danabot | bf5998ec24555a1ddf6efae54527a510d5a87e82e959660d405600404c392e27

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
19-12-2022 17:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bf5998ec24555a1ddf6efae54527a510d5a87e82e959660d405600404c392e27.exe
Size

302KB
MD5

533e1fffff34f074723b0e1bfe67e3d4
SHA1

be442829d2c06757e352f6d77eddb3a1828a5ad8
SHA256

bf5998ec24555a1ddf6efae54527a510d5a87e82e959660d405600404c392e27
SHA512

e03af96517cb9bad0425aa325cd911468795728c340f3a2a4f9de0b02bdfcb91f7b991d92b77f8d0223b8cd1bc44c61ce058e10dac42b2963d67f1a02a3967e3
SSDEEP

6144:lNLO/uZjmigijCYFvh5GfFh1z+3ng+E49HwchLP3i:lNK/imigiZ50twnVZH9P3

Score

10^/10

danabot smokeloader backdoor banker discovery trojan

Malware Config

Signatures

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot

Detects Smokeloader packer 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1800-133-0x00000000007E0000-0x00000000007E9000-memory.dmp	family_smokeloader

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Blocklisted process makes network request 3 IoCs

Processes:

rundll32.exe

flow pid process

35 4804 rundll32.exe
36 4804 rundll32.exe
55 4804 rundll32.exe
Downloads MZ/PE file
Executes dropped EXE 1 IoCs

Processes:

FAB0.exe

pid process

2008 FAB0.exe
Loads dropped DLL 1 IoCs

Processes:

rundll32.exe

pid process

4804 rundll32.exe
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Suspicious use of SetThreadContext 1 IoCs

Processes:

rundll32.exe

description pid process target process

PID 4804 set thread context of 2256 4804 rundll32.exe rundll32.exe

flow	pid	process
35	4804	rundll32.exe
36	4804	rundll32.exe
55	4804	rundll32.exe

pid	process
2008	FAB0.exe

pid	process
4804	rundll32.exe

description	pid	process	target process
PID 4804 set thread context of 2256	4804	rundll32.exe	rundll32.exe

Drops file in Program Files directory 24 IoCs

Processes:

rundll32.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\Edit_R_Full.aapp	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\sendforcomments.svg	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\create_form.gif	rundll32.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\cryptocme.sig	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\prc\MyriadCAD.otf	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\cef_extensions.pak	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\distribute_form.gif	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\LICENSE.txt	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\drvSOFT.x3d	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\back-arrow-disabled.svg	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\Close.png	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\aic_file_icons.png	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\duplicate.svg	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\Pages_R_RHP.aapp	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\InAppSign.aapp	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\cryptocme.sig	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\review_browser.gif	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\CollectSignatures.aapp	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\DefaultID.pdf	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\adobe_spinner_mini.gif	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2460 2008 WerFault.exe FAB0.exe

pid	pid_target	process	target process
2460	2008	WerFault.exe	FAB0.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

bf5998ec24555a1ddf6efae54527a510d5a87e82e959660d405600404c392e27.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	bf5998ec24555a1ddf6efae54527a510d5a87e82e959660d405600404c392e27.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	bf5998ec24555a1ddf6efae54527a510d5a87e82e959660d405600404c392e27.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	bf5998ec24555a1ddf6efae54527a510d5a87e82e959660d405600404c392e27.exe

Checks processor information in registry 2 TTPs 22 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

rundll32.exe

description	ioc	process
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\VendorIdentifier	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Status	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Revision	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	rundll32.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Previous Update Revision	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Identifier	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\FeatureSet	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	rundll32.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Previous Update Revision	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data	rundll32.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

Processes:

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser
Set value (data)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Internet Explorer\Toolbar

