Analysis
-
max time kernel
137s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
28-11-2022 02:20
Behavioral task
behavioral1
Sample
cad92167f1485252bcdb5a3824c66be38886b8ad333102cad575bc3325ad691d.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
cad92167f1485252bcdb5a3824c66be38886b8ad333102cad575bc3325ad691d.exe
Resource
win10v2004-20220901-en
General
-
Target
cad92167f1485252bcdb5a3824c66be38886b8ad333102cad575bc3325ad691d.exe
-
Size
324KB
-
MD5
81ce949bf717b5232928506f681eaafb
-
SHA1
16ddf9e90e365539b909d1374561abcc4425070f
-
SHA256
cad92167f1485252bcdb5a3824c66be38886b8ad333102cad575bc3325ad691d
-
SHA512
e1f72e7502f1f4439a5d700c749dfbf5ccd08aed4d0a3d50bb080afe92a206d37849652e6eee6faca46a6b7c6afad4e6a3cd1e404ceb45bbaf42c3df5bb8b3b8
-
SSDEEP
6144:d/j5C+EV3/4YIJ8m1MxUyRzoVOBlYQflIGE:d/s++P4BJTM6++OBlYERE
Malware Config
Signatures
-
Processes:
resource yara_rule C:\522f0c57.exe aspack_v212_v242 C:\522f0c57.exe aspack_v212_v242 \??\c:\windows\SysWOW64\fastuserswitchingcompatibility.dll aspack_v212_v242 C:\Windows\SysWOW64\FastUserSwitchingCompatibility.dll aspack_v212_v242 C:\Windows\SysWOW64\Irmon.dll aspack_v212_v242 \??\c:\windows\SysWOW64\irmon.dll aspack_v212_v242 \??\c:\windows\SysWOW64\nla.dll aspack_v212_v242 C:\Windows\SysWOW64\Nla.dll aspack_v212_v242 \??\c:\windows\SysWOW64\ntmssvc.dll aspack_v212_v242 C:\Windows\SysWOW64\Ntmssvc.dll aspack_v212_v242 C:\Windows\SysWOW64\NWCWorkstation.dll aspack_v212_v242 \??\c:\windows\SysWOW64\nwcworkstation.dll aspack_v212_v242 \??\c:\windows\SysWOW64\nwsapagent.dll aspack_v212_v242 C:\Windows\SysWOW64\Nwsapagent.dll aspack_v212_v242 \??\c:\windows\SysWOW64\srservice.dll aspack_v212_v242 C:\Windows\SysWOW64\SRService.dll aspack_v212_v242 C:\Windows\SysWOW64\WmdmPmSp.dll aspack_v212_v242 \??\c:\windows\SysWOW64\wmdmpmsp.dll aspack_v212_v242 C:\Windows\SysWOW64\LogonHours.dll aspack_v212_v242 \??\c:\windows\SysWOW64\logonhours.dll aspack_v212_v242 C:\Windows\SysWOW64\PCAudit.dll aspack_v212_v242 \??\c:\windows\SysWOW64\pcaudit.dll aspack_v212_v242 \??\c:\windows\SysWOW64\helpsvc.dll aspack_v212_v242 C:\Windows\SysWOW64\helpsvc.dll aspack_v212_v242 \??\c:\windows\SysWOW64\uploadmgr.dll aspack_v212_v242 C:\Windows\SysWOW64\uploadmgr.dll aspack_v212_v242 -
Executes dropped EXE 1 IoCs
Processes:
522f0c57.exepid process 4316 522f0c57.exe -
Sets DLL path for service in the registry 2 TTPs 14 IoCs
Processes:
522f0c57.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\helpsvc\Parameters\ServiceDll = "C:\\Windows\\system32\\helpsvc.dll" 522f0c57.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\uploadmgr\Parameters\ServiceDll = "C:\\Windows\\system32\\uploadmgr.dll" 522f0c57.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\FastUserSwitchingCompatibility\Parameters\ServiceDll = "C:\\Windows\\system32\\FastUserSwitchingCompatibility.dll" 522f0c57.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Ias\Parameters\ServiceDll = "C:\\Windows\\system32\\Ias.dll" 522f0c57.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Nla\Parameters\ServiceDll = "C:\\Windows\\system32\\Nla.dll" 522f0c57.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NWCWorkstation\Parameters\ServiceDll = "C:\\Windows\\system32\\NWCWorkstation.dll" 522f0c57.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Nwsapagent\Parameters\ServiceDll = "C:\\Windows\\system32\\Nwsapagent.dll" 522f0c57.