Analysis
-
max time kernel
154s -
max time network
162s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
25-11-2022 21:17
Static task
static1
Behavioral task
behavioral1
Sample
172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe
Resource
win7-20220812-en
General
-
Target
172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe
-
Size
564KB
-
MD5
a1d3624a30411262cfe25674dbd05051
-
SHA1
3d2c681609f5213a680955573e26f4e3a52025a9
-
SHA256
172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f
-
SHA512
59bc2190ff355409ac2d9d3fd197c6c6cddb89f25990b4cb2614a3cb6b8ca5a6cde931807290366cd203fdadb48e5a0977606f06231233d6a7be62d88af033d5
-
SSDEEP
6144:6pX2i9HjHIDeRzKPCqIlKqX6ehf1gOGqHCibZwSDqMPoyoMGGGGGGGGGGbGGGGG4:Q20zyeRWtI9qGu6HCWZwMqoKHjl
Malware Config
Extracted
pony
http://www.powerturk.rocks/web/gate.php
http://www.powerturk.rocks/webd/gate.php
Signatures
-
Executes dropped EXE 5 IoCs
Processes:
csrss.execsrss.execsrss.execsrss.execsrss.exepid process 4248 csrss.exe 5016 csrss.exe 3348 csrss.exe 2184 csrss.exe 4512 csrss.exe -
Checks computer location settings 2 TTPs 9 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.execsrss.exe172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.execsrss.exe172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.execsrss.exe172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.execsrss.exe172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation csrss.exe Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation csrss.exe Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation csrss.exe Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation csrss.exe Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook accounts 1 TTPs 5 IoCs
Processes:
172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe Key opened \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe Key opened \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe Key opened \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe Key opened \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe -
Accesses Microsoft Outlook profiles 1 TTPs 5 IoCs
Processes:
172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe Key opened \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe Key opened \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe Key opened \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe Key opened \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 5 IoCs
Processes:
172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exedescription pid process target process PID 4968 set thread context of 4576 4968 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe PID 2528 set thread context of 4532 2528 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe PID 4516 set thread context of 1216 4516 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe PID 3004 set thread context of 2416 3004 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe PID 1252 set thread context of 3540 1252 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 10 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
AcroRd32.exeAcroRd32.exeAcroRd32.exeAcroRd32.exeAcroRd32.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 AcroRd32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 AcroRd32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 AcroRd32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz AcroRd32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz AcroRd32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 AcroRd32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz AcroRd32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz AcroRd32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz AcroRd32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 AcroRd32.exe -
Processes:
AcroRd32.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION AcroRd32.exe -
