Analysis
-
max time kernel
137s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
01-12-2022 15:57
Static task
static1
Behavioral task
behavioral1
Sample
d55db3e1a122d2193f804f76a3ed2cb3.exe
Resource
win7-20220901-en
General
-
Target
d55db3e1a122d2193f804f76a3ed2cb3.exe
-
Size
448KB
-
MD5
d55db3e1a122d2193f804f76a3ed2cb3
-
SHA1
c101298055a396fee1d26220c2655125065e9fe6
-
SHA256
5107b9fda1ce6e7c51fb52d7928c49a82731ff4fc3c75d700737ce3c2f274044
-
SHA512
fab4122e82639b7acab49ee77f54c76edcf116b946b12a8a3915d5f3fc32e43ccb1b53685899f8f2f2ec31dfb2d59b3e3e4cae0ea62574e5eddf55595f38638c
-
SSDEEP
6144:xoR0EvklriDeO8pZIgVBcY/LfSSk0MeYFuRWYsraTkxAJAJ9U8sgutf2iddj5XDw:uW68NVBcY+SCY+3xAJAJ+f2E5eJQ9jq
Malware Config
Extracted
remcos
1.7 Pro
Dec 1st
terzona2022.duckdns.org:3030
-
audio_folder
audio
-
audio_path
%AppData%
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
5
-
copy_file
Windows input text.exe
-
copy_folder
Microsoft Text
-
delete_file
false
-
hide_file
true
-
hide_keylog_file
true
-
install_flag
true
-
install_path
%WinDir%
-
keylog_crypt
true
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
Windows Display
-
keylog_path
%WinDir%
-
mouse_option
false
-
mutex
Windows Audio
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screens
-
screenshot_path
%AppData%
-
screenshot_time
1
-
startup_value
Microsoft Sound Text
-
take_screenshot_option
true
-
take_screenshot_time
5
-
take_screenshot_title
Username;password;proforma;invoice;notepad
Signatures
-
Processes:
reg.exereg.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe -
Executes dropped EXE 2 IoCs
Processes:
Windows input text.exeWindows input text.exepid process 1872 Windows input text.exe 1096 Windows input text.exe -
Loads dropped DLL 1 IoCs
Processes:
cmd.exepid process 1720 cmd.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
Windows input text.exed55db3e1a122d2193f804f76a3ed2cb3.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\ Windows input text.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft Sound Text = "\"C:\\Windows\\Microsoft Text\\Windows input text.exe\"" Windows input text.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\ d55db3e1a122d2193f804f76a3ed2cb3.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft Sound Text = "\"C:\\Windows\\Microsoft Text\\Windows input text.exe\"" d55db3e1a122d2193f804f76a3ed2cb3.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
d55db3e1a122d2193f804f76a3ed2cb3.exeWindows input text.exeWindows input text.exedescription pid process target process PID 1396 set thread context of 280 1396 d55db3e1a122d2193f804f76a3ed2cb3.exe d55db3e1a122d2193f804f76a3ed2cb3.exe PID 1872 set thread context of 1096 1872 Windows input text.exe Windows input text.exe PID 1096 set thread context of 1820 1096 Windows input text.exe iexplore.exe -
Drops file in Windows directory 3 IoCs
Processes:
d55db3e1a122d2193f804f76a3ed2cb3.exedescription ioc process File opened for modification C:\Windows\Microsoft Text d55db3e1a122d2193f804f76a3ed2cb3.exe File created C:\Windows\Microsoft Text\Windows input text.exe d55db3e1a122d2193f804f76a3ed2cb3.exe File opened for modification C:\Windows\Microsoft Text\Windows input text.exe d55db3e1a122d2193f804f76a3ed2cb3.