ed80f23ce087e4141e31f7cc278932effeda192da2afa076ee03de28ffa058f2

Analysis

max time kernel
45s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
25/11/2022, 09:30

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

ed80f23ce087e4141e31f7cc278932effeda192da2afa076ee03de28ffa058f2.exe
Size

625KB
MD5

75758ea1bddf91e249edf6387adbd794
SHA1

06c1256c9d5f8305a8b34580a4963b4fdf86377c
SHA256

ed80f23ce087e4141e31f7cc278932effeda192da2afa076ee03de28ffa058f2
SHA512

f53a9f02a46c73fb3d775e8fb73ae135097849e95448100cd87fbfeda91a4f8409231f8ee096512eedf3a6e49ed212b1a29eb493cd487b508fc20ff6d7acce1e
SSDEEP

3072:aSsvihLlTQz9z71iURo2SJJmY6uFNcgifDbmeTXwVdBR:rsqhJMxzJiU5SeLmNSbmebW1

Score

8^/10

persistence spyware stealer

Malware Config

Signatures

Adds policy Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ = "\"C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\odbQ9rRCLApovUCr5JEsbiIqM42Lhst6bbtGhQOh2YUY8NvWJPiqS1t7XTHE4l5uFd.exe\" O"	ed80f23ce087e4141e31f7cc278932effeda192da2afa076ee03de28ffa058f2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	ed80f23ce087e4141e31f7cc278932effeda192da2afa076ee03de28ffa058f2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ = "\"C:\\Users\\Public\\Desktop\\5AtQBxg6ZYa0jKJiRxlzoaEMQwZET3yx.exe\" O"	ed80f23ce087e4141e31f7cc278932effeda192da2afa076ee03de28ffa058f2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\ZYK3cKJvVjDcxLKWAb8in.exe\" O"	ed80f23ce087e4141e31f7cc278932effeda192da2afa076ee03de28ffa058f2.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	ed80f23ce087e4141e31f7cc278932effeda192da2afa076ee03de28ffa058f2.exe

Executes dropped EXE 1 IoCs

pid	Process
1744	bdp0iEqE.exe

Sets file execution options in registry 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MsMpEng.exe	bdp0iEqE.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options	bdp0iEqE.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MpCmdRun.exe	bdp0iEqE.exe

