Analysis
-
max time kernel
98s -
max time network
140s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
06/12/2022, 15:36
Behavioral task
behavioral1
Sample
d7c554e6be24b8e353b89ea2441c46a0468ff4f4fb54ace3b039484de3cf957e.exe
Resource
win7-20220901-en
windows7-x64
11 signatures
150 seconds
General
-
Target
d7c554e6be24b8e353b89ea2441c46a0468ff4f4fb54ace3b039484de3cf957e.exe
-
Size
161KB
-
MD5
59a50fc74408a0c6a8016dce13e585a5
-
SHA1
16793487424807c3ae7b6218b9cf5effff141e6e
-
SHA256
d7c554e6be24b8e353b89ea2441c46a0468ff4f4fb54ace3b039484de3cf957e
-
SHA512
16ddfccd03853a720ca66e9f89090b80076466d85e5391c132bf747ef0e4091c5554ae4987d014ac11f7f9f9668b4d6171f709da5733e08387339764e3477d23
-
SSDEEP
3072:1HIENA6jJVHO585ZI/0gPQLUmTw4Pf/W8WzQJJ5oziS:ym9VHQWgPQL1rne86kJ5S
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/1768-59-0x0000000000400000-0x0000000000482000-memory.dmp upx -
Loads dropped DLL 1 IoCs
pid Process 912 regsvr32.exe -
Installs/modifies Browser Helper Object 2 TTPs 1 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{A7D5DFA9-9F96-492F-B1F5-4D1385C8E034} regsvr32.exe -
Drops file in System32 directory 7 IoCs
description ioc Process File created C:\Windows\SysWOW64\gjgsys.dll d7c554e6be24b8e353b89ea2441c46a0468ff4f4fb54ace3b039484de3cf957e.exe File created C:\Windows\SysWOW64\p.ico d7c554e6be24b8e353b89ea2441c46a0468ff4f4fb54ace3b039484de3cf957e.exe File created C:\Windows\SysWOW64\sf.ico d7c554e6be24b8e353b89ea2441c46a0468ff4f4fb54ace3b039484de3cf957e.exe File created C:\Windows\SysWOW64\c.ico d7c554e6be24b8e353b89ea2441c46a0468ff4f4fb54ace3b039484de3cf957e.exe File created C:\Windows\SysWOW64\m.ico d7c554e6be24b8e353b89ea2441c46a0468ff4f4fb54ace3b039484de3cf957e.exe File created C:\Windows\SysWOW64\m3.ico d7c554e6be24b8e353b89ea2441c46a0468ff4f4fb54ace3b039484de3cf957e.exe File created C:\Windows\SysWOW64\s.ico d7c554e6be24b8e353b89ea2441c46a0468ff4f4fb54ace3b039484de3cf957e.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\ios.dat d7c554e6be24b8e353b89ea2441c46a0468ff4f4fb54ace3b039484de3cf957e.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000098f930aee0ecf64ab18d8c03237ae45500000000020000000000106600000001000020000000550c1fa6d2fece5ea1fa037e80d3c04c8bde7d9a61a964a42f648b5a67a72ac4000000000e800000000200002000000084dca2c00f244ca76e89076dc4f08999a4b39357601f1ac55530b1941de4f2eb20000000ffdfac3aa7534e783136153ea0089f5b862561e11b727c3644cf3a7815aa20124000000061d26cb90bf4f6c7a2c471373e5c4162b01e904a0b415a88583e4c97fab19b39dbf56e059b877626de4aa8db0e1748cebb49b95303fdd217ee2366e68b17df41 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000098f930aee0ecf64ab18d8c03237ae455000000000200000000001066000000010000200000006d394f45f1e0487354a62cdfef39d158e144bd41108614975141b1f34d56d70b000000000e8000000002000020000000ac18551e07c7c684d0a24eac3396ece2f88b9d5fba2b902b3e3d7be7e7e170c990000000bd67dce324d0097704f165bb127074ba9e54f1438b39404762002c429ac55e51e86144f5d775a0842d1caeb613ea17212420d82d599b7fd065babd23be56fd5661c5be14ec4cf28954df76b2a2fefa7e98af171232c83dc6660f2dfb6f58c7be0996dd913dd2b5e840b3621561cc62a6579c46894492aba80e694aca3c98f38f1bbb67e6b974f669c0b89c5cf053129640000000f94a78f9240764aef6874c6dee2a80c34081e68ed9783dab7f3bac0baf7feb7d7d8c78fed9dd255fadb87cf68f6aedb2128f5d80167bdb3c7ea8cbcccb790a18 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0D4A9531-7911-11ED-AD07-6AC8E2464E73} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90b19ee71d0dd901 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "377499941" iexplore.exe -
Modifies registry class 60 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{68D9B1ED-EB73-428A-B20A-24C8C9FFB984}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{B59993BF-D41F-427A-B7D0-EC11F4D6FB26} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{B59993BF-D41F-427A-B7D0-EC11F4D6FB26}\TypeLib\ = "{A8954909-1F0F-41A5-A7FA-3B376D69E226}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\JopaBlizko.1\CLSID\ = "{A7D5DFA9-9F96-492F-B1F5-4D1385C8E034}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\JopaBlizko\CurVer\ = "JopaBlizko.1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{68D9B1ED-EB73-428A-B20A-24C8C9FFB984}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B59993BF-D41F-427A-B7D0-EC11F4D6FB26}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{68D9B1ED-EB73-428A-B20A-24C8C9FFB984} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{68D9B1ED-EB73-428A-B20A-24C8C9FFB984}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B59993BF-D41F-427A-B7D0-EC11F4D6FB26}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\JopaBlizko.1\ = "cvshost32" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A8954909-1F0F-41A5-A7FA-3B376D69E226}\1.0 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A8954909-1F0F-41A5-A7FA-3B376D69E226}\1.0\ = "njdbh7 Library" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{68D9B1ED-EB73-428A-B20A-24C8C9FFB984}\ = "_IvvlbbdEvents" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{68D9B1ED-EB73-428A-B20A-24C8C9FFB984}\ = "_IvvlbbdEvents" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{68D9B1ED-EB73-428A-B20A-24C8C9FFB984}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A7D5DFA9-9F96-492F-B1F5-4D1385C8E034}\VersionIndependentProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A7D5DFA9-9F96-492F-B1F5-4D1385C8E034}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A8954909-1F0F-41A5-A7FA-3B376D69E226}\1.0\FLAGS regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A8954909-1F0F-41A5-A7FA-3B376D69E226}\1.0\FLAGS\ = "0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{68D9B1ED-EB73-428A-B20A-24C8C9FFB984}\TypeLib\ = "{A8954909-1F0F-41A5-A7FA-3B376D69E226}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{68D9B1ED-EB73-428A-B20A-24C8C9FFB984}\TypeLib\ = "{A8954909-1F0F-41A5-A7FA-3B376D69E226}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{B59993BF-D41F-427A-B7D0-EC11F4D6FB26}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A7D5DFA9-9F96-492F-B1F5-4D1385C8E034}\ = "cvshost32" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A7D5DFA9-9F96-492F-B1F5-4D1385C8E034}\InprocServer32\ = "C:\\Windows\\SysWow64\\gjgsys.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{68D9B1ED-EB73-428A-B20A-24C8C9FFB984}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B59993BF-D41F-427A-B7D0-EC11F4D6FB26}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A7D5DFA9-9F96-492F-B1F5-4D1385C8E034}\ProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A7D5DFA9-9F96-492F-B1F5-4D1385C8E034}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A7D5DFA9-9F96-492F-B1F5-4D1385C8E034} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A8954909-1F0F-41A5-A7FA-3B376D69E226} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{68D9B1ED-EB73-428A-B20A-24C8C9FFB984}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B59993BF-D41F-427A-B7D0-EC11F4D6FB26}\TypeLib\ = "{A8954909-1F0F-41A5-A7FA-3B376D69E226}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\JopaBlizko.1 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\JopaBlizko regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A7D5DFA9-9F96-492F-B1F5-4D1385C8E034}\VersionIndependentProgID\ = "JopaBlizko" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A7D5DFA9-9F96-492F-B1F5-4D1385C8E034}\Programmable regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B59993BF-D41F-427A-B7D0-EC11F4D6FB26} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A7D5DFA9-9F96-492F-B1F5-4D1385C8E034}\ProgID\ = "JopaBlizko.1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{68D9B1ED-EB73-428A-B20A-24C8C9FFB984}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\JopaBlizko.1\CLSID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B59993BF-D41F-427A-B7D0-EC11F4D6FB26}\ = "Ivvlbbd" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A8954909-1F0F-41A5-A7FA-3B376D69E226}\1.0\HELPDIR regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{68D9B1ED-EB73-428A-B20A-24C8C9FFB984}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\JopaBlizko\CLSID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A7D5DFA9-9F96-492F-B1F5-4D1385C8E034}\TypeLib\ = "{A8954909-1F0F-41A5-A7FA-3B376D69E226}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A7D5DFA9-9F96-492F-B1F5-4D1385C8E034}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B59993BF-D41F-427A-B7D0-EC11F4D6FB26}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\JopaBlizko\ = "cvshost32" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\JopaBlizko\CurVer regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{B59993BF-D41F-427A-B7D0-EC11F4D6FB26}\ = "Ivvlbbd" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{B59993BF-D41F-427A-B7D0-EC11F4D6FB26}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{68D9B1ED-EB73-428A-B20A-24C8C9FFB984} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{B59993BF-D41F-427A-B7D0-EC11F4D6FB26}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A8954909-1F0F-41A5-A7FA-3B376D69E226}\1.0\0 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A8954909-1F0F-41A5-A7FA-3B376D69E226}\1.0\HELPDIR\ = "C:\\Windows\\SysWow64\\" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A8954909-1F0F-41A5-A7FA-3B376D69E226}\1.0\0\win32\ = "C:\\Windows\\SysWow64\\gjgsys.