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000095072a42c5094c47a358496371bb0401000000000200000000001066000000010000200000000be7a64f0d35f9c30f954c4cce2ecd11e5e7ad9749d74531d943f7895913e776000000000e8000000002000020000000f953f34d7b191cbdc4f3cc15eb980a6988eba5bd85a4961ae5c12f9f3e96ae1a20000000894d99f0f8950d149ab4461b1dd6fb3c9be62cbea077faded21239a5ddb6faff4000000014c881e5e1a26b042da42aea9908a28823cc92c2366cfb12bb8ca9252314f39b1fd09c0f4b396b57f2c8cbae65cf5939086c56ef86c3dd8044122b4e84e414ae iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{11D49B01-7191-11ED-B63A-76C12A601AFA} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000095072a42c5094c47a358496371bb040100000000020000000000106600000001000020000000420b43844f8e8083ef712f9cd33f73184c389dd1ea8c27b6d6cf9c39ef168c08000000000e8000000002000020000000650d46383c727a98a6fad750b1c08102236462f6af3341742158124a1f70caa29000000091e837e96c97fc2f334e20a024e1181e2662b4c63a22bb0577ec742156b17d52c28e31231599bde46cf7449b23b6f705f42eac5ebc2473343146bca8bfe948da5787851b75ff3c2cc0d4378aa3227293d3365ceeb4b6501830288399f8f83647c190128e49afdb0c6eacab7ebe8d560cdc7558c798c6c45998b6a8ffa55ab61315ba9eba5b8214e10917e878350c90fa40000000ec463d3f4a7bb6ee9d6ba3d07a72860c97be57e619b85401fcd93a7907c23e947e49123b7de952ff4ffcd0e153f21499410e5b3173045d13b48878f17bc59efa iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60fc55ed9d05d901 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe -
Modifies registry key 1 TTPs 2 IoCs
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
d55db3e1a122d2193f804f76a3ed2cb3.exepid process 1396 d55db3e1a122d2193f804f76a3ed2cb3.exe 1396 d55db3e1a122d2193f804f76a3ed2cb3.exe 1396 d55db3e1a122d2193f804f76a3ed2cb3.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
d55db3e1a122d2193f804f76a3ed2cb3.exedescription pid process Token: SeDebugPrivilege 1396 d55db3e1a122d2193f804f76a3ed2cb3.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 284 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 284 iexplore.exe 284 iexplore.exe 1604 IEXPLORE.EXE 1604 IEXPLORE.EXE 1604 IEXPLORE.EXE 1604 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
d55db3e1a122d2193f804f76a3ed2cb3.exed55db3e1a122d2193f804f76a3ed2cb3.execmd.execmd.exeWindows input text.exeWindows input text.execmd.exedescription pid process target process PID 1396 wrote to memory of 580 1396 d55db3e1a122d2193f804f76a3ed2cb3.exe d55db3e1a122d2193f804f76a3ed2cb3.exe PID 1396 wrote to memory of 580 1396 d55db3e1a122d2193f804f76a3ed2cb3.exe d55db3e1a122d2193f804f76a3ed2cb3.exe PID 1396 wrote to memory of 580 1396 d55db3e1a122d2193f804f76a3ed2cb3.exe d55db3e1a122d2193f804f76a3ed2cb3.exe PID 1396 wrote to memory of 580 1396 d55db3e1a122d2193f804f76a3ed2cb3.exe d55db3e1a122d2193f804f76a3ed2cb3.exe PID 1396 wrote to memory of 672 1396 d55db3e1a122d2193f804f76a3ed2cb3.exe d55db3e1a122d2193f804f76a3ed2cb3.exe PID 1396 wrote to memory of 672 1396 d55db3e1a122d2193f804f76a3ed2cb3.exe d55db3e1a122d2193f804f76a3ed2cb3.exe PID 1396 wrote to memory of 672 1396 d55db3e1a122d2193f804f76a3ed2cb3.exe d55db3e1a122d2193f804f76a3ed2cb3.exe PID 1396 wrote to memory of 672 1396 d55db3e1a122d2193f804f76a3ed2cb3.exe d55db3e1a122d2193f804f76a3ed2cb3.exe PID 1396 wrote to memory of 772 1396 d55db3e1a122d2193f804f76a3ed2cb3.exe d55db3e1a122d2193f804f76a3ed2cb3.exe PID 1396 wrote to memory of 772 1396 d55db3e1a122d2193f804f76a3ed2cb3.exe d55db3e1a122d2193f804f76a3ed2cb3.exe PID 1396 wrote to memory of 772 1396 d55db3e1a122d2193f804f76a3ed2cb3.exe d55db3e1a122d2193f804f76a3ed2cb3.exe PID 1396 wrote to