Analysis
-
max time kernel
152s -
max time network
164s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
28-11-2022 02:20
Behavioral task
behavioral1
Sample
cad92167f1485252bcdb5a3824c66be38886b8ad333102cad575bc3325ad691d.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
cad92167f1485252bcdb5a3824c66be38886b8ad333102cad575bc3325ad691d.exe
Resource
win10v2004-20220901-en
General
-
Target
cad92167f1485252bcdb5a3824c66be38886b8ad333102cad575bc3325ad691d.exe
-
Size
324KB
-
MD5
81ce949bf717b5232928506f681eaafb
-
SHA1
16ddf9e90e365539b909d1374561abcc4425070f
-
SHA256
cad92167f1485252bcdb5a3824c66be38886b8ad333102cad575bc3325ad691d
-
SHA512
e1f72e7502f1f4439a5d700c749dfbf5ccd08aed4d0a3d50bb080afe92a206d37849652e6eee6faca46a6b7c6afad4e6a3cd1e404ceb45bbaf42c3df5bb8b3b8
-
SSDEEP
6144:d/j5C+EV3/4YIJ8m1MxUyRzoVOBlYQflIGE:d/s++P4BJTM6++OBlYERE
Malware Config
Signatures
-
Processes:
resource yara_rule C:\522f0c57.exe aspack_v212_v242 C:\522f0c57.exe aspack_v212_v242 \??\c:\windows\SysWOW64\fastuserswitchingcompatibility.dll aspack_v212_v242 \Windows\SysWOW64\FastUserSwitchingCompatibility.dll aspack_v212_v242 \??\c:\windows\SysWOW64\irmon.dll aspack_v212_v242 \Windows\SysWOW64\Irmon.dll aspack_v212_v242 \??\c:\windows\SysWOW64\nla.dll aspack_v212_v242 \Windows\SysWOW64\Nla.dll aspack_v212_v242 \??\c:\windows\SysWOW64\ntmssvc.dll aspack_v212_v242 \Windows\SysWOW64\Ntmssvc.dll aspack_v212_v242 \Windows\SysWOW64\NWCWorkstation.dll aspack_v212_v242 \??\c:\windows\SysWOW64\nwcworkstation.dll aspack_v212_v242 \??\c:\windows\SysWOW64\nwsapagent.dll aspack_v212_v242 \Windows\SysWOW64\Nwsapagent.dll aspack_v212_v242 \??\c:\windows\SysWOW64\srservice.dll aspack_v212_v242 \Windows\SysWOW64\SRService.dll aspack_v212_v242 \??\c:\windows\SysWOW64\wmdmpmsp.dll aspack_v212_v242 \Windows\SysWOW64\WmdmPmSp.dll aspack_v212_v242 \??\c:\windows\SysWOW64\logonhours.dll aspack_v212_v242 \Windows\SysWOW64\LogonHours.dll aspack_v212_v242 \??\c:\windows\SysWOW64\pcaudit.dll aspack_v212_v242 \Windows\SysWOW64\PCAudit.dll aspack_v212_v242 \??\c:\windows\SysWOW64\helpsvc.dll aspack_v212_v242 \Windows\SysWOW64\helpsvc.dll aspack_v212_v242 \Windows\SysWOW64\uploadmgr.dll aspack_v212_v242 \??\c:\windows\SysWOW64\uploadmgr.dll aspack_v212_v242 -
Executes dropped EXE 1 IoCs
Processes:
522f0c57.exepid process 304 522f0c57.exe -
Sets DLL path for service in the registry 2 TTPs 14 IoCs
Processes:
522f0c57.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Nla\Parameters\ServiceDll = "C:\\Windows\\system32\\Nla.dll" 522f0c57.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\FastUserSwitchingCompatibility\Parameters\ServiceDll = "C:\\Windows\\system32\\FastUserSwitchingCompatibility.dll" 522f0c57.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Ias\Parameters\ServiceDll = "C:\\Windows\\system32\\Ias.dll" 522f0c57.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WmdmPmSp\Parameters\ServiceDll = "C:\\Windows\\system32\\WmdmPmSp.dll" 522f0c57.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\helpsvc\Parameters\ServiceDll = "C:\\Windows\\system32\\helpsvc.dll" 522f0c57.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Ntmssvc\Parameters\ServiceDll = "C:\\Windows\\system32\\Ntmssvc.dll" 522f0c57.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Nwsapagent\Parameters\ServiceDll = "C:\\Windows\\system32\\Nwsapagent.dll" 522f0c57.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Wmi\Parameters\ServiceDll = "C:\\Windows\\system32\\Wmi.dll" 522f0c57.