Analysis
-
max time kernel
176s -
max time network
182s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
29-11-2022 08:09
Static task
static1
Behavioral task
behavioral1
Sample
a95f207ca6b9ff09a248614ae30b3ddfbe1aaad61ccca7438451fdaa879b0c8b.exe
Resource
win7-20220812-en
windows7-x64
17 signatures
150 seconds
General
-
Target
a95f207ca6b9ff09a248614ae30b3ddfbe1aaad61ccca7438451fdaa879b0c8b.exe
-
Size
6.9MB
-
MD5
76827e19ac4b6c300c8bc37754b321a9
-
SHA1
60f1144731e4e8e98d22a59df821256307c26364
-
SHA256
a95f207ca6b9ff09a248614ae30b3ddfbe1aaad61ccca7438451fdaa879b0c8b
-
SHA512
beb2072de102d2d4d5925bd63925faa00828ad5e14f152d01544902e58293fb012991b6c614c3ff87c0928f4782b02f0302faff0f9fc0c672f4a9a1793bbc81b
-
SSDEEP
196608:CZXBJmubSsk25nnATnJpk789JENi1OudYjinaOB:ePD2sbngnXk77rudzn5B
Malware Config
Signatures
-
Executes dropped EXE 7 IoCs
pid Process 1772 1b310c37f05a6f303d844b7dc01a0c07.exe 4532 b480a56c680cb6c11e0432fdb759915f1.exe 4576 b480a56c680cb6c11e0432fdb759915f2.exe 1932 SputnikHelper.exe 4180 GuardMailRu.exe 3420 GuardMailRu.exe 1420 GuardMailRu.exe -
Modifies Windows Firewall 1 TTPs 4 IoCs
pid Process 1384 netsh.exe 4372 netsh.exe 1036 netsh.exe 3284 netsh.exe -
Checks computer location settings 2 TTPs 4 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation a95f207ca6b9ff09a248614ae30b3ddfbe1aaad61ccca7438451fdaa879b0c8b.exe Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation 1b310c37f05a6f303d844b7dc01a0c07.exe Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation b480a56c680cb6c11e0432fdb759915f1.exe Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation b480a56c680cb6c11e0432fdb759915f2.exe -
Loads dropped DLL 2 IoCs
pid Process 4576 b480a56c680cb6c11e0432fdb759915f2.exe 1420 GuardMailRu.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Guard.Mail.ru.gui = "\"C:\\Program Files (x86)\\Mail.Ru\\Guard\\GuardMailRu.exe\" /gui" GuardMailRu.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA b480a56c680cb6c11e0432fdb759915f2.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA GuardMailRu.exe -
Installs/modifies Browser Helper Object 2 TTPs 2 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8984B388-A5BB-4DF7-B274-77B879E179DB} b480a56c680cb6c11e0432fdb759915f2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8984B388-A5BB-4DF7-B274-77B879E179DB}\ = "Спутник@Mail.Ru" b480a56c680cb6c11e0432fdb759915f2.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\{dcd48218-e972-4d0c-9e5f-43462bc13e3b}\{9bed5ee2-0547-4706-8600-d3897629ade0} GuardMailRu.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\{dcd48218-e972-4d0c-9e5f-43462bc13e3b}\{9bed5ee2-0547-4706-8600-d3897629ade0} GuardMailRu.exe -
Drops file in Program Files directory 6 IoCs
description ioc Process File created C:\Program Files (x86)\Mail.Ru\Guard\GuardMailRu.exe GuardMailRu.exe File created C:\Program Files (x86)\Mail.Ru\Sputnik\MailRuSputnik.dll b480a56c680cb6c11e0432fdb759915f2.exe File created C:\Program Files (x86)\Mail.Ru\Sputnik\SputnikHelper.exe b480a56c680cb6c11e0432fdb759915f2.exe File created C:\Program Files (x86)\Mail.Ru\Sputnik\SputnikFlashPlayer.exe b480a56c680cb6c11e0432fdb759915f2.exe File created C:\Program Files (x86)\Mail.Ru\Sputnik\b480a56c680cb6c11e0432fdb759915f2.exe b480a56c680cb6c11e0432fdb759915f2.exe File opened for modification C:\Program Files (x86)\Mail.Ru\Sputnik\b480a56c680cb6c11e0432fdb759915f2.exe b480a56c680cb6c11e0432fdb759915f2.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\URLSearchHooks b480a56c680cb6c11e0432fdb759915f2.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{BA885813-C1DF-4AB5-8C6A-469D899E2C4C}\AppName = "SputnikHelper.exe" b480a56c680cb6c11e0432fdb759915f2.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Toolbar b480a56c680cb6c11e0432fdb759915f2.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{357FBE87-6C8E-490D-A059-4746C864AE6F} b480a56c680cb6c11e0432fdb759915f1.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{afe26134-8a16-4149-b798-242574f3f4a9} b480a56c680cb6c11e0432fdb759915f1.