memory of 772 1396 d55db3e1a122d2193f804f76a3ed2cb3.exe d55db3e1a122d2193f804f76a3ed2cb3.exe PID 1396 wrote to memory of 280 1396 d55db3e1a122d2193f804f76a3ed2cb3.exe d55db3e1a122d2193f804f76a3ed2cb3.exe PID 1396 wrote to memory of 280 1396 d55db3e1a122d2193f804f76a3ed2cb3.exe d55db3e1a122d2193f804f76a3ed2cb3.exe PID 1396 wrote to memory of 280 1396 d55db3e1a122d2193f804f76a3ed2cb3.exe d55db3e1a122d2193f804f76a3ed2cb3.exe PID 1396 wrote to memory of 280 1396 d55db3e1a122d2193f804f76a3ed2cb3.exe d55db3e1a122d2193f804f76a3ed2cb3.exe PID 1396 wrote to memory of 280 1396 d55db3e1a122d2193f804f76a3ed2cb3.exe d55db3e1a122d2193f804f76a3ed2cb3.exe PID 1396 wrote to memory of 280 1396 d55db3e1a122d2193f804f76a3ed2cb3.exe d55db3e1a122d2193f804f76a3ed2cb3.exe PID 1396 wrote to memory of 280 1396 d55db3e1a122d2193f804f76a3ed2cb3.exe d55db3e1a122d2193f804f76a3ed2cb3.exe PID 1396 wrote to memory of 280 1396 d55db3e1a122d2193f804f76a3ed2cb3.exe d55db3e1a122d2193f804f76a3ed2cb3.exe PID 1396 wrote to memory of 280 1396 d55db3e1a122d2193f804f76a3ed2cb3.exe d55db3e1a122d2193f804f76a3ed2cb3.exe PID 1396 wrote to memory of 280 1396 d55db3e1a122d2193f804f76a3ed2cb3.exe d55db3e1a122d2193f804f76a3ed2cb3.exe PID 280 wrote to memory of 1764 280 d55db3e1a122d2193f804f76a3ed2cb3.exe cmd.exe PID 280 wrote to memory of 1764 280 d55db3e1a122d2193f804f76a3ed2cb3.exe cmd.exe PID 280 wrote to memory of 1764 280 d55db3e1a122d2193f804f76a3ed2cb3.exe cmd.exe PID 280 wrote to memory of 1764 280 d55db3e1a122d2193f804f76a3ed2cb3.exe cmd.exe PID 1764 wrote to memory of 564 1764 cmd.exe reg.exe PID 1764 wrote to memory of 564 1764 cmd.exe reg.exe PID 1764 wrote to memory of 564 1764 cmd.exe reg.exe PID 1764 wrote to memory of 564 1764 cmd.exe reg.exe PID 280 wrote to memory of 1720 280 d55db3e1a122d2193f804f76a3ed2cb3.exe cmd.exe PID 280 wrote to memory of 1720 280 d55db3e1a122d2193f804f76a3ed2cb3.exe cmd.exe PID 280 wrote to memory of 1720 280 d55db3e1a122d2193f804f76a3ed2cb3.exe cmd.exe PID 280 wrote to memory of 1720 280 d55db3e1a122d2193f804f76a3ed2cb3.exe cmd.exe PID 280 wrote to memory of 1720 280 d55db3e1a122d2193f804f76a3ed2cb3.exe cmd.exe PID 280 wrote to memory of 1720 280 d55db3e1a122d2193f804f76a3ed2cb3.exe cmd.exe PID 280 wrote to memory of 1720 280 d55db3e1a122d2193f804f76a3ed2cb3.exe cmd.exe PID 1720 wrote to memory of 1328 1720 cmd.exe PING.EXE PID 1720 wrote to memory of 1328 1720 cmd.exe PING.EXE PID 1720 wrote to memory of 1328 1720 cmd.exe PING.EXE PID 1720 wrote to memory of 1328 1720 cmd.exe PING.EXE PID 1720 wrote to memory of 1872 1720 cmd.exe Windows input text.exe PID 1720 wrote to memory of 1872 1720 cmd.exe Windows input text.exe PID 1720 wrote to memory of 1872 1720 cmd.exe Windows input text.exe PID 1720 wrote to memory of 1872 1720 cmd.exe Windows input text.exe PID 1872 wrote to memory of 1096 1872 Windows input text.exe Windows input text.exe PID 1872 wrote to memory of 1096 1872 Windows input text.exe Windows input text.exe PID 1872 wrote to memory of 1096 1872 Windows input text.exe Windows input text.exe PID 1872 wrote to memory of 1096 1872 Windows input text.exe Windows input text.exe PID 1872 wrote to memory of 1096 1872 Windows input text.exe Windows input text.exe PID 1872 wrote to memory of 1096 1872 Windows input text.exe Windows input text.exe PID 1872 wrote to memory of 1096 1872 Windows input text.exe Windows input text.exe