Analysis
-
max time kernel
121s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
20-12-2022 14:33
Static task
static1
Behavioral task
behavioral1
Sample
dfef29259364341a9475d0d5008fc3700a76e4aa57e529c823e47a8349318c41.exe
Resource
win7-20220812-en
General
-
Target
dfef29259364341a9475d0d5008fc3700a76e4aa57e529c823e47a8349318c41.exe
-
Size
1.1MB
-
MD5
c2c8c8b30c7424edb560260d88765b78
-
SHA1
5dfe2e9f27884922bacac628c8a160c2b4aef57a
-
SHA256
dfef29259364341a9475d0d5008fc3700a76e4aa57e529c823e47a8349318c41
-
SHA512
a6700c62ecc52ac93486c7160ae03b9b7b3f81b0fef7f8330d3b8171cbb8a49c7deb6b7f893dd3b648951b61263d50462ac443c200ce224230d5b5e3600a952e
-
SSDEEP
24576:YJRACgLoI1NKdK1EPT4p0S/uICN5a7NGMPhwJPN/1amk8rs:dCgLoI/iAIS/uYZZwhamF
Malware Config
Signatures
-
Blocklisted process makes network request 3 IoCs
Processes:
rundll32.exeflow pid process 2 1756 rundll32.exe 5 1756 rundll32.exe 9 1756 rundll32.exe -
Sets DLL path for service in the registry 2 TTPs 1 IoCs
Processes:
rundll32.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SC_Reader\Parameters\ServiceDll = "C:\\Program Files (x86)\\Windows Media Player\\en-US\\SC_Reader.dll" rundll32.exe -
Sets service image path in registry 2 TTPs 1 IoCs
Processes:
rundll32.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SC_Reader\ImagePath = "C:\\Windows\\system32\\svchost.exe -k LocalService" rundll32.exe -
Loads dropped DLL 6 IoCs
Processes:
rundll32.exesvchost.exerundll32.exepid process 1756 rundll32.exe 1952 svchost.exe 820 rundll32.exe 820 rundll32.exe 820 rundll32.exe 820 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
rundll32.exedescription pid process target process PID 1756 set thread context of 1072 1756 rundll32.exe rundll32.exe -
Drops file in Program Files directory 41 IoCs
Processes:
rundll32.exedescription ioc process File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\eng32.clx rundll32.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Spelling.api rundll32.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\TURKISH.TXT rundll32.exe File created C:\Program Files (x86)\Windows Media Player\en-US\AcroBroker.exe rundll32.exe File created C:\Program Files (x86)\Windows Media Player\en-US\VDK10.STP rundll32.exe File created C:\Program Files (x86)\Windows Media Player\en-US\IA32.api rundll32.exe File created C:\Program Files (x86)\Windows Media Player\en-US\can129.hsp rundll32.exe File created C:\Program Files (x86)\Windows Media Player\en-US\AcroRd32Info.exe rundll32.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Esl\AiodLite.dll rundll32.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\Real.mpp rundll32.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\ENU\VDK10.RSD rundll32.exe File created C:\Program Files (x86)\Windows Media Player\en-US\TURKISH.TXT rundll32.exe File created C:\Program Files (x86)\Windows Media Player\en-US\StandardBusiness.pdf rundll32.exe File created C:\Program Files (x86)\Windows Media Player\en-US\SC_Reader.dll rundll32.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroSign.prc rundll32.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Acrofx32.dll rundll32.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\PDFSigQFormalRep.pdf rundll32.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\IA32.api rundll32.exe File created C:\Program Files (x86)\Windows Media Player\en-US\Spelling.api rundll32.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\brt.hyp rundll32.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\ENU\VDK10.STP rundll32.