Modifies registry class 30 IoCs

Processes:

rundll32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0
Set value (data)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 50003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014000000
Set value (int)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\NodeSlot = "1"
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU
Set value (data)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff
Set value (data)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 820074001c0043465346160031000000000000000000100041707044617461000000741a595e96dfd3488d671733bcee28bac5cdfadf9f6756418947c5c76bc0b67f400009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004100700070004400610074006100000042000000
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic"
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0
Set value (data)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = 00000000ffffffff
Set value (data)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\
Set value (data)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 = 4e0031000000000093556493100054656d7000003a0009000400efbe6b557d6c935567932e00000000000000000000000000000000000000000000000000e7bd1300540065006d007000000014000000
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0
Set value (data)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\WorkFolders
Set value (data)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\
Set value (data)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff
Set value (data)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f44471a0359723fa74489c55595fe6b30ee0000
Set value (data)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff
Set value (data)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\MRUListEx = ffffffff
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags
Set value (data)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	rundll32.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

pid process

2096

pid	process
2096

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

bf5998ec24555a1ddf6efae54527a510d5a87e82e959660d405600404c392e27.exe

pid	process
1800	bf5998ec24555a1ddf6efae54527a510d5a87e82e959660d405600404c392e27.exe
1800	bf5998ec24555a1ddf6efae54527a510d5a87e82e959660d405600404c392e27.exe
2096
2096
2096
2096
2096
2096
2096
2096
2096
2096
2096
2096
2096
2096
2096
2096
2096
2096
2096
2096
2096
2096
2096
2096
2096
2096
2096
2096
2096
2096
2096
2096
2096
2096
2096
2096
2096
2096
2096
2096
2096
2096
2096
2096
2096
2096
2096
2096
2096
2096
2096
2096
2096
2096
2096
2096
2096
2096
2096
2096
2096
2096

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

pid process

2096
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

bf5998ec24555a1ddf6efae54527a510d5a87e82e959660d405600404c392e27.exe

pid process

1800 bf5998ec24555a1ddf6efae54527a510d5a87e82e959660d405600404c392e27.exe

pid	process
2096

Suspicious use of AdjustPrivilegeToken 18 IoCs

Processes:

description	pid	process
Token: SeShutdownPrivilege	2096
Token: SeCreatePagefilePrivilege	2096
Token: SeShutdownPrivilege	2096
Token: SeCreatePagefilePrivilege	2096
Token: SeShutdownPrivilege	2096
Token: SeCreatePagefilePrivilege	2096
Token: SeShutdownPrivilege	2096
Token: SeCreatePagefilePrivilege	2096
Token: SeShutdownPrivilege	2096
Token: SeCreatePagefilePrivilege	2096
Token: SeShutdownPrivilege	2096
Token: SeCreatePagefilePrivilege	2096
Token: SeShutdownPrivilege	2096
Token: SeCreatePagefilePrivilege	2096
Token: SeShutdownPrivilege	2096
Token: SeCreatePagefilePrivilege	2096
Token: SeShutdownPrivilege	2096
Token: SeCreatePagefilePrivilege	2096

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

rundll32.exe

pid process

2256 rundll32.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

pid process

2096
2096

pid	process
2256	rundll32.exe

pid	process
2096
2096

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

FAB0.exerundll32.exe

description	pid	process	target process
PID 2096 wrote to memory of 2008	2096		FAB0.exe
PID 2096 wrote to memory of 2008	2096		FAB0.exe
PID 2096 wrote to memory of 2008	2096		FAB0.exe
PID 2008 wrote to memory of 4804	2008	FAB0.exe	rundll32.exe
PID 2008 wrote to memory of 4804	2008	FAB0.exe	rundll32.exe
PID 2008 wrote to memory of 4804	2008	FAB0.exe	rundll32.exe
PID 4804 wrote to memory of 2256	4804	rundll32.exe	rundll32.exe
PID 4804 wrote to memory of 2256	4804	rundll32.exe	rundll32.exe
PID 4804 wrote to memory of 2256	4804	rundll32.exe	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\bf5998ec24555a1ddf6efae54527a510d5a87e82e959660d405600404c392e27.exe
"C:\Users\Admin\AppData\Local\Temp\bf5998ec24555a1ddf6efae54527a510d5a87e82e959660d405600404c392e27.exe"
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:1800