PID 1872 wrote to memory of 1096 1872 Windows input text.exe Windows input text.exe PID 1872 wrote to memory of 1096 1872 Windows input text.exe Windows input text.exe PID 1872 wrote to memory of 1096 1872 Windows input text.exe Windows input text.exe PID 1096 wrote to memory of 1880 1096 Windows input text.exe cmd.exe PID 1096 wrote to memory of 1880 1096 Windows input text.exe cmd.exe PID 1096 wrote to memory of 1880 1096 Windows input text.exe cmd.exe PID 1096 wrote to memory of 1880 1096 Windows input text.exe cmd.exe PID 1880 wrote to memory of 1996 1880 cmd.exe reg.exe PID 1880 wrote to memory of 1996 1880 cmd.exe reg.exe PID 1880 wrote to memory of 1996 1880 cmd.exe reg.exe PID 1880 wrote to memory of 1996 1880 cmd.exe reg.exe PID 1096 wrote to memory of 1820 1096 Windows input text.exe iexplore.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d55db3e1a122d2193f804f76a3ed2cb3.exe"C:\Users\Admin\AppData\Local\Temp\d55db3e1a122d2193f804f76a3ed2cb3.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1396 -
C:\Users\Admin\AppData\Local\Temp\d55db3e1a122d2193f804f76a3ed2cb3.exe"C:\Users\Admin\AppData\Local\Temp\d55db3e1a122d2193f804f76a3ed2cb3.exe"2⤵PID:580
-
C:\Users\Admin\AppData\Local\Temp\d55db3e1a122d2193f804f76a3ed2cb3.exe"C:\Users\Admin\AppData\Local\Temp\d55db3e1a122d2193f804f76a3ed2cb3.exe"2⤵PID:672
-
C:\Users\Admin\AppData\Local\Temp\d55db3e1a122d2193f804f76a3ed2cb3.exe"C:\Users\Admin\AppData\Local\Temp\d55db3e1a122d2193f804f76a3ed2cb3.exe"2⤵PID:772
-
C:\Users\Admin\AppData\Local\Temp\d55db3e1a122d2193f804f76a3ed2cb3.exe"C:\Users\Admin\AppData\Local\Temp\d55db3e1a122d2193f804f76a3ed2cb3.exe"2⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:280 -
C:\Windows\SysWOW64\cmd.exe/k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f3⤵
- Suspicious use of WriteProcessMemory
PID:1764 -
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f4⤵
- UAC bypass
- Modifies registry key
PID:564 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\install.bat" "3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1720 -
C:\Windows\SysWOW64\PING.EXEPING 127.0.0.1 -n 24⤵
- Runs ping.exe
PID:1328 -
C:\Windows\Microsoft Text\Windows input text.exe"C:\Windows\Microsoft Text\Windows input text.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1872 -
C:\Windows\Microsoft Text\Windows input text.exe"C:\Windows\Microsoft Text\Windows input text.exe"5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1096 -
C:\Windows\SysWOW64\cmd.exe/k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f6⤵
- Suspicious use of WriteProcessMemory
PID:1880 -
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f7⤵
- UAC bypass
- Modifies registry key
PID:1996 -
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"6⤵PID:1820
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=iexplore.exe&platform=0009&osver=5&isServer=0&shimver=4.0.30319.07⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:284 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:284 CREDAT:275457 /prefetch:28⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1604
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\install.batFilesize
99B
MD5cd13321bdef41f7575c97a6c302668c1
SHA1f7de6ac53a6914dde55fe408c67ec934686ecc9f
SHA2562e7ff7169fe44c0360335a47264f1963bb65ae1ca3f93a20922074f143491dc8
SHA51275ea823f45820f7bc118f8f982faee3b4ede68ab42958723647c356b9f667026d37c75702f4360bc38e19b44efbf4d9bf574e8b65f6a8ef37139216041ab234b
