Analysis
- max time kernel
144s - max time network
147s - platform
windows10-2004_x64 - resource
win10v2004-20221111-en - resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system - submitted
28/12/2022, 14:17
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20220812-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20221111-en
windows10-2004-x64
30 signatures
150 seconds
General
- Target file.exe
- Size 230KB
- Sample221228-rlpmsaae83
- SHA256 f504094e6c21d8a8524e499e3055ec9bc8afa61aa092d7b7e81296ed336babd7
- MD5 808d9cb2d0e9e2a0c3cc5d93042d0c9d
- SHA1 a59b47027826dcd4652fd428efa25e9052600b14
- SHA512 0b1c296213d70e1ef3877e904213b562cea6c441750246b6432c946dd820d3456ed1787c064e890281dbecec6fa97901f27532eef378a54ef58c9089f460598f
- SSDEEP 3072:mWxSLowlF587Pvr2CVaq+jRCVNe9rJeSxbNgFDJQgdxcR8rwD3tdmdhEH:nSLFsvr25seJsdJlxcRWi3tm
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detects Smokeloader packer 1 IoCs
resource yara_rule behavioral2/memory/5088-133-0x00000000006B0000-0x00000000006B9000-memory.dmp family_smokeloader - SmokeLoader
Modular backdoor trojan in use since 2014.
- Blocklisted process makes network request 3 IoCs
flow pid Process 34 3920 rundll32.exe 35 3920 rundll32.exe 58 3920 rundll32.exe - Downloads MZ/PE file
- Executes dropped EXE 1 IoCs
pid Process 4208 BCDC.exe - Sets DLL path for service in the registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\br\Parameters\ServiceDll = "C:\\Program Files (x86)\\Google\\Temp\\br.dll" rundll32.exe - Sets service image path in registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\br\ImagePath = "C:\\Windows\\system32\\svchost.exe -k LocalService" rundll32.exe - Loads dropped DLL 1 IoCs
pid Process 3920 rundll32.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts rundll32.exe - Accesses Microsoft Outlook profiles 1 TTPs 4 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 rundll32.exe Key opened \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook rundll32.exe Key opened \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 rundll32.exe Key opened \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 rundll32.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3920 set thread context of 2968 3920 rundll32.exe 92 - Drops file in Program Files directory 11 IoCs
description ioc Process File created C:\Program Files (x86)\Google\Temp\back-arrow-hover.svg rundll32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\PDDom.api rundll32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\snapshot_blob.bin rundll32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\apple-touch-icon-144x144-precomposed.png rundll32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\AdobeID.pdf rundll32.exe File created C:\Program Files (x86)\Google\Temp\DVA.api rundll32.exe File created C:\Program Files (x86)\Google\Temp\apple-touch-icon-144x144-precomposed.png rundll32.exe File created C:\Program Files (x86)\Google\Temp\br.dll rundll32.exe File created C:\Program Files (x86)\Google\Temp\AdobeID.pdf rundll32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\DVA.api rundll32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\back-arrow-hover.svg rundll32.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Program crash 1 IoCs
pid pid_target Process procid_target 4356 4208 WerFault.exe 87 - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe - Checks processor information in registry 2 TTPs 23 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 rundll32.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 rundll32.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Status rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Component Information rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Revision rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Previous Update Revision rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Identifier rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Previous Update Revision rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet rundll32.