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\uploadmgr\Parameters\ServiceDll = "C:\\Windows\\system32\\uploadmgr.dll" 522f0c57.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Irmon\Parameters\ServiceDll = "C:\\Windows\\system32\\Irmon.dll" 522f0c57.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\NWCWorkstation\Parameters\ServiceDll = "C:\\Windows\\system32\\NWCWorkstation.dll" 522f0c57.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SRService\Parameters\ServiceDll = "C:\\Windows\\system32\\SRService.dll" 522f0c57.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\LogonHours\Parameters\ServiceDll = "C:\\Windows\\system32\\LogonHours.dll" 522f0c57.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\PCAudit\Parameters\ServiceDll = "C:\\Windows\\system32\\PCAudit.dll" 522f0c57.exe -
Processes:
resource yara_rule C:\522f0c57.exe upx C:\522f0c57.exe upx behavioral1/memory/304-59-0x0000000001110000-0x000000000115E000-memory.dmp upx behavioral1/memory/304-58-0x0000000001110000-0x000000000115E000-memory.dmp upx \??\c:\windows\SysWOW64\fastuserswitchingcompatibility.dll upx \Windows\SysWOW64\FastUserSwitchingCompatibility.dll upx behavioral1/memory/1148-63-0x00000000742F0000-0x000000007433E000-memory.dmp upx behavioral1/memory/1148-64-0x00000000742F0000-0x000000007433E000-memory.dmp upx behavioral1/memory/1148-65-0x00000000742F0000-0x000000007433E000-memory.dmp upx behavioral1/memory/1072-66-0x0000000020000000-0x0000000020053000-memory.dmp upx behavioral1/memory/304-69-0x00000000002F0000-0x000000000033E000-memory.dmp upx behavioral1/memory/304-68-0x0000000001110000-0x000000000115E000-memory.dmp upx \??\c:\windows\SysWOW64\irmon.dll upx behavioral1/memory/820-74-0x0000000073DA0000-0x0000000073DEE000-memory.dmp upx \Windows\SysWOW64\Irmon.dll upx behavioral1/memory/820-75-0x0000000073DA0000-0x0000000073DEE000-memory.dmp upx behavioral1/memory/820-76-0x0000000073DA0000-0x0000000073DEE000-memory.dmp upx \??\c:\windows\SysWOW64\nla.dll upx \Windows\SysWOW64\Nla.dll upx behavioral1/memory/1544-82-0x00000000742F0000-0x000000007433E000-memory.dmp upx behavioral1/memory/1544-81-0x00000000742F0000-0x000000007433E000-memory.dmp upx behavioral1/memory/1544-83-0x00000000742F0000-0x000000007433E000-memory.dmp upx \??\c:\windows\SysWOW64\ntmssvc.dll upx \Windows\SysWOW64\Ntmssvc.dll upx behavioral1/memory/1428-87-0x00000000742F0000-0x000000007433E000-memory.dmp upx behavioral1/memory/1428-88-0x00000000742F0000-0x000000007433E000-memory.dmp upx behavioral1/memory/1428-89-0x00000000742F0000-0x000000007433E000-memory.dmp upx behavioral1/memory/1072-90-0x0000000020000000-0x0000000020053000-memory.dmp upx \Windows\SysWOW64\NWCWorkstation.dll upx \??\c:\windows\SysWOW64\nwcworkstation.dll upx behavioral1/memory/956-94-0x0000000071BD0000-0x0000000071C1E000-memory.dmp upx behavioral1/memory/956-95-0x0000000071BD0000-0x0000000071C1E000-memory.dmp upx behavioral1/memory/956-96-0x0000000071BD0000-0x0000000071C1E000-memory.dmp upx \??\c:\windows\SysWOW64\nwsapagent.dll upx \Windows\SysWOW64\Nwsapagent.dll upx behavioral1/memory/1160-101-0x0000000071B20000-0x0000000071B6E000-memory.dmp upx behavioral1/memory/1160-100-0x0000000071B20000-0x0000000071B6E000-memory.dmp upx behavioral1/memory/1160-102-0x0000000071B20000-0x0000000071B6E000-memory.dmp upx \??