Analysis
-
max time kernel
152s -
max time network
98s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
01-12-2022 20:03
Behavioral task
behavioral1
Sample
b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe
Resource
win7-20221111-en
windows7-x64
10 signatures
150 seconds
General
-
Target
b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe
-
Size
7.3MB
-
MD5
350c42bd1a021e22f9a396601c5ca213
-
SHA1
808473f235f936e8e468d5e5c9aee34f03a3c3c0
-
SHA256
b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10
-
SHA512
fc366d7401425e53238ccf91e6ff9ce32a334d876702b8148a184699eca680214cf08197cc16632e5991059409ad0b90f8df2ced09567850f137ce71296b7800
-
SSDEEP
196608:iX1C2NKHRUn/cfzIauB6/ajo+QKvuyV8NAmY:a1d/cfzr/aKKvuyIAmY
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe -
Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\H: b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe File opened (read-only) \??\R: b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe File opened (read-only) \??\U: b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe File opened (read-only) \??\N: b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe File opened (read-only) \??\P: b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe File opened (read-only) \??\S: b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe File opened (read-only) \??\W: b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe File opened (read-only) \??\X: b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe File opened (read-only) \??\E: b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe File opened (read-only) \??\F: b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe File opened (read-only) \??\G: b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe File opened (read-only) \??\J: b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe File opened (read-only) \??\K: b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe File opened (read-only) \??\Q: b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe File opened (read-only) \??\O: b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe File opened (read-only) \??\T: b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe File opened (read-only) \??\V: b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe File opened (read-only) \??\Y: b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe File opened (read-only) \??\Z: b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe File opened (read-only) \??\I: b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe File opened (read-only) \??\L: b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe File opened (read-only) \??\M: b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\MenuExt b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\MenuExt\+ Offline E&xplorer: Download the current page b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\MenuExt\+ Offline E&xplorer: Download the current page\contexts = "243" b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MAXCONNECTIONSPERSERVER\b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe = "10" b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MAXCONNECTIONSPER1_0SERVER\b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe = "10" b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\MenuExt\+ Offline &Explorer: Download the link b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\MenuExt\+ Offline &Explorer: Download the link\contexts = "34" b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\MenuExt\+ Offline E&xplorer: Download the current page\ = "file://C:\\Users\\Admin\\AppData\\Local\\Temp\\Add_AllO.htm" b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MAXCONNECTIONSPER1_0SERVER b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\MenuExt\+ Offline &Explorer: Download the link\ = "file://C:\\Users\\Admin\\AppData\\Local\\Temp\\Add_UrlO.htm" b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MAXCONNECTIONSPERSERVER b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe -
Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{363569E1-0A87-4617-A7DC-210049609433}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe" b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\OE.OEConnection b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\OE.OEConnection\ = "OEConnection Object" b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Offline Explorer Backup file\shell b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{271F3C24-5446-11D5-8C6F-00C0DF030E23} b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{FEB83DA8-ADDA-48D8-A460-9E399ACD99C9}\TypeLib b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FEB83DA8-ADDA-48D8-A460-9E399ACD99C9}\TypeLib b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Offline Explorer Sequencer file\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe,0" b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Offline Explorer Sequencer file\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe %1" b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EB7B9783-51DF-11D5-8C6F-00C0DF030E23}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{271F3C24-5446-11D5-8C6F-00C0DF030E23}\ProxyStubClsid32 b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{772627C2-544A-11D5-8C6F-00C0DF030E23}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{271F3C28-5446-11D5-8C6F-00C0DF030E23} b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6BCF698C-278D-4281-83F5-A9B6318FD4F2}\ = "IOESequencerEvents" b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6BCF698C-278D-4281-83F5-A9B6318FD4F2}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EB7B9783-51DF-11D5-8C6F-00C0DF030E23}\TypeLib\Version = "1.0" b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{271F3C26-5446-11D5-8C6F-00C0DF030E23}\TypeLib b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{772627C2-544A-11D5-8C6F-00C0DF030E23} b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe Key created \REGISTRY\MACHINE\Software\CLASSES\Offline Explorer Backup file b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.soe b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{772627C0-544A-11D5-8C6F-00C0DF030E23}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{FEB83DA8-ADDA-48D8-A460-9E399ACD99C9}\ = "IOESequencer" b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\OE.MainOE\Clsid b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\OE.OEFolder b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{35DBDEE2-59CC-11D5-8C6F-00C0DF030E23}\Version b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FEB83DA8-ADDA-48D8-A460-9E399ACD99C9}\TypeLib\ = "{EB7B9780-51DF-11D5-8C6F-00C0DF030E23}" b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6BCF698C-278D-4281-83F5-A9B6318FD4F2}\TypeLib\Version = "1.0" b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EB7B9785-51DF-11D5-8C6F-00C0DF030E23}\Version\ = "1.0" b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Offline Explorer Queue file b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{271F3C26-5446-11D5-8C6F-00C0DF030E23}\ProxyStubClsid32 b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{35DBDEE0-59CC-11D5-8C6F-00C0DF030E23}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6BCF698C-278D-4281-83F5-A9B6318FD4F2} b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{363569E1-0A87-4617-A7DC-210049609433}\TypeLib\ = "{EB7B9780-51DF-11D5-8C6F-00C0DF030E23}" b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{35DBDEE2-59CC-11D5-8C6F-00C0DF030E23}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe" b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EB7B9783-51DF-11D5-8C6F-00C0DF030E23}\TypeLib b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{772627C0-544A-11D5-8C6F-00C0DF030E23}\TypeLib b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{35DBDEE0-59CC-11D5-8C6F-00C0DF030E23} b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{772627C0-544A-11D5-8C6F-00C0DF030E23}\ = "IOEFolder" b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Offline Explorer Backup file\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe,0" b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Offline Explorer Backup file\shell\open b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{EB7B9780-51DF-11D5-8C6F-00C0DF030E23}\1.0\0 b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe Key created \REGISTRY\MACHINE\Software\CLASSES\Offline Explorer Backup file\shell\open\command b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EB7B9783-51DF-11D5-8C6F-00C0DF030E23}\ = "IMainOEEvents" b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EB7B9783-51DF-11D5-8C6F-00C0DF030E23}\TypeLib\ = "{EB7B9780-51DF-11D5-8C6F-00C0DF030E23}" b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{271F3C28-5446-11D5-8C6F-00C0DF030E23}\Version b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EB7B9781-51DF-11D5-8C6F-00C0DF030E23}\ = "IMainOE" b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{35DBDEE2-59CC-11D5-8C6F-00C0DF030E23}\ = "OEProject Object" b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe Key created \REGISTRY\MACHINE\Software\CLASSES\.boe b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{363569E1-0A87-4617-A7DC-210049609433}\Version\ = "1.0" b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Offline Explorer Queue file\DefaultIcon b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{EB7B9780-51DF-11D5-8C6F-00C0DF030E23}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe" b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{271F3C24-5446-11D5-8C6F-00C0DF030E23}\TypeLib b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{271F3C26-5446-11D5-8C6F-00C0DF030E23} b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EB7B9785-51DF-11D5-8C6F-00C0DF030E23}\ProgID\ = "OE.MainOE" b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EB7B9781-51DF-11D5-8C6F-00C0DF030E23}\TypeLib\ = "{EB7B9780-51DF-11D5-8C6F-00C0DF030E23}" b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{772627C0-544A-11D5-8C6F-00C0DF030E23} b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{35DBDEE0-59CC-11D5-8C6F-00C0DF030E23}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe Key created \REGISTRY\MACHINE\Software\CLASSES\Offline Explorer Sequencer file\shell\open\command b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FEB83DA8-ADDA-48D8-A460-9E399ACD99C9}\ = "IOESequencer" b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\OE.OESequencer\Clsid\ = "{363569E1-0A87-4617-A7DC-210049609433}" b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wdq b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{35DBDEE2-59CC-11D5-8C6F-00C0DF030E23} b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{35DBDEE2-59CC-11D5-8C6F-00C0DF030E23}\LocalServer32 b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\OE.OEProject\Clsid\ = "{35DBDEE2-59CC-11D5-8C6F-00C0DF030E23}" b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: 33 1640 b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe Token: SeIncBasePriorityPrivilege 1640 b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1640 b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe 1640 b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe 1640 b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe 1640 b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe 1640 b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe 1640 b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe 1640 b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe 1640 b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe 1640 b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe 1640 b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe 1640 b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe 1640 b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe 1640 b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe 1640 b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe 1640 b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe 1640 b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe 1640 b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe 1640 b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe 1640 b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe 1640 b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe 1640 b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe 1640 b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe 1640 b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe 1640 b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe 1640 b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe 1640 b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe 1640 b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe 1640 b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe 1640 b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe 1640 b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe 1640 b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe 1640 b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe 1640 b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe 1640 b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe 1640 b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe 1640 b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe 1640 b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe 1640 b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe 1640 b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe 1640 b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe 1640 b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe 1640 b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe 1640 b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe 1640 b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe 1640 b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe 1640 b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe 1640 b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe 1640 b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe 1640 b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe 1640 b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe 1640 b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe 1640 b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe 1640 b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe 1640 b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe 1640 b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe 1640 b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe 1640 b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe 1640 b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe 1640 b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe 1640 b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe 1640 b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe 1640 b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe 1640 b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe 1640 b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 1640 b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe 1640 b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe 1640 b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe 1640 b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe 1640 b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe 1640 b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe 1640 b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe 1640 b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe 1640 b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe 1640 b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe 1640 b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe 1640 b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe 1640 b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe 1640 b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe 1640 b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe 1640 b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe 1640 b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe 1640 b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe 1640 b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe 1640 b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe 1640 b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe 1640 b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe 1640 b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe 1640 b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe 1640 b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe 1640 b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe 1640 b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe 1640 b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe 1640 b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe 1640 b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe 1640 b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe 1640 b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe 1640 b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe 1640 b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe 1640 b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe 1640 b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe 1640 b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe 1640 b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe 1640 b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe 1640 b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe 1640 b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe 1640 b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe 1640 b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe 1640 b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe 1640 b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe 1640 b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe 1640 b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe 1640 b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe 1640 b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe 1640 b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe 1640 b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe 1640 b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe 1640 b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe 1640 b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe 1640 b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe 1640 b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe 1640 b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe 1640 b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe 1640 b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe 1640 b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe 1640 b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe 1640 b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe 1640 b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe 1640 b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1640 b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe 1640 b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe 1640 b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe 1640 b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe 1640 b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe 1640 b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe"C:\Users\Admin\AppData\Local\Temp\b30763699ceca0a6130f7d3bee2d37ac05b67603739eef50bc1097b56e8eec10.exe"1⤵
- Checks whether UAC is enabled
- Enumerates connected drives
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1640