef07ca5fbdd35
SHA1922a7a93f4416aac635037779005355b9f505f05
SHA256649b4b5eed00d31166d9388ea03f6b3af3102a512226bea38850962a7f35749b
SHA512b5ba351f8e3c5360209a2a58647b73565e55726a819eed0564ccf8cf3a2229fc762723093e88a3a6a3ede63d776384d2addb79976c066f0db58d8e0c24e0a9e3
-
C:\ProgramData\Package Cache\{CB0836EC-B072-368D-82B2-D3470BF95707}v12.0.40660\7vNVlscOuRh6nRnca8zzOfCumXZxdrAyGfk7EwBlq9FBkkPJYXlZCqCh8b.exeFilesize
2.9MB
MD587e8b923d566b472c0d9e0c223597b56
SHA132c13391ded1a042260b0998ea0c20b6dc96e846
SHA256307d04dbeac85b93a69933a60c9589fbad8a078d89a109d6b15448e23a7d125c
SHA5121e9940903c7bf64ce5bb387faa4de81f6d11832a26b07bfe43432e78d172d1195fd7445d5c09d7d740016c3be5d232c4b490dae8578b58fc5d86bc0930aaadda
-
C:\ProgramData\WindowsHolographicDevices\88JxHzESVkZl1AlMHnRS5j9wNDbjhZvcglMpDDpj.exeFilesize
2.5MB
MD51223767032e149740914c8132f318474
SHA150471bc6632682f176bf839d2dc757bdd4af82b8
SHA2569c79a18fbcc49c8c751d5c88253c2ce07b7476bac081ceb24a68f64af9385ad5
SHA5128415d9757c574191d55768cd96a9f22b2790602b46946de128712721b2e1fbbe8a4add06f66dce5159eabbe2135f11b8c32b6d3e69ea073f863ceda4fee75d28
-
C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\41\8CMSCV1EgetIOcxBVrCKrvaSf24KlzAjL.exeFilesize
4.4MB
MD5241f5e1b497fb66659a7defa5545307e
SHA1417355d910ed0fe0dfa2485ff390a2027a51c32e
SHA256d3f51ac2ebfddbf2e9e953ff4b2418c5a60ba05418104413b32177b5e37e0433
SHA512687998c0edb7d5433b8e10076d93670cbaa95a431708fe1ce67b954e9aa4158772c822cf36fe3a83ce4cc9b32940e3b1414f79e59debe5091b4165c1569c6626
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\Code Cache\2MCdvnsCx7TvX3yW.exeFilesize
2.8MB
MD51fff99af8d8c0a84dc139ec5672cdcf1
SHA196c5ec313c3d8fc137f56f44490cd60650ec48a2
SHA256fae2623a0d88d3180dbed397b308fb254edf0d851c0dd1d89b04620772253456
SHA5128ea9c79f72cefde67851697ab2f5d8c0b612f52aa0e2d143d9bf94d073c5dc127d5b4f6a2fb3d4819d7e25f45ab0bb9b3bdd41a88da22f44d81e98f75c7e1955
-
C:\Users\Admin\AppData\Local\Microsoft\input\RfJpaSjnDQ0If0T8otwGOkrOjrxSmXNS5.exeFilesize
3.0MB
MD5c266c8e8c41add8c0ad35ee53734f196
SHA17476293d70a348492b619280e5b6b036ffe4fd82
SHA256dc7fc6806cd5ba659c3b595bebcfeb59f5115f2a4fa4a143697d10aa7818e40f
SHA512848c6f05333083592f6dc4f8b0c2e7dd2ba113898f189d0f09605593052c5d6de40c8d58ada25dafb61d2282ccfb0107ca57a30c05fe1e52379f7d0413a776c2
-
C:\Users\Admin\AppData\Local\Microsoft\input\nl-BE\7bEvt1sq3WJtAFzwXgEUqkkR7ayznynyXQql7TNqTr3UcCH97mJEMzQyQV2iKT9gj.exeFilesize
2.0MB
MD57379c43554f83a42382a7eb2cdc57f2d
SHA1ce0a9e7b31213c1b6ec163ca348f0d5e76c67b54
SHA2563306b9530c412f16020559bbbd21cfb4392841402a4a66d155d95e322c55d6a6
SHA512bdd6cb5c38d8d923e33ae8c7c5d71976e0d6ee582c18350eeef9636dfa02a88402425bdff517dcee029c8b0d28d207dbd9f5255d7d87d37bc902a65a491b28c9
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.ECApp_8wekyb3d8bbwe\LocalCache\YMCkoZZ0dryH.exeFilesize
2.0MB
MD58a923c091c5f97a710c63f80b9bd4eec
SHA1e4bc35e7ad8eadebe7fcd45e58fc3ab12a727d40