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Wmi\Parameters\ServiceDll = "C:\\Windows\\system32\\Wmi.dll" 522f0c57.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WmdmPmSp\Parameters\ServiceDll = "C:\\Windows\\system32\\WmdmPmSp.dll" 522f0c57.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SRService\Parameters\ServiceDll = "C:\\Windows\\system32\\SRService.dll" 522f0c57.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\LogonHours\Parameters\ServiceDll = "C:\\Windows\\system32\\LogonHours.dll" 522f0c57.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Irmon\Parameters\ServiceDll = "C:\\Windows\\system32\\Irmon.dll" 522f0c57.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Ntmssvc\Parameters\ServiceDll = "C:\\Windows\\system32\\Ntmssvc.dll" 522f0c57.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\PCAudit\Parameters\ServiceDll = "C:\\Windows\\system32\\PCAudit.dll" 522f0c57.exe -
Processes:
resource yara_rule C:\522f0c57.exe upx C:\522f0c57.exe upx behavioral2/memory/4316-135-0x0000000000A20000-0x0000000000A6E000-memory.dmp upx behavioral2/memory/4316-136-0x0000000000A20000-0x0000000000A6E000-memory.dmp upx behavioral2/memory/2672-137-0x0000000020000000-0x0000000020053000-memory.dmp upx behavioral2/memory/4316-138-0x0000000000A20000-0x0000000000A6E000-memory.dmp upx \??\c:\windows\SysWOW64\fastuserswitchingcompatibility.dll upx C:\Windows\SysWOW64\FastUserSwitchingCompatibility.dll upx behavioral2/memory/5072-141-0x0000000075500000-0x000000007554E000-memory.dmp upx behavioral2/memory/5072-142-0x0000000075500000-0x000000007554E000-memory.dmp upx behavioral2/memory/5072-143-0x0000000075500000-0x000000007554E000-memory.dmp upx C:\Windows\SysWOW64\Irmon.dll upx \??\c:\windows\SysWOW64\irmon.dll upx behavioral2/memory/4492-147-0x0000000075500000-0x000000007554E000-memory.dmp upx behavioral2/memory/4492-148-0x0000000075500000-0x000000007554E000-memory.dmp upx behavioral2/memory/4492-149-0x0000000075500000-0x000000007554E000-memory.dmp upx \??\c:\windows\SysWOW64\nla.dll upx behavioral2/memory/1340-152-0x0000000075500000-0x000000007554E000-memory.dmp upx behavioral2/memory/1340-153-0x0000000075500000-0x000000007554E000-memory.dmp upx C:\Windows\SysWOW64\Nla.dll upx behavioral2/memory/1340-154-0x0000000075500000-0x000000007554E000-memory.dmp upx \??\c:\windows\SysWOW64\ntmssvc.dll upx C:\Windows\SysWOW64\Ntmssvc.dll upx behavioral2/memory/3400-158-0x0000000075500000-0x000000007554E000-memory.dmp upx behavioral2/memory/3400-160-0x0000000075500000-0x000000007554E000-memory.dmp upx behavioral2/memory/3400-159-0x0000000075500000-0x000000007554E000-memory.dmp upx C:\Windows\SysWOW64\NWCWorkstation.dll upx behavioral2/memory/3780-163-0x0000000075500000-0x000000007554E000-memory.dmp upx behavioral2/memory/3780-165-0x0000000075500000-0x000000007554E000-memory.dmp upx behavioral2/memory/3780-164-0x0000000075500000-0x000000007554E000-memory.dmp upx \??\c:\windows\SysWOW64\nwcworkstation.dll upx \??\c:\windows\SysWOW64\nwsapagent.dll upx C:\Windows\SysWOW64\Nwsapagent.dll upx behavioral2/memory/3312-170-0x0000000075500000-0x000000007554E000-memory.dmp upx behavioral2/memory/3312-169-0x0000000075500000-0x000000007554E000-memory.dmp upx behavioral2/memory/3312-168-0x0000000075500000-0x000000007554E000-memory.dmp upx \??