C:\Users\Admin\AppData\Local\Temp\FAB0.exe
C:\Users\Admin\AppData\Local\Temp\FAB0.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2008

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Users\Admin\AppData\Local\Temp\Ipoetwsuqhd.tmp",Sufeidweoe
2⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:4804

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61 23949
3⤵
- Modifies registry class
- Suspicious use of FindShellTrayWindow
PID:2256

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2008 -s 528
2⤵
- Program crash
PID:2460

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 396 -p 2008 -ip 2008
1⤵
PID:1332

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:972

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k LocalService
1⤵
PID:4224

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\system32\rundll32.exe" "c:\program files (x86)\windowspowershell\modules\adobe_spinner_mini.dll",hl8nTkM=
2⤵
PID:1172

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\WindowsPowerShell\Modules\adobe_spinner_mini.dll

Filesize
726KB

MD5
3662edafeac734969698a815f969f081

SHA1
3aaea57905969f30564f6f3c8d344dac9c71857a

SHA256
b0c72af868405e57b5fec5a7e7f09f385b66ada63b2847ed173bff8d6ce0671e

SHA512
efb754489beab68c926691ee101d71edeb5af805201ba65621f8b0a9ec82c69ced97a17bbe0ad88d38e022f8936a9dcd80ffd61c8464e640d5ea945b83457ba9

Download Submit
C:\Program Files (x86)\WindowsPowerShell\Modules\adobe_spinner_mini.dll

Filesize
726KB

MD5
3662edafeac734969698a815f969f081

SHA1
3aaea57905969f30564f6f3c8d344dac9c71857a

SHA256
b0c72af868405e57b5fec5a7e7f09f385b66ada63b2847ed173bff8d6ce0671e

SHA512
efb754489beab68c926691ee101d71edeb5af805201ba65621f8b0a9ec82c69ced97a17bbe0ad88d38e022f8936a9dcd80ffd61c8464e640d5ea945b83457ba9

Download Submit
C:\ProgramData\{F21FF8C2-A136-6557-C5DD-F59D9999C8E7}\2F1A6504-0641-44CF-8BB5-3612D865F2E5.vsch

Filesize
110B

MD5
37a1115747e63e1c0ead2c66301f22d3

SHA1
44339aa5b475ecc2669a69fa1850ffcbf6fc666e

SHA256
9496889b2cbda0bcb85b8ef91dc323107702c214ee37a7c1057b8fc9c8874589

SHA512
6ecc4b9f1d08bccc3f1ae111391e83b8a1ae3788f532ae3afac5ed91823891aaf6a56385e3856910730d312d5374c779bdab7760d82a685ee99c077a3180357d

Download Submit
C:\ProgramData\{F21FF8C2-A136-6557-C5DD-F59D9999C8E7}\C2RManifest.Proof.Culture.msi.16.es-es.xml

Filesize
23KB

MD5
156b3ab70b2cce134d493104d047e6fa

SHA1
9907a741812bef8c5b55d0e73c9ac5c0d973c4be

SHA256
5fba15e64d0ff7075951a8e6bf758d81d4c14fa98e6b8604d5bbc43317da8c01

SHA512
f3b2157c6aaf1b9e450872057fd5ddaad36bd30be98a48c28c0617c7a638a378dc38cbdbfb9f4b66858b32dfa3e79d577f99fd488b73b6000d1d8887640e7cbd

Download Submit
C:\ProgramData\{F21FF8C2-A136-6557-C5DD-F59D9999C8E7}\C2RManifest.wordmui.msi.16.en-us.xml

