Analysis
- max time kernel
150s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system - submitted
31/12/2022, 17:20
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20220901-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
23 signatures
150 seconds
General
- Target file.exe
- Size 256KB
- Sample221231-vwe3waaa76
- SHA256 ea352e5f678ca67dd9210261cabdd2eb17723ab94a38f9111ac86186b012340b
- MD5 fe4bd7b275c38f6bbada20c131ada4aa
- SHA1 ec1cac2a0ceeecbc415665cd14b9d59d68078aae
- SHA512 55fdc6eabe57e9ada2d1eecfb0327d0359829e5b722b63edfbd2c0c38575c810223c635f54c211e26db2a74df156db268c887f82906ad87f54bc91e1e6aff841
- SSDEEP 3072:0gawmBClgeL65FmxoORJvYkO9OI+iaZU6KtmqzXd27hZY:LQCJLKmxoKvNO9OI+iMU6BSIZY
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Detects Smokeloader packer 1 IoCs
resource yara_rule behavioral2/memory/4656-133-0x0000000002190000-0x0000000002199000-memory.dmp family_smokeloader - SmokeLoader
Modular backdoor trojan in use since 2014.
- Downloads MZ/PE file
- Executes dropped EXE 2 IoCs
pid Process 3424 E9F7.exe 3940 Iqpoqhfidqa.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation E9F7.exe - Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 684 Process not Found 4712 chrome.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3424 set thread context of 960 3424 E9F7.exe 104 - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Program crash 10 IoCs
pid pid_target Process procid_target 3548 3424 WerFault.exe 88 4068 3424 WerFault.exe 88 4052 3424 WerFault.exe 88 1940 3424 WerFault.exe 88 3360 3424 WerFault.exe 88 1092 3424 WerFault.exe 88 1320 3424 WerFault.exe 88 1336 3940 WerFault.exe 102 3860 4712 WerFault.exe 108 3660 3424 WerFault.exe 88 - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe - Checks processor information in registry 2 TTPs 48 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 E9F7.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString E9F7.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information E9F7.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Identifier E9F7.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\VendorIdentifier rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Previous Update Revision rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 E9F7.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\FeatureSet E9F7.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Previous Update Revision E9F7.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet E9F7.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Platform Specific Field 1 rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 E9F7.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 E9F7.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz E9F7.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data rundll32.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor E9F7.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString E9F7.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Platform Specific Field 1 E9F7.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Status rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Component Information rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor E9F7.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 E9F7.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision E9F7.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Previous Update Revision E9F7.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Component Information E9F7.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier E9F7.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor rundll32.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Revision E9F7.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier E9F7.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data E9F7.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz E9F7.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Configuration Data E9F7.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Status rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Configuration Data rundll32.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Toolbar Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1" Process not Found Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 Process not Found - Modifies registry class 19 IoCs
