cd946f863145acbd83117ccb6ca83d5fe37207e3fa1d0751211ae5c6c0a21c04

General

Target

cd946f863145acbd83117ccb6ca83d5fe37207e3fa1d0751211ae5c6c0a21c04.exe
Size

149KB
MD5

2aca3f75294e962c8f5efab3326e9117
SHA1

81c045eb5f76697e786647b765d365d0262ab218
SHA256

cd946f863145acbd83117ccb6ca83d5fe37207e3fa1d0751211ae5c6c0a21c04
SHA512

f637604a0a76ac10a05770a79274d8e88f4c33c89beb7af83a3919471d4739020c235531f6b3c8c8039b543f71a51782d27cfcd6420f1a812c838a59ec85004e
SSDEEP

1536:RXcxTLIUH22hNPzEY0nbe6i4YrJENmjIDCJDGYygwtHZRzoeJPIHYZ0gr4OOUkN0:RRUB9zEY0beD4YbUGQYqXz/PIHjMRSu

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

cd946f863145acbd83117ccb6ca83d5fe37207e3fa1d0751211ae5c6c0a21c04.exemspaint.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Screen Saver Pro 3.1 = "C:\\Users\\Admin\\AppData\\Roaming\\ScreenSaverPro.scr"	cd946f863145acbd83117ccb6ca83d5fe37207e3fa1d0751211ae5c6c0a21c04.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Foooot = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Foooot.exe"	mspaint.exe

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

svchost.exemspaint.exe

description	ioc	process
File opened (read-only)	\??\E:	svchost.exe
File opened (read-only)	\??\H:	svchost.exe
File opened (read-only)	\??\K:	svchost.exe
File opened (read-only)	\??\L:	svchost.exe
File opened (read-only)	\??\O:	svchost.exe
File opened (read-only)	\??\U:	svchost.exe
File opened (read-only)	\??\V:	svchost.exe
File opened (read-only)	\??\B:	svchost.exe
File opened (read-only)	\??\N:	svchost.exe
File opened (read-only)	\??\P:	svchost.exe
File opened (read-only)	\??\R:	svchost.exe
File opened (read-only)	\??\S:	svchost.exe
File opened (read-only)	\??\T:	svchost.exe
File opened (read-only)	\??\Y:	svchost.exe
File opened (read-only)	\??\Z:	svchost.exe
File opened (read-only)	\??\I:	svchost.exe
File opened (read-only)	\??\W:	svchost.exe
File opened (read-only)	\??\D:	mspaint.exe
File opened (read-only)	\??\G:	svchost.exe
File opened (read-only)	\??\J:	svchost.exe
File opened (read-only)	\??\M:	svchost.exe
File opened (read-only)	\??\Q:	svchost.exe
File opened (read-only)	\??\X:	svchost.exe
File opened (read-only)	\??\F:	svchost.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

cd946f863145acbd83117ccb6ca83d5fe37207e3fa1d0751211ae5c6c0a21c04.execd946f863145acbd83117ccb6ca83d5fe37207e3fa1d0751211ae5c6c0a21c04.exe

description	pid	process	target process
PID 3400 set thread context of 3488	3400	cd946f863145acbd83117ccb6ca83d5fe37207e3fa1d0751211ae5c6c0a21c04.exe	cd946f863145acbd83117ccb6ca83d5fe37207e3fa1d0751211ae5c6c0a21c04.exe
PID 3488 set thread context of 4952	3488	cd946f863145acbd83117ccb6ca83d5fe37207e3fa1d0751211ae5c6c0a21c04.exe	cd946f863145acbd83117ccb6ca83d5fe37207e3fa1d0751211ae5c6c0a21c04.exe

Drops file in Windows directory 1 IoCs

Processes:

mspaint.exe

description ioc process

File opened for modification C:\Windows\Debug\WIA\wiatrace.log mspaint.exe

description	ioc	process
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe

Modifies Internet Explorer settings 1 TTPs 30 IoCs

adware spyware

Modify Registry

T1112

Processes:

