Analysis
- max time kernel
149s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20221111-en - resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system - submitted
23/12/2022, 04:21
Static task
static1
Behavioral task
behavioral1
Sample
cdeee6b3ed1cf3fda7a61c7d2ffec102.exe
Resource
win7-20220812-en
windows7-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
cdeee6b3ed1cf3fda7a61c7d2ffec102.exe
Resource
win10v2004-20221111-en
windows10-2004-x64
21 signatures
150 seconds
General
- Target cdeee6b3ed1cf3fda7a61c7d2ffec102.exe
- Size 1.1MB
- Sample221223-eynvssah91
- SHA256 3f90b1365a96b6f621ee3010f110da568909bedaa96e735dc6ce211e1176f91a
- MD5 cdeee6b3ed1cf3fda7a61c7d2ffec102
- SHA1 be293f50521ff48bcdea938b2de14e69e057274d
- SHA512 a6bbebf2c4a665e39f2c116c56aedfbb0fded90673383677d66b6f2e13187d82054a39d394ab2cb80a0f15d2f58cd66f3a09b2bac796013ddf1ef3acb010f263
- SSDEEP 24576:GGb4c/ud0VVyfTjTvUzXyRpQu5bOyfLI7Dw2A5OZzRCr:n4c/O0X+TU2RpDfk02Z
- MD5 SHA1 SHA512 SSDEEP
Score
8/10
Malware Config
Signatures
- Blocklisted process makes network request 4 IoCs
flow pid Process 9 2828 rundll32.exe 10 2828 rundll32.exe 40 2828 rundll32.exe 42 2828 rundll32.exe - Sets DLL path for service in the registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Onix32\Parameters\ServiceDll = "C:\\Program Files (x86)\\WindowsPowerShell\\Configuration\\Onix32.dll" rundll32.exe - Sets service image path in registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Onix32\ImagePath = "C:\\Windows\\system32\\svchost.exe -k LocalService" rundll32.exe - Loads dropped DLL 3 IoCs
pid Process 2828 rundll32.exe 1672 svchost.exe 5036 rundll32.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts rundll32.exe - Accesses Microsoft Outlook profiles 1 TTPs 4 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 rundll32.exe Key opened \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook rundll32.exe Key opened \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 rundll32.exe Key opened \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 rundll32.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2828 set thread context of 940 2828 rundll32.exe 90 - Drops file in Program Files directory 59 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\3difr.x3d rundll32.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.ini rundll32.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe rundll32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\s_filetype_xd.svg rundll32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\MPP\QuickTime.mpp rundll32.exe File opened for modification C:\Program Files\Mozilla Firefox\defaults\pref\channel-prefs.js rundll32.exe File opened for modification C:\Program Files\Mozilla Firefox\api-ms-win-crt-string-l1-1-0.dll rundll32.exe File opened for modification C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\clearkey.dll.sig rundll32.exe File opened for modification C:\Program Files\7-Zip\Lang\fur.txt rundll32.exe File created C:\Program Files (x86)\WindowsPowerShell\Configuration\Onix32.dll rundll32.exe File created C:\Program Files (x86)\WindowsPowerShell\Configuration\OptimizePDF_R_RHP.aapp rundll32.exe File created C:\Program Files (x86)\WindowsPowerShell\Configuration\aic_file_icons_highcontrast.png rundll32.exe File created C:\Program Files (x86)\WindowsPowerShell\Configuration\back-arrow-down.svg rundll32.exe File opened for modification C:\Program Files\7-Zip\Lang\gu.txt rundll32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\back-arrow-down.svg