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{aff735eb-cdf9-4894-aa69-3e3131128618} b480a56c680cb6c11e0432fdb759915f1.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{dc6bf185-7ae4-444e-8c35-e447b0d2bd1e} b480a56c680cb6c11e0432fdb759915f1.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{07d873dc-b9b9-44f5-af0b-fb59fa54fb7a} b480a56c680cb6c11e0432fdb759915f1.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{6bf52a52-394a-11d3-b153-00c04f79faa6} b480a56c680cb6c11e0432fdb759915f1.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{6bf52a52-394a-11d3-b153-00c04f79faa6}-32 b480a56c680cb6c11e0432fdb759915f1.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{7AC06A6F-4C88-4707-8DEC-61017CB50E1E} b480a56c680cb6c11e0432fdb759915f1.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{8E1F80F4-953F-41E7-8460-E64AE5BE4ED3} b480a56c680cb6c11e0432fdb759915f1.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{E88E0043-C9D4-4e33-8555-FEE4F5B63060}\SuggestionsURL = "http://suggests.go.mail.ru/ie8?q={searchTerms}" b480a56c680cb6c11e0432fdb759915f2.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5FBAF6E6-C64B-49DB-AB1B-F93C607EBC71} b480a56c680cb6c11e0432fdb759915f1.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{B7278BD0-7970-47D6-8954-99B2343EED88} b480a56c680cb6c11e0432fdb759915f1.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{E88E0043-C9D4-4e33-8555-FEE4F5B63060}\FaviconURLFallback = "http://go.mail.ru/favicon.ico" b480a56c680cb6c11e0432fdb759915f2.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\SearchScopes b480a56c680cb6c11e0432fdb759915f2.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main GuardMailRu.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{08f24d68-9087-4b24-81ad-7b34af3e3ed5} b480a56c680cb6c11e0432fdb759915f1.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{877467C0-F9E4-4561-84F0-65AA7539833C} b480a56c680cb6c11e0432fdb759915f1.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{a1ad1bbb-3b33-4260-a74c-5fd8bc1479fc} b480a56c680cb6c11e0432fdb759915f1.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{eee261cc-4b3e-46e7-affb-61f297155bf2} b480a56c680cb6c11e0432fdb759915f1.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{BA885813-C1DF-4AB5-8C6A-469D899E2C4C}\AppPath = "C:\\Program Files (x86)\\Mail.Ru\\Sputnik" b480a56c680cb6c11e0432fdb759915f2.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{7f7bd411-f034-4ac0-9424-224bd7ab4e4e} b480a56c680cb6c11e0432fdb759915f1.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{95a4104c-1c49-4c2a-9830-1be0f47e926c} b480a56c680cb6c11e0432fdb759915f1.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{989F13EE-B25B-4FAB-9AED-C4336C8CCF0C} b480a56c680cb6c11e0432fdb759915f1.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{e5f90a07-7db7-4dcb-bd6d-d3fecd376ca3} b480a56c680cb6c11e0432fdb759915f1.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{fa6f0991-f729-4899-b095-d3fbca253cf6} b480a56c680cb6c11e0432fdb759915f1.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{E88E0043-C9D4-4e33-8555-FEE4F5B63060}\ShowSearchSuggestions = "1" b480a56c680cb6c11e0432fdb759915f2.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\DefaultScope = "{E88E0043-C9D4-4e33-8555-FEE4F5B63060}" b480a56c680cb6c11e0432fdb759915f2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{BEBD1F2A-C192-44A3-9AF8-7D68B8C746EB}\AppName = "SputnikHelper.exe" b480a56c680cb6c11e0432fdb759915f2.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1F1E561D-AF17-4510-B996-351BBA0862A7} b480a56c680cb6c11e0432fdb759915f1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{BEBD1F2A-C192-44A3-9AF8-7D68B8C746EB}\Policy = "3" b480a56c680cb6c11e0432fdb759915f2.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{85fc331e-bb64-4c53-ba25-3d8a956c02fd} b480a56c680cb6c11e0432fdb759915f1.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9da1d2cb-796d-4bec-bbaa-0aa9ccd80e15} b480a56c680cb6c11e0432fdb759915f1.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy b480a56c680cb6c11e0432fdb759915f1.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\{09900DE8-1DCA-443F-9243-26FF581438AF} = "Спутник@Mail.Ru" b480a56c680cb6c11e0432fdb759915f2.