\c:\windows\SysWOW64\srservice.dll upx \Windows\SysWOW64\SRService.dll upx behavioral1/memory/812-106-0x00000000710F0000-0x000000007113E000-memory.dmp upx behavioral1/memory/812-108-0x00000000710F0000-0x000000007113E000-memory.dmp upx behavioral1/memory/812-109-0x00000000710F0000-0x000000007113E000-memory.dmp upx \??\c:\windows\SysWOW64\wmdmpmsp.dll upx \Windows\SysWOW64\WmdmPmSp.dll upx behavioral1/memory/1968-113-0x00000000710A0000-0x00000000710EE000-memory.dmp upx behavioral1/memory/1968-114-0x00000000710A0000-0x00000000710EE000-memory.dmp upx behavioral1/memory/1968-115-0x00000000710A0000-0x00000000710EE000-memory.dmp upx \??\c:\windows\SysWOW64\logonhours.dll upx \Windows\SysWOW64\LogonHours.dll upx behavioral1/memory/1240-119-0x00000000710A0000-0x00000000710EE000-memory.dmp upx behavioral1/memory/1240-120-0x00000000710A0000-0x00000000710EE000-memory.dmp upx behavioral1/memory/1240-121-0x00000000710A0000-0x00000000710EE000-memory.dmp upx \??\c:\windows\SysWOW64\pcaudit.dll upx \Windows\SysWOW64\PCAudit.dll upx \??\c:\windows\SysWOW64\helpsvc.dll upx \Windows\SysWOW64\helpsvc.dll upx behavioral1/memory/932-130-0x00000000710A0000-0x00000000710EE000-memory.dmp upx behavioral1/memory/932-131-0x00000000710A0000-0x00000000710EE000-memory.dmp upx behavioral1/memory/932-133-0x00000000710A0000-0x00000000710EE000-memory.dmp upx \Windows\SysWOW64\uploadmgr.dll upx \??\c:\windows\SysWOW64\uploadmgr.dll upx behavioral1/memory/820-138-0x00000000710A0000-0x00000000710EE000-memory.dmp upx behavioral1/memory/820-139-0x00000000710A0000-0x00000000710EE000-memory.dmp upx -
Loads dropped DLL 12 IoCs
Processes:
svchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exepid process 1148 svchost.exe 820 svchost.exe 1544 svchost.exe 1428 svchost.exe 956 svchost.exe 1160 svchost.exe 812 svchost.exe 1968 svchost.exe 1240 svchost.exe 1684 svchost.exe 932 svchost.exe 820 svchost.exe -
Drops file in System32 directory 14 IoCs
Processes:
522f0c57.exedescription ioc process File opened for modification C:\Windows\SysWOW64\FastUserSwitchingCompatibility.dll 522f0c57.exe File opened for modification C:\Windows\SysWOW64\Nwsapagent.dll 522f0c57.exe File opened for modification C:\Windows\SysWOW64\WmdmPmSp.dll 522f0c57.exe File opened for modification C:\Windows\SysWOW64\Wmi.dll 522f0c57.exe File opened for modification C:\Windows\SysWOW64\LogonHours.dll 522f0c57.exe File opened for modification C:\Windows\SysWOW64\PCAudit.dll 522f0c57.exe File opened for modification C:\Windows\SysWOW64\uploadmgr.dll 522f0c57.exe File opened for modification C:\Windows\SysWOW64\Ias.dll 522f0c57.exe File opened for modification C:\Windows\SysWOW64\Irmon.dll 522f0c57.exe File opened for modification C:\Windows\SysWOW64\Ntmssvc.dll 522f0c57.exe File opened for modification C:\Windows\SysWOW64\NWCWorkstation.dll 522f0c57.exe File opened for modification C:\Windows\SysWOW64\Nla.dll 522f0c57.exe File opened for modification C:\Windows\SysWOW64\SRService.dll 522f0c57.exe File opened for modification C:\Windows\SysWOW64\helpsvc.dll 522f0c57.exe -
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{45EBF2D1-6FA7-11ED-AE30-7E4CDA66D2DC} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0f7e924b403d901 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000c8d16feb03b8643bf04698af1fc39f9000000000200000000001066000000010000200000008b0fd933f34bb85796d26c7f1e379ac8c673a1744c23f64d7eaba56c09debad0000000000e80000000020000200000006406e41037d7f3dc1ef8749e26aa656bf7df22fde3fe293bb8f640218f3b7d60900000006c45b790ca86e03e1aabac292332239035e09413ad305ee5e0e516fa275fd78840c1ad1c3e8dd4cb883b357cfed68fd54d5b3c70fba38cafccf715cb96e4a01107ed2fc35b206e22956e8272dfa065d48b7c067a64976c4fd65e0835f7fc0b3edfa6b8aa36d33df671c3393ab0e7933c2f75a3d7bc2e79c97e2e4ca186c60c6baaf0b0f3b1ec4acd74d287d62a007acd40000000527dd10f488cc36b8760d00896c21c6cc90669e9eeea8d589ae49f08c634e45d1789e6c0e37dfbf9ad28d9b12a7f488f15f8f7ca6107643cd2e017ea4bb2f9f7 