Modifies registry class 5 IoCs
Processes:
172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
csrss.exepid process 4248 csrss.exe 4248 csrss.exe 4248 csrss.exe 4248 csrss.exe 4248 csrss.exe 4248 csrss.exe 4248 csrss.exe 4248 csrss.exe 4248 csrss.exe 4248 csrss.exe 4248 csrss.exe 4248 csrss.exe 4248 csrss.exe 4248 csrss.exe 4248 csrss.exe 4248 csrss.exe 4248 csrss.exe 4248 csrss.exe 4248 csrss.exe 4248 csrss.exe 4248 csrss.exe 4248 csrss.exe 4248 csrss.exe 4248 csrss.exe 4248 csrss.exe 4248 csrss.exe 4248 csrss.exe 4248 csrss.exe 4248 csrss.exe 4248 csrss.exe 4248 csrss.exe 4248 csrss.exe 4248 csrss.exe 4248 csrss.exe 4248 csrss.exe 4248 csrss.exe 4248 csrss.exe 4248 csrss.exe 4248 csrss.exe 4248 csrss.exe 4248 csrss.exe 4248 csrss.exe 4248 csrss.exe 4248 csrss.exe 4248 csrss.exe 4248 csrss.exe 4248 csrss.exe 4248 csrss.exe 4248 csrss.exe 4248 csrss.exe 4248 csrss.exe 4248 csrss.exe 4248 csrss.exe 4248 csrss.exe 4248 csrss.exe 4248 csrss.exe 4248 csrss.exe 4248 csrss.exe 4248 csrss.exe 4248 csrss.exe 4248 csrss.exe 4248 csrss.exe 4248 csrss.exe 4248 csrss.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.execsrss.exe172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.execsrss.exedescription pid process Token: SeImpersonatePrivilege 4576 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe Token: SeTcbPrivilege 4576 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe Token: SeChangeNotifyPrivilege 4576 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe Token: SeCreateTokenPrivilege 4576 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe Token: SeBackupPrivilege 4576 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe Token: SeRestorePrivilege 4576 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe Token: SeIncreaseQuotaPrivilege 4576 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe Token: SeAssignPrimaryTokenPrivilege 4576 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe Token: SeDebugPrivilege 4248 csrss.exe Token: SeImpersonatePrivilege 4576 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe Token: SeTcbPrivilege 4576 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe Token: SeChangeNotifyPrivilege 4576 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe Token: SeCreateTokenPrivilege 4576 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe Token: SeBackupPrivilege 4576 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe Token: SeRestorePrivilege 4576 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe Token: SeIncreaseQuotaPrivilege 4576 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe Token: SeAssignPrimaryTokenPrivilege 4576 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe Token: SeImpersonatePrivilege 4576 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe Token: SeTcbPrivilege 4576 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe Token: SeChangeNotifyPrivilege 4576 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe Token: SeCreateTokenPrivilege 4576 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe Token: SeBackupPrivilege 4576 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe Token: SeRestorePrivilege 4576 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe Token: SeIncreaseQuotaPrivilege 4576 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe Token: SeAssignPrimaryTokenPrivilege 4576 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe Token: SeImpersonatePrivilege 4576 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe Token: SeTcbPrivilege 4576 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe Token: SeChangeNotifyPrivilege 4576 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe Token: SeCreateTokenPrivilege 4576 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe Token: SeBackupPrivilege 4576 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe Token: SeRestorePrivilege 4576 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe Token: SeIncreaseQuotaPrivilege 4576 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe Token: SeAssignPrimaryTokenPrivilege 4576 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe Token: SeImpersonatePrivilege 4576 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe Token: SeTcbPrivilege 4576 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe Token: SeChangeNotifyPrivilege 4576 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe Token: SeCreateTokenPrivilege 4576 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe Token: SeBackupPrivilege 4576 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe Token: SeRestorePrivilege 4576 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe Token: SeIncreaseQuotaPrivilege 4576 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe Token: SeAssignPrimaryTokenPrivilege 4576 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe Token: SeImpersonatePrivilege 4576 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe Token: SeTcbPrivilege 4576 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe Token: SeChangeNotifyPrivilege 4576 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe Token: SeCreateTokenPrivilege 4576 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe Token: SeBackupPrivilege 4576 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe Token: SeRestorePrivilege 4576 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe Token: SeIncreaseQuotaPrivilege 4576 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe Token: SeAssignPrimaryTokenPrivilege 4576 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe Token: SeImpersonatePrivilege 4532 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe Token: SeTcbPrivilege 4532 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe Token: SeChangeNotifyPrivilege 4532 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe Token: SeCreateTokenPrivilege 4532 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe Token: SeBackupPrivilege 4532 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe Token: SeRestorePrivilege 4532 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe Token: SeIncreaseQuotaPrivilege 4532 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe Token: SeAssignPrimaryTokenPrivilege 4532 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe Token: SeDebugPrivilege 5016 csrss.exe Token: SeImpersonatePrivilege 4532 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe Token: SeTcbPrivilege 4532 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe Token: SeChangeNotifyPrivilege 4532 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe Token: SeCreateTokenPrivilege 4532 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe Token: SeBackupPrivilege 4532 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe Token: SeRestorePrivilege 4532 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe -
Suspicious use of SetWindowsHookEx 11 IoCs
Processes:
AcroRd32.exeAcroRd32.exeAcroRd32.exeAcroRd32.exeAcroRd32.exepid process 2356 AcroRd32.exe 2356 AcroRd32.exe 2356 AcroRd32.exe 2356 AcroRd32.exe 2356 AcroRd32.exe 4888 AcroRd32.exe 2356 AcroRd32.exe 2260 AcroRd32.exe 2356 AcroRd32.exe 2384 AcroRd32.exe 4180 AcroRd32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exeAcroRd32.exeRdrCEF.exedescription pid process target process PID 4968 wrote to memory of 2356 4968 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe AcroRd32.exe PID 4968 wrote to memory of 2356 4968 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe AcroRd32.exe PID 4968 wrote to memory of 2356 4968 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe AcroRd32.exe PID 4968 wrote to memory of 4576 4968 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe PID 4968 wrote to memory of 4576 4968 