Filesize
77KB

MD5
50a33f3ee76c3f15703f82890efcc8c8

SHA1
b24e99bb702478edcbbda43f75457e5833abdc95

SHA256
77a2a4517a0c488c78bf9742e86de5af419d6c148346845d8b0f062d5f8a631a

SHA512
f14e224c1582476f09f969f1e29d5e2fa7855b22aa6b35682e264da0fc6cafdc1d62022dde5032206e1d973382604d9ccfa7495ebf90578a55c9c74bac1e606e

Download Submit
C:\ProgramData\{F21FF8C2-A136-6557-C5DD-F59D9999C8E7}\DiagnosticLogCSP_Collector_DeviceProvisioning_2022_11_11_13_34_6.etl

Filesize
256KB

MD5
1fe0d68375877cabfccb619d9d4ab43f

SHA1
cf193c9d2867df41dcccb8f6aabf425dffb509eb

SHA256
0cb5476c09391a9aa162dab319070f54ad3befb8cb202acfd274613985912aea

SHA512
51370046f065ae8b86afe3cc5f0ec7e71b13d6bc3272db4bf16924cbdfdc126e5b10399055756234e776a44a0449d2d1554ca0097e7d72790713ca618fdc7ec1

Download Submit
C:\ProgramData\{F21FF8C2-A136-6557-C5DD-F59D9999C8E7}\Microsoft.ECApp_10.0.19041.1023_neutral__8wekyb3d8bbwe.xml

Filesize
2KB

MD5
13eb9cfbca43ebcd240e1fcff5acab4d

SHA1
5a0da86ab3f30905433677284eb843742f05afe5

SHA256
616d6a37866683e848fac3a17cecdea05e51da55420adcf947e40d062f587bb8

SHA512
256879b3d2c86ed4c3e8fccc8ffa09d11ae6eb6a2c9da4afa834f36b399752d7c46ceb638497cb28c48d874db0ccde15b73a22f1aa894b376aafd00f20b23352

Download Submit
C:\ProgramData\{F21FF8C2-A136-6557-C5DD-F59D9999C8E7}\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_neutral_~_8wekyb3d8bbwe.xml

Filesize
34KB

MD5
49ab499fcfc79c613b8fd961693f4c6d

SHA1
145f086f024f268cfd67395e672f642cfc70e528

SHA256
e9be748ed4a3c102ea57b0a8f437768ce2a2f626d4cdfa5f0e1c4b96dd688a49

SHA512
4fbb6fd9529ca7e178060e3d8724d56d5fc088e313bd17fdd075c0bb57e97f113c65bb72bef1e2cf5a806682bb2e3d236986b31db20a51d1ff3b800d4e10c3b1

Download Submit
C:\ProgramData\{F21FF8C2-A136-6557-C5DD-F59D9999C8E7}\Microsoft.ScreenSketch_10.1907.2471.0_neutral_split.scale-100_8wekyb3d8bbwe.xml

Filesize
839B

MD5
2f6bc19cc3de731b8eaec46910edaf83

SHA1
61fd41f1fd1e4c6d7178a204c8ab68add839a199

SHA256
6893a54cc402ac94a278294c20918a5a6d15f8bf11995a8b2388dbe9fce5b966

SHA512
841a7777d1cf45ae391a101a44a25407023dd66e539e303057f0bfd01db8b37f56f9047eeccb920a5cdaa3ce44779d1703235a2db510594f70bbd2eff441b15a

Download Submit
C:\ProgramData\{F21FF8C2-A136-6557-C5DD-F59D9999C8E7}\MicrosoftLync2013Win64.xml

Filesize
2KB

MD5
e3a68bbd204d36868c6f5570e4576675

SHA1
bc5c44144e8e962c62f7febabdb3d0ba20a8162a

SHA256
11031974100f363daebe2d5c9e4bf67418d662c73e0341eb71e10b91a33280ac

SHA512
7c435d9f0e05469979ac3ce3153ad96ac1b01c9946b3df7230b384cc3ed1a2766dfbad0eb00fa1f2105d0fc0e5a87cbc1eb2c6c700c1041ebe4488a6d16c2f02