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "376464966" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000c8d16feb03b8643bf04698af1fc39f9000000000200000000001066000000010000200000009e0d174d5c99f3383315a6fd02cc6e53f3cc7ef0c3730d7b6a27b9fa0cc5b6b6000000000e8000000002000020000000b17892cbb9a5d539bf717e6c23c82c6bc863853c6fe92a323bf6d29e619095ff20000000390acd873c6c76aff14396a8fae12bbfc937e386ab68fc59443b66920c73cb9940000000aff3a2a0c6293fb228676b86768b1145dd5748618c3df30043dfef1e3cbf207ef89ebd8f5142c9d52a02797c9677e7a0b6591d4f9fcb92c0572c0f95b999902e iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
522f0c57.exepid process 304 522f0c57.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 1404 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 1404 iexplore.exe 1404 iexplore.exe 856 IEXPLORE.EXE 856 IEXPLORE.EXE 856 IEXPLORE.EXE 856 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
cad92167f1485252bcdb5a3824c66be38886b8ad333102cad575bc3325ad691d.exeiexplore.exedescription pid process target process PID 1072 wrote to memory of 304 1072 cad92167f1485252bcdb5a3824c66be38886b8ad333102cad575bc3325ad691d.exe 522f0c57.exe PID 1072 wrote to memory of 304 1072 cad92167f1485252bcdb5a3824c66be38886b8ad333102cad575bc3325ad691d.exe 522f0c57.exe PID 1072 wrote to memory of 304 1072 cad92167f1485252bcdb5a3824c66be38886b8ad333102cad575bc3325ad691d.exe 522f0c57.exe PID 1072 wrote to memory of 304 1072 cad92167f1485252bcdb5a3824c66be38886b8ad333102cad575bc3325ad691d.exe 522f0c57.exe PID 1072 wrote to memory of 304 1072 cad92167f1485252bcdb5a3824c66be38886b8ad333102cad575bc3325ad691d.exe 522f0c57.exe PID 1072 wrote to memory of 304 1072 cad92167f1485252bcdb5a3824c66be38886b8ad333102cad575bc3325ad691d.exe 522f0c57.exe PID 1072 wrote to memory of 304 1072 cad92167f1485252bcdb5a3824c66be38886b8ad333102cad575bc3325ad691d.exe 522f0c57.exe PID 1072 wrote to memory of 1404 1072 cad92167f1485252bcdb5a3824c66be38886b8ad333102cad575bc3325ad691d.exe iexplore.exe PID 1072 wrote to memory of 1404 1072 cad92167f1485252bcdb5a3824c66be38886b8ad333102cad575bc3325ad691d.exe iexplore.exe PID 1072 wrote to memory of 1404 1072 cad92167f1485252bcdb5a3824c66be38886b8ad333102cad575bc3325ad691d.exe iexplore.exe PID 1072 wrote to memory of 1404 1072 cad92167f1485252bcdb5a3824c66be38886b8ad333102cad575bc3325ad691d.exe iexplore.exe PID 1404 wrote to memory of 856 1404 iexplore.exe IEXPLORE.EXE PID 1404 wrote to memory of 856 1404 iexplore.exe IEXPLORE.EXE PID 1404 wrote to memory of 856 1404 iexplore.exe IEXPLORE.EXE PID 1404 wrote to memory of 856 1404 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\cad92167f1485252bcdb5a3824c66be38886b8ad333102cad575bc3325ad691d.exe"C:\Users\Admin\AppData\Local\Temp\cad92167f1485252bcdb5a3824c66be38886b8ad333102cad575bc3325ad691d.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\522f0c57.exeC:\522f0c57.exe2⤵
- Executes dropped EXE