IEXPLORE.EXEIEXPLORE.EXE

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "819523335"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31001876"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "377495748"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{3D54314A-7907-11ED-B696-FA09CB65A760} = "0"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31001876"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31001876"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "650461161"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "819523335"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "650461161"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31001876"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	IEXPLORE.EXE

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

mspaint.execd946f863145acbd83117ccb6ca83d5fe37207e3fa1d0751211ae5c6c0a21c04.exe

pid	process
4940	mspaint.exe
4940	mspaint.exe
4952	cd946f863145acbd83117ccb6ca83d5fe37207e3fa1d0751211ae5c6c0a21c04.exe
4952	cd946f863145acbd83117ccb6ca83d5fe37207e3fa1d0751211ae5c6c0a21c04.exe
4952	cd946f863145acbd83117ccb6ca83d5fe37207e3fa1d0751211ae5c6c0a21c04.exe

Suspicious behavior: RenamesItself 1 IoCs

Processes:

cd946f863145acbd83117ccb6ca83d5fe37207e3fa1d0751211ae5c6c0a21c04.exe

pid process

3488 cd946f863145acbd83117ccb6ca83d5fe37207e3fa1d0751211ae5c6c0a21c04.exe

pid	process
3488	cd946f863145acbd83117ccb6ca83d5fe37207e3fa1d0751211ae5c6c0a21c04.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

cd946f863145acbd83117ccb6ca83d5fe37207e3fa1d0751211ae5c6c0a21c04.exesvchost.exemspaint.exeIEXPLORE.EXE

description	pid	process
Token: SeDebugPrivilege	4952	cd946f863145acbd83117ccb6ca83d5fe37207e3fa1d0751211ae5c6c0a21c04.exe
Token: SeDebugPrivilege	1984	svchost.exe
Token: SeDebugPrivilege	4940	mspaint.exe
Token: SeDebugPrivilege	3884	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

IEXPLORE.EXE

pid process

4552 IEXPLORE.EXE

pid	process
4552	IEXPLORE.EXE

Suspicious use of SetWindowsHookEx 10 IoCs

Processes:

mspaint.exeIEXPLORE.EXEIEXPLORE.EXE

pid	process
4940	mspaint.exe
4940	mspaint.exe
4940	mspaint.exe
4940	mspaint.exe
4552	IEXPLORE.EXE
4552	IEXPLORE.EXE
3884	IEXPLORE.EXE
3884	IEXPLORE.EXE
3884	IEXPLORE.EXE
3884	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 41 IoCs

Processes:

cd946f863145acbd83117ccb6ca83d5fe37207e3fa1d0751211ae5c6c0a21c04.execd946f863145acbd83117ccb6ca83d5fe37207e3fa1d0751211ae5c6c0a21c04.exesvchost.execd946f863145acbd83117ccb6ca83d5fe37207e3fa1d0751211ae5c6c0a21c04.exeiexplore.exeIEXPLORE.EXE