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe PID 4968 wrote to memory of 4576 4968 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe PID 4968 wrote to memory of 4576 4968 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe PID 4968 wrote to memory of 4576 4968 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe PID 4968 wrote to memory of 4576 4968 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe PID 4968 wrote to memory of 4576 4968 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe PID 4968 wrote to memory of 4576 4968 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe PID 4968 wrote to memory of 4248 4968 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe csrss.exe PID 4968 wrote to memory of 4248 4968 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe csrss.exe PID 4968 wrote to memory of 4248 4968 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe csrss.exe PID 2356 wrote to memory of 3120 2356 AcroRd32.exe RdrCEF.exe PID 2356 wrote to memory of 3120 2356 AcroRd32.exe RdrCEF.exe PID 2356 wrote to memory of 3120 2356 AcroRd32.exe RdrCEF.exe PID 2356 wrote to memory of 2828 2356 AcroRd32.exe RdrCEF.exe PID 2356 wrote to memory of 2828 2356 AcroRd32.exe RdrCEF.exe PID 2356 wrote to memory of 2828 2356 AcroRd32.exe RdrCEF.exe PID 3120 wrote to memory of 4108 3120 RdrCEF.exe RdrCEF.exe PID 3120 wrote to memory of 4108 3120 RdrCEF.exe RdrCEF.exe PID 3120 wrote to memory of 4108 3120 RdrCEF.exe RdrCEF.exe PID 3120 wrote to memory of 4108 3120 RdrCEF.exe RdrCEF.exe PID 3120 wrote to memory of 4108 3120 RdrCEF.exe RdrCEF.exe PID 3120 wrote to memory of 4108 3120 RdrCEF.exe RdrCEF.exe PID 3120 wrote to memory of 4108 3120 RdrCEF.exe RdrCEF.exe PID 3120 wrote to memory of 4108 3120 RdrCEF.exe RdrCEF.exe PID 3120 wrote to memory of 4108 3120 RdrCEF.exe RdrCEF.exe PID 3120 wrote to memory of 4108 3120 RdrCEF.exe RdrCEF.exe PID 3120 wrote to memory of 4108 3120 RdrCEF.exe RdrCEF.exe PID 3120 wrote to memory of 4108 3120 RdrCEF.exe RdrCEF.exe PID 3120 wrote to memory of 4108 3120 RdrCEF.exe RdrCEF.exe PID 3120 wrote to memory of 4108 3120 RdrCEF.exe RdrCEF.exe PID 3120 wrote to memory of 4108 3120 RdrCEF.exe RdrCEF.exe PID 3120 wrote to memory of 4108 3120 RdrCEF.exe RdrCEF.exe PID 3120 wrote to memory of 4108 3120 RdrCEF.exe RdrCEF.exe PID 3120 wrote to memory of 4108 3120 RdrCEF.exe RdrCEF.exe PID 3120 wrote to memory of 4108 3120 RdrCEF.exe RdrCEF.exe PID 3120 wrote to memory of 4108 3120 RdrCEF.exe RdrCEF.exe PID 3120 wrote to memory of 4108 3120 RdrCEF.exe RdrCEF.exe PID 3120 wrote to memory of 4108 3120 RdrCEF.exe RdrCEF.exe PID 3120 wrote to memory of 4108 3120 RdrCEF.exe RdrCEF.exe PID 3120 wrote to memory of 4108 3120 RdrCEF.exe RdrCEF.exe PID 3120 wrote to memory of 4108 3120 RdrCEF.exe RdrCEF.exe PID 3120 wrote to memory of 4108 3120 RdrCEF.exe RdrCEF.exe PID 3120 wrote to memory of 4108 3120 RdrCEF.exe RdrCEF.exe PID 3120 wrote to memory of 4108 3120 RdrCEF.exe RdrCEF.exe PID 3120 wrote to memory of 4108 3120 RdrCEF.exe RdrCEF.exe PID 3120 wrote to memory of 4108 3120 RdrCEF.exe RdrCEF.exe PID 3120 wrote to memory of 4108 3120 RdrCEF.exe RdrCEF.exe PID 3120 wrote to memory of 4108 3120 RdrCEF.exe RdrCEF.exe PID 3120 wrote to memory of 4108 3120 RdrCEF.exe RdrCEF.exe PID 3120 wrote to memory of 4108 3120 RdrCEF.exe RdrCEF.exe PID 3120 wrote to memory of 4108 3120 RdrCEF.exe RdrCEF.exe PID 3120 wrote to memory of 4108 3120 RdrCEF.exe RdrCEF.exe PID 3120 wrote to memory of 4108 3120 RdrCEF.exe RdrCEF.exe PID 3120 wrote to memory of 4108 3120 RdrCEF.exe RdrCEF.exe PID 3120 wrote to memory of 4108 3120 RdrCEF.exe RdrCEF.exe PID 3120 wrote to memory of 4108 3120 RdrCEF.exe RdrCEF.exe PID 3120 wrote to memory of 4108 3120 RdrCEF.exe RdrCEF.exe PID 3120 wrote to memory of 3060 3120 RdrCEF.exe RdrCEF.exe PID 3120 wrote to memory of 3060 3120 RdrCEF.exe RdrCEF.exe PID 3120 wrote to memory of 3060 3120 RdrCEF.exe RdrCEF.exe -