\c:\windows\SysWOW64\srservice.dll upx behavioral2/memory/1732-173-0x0000000075500000-0x000000007554E000-memory.dmp upx behavioral2/memory/1732-174-0x0000000075500000-0x000000007554E000-memory.dmp upx C:\Windows\SysWOW64\SRService.dll upx behavioral2/memory/1732-175-0x0000000075500000-0x000000007554E000-memory.dmp upx C:\Windows\SysWOW64\WmdmPmSp.dll upx \??\c:\windows\SysWOW64\wmdmpmsp.dll upx behavioral2/memory/4860-180-0x0000000075500000-0x000000007554E000-memory.dmp upx behavioral2/memory/4860-179-0x0000000075500000-0x000000007554E000-memory.dmp upx behavioral2/memory/4860-178-0x0000000075500000-0x000000007554E000-memory.dmp upx behavioral2/memory/4280-183-0x0000000074EF0000-0x0000000074F3E000-memory.dmp upx behavioral2/memory/4280-185-0x0000000074EF0000-0x0000000074F3E000-memory.dmp upx behavioral2/memory/4280-184-0x0000000074EF0000-0x0000000074F3E000-memory.dmp upx C:\Windows\SysWOW64\LogonHours.dll upx \??\c:\windows\SysWOW64\logonhours.dll upx behavioral2/memory/2672-186-0x0000000020000000-0x0000000020053000-memory.dmp upx C:\Windows\SysWOW64\PCAudit.dll upx behavioral2/memory/3528-189-0x0000000075000000-0x000000007504E000-memory.dmp upx \??\c:\windows\SysWOW64\pcaudit.dll upx behavioral2/memory/3528-190-0x0000000075000000-0x000000007504E000-memory.dmp upx behavioral2/memory/3528-191-0x0000000075000000-0x000000007504E000-memory.dmp upx \??\c:\windows\SysWOW64\helpsvc.dll upx C:\Windows\SysWOW64\helpsvc.dll upx behavioral2/memory/4524-194-0x0000000070740000-0x000000007078E000-memory.dmp upx behavioral2/memory/4524-195-0x0000000070740000-0x000000007078E000-memory.dmp upx behavioral2/memory/4524-196-0x0000000070740000-0x000000007078E000-memory.dmp upx \??\c:\windows\SysWOW64\uploadmgr.dll upx C:\Windows\SysWOW64\uploadmgr.dll upx -
Loads dropped DLL 12 IoCs
Processes:
svchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exepid process 5072 svchost.exe 4492 svchost.exe 1340 svchost.exe 3400 svchost.exe 3780 svchost.exe 3312 svchost.exe 1732 svchost.exe 4860 svchost.exe 4280 svchost.exe 3528 svchost.exe 4524 svchost.exe 2568 svchost.exe -
Drops file in System32 directory 14 IoCs
Processes:
522f0c57.exedescription ioc process File opened for modification C:\Windows\SysWOW64\Ntmssvc.dll 522f0c57.exe File opened for modification C:\Windows\SysWOW64\NWCWorkstation.dll 522f0c57.exe File opened for modification C:\Windows\SysWOW64\Wmi.dll 522f0c57.exe File opened for modification C:\Windows\SysWOW64\PCAudit.dll 522f0c57.exe File opened for modification C:\Windows\SysWOW64\Ias.dll 522f0c57.exe File opened for modification C:\Windows\SysWOW64\Nla.dll 522f0c57.exe File opened for modification C:\Windows\SysWOW64\Nwsapagent.dll 522f0c57.exe File opened for modification C:\Windows\SysWOW64\WmdmPmSp.dll 522f0c57.exe File opened for modification C:\Windows\SysWOW64\FastUserSwitchingCompatibility.dll 522f0c57.exe File opened for modification C:\Windows\SysWOW64\LogonHours.dll 522f0c57.exe File opened for modification C:\Windows\SysWOW64\SRService.dll 522f0c57.exe File opened for modification C:\Windows\SysWOW64\helpsvc.dll 522f0c57.exe File opened for modification C:\Windows\SysWOW64\uploadmgr.dll 522f0c57.exe File opened for modification C:\Windows\SysWOW64\Irmon.dll 522f0c57.exe -
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{C575FACA-6F9E-11ED-A0EE-F63A18EFECFD} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2600000474" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "2600000474" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "376461298" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000043e2eb2e51ccf149ab640c8bdb0d7906000000000200000000001066000000010000200000003602666b2421989bf81493872fc897920ef6cf8f11a62c8d1728bcd0bf2ac030000000000e80000000020000200000005d9cd49a1e8cd75f86d3679a0c1246b65debd6f6fa3ddc523e5e15a00bf8467d20000000ecd3047dd0caca82784deb173a49ec235e16664fe083b9bd99d21566c87c373e40000000f6c819bd0139ddca75f120493e973d586b11b940b25138714ac2e7ee94136c3e5dcf105c54aea109eeab16333f9e196ed0e678041fc31774370dd58b8797ee11 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30999467" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30999467" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000043e2eb2e51ccf149ab640c8bdb0d790600000000020000000000106600000001000020000000036c8f3b5e6f97219366b9edc76ab8dc8315b5e5aabf0c80765480f35ad38039000000000e8000000002000020000000abe06ef0d034cdaeccc5b55acf5e5537b79da7f44f957e7225f609af3ea046612000000067622f1f8413004b453ba6d9ce0a8f64909d20438dffec8dae8b9901c8ebdc8840000000786cdd8ba06a8a0080690607c1186ed1099dea45bf36fe936f8bf9460471c0d98354412f4893e457f3092a317be5f2eb13fea553062b88f580814b7813b59d3b iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0e2e49bab03d901 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60f4ad9bab03d901 iexplore.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
522f0c57.exepid process 4316 522f0c57.exe 4316 522f0c57.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
iexplore.exepid process 4628 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 4628 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 4628 iexplore.exe 4628 iexplore.exe 1880 IEXPLORE.EXE 1880 IEXPLORE.EXE 1880 IEXPLORE.EXE 1880 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
cad92167f1485252bcdb5a3824c66be38886b8ad333102cad575bc3325ad691d.exeiexplore.exedescription pid process target process PID 2672 wrote to memory of 4316 2672 cad92167f1485252bcdb5a3824c66be38886b8ad333102cad575bc3325ad691d.exe 522f0c57.exe PID 2672 wrote to memory of 4316 2672 cad92167f1485252bcdb5a3824c66be38886b8ad333102cad575bc3325ad691d.exe 522f0c57.exe PID 2672 wrote to memory of 4316 2672 cad92167f1485252bcdb5a3824c66be38886b8ad333102cad575bc3325ad691d.exe 522f0c57.exe PID 2672 wrote to memory of 4628 2672 cad92167f1485252bcdb5a3824c66be38886b8ad333102cad575bc3325ad691d.exe iexplore.exe PID 2672 wrote to memory of 4628 2672 cad92167f1485252bcdb5a3824c66be38886b8ad333102cad575bc3325ad691d.exe iexplore.exe PID 4628 wrote to memory of 1880 4628 iexplore.exe IEXPLORE.EXE PID 4628 wrote to memory of 1880 4628 iexplore.exe IEXPLORE.EXE PID 4628 wrote to memory of 1880 4628 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\cad92167f1485252bcdb5a3824c66be38886b8ad333102cad575bc3325ad691d.exe"C:\Users\Admin\AppData\Local\Temp\cad92167f1485252bcdb5a3824c66be38886b8ad333102cad575bc3325ad691d.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\522f0c57.exeC:\522f0c57.exe2⤵
- Executes dropped EXE
- Sets DLL path for service in the registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://www.macromedia.com/shockwave/download/?P1_Prod_Version=SWArchive10.0.02⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4628 CREDAT:17410 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs -s FastUserSwitchingCompatibility1⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs -s Irmon1⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs -s Nla1⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs -s Ntmssvc1⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs -s NWCWorkstation1⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs -s Nwsapagent1⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs -s SRService1⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs -s WmdmPmSp1⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs -s LogonHours1⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs -s PCAudit1⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs -s helpsvc1⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs -s uploadmgr1⤵
- Loads dropped DLL
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\522f0c57.exeFilesize
240KB
MD5f5d2a6e81cd9b23d4899371b296b8a8c
SHA17b095e73b522c5a1b12e26ae389464c5c123bc8e
SHA256775082343ef68119bf9bf671c677c981b68ed6f627ff5b8b4de414e2e9d29a42
SHA51277842aae633daac864c148fdc5d40b22cc1dc9e3e0c0e81df7694d2c6e95bfb02bc18bb34c047bbf4b12dc24d14eb1b89acf75f43f547e311fe63730b6a54662
-
C:\522f0c57.exeFilesize
240KB
MD5f5d2a6e81cd9b23d4899371b296b8a8c
SHA17b095e73b522c5a1b12e26ae389464c5c123bc8e
SHA256775082343ef68119bf9bf671c677c981b68ed6f627ff5b8b4de414e2e9d29a42
SHA51277842aae633daac864c148fdc5d40b22cc1dc9e3e0c0e81df7694d2c6e95bfb02bc18bb34c047bbf4b12dc24d14eb1b89acf75f43f547e311fe63730b6a54662
-
C:\Windows\SysWOW64\FastUserSwitchingCompatibility.dllFilesize
240KB
MD5e48f830a89ba95daf7650bb9b05bd117
SHA1304e6666ad4a8e0329f7aa4646c34c5fe57d19fe
SHA256046338af97e20aaf13aa5aa3c550a139a5f41ee3f22592497ab1f9b7c82786c6
SHA512a462bea2fedd9135dd9b226b5b20cfd8172581d03b2c06acae4018ba8fba1c1e5f2d68f7e0ff860fd9269a02e36cc6c59e33b8c02f8168cd83e674ee074b3095
-
C:\Windows\SysWOW64\Irmon.dllFilesize
240KB
MD5e48f830a89ba95daf7650bb9b05bd117
SHA1304e6666ad4a8e0329f7aa4646c34c5fe57d19fe
SHA256046338af97e20aaf13aa5aa3c550a139a5f41ee3f22592497ab1f9b7c82786c6
SHA512a462bea2fedd9135dd9b226b5b20cfd8172581d03b2c06acae4018ba8fba1c1e5f2d68f7e0ff860fd9269a02e36cc6c59e33b8c02f8168cd83e674ee074b3095
-
C:\Windows\SysWOW64\LogonHours.dllFilesize
240KB
MD5e48f830a89ba95daf7650bb9b05bd117
SHA1304e6666ad4a8e0329f7aa4646c34c5fe57d19fe
SHA256046338af97e20aaf13aa5aa3c550a139a5f41ee3f22592497ab1f9b7c82786c6
SHA512a462bea2fedd9135dd9b226b5b20cfd8172581d03b2c06acae4018ba8fba1c1e5f2d68f7e0ff860fd9269a02e36cc6c59e33b8c02f8168cd83e674ee074b3095
-
C:\Windows\SysWOW64\NWCWorkstation.dllFilesize
240KB
MD5e48f830a89ba95daf7650bb9b05bd117
SHA1304e6666ad4a8e0329f7aa4646c34c5fe57d19fe
SHA256046338af97e20aaf13aa5aa3c550a139a5f41ee3f22592497ab1f9b7c82786c6
SHA512a462bea2fedd9135dd9b226b5b20cfd8172581d03b2c06acae4018ba8fba1c1e5f2d68f7e0ff860fd9269a02e36cc6c59e33b8c02f8168cd83e674ee074b3095
-
C:\Windows\SysWOW64\Nla.dllFilesize
240KB
MD5e48f830a89ba95daf7650bb9b05bd117
SHA1304e6666ad4a8e0329f7aa4646c34c5fe57d19fe
SHA256046338af97e20aaf13aa5aa3c550a139a5f41ee3f22592497ab1f9b7c82786c6
SHA512a462bea2fedd9135dd9b226b5b20cfd8172581d03b2c06acae4018ba8fba1c1e5f2d68f7e0ff860fd9269a02e36cc6c59e33b8c02f8168cd83e674ee074b3095
-
C:\Windows\SysWOW64\Ntmssvc.dllFilesize
240KB
MD5e48f830a89ba95daf7650bb9b05bd117
SHA1304e6666ad4a8e0329f7aa4646c34c5fe57d19fe
SHA256046338af97e20aaf13aa5aa3c550a139a5f41ee3f22592497ab1f9b7c82786c6
SHA512a462bea2fedd9135dd9b226b5b20cfd8172581d03b2c06acae4018ba8fba1c1e5f2d68f7e0ff860fd9269a02e36cc6c59e33b8c02f8168cd83e674ee074b3095
-
C:\Windows\SysWOW64\Nwsapagent.dllFilesize
240KB
MD5e48f830a89ba95daf7650bb9b05bd117
SHA1304e6666ad4a8e0329f7aa4646c34c5fe57d19fe
SHA256046338af97e20aaf13aa5aa3c550a139a5f41ee3f22592497ab1f9b7c82786c6
SHA512a462bea2fedd9135dd9b226b5b20cfd8172581d03b2c06acae4018ba8fba1c1e5f2d68f7e0ff860fd9269a02e36cc6c59e33b8c02f8168cd83e674ee074b3095
-
C:\Windows\SysWOW64\PCAudit.dllFilesize
240KB
MD5e48f830a89ba95daf7650bb9b05bd117
SHA1304e6666ad4a8e0329f7aa4646c34c5fe57d19fe
SHA256046338af97e20aaf13aa5aa3c550a139a5f41ee3f22592497ab1f9b7c82786c6
SHA512a462bea2fedd9135dd9b226b5b20cfd8172581d03b2c06acae4018ba8fba1c1e5f2d68f7e0ff860fd9269a02e36cc6c59e33b8c02f8168cd83e674ee074b3095
-
C:\Windows\SysWOW64\SRService.dllFilesize
240KB
MD5e48f830a89ba95daf7650bb9b05bd117
SHA1304e6666ad4a8e0329f7aa4646c34c5fe57d19fe
SHA256046338af97e20aaf13aa5aa3c550a139a5f41ee3f22592497ab1f9b7c82786c6
SHA512a462bea2fedd9135dd9b226b5b20cfd8172581d03b2c06acae4018ba8fba1c1e5f2d68f7e0ff860fd9269a02e36cc6c59e33b8c02f8168cd83e674ee074b3095
-
C:\Windows\SysWOW64\WmdmPmSp.dllFilesize
240KB
MD5e48f830a89ba95daf7650bb9b05bd117
SHA1304e6666ad4a8e0329f7aa4646c34c5fe57d19fe
SHA256046338af97e20aaf13aa5aa3c550a139a5f41ee3f22592497ab1f9b7c82786c6
SHA512a462bea2fedd9135dd9b226b5b20cfd8172581d03b2c06acae4018ba8fba1c1e5f2d68f7e0ff860fd9269a02e36cc6c59e33b8c02f8168cd83e674ee074b3095
-
C:\Windows\SysWOW64\helpsvc.dllFilesize
240KB
MD5e48f830a89ba95daf7650bb9b05bd117
SHA1304e6666ad4a8e0329f7aa4646c34c5fe57d19fe
SHA256046338af97e20aaf13aa5aa3c550a139a5f41ee3f22592497ab1f9b7c82786c6
SHA512a462bea2fedd9135dd9b226b5b20cfd8172581d03b2c06acae4018ba8fba1c1e5f2d68f7e0ff860fd9269a02e36cc6c59e33b8c02f8168cd83e674ee074b3095
-
C:\Windows\SysWOW64\uploadmgr.dllFilesize
240KB
MD5e48f830a89ba95daf7650bb9b05bd117
SHA1304e6666ad4a8e0329f7aa4646c34c5fe57d19fe
SHA256046338af97e20aaf13aa5aa3c550a139a5f41ee3f22592497ab1f9b7c82786c6
SHA512a462bea2fedd9135dd9b226b5b20cfd8172581d03b2c06acae4018ba8fba1c1e5f2d68f7e0ff860fd9269a02e36cc6c59e33b8c02f8168cd83e674ee074b3095
-
\??\c:\windows\SysWOW64\fastuserswitchingcompatibility.dllFilesize
240KB
MD5e48f830a89ba95daf7650bb9b05bd117
SHA1304e6666ad4a8e0329f7aa4646c34c5fe57d19fe
SHA256046338af97e20aaf13aa5aa3c550a139a5f41ee3f22592497ab1f9b7c82786c6
SHA512a462bea2fedd9135dd9b226b5b20cfd8172581d03b2c06acae4018ba8fba1c1e5f2d68f7e0ff860fd9269a02e36cc6c59e33b8c02f8168cd83e674ee074b3095
-
\??\c:\windows\SysWOW64\helpsvc.dllFilesize
240KB
MD5e48f830a89ba95daf7650bb9b05bd117
SHA1304e6666ad4a8e0329f7aa4646c34c5fe57d19fe
SHA256046338af97e20aaf13aa5aa3c550a139a5f41ee3f22592497ab1f9b7c82786c6
SHA512a462bea2fedd9135dd9b226b5b20cfd8172581d03b2c06acae4018ba8fba1c1e5f2d68f7e0ff860fd9269a02e36cc6c59e33b8c02f8168cd83e674ee074b3095
-
\??\c:\windows\SysWOW64\irmon.dllFilesize
240KB
MD5e48f830a89ba95daf7650bb9b05bd117
SHA1304e6666ad4a8e0329f7aa4646c34c5fe57d19fe
SHA256046338af97e20aaf13aa5aa3c550a139a5f41ee3f22592497ab1f9b7c82786c6
SHA512a462bea2fedd9135dd9b226b5b20cfd8172581d03b2c06acae4018ba8fba1c1e5f2d68f7e0ff860fd9269a02e36cc6c59e33b8c02f8168cd83e674ee074b3095
-
\??\c:\windows\SysWOW64\logonhours.dllFilesize
240KB
MD5e48f830a89ba95daf7650bb9b05bd117
SHA1304e6666ad4a8e0329f7aa4646c34c5fe57d19fe
SHA256046338af97e20aaf13aa5aa3c550a139a5f41ee3f22592497ab1f9b7c82786c6
SHA512a462bea2fedd9135dd9b226b5b20cfd8172581d03b2c06acae4018ba8fba1c1e5f2d68f7e0ff860fd9269a02e36cc6c59e33b8c02f8168cd83e674ee074b3095
-
\??\c:\windows\SysWOW64\nla.dllFilesize
240KB
MD5e48f830a89ba95daf7650bb9b05bd117
SHA1304e6666ad4a8e0329f7aa4646c34c5fe57d19fe
SHA256046338af97e20aaf13aa5aa3c550a139a5f41ee3f22592497ab1f9b7c82786c6
SHA512a462bea2fedd9135dd9b226b5b20cfd8172581d03b2c06acae4018ba8fba1c1e5f2d68f7e0ff860fd9269a02e36cc6c59e33b8c02f8168cd83e674ee074b3095
-
\??\c:\windows\SysWOW64\ntmssvc.dllFilesize
240KB
MD5e48f830a89ba95daf7650bb9b05bd117
SHA1304e6666ad4a8e0329f7aa4646c34c5fe57d19fe
SHA256046338af97e20aaf13aa5aa3c550a139a5f41ee3f22592497ab1f9b7c82786c6
SHA512a462bea2fedd9135dd9b226b5b20cfd8172581d03b2c06acae4018ba8fba1c1e5f2d68f7e0ff860fd9269a02e36cc6c59e33b8c02f8168cd83e674ee074b3095
-
\??\c:\windows\SysWOW64\nwcworkstation.dllFilesize
240KB
MD5e48f830a89ba95daf7650bb9b05bd117
SHA1304e6666ad4a8e0329f7aa4646c34c5fe57d19fe
SHA256046338af97e20aaf13aa5aa3c550a139a5f41ee3f22592497ab1f9b7c82786c6
SHA512a462bea2fedd9135dd9b226b5b20cfd8172581d03b2c06acae4018ba8fba1c1e5f2d68f7e0ff860fd9269a02e36cc6c59e33b8c02f8168cd83e674ee074b3095
-
\??\c:\windows\SysWOW64\nwsapagent.dllFilesize
240KB
MD5e48f830a89ba95daf7650bb9b05bd117
SHA1304e6666ad4a8e0329f7aa4646c34c5fe57d19fe
SHA256046338af97e20aaf13aa5aa3c550a139a5f41ee3f22592497ab1f9b7c82786c6
SHA512a462bea2fedd9135dd9b226b5b20cfd8172581d03b2c06acae4018ba8fba1c1e5f2d68f7e0ff860fd9269a02e36cc6c59e33b8c02f8168cd83e674ee074b3095
-
\??\c:\windows\SysWOW64\pcaudit.dllFilesize
240KB
MD5e48f830a89ba95daf7650bb9b05bd117
SHA1304e6666ad4a8e0329f7aa4646c34c5fe57d19fe
SHA256046338af97e20aaf13aa5aa3c550a139a5f41ee3f22592497ab1f9b7c82786c6
SHA512a462bea2fedd9135dd9b226b5b20cfd8172581d03b2c06acae4018ba8fba1c1e5f2d68f7e0ff860fd9269a02e36cc6c59e33b8c02f8168cd83e674ee074b3095
-
\??\c:\windows\SysWOW64\srservice.dllFilesize
240KB
MD5e48f830a89ba95daf7650bb9b05bd117
SHA1304e6666ad4a8e0329f7aa4646c34c5fe57d19fe
SHA256046338af97e20aaf13aa5aa3c550a139a5f41ee3f22592497ab1f9b7c82786c6
SHA512a462bea2fedd9135dd9b226b5b20cfd8172581d03b2c06acae4018ba8fba1c1e5f2d68f7e0ff860fd9269a02e36cc6c59e33b8c02f8168cd83e674ee074b3095
-
\??\c:\windows\SysWOW64\uploadmgr.dllFilesize
240KB
MD5e48f830a89ba95daf7650bb9b05bd117
SHA1304e6666ad4a8e0329f7aa4646c34c5fe57d19fe
SHA256046338af97e20aaf13aa5aa3c550a139a5f41ee3f22592497ab1f9b7c82786c6
SHA512a462bea2fedd9135dd9b226b5b20cfd8172581d03b2c06acae4018ba8fba1c1e5f2d68f7e0ff860fd9269a02e36cc6c59e33b8c02f8168cd83e674ee074b3095
-
\??\c:\windows\SysWOW64\wmdmpmsp.dllFilesize
240KB
MD5e48f830a89ba95daf7650bb9b05bd117
SHA1304e6666ad4a8e0329f7aa4646c34c5fe57d19fe
SHA256046338af97e20aaf13aa5aa3c550a139a5f41ee3f22592497ab1f9b7c82786c6
SHA512a462bea2fedd9135dd9b226b5b20cfd8172581d03b2c06acae4018ba8fba1c1e5f2d68f7e0ff860fd9269a02e36cc6c59e33b8c02f8168cd83e674ee074b3095
-
memory/1340-152-0x0000000075500000-0x000000007554E000-memory.dmpFilesize
312KB
-
memory/1340-154-0x0000000075500000-0x000000007554E000-memory.dmpFilesize
312KB
-
memory/1340-153-0x0000000075500000-0x000000007554E000-memory.dmpFilesize
312KB
-
memory/1732-174-0x0000000075500000-0x000000007554E000-memory.dmpFilesize
312KB
-
memory/1732-173-0x0000000075500000-0x000000007554E000-memory.dmpFilesize
312KB
-
memory/1732-175-0x0000000075500000-0x000000007554E000-memory.dmpFilesize
312KB
-
memory/2568-201-0x0000000070380000-0x00000000703CE000-memory.dmpFilesize
312KB
-
memory/2568-200-0x0000000070380000-0x00000000703CE000-memory.dmpFilesize
312KB
-
memory/2568-199-0x0000000070380000-0x00000000703CE000-memory.dmpFilesize
312KB
-
memory/2672-186-0x0000000020000000-0x0000000020053000-memory.dmpFilesize
332KB
-
memory/2672-137-0x0000000020000000-0x0000000020053000-memory.dmpFilesize
332KB
-
memory/3312-168-0x0000000075500000-0x000000007554E000-memory.dmpFilesize
312KB
-
memory/3312-169-0x0000000075500000-0x000000007554E000-memory.dmpFilesize
312KB
-
memory/3312-170-0x0000000075500000-0x000000007554E000-memory.dmpFilesize
312KB
-
memory/3400-158-0x0000000075500000-0x000000007554E000-memory.dmpFilesize
312KB
-
memory/3400-160-0x0000000075500000-0x000000007554E000-memory.dmpFilesize
312KB
-
memory/3400-159-0x0000000075500000-0x000000007554E000-memory.dmpFilesize
312KB
-
memory/3528-190-0x0000000075000000-0x000000007504E000-memory.dmpFilesize
312KB
-
memory/3528-189-0x0000000075000000-0x000000007504E000-memory.dmpFilesize
312KB
-
memory/3528-191-0x0000000075000000-0x000000007504E000-memory.dmpFilesize
312KB
-
memory/3780-163-0x0000000075500000-0x000000007554E000-memory.dmpFilesize
312KB
-
memory/3780-164-0x0000000075500000-0x000000007554E000-memory.dmpFilesize
312KB
-
memory/3780-165-0x0000000075500000-0x000000007554E000-memory.dmpFilesize
312KB
-
memory/4280-185-0x0000000074EF0000-0x0000000074F3E000-memory.dmpFilesize
312KB
-
memory/4280-183-0x0000000074EF0000-0x0000000074F3E000-memory.dmpFilesize
312KB
-
memory/4280-184-0x0000000074EF0000-0x0000000074F3E000-memory.dmpFilesize
312KB
-
memory/4316-155-0x0000000002EA0000-0x0000000006EA0000-memory.dmpFilesize
64.0MB
-
memory/4316-202-0x0000000000A20000-0x0000000000A6E000-memory.dmpFilesize
312KB
-
memory/4316-135-0x0000000000A20000-0x0000000000A6E000-memory.dmpFilesize
312KB
-
memory/4316-132-0x0000000000000000-mapping.dmp
-
memory/4316-138-0x0000000000A20000-0x0000000000A6E000-memory.dmpFilesize
312KB
-
memory/4316-144-0x0000000002EA0000-0x0000000006EA0000-memory.dmpFilesize
64.0MB
-
memory/4316-136-0x0000000000A20000-0x0000000000A6E000-memory.dmpFilesize
312KB
-
memory/4492-149-0x0000000075500000-0x000000007554E000-memory.dmpFilesize
312KB
-
memory/4492-148-0x0000000075500000-0x000000007554E000-memory.dmpFilesize
312KB
-
memory/4492-147-0x0000000075500000-0x000000007554E000-memory.dmpFilesize
312KB
-
memory/4524-194-0x0000000070740000-0x000000007078E000-memory.dmpFilesize
312KB
-
memory/4524-195-0x0000000070740000-0x000000007078E000-memory.dmpFilesize
312KB
-
memory/4524-196-0x0000000070740000-0x000000007078E000-memory.dmpFilesize
312KB
-
memory/4860-180-0x0000000075500000-0x000000007554E000-memory.dmpFilesize
312KB
-
memory/4860-179-0x0000000075500000-0x000000007554E000-memory.dmpFilesize
312KB
-
memory/4860-178-0x0000000075500000-0x000000007554E000-memory.dmpFilesize
312KB
-
memory/5072-141-0x0000000075500000-0x000000007554E000-memory.dmpFilesize
312KB
-
memory/5072-142-0x0000000075500000-0x000000007554E000-memory.dmpFilesize
312KB
-
memory/5072-143-0x0000000075500000-0x000000007554E000-memory.dmpFilesize
312KB