description	pid	process	target process
PID 3400 wrote to memory of 3488	3400	cd946f863145acbd83117ccb6ca83d5fe37207e3fa1d0751211ae5c6c0a21c04.exe	cd946f863145acbd83117ccb6ca83d5fe37207e3fa1d0751211ae5c6c0a21c04.exe
PID 3400 wrote to memory of 3488	3400	cd946f863145acbd83117ccb6ca83d5fe37207e3fa1d0751211ae5c6c0a21c04.exe	cd946f863145acbd83117ccb6ca83d5fe37207e3fa1d0751211ae5c6c0a21c04.exe
PID 3400 wrote to memory of 3488	3400	cd946f863145acbd83117ccb6ca83d5fe37207e3fa1d0751211ae5c6c0a21c04.exe	cd946f863145acbd83117ccb6ca83d5fe37207e3fa1d0751211ae5c6c0a21c04.exe
PID 3400 wrote to memory of 3488	3400	cd946f863145acbd83117ccb6ca83d5fe37207e3fa1d0751211ae5c6c0a21c04.exe	cd946f863145acbd83117ccb6ca83d5fe37207e3fa1d0751211ae5c6c0a21c04.exe
PID 3400 wrote to memory of 3488	3400	cd946f863145acbd83117ccb6ca83d5fe37207e3fa1d0751211ae5c6c0a21c04.exe	cd946f863145acbd83117ccb6ca83d5fe37207e3fa1d0751211ae5c6c0a21c04.exe
PID 3400 wrote to memory of 3488	3400	cd946f863145acbd83117ccb6ca83d5fe37207e3fa1d0751211ae5c6c0a21c04.exe	cd946f863145acbd83117ccb6ca83d5fe37207e3fa1d0751211ae5c6c0a21c04.exe
PID 3400 wrote to memory of 3488	3400	cd946f863145acbd83117ccb6ca83d5fe37207e3fa1d0751211ae5c6c0a21c04.exe	cd946f863145acbd83117ccb6ca83d5fe37207e3fa1d0751211ae5c6c0a21c04.exe
PID 3400 wrote to memory of 3488	3400	cd946f863145acbd83117ccb6ca83d5fe37207e3fa1d0751211ae5c6c0a21c04.exe	cd946f863145acbd83117ccb6ca83d5fe37207e3fa1d0751211ae5c6c0a21c04.exe
PID 3400 wrote to memory of 3488	3400	cd946f863145acbd83117ccb6ca83d5fe37207e3fa1d0751211ae5c6c0a21c04.exe	cd946f863145acbd83117ccb6ca83d5fe37207e3fa1d0751211ae5c6c0a21c04.exe
PID 3488 wrote to memory of 1984	3488	cd946f863145acbd83117ccb6ca83d5fe37207e3fa1d0751211ae5c6c0a21c04.exe	svchost.exe
PID 3488 wrote to memory of 1984	3488	cd946f863145acbd83117ccb6ca83d5fe37207e3fa1d0751211ae5c6c0a21c04.exe	svchost.exe
PID 3488 wrote to memory of 1984	3488	cd946f863145acbd83117ccb6ca83d5fe37207e3fa1d0751211ae5c6c0a21c04.exe	svchost.exe
PID 3488 wrote to memory of 1984	3488	cd946f863145acbd83117ccb6ca83d5fe37207e3fa1d0751211ae5c6c0a21c04.exe	svchost.exe
PID 3488 wrote to memory of 1984	3488	cd946f863145acbd83117ccb6ca83d5fe37207e3fa1d0751211ae5c6c0a21c04.exe	svchost.exe
PID 3488 wrote to memory of 1984	3488	cd946f863145acbd83117ccb6ca83d5fe37207e3fa1d0751211ae5c6c0a21c04.exe	svchost.exe
PID 3488 wrote to memory of 4952	3488	cd946f863145acbd83117ccb6ca83d5fe37207e3fa1d0751211ae5c6c0a21c04.exe	cd946f863145acbd83117ccb6ca83d5fe37207e3fa1d0751211ae5c6c0a21c04.exe
PID 3488 wrote to memory of 4952	3488	cd946f863145acbd83117ccb6ca83d5fe37207e3fa1d0751211ae5c6c0a21c04.exe	cd946f863145acbd83117ccb6ca83d5fe37207e3fa1d0751211ae5c6c0a21c04.exe
PID 3488 wrote to memory of 4952	3488	cd946f863145acbd83117ccb6ca83d5fe37207e3fa1d0751211ae5c6c0a21c04.exe	cd946f863145acbd83117ccb6ca83d5fe37207e3fa1d0751211ae5c6c0a21c04.exe
PID 3488 wrote to memory of 4952	3488	cd946f863145acbd83117ccb6ca83d5fe37207e3fa1d0751211ae5c6c0a21c04.exe	cd946f863145acbd83117ccb6ca83d5fe37207e3fa1d0751211ae5c6c0a21c04.exe
PID 3488 wrote to memory of 4952	3488	cd946f863145acbd83117ccb6ca83d5fe37207e3fa1d0751211ae5c6c0a21c04.exe	cd946f863145acbd83117ccb6ca83d5fe37207e3fa1d0751211ae5c6c0a21c04.exe
PID 3488 wrote to memory of 4952	3488	cd946f863145acbd83117ccb6ca83d5fe37207e3fa1d0751211ae5c6c0a21c04.exe	cd946f863145acbd83117ccb6ca83d5fe37207e3fa1d0751211ae5c6c0a21c04.exe
PID 3488 wrote to memory of 4952	3488	cd946f863145acbd83117ccb6ca83d5fe37207e3fa1d0751211ae5c6c0a21c04.exe	cd946f863145acbd83117ccb6ca83d5fe37207e3fa1d0751211ae5c6c0a21c04.exe
PID 3488 wrote to memory of 4952	3488	cd946f863145acbd83117ccb6ca83d5fe37207e3fa1d0751211ae5c6c0a21c04.exe	cd946f863145acbd83117ccb6ca83d5fe37207e3fa1d0751211ae5c6c0a21c04.exe
PID 3488 wrote to memory of 4952	3488	cd946f863145acbd83117ccb6ca83d5fe37207e3fa1d0751211ae5c6c0a21c04.exe	cd946f863145acbd83117ccb6ca83d5fe37207e3fa1d0751211ae5c6c0a21c04.exe
PID 1984 wrote to memory of 4940	1984	svchost.exe	mspaint.exe
PID 1984 wrote to memory of 4940	1984	svchost.exe	mspaint.exe
PID 1984 wrote to memory of 4940	1984	svchost.exe	mspaint.exe
PID 4952 wrote to memory of 1392	4952	cd946f863145acbd83117ccb6ca83d5fe37207e3fa1d0751211ae5c6c0a21c04.exe	iexplore.exe
PID 4952 wrote to memory of 1392	4952	cd946f863145acbd83117ccb6ca83d5fe37207e3fa1d0751211ae5c6c0a21c04.exe	iexplore.exe
PID 4952 wrote to memory of 1392	4952	cd946f863145acbd83117ccb6ca83d5fe37207e3fa1d0751211ae5c6c0a21c04.exe	iexplore.exe
PID 1392 wrote to memory of 4552	1392	iexplore.exe	IEXPLORE.EXE
PID 1392 wrote to memory of 4552	1392	iexplore.exe	IEXPLORE.EXE
PID 4552 wrote to memory of 3884	4552	IEXPLORE.EXE	IEXPLORE.EXE
PID 4552 wrote to memory of 3884	4552	IEXPLORE.EXE	IEXPLORE.EXE
PID 4552 wrote to memory of 3884	4552	IEXPLORE.EXE	IEXPLORE.EXE
PID 4952 wrote to memory of 1984	4952	cd946f863145acbd83117ccb6ca83d5fe37207e3fa1d0751211ae5c6c0a21c04.exe	svchost.exe
PID 4952 wrote to memory of 1984	4952	cd946f863145acbd83117ccb6ca83d5fe37207e3fa1d0751211ae5c6c0a21c04.exe	svchost.exe
PID 4952 wrote to memory of 4940	4952	cd946f863145acbd83117ccb6ca83d5fe37207e3fa1d0751211ae5c6c0a21c04.exe	mspaint.exe
PID 4952 wrote to memory of 4940	4952	cd946f863145acbd83117ccb6ca83d5fe37207e3fa1d0751211ae5c6c0a21c04.exe	mspaint.exe
PID 4952 wrote to memory of 3884	4952	cd946f863145acbd83117ccb6ca83d5fe37207e3fa1d0751211ae5c6c0a21c04.exe	IEXPLORE.EXE
PID 4952 wrote to memory of 3884	4952	cd946f863145acbd83117ccb6ca83d5fe37207e3fa1d0751211ae5c6c0a21c04.exe	IEXPLORE.EXE