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\SearchScopes GuardMailRu.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{4becf16c-74f0-429b-8d3e-4fba507ac661} b480a56c680cb6c11e0432fdb759915f1.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{61bd7005-d55e-4693-a191-0caa33601426} b480a56c680cb6c11e0432fdb759915f1.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5054EC7-B9CB-4ad5-9F95-D8171A6D6BFA} b480a56c680cb6c11e0432fdb759915f1.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29} b480a56c680cb6c11e0432fdb759915f1.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{DD993BDC-06E0-4131-B889-DD3B9AEBE253} b480a56c680cb6c11e0432fdb759915f1.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy b480a56c680cb6c11e0432fdb759915f1.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} b480a56c680cb6c11e0432fdb759915f2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{BEBD1F2A-C192-44A3-9AF8-7D68B8C746EB}\AppPath = "C:\\Program Files (x86)\\Mail.Ru\\Sputnik" b480a56c680cb6c11e0432fdb759915f2.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{15B3FB63-66F4-4EFC-B717-BB283B85E79B} b480a56c680cb6c11e0432fdb759915f1.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{78c7b664-c9bf-4ce9-8b3a-b05d442e451e} b480a56c680cb6c11e0432fdb759915f1.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{7eb01fb2-f185-445a-94e4-ec4e1ba2202c} b480a56c680cb6c11e0432fdb759915f1.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{fb9e068b-c612-4fa8-bdb9-d728a716a420} b480a56c680cb6c11e0432fdb759915f1.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{054aae20-4bea-4347-8a35-64a533254a9d} b480a56c680cb6c11e0432fdb759915f1.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{70f641fd-9ffc-4d5b-a4dc-962af4ed7999} b480a56c680cb6c11e0432fdb759915f1.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{8cec58ae-07a1-11d9-b15e-000d56bfe6ee} b480a56c680cb6c11e0432fdb759915f1.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{a5a2d52a-4944-47c4-a3e0-8bd92e14d953} b480a56c680cb6c11e0432fdb759915f1.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights b480a56c680cb6c11e0432fdb759915f1.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\SearchScopes\{E88E0043-C9D4-4e33-8555-FEE4F5B63060} b480a56c680cb6c11e0432fdb759915f2.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{BEBD1F2A-C192-44A3-9AF8-7D68B8C746EB} b480a56c680cb6c11e0432fdb759915f2.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy b480a56c680cb6c11e0432fdb759915f1.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{B43A0C1E-B63F-4691-B68F-CD807A45DA01} b480a56c680cb6c11e0432fdb759915f1.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main b480a56c680cb6c11e0432fdb759915f2.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{2dec4925-1312-4d7f-a6f5-89272d848dcf} b480a56c680cb6c11e0432fdb759915f1.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{7aaae723-5fb5-4b2d-9327-75519f336825} b480a56c680cb6c11e0432fdb759915f1.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9C6A861C-B233-4994-AFB1-C158EE4FC578} b480a56c680cb6c11e0432fdb759915f1.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{f5d04f46-b4b2-4202-a191-f780421b4200} b480a56c680cb6c11e0432fdb759915f1.exe -
Modifies Internet Explorer start page 1 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://www.mail.ru/cnt/9516" b480a56c680cb6c11e0432fdb759915f2.exe -
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8984B388-A5BB-4DF7-B274-77B879E179DB}\VersionIndependentProgID b480a56c680cb6c11e0432fdb759915f2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MailRu.MailRuSputnikObj\CLSID\ = "{09900DE8-1DCA-443F-9243-26FF581438AF}" b480a56c680cb6c11e0432fdb759915f2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{09900DE8-1DCA-443F-9243-26FF581438AF}\Programmable b480a56c680cb6c11e0432fdb759915f2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SputnikHelper.SputnikHelperObj.1\CLSID SputnikHelper.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SputnikHelper.SputnikHelperObj\CLSID SputnikHelper.