Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20221111-en - resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system - submitted
21/12/2022, 11:10
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20221111-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20221111-en
windows10-2004-x64
31 signatures
150 seconds
General
- Target file.exe
- Size 241KB
- Sample221221-m9pkgacb69
- SHA256 e571ff508ec99e5039458b4e0aa2f2badd6f2417371f9d406427d8d055f2d63e
- MD5 f5967870b1eb3d4354d6041e09742610
- SHA1 8a5e04682d1c4a25b41782ec66f82fd669026237
- SHA512 fcaa5f6e4c4d430a0f748445b71e26c86c55fca83c933d11b8f26fe7423e523da8a143c52522c942e14064fecf44f31d741b478878a48bdad8c8a4c6eebebfb5
- SSDEEP 3072:IV/fLL3VU2DJF5yfV+J+GpJtPzIoHS8d8rLW4P84nuSe4yHWzcNQK1+eJV5u48:+DLFU8IfQJLvNIwbd8PW85Re32zeRu4
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detects Smokeloader packer 1 IoCs
resource yara_rule behavioral2/memory/4724-133-0x00000000001F0000-0x00000000001F9000-memory.dmp family_smokeloader - SmokeLoader
Modular backdoor trojan in use since 2014.
- Blocklisted process makes network request 2 IoCs
flow pid Process 39 1032 rundll32.exe 40 1032 rundll32.exe - Downloads MZ/PE file
- Executes dropped EXE 2 IoCs
pid Process 1548 EB6E.exe 2032 757F.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation 757F.exe - Loads dropped DLL 3 IoCs
pid Process 1032 rundll32.exe 2032 757F.exe 2032 757F.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts rundll32.exe - Accesses Microsoft Outlook profiles 1 TTPs 4 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook rundll32.exe Key opened \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 rundll32.exe Key opened \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 rundll32.exe Key opened \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 rundll32.exe - Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1032 set thread context of 4784 1032 rundll32.exe 94 - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Program crash 2 IoCs
pid pid_target Process procid_target 3972 1548 WerFault.exe 90 1160 2032 WerFault.exe 100 - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe - Checks processor information in registry 2 TTPs 28 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz rundll32.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\FeatureSet rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Status rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\VendorIdentifier rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Status rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 757F.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision rundll32.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Previous Update Revision rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Previous Update Revision rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Identifier rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Configuration Data rundll32.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Platform Specific Field 1 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 757F.exe - Delays execution with timeout.exe 1 IoCs
pid Process 2196 timeout.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Internet Explorer\Toolbar Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1" Process not Found Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 Process not Found - Modifies registry class 30 IoCs
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots rundll32.exe Set value (data) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots Process not Found Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 Process not Found Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\WorkFolders Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f44471a0359723fa74489c55595fe6b30ee0000 Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 50003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014000000 Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 = 