Download Submit
C:\ProgramData\{F21FF8C2-A136-6557-C5DD-F59D9999C8E7}\MicrosoftNotepad.xml

Filesize
957B

MD5
06f405331f1f99bd455f4afa7b8ee0cc

SHA1
815d8d81c01208aef4bc1a0048b2d4f4171b26f6

SHA256
b752d2c5a3c66c338fd6cd92224d5995be0eac8fd47092b8cd6ea2cc28a5e790

SHA512
a2a771f97346a5db7ee8e948cba2c9e223848e1c395eb335a6e3609739c125e0414e7a254f5ac81ca4a28b04cf4e631ee69edaaf24ef534b96c01c30f96c3a2c

Download Submit
C:\ProgramData\{F21FF8C2-A136-6557-C5DD-F59D9999C8E7}\OfficeIntegrator.ps1

Filesize
4KB

MD5
552d7c9707f6dedc9b275df20cfda14f

SHA1
6dfa65a6e2ab94e19deb7cac003674cc2bb4bcd7

SHA256
6e28d25e4b520aab2f2fd0983f62bae3cd8730cc07e003c1efd5cf635df474b2

SHA512
2fe977ef79afb53afd1ea5ba06453706c27c61f31125f9f5089eedad7211195bfcd3ea5c97e4a2a25bd82fa512cb16265e4e7c04fa54a06e3af6380e2a68d91c

Download Submit
C:\ProgramData\{F21FF8C2-A136-6557-C5DD-F59D9999C8E7}\Shpetph.tmp

Filesize
2.3MB

MD5
244694a772987a18be52fb6d130880ee

SHA1
a20c357072566f2c8858c697a49ce8809d17403e

SHA256
42cc5c1389ccbb382a1573e76bd839bb58154e299c70b8ba3f4d077fa1e79f9c

SHA512
7302029e6c44f17b017e464eeaed1bc0da6775d4474b740ef80b80e4ab72021008942546de602fc215aef82211567775b53ac87e5490c5b09e341d53fa7609fa

Download Submit
C:\ProgramData\{F21FF8C2-A136-6557-C5DD-F59D9999C8E7}\guest.png

Filesize
5KB

MD5
d7ee4543371744836d520e0ce24a9ee6

SHA1
a6cda6aac3e480b269b9da2bd616bdb4d6fa87f0

SHA256
98817a572430813ca4ca2787dab20573f7864c5168ac6912f34d14b49e7bd7c9

SHA512
e15b6a50d9d498918a81488bf8d60860027f9a38f4d87e239f1c6e9d20fe4938e75861dad35c69e4087370c18b2cd5b482ab6ca694dfe205d053f1d303d17808

Download Submit
C:\ProgramData\{F21FF8C2-A136-6557-C5DD-F59D9999C8E7}\wmp.ico

Filesize
110KB

MD5
589ff0b7d4d0d3fced65c3eae6559657

SHA1
4be3e4221a429b347888bbe3635e377271974c7f

SHA256
0e96c027d23a57e95103d1b64e4c5b8a153402f05b756dfcb737459476aaae35

SHA512
4a12bac3f61964d6c5608bbb9067d7673cd5e5a22463f6d16f402954045692f43ef1ea32d405f452d415c859c30b217e9d250a1c5c85cfd629bd393824b6523b

Download Submit
C:\Users\Admin\AppData\Local\Temp\FAB0.exe

Filesize
1.0MB

MD5
1a61e55fa3fd1dc5cbf63d91e6c5a93b

SHA1
0f68fc53fafb875aa9150ab4d39b8b5015cac684

SHA256
30b818c6458a2626eee09c58a2f02f11568c85a3011b4fde5b601cf8972d8a2a

SHA512
975c9594a3583bd72d550c57ddd60bec585c87f556aa8118ed4288f0f77e69473a11c0d889692e758363ecdb4c4e9abb6c3d7bb01cc173051bddb9e46ca598d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\FAB0.exe