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MailRuSputnik.MailRuBHO.1\ = "MailRuBHO Class" b480a56c680cb6c11e0432fdb759915f2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8984B388-A5BB-4DF7-B274-77B879E179DB}\InprocServer32\ = "C:\\Program Files (x86)\\Mail.Ru\\Sputnik\\MailRuSputnik.dll" b480a56c680cb6c11e0432fdb759915f2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{BFD1C493-BE73-4660-9924-7C23CF34C11D}\ = "SputnikHelper" SputnikHelper.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\SputnikHelper.EXE\AppID = "{BFD1C493-BE73-4660-9924-7C23CF34C11D}" SputnikHelper.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D2D4C0D4-2E88-40D0-A0DB-B8F9AC388529}\ProgID SputnikHelper.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2D1384D8-DA46-44FF-8E24-2049552FF9D7}\TypeLib\Version = "1.0" SputnikHelper.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8984B388-A5BB-4DF7-B274-77B879E179DB}\Programmable b480a56c680cb6c11e0432fdb759915f2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{09900DE8-1DCA-443F-9243-26FF581438AF}\InprocServer32\ThreadingModel = "Apartment" b480a56c680cb6c11e0432fdb759915f2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{09900DE8-1DCA-443F-9243-26FF581438AF}\TypeLib b480a56c680cb6c11e0432fdb759915f2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SputnikHelper.SputnikHelperObj\CLSID\ = "{D2D4C0D4-2E88-40D0-A0DB-B8F9AC388529}" SputnikHelper.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D2D4C0D4-2E88-40D0-A0DB-B8F9AC388529}\TypeLib\ = "{A6024453-8AD2-4424-8C4E-AB8BDE5506B9}" SputnikHelper.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A6024453-8AD2-4424-8C4E-AB8BDE5506B9}\1.0\0\win32 SputnikHelper.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SputnikHelper.SputnikHelperObj\CurVer SputnikHelper.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\ b480a56c680cb6c11e0432fdb759915f2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MailRuSputnik.MailRuBHO.1\CLSID b480a56c680cb6c11e0432fdb759915f2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8984B388-A5BB-4DF7-B274-77B879E179DB} b480a56c680cb6c11e0432fdb759915f2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{09900DE8-1DCA-443F-9243-26FF581438AF}\ = "Спутник@Mail.Ru" b480a56c680cb6c11e0432fdb759915f2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{09900DE8-1DCA-443F-9243-26FF581438AF}\InprocServer32\ = "C:\\Program Files (x86)\\Mail.Ru\\Sputnik\\MailRuSputnik.dll" b480a56c680cb6c11e0432fdb759915f2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{09900DE8-1DCA-443F-9243-26FF581438AF}\VersionIndependentProgID\ = "MailRu.MailRuSputnikObj" b480a56c680cb6c11e0432fdb759915f2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2D1384D8-DA46-44FF-8E24-2049552FF9D7}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" SputnikHelper.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2D1384D8-DA46-44FF-8E24-2049552FF9D7}\TypeLib\Version = "1.0" SputnikHelper.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8984B388-A5BB-4DF7-B274-77B879E179DB}\TypeLib b480a56c680cb6c11e0432fdb759915f2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8984B388-A5BB-4DF7-B274-77B879E179DB}\TypeLib\ = "{D9396DCA-81B4-4C62-8C48-619573A3C4E6}" b480a56c680cb6c11e0432fdb759915f2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MailRu.MailRuSputnikObj\ = "Спутник@Mail.Ru" b480a56c680cb6c11e0432fdb759915f2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D2D4C0D4-2E88-40D0-A0DB-B8F9AC388529}\ProgID\ = "SputnikHelper.SputnikHelperObj.1" SputnikHelper.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A6024453-8AD2-4424-8C4E-AB8BDE5506B9} SputnikHelper.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A6024453-8AD2-4424-8C4E-AB8BDE5506B9}\1.0\FLAGS SputnikHelper.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2D1384D8-DA46-44FF-8E24-2049552FF9D7}\TypeLib\ = "{A6024453-8AD2-4424-8C4E-AB8BDE5506B9}" SputnikHelper.