- Sets DLL path for service in the registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://www.macromedia.com/shockwave/download/?P1_Prod_Version=SWArchive10.0.02⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1404 CREDAT:275457 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs1⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs1⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs1⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs1⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs1⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs1⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs1⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs1⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs1⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs1⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs1⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs1⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs1⤵
- Loads dropped DLL
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\522f0c57.exeFilesize
240KB
MD5f5d2a6e81cd9b23d4899371b296b8a8c
SHA17b095e73b522c5a1b12e26ae389464c5c123bc8e
SHA256775082343ef68119bf9bf671c677c981b68ed6f627ff5b8b4de414e2e9d29a42
SHA51277842aae633daac864c148fdc5d40b22cc1dc9e3e0c0e81df7694d2c6e95bfb02bc18bb34c047bbf4b12dc24d14eb1b89acf75f43f547e311fe63730b6a54662
-
C:\522f0c57.exeFilesize
240KB
MD5f5d2a6e81cd9b23d4899371b296b8a8c
SHA17b095e73b522c5a1b12e26ae389464c5c123bc8e
SHA256775082343ef68119bf9bf671c677c981b68ed6f627ff5b8b4de414e2e9d29a42
SHA51277842aae633daac864c148fdc5d40b22cc1dc9e3e0c0e81df7694d2c6e95bfb02bc18bb34c047bbf4b12dc24d14eb1b89acf75f43f547e311fe63730b6a54662
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
340B
MD5b16a623e686d9366148992976c9f6532
SHA1bb9db95a2e9cb22910b352a75919482ba45edc95
SHA256daab1a6d5ef04e9b8ab01f2cd7325eba393d4fe4b3fc76b02e0d2b51cc0acf5b
SHA512859e22bede0d0c8fa237bd432a755459364c0aa7fcf5c0fecbd5a90816c123a94492a26673d2b31b78b0c65ba77c79aacb15c66a53c36fe69a9ff09c9e4c7d9d
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\OLVRZ234.txtFilesize
603B
MD5abbf236b74e2e14688ed3e0f05ec90ea
SHA1b09b14f4a1b3d8aa69a6bb5eba27eb4c5890af33
SHA25663ba2e1644f160835343767c7cbbcc7f29f9f88efcc45654f85375d3e575780c
SHA512ff2a6823c35b8d4dc6146e296e359890b4b5f663c8fe21585e5427c7d64325cb2cd23a1d61f654b896930225a7c1337588506f1065619029b01d6fcd2370df92
-
\??\c:\windows\SysWOW64\fastuserswitchingcompatibility.dllFilesize
240KB
MD5e48f830a89ba95daf7650bb9b05bd117
SHA1304e6666ad4a8e0329f7aa4646c34c5fe57d19fe
SHA256046338af97e20aaf13aa5aa3c550a139a5f41ee3f22592497ab1f9b7c82786c6
SHA512a462bea2fedd9135dd9b226b5b20cfd8172581d03b2c06acae4018ba8fba1c1e5f2d68f7e0ff860fd9269a02e36cc6c59e33b8c02f8168cd83e674ee074b3095
-
\??\c:\windows\SysWOW64\helpsvc.dllFilesize
240KB
MD5e48f830a89ba95daf7650bb9b05bd117
SHA1304e6666ad4a8e0329f7aa4646c34c5fe57d19fe
SHA256046338af97e20aaf13aa5aa3c550a139a5f41ee3f22592497ab1f9b7c82786c6
SHA512a462bea2fedd9135dd9b226b5b20cfd8172581d03b2c06acae4018ba8fba1c1e5f2d68f7e0ff860fd9269a02e36cc6c59e33b8c02f8168cd83e674ee074b3095
-
\??\c:\windows\SysWOW64\irmon.dllFilesize
240KB
MD5e48f830a89ba95daf7650bb9b05bd117
SHA1304e6666ad4a8e0329f7aa4646c34c5fe57d19fe
SHA256046338af97e20aaf13aa5aa3c550a139a5f41ee3f22592497ab1f9b7c82786c6
SHA512a462bea2fedd9135dd9b226b5b20cfd8172581d03b2c06acae4018ba8fba1c1e5f2d68f7e0ff860fd9269a02e36cc6c59e33b8c02f8168cd83e674ee074b3095
-
\??\c:\windows\SysWOW64\logonhours.dllFilesize
240KB
MD5e48f830a89ba95daf7650bb9b05bd117
SHA1304e6666ad4a8e0329f7aa4646c34c5fe57d19fe
SHA256046338af97e20aaf13aa5aa3c550a139a5f41ee3f22592497ab1f9b7c82786c6