-
C:\Windows\Microsoft Text\Windows input text.exeFilesize
448KB
MD5d55db3e1a122d2193f804f76a3ed2cb3
SHA1c101298055a396fee1d26220c2655125065e9fe6
SHA2565107b9fda1ce6e7c51fb52d7928c49a82731ff4fc3c75d700737ce3c2f274044
SHA512fab4122e82639b7acab49ee77f54c76edcf116b946b12a8a3915d5f3fc32e43ccb1b53685899f8f2f2ec31dfb2d59b3e3e4cae0ea62574e5eddf55595f38638c
-
C:\Windows\Microsoft Text\Windows input text.exeFilesize
448KB
MD5d55db3e1a122d2193f804f76a3ed2cb3
SHA1c101298055a396fee1d26220c2655125065e9fe6
SHA2565107b9fda1ce6e7c51fb52d7928c49a82731ff4fc3c75d700737ce3c2f274044
SHA512fab4122e82639b7acab49ee77f54c76edcf116b946b12a8a3915d5f3fc32e43ccb1b53685899f8f2f2ec31dfb2d59b3e3e4cae0ea62574e5eddf55595f38638c
-
C:\Windows\Microsoft Text\Windows input text.exeFilesize
448KB
MD5d55db3e1a122d2193f804f76a3ed2cb3
SHA1c101298055a396fee1d26220c2655125065e9fe6
SHA2565107b9fda1ce6e7c51fb52d7928c49a82731ff4fc3c75d700737ce3c2f274044
SHA512fab4122e82639b7acab49ee77f54c76edcf116b946b12a8a3915d5f3fc32e43ccb1b53685899f8f2f2ec31dfb2d59b3e3e4cae0ea62574e5eddf55595f38638c
-
\Windows\Microsoft Text\Windows input text.exeFilesize
448KB
MD5d55db3e1a122d2193f804f76a3ed2cb3
SHA1c101298055a396fee1d26220c2655125065e9fe6
SHA2565107b9fda1ce6e7c51fb52d7928c49a82731ff4fc3c75d700737ce3c2f274044
SHA512fab4122e82639b7acab49ee77f54c76edcf116b946b12a8a3915d5f3fc32e43ccb1b53685899f8f2f2ec31dfb2d59b3e3e4cae0ea62574e5eddf55595f38638c
-
memory/280-60-0x0000000000400000-0x0000000000417000-memory.dmpFilesize
92KB
-
memory/280-76-0x0000000000400000-0x0000000000417000-memory.dmpFilesize
92KB
-
memory/280-63-0x0000000000400000-0x0000000000417000-memory.dmpFilesize
92KB
-
memory/280-61-0x0000000000400000-0x0000000000417000-memory.dmpFilesize
92KB
-
memory/280-65-0x0000000000400000-0x0000000000417000-memory.dmpFilesize
92KB
-
memory/280-66-0x0000000000400000-0x0000000000417000-memory.dmpFilesize
92KB
-
memory/280-67-0x0000000000400000-0x0000000000417000-memory.dmpFilesize
92KB
-
memory/280-68-0x000000000040FD88-mapping.dmp
-
memory/280-71-0x0000000000400000-0x0000000000417000-memory.dmpFilesize
92KB
-
memory/280-72-0x0000000000400000-0x0000000000417000-memory.dmpFilesize
92KB
-
memory/564-74-0x0000000000000000-mapping.dmp
-
memory/1096-94-0x000000000040FD88-mapping.dmp
-
memory/1096-101-0x0000000000400000-0x0000000000417000-memory.dmpFilesize
92KB
-
memory/1096-98-0x0000000000400000-0x0000000000417000-memory.dmpFilesize
92KB
-
memory/1328-78-0x0000000000000000-mapping.dmp
-
memory/1396-55-0x00000000752B1000-0x00000000752B3000-memory.dmpFilesize
8KB
-
memory/1396-58-0x0000000004FA0000-0x0000000004FF6000-memory.dmpFilesize
344KB
-
memory/1396-57-0x0000000000470000-0x000000000047E000-memory.dmpFilesize
56KB
-
memory/1396-56-0x00000000003C0000-0x00000000003D6000-memory.dmpFilesize
88KB
-
memory/1396-54-0x0000000000310000-0x0000000000380000-memory.dmpFilesize
448KB
-
memory/1396-59-0x0000000001F00000-0x0000000001F1E000-memory.dmpFilesize
120KB
-
memory/1720-75-0x0000000000000000-mapping.dmp
-
memory/1764-73-0x0000000000000000-mapping.dmp
-
memory/1872-85-0x0000000000450000-0x0000000000466000-memory.dmpFilesize
88KB
-
memory/1872-83-0x0000000000E40000-0x0000000000EB0000-memory.dmpFilesize
448KB
-
memory/1872-81-0x0000000000000000-mapping.dmp
-
memory/1880-99-0x0000000000000000-mapping.dmp
-
memory/1996-100-0x0000000000000000-mapping.dmp