4e0031000000000095555d61100054656d7000003a0009000400efbe6b557d6c955564612e000000000000000000000000000000000000000000000000006ba49a00540065006d007000000014000000 Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = 00000000ffffffff Process not Found Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 Process not Found Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1 Process not Found Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ Process not Found Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 Process not Found Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\NodeSlot = "1" Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\MRUListEx = ffffffff Process not Found Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell Process not Found Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings rundll32.exe Set value (data) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 820074001c0043465346160031000000000000000000100041707044617461000000741a595e96dfd3488d671733bcee28bac5cdfadf9f6756418947c5c76bc0b67f400009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004100700070004400610074006100000042000000 Process not Found Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 Process not Found Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic" Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff Process not Found Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell rundll32.exe - Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2616 Process not Found - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4724 file.exe 4724 file.exe 2616 Process not Found 2616 Process not Found 2616 Process not Found 2616 Process not Found 2616 Process not Found 2616 Process not Found 2616 Process not Found 2616 Process not Found 2616 Process not Found 2616 Process not Found 2616 Process not Found 2616 Process not Found 2616 Process not Found 2616 Process not Found 2616 Process not Found 2616 Process not Found 2616 Process not Found 2616 Process not Found 2616 Process not Found 2616 Process not Found 2616 Process not Found 2616 Process not Found 2616 Process not Found 2616 Process not Found 2616 Process not Found 2616 Process not Found 2616 Process not Found 2616 Process not Found 2616 Process not Found 2616 Process not Found 2616 Process not Found 2616 Process not Found 2616 Process not Found 2616 Process not Found 2616 Process not Found 2616 Process not Found 2616 Process not Found 2616 Process not Found 2616 Process not Found 2616 Process not Found 2616 Process not Found 2616 Process not Found 2616 Process not Found 2616 Process not Found 2616 Process not Found 2616 Process not Found 2616 Process not Found 2616 Process not Found 2616 Process not Found 2616 Process not Found 2616 Process not Found 2616 Process not Found 2616 Process not Found 2616 Process not Found 2616 Process not Found 2616 Process not Found 2616 Process not Found 2616 Process not Found 2616 Process not Found 2616 Process not Found 2616 Process not Found 2616 Process not Found - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2616 Process not Found - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 4724 file.exe - Suspicious use of AdjustPrivilegeToken 33 IoCs
description pid Process Token: SeShutdownPrivilege 2616 Process not Found Token: SeCreatePagefilePrivilege 2616 Process not Found Token: SeDebugPrivilege 1032 rundll32.exe Token: SeShutdownPrivilege 2616 Process not Found Token: SeCreatePagefilePrivilege 2616 Process not Found Token: SeShutdownPrivilege 2616 Process not Found Token: SeCreatePagefilePrivilege 2616 Process not Found Token: SeShutdownPrivilege 2616 Process not Found Token: SeCreatePagefilePrivilege 2616 Process not Found Token: SeShutdownPrivilege 2616 Process not Found Token: SeCreatePagefilePrivilege 2616 Process not Found Token: SeShutdownPrivilege 2616 Process not Found Token: SeCreatePagefilePrivilege 2616 Process not Found Token: SeShutdownPrivilege 2616 Process not Found Token: SeCreatePagefilePrivilege 2616 Process not Found Token: SeShutdownPrivilege 2616 Process not Found Token: SeCreatePagefilePrivilege 2616 Process not Found