SHA512a462bea2fedd9135dd9b226b5b20cfd8172581d03b2c06acae4018ba8fba1c1e5f2d68f7e0ff860fd9269a02e36cc6c59e33b8c02f8168cd83e674ee074b3095
-
\??\c:\windows\SysWOW64\nla.dllFilesize
240KB
MD5e48f830a89ba95daf7650bb9b05bd117
SHA1304e6666ad4a8e0329f7aa4646c34c5fe57d19fe
SHA256046338af97e20aaf13aa5aa3c550a139a5f41ee3f22592497ab1f9b7c82786c6
SHA512a462bea2fedd9135dd9b226b5b20cfd8172581d03b2c06acae4018ba8fba1c1e5f2d68f7e0ff860fd9269a02e36cc6c59e33b8c02f8168cd83e674ee074b3095
-
\??\c:\windows\SysWOW64\ntmssvc.dllFilesize
240KB
MD5e48f830a89ba95daf7650bb9b05bd117
SHA1304e6666ad4a8e0329f7aa4646c34c5fe57d19fe
SHA256046338af97e20aaf13aa5aa3c550a139a5f41ee3f22592497ab1f9b7c82786c6
SHA512a462bea2fedd9135dd9b226b5b20cfd8172581d03b2c06acae4018ba8fba1c1e5f2d68f7e0ff860fd9269a02e36cc6c59e33b8c02f8168cd83e674ee074b3095
-
\??\c:\windows\SysWOW64\nwcworkstation.dllFilesize
240KB
MD5e48f830a89ba95daf7650bb9b05bd117
SHA1304e6666ad4a8e0329f7aa4646c34c5fe57d19fe
SHA256046338af97e20aaf13aa5aa3c550a139a5f41ee3f22592497ab1f9b7c82786c6
SHA512a462bea2fedd9135dd9b226b5b20cfd8172581d03b2c06acae4018ba8fba1c1e5f2d68f7e0ff860fd9269a02e36cc6c59e33b8c02f8168cd83e674ee074b3095
-
\??\c:\windows\SysWOW64\nwsapagent.dllFilesize
240KB
MD5e48f830a89ba95daf7650bb9b05bd117
SHA1304e6666ad4a8e0329f7aa4646c34c5fe57d19fe
SHA256046338af97e20aaf13aa5aa3c550a139a5f41ee3f22592497ab1f9b7c82786c6
SHA512a462bea2fedd9135dd9b226b5b20cfd8172581d03b2c06acae4018ba8fba1c1e5f2d68f7e0ff860fd9269a02e36cc6c59e33b8c02f8168cd83e674ee074b3095
-
\??\c:\windows\SysWOW64\pcaudit.dllFilesize
240KB
MD5e48f830a89ba95daf7650bb9b05bd117
SHA1304e6666ad4a8e0329f7aa4646c34c5fe57d19fe
SHA256046338af97e20aaf13aa5aa3c550a139a5f41ee3f22592497ab1f9b7c82786c6
SHA512a462bea2fedd9135dd9b226b5b20cfd8172581d03b2c06acae4018ba8fba1c1e5f2d68f7e0ff860fd9269a02e36cc6c59e33b8c02f8168cd83e674ee074b3095
-
\??\c:\windows\SysWOW64\srservice.dllFilesize
240KB
MD5e48f830a89ba95daf7650bb9b05bd117
SHA1304e6666ad4a8e0329f7aa4646c34c5fe57d19fe
SHA256046338af97e20aaf13aa5aa3c550a139a5f41ee3f22592497ab1f9b7c82786c6
SHA512a462bea2fedd9135dd9b226b5b20cfd8172581d03b2c06acae4018ba8fba1c1e5f2d68f7e0ff860fd9269a02e36cc6c59e33b8c02f8168cd83e674ee074b3095
-
\??\c:\windows\SysWOW64\uploadmgr.dllFilesize
240KB
MD5e48f830a89ba95daf7650bb9b05bd117
SHA1304e6666ad4a8e0329f7aa4646c34c5fe57d19fe
SHA256046338af97e20aaf13aa5aa3c550a139a5f41ee3f22592497ab1f9b7c82786c6
SHA512a462bea2fedd9135dd9b226b5b20cfd8172581d03b2c06acae4018ba8fba1c1e5f2d68f7e0ff860fd9269a02e36cc6c59e33b8c02f8168cd83e674ee074b3095
-
\??\c:\windows\SysWOW64\wmdmpmsp.dllFilesize
240KB
MD5e48f830a89ba95daf7650bb9b05bd117
SHA1304e6666ad4a8e0329f7aa4646c34c5fe57d19fe
SHA256046338af97e20aaf13aa5aa3c550a139a5f41ee3f22592497ab1f9b7c82786c6
SHA512a462bea2fedd9135dd9b226b5b20cfd8172581d03b2c06acae4018ba8fba1c1e5f2d68f7e0ff860fd9269a02e36cc6c59e33b8c02f8168cd83e674ee074b3095
-
\Windows\SysWOW64\FastUserSwitchingCompatibility.dllFilesize
240KB
MD5e48f830a89ba95daf7650bb9b05bd117
SHA1304e6666ad4a8e0329f7aa4646c34c5fe57d19fe
SHA256046338af97e20aaf13aa5aa3c550a139a5f41ee3f22592497ab1f9b7c82786c6
SHA512a462bea2fedd9135dd9b226b5b20cfd8172581d03b2c06acae4018ba8fba1c1e5f2d68f7e0ff860fd9269a02e36cc6c59e33b8c02f8168cd83e674ee074b3095
-
\Windows\SysWOW64\Irmon.dllFilesize
240KB
MD5e48f830a89ba95daf7650bb9b05bd117
SHA1304e6666ad4a8e0329f7aa4646c34c5fe57d19fe
SHA256046338af97e20aaf13aa5aa3c550a139a5f41ee3f22592497ab1f9b7c82786c6