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8984B388-A5BB-4DF7-B274-77B879E179DB}\InprocServer32\ThreadingModel = "Apartment" b480a56c680cb6c11e0432fdb759915f2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MailRu.MailRuSputnikObj b480a56c680cb6c11e0432fdb759915f2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MailRu.MailRuSputnikObj\CLSID b480a56c680cb6c11e0432fdb759915f2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\SputnikHelper.EXE SputnikHelper.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A6024453-8AD2-4424-8C4E-AB8BDE5506B9}\1.0\0\win32\ = "C:\\Program Files (x86)\\Mail.Ru\\Sputnik\\SputnikHelper.exe" SputnikHelper.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2D1384D8-DA46-44FF-8E24-2049552FF9D7} SputnikHelper.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8984B388-A5BB-4DF7-B274-77B879E179DB}\ProgID\ = "MailRuSputnik.MailRuBHO.1" b480a56c680cb6c11e0432fdb759915f2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{09900DE8-1DCA-443F-9243-26FF581438AF}\VersionIndependentProgID b480a56c680cb6c11e0432fdb759915f2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D2D4C0D4-2E88-40D0-A0DB-B8F9AC388529} SputnikHelper.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2D1384D8-DA46-44FF-8E24-2049552FF9D7}\ = "ISputnikHelperObj" SputnikHelper.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2D1384D8-DA46-44FF-8E24-2049552FF9D7}\TypeLib SputnikHelper.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8984B388-A5BB-4DF7-B274-77B879E179DB}\ProgID b480a56c680cb6c11e0432fdb759915f2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MailRu.MailRuSputnikObj\CurVer\ = "MailRu.MailRuSputnikObj.1" b480a56c680cb6c11e0432fdb759915f2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID b480a56c680cb6c11e0432fdb759915f2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MailRuSputnik.MailRuBHO b480a56c680cb6c11e0432fdb759915f2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MailRuSputnik.MailRuBHO\CLSID b480a56c680cb6c11e0432fdb759915f2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MailRuSputnik.MailRuBHO\CLSID\ = "{8984B388-A5BB-4DF7-B274-77B879E179DB}" b480a56c680cb6c11e0432fdb759915f2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MailRuSputnik.MailRuBHO\CurVer\ = "MailRuSputnik.MailRuBHO.1" b480a56c680cb6c11e0432fdb759915f2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MailRuSputnik.MailRuBHO.1\CLSID\ = "{8984B388-A5BB-4DF7-B274-77B879E179DB}" b480a56c680cb6c11e0432fdb759915f2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2D1384D8-DA46-44FF-8E24-2049552FF9D7}\ = "ISputnikHelperObj" SputnikHelper.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MailRu.MailRuSputnikObj.1\CLSID b480a56c680cb6c11e0432fdb759915f2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{BFD1C493-BE73-4660-9924-7C23CF34C11D} SputnikHelper.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SputnikHelper.SputnikHelperObj\ = "SputnikHelperObj Class" SputnikHelper.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A6024453-8AD2-4424-8C4E-AB8BDE5506B9}\1.0 SputnikHelper.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A6024453-8AD2-4424-8C4E-AB8BDE5506B9}\1.0\ = "SputnikHelper 1.0 Type Library" SputnikHelper.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2D1384D8-DA46-44FF-8E24-2049552FF9D7}\TypeLib\ = "{A6024453-8AD2-4424-8C4E-AB8BDE5506B9}" SputnikHelper.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D2D4C0D4-2E88-40D0-A0DB-B8F9AC388529}\TypeLib SputnikHelper.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2D1384D8-DA46-44FF-8E24-2049552FF9D7} SputnikHelper.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{09900DE8-1DCA-443F-9243-26FF581438AF}\InprocServer32 b480a56c680cb6c11e0432fdb759915f2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MailRuSputnik.MailRuBHO\CurVer b480a56c680cb6c11e0432fdb759915f2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8984B388-A5BB-4DF7-B274-77B879E179DB}\VersionIndependentProgID\ = "MailRuSputnik.MailRuBHO" b480a56c680cb6c11e0432fdb759915f2.