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\can129.hsp rundll32.exe File created C:\Program Files (x86)\Windows Media Player\en-US\dao360.dll rundll32.exe File created C:\Program Files (x86)\Windows Media Player\en-US\DisplayLanguageNames.en_US_POSIX.txt rundll32.exe File created C:\Program Files (x86)\Windows Media Player\en-US\AcroSign.prc rundll32.exe File created C:\Program Files (x86)\Windows Media Player\en-US\Acrofx32.dll rundll32.exe File created C:\Program Files (x86)\Windows Media Player\en-US\brt.hyp rundll32.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroBroker.exe rundll32.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\DAO\dao360.dll rundll32.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\abcpy.ini rundll32.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\atl.dll rundll32.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\DisplayLanguageNames.en_US_POSIX.txt rundll32.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\StandardBusiness.pdf rundll32.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32Info.exe rundll32.exe File created C:\Program Files (x86)\Windows Media Player\en-US\atl.dll rundll32.exe File created C:\Program Files (x86)\Windows Media Player\en-US\AiodLite.dll rundll32.exe File created C:\Program Files (x86)\Windows Media Player\en-US\PDFSigQFormalRep.pdf rundll32.exe File created C:\Program Files (x86)\Windows Media Player\en-US\eng32.clx rundll32.exe File created C:\Program Files (x86)\Windows Media Player\en-US\Real.mpp rundll32.exe File created C:\Program Files (x86)\Windows Media Player\en-US\abcpy.ini rundll32.exe File created C:\Program Files (x86)\Windows Media Player\en-US\VDK10.RSD rundll32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 50 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
rundll32.exesvchost.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Identifier rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data rundll32.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Status svchost.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 svchost.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 svchost.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Platform ID rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Status rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Signature svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Status rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz rundll32.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Previous Update Signature svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Platform ID svchost.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\FeatureSet rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Configuration Data rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform ID rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform ID svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\VendorIdentifier svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Component Information svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Previous Update Signature rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Component Information rundll32.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Previous Update Signature rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Status svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\FeatureSet svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString svchost.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Identifier svchost.exe -
Modifies registry class 24 IoCs
Processes:
rundll32.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags rundll32.exe Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 4c003100000000000000000010004c6f63616c00380008000400efbe00000000000000002a000000000000000000000000000000000000000000000000004c006f00630061006c00000014000000 rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 rundll32.exe Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff rundll32.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\NodeSlot = "1" rundll32.exe Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 rundll32.exe Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff rundll32.exe Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1 rundll32.exe Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 rundll32.exe Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\MRUListEx = ffffffff rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell rundll32.exe Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 rundll32.exe Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 = 4a0031000000000000000000102054656d700000360008000400efbe00000000000000002a00000000000000000000000000000000000000000000000000540065006d007000000014000000 rundll32.exe Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = 00000000ffffffff rundll32.exe Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 7e0074001c0043465346160031000000000000000000100041707044617461000000741a595e96dfd3488d671733bcee28bac5cdfadf9f6756418947c5c76bc0b67f3c0008000400efbe00000000000000002a000000000000000000000000000000000000000000000000004100700070004400610074006100000042000000 rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\KnownFolderDerivedFolderType = "{57807898-8C4F-4462-BB63-71042380B109}" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU rundll32.exe Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f44471a0359723fa74489c55595fe6b30ee0000 rundll32.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
svchost.exepid process 1952 svchost.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
rundll32.exedescription pid process Token: SeDebugPrivilege 1756 rundll32.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
rundll32.exepid process 1072 rundll32.exe -
Suspicious use of WriteProcessMemory 19 IoCs
Processes:
dfef29259364341a9475d0d5008fc3700a76e4aa57e529c823e47a8349318c41.exerundll32.exesvchost.exedescription pid process target process PID 1980 wrote to memory of 1756 1980 dfef29259364341a9475d0d5008fc3700a76e4aa57e529c823e47a8349318c41.exe rundll32.exe PID 1980 wrote to memory of 1756 1980 dfef29259364341a9475d0d5008fc3700a76e4aa57e529c823e47a8349318c41.exe rundll32.exe PID 1980 wrote to memory of 1756 1980 dfef29259364341a9475d0d5008fc3700a76e4aa57e529c823e47a8349318c41.exe rundll32.exe PID 1980 wrote to memory of 1756 1980 dfef29259364341a9475d0d5008fc3700a76e4aa57e529c823e47a8349318c41.exe rundll32.exe PID 1980 wrote to memory of 1756 1980 dfef29259364341a9475d0d5008fc3700a76e4aa57e529c823e47a8349318c41.exe rundll32.exe PID 1980 wrote to memory of 1756 1980 dfef29259364341a9475d0d5008fc3700a76e4aa57e529c823e47a8349318c41.exe rundll32.exe PID 1980 wrote to memory of 1756 1980 dfef29259364341a9475d0d5008fc3700a76e4aa57e529c823e47a8349318c41.exe rundll32.exe PID 1756 wrote to memory of 1072 1756 rundll32.exe rundll32.exe PID 1756 wrote to memory of 1072 1756 rundll32.exe rundll32.exe PID 1756 wrote to memory of 1072 1756 rundll32.exe rundll32.exe PID 1756 wrote to memory of 1072 1756 rundll32.exe rundll32.exe PID 1756 wrote to memory of 1072 1756 rundll32.exe rundll32.exe PID 1952 wrote to memory of 820 1952 svchost.exe rundll32.exe PID 1952 wrote to memory of 820 1952 svchost.exe rundll32.exe PID 1952 wrote to memory of 820 1952 svchost.exe rundll32.exe PID 1952 wrote to memory of 820 1952 svchost.exe rundll32.exe PID 1952 wrote to memory of 820 1952 svchost.exe rundll32.exe PID 1952 wrote to memory of 820 1952 svchost.exe rundll32.exe PID 1952 wrote to memory of 820 1952 svchost.exe rundll32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\dfef29259364341a9475d0d5008fc3700a76e4aa57e529c823e47a8349318c41.exe"C:\Users\Admin\AppData\Local\Temp\dfef29259364341a9475d0d5008fc3700a76e4aa57e529c823e47a8349318c41.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Users\Admin\AppData\Local\Temp\Ipoetwsuqhd.tmp",Sufeidweoe2⤵
- Blocklisted process makes network request
- Sets DLL path for service in the registry
- Sets service image path in registry
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61 239893⤵
- Modifies registry class
- Suspicious use of FindShellTrayWindow
-
C:\Windows\SysWOW64\schtasks.exeschtasks /End /tn \Microsoft\Windows\Wininet\CacheTask3⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k LocalService1⤵
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\system32\rundll32.exe" "c:\program files (x86)\windows media player\en-us\sc_reader.dll",eDs9RTI1dQ==2⤵
- Loads dropped DLL
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\{F21FF8C2-A136-6557-C5DD-F59D9999C8E7}\34e548a8-3268-4dde-bedf-c40f9b6c814a.devicemetadata-msFilesize
13KB
MD5e4df12694bb232e181ce359c6ccc4b8b
SHA1635891358e6b39e180f628feca901b2d11f1c34a
SHA25634aff42438ba883f180da0f4a78163b951add412feec65a293768efe152713a3
SHA512a4a29e44538a2274ec680554c9f1207d62b6b30a950a9a4914bdc7cef2c1cc22c98598055b1f79410ff5385ea30f8d0e001eb36c0f08f13a5b2b28671dac511d
-
C:\ProgramData\{F21FF8C2-A136-6557-C5DD-F59D9999C8E7}\Help_MKWD_AssetId.H1WFilesize
229KB
MD5273db6cc1a6469283b615dc0be4c33c5
SHA11d164856d6375fa989c682079e7d9a98c032a073
SHA256074862c6f3b8251f59424f44103488437d7d9108b75fc232eb05876066bbe270
SHA512acd3e4b70c4a7d2fe4ac3d020d06c99c36b728299ac68a64cd87a6e7089ca0a4c79bd9b0c1a297bb07eb1fcd5a2b8a27ef9d4308922a95a660b765ff0e769400
-
C:\ProgramData\{F21FF8C2-A136-6557-C5DD-F59D9999C8E7}\MySite.icoFilesize
24KB
MD590f8d4cfa4a0b76a6299fedf3391a061
SHA11dc564eab3e8e4f1dacfce883e2faad45660fd29
SHA256f358343f8d2239e316e12130eb0cb8efbcb696705a82444eb46ceadf0d9a2650
SHA5123ca446615dd644bf724d54105075b335fe6aeab4c7cde0b83dab23a94ff1b0d8d0a5be1519249911ee17dbf50ea4b44fb9e7d37a3d10ad0a367a5a304723249a
-
C:\ProgramData\{F21FF8C2-A136-6557-C5DD-F59D9999C8E7}\Ringtone 07.wmaFilesize
92KB
MD5832e9174653fbd4eacdbfaf5da0ddb77
SHA15e9827310d70acf913c2d26e5c82040b61bb24f0
SHA256c212b041d37438a8a49dbc64b9a84c27a3a5dd491616f28822c691fdd4ead9fb
SHA512a69844e222bf96b2671304489f56e738dbb9d6e983187e773e223e286523a428a0fe56970ae3f2e1b6dde0eda89a33425a8b889409470aba39c73ceb36ce6277
-
C:\ProgramData\{F21FF8C2-A136-6557-C5DD-F59D9999C8E7}\Shpetph.tmpFilesize
2.3MB
MD5074214bbf395a7faa6f32dfa013ebe1b
SHA1c1d1a331fb2f4b97c4068ac9e1fd406a1d448161
SHA256f8520d48613ad7d185a0e2dec40025e790ad9bf9b7ab2e1fa6ce9666830d8d22
SHA51243a42af1af8e8db955a7cf3b40380334052832472b3ab38c7aaa21ef48edbab38d1e279f70e8f0cbe2b6dc9a8d5fd66538d2d6812d0a742812a3d76bfc86bc73
-
C:\ProgramData\{F21FF8C2-A136-6557-C5DD-F59D9999C8E7}\Shpetph.tmpFilesize
2.3MB
MD5aae530331ed421444a2a23c211f4cef8
SHA12e4b847e3eaba1a395e1e804a2f0aba609585cd1
SHA2567a8ec25cd705c46ca732173863798dabb99f05604b5b7a6e3271572fa48d2189
SHA51263c0082a11bd6b78aa0fb0ed850d55cbadc0793094584d5f0fb719f890ce93cfde273366f78b048e4d3a28f474bba3b522176d0b6999ac8c6e94aa6e609406cb
-
C:\ProgramData\{F21FF8C2-A136-6557-C5DD-F59D9999C8E7}\resource.xmlFilesize
1KB
MD59e3d2d6830eba41e31e8558da30ddccd
SHA1f5fbe0dfef87a30a9898cd6e1e7691c7dd9a9b99
SHA25650ce5d2f9497955246143e7bb7d7584f221c15574a910c7cc11af87537711d25
SHA512d1f3774e8c2bdfb6acbb8b9429f59fce5048b5adc4ddc7ecacf7bf52862715db35aee04884a24a8e329e8d10aa5fd06cac5360aad9dd296582453fadadf4d7ee
-
C:\ProgramData\{F21FF8C2-A136-6557-C5DD-F59D9999C8E7}\{FAD384B6-4068-45FB-8966-B465D310EC9C}.2.ver0x0000000000000002.dbFilesize
1KB
MD5a263c80cdda0bfe4a8203e10a1c1ea19
SHA10f197022aca6a598c4ff644547b4d899623420bf
SHA2563b09a1e3b42003a7b5388bc7a75d16cde75d13f2f6344f47b6fccf2c03f03066
SHA5124834abe8f81aa9db6b2e0e8dec0b1347ae6d10f62c9db4b5600c88acede25ffe4f9d3cf0c1217ceb6541e0a1b29093519b7ef1548f5c223924e80f50a3e536f0
-
C:\Users\Admin\AppData\Local\Temp\Ipoetwsuqhd.tmpFilesize
726KB
MD56ea8a6cc5fed6c664df1b3ef7c56b55d
SHA16b244d708706441095ae97294928967ddf28432b
SHA2562c7500ac5ebb0116e640747b8a5f0a2648f7d2f5f516ebb398b864cccc626fbe
SHA5124a328a66df407e4c9fa230287104771ea3b5dd8265d60314797426101a8be19d13bc57de2388f0f90b20ada82d950e156ef4267c029080a6254b80eefd8b8741
-
\??\c:\program files (x86)\windows media player\en-us\sc_reader.dllFilesize
726KB
MD54bd619d00b372dadb6ed45f42654f01f
SHA1b00b01175592161e79a18b64138a0895ca947846
SHA256d1956af1792c4a638a4f14bbe297168d3072cb99776dc851fede4ce4de952f48
SHA512726d130816db8cd53db320d89472cb07ae1c0139c118f97fbbf291e09e9c0bca4fcf64667f065acf8f45e15745cab750d07b13ff7f278c954492b2517331d300
-
\Program Files (x86)\Windows Media Player\en-US\SC_Reader.dllFilesize
726KB
MD54bd619d00b372dadb6ed45f42654f01f
SHA1b00b01175592161e79a18b64138a0895ca947846
SHA256d1956af1792c4a638a4f14bbe297168d3072cb99776dc851fede4ce4de952f48
SHA512726d130816db8cd53db320d89472cb07ae1c0139c118f97fbbf291e09e9c0bca4fcf64667f065acf8f45e15745cab750d07b13ff7f278c954492b2517331d300
-
\Program Files (x86)\Windows Media Player\en-US\SC_Reader.dllFilesize
726KB
MD54bd619d00b372dadb6ed45f42654f01f
SHA1b00b01175592161e79a18b64138a0895ca947846
SHA256d1956af1792c4a638a4f14bbe297168d3072cb99776dc851fede4ce4de952f48
SHA512726d130816db8cd53db320d89472cb07ae1c0139c118f97fbbf291e09e9c0bca4fcf64667f065acf8f45e15745cab750d07b13ff7f278c954492b2517331d300
-
\Program Files (x86)\Windows Media Player\en-US\SC_Reader.dllFilesize
726KB
MD54bd619d00b372dadb6ed45f42654f01f
SHA1b00b01175592161e79a18b64138a0895ca947846
SHA256d1956af1792c4a638a4f14bbe297168d3072cb99776dc851fede4ce4de952f48
SHA512726d130816db8cd53db320d89472cb07ae1c0139c118f97fbbf291e09e9c0bca4fcf64667f065acf8f45e15745cab750d07b13ff7f278c954492b2517331d300
-
\Program Files (x86)\Windows Media Player\en-US\SC_Reader.dllFilesize
726KB
MD54bd619d00b372dadb6ed45f42654f01f
SHA1b00b01175592161e79a18b64138a0895ca947846
SHA256d1956af1792c4a638a4f14bbe297168d3072cb99776dc851fede4ce4de952f48
SHA512726d130816db8cd53db320d89472cb07ae1c0139c118f97fbbf291e09e9c0bca4fcf64667f065acf8f45e15745cab750d07b13ff7f278c954492b2517331d300
-
\Program Files (x86)\Windows Media Player\en-US\SC_Reader.dllFilesize
726KB
MD54bd619d00b372dadb6ed45f42654f01f
SHA1b00b01175592161e79a18b64138a0895ca947846
SHA256d1956af1792c4a638a4f14bbe297168d3072cb99776dc851fede4ce4de952f48
SHA512726d130816db8cd53db320d89472cb07ae1c0139c118f97fbbf291e09e9c0bca4fcf64667f065acf8f45e15745cab750d07b13ff7f278c954492b2517331d300
-
\Program Files\Mozilla Firefox\firefox.exeFilesize
562KB
MD5d388df6ed5ccbf1acdeda5af2d18cb0b
SHA1124d3c2ba93644ac6c2d7253de242b46be836692
SHA2568bcfd8420d721cc0ca50c1bef653e63e013ce201dfcca5927228eb25c9abf606
SHA512f45200d296f4956ec2c39115095559e7825a748b5481c1a3244edf362a49c40b90d778fcdf4bf629095661d96879c96259574d9bfc29d81b6b14f19f4c32d234
-
\Program Files\Mozilla Firefox\firefox.exeFilesize
562KB
MD5d388df6ed5ccbf1acdeda5af2d18cb0b
SHA1124d3c2ba93644ac6c2d7253de242b46be836692
SHA2568bcfd8420d721cc0ca50c1bef653e63e013ce201dfcca5927228eb25c9abf606
SHA512f45200d296f4956ec2c39115095559e7825a748b5481c1a3244edf362a49c40b90d778fcdf4bf629095661d96879c96259574d9bfc29d81b6b14f19f4c32d234
-
\Program Files\Mozilla Firefox\firefox.exeFilesize
562KB
MD5d388df6ed5ccbf1acdeda5af2d18cb0b
SHA1124d3c2ba93644ac6c2d7253de242b46be836692
SHA2568bcfd8420d721cc0ca50c1bef653e63e013ce201dfcca5927228eb25c9abf606
SHA512f45200d296f4956ec2c39115095559e7825a748b5481c1a3244edf362a49c40b90d778fcdf4bf629095661d96879c96259574d9bfc29d81b6b14f19f4c32d234
-
\Program Files\Mozilla Firefox\firefox.exeFilesize
562KB
MD5d388df6ed5ccbf1acdeda5af2d18cb0b
SHA1124d3c2ba93644ac6c2d7253de242b46be836692
SHA2568bcfd8420d721cc0ca50c1bef653e63e013ce201dfcca5927228eb25c9abf606
SHA512f45200d296f4956ec2c39115095559e7825a748b5481c1a3244edf362a49c40b90d778fcdf4bf629095661d96879c96259574d9bfc29d81b6b14f19f4c32d234
-
\Users\Admin\AppData\Local\Temp\Ipoetwsuqhd.tmpFilesize
726KB
MD56ea8a6cc5fed6c664df1b3ef7c56b55d
SHA16b244d708706441095ae97294928967ddf28432b
SHA2562c7500ac5ebb0116e640747b8a5f0a2648f7d2f5f516ebb398b864cccc626fbe
SHA5124a328a66df407e4c9fa230287104771ea3b5dd8265d60314797426101a8be19d13bc57de2388f0f90b20ada82d950e156ef4267c029080a6254b80eefd8b8741
-
memory/820-103-0x0000000003910000-0x0000000004035000-memory.dmpFilesize
7.1MB
-
memory/820-99-0x0000000003910000-0x0000000004035000-memory.dmpFilesize
7.1MB
-
memory/820-101-0x0000000003910000-0x0000000004035000-memory.dmpFilesize
7.1MB
-
memory/820-102-0x0000000003910000-0x0000000004035000-memory.dmpFilesize
7.1MB
-
memory/820-92-0x0000000000000000-mapping.dmp
-
memory/1068-108-0x0000000000000000-mapping.dmp
-
memory/1072-76-0x0000000001E40000-0x000000000206A000-memory.dmpFilesize
2.2MB
-
memory/1072-75-0x0000000000210000-0x0000000000429000-memory.dmpFilesize
2.1MB
-
memory/1072-74-0x000007FEFC2C1000-0x000007FEFC2C3000-memory.dmpFilesize
8KB
-
memory/1072-73-0x0000000002070000-0x00000000021B0000-memory.dmpFilesize
1.2MB
-
memory/1072-72-0x0000000002070000-0x00000000021B0000-memory.dmpFilesize
1.2MB
-
memory/1072-71-0x00000000FF4A3CEC-mapping.dmp
-
memory/1072-66-0x0000000000210000-0x0000000000429000-memory.dmpFilesize
2.1MB
-
memory/1756-69-0x0000000004C40000-0x0000000004D80000-memory.dmpFilesize
1.2MB
-
memory/1756-68-0x0000000004DA0000-0x0000000004EE0000-memory.dmpFilesize
1.2MB
-
memory/1756-55-0x0000000000000000-mapping.dmp
-
memory/1756-59-0x0000000004510000-0x0000000004C35000-memory.dmpFilesize
7.1MB
-
memory/1756-77-0x0000000004510000-0x0000000004C35000-memory.dmpFilesize
7.1MB
-
memory/1756-70-0x0000000004C40000-0x0000000004D80000-memory.dmpFilesize
1.2MB
-
memory/1756-61-0x0000000004510000-0x0000000004C35000-memory.dmpFilesize
7.1MB
-
memory/1756-62-0x0000000004510000-0x0000000004C35000-memory.dmpFilesize
7.1MB
-
memory/1756-65-0x0000000004DA0000-0x0000000004EE0000-memory.dmpFilesize
1.2MB
-
memory/1756-63-0x0000000004C40000-0x0000000004D80000-memory.dmpFilesize
1.2MB
-
memory/1756-64-0x0000000004C40000-0x0000000004D80000-memory.dmpFilesize
1.2MB
-
memory/1952-85-0x00000000039B0000-0x00000000040D5000-memory.dmpFilesize
7.1MB
-
memory/1952-82-0x00000000039B0000-0x00000000040D5000-memory.dmpFilesize
7.1MB
-
memory/1952-84-0x00000000039B0000-0x00000000040D5000-memory.dmpFilesize
7.1MB
-
memory/1952-109-0x00000000039B0000-0x00000000040D5000-memory.dmpFilesize
7.1MB
-
memory/1980-54-0x00000000756B1000-0x00000000756B3000-memory.dmpFilesize
8KB