Filesize
1.0MB

MD5
1a61e55fa3fd1dc5cbf63d91e6c5a93b

SHA1
0f68fc53fafb875aa9150ab4d39b8b5015cac684

SHA256
30b818c6458a2626eee09c58a2f02f11568c85a3011b4fde5b601cf8972d8a2a

SHA512
975c9594a3583bd72d550c57ddd60bec585c87f556aa8118ed4288f0f77e69473a11c0d889692e758363ecdb4c4e9abb6c3d7bb01cc173051bddb9e46ca598d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Ipoetwsuqhd.tmp

Filesize
726KB

MD5
6ea8a6cc5fed6c664df1b3ef7c56b55d

SHA1
6b244d708706441095ae97294928967ddf28432b

SHA256
2c7500ac5ebb0116e640747b8a5f0a2648f7d2f5f516ebb398b864cccc626fbe

SHA512
4a328a66df407e4c9fa230287104771ea3b5dd8265d60314797426101a8be19d13bc57de2388f0f90b20ada82d950e156ef4267c029080a6254b80eefd8b8741

Download Submit
C:\Users\Admin\AppData\Local\Temp\Ipoetwsuqhd.tmp

Filesize
726KB

MD5
6ea8a6cc5fed6c664df1b3ef7c56b55d

SHA1
6b244d708706441095ae97294928967ddf28432b

SHA256
2c7500ac5ebb0116e640747b8a5f0a2648f7d2f5f516ebb398b864cccc626fbe

SHA512
4a328a66df407e4c9fa230287104771ea3b5dd8265d60314797426101a8be19d13bc57de2388f0f90b20ada82d950e156ef4267c029080a6254b80eefd8b8741

Download Submit
\??\c:\program files (x86)\windowspowershell\modules\adobe_spinner_mini.dll

Filesize
726KB

MD5
3662edafeac734969698a815f969f081

SHA1
3aaea57905969f30564f6f3c8d344dac9c71857a

SHA256
b0c72af868405e57b5fec5a7e7f09f385b66ada63b2847ed173bff8d6ce0671e

SHA512
efb754489beab68c926691ee101d71edeb5af805201ba65621f8b0a9ec82c69ced97a17bbe0ad88d38e022f8936a9dcd80ffd61c8464e640d5ea945b83457ba9

Download Submit
memory/1172-197-0x0000000000000000-mapping.dmp

Download
memory/1172-201-0x0000000004B00000-0x0000000005225000-memory.dmp

Filesize
7.1MB

Download
memory/1172-200-0x0000000004B00000-0x0000000005225000-memory.dmp

Filesize
7.1MB

Download
memory/1800-134-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1800-132-0x0000000000848000-0x000000000085E000-memory.dmp

Filesize
88KB

Download
memory/1800-135-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1800-133-0x00000000007E0000-0x00000000007E9000-memory.dmp