Token: SeShutdownPrivilege 2616 Process not Found Token: SeCreatePagefilePrivilege 2616 Process not Found Token: SeShutdownPrivilege 2616 Process not Found Token: SeCreatePagefilePrivilege 2616 Process not Found Token: SeShutdownPrivilege 2616 Process not Found Token: SeCreatePagefilePrivilege 2616 Process not Found Token: SeShutdownPrivilege 2616 Process not Found Token: SeCreatePagefilePrivilege 2616 Process not Found Token: SeShutdownPrivilege 2616 Process not Found Token: SeCreatePagefilePrivilege 2616 Process not Found Token: SeShutdownPrivilege 2616 Process not Found Token: SeCreatePagefilePrivilege 2616 Process not Found Token: SeShutdownPrivilege 2616 Process not Found Token: SeCreatePagefilePrivilege 2616 Process not Found Token: SeShutdownPrivilege 2616 Process not Found Token: SeCreatePagefilePrivilege 2616 Process not Found - Suspicious use of FindShellTrayWindow 10 IoCs
pid Process 4784 rundll32.exe 2616 Process not Found 2616 Process not Found 2616 Process not Found 2616 Process not Found 1032 rundll32.exe 2616 Process not Found 2616 Process not Found 2616 Process not Found 2616 Process not Found - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2616 Process not Found 2616 Process not Found - Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 2616 wrote to memory of 1548 2616 Process not Found 90 PID 2616 wrote to memory of 1548 2616 Process not Found 90 PID 2616 wrote to memory of 1548 2616 Process not Found 90 PID 1548 wrote to memory of 1032 1548 EB6E.exe 91 PID 1548 wrote to memory of 1032 1548 EB6E.exe 91 PID 1548 wrote to memory of 1032 1548 EB6E.exe 91 PID 1032 wrote to memory of 4784 1032 rundll32.exe 94 PID 1032 wrote to memory of 4784 1032 rundll32.exe 94 PID 1032 wrote to memory of 4784 1032 rundll32.exe 94 PID 1032 wrote to memory of 1364 1032 rundll32.exe 95 PID 1032 wrote to memory of 1364 1032 rundll32.exe 95 PID 1032 wrote to memory of 1364 1032 rundll32.exe 95 PID 1032 wrote to memory of 944 1032 rundll32.exe 97 PID 1032 wrote to memory of 944 1032 rundll32.exe 97 PID 1032 wrote to memory of 944 1032 rundll32.exe 97 PID 2616 wrote to memory of 2032 2616 Process not Found 100 PID 2616 wrote to memory of 2032 2616 Process not Found 100 PID 2616 wrote to memory of 2032 2616 Process not Found 100 PID 2032 wrote to memory of 1976 2032 757F.exe 101 PID 2032 wrote to memory of 1976 2032 757F.exe 101 PID 2032 wrote to memory of 1976 2032 757F.exe 101 PID 1976 wrote to memory of 2196 1976 cmd.exe 104 PID 1976 wrote to memory of 2196 1976 cmd.exe 104 PID 1976 wrote to memory of 2196 1976 cmd.exe 104 - outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 rundll32.exe - outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 rundll32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:4724
-
C:\Users\Admin\AppData\Local\Temp\EB6E.exeC:\Users\Admin\AppData\Local\Temp\EB6E.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1548 -
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Users\Admin\AppData\Local\Temp\Quspupodwqfhie.tmp",Ritwuoaoyiy2⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Accesses Microsoft Outlook accounts
- Accesses Microsoft Outlook profiles
- Suspicious use of SetThreadContext
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
PID:1032 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61 189073⤵
- Modifies registry class
- Suspicious use of FindShellTrayWindow
PID:4784
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /End /tn \Microsoft\Windows\Wininet\CacheTask3⤵PID:1364
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Run /tn \Microsoft\Windows\Wininet\CacheTask3⤵PID:944
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1548 -s 5282⤵
- Program crash
PID:3972
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 1548 -ip 15481⤵PID:3436
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:1380
-
C:\Users\Admin\AppData\Local\Temp\757F.exeC:\Users\Admin\AppData\Local\Temp\757F.exe1⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:2032 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\757F.exe" & exit2⤵
- Suspicious use of WriteProcessMemory
PID:1976 -
C:\Windows\SysWOW64\timeout.exetimeout /t 63⤵
- Delays execution with timeout.exe
PID:2196
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2032 -s 20802⤵
- Program crash
PID:1160
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 2032 -ip 20321⤵PID:1836
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\mozglue.dll
- Size 133KB
- SHA256 3fe6b1c54b8cf28f571e0c5d6636b4069a8ab00b4f11dd842cfec00691d0c9cd
- MD5 8f73c08a9660691143661bf7332c3c27
- SHA1 37fa65dd737c50fda710fdbde89e51374d0c204a
- SHA512 0042ecf9b3571bb5eba2de893e8b2371df18f7c5a589f52ee66e4bfbaa15a5b8b7cc6a155792aaa8988528c27196896d5e82e1751c998bacea0d92395f66ad89
- SSDEEP 3072:7Gyzk/x2Wp53pUzPoNpj/kVghp1qt/dXDyp4D2JJJvPhrSeTuk:6yQ2Wp53iO/kVghp12/dXDyyD2JJJvPR
- MD5 SHA1 SHA512 SSDEEP
- Path C:\ProgramData\nss3.dll
- Size 1.2MB
- SHA256 e2935b5b28550d47dc971f456d6961f20d1633b4892998750140e0eaa9ae9d78
- MD5 bfac4e3c5908856ba17d41edcd455a51
- SHA1 8eec7e888767aa9e4cca8ff246eb2aacb9170428
- SHA512 2565bab776c4d732ffb1f9b415992a4c65b81bcd644a9a1df1333a269e322925fc1df4f76913463296efd7c88ef194c3056de2f1ca1357d7b5fe5ff0da877a66
- SSDEEP 24576:Sb5zzlswYNYLVJAwfpeYQ1Dw/fEE8DhSJVIVfRyAkgO6S/V/jbHpls4MSRSMxkoo:4zW5ygDwnEZIYkjgWjblMSRSMqH
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\757F.exe
- Size 345KB
- SHA256 f4903708e3119ee5614cdff2071f645a3e1be93826b7e45f7302854c1e925ced
- MD5 89337ce7760628d22c0852a4e8a4ec3c
- SHA1 f8a3de35622cef7badd7b7d8eed15d1efe533c03
- SHA512 10d8e9a5537c63ebda34f4966ea814c6996d1b2af5ea09131c570ab185e51e605e667f3e98614616661657864a3699facba9931040e77847e420446f622b2a08
- SSDEEP 6144:3MLK7pllIZIlC+/m5toMh4FHS2GkwN0KW85sm4ka5zeRu4:3MG7poIko4kw+x5FU8
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\757F.exe
- Size 345KB
- SHA256 f4903708e3119ee5614cdff2071f645a3e1be93826b7e45f7302854c1e925ced
- MD5 89337ce7760628d22c0852a4e8a4ec3c
- SHA1 f8a3de35622cef7badd7b7d8eed15d1efe533c03
- SHA512 10d8e9a5537c63ebda34f4966ea814c6996d1b2af5ea09131c570ab185e51e605e667f3e98614616661657864a3699facba9931040e77847e420446f622b2a08
- SSDEEP 6144:3MLK7pllIZIlC+/m5toMh4FHS2GkwN0KW85sm4ka5zeRu4:3MG7poIko4kw+x5FU8
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\EB6E.exe
- Size 1.1MB
- SHA256 76b3c502e920d0b47f3314be49a8960e66752031731be9efb3328e681d06d1f5
- MD5 0be021c57eeac99798b609431408cede
- SHA1 329ba46c49ae0605adac974cffd1211b92ce49fc
- SHA512 4b562a3c955abc2a5ecbbb0c2ea0448f5d834bd739abde0ef8fda68facf2621ce907b5927fb25fcc149065aab9c4f91e5a0a06cb0d190c914b3760865b1cb239
- SSDEEP 24576:29wkYpicasFt6/9jf+FmrfYFiDbaza0DjlJQKNTnjR5aa:O4BFO9j4GfwBlJQWTn
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\EB6E.exe
- Size 1.1MB
- SHA256 76b3c502e920d0b47f3314be49a8960e66752031731be9efb3328e681d06d1f5
- MD5 0be021c57eeac99798b609431408cede
- SHA1 329ba46c49ae0605adac974cffd1211b92ce49fc
- SHA512 4b562a3c955abc2a5ecbbb0c2ea0448f5d834bd739abde0ef8fda68facf2621ce907b5927fb25fcc149065aab9c4f91e5a0a06cb0d190c914b3760865b1cb239
- SSDEEP 24576:29wkYpicasFt6/9jf+FmrfYFiDbaza0DjlJQKNTnjR5aa:O4BFO9j4GfwBlJQWTn
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\Quspupodwqfhie.tmp
- Size 814KB
- SHA256 226eac6b8ce415bf0900050818f8212129fc51d14dab026e7b8600aa89d65c8a
- MD5 f93876956e6e2f754c8be97ac269729d
- SHA1 bf0eb05f31b4177e5e2fdeb203698d5018c8ee12
- SHA512 c3c53aca227ac035ac838002c8f68b2d449ac983a85780356eb8ef7791171fdb2133cf7f8b694cd4e62b6239b5b8ca21013c483c797153dcd57ea845d4b458cb
- SSDEEP 12288:FI1x+fRZMhMlCKoG6/IqKoF7TUv/ncB8CZp5jff2MkWkSsEciPj3:6azvb6AqKoBUvvcB8CZ7n21WZ1cir
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\Quspupodwqfhie.tmp
- Size 814KB
- SHA256 226eac6b8ce415bf0900050818f8212129fc51d14dab026e7b8600aa89d65c8a
- MD5 f93876956e6e2f754c8be97ac269729d
- SHA1 bf0eb05f31b4177e5e2fdeb203698d5018c8ee12
- SHA512 c3c53aca227ac035ac838002c8f68b2d449ac983a85780356eb8ef7791171fdb2133cf7f8b694cd4e62b6239b5b8ca21013c483c797153dcd57ea845d4b458cb
- SSDEEP 12288:FI1x+fRZMhMlCKoG6/IqKoF7TUv/ncB8CZp5jff2MkWkSsEciPj3:6azvb6AqKoBUvvcB8CZ7n21WZ1cir
- MD5 SHA1 SHA512 SSDEEP