SHA512a462bea2fedd9135dd9b226b5b20cfd8172581d03b2c06acae4018ba8fba1c1e5f2d68f7e0ff860fd9269a02e36cc6c59e33b8c02f8168cd83e674ee074b3095
-
\Windows\SysWOW64\LogonHours.dllFilesize
240KB
MD5e48f830a89ba95daf7650bb9b05bd117
SHA1304e6666ad4a8e0329f7aa4646c34c5fe57d19fe
SHA256046338af97e20aaf13aa5aa3c550a139a5f41ee3f22592497ab1f9b7c82786c6
SHA512a462bea2fedd9135dd9b226b5b20cfd8172581d03b2c06acae4018ba8fba1c1e5f2d68f7e0ff860fd9269a02e36cc6c59e33b8c02f8168cd83e674ee074b3095
-
\Windows\SysWOW64\NWCWorkstation.dllFilesize
240KB
MD5e48f830a89ba95daf7650bb9b05bd117
SHA1304e6666ad4a8e0329f7aa4646c34c5fe57d19fe
SHA256046338af97e20aaf13aa5aa3c550a139a5f41ee3f22592497ab1f9b7c82786c6
SHA512a462bea2fedd9135dd9b226b5b20cfd8172581d03b2c06acae4018ba8fba1c1e5f2d68f7e0ff860fd9269a02e36cc6c59e33b8c02f8168cd83e674ee074b3095
-
\Windows\SysWOW64\Nla.dllFilesize
240KB
MD5e48f830a89ba95daf7650bb9b05bd117
SHA1304e6666ad4a8e0329f7aa4646c34c5fe57d19fe
SHA256046338af97e20aaf13aa5aa3c550a139a5f41ee3f22592497ab1f9b7c82786c6
SHA512a462bea2fedd9135dd9b226b5b20cfd8172581d03b2c06acae4018ba8fba1c1e5f2d68f7e0ff860fd9269a02e36cc6c59e33b8c02f8168cd83e674ee074b3095
-
\Windows\SysWOW64\Ntmssvc.dllFilesize
240KB
MD5e48f830a89ba95daf7650bb9b05bd117
SHA1304e6666ad4a8e0329f7aa4646c34c5fe57d19fe
SHA256046338af97e20aaf13aa5aa3c550a139a5f41ee3f22592497ab1f9b7c82786c6
SHA512a462bea2fedd9135dd9b226b5b20cfd8172581d03b2c06acae4018ba8fba1c1e5f2d68f7e0ff860fd9269a02e36cc6c59e33b8c02f8168cd83e674ee074b3095
-
\Windows\SysWOW64\Nwsapagent.dllFilesize
240KB
MD5e48f830a89ba95daf7650bb9b05bd117
SHA1304e6666ad4a8e0329f7aa4646c34c5fe57d19fe
SHA256046338af97e20aaf13aa5aa3c550a139a5f41ee3f22592497ab1f9b7c82786c6
SHA512a462bea2fedd9135dd9b226b5b20cfd8172581d03b2c06acae4018ba8fba1c1e5f2d68f7e0ff860fd9269a02e36cc6c59e33b8c02f8168cd83e674ee074b3095
-
\Windows\SysWOW64\PCAudit.dllFilesize
240KB
MD5e48f830a89ba95daf7650bb9b05bd117
SHA1304e6666ad4a8e0329f7aa4646c34c5fe57d19fe
SHA256046338af97e20aaf13aa5aa3c550a139a5f41ee3f22592497ab1f9b7c82786c6
SHA512a462bea2fedd9135dd9b226b5b20cfd8172581d03b2c06acae4018ba8fba1c1e5f2d68f7e0ff860fd9269a02e36cc6c59e33b8c02f8168cd83e674ee074b3095
-
\Windows\SysWOW64\SRService.dllFilesize
240KB
MD5e48f830a89ba95daf7650bb9b05bd117
SHA1304e6666ad4a8e0329f7aa4646c34c5fe57d19fe
SHA256046338af97e20aaf13aa5aa3c550a139a5f41ee3f22592497ab1f9b7c82786c6
SHA512a462bea2fedd9135dd9b226b5b20cfd8172581d03b2c06acae4018ba8fba1c1e5f2d68f7e0ff860fd9269a02e36cc6c59e33b8c02f8168cd83e674ee074b3095
-
\Windows\SysWOW64\WmdmPmSp.dllFilesize
240KB
MD5e48f830a89ba95daf7650bb9b05bd117
SHA1304e6666ad4a8e0329f7aa4646c34c5fe57d19fe
SHA256046338af97e20aaf13aa5aa3c550a139a5f41ee3f22592497ab1f9b7c82786c6
SHA512a462bea2fedd9135dd9b226b5b20cfd8172581d03b2c06acae4018ba8fba1c1e5f2d68f7e0ff860fd9269a02e36cc6c59e33b8c02f8168cd83e674ee074b3095
-
\Windows\SysWOW64\helpsvc.dllFilesize
240KB
MD5e48f830a89ba95daf7650bb9b05bd117
SHA1304e6666ad4a8e0329f7aa4646c34c5fe57d19fe
SHA256046338af97e20aaf13aa5aa3c550a139a5f41ee3f22592497ab1f9b7c82786c6
SHA512a462bea2fedd9135dd9b226b5b20cfd8172581d03b2c06acae4018ba8fba1c1e5f2d68f7e0ff860fd9269a02e36cc6c59e33b8c02f8168cd83e674ee074b3095
-
\Windows\SysWOW64\uploadmgr.dllFilesize
240KB
MD5e48f830a89ba95daf7650bb9b05bd117
SHA1304e6666ad4a8e0329f7aa4646c34c5fe57d19fe
SHA256046338af97e20aaf13aa5aa3c550a139a5f41ee3f22592497ab1f9b7c82786c6
SHA512a462bea2fedd9135dd9b226b5b20cfd8172581d03b2c06acae4018ba8fba1c1e5f2d68f7e0ff860fd9269a02e36cc6c59e33b8c02f8168cd83e674ee074b3095
-