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1772 1b310c37f05a6f303d844b7dc01a0c07.exe 1772 1b310c37f05a6f303d844b7dc01a0c07.exe 4576 b480a56c680cb6c11e0432fdb759915f2.exe 4576 b480a56c680cb6c11e0432fdb759915f2.exe 4180 GuardMailRu.exe 4180 GuardMailRu.exe 3420 GuardMailRu.exe 3420 GuardMailRu.exe 3420 GuardMailRu.exe 3420 GuardMailRu.exe 3420 GuardMailRu.exe 3420 GuardMailRu.exe 3420 GuardMailRu.exe 3420 GuardMailRu.exe 3420 GuardMailRu.exe 3420 GuardMailRu.exe 3420 GuardMailRu.exe 3420 GuardMailRu.exe 3420 GuardMailRu.exe 3420 GuardMailRu.exe 3420 GuardMailRu.exe 3420 GuardMailRu.exe 3420 GuardMailRu.exe 3420 GuardMailRu.exe 3420 GuardMailRu.exe 3420 GuardMailRu.exe 3420 GuardMailRu.exe 3420 GuardMailRu.exe 3420 GuardMailRu.exe 3420 GuardMailRu.exe 3420 GuardMailRu.exe 3420 GuardMailRu.exe 3420 GuardMailRu.exe 3420 GuardMailRu.exe 3420 GuardMailRu.exe 3420 GuardMailRu.exe 3420 GuardMailRu.exe 3420 GuardMailRu.exe 3420 GuardMailRu.exe 3420 GuardMailRu.exe 3420 GuardMailRu.exe 3420 GuardMailRu.exe 3420 GuardMailRu.exe 3420 GuardMailRu.exe 3420 GuardMailRu.exe 3420 GuardMailRu.exe 3420 GuardMailRu.exe 3420 GuardMailRu.exe 3420 GuardMailRu.exe 3420 GuardMailRu.exe 3420 GuardMailRu.exe 3420 GuardMailRu.exe 3420 GuardMailRu.exe 3420 GuardMailRu.exe 3420 GuardMailRu.exe 3420 GuardMailRu.exe 3420 GuardMailRu.exe 3420 GuardMailRu.exe 3420 GuardMailRu.exe 3420 GuardMailRu.exe 3420 GuardMailRu.exe 3420 GuardMailRu.exe 3420 GuardMailRu.exe 3420 GuardMailRu.exe -
Suspicious use of WriteProcessMemory 30 IoCs
description pid Process procid_target PID 4824 wrote to memory of 1772 4824 a95f207ca6b9ff09a248614ae30b3ddfbe1aaad61ccca7438451fdaa879b0c8b.exe 81 PID 4824 wrote to memory of 1772 4824 a95f207ca6b9ff09a248614ae30b3ddfbe1aaad61ccca7438451fdaa879b0c8b.exe 81 PID 4824 wrote to memory of 1772 4824 a95f207ca6b9ff09a248614ae30b3ddfbe1aaad61ccca7438451fdaa879b0c8b.exe 81 PID 1772 wrote to memory of 4532 1772 1b310c37f05a6f303d844b7dc01a0c07.exe 83 PID 1772 wrote to memory of 4532 1772 1b310c37f05a6f303d844b7dc01a0c07.exe 83 PID 1772 wrote to memory of 4532 1772 1b310c37f05a6f303d844b7dc01a0c07.exe 83 PID 4532 wrote to memory of 1384 4532 b480a56c680cb6c11e0432fdb759915f1.exe 85 PID 4532 wrote to memory of 1384 4532 b480a56c680cb6c11e0432fdb759915f1.exe 85 PID 4532 wrote to memory of 1384 4532 b480a56c680cb6c11e0432fdb759915f1.exe 85 PID 4532 wrote to memory of 4372 4532 b480a56c680cb6c11e0432fdb759915f1.exe 87 PID 4532 wrote to memory of 4372 4532 b480a56c680cb6c11e0432fdb759915f1.exe 87 PID 4532 wrote to memory of 4372 4532 b480a56c680cb6c11e0432fdb759915f1.exe 87 PID 1772 wrote to memory of 4576 1772 1b310c37f05a6f303d844b7dc01a0c07.exe 89 PID 1772 wrote to memory of 4576 1772 1b310c37f05a6f303d844b7dc01a0c07.exe 89 PID 1772 wrote to memory of 4576 1772 1b310c37f05a6f303d844b7dc01a0c07.exe 89 PID 4576 wrote to memory of 1932 4576 b480a56c680cb6c11e0432fdb759915f2.exe 90 PID 4576 wrote to memory of 1932 4576 b480a56c680cb6c11e0432fdb759915f2.exe 90 PID 4576 wrote to memory of 1932 4576 b480a56c680cb6c11e0432fdb759915f2.exe 90 PID 4576 wrote to memory of 1036 4576 b480a56c680cb6c11e0432fdb759915f2.exe 91 PID 4576 wrote to memory of 1036 4576 b480a56c680cb6c11e0432fdb759915f2.exe 91 PID 4576 wrote to memory of 1036 4576 b480a56c680cb6c11e0432fdb759915f2.exe 91 PID 4576 wrote to memory of 3284 4576 b480a56c680cb6c11e0432fdb759915f2.exe 94 PID 4576 wrote to memory of 3284 4576 b480a56c680cb6c11e0432fdb759915f2.exe 94 PID 4576 wrote to memory of 3284 4576 b480a56c680cb6c11e0432fdb759915f2.exe 94 PID 4576 wrote to memory of 4180 4576 b480a56c680cb6c11e0432fdb759915f2.exe 96 PID 4576 wrote to memory of 4180 4576 b480a56c680cb6c11e0432fdb759915f2.exe 96 PID 4576 wrote to memory of 4180 4576 b480a56c680cb6c11e0432fdb759915f2.exe 96 PID 4180 wrote to memory of 1420 4180 GuardMailRu.exe 98 PID 4180 wrote to memory of 1420 4180 GuardMailRu.exe 98 PID 4180 wrote to memory of 1420 4180 GuardMailRu.exe 98 -
System policy modification 1 TTPs 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System b480a56c680cb6c11e0432fdb759915f2.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a95f207ca6b9ff09a248614ae30b3ddfbe1aaad61ccca7438451fdaa879b0c8b.exe"C:\Users\Admin\AppData\Local\Temp\a95f207ca6b9ff09a248614ae30b3ddfbe1aaad61ccca7438451fdaa879b0c8b.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4824 -