SHA2569f3c162aff787e6294537ab6b186e07b9271b5bb34011a25d2b24968b95982af
SHA5122d11e8e80b42c2918151484bd9a58fccaf072d15f23f176dcaebb5d055a02194a3709e4393725bd1eeb018f11cab702be5cd5586ce634248aaa08487262adc86
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.ECApp_8wekyb3d8bbwe\LocalState\GNRleclld8xyldfV1qw1DseqgPUjZ9J2rb.exeFilesize
2.3MB
MD5931ab8501555a23a6a2f4f7d6e3cca27
SHA1e3f99b63c3fe5378ffc2b71e9d4b2c71c1b9a1b9
SHA25690265278d716969f729a57e82ff14d20129344f789d5e649b899675f7d83199b
SHA5125c93c7cb3dcba28af4f24a5d7146ab36ab2d79bb83a1e8f591a3793f8cfa161dc50d2a89925c9fa750ffc29eaeab5ef6bc5f6994871066ce1e9fbdb3c9d23db9
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.ECApp_8wekyb3d8bbwe\LocalState\GNRleclld8xyldfV1qw1DseqgPUjZ9J2rb.exeFilesize
2.3MB
MD5931ab8501555a23a6a2f4f7d6e3cca27
SHA1e3f99b63c3fe5378ffc2b71e9d4b2c71c1b9a1b9
SHA25690265278d716969f729a57e82ff14d20129344f789d5e649b899675f7d83199b
SHA5125c93c7cb3dcba28af4f24a5d7146ab36ab2d79bb83a1e8f591a3793f8cfa161dc50d2a89925c9fa750ffc29eaeab5ef6bc5f6994871066ce1e9fbdb3c9d23db9
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.ECApp_8wekyb3d8bbwe\LocalState\GNRleclld8xyldfV1qw1DseqgPUjZ9J2rb.exeFilesize
2.3MB
MD5931ab8501555a23a6a2f4f7d6e3cca27
SHA1e3f99b63c3fe5378ffc2b71e9d4b2c71c1b9a1b9
SHA25690265278d716969f729a57e82ff14d20129344f789d5e649b899675f7d83199b
SHA5125c93c7cb3dcba28af4f24a5d7146ab36ab2d79bb83a1e8f591a3793f8cfa161dc50d2a89925c9fa750ffc29eaeab5ef6bc5f6994871066ce1e9fbdb3c9d23db9
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Win32WebViewHost_cw5n1h2txyewy\SystemAppData\rifEdxyIxR.batFilesize
2.7MB
MD57991d891f2269198a7ba5d43aa04ea23
SHA1e1874ae894f4c8279d1b1af35156050c131f64d1
SHA256ddde2fa422f85941e4cc7df8e43f147d7fc578a0e96a53b3f3541f1da0c96cab
SHA5120b3da35eb74d8ef2954bf8581ff2678b070397ca887ec0624bb72b5d2ecff7c66b78f41ca478fb16b89186a024775983f71614b7a67345703f78c421a26c3ff5
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\INetCache\PNXHMZV0\ZpCKGRG8GzayuPZkgaCU8XGz.exeFilesize
3.4MB
MD5e9c057271d293b98717456d88d17620a
SHA1f36056ae862558df6e54d8b834d90485e0f24341
SHA256d999ba5e0c6eaf17f7a280f0eec9df80260e0218929440deaa98b5fc26180a72
SHA51227b59ec5e95f78559c0cb804d764f7279fc2e9613a91b9ce95dda0d05bffee0f043bd4217658aafb6fe2059e9f73324e9460800e3b1cd1f07acded92231facac
-
memory/396-137-0x0000000000400000-0x000000000042D000-memory.dmpFilesize
180KB
-
memory/396-146-0x0000000000400000-0x000000000042D000-memory.dmpFilesize
180KB
-
memory/396-149-0x0000000000400000-0x000000000042D000-memory.dmpFilesize
180KB
-
memory/396-135-0x0000000000000000-mapping.dmp
-
memory/1352-132-0x0000000000400000-0x000000000042D000-memory.dmpFilesize
180KB
-
memory/1352-133-0x0000000000400000-0x000000000042D000-memory.dmpFilesize
180KB
-
memory/4768-147-0x0000000000000000-mapping.dmp
-
memory/4768-150-0x0000000000400000-0x000000000042D000-memory.dmpFilesize
180KB