outlook_win_path 1 IoCs
Processes:
172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe"C:\Users\Admin\AppData\Local\Temp\172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Roaming\SLED_PO_Template.pdf"2⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140433⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=DE371F4492BC74CC931EA4001AF66DA6 --mojo-platform-channel-handle=1720 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:24⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=01045DCA0AD048426649F3B818E0C4AE --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=01045DCA0AD048426649F3B818E0C4AE --renderer-client-id=2 --mojo-platform-channel-handle=1732 --allow-no-sandbox-job /prefetch:14⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=A98A189F61168B30292B93A053BEA205 --mojo-platform-channel-handle=2276 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:24⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=FA32F1C65CA31F830AF67954C4925683 --mojo-platform-channel-handle=2404 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:24⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=73C01DACB1177943917EF9A2AACC95A1 --mojo-platform-channel-handle=2292 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:24⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140433⤵
-
C:\Users\Admin\AppData\Local\Temp\172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe"C:\Users\Admin\AppData\Local\Temp\172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe"2⤵
- Accesses Microsoft Outlook accounts
- Accesses Microsoft Outlook profiles
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\csrss.exe"C:\Users\Admin\AppData\Local\Temp\csrss.exe" -prochide 4576 -proc 4576 C:\Users\Admin\AppData\Local\Temp\172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe2⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe"C:\Users\Admin\AppData\Local\Temp\172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe"3⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Modifies registry class
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Roaming\SLED_PO_Template.pdf"4⤵
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe"C:\Users\Admin\AppData\Local\Temp\172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe"4⤵
- Accesses Microsoft Outlook accounts
- Accesses Microsoft Outlook profiles
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\csrss.exe"C:\Users\Admin\AppData\Local\Temp\csrss.exe" -prochide 4532 -proc 4532 C:\Users\Admin\AppData\Local\Temp\172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe4⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe"C:\Users\Admin\AppData\Local\Temp\172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe"5⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Modifies registry class
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Roaming\SLED_PO_Template.pdf"6⤵
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe"C:\Users\Admin\AppData\Local\Temp\172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe"6⤵
- Accesses Microsoft Outlook accounts
- Accesses Microsoft Outlook profiles
-
C:\Users\Admin\AppData\Local\Temp\csrss.exe"C:\Users\Admin\AppData\Local\Temp\csrss.exe" -prochide 1216 -proc 1216 C:\Users\Admin\AppData\Local\Temp\172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe6⤵
- Executes dropped EXE
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe"C:\Users\Admin\AppData\Local\Temp\172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe"7⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Modifies registry class
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Roaming\SLED_PO_Template.pdf"8⤵
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe"C:\Users\Admin\AppData\Local\Temp\172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe"8⤵
- Accesses Microsoft Outlook accounts
- Accesses Microsoft Outlook profiles
-
C:\Users\Admin\AppData\Local\Temp\csrss.exe"C:\Users\Admin\AppData\Local\Temp\csrss.exe" -prochide 2416 -proc 2416 C:\Users\Admin\AppData\Local\Temp\172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe8⤵
- Executes dropped EXE
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe"C:\Users\Admin\AppData\Local\Temp\172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe"9⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Modifies registry class
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Roaming\SLED_PO_Template.pdf"10⤵
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe"C:\Users\Admin\AppData\Local\Temp\172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe"10⤵
-
C:\Users\Admin\AppData\Local\Temp\172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe"C:\Users\Admin\AppData\Local\Temp\172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe"10⤵
- Accesses Microsoft Outlook accounts
- Accesses Microsoft Outlook profiles
- outlook_win_path
-
C:\Users\Admin\AppData\Local\Temp\csrss.exe"C:\Users\Admin\AppData\Local\Temp\csrss.exe" -prochide 3540 -proc 3540 C:\Users\Admin\AppData\Local\Temp\172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe10⤵
- Executes dropped EXE
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe.logFilesize
408B
MD525564ec5d067d1ad0e3b62272e3b90e5
SHA1034e3196df747dc3d48ed01af14bb6232588bcc3
SHA256f06b300a0246c62f9f5136eb6c4fb2cb07ffd21c62a70901428af71c79acd9f5
SHA51269b637a2e9142bad566d5bdf7b0a55ff2905be0355be38368e82fd13b99d116856b4fad4c122fdecc6d6d3ebf89bab86f7fc7111028b925bcd30cbc89d02bd19
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\csrss.exe.logFilesize
408B
MD525564ec5d067d1ad0e3b62272e3b90e5
SHA1034e3196df747dc3d48ed01af14bb6232588bcc3
SHA256f06b300a0246c62f9f5136eb6c4fb2cb07ffd21c62a70901428af71c79acd9f5
SHA51269b637a2e9142bad566d5bdf7b0a55ff2905be0355be38368e82fd13b99d116856b4fad4c122fdecc6d6d3ebf89bab86f7fc7111028b925bcd30cbc89d02bd19
-
C:\Users\Admin\AppData\Local\Temp\csrss.exeFilesize
564KB
MD5a1d3624a30411262cfe25674dbd05051
SHA13d2c681609f5213a680955573e26f4e3a52025a9
SHA256172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f
SHA51259bc2190ff355409ac2d9d3fd197c6c6cddb89f25990b4cb2614a3cb6b8ca5a6cde931807290366cd203fdadb48e5a0977606f06231233d6a7be62d88af033d5
-
C:\Users\Admin\AppData\Local\Temp\csrss.exeFilesize
564KB
MD5a1d3624a30411262cfe25674dbd05051
SHA13d2c681609f5213a680955573e26f4e3a52025a9
SHA256172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f
SHA51259bc2190ff355409ac2d9d3fd197c6c6cddb89f25990b4cb2614a3cb6b8ca5a6cde931807290366cd203fdadb48e5a0977606f06231233d6a7be62d88af033d5
-
C:\Users\Admin\AppData\Local\Temp\csrss.exeFilesize
564KB
MD5a1d3624a30411262cfe25674dbd05051
SHA13d2c681609f5213a680955573e26f4e3a52025a9
SHA256172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f
SHA51259bc2190ff355409ac2d9d3fd197c6c6cddb89f25990b4cb2614a3cb6b8ca5a6cde931807290366cd203fdadb48e5a0977606f06231233d6a7be62d88af033d5
-
C:\Users\Admin\AppData\Local\Temp\csrss.exeFilesize
564KB
MD5a1d3624a30411262cfe25674dbd05051
SHA13d2c681609f5213a680955573e26f4e3a52025a9
SHA256172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f
SHA51259bc2190ff355409ac2d9d3fd197c6c6cddb89f25990b4cb2614a3cb6b8ca5a6cde931807290366cd203fdadb48e5a0977606f06231233d6a7be62d88af033d5
-
C:\Users\Admin\AppData\Local\Temp\csrss.exeFilesize
564KB
MD5a1d3624a30411262cfe25674dbd05051
SHA13d2c681609f5213a680955573e26f4e3a52025a9
SHA256172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f
SHA51259bc2190ff355409ac2d9d3fd197c6c6cddb89f25990b4cb2614a3cb6b8ca5a6cde931807290366cd203fdadb48e5a0977606f06231233d6a7be62d88af033d5
-
C:\Users\Admin\AppData\Local\Temp\csrss.exeFilesize
564KB
MD5a1d3624a30411262cfe25674dbd05051
SHA13d2c681609f5213a680955573e26f4e3a52025a9
SHA256172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f
SHA51259bc2190ff355409ac2d9d3fd197c6c6cddb89f25990b4cb2614a3cb6b8ca5a6cde931807290366cd203fdadb48e5a0977606f06231233d6a7be62d88af033d5
-
C:\Users\Admin\AppData\Local\Temp\csrss.exeFilesize
564KB
MD5a1d3624a30411262cfe25674dbd05051
SHA13d2c681609f5213a680955573e26f4e3a52025a9
SHA256172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f
SHA51259bc2190ff355409ac2d9d3fd197c6c6cddb89f25990b4cb2614a3cb6b8ca5a6cde931807290366cd203fdadb48e5a0977606f06231233d6a7be62d88af033d5
-
C:\Users\Admin\AppData\Local\Temp\csrss.exeFilesize
564KB
MD5a1d3624a30411262cfe25674dbd05051
SHA13d2c681609f5213a680955573e26f4e3a52025a9
SHA256172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f
SHA51259bc2190ff355409ac2d9d3fd197c6c6cddb89f25990b4cb2614a3cb6b8ca5a6cde931807290366cd203fdadb48e5a0977606f06231233d6a7be62d88af033d5
-
C:\Users\Admin\AppData\Local\Temp\csrss.exeFilesize
564KB
MD5a1d3624a30411262cfe25674dbd05051
SHA13d2c681609f5213a680955573e26f4e3a52025a9
SHA256172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f
SHA51259bc2190ff355409ac2d9d3fd197c6c6cddb89f25990b4cb2614a3cb6b8ca5a6cde931807290366cd203fdadb48e5a0977606f06231233d6a7be62d88af033d5
-
C:\Users\Admin\AppData\Local\Temp\csrss.exeFilesize
564KB
MD5a1d3624a30411262cfe25674dbd05051
SHA13d2c681609f5213a680955573e26f4e3a52025a9
SHA256172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f
SHA51259bc2190ff355409ac2d9d3fd197c6c6cddb89f25990b4cb2614a3cb6b8ca5a6cde931807290366cd203fdadb48e5a0977606f06231233d6a7be62d88af033d5
-
C:\Users\Admin\AppData\Roaming\SLED_PO_Template.pdfFilesize
113KB
MD540caa279a85473a57eb422c6dcee609f
SHA177a9ba6dcb39cfdd47230d87a3c566f024b645b4
SHA256e2d8e5e3093bf2eac1618ae744a5277ddc2eeef478632adc9157d50e8e74ab18
SHA5125ec4c71cfb5fc5104ef50c68a6f2041e67ca9d44ac1860551a3b5468f85e57be4c5395108aaf44b5c0e58b39ad826b32b27fc9267ded5638f62eaca374d4dc40
-
C:\Users\Admin\AppData\Roaming\SLED_PO_Template.pdfFilesize
113KB
MD540caa279a85473a57eb422c6dcee609f
SHA177a9ba6dcb39cfdd47230d87a3c566f024b645b4
SHA256e2d8e5e3093bf2eac1618ae744a5277ddc2eeef478632adc9157d50e8e74ab18
SHA5125ec4c71cfb5fc5104ef50c68a6f2041e67ca9d44ac1860551a3b5468f85e57be4c5395108aaf44b5c0e58b39ad826b32b27fc9267ded5638f62eaca374d4dc40
-
C:\Users\Admin\AppData\Roaming\SLED_PO_Template.pdfFilesize
113KB
MD540caa279a85473a57eb422c6dcee609f
SHA177a9ba6dcb39cfdd47230d87a3c566f024b645b4
SHA256e2d8e5e3093bf2eac1618ae744a5277ddc2eeef478632adc9157d50e8e74ab18
SHA5125ec4c71cfb5fc5104ef50c68a6f2041e67ca9d44ac1860551a3b5468f85e57be4c5395108aaf44b5c0e58b39ad826b32b27fc9267ded5638f62eaca374d4dc40
-
C:\Users\Admin\AppData\Roaming\SLED_PO_Template.pdfFilesize
113KB
MD540caa279a85473a57eb422c6dcee609f
SHA177a9ba6dcb39cfdd47230d87a3c566f024b645b4
SHA256e2d8e5e3093bf2eac1618ae744a5277ddc2eeef478632adc9157d50e8e74ab18
SHA5125ec4c71cfb5fc5104ef50c68a6f2041e67ca9d44ac1860551a3b5468f85e57be4c5395108aaf44b5c0e58b39ad826b32b27fc9267ded5638f62eaca374d4dc40
-
C:\Users\Admin\AppData\Roaming\SLED_PO_Template.pdfFilesize
113KB
MD540caa279a85473a57eb422c6dcee609f
SHA177a9ba6dcb39cfdd47230d87a3c566f024b645b4
SHA256e2d8e5e3093bf2eac1618ae744a5277ddc2eeef478632adc9157d50e8e74ab18
SHA5125ec4c71cfb5fc5104ef50c68a6f2041e67ca9d44ac1860551a3b5468f85e57be4c5395108aaf44b5c0e58b39ad826b32b27fc9267ded5638f62eaca374d4dc40
-
memory/1216-196-0x0000000000000000-mapping.dmp
-
memory/1216-205-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/1216-211-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/1216-213-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/1252-234-0x0000000000000000-mapping.dmp
-
memory/1252-245-0x0000000075140000-0x00000000756F1000-memory.dmpFilesize
5.7MB
-
memory/1252-250-0x0000000075140000-0x00000000756F1000-memory.dmpFilesize
5.7MB
-
memory/2184-230-0x0000000075140000-0x00000000756F1000-memory.dmpFilesize
5.7MB
-
memory/2184-226-0x0000000000000000-mapping.dmp
-
memory/2184-235-0x0000000075140000-0x00000000756F1000-memory.dmpFilesize
5.7MB
-
memory/2184-232-0x0000000075140000-0x00000000756F1000-memory.dmpFilesize
5.7MB
-
memory/2260-195-0x0000000000000000-mapping.dmp
-
memory/2356-134-0x0000000000000000-mapping.dmp
-
memory/2384-217-0x0000000000000000-mapping.dmp
-
memory/2416-218-0x0000000000000000-mapping.dmp
-
memory/2416-231-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/2416-233-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/2528-171-0x0000000000000000-mapping.dmp
-
memory/2528-187-0x0000000075140000-0x00000000756F1000-memory.dmpFilesize
5.7MB
-
memory/2528-174-0x0000000075140000-0x00000000756F1000-memory.dmpFilesize
5.7MB
-
memory/2828-152-0x0000000000000000-mapping.dmp
-
memory/2980-162-0x0000000000000000-mapping.dmp
-
memory/3004-214-0x0000000000000000-mapping.dmp
-
memory/3004-216-0x0000000075140000-0x00000000756F1000-memory.dmpFilesize
5.7MB
-
memory/3004-229-0x0000000075140000-0x00000000756F1000-memory.dmpFilesize
5.7MB
-
memory/3060-157-0x0000000000000000-mapping.dmp
-
memory/3120-150-0x0000000000000000-mapping.dmp
-
memory/3348-210-0x0000000075140000-0x00000000756F1000-memory.dmpFilesize
5.7MB
-
memory/3348-206-0x0000000000000000-mapping.dmp
-
memory/3348-215-0x0000000075140000-0x00000000756F1000-memory.dmpFilesize
5.7MB
-
memory/3348-212-0x0000000075140000-0x00000000756F1000-memory.dmpFilesize
5.7MB
-
memory/3540-252-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/3540-246-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/3540-237-0x0000000000000000-mapping.dmp
-
memory/4108-154-0x0000000000000000-mapping.dmp
-
memory/4180-236-0x0000000000000000-mapping.dmp
-
memory/4248-173-0x0000000075140000-0x00000000756F1000-memory.dmpFilesize
5.7MB
-
memory/4248-143-0x0000000000000000-mapping.dmp
-
memory/4248-147-0x0000000075140000-0x00000000756F1000-memory.dmpFilesize
5.7MB
-
memory/4248-151-0x0000000075140000-0x00000000756F1000-memory.dmpFilesize
5.7MB
-
memory/4512-251-0x0000000075140000-0x00000000756F1000-memory.dmpFilesize
5.7MB
-
memory/4512-247-0x0000000000000000-mapping.dmp
-
memory/4512-253-0x0000000075140000-0x00000000756F1000-memory.dmpFilesize
5.7MB
-
memory/4516-204-0x0000000075140000-0x00000000756F1000-memory.dmpFilesize
5.7MB
-
memory/4516-193-0x0000000000000000-mapping.dmp
-
memory/4516-209-0x0000000075140000-0x00000000756F1000-memory.dmpFilesize
5.7MB
-
memory/4532-182-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/4532-189-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/4532-176-0x0000000000000000-mapping.dmp
-
memory/4532-192-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/4576-135-0x0000000000000000-mapping.dmp
-
memory/4576-149-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/4576-138-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/4576-137-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/4576-142-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/4576-141-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/4576-170-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/4576-136-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/4824-165-0x0000000000000000-mapping.dmp
-
memory/4848-168-0x0000000000000000-mapping.dmp
-
memory/4888-175-0x0000000000000000-mapping.dmp
-
memory/4968-146-0x0000000075140000-0x00000000756F1000-memory.dmpFilesize
5.7MB
-
memory/4968-132-0x0000000075140000-0x00000000756F1000-memory.dmpFilesize
5.7MB
-
memory/4968-133-0x0000000075140000-0x00000000756F1000-memory.dmpFilesize
5.7MB
-
memory/5016-190-0x0000000075140000-0x00000000756F1000-memory.dmpFilesize
5.7MB
-
memory/5016-194-0x0000000075140000-0x00000000756F1000-memory.dmpFilesize
5.7MB
-
memory/5016-188-0x0000000075140000-0x00000000756F1000-memory.dmpFilesize
5.7MB
-
memory/5016-183-0x0000000000000000-mapping.dmp