memory/304-70-0x0000000002560000-0x0000000006560000-memory.dmpFilesize
64.0MB
-
memory/304-68-0x0000000001110000-0x000000000115E000-memory.dmpFilesize
312KB
-
memory/304-77-0x0000000002560000-0x0000000006560000-memory.dmpFilesize
64.0MB
-
memory/304-56-0x0000000074C91000-0x0000000074C93000-memory.dmpFilesize
8KB
-
memory/304-69-0x00000000002F0000-0x000000000033E000-memory.dmpFilesize
312KB
-
memory/304-54-0x0000000000000000-mapping.dmp
-
memory/304-58-0x0000000001110000-0x000000000115E000-memory.dmpFilesize
312KB
-
memory/304-59-0x0000000001110000-0x000000000115E000-memory.dmpFilesize
312KB
-
memory/812-108-0x00000000710F0000-0x000000007113E000-memory.dmpFilesize
312KB
-
memory/812-106-0x00000000710F0000-0x000000007113E000-memory.dmpFilesize
312KB
-
memory/812-109-0x00000000710F0000-0x000000007113E000-memory.dmpFilesize
312KB
-
memory/820-74-0x0000000073DA0000-0x0000000073DEE000-memory.dmpFilesize
312KB
-
memory/820-139-0x00000000710A0000-0x00000000710EE000-memory.dmpFilesize
312KB
-
memory/820-76-0x0000000073DA0000-0x0000000073DEE000-memory.dmpFilesize
312KB
-
memory/820-75-0x0000000073DA0000-0x0000000073DEE000-memory.dmpFilesize
312KB
-
memory/820-138-0x00000000710A0000-0x00000000710EE000-memory.dmpFilesize
312KB
-
memory/820-140-0x00000000710A0000-0x00000000710EE000-memory.dmpFilesize
312KB
-
memory/932-130-0x00000000710A0000-0x00000000710EE000-memory.dmpFilesize
312KB
-
memory/932-131-0x00000000710A0000-0x00000000710EE000-memory.dmpFilesize
312KB
-
memory/932-133-0x00000000710A0000-0x00000000710EE000-memory.dmpFilesize
312KB
-
memory/956-94-0x0000000071BD0000-0x0000000071C1E000-memory.dmpFilesize
312KB
-
memory/956-95-0x0000000071BD0000-0x0000000071C1E000-memory.dmpFilesize
312KB
-
memory/956-96-0x0000000071BD0000-0x0000000071C1E000-memory.dmpFilesize
312KB
-
memory/1072-90-0x0000000020000000-0x0000000020053000-memory.dmpFilesize
332KB
-
memory/1072-66-0x0000000020000000-0x0000000020053000-memory.dmpFilesize
332KB
-
memory/1072-67-0x0000000000420000-0x000000000046E000-memory.dmpFilesize
312KB
-
memory/1148-63-0x00000000742F0000-0x000000007433E000-memory.dmpFilesize
312KB
-
memory/1148-64-0x00000000742F0000-0x000000007433E000-memory.dmpFilesize
312KB
-
memory/1148-65-0x00000000742F0000-0x000000007433E000-memory.dmpFilesize
312KB
-
memory/1160-101-0x0000000071B20000-0x0000000071B6E000-memory.dmpFilesize
312KB
-
memory/1160-102-0x0000000071B20000-0x0000000071B6E000-memory.dmpFilesize
312KB
-
memory/1160-100-0x0000000071B20000-0x0000000071B6E000-memory.dmpFilesize
312KB
-
memory/1240-120-0x00000000710A0000-0x00000000710EE000-memory.dmpFilesize
312KB
-
memory/1240-121-0x00000000710A0000-0x00000000710EE000-memory.dmpFilesize
312KB
-
memory/1240-119-0x00000000710A0000-0x00000000710EE000-memory.dmpFilesize
312KB
-
memory/1428-87-0x00000000742F0000-0x000000007433E000-memory.dmpFilesize
312KB
-
memory/1428-88-0x00000000742F0000-0x000000007433E000-memory.dmpFilesize
312KB
-
memory/1428-89-0x00000000742F0000-0x000000007433E000-memory.dmpFilesize
312KB
-
memory/1544-82-0x00000000742F0000-0x000000007433E000-memory.dmpFilesize
312KB
-
memory/1544-81-0x00000000742F0000-0x000000007433E000-memory.dmpFilesize
312KB
-
memory/1544-83-0x00000000742F0000-0x000000007433E000-memory.dmpFilesize
312KB
-
memory/1968-115-0x00000000710A0000-0x00000000710EE000-memory.dmpFilesize
312KB
-
memory/1968-114-0x00000000710A0000-0x00000000710EE000-memory.dmpFilesize
312KB
-
memory/1968-113-0x00000000710A0000-0x00000000710EE000-memory.dmpFilesize
312KB