Filesize
36KB

Download
memory/2008-163-0x00000000020B9000-0x000000000218F000-memory.dmp

Filesize
856KB

Download
memory/2008-164-0x0000000002290000-0x00000000023A5000-memory.dmp

Filesize
1.1MB

Download
memory/2008-157-0x0000000000000000-mapping.dmp

Download
memory/2008-165-0x0000000000400000-0x0000000000517000-memory.dmp

Filesize
1.1MB

Download
memory/2096-149-0x0000000007E90000-0x0000000007EA0000-memory.dmp

Filesize
64KB

Download
memory/2096-145-0x0000000002A50000-0x0000000002A60000-memory.dmp

Filesize
64KB

Download
memory/2096-156-0x0000000007E90000-0x0000000007EA0000-memory.dmp

Filesize
64KB

Download
memory/2096-136-0x0000000002A50000-0x0000000002A60000-memory.dmp

Filesize
64KB

Download
memory/2096-137-0x0000000002A50000-0x0000000002A60000-memory.dmp

Filesize
64KB

Download
memory/2096-138-0x0000000002A50000-0x0000000002A60000-memory.dmp

Filesize
64KB

Download
memory/2096-139-0x0000000002A50000-0x0000000002A60000-memory.dmp

Filesize
64KB

Download
memory/2096-140-0x0000000002A50000-0x0000000002A60000-memory.dmp

Filesize
64KB

Download
memory/2096-141-0x0000000002A50000-0x0000000002A60000-memory.dmp

Filesize
64KB

Download
memory/2096-142-0x0000000002A50000-0x0000000002A60000-memory.dmp

Filesize
64KB

Download
memory/2096-143-0x0000000002A50000-0x0000000002A60000-memory.dmp

Filesize
64KB

Download
memory/2096-144-0x0000000002A50000-0x0000000002A60000-memory.dmp

Filesize
64KB

Download
memory/2096-146-0x0000000002A50000-0x0000000002A60000-memory.dmp

Filesize
64KB

Download
memory/2096-147-0x0000000002A50000-0x0000000002A60000-memory.dmp

Filesize
64KB

Download
memory/2096-148-0x0000000002A50000-0x0000000002A60000-memory.dmp

Filesize
64KB

Download
memory/2096-150-0x0000000002A50000-0x0000000002A60000-memory.dmp

Filesize
64KB

Download
memory/2096-151-0x0000000002A50000-0x0000000002A60000-memory.dmp

Filesize
64KB

Download
memory/2096-152-0x0000000002A50000-0x0000000002A60000-memory.dmp

Filesize
64KB

Download
memory/2096-155-0x0000000007E90000-0x0000000007EA0000-memory.dmp

Filesize
64KB

Download
memory/2096-154-0x0000000002A50000-0x0000000002A60000-memory.dmp

Filesize
64KB

Download
memory/2096-153-0x0000000002A50000-0x0000000002A60000-memory.dmp

Filesize
64KB

Download
memory/2256-174-0x00007FF6624A6890-mapping.dmp

Download
memory/2256-179-0x000001A41D0E0000-0x000001A41D30A000-memory.dmp

Filesize
2.2MB

Download
memory/2256-178-0x0000000000E20000-0x0000000001039000-memory.dmp

Filesize
2.1MB

Download
memory/2256-175-0x000001A41EAB0000-0x000001A41EBF0000-memory.dmp

Filesize
1.2MB

Download
memory/2256-176-0x000001A41EAB0000-0x000001A41EBF0000-memory.dmp

Filesize
1.2MB

Download
memory/4224-199-0x00000000032C0000-0x00000000039E5000-memory.dmp

Filesize
7.1MB

Download
memory/4224-184-0x00000000032C0000-0x00000000039E5000-memory.dmp

Filesize
7.1MB

Download
memory/4804-177-0x0000000005999000-0x000000000599B000-memory.dmp

Filesize
8KB

Download
memory/4804-160-0x0000000000000000-mapping.dmp

Download
memory/4804-173-0x0000000005920000-0x0000000005A60000-memory.dmp

Filesize
1.2MB

Download
memory/4804-172-0x0000000005920000-0x0000000005A60000-memory.dmp

Filesize
1.2MB

Download
memory/4804-171-0x0000000005920000-0x0000000005A60000-memory.dmp

Filesize
1.2MB

Download
memory/4804-170-0x0000000005920000-0x0000000005A60000-memory.dmp

Filesize
1.2MB

Download
memory/4804-169-0x0000000005920000-0x0000000005A60000-memory.dmp

Filesize
1.2MB

Download
memory/4804-168-0x0000000005920000-0x0000000005A60000-memory.dmp

Filesize
1.2MB

Download
memory/4804-180-0x0000000004AB0000-0x00000000051D5000-memory.dmp

Filesize
7.1MB

Download
memory/4804-167-0x0000000004AB0000-0x00000000051D5000-memory.dmp

Filesize
7.1MB

Download
memory/4804-166-0x0000000004AB0000-0x00000000051D5000-memory.dmp

Filesize
7.1MB

Download