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\VendorIdentifier rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString rundll32.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 Process not Found Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Internet Explorer\Toolbar Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1" Process not Found - Modifies registry class 30 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\NodeSlot = "1" Process not Found Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell Process not Found Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings rundll32.exe Set value (data) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f44471a0359723fa74489c55595fe6b30ee0000 Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 50003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014000000 Process not Found Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 Process not Found Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic" Process not Found Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell rundll32.exe Set value (data) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 820074001c0043465346160031000000000000000000100041707044617461000000741a595e96dfd3488d671733bcee28bac5cdfadf9f6756418947c5c76bc0b67f400009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004100700070004400610074006100000042000000 Process not Found Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\WorkFolders Process not Found Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU Process not Found Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 = 4e003100000000009c55357a100054656d7000003a0009000400efbe6b557d6c9c55397a2e000000000000000000000000000000000000000000000000002db41701540065006d007000000014000000 Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots rundll32.exe Set value (data) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 Process not Found Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = 00000000ffffffff Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\MRUListEx = ffffffff Process not Found Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags Process not Found Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots Process not Found Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1 Process not Found - Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 3020 Process not Found - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5088 file.exe 5088 file.exe 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3020 Process not Found - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 5088 file.exe - Suspicious use of AdjustPrivilegeToken 23 IoCs
description pid Process Token: SeShutdownPrivilege 3020 Process not Found Token: SeCreatePagefilePrivilege 3020 Process not Found Token: SeDebugPrivilege 3920 rundll32.exe Token: SeShutdownPrivilege 3020 Process not Found Token: SeCreatePagefilePrivilege 3020 Process not Found Token: SeShutdownPrivilege 3020 Process not Found Token: SeCreatePagefilePrivilege 3020 Process not Found Token: SeShutdownPrivilege 3020 Process not Found Token: SeCreatePagefilePrivilege 3020 Process not Found Token: SeShutdownPrivilege 3020 Process not Found Token: SeCreatePagefilePrivilege 3020 Process not Found Token: SeShutdownPrivilege 3020 Process not Found Token: SeCreatePagefilePrivilege 3020 Process not Found Token: SeShutdownPrivilege 3020 Process not Found Token: SeCreatePagefilePrivilege 3020 Process not Found Token: SeShutdownPrivilege 3020 Process not Found Token: SeCreatePagefilePrivilege 3020 Process not Found Token: SeShutdownPrivilege 3020 Process not Found Token: SeCreatePagefilePrivilege 3020 Process not Found Token: SeShutdownPrivilege 3020 Process not Found Token: SeCreatePagefilePrivilege 3020 Process not Found Token: SeShutdownPrivilege 3020 Process not Found Token: SeCreatePagefilePrivilege 3020 Process not Found - Suspicious use of FindShellTrayWindow 10 IoCs
pid Process 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 2968 rundll32.exe 3020 Process not Found 3020 Process not Found 3020 Process not Found 3020 Process not Found 3920 rundll32.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3020 Process not Found 3020 Process not Found - Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 3020 wrote to memory of 4208 3020 Process not Found 87 PID 3020 wrote to memory of 4208 3020 Process not Found 87 PID 3020 wrote to memory of 4208 3020 Process not Found 87 PID 4208 wrote to memory of 3920 4208 BCDC.exe 88 PID 4208 wrote to memory of 3920 4208 BCDC.exe 88 PID 4208 wrote to memory of 3920 4208 BCDC.exe 88 PID 3920 wrote to memory of 2968 3920 rundll32.exe 92 PID 3920 wrote to memory of 2968 3920 rundll32.exe 92 PID 3920 wrote to memory of 2968 3920 rundll32.exe 92 PID 3920 wrote to memory of 1516 3920 rundll32.exe 93 PID 3920 wrote to memory of 1516 3920 rundll32.exe 93 PID 3920 wrote to memory of 1516 3920 rundll32.exe 93 PID 3920 wrote to memory of 2324 3920 rundll32.exe 96 PID 3920 wrote to memory of 2324 3920 rundll32.exe 96 PID 3920 wrote to memory of 2324 3920 rundll32.exe 96 - outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 rundll32.exe - outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 rundll32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:5088
-
C:\Users\Admin\AppData\Local\Temp\BCDC.exeC:\Users\Admin\AppData\Local\Temp\BCDC.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4208 -
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Users\Admin\AppData\Local\Temp\Qfyshwqueqdpai.tmp",Dioeeedresq2⤵
- Blocklisted process makes network request
- Sets DLL path for service in the registry
- Sets service image path in registry
- Loads dropped DLL
- Accesses Microsoft Outlook accounts
- Accesses Microsoft Outlook profiles
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
PID:3920 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61 139963⤵
- Modifies registry class
- Suspicious use of FindShellTrayWindow
PID:2968
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /End /tn \Microsoft\Windows\Wininet\CacheTask3⤵PID:1516
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Run /tn \Microsoft\Windows\Wininet\CacheTask3⤵PID:2324
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /End /tn \Microsoft\Windows\Wininet\CacheTask3⤵PID:4048
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4208 -s 5322⤵
- Program crash
PID:4356
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4208 -ip 42081⤵PID:4792
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:3864
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k LocalService1⤵PID:1260
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\system32\rundll32.exe" "c:\program files (x86)\google\temp\br.dll",WisvUnp6TQ==2⤵PID:1852
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Google\Temp\br.dll
- Size 792KB
- SHA256 0eb9b8d73ebef822c21571d211afede106bcfb6e71cdbb6c8637186d19604a39
- MD5 a2d47248161dc73f86daea7e2924e4d7
- SHA1 fc9e598e3e6fb7a8fe02b74ec4626040e237130f
- SHA512 193f4cdaaffbf09d5c4b6ffb103bd1368cee63fc306c2f19de532d185a95905ebcac9c97407098eeef0e32157daa91e5310d73fdb8cc125b94261beba42dcf07
- SSDEEP 24576:p9FmFb4sE9VXjvqjNnHgseKbgf7jb10Dj:prsBpelfC
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Google\Temp\br.dll
- Size 792KB
- SHA256 0eb9b8d73ebef822c21571d211afede106bcfb6e71cdbb6c8637186d19604a39
- MD5 a2d47248161dc73f86daea7e2924e4d7
- SHA1 fc9e598e3e6fb7a8fe02b74ec4626040e237130f
- SHA512 193f4cdaaffbf09d5c4b6ffb103bd1368cee63fc306c2f19de532d185a95905ebcac9c97407098eeef0e32157daa91e5310d73fdb8cc125b94261beba42dcf07
- SSDEEP 24576:p9FmFb4sE9VXjvqjNnHgseKbgf7jb10Dj:prsBpelfC
- MD5 SHA1 SHA512 SSDEEP
- Path C:\ProgramData\{0222BCDE-1250-CD5F-F334-C7FEF4A3D675}\Ieohspdwyru.tmp
- Size 3.5MB
- SHA256 124824573f28f354a9ee9542116dd5411972f51d001035d4448f60f564a3f38f
- MD5 70907fe710913599ef8c8f8be14bf25a
- SHA1 832337a64ffce0dd02aeb03fe2d12adcdfb3dcce
- SHA512 cf89f1463b828059e3bca62e0f0f380e25e3eac08df89533be571889da1b48a2abe635578bf957a674faa91021aeb0d5a5c97b60504fe280ca30ed68e954f0cb
- SSDEEP 98304:ADTEpe0Roi8qUOedaV+L8HSX+VdSUSAZmd6R:ADTEE0RB8Pt58s+d+AZmd6R
- MD5 SHA1 SHA512 SSDEEP
- Path C:\ProgramData\{0222BCDE-1250-CD5F-F334-C7FEF4A3D675}\Ieohspdwyru.tmp
- Size 3.5MB
- SHA256 124824573f28f354a9ee9542116dd5411972f51d001035d4448f60f564a3f38f
- MD5 70907fe710913599ef8c8f8be14bf25a
- SHA1 832337a64ffce0dd02aeb03fe2d12adcdfb3dcce
- SHA512 cf89f1463b828059e3bca62e0f0f380e25e3eac08df89533be571889da1b48a2abe635578bf957a674faa91021aeb0d5a5c97b60504fe280ca30ed68e954f0cb
- SSDEEP 98304:ADTEpe0Roi8qUOedaV+L8HSX+VdSUSAZmd6R:ADTEE0RB8Pt58s+d+AZmd6R
- MD5 SHA1 SHA512 SSDEEP
- Path C:\ProgramData\{0222BCDE-1250-CD5F-F334-C7FEF4A3D675}\Microsoft.Advertising.Xaml_10.1808.3.0_x64__8wekyb3d8bbwe.xml
- Size 4KB
- SHA256 1469f5b82db4cb94fdb24580efe2cf3d30a9bc94ee4d4378b6cce50674999e1a
- MD5 7eb2ff3e6ad26430b3d7c1d86bd55042
- SHA1 3c1f961bb1317b63fa454d1938e2dfab8fa518be
- SHA512 89d6f1ae647cb3e3fc2cd8b1657f22e0fb023bff68482d159f61a6d1f8dd97b6c6d4e9c9edde989963e97740371a1dbd45b5f0524532c81cd082636e5d971e13
- SSDEEP 96:TRATANmtxzpVXwDfDVdSmjDima0VIQmZ+a4laPaLata5aJaZOamakama8aKakaBK:6EYLOnmKblySiyIR5nllVtm7lfg7Slxo
- MD5 SHA1 SHA512 SSDEEP
- Path C:\ProgramData\{0222BCDE-1250-CD5F-F334-C7FEF4A3D675}\tasks.xml
- Size 11KB
- SHA256 faf021b3c06abc41a9fb8e021171fd0ea41684b732a8e77433e447af8e527516
- MD5 6ab160b8998020e6d4373c003e9879d4
- SHA1 efa87d3fb95a73a892ed88b08651c44fe03c150f
- SHA512 c923c48b0b5c741777666ca161864879defd50c299ae76d9f093ffb846d144600c99d281d879f9328509061f3ae6784a706f15248e0fed7bfd7a595b389aae1b
- SSDEEP 96:Ucc2XjObPX0bFXZxMAklQRAFlCAhluKtKLqX:Tc6ObMbxMA1A+AhcLs
- MD5 SHA1 SHA512 SSDEEP
- Path C:\ProgramData\{0222BCDE-1250-CD5F-F334-C7FEF4A3D675}\utc.cert.json
- Size 2KB
- SHA256 dc9c38e035984439878ac48131835b0ad4d113c9bdfe6ce62f23c069a04edbcd
- MD5 635a39ff9f822dcfd1fb3c22e6ffeb45
- SHA1 148a7e0a56504cae9219d0ed0f9aa8fb0ce7f7ca
- SHA512 f246594c76d4740fab3552b0c738ea5dea75d6f81a4ca956c524ca0d09a4d1e71060d11447ac8de2810364828660ee328211ba727231172b30e636d84cd3747e
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\BCDC.exe
- Size 1021KB
- SHA256 38d2d32039e1b88fa6e1f0b13226446586432d7b8f9927bd023d76097b39d94c
- MD5 845a580949bdb9341e5cedea3c1c7f11
- SHA1 d966b359dd0988e1d339780bad48f231253badf6
- SHA512 4af8e7dfcc966f508cedff879ac2d65c256a554eb4f616f28fd988605434f9064befe12b1cb85bf0f03d06a8a5cd9e57aa67544759b5e82473e455283867883d
- SSDEEP 24576:xCoQWOpRSsg3DlIWZJ564QADA7gZ+GsVN7rpsZ8hnxW0i30:koQWIng3qWZ3eADA7gUNVBr3nx40
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\BCDC.exe
- Size 1021KB
- SHA256 38d2d32039e1b88fa6e1f0b13226446586432d7b8f9927bd023d76097b39d94c
- MD5 845a580949bdb9341e5cedea3c1c7f11
- SHA1 d966b359dd0988e1d339780bad48f231253badf6
- SHA512 4af8e7dfcc966f508cedff879ac2d65c256a554eb4f616f28fd988605434f9064befe12b1cb85bf0f03d06a8a5cd9e57aa67544759b5e82473e455283867883d
- SSDEEP 24576:xCoQWOpRSsg3DlIWZJ564QADA7gZ+GsVN7rpsZ8hnxW0i30:koQWIng3qWZ3eADA7gUNVBr3nx40
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\Qfyshwqueqdpai.tmp
- Size 792KB
- SHA256 72bdb3a06dca8458ac9aedf06785b2d7b95a19f8b9f3f8f5be2eb4744e9c5d1d
- MD5 822d3ead416a1a85cb96e65f65cd5ae2
- SHA1 af32b69e2835d1cacdadb97ae6dfafccc32d1837
- SHA512 48d0d61efd51fd2d8eb04d990b4a5b3ca34c916199d3b0a3b135d2089e028ee37f5145e4705fb75da77eaabbe12f8c4ea55775a41e1b1c68a90ce68b8c2a7260
- SSDEEP 24576:o9FmFb4sE9VXjvqjNnHgseKbgf7jb10Dj:orsBpelfC
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\Qfyshwqueqdpai.tmp
- Size 792KB
- SHA256 72bdb3a06dca8458ac9aedf06785b2d7b95a19f8b9f3f8f5be2eb4744e9c5d1d
- MD5 822d3ead416a1a85cb96e65f65cd5ae2
- SHA1 af32b69e2835d1cacdadb97ae6dfafccc32d1837
- SHA512 48d0d61efd51fd2d8eb04d990b4a5b3ca34c916199d3b0a3b135d2089e028ee37f5145e4705fb75da77eaabbe12f8c4ea55775a41e1b1c68a90ce68b8c2a7260
- SSDEEP 24576:o9FmFb4sE9VXjvqjNnHgseKbgf7jb10Dj:orsBpelfC
- MD5 SHA1 SHA512 SSDEEP
- Path \??\c:\program files (x86)\google\temp\br.dll
- Size 792KB
- SHA256 0eb9b8d73ebef822c21571d211afede106bcfb6e71cdbb6c8637186d19604a39
- MD5 a2d47248161dc73f86daea7e2924e4d7
- SHA1 fc9e598e3e6fb7a8fe02b74ec4626040e237130f
- SHA512 193f4cdaaffbf09d5c4b6ffb103bd1368cee63fc306c2f19de532d185a95905ebcac9c97407098eeef0e32157daa91e5310d73fdb8cc125b94261beba42dcf07
- SSDEEP 24576:p9FmFb4sE9VXjvqjNnHgseKbgf7jb10Dj:prsBpelfC
- MD5 SHA1 SHA512 SSDEEP