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{B59993BF-D41F-427A-B7D0-EC11F4D6FB26}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\JopaBlizko\CLSID\ = "{A7D5DFA9-9F96-492F-B1F5-4D1385C8E034}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A8954909-1F0F-41A5-A7FA-3B376D69E226}\1.0\0\win32 regsvr32.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1292 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1292 iexplore.exe 1292 iexplore.exe 584 IEXPLORE.EXE 584 IEXPLORE.EXE 584 IEXPLORE.EXE 584 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 1768 wrote to memory of 912 1768 d7c554e6be24b8e353b89ea2441c46a0468ff4f4fb54ace3b039484de3cf957e.exe 27 PID 1768 wrote to memory of 912 1768 d7c554e6be24b8e353b89ea2441c46a0468ff4f4fb54ace3b039484de3cf957e.exe 27 PID 1768 wrote to memory of 912 1768 d7c554e6be24b8e353b89ea2441c46a0468ff4f4fb54ace3b039484de3cf957e.exe 27 PID 1768 wrote to memory of 912 1768 d7c554e6be24b8e353b89ea2441c46a0468ff4f4fb54ace3b039484de3cf957e.exe 27 PID 1768 wrote to memory of 912 1768 d7c554e6be24b8e353b89ea2441c46a0468ff4f4fb54ace3b039484de3cf957e.exe 27 PID 1768 wrote to memory of 912 1768 d7c554e6be24b8e353b89ea2441c46a0468ff4f4fb54ace3b039484de3cf957e.exe 27 PID 1768 wrote to memory of 912 1768 d7c554e6be24b8e353b89ea2441c46a0468ff4f4fb54ace3b039484de3cf957e.exe 27 PID 1768 wrote to memory of 1292 1768 d7c554e6be24b8e353b89ea2441c46a0468ff4f4fb54ace3b039484de3cf957e.exe 28 PID 1768 wrote to memory of 1292 1768 d7c554e6be24b8e353b89ea2441c46a0468ff4f4fb54ace3b039484de3cf957e.exe 28 PID 1768 wrote to memory of 1292 1768 d7c554e6be24b8e353b89ea2441c46a0468ff4f4fb54ace3b039484de3cf957e.exe 28 PID 1768 wrote to memory of 1292 1768 d7c554e6be24b8e353b89ea2441c46a0468ff4f4fb54ace3b039484de3cf957e.exe 28 PID 1292 wrote to memory of 584 1292 iexplore.exe 30 PID 1292 wrote to memory of 584 1292 iexplore.exe 30 PID 1292 wrote to memory of 584 1292 iexplore.exe 30 PID 1292 wrote to memory of 584 1292 iexplore.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\d7c554e6be24b8e353b89ea2441c46a0468ff4f4fb54ace3b039484de3cf957e.exe"C:\Users\Admin\AppData\Local\Temp\d7c554e6be24b8e353b89ea2441c46a0468ff4f4fb54ace3b039484de3cf957e.exe"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1768 -
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s C:\Windows\system32\gjgsys.dll2⤵
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Modifies registry class
PID:912
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://configupdatestart.com/bind2.php?id=39134692⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1292 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1292 CREDAT:275457 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:584
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
608B
MD59b80cc49adf54241fbc71134d9a5346b
SHA1d81ea942e9ce01b0defbd0f850c4cfef11cc85eb
SHA25691fa6de85d0b4e0dcccfcd191592d49261e97cf70c1e813b84ca205edcf38f90
SHA5124e64eba61f05e8f1010efed784576d7fa27c8f3193352d52ebc424d7d99ad444de8118b435b34d2ac4acdb740e4bb0b623053920a37f4f24ca73a4444585df4e
-
Filesize
272KB
MD5350389796f77883f91933203ca6aa448
SHA149c470a38b7e48a4b9a673580f22b4aa8268016d
SHA256977818d61f8a496bfafca28023b7aa2556231027bbd09cd20ff9abaef728cfb5
SHA512842ed73aba67e7b79c2cc7c8f7e39c2fafa6dd5e0983388c8b30dd02e2af9a5bab466cb3b7e65b4d9c0151d93fd49858b00fcd18d0baf70a87ee5721d8b17bd3
-
Filesize
272KB
MD5350389796f77883f91933203ca6aa448
SHA149c470a38b7e48a4b9a673580f22b4aa8268016d
SHA256977818d61f8a496bfafca28023b7aa2556231027bbd09cd20ff9abaef728cfb5
SHA512842ed73aba67e7b79c2cc7c8f7e39c2fafa6dd5e0983388c8b30dd02e2af9a5bab466cb3b7e65b4d9c0151d93fd49858b00fcd18d0baf70a87ee5721d8b17bd3