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 19002f433a5c000000000000000000000000000000000000000000 Process not Found Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ Process not Found Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 Process not Found Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 Process not Found Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1 Process not Found Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000 Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff Process not Found Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell Process not Found Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings rundll32.exe Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1" Process not Found Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic" Process not Found Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ Process not Found - Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 684 Process not Found - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4656 file.exe 4656 file.exe 684 Process not Found 684 Process not Found 684 Process not Found 684 Process not Found 684 Process not Found 684 Process not Found 684 Process not Found 684 Process not Found 684 Process not Found 684 Process not Found 684 Process not Found 684 Process not Found 684 Process not Found 684 Process not Found 684 Process not Found 684 Process not Found 684 Process not Found 684 Process not Found 684 Process not Found 684 Process not Found 684 Process not Found 684 Process not Found 684 Process not Found 684 Process not Found 684 Process not Found 684 Process not Found 684 Process not Found 684 Process not Found 684 Process not Found 684 Process not Found 684 Process not Found 684 Process not Found 684 Process not Found 684 Process not Found 684 Process not Found 684 Process not Found 684 Process not Found 684 Process not Found 684 Process not Found 684 Process not Found 684 Process not Found 684 Process not Found 684 Process not Found 684 Process not Found 684 Process not Found 684 Process not Found 684 Process not Found 684 Process not Found 684 Process not Found 684 Process not Found 684 Process not Found 684 Process not Found 684 Process not Found 684 Process not Found 684 Process not Found 684 Process not Found 684 Process not Found 684 Process not Found 684 Process not Found 684 Process not Found 684 Process not Found 684 Process not Found - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 684 Process not Found - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 4656 file.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 684 Process not Found Token: SeCreatePagefilePrivilege 684 Process not Found Token: SeShutdownPrivilege 684 Process not Found Token: SeCreatePagefilePrivilege 684 Process not Found Token: SeShutdownPrivilege 684 Process not Found Token: SeCreatePagefilePrivilege 684 Process not Found Token: SeShutdownPrivilege 684 Process not Found Token: SeCreatePagefilePrivilege 684 Process not Found Token: SeShutdownPrivilege 684 Process not Found Token: SeCreatePagefilePrivilege 684 Process not Found Token: SeShutdownPrivilege 684 Process not Found Token: SeCreatePagefilePrivilege 684 Process not Found Token: SeShutdownPrivilege 684 Process not Found Token: SeCreatePagefilePrivilege 684 Process not Found Token: SeShutdownPrivilege 684 Process not Found Token: SeCreatePagefilePrivilege 684 Process not Found Token: SeShutdownPrivilege 684 Process not Found Token: SeCreatePagefilePrivilege 684 Process not Found Token: SeShutdownPrivilege 684 Process not Found Token: SeCreatePagefilePrivilege 684 Process not Found Token: SeShutdownPrivilege 684 Process not Found Token: SeCreatePagefilePrivilege 684 Process not Found Token: SeShutdownPrivilege 684 Process not Found Token: SeCreatePagefilePrivilege 684 Process not Found Token: SeShutdownPrivilege 684 Process not Found Token: SeCreatePagefilePrivilege 684 Process not Found Token: SeDebugPrivilege 3940 Iqpoqhfidqa.exe Token: SeShutdownPrivilege 684 Process not Found Token: SeCreatePagefilePrivilege 684 Process not Found Token: SeShutdownPrivilege 684 Process not Found Token: SeCreatePagefilePrivilege 684 Process not Found Token: SeShutdownPrivilege 684 Process not Found Token: SeCreatePagefilePrivilege 684 Process not Found Token: SeShutdownPrivilege 684 Process not Found Token: SeCreatePagefilePrivilege 684 Process not Found Token: SeDebugPrivilege 684 Process not Found Token: SeShutdownPrivilege 684 Process not Found Token: SeCreatePagefilePrivilege 684 Process not Found Token: SeShutdownPrivilege 684 Process not Found Token: SeCreatePagefilePrivilege 684 Process not Found Token: SeShutdownPrivilege 684 Process not Found Token: SeCreatePagefilePrivilege 684 Process not Found Token: SeShutdownPrivilege 684 Process not Found Token: SeCreatePagefilePrivilege 684 Process not Found Token: SeShutdownPrivilege 684 Process not Found Token: SeCreatePagefilePrivilege 684 Process not Found Token: SeShutdownPrivilege 684 Process not Found Token: SeCreatePagefilePrivilege 684 Process not Found Token: SeShutdownPrivilege 684 Process not Found Token: SeCreatePagefilePrivilege 684 Process not Found Token: SeShutdownPrivilege 684 Process not Found Token: SeCreatePagefilePrivilege 684 Process not Found Token: SeShutdownPrivilege 684 Process not Found Token: SeCreatePagefilePrivilege 684 Process not Found Token: SeShutdownPrivilege 684 Process not Found Token: SeCreatePagefilePrivilege 684 Process not Found Token: SeShutdownPrivilege 684 Process not Found Token: SeCreatePagefilePrivilege 684 Process not Found Token: SeShutdownPrivilege 684 Process not Found Token: SeCreatePagefilePrivilege 684 Process not Found Token: SeShutdownPrivilege 684 Process not Found Token: SeCreatePagefilePrivilege 684 Process not Found Token: SeShutdownPrivilege 684 Process not Found Token: SeCreatePagefilePrivilege 684 Process not Found - Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 960 rundll32.exe 3940 Iqpoqhfidqa.exe 4712 chrome.exe - Suspicious use of SendNotifyMessage 1 IoCs
pid Process 3940 Iqpoqhfidqa.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 684 Process not Found 684 Process not Found 4712 chrome.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 684 wrote to memory of 3424 684 Process not Found 88 PID 684 wrote to memory of 3424 684 Process not Found 88 PID 684 wrote to memory of 3424 684 Process not Found 88 PID 3424 wrote to memory of 3940 3424 E9F7.exe 102 PID 3424 wrote to memory of 3940 3424 E9F7.exe 102 PID 3424 wrote to memory of 3940 3424 E9F7.exe 102 PID 3424 wrote to memory of 960 3424 E9F7.exe 104 PID 3424 wrote to memory of 960 3424 E9F7.exe 104 PID 3424 wrote to memory of 960 3424 E9F7.exe 104 PID 3424 wrote to memory of 960 3424 E9F7.exe 104 PID 684 wrote to memory of 4712 684 Process not Found 108 PID 684 wrote to memory of 4712 684 Process not Found 108 PID 4712 wrote to memory of 396 4712 chrome.exe 109 PID 4712 wrote to memory of 396 4712 chrome.exe 109 PID 4712 wrote to memory of 1716 4712 chrome.exe 112 PID 4712 wrote to memory of 1716 4712 chrome.exe 112 PID 4712 wrote to memory of 1716 4712 chrome.exe 112 PID 4712 wrote to memory of 1716 4712 chrome.exe 112 PID 4712 wrote to memory of 1716 4712 chrome.exe 112 PID 4712 wrote to memory of 1716 4712 chrome.exe 112 PID 4712 wrote to memory of 1716 4712 chrome.exe 112 PID 4712 wrote to memory of 1716 4712 chrome.exe 112 PID 4712 wrote to memory of 1716 4712 chrome.exe 112 PID 4712 wrote to memory of 1716 4712 chrome.exe 112 PID 4712 wrote to memory of 1716 4712 chrome.exe 112 PID 4712 wrote to memory of 1716 4712 chrome.exe 112 PID 4712 wrote to memory of 1716 4712 chrome.exe 112 PID 4712 wrote to memory of 1716 4712 chrome.exe 112 PID 4712 wrote to memory of 1716 4712 chrome.exe 112 PID 4712 wrote to memory of 1716 4712 chrome.exe 112 PID 4712 wrote to memory of 1716 4712 chrome.exe 112 PID 4712 wrote to memory of 1716 4712 chrome.exe 112 PID 4712 wrote to memory of 1716 4712 chrome.exe 112 PID 4712 wrote to memory of 1716 4712 chrome.exe 112 PID 4712 wrote to memory of 1716 4712 chrome.exe 112 PID 4712 wrote to memory of 1716 4712 chrome.exe 112 PID 4712 wrote to memory of 1716 4712 chrome.exe 112 PID 4712 wrote to memory of 1716 4712 chrome.exe 112 PID 4712 wrote to memory of 1716 4712 chrome.exe 112 PID 4712 wrote to memory of 1716 4712 chrome.exe 112 PID 4712 wrote to memory of 1716 4712 chrome.exe 112 PID 4712 wrote to memory of 1716 4712 chrome.exe 112 PID 4712 wrote to memory of 1716 4712 chrome.exe 112 PID 4712 wrote to memory of 1716 4712 chrome.exe 112 PID 4712 wrote to memory of 1716 4712 chrome.exe 112 PID 4712 wrote to memory of 1716 4712 chrome.exe 112 PID 4712 wrote to memory of 1716 4712 chrome.exe 112 PID 4712 wrote to memory of 1716 4712 chrome.exe 112 PID 4712 wrote to memory of 1716 4712 chrome.exe 112 PID 4712 wrote to memory of 1716 4712 chrome.exe 112 PID 4712 wrote to memory of 1716 4712 chrome.exe 112 PID 4712 wrote to memory of 1716 4712 chrome.exe 112 PID 4712 wrote to memory of 1716 4712 chrome.exe 112 PID 4712 wrote to memory of 1716 4712 chrome.exe 112 PID 4712 wrote to memory of 732 4712 chrome.exe 113 PID 4712 wrote to memory of 732 4712 chrome.exe 113 PID 4712 wrote to memory of 2976 4712 chrome.exe 114 PID 4712 wrote to memory of 2976 4712 chrome.exe 114 PID 4712 wrote to memory of 2976 4712 chrome.exe 114 PID 4712 wrote to memory of 2976 4712 chrome.exe 114 PID 4712 wrote to memory of 2976 4712 chrome.exe 114 PID 4712 wrote to memory of 2976 4712 chrome.exe 114 PID 4712 wrote to memory of 2976 4712 chrome.exe 114 PID 4712 wrote to memory of 2976 4712 chrome.exe 114
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:4656
-
C:\Users\Admin\AppData\Local\Temp\E9F7.exeC:\Users\Admin\AppData\Local\Temp\E9F7.exe1⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetThreadContext
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:3424 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3424 -s 10162⤵
- Program crash
PID:3548
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3424 -s 10802⤵
- Program crash
PID:4068
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3424 -s 11602⤵
- Program crash
PID:4052
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3424 -s 10882⤵
- Program crash
PID:1940
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3424 -s 10882⤵
- Program crash
PID:3360
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3424 -s 10162⤵
- Program crash
PID:1092
-
-
C:\Users\Admin\AppData\Local\Temp\Iqpoqhfidqa.exe"C:\Users\Admin\AppData\Local\Temp\Iqpoqhfidqa.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3940 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3940 -s 4723⤵
- Program crash
PID:1336
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\syswow64\rundll32.exe" "C:\Windows\syswow64\shell32.dll",#612⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of FindShellTrayWindow
PID:960
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3424 -s 14722⤵
- Program crash
PID:1320
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3424 -s 14922⤵
- Program crash
PID:3660
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3424 -ip 34241⤵PID:1956
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 3424 -ip 34241⤵PID:3816
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 3424 -ip 34241⤵PID:3596
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 3424 -ip 34241⤵PID:1996
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 3424 -ip 34241⤵PID:3924
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 3424 -ip 34241⤵PID:4528
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 3424 -ip 34241⤵PID:4832
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 3940 -ip 39401⤵PID:1496
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --no-default-browser-check --silent-launch --disable-backgrounding-occluded-windows --disable-background-timer-throttling --ran-launcher --profile-directory="Default"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Enumerates system info in registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4712 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe1bed4f50,0x7ffe1bed4f60,0x7ffe1bed4f702⤵PID:396
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1632,6924410274965671030,5694542217265837425,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1668 /prefetch:22⤵PID:1716
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1632,6924410274965671030,5694542217265837425,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=2020 /prefetch:82⤵PID:732
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1632,6924410274965671030,5694542217265837425,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2308 /prefetch:82⤵PID:2976
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 4712 -s 31682⤵
- Program crash
PID:3860
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3196
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 668 -p 4712 -ip 47121⤵PID:4792
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 3424 -ip 34241⤵PID:3648
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\AdobeSFX.log
- Size 1KB
- SHA256 ab5bbad92eb5b118a83152c34f7d011cd7ebd55e0774e7649b5bd6084c6bb807
- MD5 f100bb8b2cb884eaeb980fec005fda2a
- SHA1 35b381fb5f67e27d337a9be9a9a80f99a62ade7b
- SHA512 f199706af09ab1ec2fd2e1a23055f1d898271bb27ef067b992dece2677e74854023188a7c7c2f8836e7f64854b0bc6b190684b300f0da973d8bd96c3497346b2
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\E9F7.exe
- Size 6.6MB
- SHA256 55054d7dd67fa5e02e014e92761470d3b43f1d6a42846a6c17b266ccca38eaf5
- MD5 626bc845cac86f0d2cfaa34d7777a77c
- SHA1 913b8bcfea8c03e11fc86fd0af1c275c4ca2f665
- SHA512 adf31dcba3223c8d2272109ebd2ddb68369ceae933487207e0172b31b8f4de01f66a918bb4a7019c1bb9af8feef81f651d52c6587d958d4b88225a2c8f8091cc
- SSDEEP 196608:/xEdNo7ijr+Q5IupHmFsehQRq6HO8FfhVKUbfh:/+wiWQ53pGiRHQU
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\E9F7.exe
- Size 6.6MB
- SHA256 55054d7dd67fa5e02e014e92761470d3b43f1d6a42846a6c17b266ccca38eaf5
- MD5 626bc845cac86f0d2cfaa34d7777a77c
- SHA1 913b8bcfea8c03e11fc86fd0af1c275c4ca2f665
- SHA512 adf31dcba3223c8d2272109ebd2ddb68369ceae933487207e0172b31b8f4de01f66a918bb4a7019c1bb9af8feef81f651d52c6587d958d4b88225a2c8f8091cc
- SSDEEP 196608:/xEdNo7ijr+Q5IupHmFsehQRq6HO8FfhVKUbfh:/+wiWQ53pGiRHQU
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\Iqpoqhfidqa.exe
- Size 1.4MB
- SHA256 57c3c745da3abd3efb910c157bad430f5dc74a3aab48334e4f8f1a93c68d7d67
- MD5 526b7ca434081a2cde3a52401145e6d1
- SHA1 4a56c2f0a375fd61e8c735b8e01b82c5d937f23d
- SHA512 57b54dcdd7f99cde495e202e2e8f85278afdd6a4bd31c9593975d890942cecac0a482602ddf0e6f04dc4b37517414b65949a2c506c9c7f04197ec53845834f2d