Loads dropped DLL 2 IoCs

pid	Process
316	gpscript.exe
316	gpscript.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Modifies data under HKEY_USERS 37 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft	ed80f23ce087e4141e31f7cc278932effeda192da2afa076ee03de28ffa058f2.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	ed80f23ce087e4141e31f7cc278932effeda192da2afa076ee03de28ffa058f2.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows	ed80f23ce087e4141e31f7cc278932effeda192da2afa076ee03de28ffa058f2.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion	ed80f23ce087e4141e31f7cc278932effeda192da2afa076ee03de28ffa058f2.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies	ed80f23ce087e4141e31f7cc278932effeda192da2afa076ee03de28ffa058f2.exe
Set value (str)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Command Processor\AutoRun = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates\\S8O4ei6kEJzlE2CEV4k81oNW04NEn.exe\" O 2>NUL"	ed80f23ce087e4141e31f7cc278932effeda192da2afa076ee03de28ffa058f2.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft	ed80f23ce087e4141e31f7cc278932effeda192da2afa076ee03de28ffa058f2.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion	ed80f23ce087e4141e31f7cc278932effeda192da2afa076ee03de28ffa058f2.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ = "\"C:\\Users\\Default\\Saved Games\\mmdUHbnEcOocQth1aGsM4XLN9v.exe\" O"	ed80f23ce087e4141e31f7cc278932effeda192da2afa076ee03de28ffa058f2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	gpscript.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Command Processor	ed80f23ce087e4141e31f7cc278932effeda192da2afa076ee03de28ffa058f2.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies	ed80f23ce087e4141e31f7cc278932effeda192da2afa076ee03de28ffa058f2.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Credentials\\JWnZAzcvvuBoQjWbFI0KXc.exe\" O"	ed80f23ce087e4141e31f7cc278932effeda192da2afa076ee03de28ffa058f2.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	ed80f23ce087e4141e31f7cc278932effeda192da2afa076ee03de28ffa058f2.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{6C467336-8281-4E60-8204-430CED96822D} {000214E4-0000-0000-C000-000000000046} 0xFFFF = 010000000000000010e2b685eb00d901	gpscript.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Command Processor	ed80f23ce087e4141e31f7cc278932effeda192da2afa076ee03de28ffa058f2.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Command Processor\AutoRun = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\MkFwPoRqgMeuHAJk2jrqomef.exe\" O 2>NUL"	ed80f23ce087e4141e31f7cc278932effeda192da2afa076ee03de28ffa058f2.exe
Key created	\REGISTRY\USER\.DEFAULT	ed80f23ce087e4141e31f7cc278932effeda192da2afa076ee03de28ffa058f2.exe
Key created	\REGISTRY\USER\S-1-5-19	ed80f23ce087e4141e31f7cc278932effeda192da2afa076ee03de28ffa058f2.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	ed80f23ce087e4141e31f7cc278932effeda192da2afa076ee03de28ffa058f2.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Command Processor\AutoRun = "\"C:\\Users\\Admin\\AppData\\LocalLow\\Sun\\Java\\Deployment\\cache\\6.0\\59\\ZteLqPv7WZdANRVWE9Z.exe\" O 2>NUL"	ed80f23ce087e4141e31f7cc278932effeda192da2afa076ee03de28ffa058f2.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Command Processor	ed80f23ce087e4141e31f7cc278932effeda192da2afa076ee03de28ffa058f2.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	ed80f23ce087e4141e31f7cc278932effeda192da2afa076ee03de28ffa058f2.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	ed80f23ce087e4141e31f7cc278932effeda192da2afa076ee03de28ffa058f2.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	ed80f23ce087e4141e31f7cc278932effeda192da2afa076ee03de28ffa058f2.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	ed80f23ce087e4141e31f7cc278932effeda192da2afa076ee03de28ffa058f2.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies	ed80f23ce087e4141e31f7cc278932effeda192da2afa076ee03de28ffa058f2.exe
Set value (str)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Feeds\\8P1ShPh5HbeR0DAZDOLsYf.exe\" O"	ed80f23ce087e4141e31f7cc278932effeda192da2afa076ee03de28ffa058f2.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Command Processor\AutoRun = "\"C:\\ProgramData\\Package Cache\\{662A0088-6FCD-45DD-9EA7-68674058AED5}v14.30.30704\\packages\\aSUECAEGR9qTZSc.exe\" O 2>NUL"	ed80f23ce087e4141e31f7cc278932effeda192da2afa076ee03de28ffa058f2.exe
Key created	\REGISTRY\USER\S-1-5-20	ed80f23ce087e4141e31f7cc278932effeda192da2afa076ee03de28ffa058f2.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft	ed80f23ce087e4141e31f7cc278932effeda192da2afa076ee03de28ffa058f2.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows	ed80f23ce087e4141e31f7cc278932effeda192da2afa076ee03de28ffa058f2.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion	ed80f23ce087e4141e31f7cc278932effeda192da2afa076ee03de28ffa058f2.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	ed80f23ce087e4141e31f7cc278932effeda192da2afa076ee03de28ffa058f2.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE	ed80f23ce087e4141e31f7cc278932effeda192da2afa076ee03de28ffa058f2.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates\\khv8hTbL2T3P6n1gyNRgXOYtHrqiExqXUezQyUoEgwhaq6.exe\" O"	ed80f23ce087e4141e31f7cc278932effeda192da2afa076ee03de28ffa058f2.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows	ed80f23ce087e4141e31f7cc278932effeda192da2afa076ee03de28ffa058f2.exe

Modifies registry class 12 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\SOFTWARE\Microsoft	ed80f23ce087e4141e31f7cc278932effeda192da2afa076ee03de28ffa058f2.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\SOFTWARE\Microsoft\Windows\CurrentVersion	ed80f23ce087e4141e31f7cc278932effeda192da2afa076ee03de28ffa058f2.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies	ed80f23ce087e4141e31f7cc278932effeda192da2afa076ee03de28ffa058f2.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	ed80f23ce087e4141e31f7cc278932effeda192da2afa076ee03de28ffa058f2.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\SOFTWARE\Microsoft\Windows	ed80f23ce087e4141e31f7cc278932effeda192da2afa076ee03de28ffa058f2.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	ed80f23ce087e4141e31f7cc278932effeda192da2afa076ee03de28ffa058f2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Internet Explorer\\Tiles\\pin9728060290\\wlbpPOPln402fiTYiOs5.exe\" O"	ed80f23ce087e4141e31f7cc278932effeda192da2afa076ee03de28ffa058f2.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_Classes\SOFTWARE\Microsoft\Command Processor	ed80f23ce087e4141e31f7cc278932effeda192da2afa076ee03de28ffa058f2.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\SOFTWARE	ed80f23ce087e4141e31f7cc278932effeda192da2afa076ee03de28ffa058f2.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\SOFTWARE\Microsoft\Command Processor	ed80f23ce087e4141e31f7cc278932effeda192da2afa076ee03de28ffa058f2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\SOFTWARE\Microsoft\Command Processor\AutoRun = "\"C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\yrPSjlEvkyyJ0LRdGFiB8bUUOnWaGvBV4WzwvEMBR6CfNXl9Es5DD91tt0Lpnq9HPQm.exe\" O 2>NUL"	ed80f23ce087e4141e31f7cc278932effeda192da2afa076ee03de28ffa058f2.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_Classes\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	ed80f23ce087e4141e31f7cc278932effeda192da2afa076ee03de28ffa058f2.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeBackupPrivilege	1388	ed80f23ce087e4141e31f7cc278932effeda192da2afa076ee03de28ffa058f2.exe
Token: SeRestorePrivilege	1388	ed80f23ce087e4141e31f7cc278932effeda192da2afa076ee03de28ffa058f2.exe
Token: SeShutdownPrivilege	1388	ed80f23ce087e4141e31f7cc278932effeda192da2afa076ee03de28ffa058f2.exe
Token: 33	1736	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1736	AUDIODG.EXE
Token: 33	1736	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1736	AUDIODG.EXE
Token: SeDebugPrivilege	1744	bdp0iEqE.exe
Token: SeRestorePrivilege	1744	bdp0iEqE.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 316 wrote to memory of 1744	316	gpscript.exe	31
PID 316 wrote to memory of 1744	316	gpscript.exe	31
PID 316 wrote to memory of 1744	316	gpscript.exe	31