C:\Users\Admin\AppData\Local\Temp\cd946f863145acbd83117ccb6ca83d5fe37207e3fa1d0751211ae5c6c0a21c04.exe
"C:\Users\Admin\AppData\Local\Temp\cd946f863145acbd83117ccb6ca83d5fe37207e3fa1d0751211ae5c6c0a21c04.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3400
- C:\Users\Admin\AppData\Local\Temp\cd946f863145acbd83117ccb6ca83d5fe37207e3fa1d0751211ae5c6c0a21c04.exe
  "C:\Users\Admin\AppData\Local\Temp\cd946f863145acbd83117ccb6ca83d5fe37207e3fa1d0751211ae5c6c0a21c04.exe"
  2⤵
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:3488
- - C:\Windows\SysWOW64\svchost.exe
    "C:\Windows\system32\svchost.exe"
    3⤵
    - Enumerates connected drives
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1984
  - - C:\Windows\SysWOW64\mspaint.exe
      "C:\Windows\system32\mspaint.exe"
      4⤵
      Adds Run key to start application
      Enumerates connected drives
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:4940
- - C:\Users\Admin\AppData\Local\Temp\cd946f863145acbd83117ccb6ca83d5fe37207e3fa1d0751211ae5c6c0a21c04.exe
    "C:\Users\Admin\AppData\Local\Temp\cd946f863145acbd83117ccb6ca83d5fe37207e3fa1d0751211ae5c6c0a21c04.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4952
  - - C:\Program Files (x86)\Internet Explorer\iexplore.exe
      "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1392
    - - C:\Program Files\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files\Internet Explorer\IEXPLORE.EXE"
        5⤵
        Modifies Internet Explorer settings
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4552
      - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4552 CREDAT:17410 /prefetch:2
        6⤵
        Modifies Internet Explorer settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:3884

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
PID:4920

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
471B

MD5
228d25dd7d377af29848012a2b059814

SHA1
a29a3c1e167f3581b0aa4be90b1769a89beab01c

SHA256
9d4e26398806093c8af5a60e646afb3c2fc110ea0dc93821e29dc48da62280bb

SHA512
1d004bb21f7225fe220aae71d7836c0f5b2e58cb855209e2cc7f1a903ae73b67c408f59108b31faf7caed420758f4753b476c927299da5d607304b5d3a45bc61

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
434B

MD5
62817e8aee918bfb307e9374960c0e22

SHA1
a17cd5fde65a4dd8dd8c854b1e39fb00afba1b6e

SHA256
b0ce587f7b3229ee1acded737b29fa71e198e5333f3649f8d356ed9c16be9099

SHA512
25ef2923a16b8319f2310cfbdcac7fe357472f2d317f7df0355123e2382e0e16665b588d512b44c1940a82bc9b1b32787cbfcded6dc331f5e0ba0a268d80e4d2

Download Submit
memory/1984-146-0x0000000002EF0000-0x0000000002F3E000-memory.dmp

Filesize
312KB

Download
memory/1984-136-0x0000000000000000-mapping.dmp

Download
memory/1984-142-0x0000000000C60000-0x0000000000C81000-memory.dmp

Filesize
132KB

Download
memory/3488-132-0x0000000000000000-mapping.dmp

Download
memory/3488-133-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/3488-135-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/3488-144-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/4940-141-0x0000000000000000-mapping.dmp

Download
memory/4940-147-0x0000000003890000-0x00000000038DE000-memory.dmp

Filesize
312KB

Download
memory/4952-140-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/4952-145-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/4952-143-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/4952-138-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/4952-137-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads