Analysis
- max time kernel
145s - max time network
157s - platform
windows10-2004_x64 - resource
win10v2004-20220901-en - resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system - submitted
09/12/2022, 17:20
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20220901-en
windows7-x64
6 signatures
150 seconds
General
- Target file.exe
- Size 384KB
- Sample221209-vwegcadf53
- SHA256 28925c3dbb89301a158ade1ff7f18b840f4361cf7136cd788ec94cb7eab9b58d
- MD5 332489293f425b32935ab61b9ec16e75
- SHA1 153cf3d94e2c19a862574a070df3320fcb23213b
- SHA512 d0419e1d95599fbc146ff9f98e875dd183c4dcfc9aa87788cf25a0d73640f312b45eea12905c7245b02f0b6b90592d0d1f472904447a266e76283126a9332936
- SSDEEP 6144:S0HOLZkCq0wzTtBlOEzKDkWrr4ZfwcbRSpveFn2Fa7Fns:S3FkCHUTtBlOkUr4twwRS4FnPs
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detects Smokeloader packer 1 IoCs
resource yara_rule behavioral2/memory/3256-133-0x00000000005B0000-0x00000000005B9000-memory.dmp family_smokeloader - SmokeLoader
Modular backdoor trojan in use since 2014.
- Blocklisted process makes network request 3 IoCs
flow pid Process 40 2032 rundll32.exe 42 2032 rundll32.exe 60 2032 rundll32.exe - Downloads MZ/PE file
- Executes dropped EXE 1 IoCs
pid Process 220 2858.exe - Loads dropped DLL 1 IoCs
pid Process 2032 rundll32.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2032 set thread context of 2320 2032 rundll32.exe 94 - Drops file in Program Files directory 30 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\Measure.aapp rundll32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ahclient.dll rundll32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\adobe_spinner_mini.gif rundll32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\remove.svg rundll32.exe File created C:\Program Files (x86)\Windows Photo Viewer\en-US\Combine_R_RHP.aapp rundll32.exe File created C:\Program Files (x86)\Windows Photo Viewer\en-US\favicon.ico rundll32.exe File created C:\Program Files (x86)\Windows Photo Viewer\en-US\AdobeXMP.dll rundll32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\Combine_R_RHP.aapp rundll32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\DVA.api rundll32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\Home.aapp rundll32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\cloud_icon.png rundll32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\favicon.ico rundll32.exe File created C:\Program Files (x86)\Windows Photo Viewer\en-US\aic_file_icons_retina_thumb_highContrast_wob.png rundll32.exe File created C:\Program Files (x86)\Windows Photo Viewer\en-US\Compare_R_RHP..dll rundll32.exe File created C:\Program Files (x86)\Windows Photo Viewer\en-US\adobe_spinner_mini.gif rundll32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\hi_contrast\aic_file_icons_retina_thumb_highContrast_wob.png rundll32.exe File created C:\Program Files (x86)\Windows Photo Viewer\en-US\Measure.aapp rundll32.exe File created C:\Program Files (x86)\Windows Photo Viewer\en-US\DVA.api rundll32.exe File created C:\Program Files (x86)\Windows Photo Viewer\en-US\distribute_form.gif rundll32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\duplicate.svg rundll32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeXMP.dll rundll32.exe File created C:\Program Files (x86)\Windows Photo Viewer\en-US\duplicate.svg