- SSDEEP 24576:K/DzDFUkZ6Zoqsd3hF23sTxcG9zF+4ibcnnSizPU6pnKKM0:KXDmkZAoqsd36mRXBTZzPxlM
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\Iqpoqhfidqa.exe
- Size 1.4MB
- SHA256 57c3c745da3abd3efb910c157bad430f5dc74a3aab48334e4f8f1a93c68d7d67
- MD5 526b7ca434081a2cde3a52401145e6d1
- SHA1 4a56c2f0a375fd61e8c735b8e01b82c5d937f23d
- SHA512 57b54dcdd7f99cde495e202e2e8f85278afdd6a4bd31c9593975d890942cecac0a482602ddf0e6f04dc4b37517414b65949a2c506c9c7f04197ec53845834f2d
- SSDEEP 24576:K/DzDFUkZ6Zoqsd3hF23sTxcG9zF+4ibcnnSizPU6pnKKM0:KXDmkZAoqsd36mRXBTZzPxlM
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\Iqpoqhfidqa.tmp
- Size 3.5MB
- SHA256 c34565954052e885c9978fc2b50cf32cc98a67ba9851689101ed5bfffa9bdce4
- MD5 e46489e6f67972c624a8ef215d26db53
- SHA1 304fdfc6918d97480f65c80891baeb63e55ee3e0
- SHA512 6c65ad50bde38b2d6b5880f998e67ac431daa783be6baf925a84f1bb439b04806d1a612f4537363940325bb2aa6d1e692379215a63d1e80ac997fc1a9eb47ac1
- SSDEEP 49152:GRptgqJtySbKTpj5ADb4QR3YTsAyTGQn++LKzqoJMhT2gmhsyBPX5+q65XNTwO7F:GCSbIeuT9yTGQ+ZzqAlB/a51px
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\JavaDeployReg.log
- Size 25KB
- SHA256 c3db936d22f55c93214a38a5cc2b7a042b298822db68af0b4a574df37a1820db
- MD5 81afc5fdc60ea77324d4d8c4438e6510
- SHA1 4b21359d6a24d7096bd1f5afe2c100cb06829352
- SHA512 87e49d7bcf9f7d383ccf98ec4125402749db4bf954b8dc7c64177dd1ed254916a5b9a03903ccc01f0fc6bf635dc8640d3f9961156cd23882896c9b23fb472dcc
- SSDEEP 768:2/cTG175pcvVJgBBBBB3LJOgSs3MOPULIobKL3nZZZZZsQt:5TG19pfBBBBB3L6OPUMoMZZZZZsQt
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\TMKNGOMU-20220812-1924.log
- Size 56KB
- SHA256 1226acee43898580e53859127ed657800319973cb60df51155e5c8a7ce45e895
- MD5 942061e415bb8ead9b5a5218d5c14343
- SHA1 6017ef310882921100fa81965ff75e420200507d
- SHA512 b0a93f95992a6389ba9913d8ca29aaba421f25aea2463244468f3279185f88dddd3db4ecc9d58e4c73ac9901465548df24150978f3bc8a943376a176f605cddd
- SSDEEP 1536:mLUsQsETTcOWWWMT84wO8gwRjNj2BqdapyRt4iVbLswSq/cgb++G6B4Y6PzLH3rK:qxic2CgBqda83
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\dd_vcredistMSI50B8.txt
- Size 426KB
- SHA256 37c69c02974b85d856e00765ff6b978bc55f03f1254b5f50754d5acd7c32c296
- MD5 cd406b2d2202bec1d657b0042c2a2cb8
- SHA1 87d639c4dc350106f0e2cd2364d78df223aac7e4
- SHA512 09a482f2fe99f4b6a45f8acb8953705cc834a8e92be2f579f62e5aa784d972b63e1dc8d0a4bf25442623a3f251f9a675121c3a402e1b5748424acceeaf547ee0
- SSDEEP 1536:D0LrTEvCMI7DIWv2+2fDGw1NWNw8wzfnFNeYTJ3ERsIvPEm6JJNlZ+KdzbjZsRL9:D0NTj7XprZUoBNr
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\jawshtml.html
- Size 13B
- SHA256 7b4f72a40bd21934680f085afe8a30bf85acff1a8365af43102025c4ccf52b73
- MD5 b2a4bc176e9f29b0c439ef9a53a62a1a
- SHA1 1ae520cbbf7e14af867232784194366b3d1c3f34
- SHA512 e04b85d8d45d43479abbbe34f57265b64d1d325753ec3d2ecadb5f83fa5822b1d999b39571801ca39fa32e4a0a7caab073ccd003007e5b86dac7b1c892a5de3f
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\wct1F1D.tmp
- Size 62KB
- SHA256 094754a618b102b7ad0800dd4c9c02c882cf2d1e7996ba864f422fa4312427e1
- MD5 7185e716980842db27c3b3a88e1fe804
- SHA1 e4615379cd4797629b4cc3da157f4d4a5412fb2b
- SHA512 dea331907f5f1de407ca07e24be7ad808fa43a0eef2d1b5009721f937ab2a8f77832e332d5ac3d9662e5b02ecaabbec0f4228af279fa6562be4dccb6c829246c
- SSDEEP 384:poaSLZTSy3x02SMU9mCzmT2zu/649Pji7iJI5TZCP56vS1xDR+dfUFv8WTT:WIyWcU9mCzmKu/JV2iP56vcDR+p0T
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\wctA1E8.tmp
- Size 62KB
- SHA256 094754a618b102b7ad0800dd4c9c02c882cf2d1e7996ba864f422fa4312427e1
- MD5 7185e716980842db27c3b3a88e1fe804
- SHA1 e4615379cd4797629b4cc3da157f4d4a5412fb2b
- SHA512 dea331907f5f1de407ca07e24be7ad808fa43a0eef2d1b5009721f937ab2a8f77832e332d5ac3d9662e5b02ecaabbec0f4228af279fa6562be4dccb6c829246c
- SSDEEP 384:poaSLZTSy3x02SMU9mCzmT2zu/649Pji7iJI5TZCP56vS1xDR+dfUFv8WTT:WIyWcU9mCzmKu/JV2iP56vcDR+p0T
- MD5 SHA1 SHA512 SSDEEP