C:\Users\Admin\AppData\Local\Temp\1b310c37f05a6f303d844b7dc01a0c07.exe"C:\Users\Admin\AppData\Local\Temp\1b310c37f05a6f303d844b7dc01a0c07.exe" /c mailru2⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1772 -
C:\Users\Admin\AppData\Local\Temp\b480a56c680cb6c11e0432fdb759915f1.exe"C:\Users\Admin\AppData\Local\Temp\b480a56c680cb6c11e0432fdb759915f1.exe" /uninstall /silent3⤵
- Executes dropped EXE
- Checks computer location settings
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:4532 -
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" firewall delete allowedprogram "SputnikHelper.exe"4⤵
- Modifies Windows Firewall
PID:1384
-
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" firewall delete allowedprogram "SputnikFlashPlayer.exe"4⤵
- Modifies Windows Firewall
PID:4372
-
-
-
C:\Users\Admin\AppData\Local\Temp\b480a56c680cb6c11e0432fdb759915f2.exe"C:\Users\Admin\AppData\Local\Temp\b480a56c680cb6c11e0432fdb759915f2.exe" /silent /rfr=openpr /mpcln=9516 /partner_new_url=http://smstransfers.net/toolbar.php?id=3930&file_id=343303&guid=$__GUID&sig=$__SIG3⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
- Checks whether UAC is enabled
- Installs/modifies Browser Helper Object
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4576 -
C:\Program Files (x86)\Mail.Ru\Sputnik\SputnikHelper.exe"C:\Program Files (x86)\Mail.Ru\Sputnik\SputnikHelper.exe" /RegServer4⤵
- Executes dropped EXE
- Modifies registry class
PID:1932
-
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" firewall add allowedprogram "C:\Program Files (x86)\Mail.Ru\Sputnik\SputnikHelper.exe" "C:\Program Files (x86)\Mail.Ru\Sputnik\SputnikHelper.exe" ENABLE ALL4⤵
- Modifies Windows Firewall
PID:1036
-
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" firewall add allowedprogram "C:\Program Files (x86)\Mail.Ru\Sputnik\SputnikFlashPlayer.exe" "C:\Program Files (x86)\Mail.Ru\Sputnik\SputnikFlashPlayer.exe" ENABLE ALL4⤵
- Modifies Windows Firewall
PID:3284
-
-
C:\Users\Admin\AppData\Local\Temp\GuardMailRu.exe"C:\Users\Admin\AppData\Local\Temp\GuardMailRu.exe" /INSTALL2 /LANG=ru /GUID={8E5A2595-3F79-41FF-A289-A56B84C738BF}4⤵
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4180 -
C:\Program Files (x86)\Mail.Ru\Guard\GuardMailRu.exe"C:\Program Files (x86)\Mail.Ru\Guard\GuardMailRu.exe" /gui5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1420
-
-
-
-
-
C:\Program Files (x86)\Mail.Ru\Guard\GuardMailRu.exe"C:\Program Files (x86)\Mail.Ru\Guard\GuardMailRu.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
PID:3420
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.6MB
MD54e808bd83cc5ecf45163fc7942657a1a
SHA135cf5e55111a95a8d67f14d6efe80f46c240159a
SHA256a6ccc5b32f422b74b2fe68456b6c89543984ba67fa5716cc144e2b5e9e9b3c11
SHA5124c61f777bef89be7a89c95ebd6e82bfc67f49ba8a2e5e1995e570ccf45ec43609a461fb072f44882e2766ac4db44468694d1b561939e68cac3b36d37988ad96f
-
Filesize
1.6MB
MD54e808bd83cc5ecf45163fc7942657a1a
SHA135cf5e55111a95a8d67f14d6efe80f46c240159a
SHA256a6ccc5b32f422b74b2fe68456b6c89543984ba67fa5716cc144e2b5e9e9b3c11
SHA5124c61f777bef89be7a89c95ebd6e82bfc67f49ba8a2e5e1995e570ccf45ec43609a461fb072f44882e2766ac4db44468694d1b561939e68cac3b36d37988ad96f
-
Filesize
1.6MB
MD54e808bd83cc5ecf45163fc7942657a1a
SHA135cf5e55111a95a8d67f14d6efe80f46c240159a
SHA256a6ccc5b32f422b74b2fe68456b6c89543984ba67fa5716cc144e2b5e9e9b3c11
SHA5124c61f777bef89be7a89c95ebd6e82bfc67f49ba8a2e5e1995e570ccf45ec43609a461fb072f44882e2766ac4db44468694d1b561939e68cac3b36d37988ad96f
-
Filesize
1.5MB
MD556d85d7003505c771b2e9dbde94cc198
SHA18a4415d69ac95281fb8ed7b23f5ef8ac7f2987d1
SHA2560d90251790d8886dedb79129a8cdfad69b44675cfe6f7c4924f69bdff18f69e0
SHA512113c511dbe49a61ebcedf9900adf814039be639392f7408d581b7e80448cd6881985a4649b8d9ac9998d835d3c3bc5a3164d6a91a9ba5dae84aaab38376acd27
-
Filesize
1.5MB
MD556d85d7003505c771b2e9dbde94cc198
SHA18a4415d69ac95281fb8ed7b23f5ef8ac7f2987d1
SHA2560d90251790d8886dedb79129a8cdfad69b44675cfe6f7c4924f69bdff18f69e0
SHA512113c511dbe49a61ebcedf9900adf814039be639392f7408d581b7e80448cd6881985a4649b8d9ac9998d835d3c3bc5a3164d6a91a9ba5dae84aaab38376acd27
-
Filesize
1.5MB
MD556d85d7003505c771b2e9dbde94cc198
SHA18a4415d69ac95281fb8ed7b23f5ef8ac7f2987d1
SHA2560d90251790d8886dedb79129a8cdfad69b44675cfe6f7c4924f69bdff18f69e0
SHA512113c511dbe49a61ebcedf9900adf814039be639392f7408d581b7e80448cd6881985a4649b8d9ac9998d835d3c3bc5a3164d6a91a9ba5dae84aaab38376acd27
-
Filesize
702KB
MD58f73724c3cdc2f735e448aa950a5908a
SHA1be803a6d3e2b4f28f14869f198a67c3cad81246d
SHA25616e4788811c91608db8ec06b02d0de955557c88d8b6f2c16e54f6b863aecbe2a
SHA512ffbc21e390e9109e7370a305aa4027ae294d5173a4ec792c2acb70027ecd6a13c6cd0de10b90e8092289939a392a7b8511e2567d8bc6fade72e19df11b052b54
-
Filesize
263KB
MD5087f605952660f57198f90625324dba1
SHA12e1e5f0132c7bc6df36cde8debfc6fa7adfb6b54
SHA25652c532141e36ddbfe58424781827f8996b18a86fdf6d088f95fe063cf9c4f4cd
SHA51238e2d5ff20f814c94d5abe5f3b53f8480c64f78e2e2b57ce864d421f9fece1fc04c093ceee1449bde66392894bd7c07d25e4692a4c0337f05fd021e7f5fff103
-
Filesize
263KB
MD5087f605952660f57198f90625324dba1
SHA12e1e5f0132c7bc6df36cde8debfc6fa7adfb6b54
SHA25652c532141e36ddbfe58424781827f8996b18a86fdf6d088f95fe063cf9c4f4cd
SHA51238e2d5ff20f814c94d5abe5f3b53f8480c64f78e2e2b57ce864d421f9fece1fc04c093ceee1449bde66392894bd7c07d25e4692a4c0337f05fd021e7f5fff103
-
Filesize
9KB
MD5f42cdab2210d9a340f758cb8843dcac5
SHA1626d020e25676d3436ccfa056c38ebb332208479
SHA256501abb44e1a98f70920a0ecccd8ee76b3d48e87b8b2c550a61dcbeb10f53d59e
SHA51252d569b17559fe68758fc8f99832005c8524d5d43e62eff7a40fd576094cd21cf143404b69a7909fe2eeb26bdbfe5a44af82990a2a8a78d5b02d49cc7ce05a61
-
Filesize
6.9MB
MD576827e19ac4b6c300c8bc37754b321a9
SHA160f1144731e4e8e98d22a59df821256307c26364
SHA256a95f207ca6b9ff09a248614ae30b3ddfbe1aaad61ccca7438451fdaa879b0c8b
SHA512beb2072de102d2d4d5925bd63925faa00828ad5e14f152d01544902e58293fb012991b6c614c3ff87c0928f4782b02f0302faff0f9fc0c672f4a9a1793bbc81b
-
Filesize
6.9MB
MD576827e19ac4b6c300c8bc37754b321a9
SHA160f1144731e4e8e98d22a59df821256307c26364
SHA256a95f207ca6b9ff09a248614ae30b3ddfbe1aaad61ccca7438451fdaa879b0c8b
SHA512beb2072de102d2d4d5925bd63925faa00828ad5e14f152d01544902e58293fb012991b6c614c3ff87c0928f4782b02f0302faff0f9fc0c672f4a9a1793bbc81b
-
Filesize
1.6MB
MD54e808bd83cc5ecf45163fc7942657a1a
SHA135cf5e55111a95a8d67f14d6efe80f46c240159a
SHA256a6ccc5b32f422b74b2fe68456b6c89543984ba67fa5716cc144e2b5e9e9b3c11
SHA5124c61f777bef89be7a89c95ebd6e82bfc67f49ba8a2e5e1995e570ccf45ec43609a461fb072f44882e2766ac4db44468694d1b561939e68cac3b36d37988ad96f
-
Filesize
1.6MB
MD54e808bd83cc5ecf45163fc7942657a1a
SHA135cf5e55111a95a8d67f14d6efe80f46c240159a
SHA256a6ccc5b32f422b74b2fe68456b6c89543984ba67fa5716cc144e2b5e9e9b3c11
SHA5124c61f777bef89be7a89c95ebd6e82bfc67f49ba8a2e5e1995e570ccf45ec43609a461fb072f44882e2766ac4db44468694d1b561939e68cac3b36d37988ad96f
-
Filesize
3.8MB
MD5e60a475bd1f3fd8ef26341406da4ddaa
SHA13478887290966bf94525dfed829746b39731e627
SHA256859bbdd2ab0e14cbfe3a951fad3ec723984d962f74f17813220abc8887fd3338
SHA512424164da27f9750764eb08ec30468f9e036fae9f5b59181054c4c2e1ba4d1d710e06d49409e608fbeec14b0efc60e726254b7280c848f9f3ec95f3dbb00d91f3
-
Filesize
3.8MB
MD5e60a475bd1f3fd8ef26341406da4ddaa
SHA13478887290966bf94525dfed829746b39731e627
SHA256859bbdd2ab0e14cbfe3a951fad3ec723984d962f74f17813220abc8887fd3338
SHA512424164da27f9750764eb08ec30468f9e036fae9f5b59181054c4c2e1ba4d1d710e06d49409e608fbeec14b0efc60e726254b7280c848f9f3ec95f3dbb00d91f3
-
Filesize
3.8MB
MD5e60a475bd1f3fd8ef26341406da4ddaa
SHA13478887290966bf94525dfed829746b39731e627
SHA256859bbdd2ab0e14cbfe3a951fad3ec723984d962f74f17813220abc8887fd3338
SHA512424164da27f9750764eb08ec30468f9e036fae9f5b59181054c4c2e1ba4d1d710e06d49409e608fbeec14b0efc60e726254b7280c848f9f3ec95f3dbb00d91f3
-
Filesize
3.8MB
MD5e60a475bd1f3fd8ef26341406da4ddaa
SHA13478887290966bf94525dfed829746b39731e627
SHA256859bbdd2ab0e14cbfe3a951fad3ec723984d962f74f17813220abc8887fd3338
SHA512424164da27f9750764eb08ec30468f9e036fae9f5b59181054c4c2e1ba4d1d710e06d49409e608fbeec14b0efc60e726254b7280c848f9f3ec95f3dbb00d91f3