rundll32.exe File created C:\Program Files (x86)\Windows Photo Viewer\en-US\cloud_icon.png rundll32.exe File created C:\Program Files (x86)\Windows Photo Viewer\en-US\delete.svg rundll32.exe File created C:\Program Files (x86)\Windows Photo Viewer\en-US\remove.svg rundll32.exe File created C:\Program Files (x86)\Windows Photo Viewer\en-US\ACE.dll rundll32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\delete.svg rundll32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\distribute_form.gif rundll32.exe File created C:\Program Files (x86)\Windows Photo Viewer\en-US\Home.aapp rundll32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ACE.dll rundll32.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Program crash 1 IoCs
pid pid_target Process procid_target 4072 220 WerFault.exe 83 - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe - Checks processor information in registry 2 TTPs 25 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\VendorIdentifier rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Previous Update Revision rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier rundll32.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 rundll32.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Identifier rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Status rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Revision rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information rundll32.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\FeatureSet rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Component Information rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Configuration Data rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Platform Specific Field 1 rundll32.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Toolbar Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1" Process not Found Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 Process not Found - Modifies registry class 30 IoCs
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\MRUListEx = ffffffff Process not Found Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\WorkFolders Process not Found Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings rundll32.exe Set value (data) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff rundll32.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = 00000000ffffffff Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f44471a0359723fa74489c55595fe6b30ee0000 Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 50003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014000000 Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ Process not Found Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots rundll32.exe Set value (data) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff Process not Found Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 Process not Found Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic" Process not Found Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff Process not Found Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell Process not Found Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1 Process not Found Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell rundll32.exe Set value (data) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 = 4e003100000000008955a28a100054656d7000003a0009000400efbe21550a588955a78a2e00000000000000000000000000000000000000000000000000ebf38c00540065006d007000000014000000 Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\NodeSlot = "1" Process not Found Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags Process not Found Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU rundll32.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 820074001c0043465346160031000000000000000000100041707044617461000000741a595e96dfd3488d671733bcee28bac5cdfadf9f6756418947c5c76bc0b67f400009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004100700070004400610074006100000042000000 Process not Found Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 Process not Found - Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 1040 Process not Found - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3256 file.exe 3256 file.exe 1040 Process not Found 1040 Process not Found 1040 Process not Found 1040 Process not Found 1040 Process not Found 1040 Process not Found 1040 Process not Found 1040 Process not Found 1040 Process not Found 1040 Process not Found 1040 Process not Found 1040 Process not Found 1040 Process not Found 1040 Process not Found 1040 Process not Found 1040 Process not Found 1040 Process not Found 1040 Process not Found 1040 Process not Found 1040 Process not Found 1040 Process not Found 1040 Process not Found 1040 Process not Found 1040 Process not Found 1040 Process not Found 1040 Process not Found 1040 Process not Found 1040 Process not Found 1040 Process not Found 1040 Process not Found 1040 Process not Found 1040 Process not Found 1040 Process not Found 1040 Process not Found 1040 Process not Found 1040 Process not Found 1040 Process not Found 1040 Process not Found 1040 Process not Found 1040 Process not Found 1040 Process not Found 1040 Process not Found 1040 Process not Found 1040 Process not Found 1040 Process not Found 1040 Process not Found 1040 Process not Found 1040 Process not Found 1040 Process not Found 1040 Process not Found 1040 Process not Found 1040 Process not Found 1040 Process not Found 1040 Process not Found 1040 Process not Found 1040 Process not Found 1040 Process not Found 1040 Process not Found 1040 Process not Found 1040 Process not Found 1040 Process not Found 1040 Process not Found - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1040 Process not Found - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 3256 file.exe - Suspicious use of AdjustPrivilegeToken 18 IoCs
description pid Process Token: SeShutdownPrivilege 1040 Process not Found Token: SeCreatePagefilePrivilege 1040 Process not Found Token: SeShutdownPrivilege 1040 Process not Found Token: SeCreatePagefilePrivilege 1040 Process not Found Token: SeShutdownPrivilege 1040 Process not Found Token: SeCreatePagefilePrivilege 1040 Process not Found Token: SeShutdownPrivilege 1040 Process not Found Token: SeCreatePagefilePrivilege 1040 Process not Found Token: SeShutdownPrivilege 1040 Process not Found Token: SeCreatePagefilePrivilege 1040 Process not Found Token: SeShutdownPrivilege 1040 Process not Found Token: SeCreatePagefilePrivilege 1040 Process not Found Token: SeShutdownPrivilege 1040 Process not Found Token: SeCreatePagefilePrivilege 1040 Process not Found Token: SeShutdownPrivilege 1040 Process not Found Token: SeCreatePagefilePrivilege 1040 Process not Found Token: SeShutdownPrivilege 1040 Process not Found Token: SeCreatePagefilePrivilege 1040 Process not Found - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2320 rundll32.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1040 Process not Found 1040 Process not Found - Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 1040 wrote to memory of 220 1040 Process not Found 83 PID 1040 wrote to memory of 220 1040 Process not Found 83 PID 1040 wrote to memory of 220 1040 Process not Found 83 PID 220 wrote to memory of 2032 220 2858.exe 84 PID 220 wrote to memory of 2032 220 2858.exe 84 PID 220 wrote to memory of 2032 220 2858.exe 84 PID 2032 wrote to memory of 2320 2032 rundll32.exe 94 PID 2032 wrote to memory of 2320 2032 rundll32.exe 94 PID 2032 wrote to memory of 2320 2032 rundll32.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:3256
-
C:\Users\Admin\AppData\Local\Temp\2858.exeC:\Users\Admin\AppData\Local\Temp\2858.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:220 -
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Users\Admin\AppData\Local\Temp\Atdwtfifphqhe.tmp",Eufweypaeeoooya2⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:2032 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61 184313⤵
- Modifies registry class
- Suspicious use of FindShellTrayWindow
PID:2320
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /End /tn \Microsoft\Windows\Wininet\CacheTask3⤵PID:3176
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 220 -s 5362⤵
- Program crash
PID:4072
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 220 -ip 2201⤵PID:1016
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:1044
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k LocalService1⤵PID:2552
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\system32\rundll32.exe" "c:\program files (x86)\windows photo viewer\en-us\compare_r_rhp..dll",UVEAR1JXRTRw2⤵PID:1704
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Windows Photo Viewer\en-US\Compare_R_RHP..dll
- Size 747KB
- SHA256 d2ee592a6431a951816f86cc75c172bf319e3d177547789b39fa34cc50a6417a
- MD5 be1cbcd770ab2cbae1c3f9e9eac0ceae
- SHA1 3375ad8e9cc47a3c62f0e2c8646fec75dc1d8a31
- SHA512 21050b57e3ec9c18b1ac7407d8e90cb28f38fdd028ad85a102fdd46464b2b4d798c62984c4f80ba82d0bb512816dfa8ff0f534d650e1d26e92d5d89047cd1b4b
- SSDEEP 12288:wWEzicUTKXwn+R4Hw69bimoGfYYD57sL8SaL1TzOF7Y4k+:JWKTKXwapKimoGfYYDmo5OF7Y4k+
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Windows Photo Viewer\en-US\Compare_R_RHP..dll
- Size 747KB
- SHA256 d2ee592a6431a951816f86cc75c172bf319e3d177547789b39fa34cc50a6417a
- MD5 be1cbcd770ab2cbae1c3f9e9eac0ceae
- SHA1 3375ad8e9cc47a3c62f0e2c8646fec75dc1d8a31
- SHA512 21050b57e3ec9c18b1ac7407d8e90cb28f38fdd028ad85a102fdd46464b2b4d798c62984c4f80ba82d0bb512816dfa8ff0f534d650e1d26e92d5d89047cd1b4b
- SSDEEP 12288:wWEzicUTKXwn+R4Hw69bimoGfYYD57sL8SaL1TzOF7Y4k+:JWKTKXwapKimoGfYYDmo5OF7Y4k+
- MD5 SHA1 SHA512 SSDEEP
- Path C:\ProgramData\{1C55FFAC-E488-2CEC-376A-99C669D12C5F}\C2RManifest.Proof.Culture.msi.16.fr-fr.xml
- Size 23KB
- SHA256 516aa640a48752bcadbd46e4f53c0560a1cb379d5366b1c9bb4d0706d1bd040f
- MD5 37cde9afb1540513bd564d71867021e0
- SHA1 e319abb6093025dccc55618fb407c1182ccdafe7
- SHA512 6746350447a6a0424c90571c7cc3442d34af0cb16fa1459bb76b25423f165f474073f1d359462cb805ac376a9d069236d6b7a796332c27253a4807f691292881
- SSDEEP 192:l/+vpvfAcr+MeVeC/yqjU4vWGNMf0rS03EwSA/fo:l/+hvI+evhjU4vu03bt/fo
- MD5 SHA1 SHA512 SSDEEP
- Path C:\ProgramData\{1C55FFAC-E488-2CEC-376A-99C669D12C5F}\C2RManifest.Word.Word.x-none.msi.16.x-none.xml
- Size 93KB
- SHA256 846687ca03420046249f3525dc02ee08099671d8a3f48f42046febff9eedc877
- MD5 2e8a1f4e2c4678c174e9f328fc9c0846
- SHA1 39a7038d855f22e339bd26e578d02804ed7ec3b4
- SHA512 21cc574180abb4068293e44eb42820f57d4fc238a7677443997afa289a15c85f6c51311875a2c10edfe974dc56f484da0fe5dfeb2c0a4ca34ab977e1b0c2dd75
- SSDEEP 384:kspbdleD8pcyQAOFtzRhXDFwtOdYAuqG3vi8jnVVpo:t3eHyvghDJdY7qei8za
- MD5 SHA1 SHA512 SSDEEP
- Path C:\ProgramData\{1C55FFAC-E488-2CEC-376A-99C669D12C5F}\F46D4000-FD22-4DB4-AC8E-4E1DDDE828FE_10.0.19041.1023_neutral_neutral_cw5n1h2txyewy.xml
- Size 2KB
- SHA256 f8a8635147117201638a6a4dfa8dcd5b4506cbee07f582001d2a92da434a231f
- MD5 db0acdbf49f80d3f3b0fb65a71b39341
- SHA1 12c6d86ba5f90a1e1d2b4b4ec3bd94fc9f1296ae
- SHA512 3d4e7547c8186164aa3fb7f08a50e6b065d536ca5ec8bc216c9dfd34c98e7c58c64ebcb39077fbd46370bc42b504acf769c6b3c7387cb98ec209087d4d46d784
- MD5 SHA1 SHA512
- Path C:\ProgramData\{1C55FFAC-E488-2CEC-376A-99C669D12C5F}\MasterDescriptor.x-none.xml
- Size 27KB
- SHA256 25b87fbabbec1d49eae7cf47c3d659cb6c99eb82203e90eee6035b21b425b5ef
- MD5 82c3ab31834272e4118e925922249240
- SHA1 a116ca5af39e39b7d4234c2c0cd6a91bff6727af
- SHA512 4d3eaec898ef47e9b6039bcd481a06001263e7fcbc9303974423f90058a4d91494392427ca35dced5db642e8692580f24cb761b27a60e3288f15aefd8dbdb647
- SSDEEP 768:X67RsmZ8xJpwQJyWj0j8xR3yb09udiR5ypSEelbIB7Go9/OwsFfS4OvF8ZO2h34f:u9
- MD5 SHA1 SHA512 SSDEEP
- Path C:\ProgramData\{1C55FFAC-E488-2CEC-376A-99C669D12C5F}\Microsoft.BingWeather_4.25.20211.0_neutral_split.scale-150_8wekyb3d8bbwe.xml
- Size 849B
- SHA256 40d6a0b80770bf41ddc0a3b3607ac53eb82d0f90675e5a595a18cd3f8bdf3d94
- MD5 cff245d69fe04eec05ce3601d77467b6
- SHA1 d09b1d953eea98ef0b0fcec5936fc806940f7717
- SHA512 4615affbbc7163076cbc82a8e65cd5d168d1411a028b47bddd0ec5219e08037304de1d14ae1fa659909760150edf5401e698c9f6252674eb4e84dec341aa3666
- MD5 SHA1 SHA512
- Path C:\ProgramData\{1C55FFAC-E488-2CEC-376A-99C669D12C5F}\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe.xml
- Size 9KB
- SHA256 1bc1d4525a46e58edd165a9d792f50441ea3cbcecd14022dc112e02f3d9b5bf8
- MD5 993d82e37af681bd65f1d428b6ee281e
- SHA1 bb1a8402cfccd1d97ea58d6136847a4dd1ba0f65
- SHA512 4eb247e384ffa84460e43abe7563643de30f397b628c02f3e6e51c69669d5d7b8be6ebe51355586e5cd5a252652e0eef7f1bd0219b416b61e1db318db4ac833c
- SSDEEP 192:60P4RWfwMHdJEyC/EyzL5CD5zS5yNDmD9Nfb:60P4RWfwM9JEFEsS0I4D9d
- MD5 SHA1 SHA512 SSDEEP
- Path C:\ProgramData\{1C55FFAC-E488-2CEC-376A-99C669D12C5F}\Rsyeeespf.tmp
- Size 2.3MB
- SHA256 114265fa375c51527e2b56b8e4f50c4930b118e0ab922c4541afceb3ccb1a4a4
- MD5 7f373c92c89bb8362853d54d5e48b246
- SHA1 4ed8d2e914e79872840cdd6eb6b21c2fd79038d9
- SHA512 090ebd5b7fd2bba47c6d53ee4b6c83238da8023348fd7e8ade09b0a7d3330567ed0a19faa8e44c54924446240da7659cfa87d7aa3c9003cbd8b376cad5e52cb6
- SSDEEP 49152:S8fCxdtYZBZSBz3v/t+1Cih31gyaKimmJqcYH+EaeKPuR5sGC63VvE:nfCrI4JE+Dbmm8cYeEZKPuvD4
- MD5 SHA1 SHA512 SSDEEP
- Path C:\ProgramData\{1C55FFAC-E488-2CEC-376A-99C669D12C5F}\print_property.ico
- Size 58KB
- SHA256 24e77f244b0743e311b0fc97f06513a0cecf6560e92f9c6f164288a152d32000
- MD5 30d7062e069bc0a9b34f4034090c1aae
- SHA1 e5fcedd8e4cc0463c0bc6912b1791f2876e28a61
- SHA512 85dd6c916d48804a24dbbad0f4b4842453ac31a692905f8f2f34112eaa1bbf062a825d45ed5d800bbc4663a28b0b5003ebd5fa54991cf846f1028e929ea06de6
- SSDEEP 768:wb5C9LMkCR4AR6e1I6z3VPDD/btuvlUWWVqoi8OEHqEfuHl+UrccLA71LDIc3:OC9KqI+GDD/5SdWiEFf6xgwA71L
- MD5 SHA1 SHA512 SSDEEP
- Path C:\ProgramData\{1C55FFAC-E488-2CEC-376A-99C669D12C5F}\qmgr.jfm
- Size 16KB
- SHA256 24b50c3f3d71f216fc21987049dfc282e85a331e86c98b7b48cea4dcf2176ce8
- MD5 6652a05c4a585c60b74de48a49167e8c
- SHA1 dd5a92e19f65652ec5a272e7fdb12236c6a1ed5f
- SHA512 4fb8f9439a412cdb12a79e528cd04a59be58c618fb6969de68a7d88c33022800957a4ecc18a9e80cd041aa7dc4fe109d0a42decf90b1a7e9f7bf7b561aa3872a
- SSDEEP 3:vXlqlukqsgWfWlbSWQo+WxySWllsk+Wlqll7KH/tllUUxS:v1euJsgWfWlWWYWxySWlH+WleBUxS
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\2858.exe
- Size 1.1MB
- SHA256 5db2e2422dfb2e5c357ba6e94accfb81531f12247ca9c2d20ae186e6c890430f
- MD5 aa35d642e4a3d8c8fc0d1e233162c71b
- SHA1 08c884e3aaa118ba09930e29a980beea2fea5607
- SHA512 77d17de1aab470af09e9a8168a02233c1a452b1056e9b03d9666c8266b9c4b45cd84ea75d93eef81db840ba420fab25130bdcd28900ee446408e4787cf67ef12
- SSDEEP 24576:ltEmXJN6bz0HDd0xwDIo0EcalLfX0gOQ5QD53RdwZn:ltncfYd0xIIoc8Dkgh+tjun
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\2858.exe
- Size 1.1MB
- SHA256 5db2e2422dfb2e5c357ba6e94accfb81531f12247ca9c2d20ae186e6c890430f
- MD5 aa35d642e4a3d8c8fc0d1e233162c71b
- SHA1 08c884e3aaa118ba09930e29a980beea2fea5607
- SHA512 77d17de1aab470af09e9a8168a02233c1a452b1056e9b03d9666c8266b9c4b45cd84ea75d93eef81db840ba420fab25130bdcd28900ee446408e4787cf67ef12
- SSDEEP 24576:ltEmXJN6bz0HDd0xwDIo0EcalLfX0gOQ5QD53RdwZn:ltncfYd0xIIoc8Dkgh+tjun
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\Atdwtfifphqhe.tmp
- Size 747KB
- SHA256 bcde33054c45d2f7e5c9d30bbf616ca980f543ae9715f98a888881ce2a9fe188
- MD5 6b69fff25f9de8575891270476bc3cb8
- SHA1 9f4dc9d50c8f8584f9bf19e465e4367885ad1233
- SHA512 3181061184691e1e442d28b93a1b569b0f77a600eb39254e9f7ab663ae89503627276aa417c2c8e3d2b9bdefbc81c68449a86f6d8d3b2ebec4fea340752c007b
- SSDEEP 12288:+WEzicUTKXwn+R4Hw69bimoGfYYD57sL8SaL1TzOF7Y4k+:zWKTKXwapKimoGfYYDmo5OF7Y4k+
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\Atdwtfifphqhe.tmp
- Size 747KB
- SHA256 bcde33054c45d2f7e5c9d30bbf616ca980f543ae9715f98a888881ce2a9fe188
- MD5 6b69fff25f9de8575891270476bc3cb8
- SHA1 9f4dc9d50c8f8584f9bf19e465e4367885ad1233
- SHA512 3181061184691e1e442d28b93a1b569b0f77a600eb39254e9f7ab663ae89503627276aa417c2c8e3d2b9bdefbc81c68449a86f6d8d3b2ebec4fea340752c007b
- SSDEEP 12288:+WEzicUTKXwn+R4Hw69bimoGfYYD57sL8SaL1TzOF7Y4k+:zWKTKXwapKimoGfYYDmo5OF7Y4k+
- MD5 SHA1 SHA512 SSDEEP
- Path \??\c:\program files (x86)\windows photo viewer\en-us\compare_r_rhp..dll
- Size 747KB
- SHA256 d2ee592a6431a951816f86cc75c172bf319e3d177547789b39fa34cc50a6417a
- MD5 be1cbcd770ab2cbae1c3f9e9eac0ceae
- SHA1 3375ad8e9cc47a3c62f0e2c8646fec75dc1d8a31
- SHA512 21050b57e3ec9c18b1ac7407d8e90cb28f38fdd028ad85a102fdd46464b2b4d798c62984c4f80ba82d0bb512816dfa8ff0f534d650e1d26e92d5d89047cd1b4b
- SSDEEP 12288:wWEzicUTKXwn+R4Hw69bimoGfYYD57sL8SaL1TzOF7Y4k+:JWKTKXwapKimoGfYYDmo5OF7Y4k+
- MD5 SHA1 SHA512 SSDEEP