rundll32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\AppCenter_R.aapp rundll32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\open_original_form.gif rundll32.exe File opened for modification C:\Program Files\Mozilla Firefox\api-ms-win-crt-math-l1-1-0.dll rundll32.exe File opened for modification C:\Program Files\7-Zip\Lang\ba.txt rundll32.exe File opened for modification C:\Program Files\7-Zip\Lang\af.txt rundll32.exe File opened for modification C:\Program Files\7-Zip\Lang\hi.txt rundll32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\sqlite.dll rundll32.exe File created C:\Program Files (x86)\WindowsPowerShell\Configuration\AppCenter_R.aapp rundll32.exe File created C:\Program Files (x86)\WindowsPowerShell\Configuration\index.html rundll32.exe File opened for modification C:\Program Files\7-Zip\Lang\da.txt rundll32.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe rundll32.exe File opened for modification C:\Program Files\7-Zip\Lang\en.ttt rundll32.exe File opened for modification C:\Program Files\7-Zip\Lang\is.txt rundll32.exe File created C:\Program Files (x86)\WindowsPowerShell\Configuration\review_email.gif rundll32.exe File created C:\Program Files (x86)\WindowsPowerShell\Configuration\rename.svg rundll32.exe File created C:\Program Files (x86)\WindowsPowerShell\Configuration\Comments.aapp rundll32.exe File created C:\Program Files (x86)\WindowsPowerShell\Configuration\distribute_form.gif rundll32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\OptimizePDF_R_RHP.aapp rundll32.exe File created C:\Program Files (x86)\WindowsPowerShell\Configuration\sqlite.dll rundll32.exe File created C:\Program Files (x86)\WindowsPowerShell\Configuration\s_filetype_xd.svg rundll32.exe File opened for modification C:\Program Files\7-Zip\Lang\hr.txt rundll32.exe File opened for modification C:\Program Files\Mozilla Firefox\api-ms-win-core-synch-l1-2-0.dll rundll32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\ccloud.png rundll32.exe File opened for modification C:\Program Files\Mozilla Firefox\AccessibleMarshal.dll rundll32.exe File opened for modification C:\Program Files\7-Zip\Lang\io.txt rundll32.exe File opened for modification C:\Program Files\Mozilla Firefox\dependentlibs.list rundll32.exe File opened for modification C:\Program Files\7-Zip\Lang\ca.txt rundll32.exe File opened for modification C:\Program Files\Mozilla Firefox\api-ms-win-crt-convert-l1-1-0.dll rundll32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\hi_contrast\aic_file_icons_highcontrast.png rundll32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\apple-touch-icon-72x72-precomposed.png rundll32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\Comments.aapp rundll32.exe File created C:\Program Files (x86)\WindowsPowerShell\Configuration\QuickTime.mpp rundll32.exe File created C:\Program Files (x86)\WindowsPowerShell\Configuration\open_original_form.gif rundll32.exe File opened for modification C:\Program Files\Mozilla Firefox\application.ini rundll32.exe File opened for modification C:\Program Files\Mozilla Firefox\browser\VisualElements\VisualElements_150.png rundll32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\review_email.gif rundll32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\rename.svg rundll32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\distribute_form.gif rundll32.exe File opened for modification C:\Program Files\7-Zip\Lang\fi.txt rundll32.exe File opened for modification C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\manifest.json rundll32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\index.html rundll32.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe rundll32.exe File created C:\Program Files (x86)\WindowsPowerShell\Configuration\3difr.x3d rundll32.exe File created C:\Program Files (x86)\WindowsPowerShell\Configuration\apple-touch-icon-72x72-precomposed.png rundll32.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Program crash 1 IoCs
pid pid_target Process procid_target 3000 1460 WerFault.exe 80 - Checks processor information in registry 2 TTPs 64 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Previous Update Revision svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Status rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Previous Update Revision svchost.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Component Information rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Previous Update Revision rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Platform Specific Field 1 svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Status rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Status svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\VendorIdentifier svchost.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 rundll32.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Previous Update Revision rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz rundll32.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data svchost.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Previous Update Revision rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Identifier svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\FeatureSet svchost.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Status rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Status svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet svchost.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 rundll32.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\FeatureSet rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Component Information svchost.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Status rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\FeatureSet rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\VendorIdentifier rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Component Information rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 svchost.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor svchost.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor rundll32.exe - Modifies registry class 5 IoCs
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots rundll32.exe Set value (data) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff rundll32.exe Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell rundll32.exe Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU rundll32.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\B7FA42F2F94AD28A6FD1F0EA5E00A898390FF786 rundll32.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\B7FA42F2F94AD28A6FD1F0EA5E00A898390FF786\Blob = 030000000100000014000000b7fa42f2f94ad28a6fd1f0ea5e00a898390ff7862000000001000000c5020000308202c13082022aa00302010202084dfff45056a83204300d06092a864886f70d01010b0500307a3139303706035504030c304d6963726f736f66742045434320545320526f6f7420436572746966696361616520417574686f726974792032303138311e301c060355040a0c154d6963726f736f667420436f72706f726174696f6e310b30090603550406130255533110300e06035504070c075265646d6f6e64301e170d3230313232333035323331375a170d3234313232323035323331375a307a3139303706035504030c304d6963726f736f66742045434320545320526f6f7420436572746966696361616520417574686f726974792032303138311e301c060355040a0c154d6963726f736f667420436f72706f726174696f6e310b30090603550406130255533110300e06035504070c075265646d6f6e6430819f300d06092a864886f70d010101050003818d0030818902818100aebf2e5d8d5d3f42f0745bff0a7b623786021b8d4d632ac5979b4639a6fa167c1185b8cc44c1aef6ab23963df0a2be04dd4ab0fae46ecb0bf03e59e32ef12b1dec385aef8ccb9d372c4c8c912d0984b7b552bd26ad69126a9fe61f38cb91a0b235703f79224b393d5100bba6cd3bad2ba0c71798a8625b462038bed5f06ab2530203010001a350304e300f0603551d130101ff040530030101ff303b0603551d110434303282304d6963726f736f66742045434320545320526f6f7420436572746966696361616520417574686f726974792032303138300d06092a864886f70d01010b0500038181002887b076b8e6350f7e6243793121a9699afe3b5fb18df1d946e98a69760ab2cca652546d9819c5e3129a69a4160cacbe52669a40c78363145ad53a14d05e5ce5453e270ac8c7a41772bc790fc5350aacf000fbe3fb94c4a9be73c49c24ac207cae6d3521195f2d69e51e12c79068c3f5fc28c5c86163d1bbf061a71d122853b7 rundll32.exe - Suspicious behavior: EnumeratesProcesses 28 IoCs
pid Process 2828 rundll32.exe 2828 rundll32.exe 2828 rundll32.exe 2828 rundll32.exe 1672 svchost.exe 1672 svchost.exe 2828 rundll32.exe 2828 rundll32.exe 2828 rundll32.exe 2828 rundll32.exe 2828 rundll32.exe 2828 rundll32.exe 1672 svchost.exe 1672 svchost.exe 1672 svchost.exe 1672 svchost.exe 1672 svchost.exe 1672 svchost.exe 2828 rundll32.exe 2828 rundll32.exe 1672 svchost.exe 1672 svchost.exe 1672 svchost.exe 1672 svchost.exe 1672 svchost.exe 1672 svchost.exe 1672 svchost.exe 1672 svchost.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2828 rundll32.exe - Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 2828 rundll32.exe 940 rundll32.exe 2828 rundll32.exe 2828 rundll32.exe - Suspicious use of WriteProcessMemory 27 IoCs
description pid Process procid_target PID 1460 wrote to memory of 2828 1460 cdeee6b3ed1cf3fda7a61c7d2ffec102.exe 83 PID 1460 wrote to memory of 2828 1460 cdeee6b3ed1cf3fda7a61c7d2ffec102.exe 83 PID 1460 wrote to memory of 2828 1460 cdeee6b3ed1cf3fda7a61c7d2ffec102.exe 83 PID 2828 wrote to memory of 940 2828 rundll32.exe 90 PID 2828 wrote to memory of 940 2828 rundll32.exe 90 PID 2828 wrote to memory of 940 2828 rundll32.exe 90 PID 2828 wrote to memory of 4784 2828 rundll32.exe 91 PID 2828 wrote to memory of 4784 2828 rundll32.exe 91 PID 2828 wrote to memory of 4784 2828 rundll32.exe 91 PID 2828 wrote to memory of 4888 2828 rundll32.exe 93 PID 2828 wrote to memory of 4888 2828 rundll32.exe 93 PID 2828 wrote to memory of 4888 2828 rundll32.exe 93 PID 1672 wrote to memory of 5036 1672 svchost.exe 99 PID 1672 wrote to memory of 5036 1672 svchost.exe 99 PID 1672 wrote to memory of 5036 1672 svchost.exe 99 PID 2828 wrote to memory of 4880 2828 rundll32.exe 100 PID 2828 wrote to memory of 4880 2828 rundll32.exe 100 PID 2828 wrote to memory of 4880 2828 rundll32.exe 100 PID 2828 wrote to memory of 3928 2828 rundll32.exe 102 PID 2828 wrote to memory of 3928 2828 rundll32.exe 102 PID 2828 wrote to memory of 3928 2828 rundll32.exe 102 PID 2828 wrote to memory of 3080 2828 rundll32.exe 104 PID 2828 wrote to memory of 3080 2828 rundll32.exe 104 PID 2828 wrote to memory of 3080 2828 rundll32.exe 104 PID 2828 wrote to memory of 2240 2828 rundll32.exe 106 PID 2828 wrote to memory of 2240 2828 rundll32.exe 106 PID 2828 wrote to memory of 2240 2828 rundll32.exe 106 - outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 rundll32.exe - outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 rundll32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\cdeee6b3ed1cf3fda7a61c7d2ffec102.exe"C:\Users\Admin\AppData\Local\Temp\cdeee6b3ed1cf3fda7a61c7d2ffec102.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1460 -
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Users\Admin\AppData\Local\Temp\Quspupodwqfhie.tmp",Ritwuoaoyiy2⤵
- Blocklisted process makes network request
- Sets DLL path for service in the registry
- Sets service image path in registry
- Loads dropped DLL
- Accesses Microsoft Outlook accounts
- Accesses Microsoft Outlook profiles
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Checks processor information in registry
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
PID:2828 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61 189373⤵
- Modifies registry class
- Suspicious use of FindShellTrayWindow
PID:940
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /End /tn \Microsoft\Windows\Wininet\CacheTask3⤵PID:4784
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Run /tn \Microsoft\Windows\Wininet\CacheTask3⤵PID:4888
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /End /tn \Microsoft\Windows\Wininet\CacheTask3⤵PID:4880
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Run /tn \Microsoft\Windows\Wininet\CacheTask3⤵PID:3928
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /End /tn \Microsoft\Windows\Wininet\CacheTask3⤵PID:3080
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Run /tn \Microsoft\Windows\Wininet\CacheTask3⤵PID:2240
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1460 -s 4642⤵
- Program crash
PID:3000
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 1460 -ip 14601⤵PID:3504
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:3172
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k LocalService1⤵
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1672 -
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\system32\rundll32.exe" "c:\program files (x86)\windowspowershell\configuration\onix32.dll",lVVAS0VsUw==2⤵
- Loads dropped DLL
- Checks processor information in registry
PID:5036
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\WindowsPowerShell\Configuration\Onix32.dll
- Size 814KB
- SHA256 062f0df8621994326055a325056efcd00ada62293e5c07f6cda01511975f271d
- MD5 defec8188671f60123e593de3b5f67f0
- SHA1 2ea0e6d8c9ad65e6c1a646251b4c531be7909056
- SHA512 89011aa81db10a27d9e8fe27f45a2490b3ccc259fc987fec0c145252c1b6a6061e09a55abb7947d98ce0f4ef75247cad82e04d42ceea596b219e9e1d25fe64f5
- SSDEEP 12288:9I1x+fRZMhMlCKoG6/IqKoF7TUv/ncB8CZp5jff2MkWkSsEciPj3:Cazvb6AqKoBUvvcB8CZ7n21WZ1cir
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\WindowsPowerShell\Configuration\Onix32.dll
- Size 814KB
- SHA256 062f0df8621994326055a325056efcd00ada62293e5c07f6cda01511975f271d
- MD5 defec8188671f60123e593de3b5f67f0
- SHA1 2ea0e6d8c9ad65e6c1a646251b4c531be7909056
- SHA512 89011aa81db10a27d9e8fe27f45a2490b3ccc259fc987fec0c145252c1b6a6061e09a55abb7947d98ce0f4ef75247cad82e04d42ceea596b219e9e1d25fe64f5
- SSDEEP 12288:9I1x+fRZMhMlCKoG6/IqKoF7TUv/ncB8CZp5jff2MkWkSsEciPj3:Cazvb6AqKoBUvvcB8CZ7n21WZ1cir
- MD5 SHA1 SHA512 SSDEEP
- Path C:\ProgramData\{9C0BA6AF-75FB-72C6-BE9A-B167A4AE4026}\C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml
- Size 30KB
- SHA256 fd3507cd60edf41093c8fe843d1601e33db9cbe1cd36247cec587c265109bcfa
- MD5 98de295b21abe2451f86b82df3be269a
- SHA1 1665a23d307748e8c1c0164ba7939275f9fb676c
- SHA512 230ae283c81771496dcae9ef84787379712106738ea82754b101af9047ae27cadb8b1f4aed00d146a699c22fd1c505c31068418a70d2b535c85c3017726d91cc
- SSDEEP 768:6K3dVfwtH7aliWz8rq19XOSgXOx75O4CB4JPTbC3nHJ1OJL/n5p3Q:6K3dVfwtH7aliWz8rq19XOSgXQ75O4C3
- MD5 SHA1 SHA512 SSDEEP
- Path C:\ProgramData\{9C0BA6AF-75FB-72C6-BE9A-B167A4AE4026}\DesktopSettings2013.xml
- Size 17KB
- SHA256 f8b710777d2c0105e74ee27ee6dfc8e43ca4ff7e14b4dba390eb72dad20705bd
- MD5 c6b6b07071e0f8ff39f5941a3169b20c
- SHA1 d77fd2513ac3cb9b8595424d1f695fce21e33d96
- SHA512 167ab504d6e4c91239f8239722aba17a7f6748fb3e8ee750b2d3f3fd677e6646a8149c8b956513cb2e90722196471865591215938cea8444fdf2e5cff180fdec
- SSDEEP 384:2OVSu+n9bgJZ/L/b5rRJj9WPGeTVYXzGZGsaraCY6hHyqVMZeSKJcTLZSz167Es1:2WMtoy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\ProgramData\{9C0BA6AF-75FB-72C6-BE9A-B167A4AE4026}\Microsoft.BioEnrollment_10.0.19041.1023_neutral__cw5n1h2txyewy.xml
- Size 3KB
- SHA256 1545f3cf4b4c17d52c387e560dcb777e1748757c1dbb18788080d9dac64a82a6
- MD5 3e0786e68ac00141fd51790c561c60ef
- SHA1 96f2bdc8310d74e466bd8ef0931baaa2f276de03
- SHA512 cdcecba2775b627e9e6fce205166e2f0f9af9550ed838689c586c707c29d6d7e7a5daa03814b0c95f5da3b8b2d2366b77e5011a8cad8fac448feaa96679353f2
- MD5 SHA1 SHA512
- Path C:\ProgramData\{9C0BA6AF-75FB-72C6-BE9A-B167A4AE4026}\Microsoft.GetHelp_10.1706.13331.0_x64__8wekyb3d8bbwe.xml
- Size 9KB
- SHA256 bb39de067132d2ccbb7a3c066743010f070a3c3856f42ccc892da0b40012771e
- MD5 996f11041df0526341cebbbd40a98390
- SHA1 37f652515ef8c662840086d743f7f68d327cce52
- SHA512 6cafa4b3bd8c56d20859a4f8fb7109e3ca4c690d0746b13f9f2eaa19d88bfca469dc45d71fb91f5658f9cd300f285aafb9e212ebd7c1496aadb6046da4e56c03
- SSDEEP 192:KEmP0oyC2JDsDn/ZMZwZUEJWcBtMbZv0IKVptlONftrMBr9Imfipoaag+zysaZvJ:KEmP0oybOj/ZMZwZUEJWcBtMbZv0IKVu
- MD5 SHA1 SHA512 SSDEEP
- Path C:\ProgramData\{9C0BA6AF-75FB-72C6-BE9A-B167A4AE4026}\Microsoft.People_10.1902.633.0_neutral_split.scale-125_8wekyb3d8bbwe.xml
- Size 829B
- SHA256 7c8df7b34fca6387a15cbc0d6f591624a5a28bf513f71eb1077d55f1b448d856
- MD5 87abe99363b16041e32b8a146eb53617
- SHA1 b1f3f3c3939f2331dee213e480f4a4d0c753f72a
- SHA512 091ffae18e7cf41237b1039964cb4c3116275edfa34b198bbb9a0b258a99bf3b62b420fb22d747788a889f2306c30f0dc00566c432d4b2bb2e410a9e7dc69e44
- MD5 SHA1 SHA512
- Path C:\ProgramData\{9C0BA6AF-75FB-72C6-BE9A-B167A4AE4026}\MicrosoftLync2013Win64.xml
- Size 2KB
- SHA256 11031974100f363daebe2d5c9e4bf67418d662c73e0341eb71e10b91a33280ac
- MD5 e3a68bbd204d36868c6f5570e4576675
- SHA1 bc5c44144e8e962c62f7febabdb3d0ba20a8162a
- SHA512 7c435d9f0e05469979ac3ce3153ad96ac1b01c9946b3df7230b384cc3ed1a2766dfbad0eb00fa1f2105d0fc0e5a87cbc1eb2c6c700c1041ebe4488a6d16c2f02
- MD5 SHA1 SHA512
- Path C:\ProgramData\{9C0BA6AF-75FB-72C6-BE9A-B167A4AE4026}\Uyoiheuooe.tmp
- Size 3.5MB
- SHA256 a9a7f7e4951ebe5b9ddd6bd2bca21849f94614128087141430766cf949acd516
- MD5 3d772aed380c91a5f3abba138954c541
- SHA1 eb6c23e6fb7bab781cf2faa03ca40fcbd9073455
- SHA512 042a68dd38fdc4d928f92eecc5a4caecd8c41d1455a06fe358254d28e930038d2d0a77ab764c44cb3a7beee8761a0e64a9afec890c23525604275d10c4246e8e
- SSDEEP 98304:kQ03KCbE4t+LU6qL5+pX30JwHBjLmNNEyvM6H/hEQCur:kQSbEZLVARJwHBPmNNw6H5T
- MD5 SHA1 SHA512 SSDEEP
- Path C:\ProgramData\{9C0BA6AF-75FB-72C6-BE9A-B167A4AE4026}\device.png
- Size 43KB
- SHA256 609824cc9c4f6c26c529ea3eb6f112c1a7c74d5ed58e25b6f9d88dce5944626a
- MD5 7051c15362866f6411ff4906403f2c54
- SHA1 768b062b336675ff9a2b9fcff0ce1057234a5399
- SHA512 5fcbb98b9f421ee9884b8e927774de3d60043401b2f746f7af6aa059fa8a7c48f00ec3c2437f8e6687e0c328d0d2c79427d5ab5eed0805aa9e2a8b12a6418f08
- SSDEEP 768:535IyJCYFakAnKI1Uu0IIjMwFtNy2Sp9oRnMcHCe+X28hGlrBw/21Qo:7C0AKImaIjM+A2K9mnMcHX+G8h2
- MD5 SHA1 SHA512 SSDEEP
- Path C:\ProgramData\{9C0BA6AF-75FB-72C6-BE9A-B167A4AE4026}\print_property.ico
- Size 58KB
- SHA256 24e77f244b0743e311b0fc97f06513a0cecf6560e92f9c6f164288a152d32000
- MD5 30d7062e069bc0a9b34f4034090c1aae
- SHA1 e5fcedd8e4cc0463c0bc6912b1791f2876e28a61
- SHA512 85dd6c916d48804a24dbbad0f4b4842453ac31a692905f8f2f34112eaa1bbf062a825d45ed5d800bbc4663a28b0b5003ebd5fa54991cf846f1028e929ea06de6
- SSDEEP 768:wb5C9LMkCR4AR6e1I6z3VPDD/btuvlUWWVqoi8OEHqEfuHl+UrccLA71LDIc3:OC9KqI+GDD/5SdWiEFf6xgwA71L
- MD5 SHA1 SHA512 SSDEEP
- Path C:\ProgramData\{9C0BA6AF-75FB-72C6-BE9A-B167A4AE4026}\qmgr.db
- Size 768KB
- SHA256 53a3d757852db77bf8fda088c34d7759508f1c6af57e998aa1be96cba8557a17
- MD5 28162e7b1ec7202327a487f83d38a873
- SHA1 ae1052802005d2f0e1aaf378bbba3a7c80176896
- SHA512 345cbbbb1a62ff1f340bd66b5afafa8de10eecbf1a5126eb0fae080914c4d1a09e69c93f3f84a70ac0443d0aeff530fbc187db4c3078ebb1443e36b527b6800b
- SSDEEP 768:FSB2cSB2ySjlK/lgEebKiJqLLxW+g/nHhH:FSB2cSB2ySjlK/lgEebvJqHxW+g/nB
- MD5 SHA1 SHA512 SSDEEP
- Path C:\ProgramData\{9C0BA6AF-75FB-72C6-BE9A-B167A4AE4026}\resource.xml
- Size 1KB
- SHA256 f83662badfaa62797f925aa8292852be5351d3e641d70fe22c911ee4cdf68aad
- MD5 36b733e882d091355ffdd2b0a3286888
- SHA1 0043a974ebd90d802e8cc5e04b5cefc980d03292
- SHA512 abb0df60401f74df3368e17cd8ff672dceaeef0fbeb097da659c07f2b8d756a09ada065ecb3ba7ccabbb4416817d730c13e6340ae5c6239dff31ae8b81c0a10c
- MD5 SHA1 SHA512
- Path C:\ProgramData\{9C0BA6AF-75FB-72C6-BE9A-B167A4AE4026}\s640.hash
- Size 106B
- SHA256 7f9c7cc5b265e312fc587d98c7c31218b7a46f1efb8c397dcc329354b4e5831d
- MD5 bef40d5a19278ca19b56fbcdde7e26ef
- SHA1 4f01d5b8de038e120c64bd7cc22cf150af1452fb
- SHA512 5a361b1378c7b9f635e72ffdfba4d59acd17341caba480a5271237a37d40d8eb03a6ca7f3c38e73ce87a15b682d434ffa0a7f96dd6355e286d8213a80518c493
- MD5 SHA1 SHA512
- Path C:\ProgramData\{9C0BA6AF-75FB-72C6-BE9A-B167A4AE4026}\user-32.png
- Size 441B
- SHA256 0e73d224603c23ae46c24341826dc6bdcfc9bda04b2ebd261537f439ed229de9
- MD5 a60e1edd0e806500b9247ebc886d1ecd
- SHA1 bb96af6a28162ea763117b838534829bf3dc632e
- SHA512 fdd37f5da650f99f7657285a5f062f19caa99f969676f1b426f1c0a928eed6fe1698d4ba515ba6245e8a24e3ddf02ee6e5f6a3bade221cfc09444b43839b7070
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\Quspupodwqfhie.tmp
- Size 814KB
- SHA256 226eac6b8ce415bf0900050818f8212129fc51d14dab026e7b8600aa89d65c8a
- MD5 f93876956e6e2f754c8be97ac269729d
- SHA1 bf0eb05f31b4177e5e2fdeb203698d5018c8ee12
- SHA512 c3c53aca227ac035ac838002c8f68b2d449ac983a85780356eb8ef7791171fdb2133cf7f8b694cd4e62b6239b5b8ca21013c483c797153dcd57ea845d4b458cb
- SSDEEP 12288:FI1x+fRZMhMlCKoG6/IqKoF7TUv/ncB8CZp5jff2MkWkSsEciPj3:6azvb6AqKoBUvvcB8CZ7n21WZ1cir
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\Quspupodwqfhie.tmp
- Size 814KB
- SHA256 226eac6b8ce415bf0900050818f8212129fc51d14dab026e7b8600aa89d65c8a
- MD5 f93876956e6e2f754c8be97ac269729d
- SHA1 bf0eb05f31b4177e5e2fdeb203698d5018c8ee12
- SHA512 c3c53aca227ac035ac838002c8f68b2d449ac983a85780356eb8ef7791171fdb2133cf7f8b694cd4e62b6239b5b8ca21013c483c797153dcd57ea845d4b458cb
- SSDEEP 12288:FI1x+fRZMhMlCKoG6/IqKoF7TUv/ncB8CZp5jff2MkWkSsEciPj3:6azvb6AqKoBUvvcB8CZ7n21WZ1cir
- MD5 SHA1 SHA512 SSDEEP
- Path \??\c:\program files (x86)\windowspowershell\configuration\onix32.dll
- Size 814KB
- SHA256 062f0df8621994326055a325056efcd00ada62293e5c07f6cda01511975f271d
- MD5 defec8188671f60123e593de3b5f67f0
- SHA1 2ea0e6d8c9ad65e6c1a646251b4c531be7909056
- SHA512 89011aa81db10a27d9e8fe27f45a2490b3ccc259fc987fec0c145252c1b6a6061e09a55abb7947d98ce0f4ef75247cad82e04d42ceea596b219e9e1d25fe64f5
- SSDEEP 12288:9I1x+fRZMhMlCKoG6/IqKoF7TUv/ncB8CZp5jff2MkWkSsEciPj3:Cazvb6AqKoBUvvcB8CZ7n21WZ1cir
- MD5 SHA1 SHA512 SSDEEP