C:\Users\Admin\AppData\Local\Temp\ed80f23ce087e4141e31f7cc278932effeda192da2afa076ee03de28ffa058f2.exe
"C:\Users\Admin\AppData\Local\Temp\ed80f23ce087e4141e31f7cc278932effeda192da2afa076ee03de28ffa058f2.exe"
1⤵
- Adds policy Run key to start application
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:1388

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0
1⤵
PID:1520

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x504
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1736

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x1
1⤵
PID:1112

C:\Windows\system32\gpscript.exe
gpscript.exe /Shutdown
1⤵
- Loads dropped DLL
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:316
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\DNTException\Low\bdp0iEqE.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\DNTException\Low\bdp0iEqE.exe" 1
  2⤵
  - Executes dropped EXE
  - Sets file execution options in registry
  - Suspicious use of AdjustPrivilegeToken
  PID:1744

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\DNTException\Low\bdp0iEqE.exe

Filesize
819KB

MD5
3f059ad7f45b8e21153feaa5b1344562

SHA1
64d5a89f21779b1016f16a2e8f114cfbeeee565a

SHA256
08444d93daf531f559a371d2d3604d558752f05f12e772127fbdb83056118079

SHA512
30ebd0297e05c1fa00b90ef3aae5290bb49fbaa837e8906e123ab45f912c4c6021d59236596710ac33586697f62cfb3d55da449af448eb42e3f5f7f877fb9cc1

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\DNTException\Low\bdp0iEqE.exe

Filesize
819KB

MD5
3f059ad7f45b8e21153feaa5b1344562

SHA1
64d5a89f21779b1016f16a2e8f114cfbeeee565a

SHA256
08444d93daf531f559a371d2d3604d558752f05f12e772127fbdb83056118079

SHA512
30ebd0297e05c1fa00b90ef3aae5290bb49fbaa837e8906e123ab45f912c4c6021d59236596710ac33586697f62cfb3d55da449af448eb42e3f5f7f877fb9cc1

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Windows\DNTException\Low\bdp0iEqE.exe

Filesize
819KB

MD5
3f059ad7f45b8e21153feaa5b1344562

SHA1
64d5a89f21779b1016f16a2e8f114cfbeeee565a

SHA256
08444d93daf531f559a371d2d3604d558752f05f12e772127fbdb83056118079

SHA512
30ebd0297e05c1fa00b90ef3aae5290bb49fbaa837e8906e123ab45f912c4c6021d59236596710ac33586697f62cfb3d55da449af448eb42e3f5f7f877fb9cc1

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Windows\DNTException\Low\bdp0iEqE.exe

Filesize
819KB

MD5
3f059ad7f45b8e21153feaa5b1344562

SHA1
64d5a89f21779b1016f16a2e8f114cfbeeee565a

SHA256
08444d93daf531f559a371d2d3604d558752f05f12e772127fbdb83056118079

SHA512
30ebd0297e05c1fa00b90ef3aae5290bb49fbaa837e8906e123ab45f912c4c6021d59236596710ac33586697f62cfb3d55da449af448eb42e3f5f7f877fb9cc1

Download Submit
memory/1388-54-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/1388-56-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/1520-55-0x000007FEFBF81000-0x000007FEFBF83000-memory.dmp

Filesize
8KB

Download
memory/1744-64-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads