Analysis
- max time kernel
151s - max time network
154s - platform
windows10-2004_x64 - resource
win10v2004-20220901-en - resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system - submitted
01/01/2023, 06:27
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20221111-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20220901-en
windows10-2004-x64
24 signatures
150 seconds
General
- Target file.exe
- Size 240KB
- Sample230101-g7rddsbc52
- SHA256 14774b2c7363dd1bde9175acb75cb3e5d6619225bd51b2ef710a4bb1a8a9475f
- MD5 81e062ec8bf8fd4f39e1cc495a049440
- SHA1 49ad48dd87b04546e0335339c94e03b6cfc37192
- SHA512 d79802569ec511b9ab6f89ada75bcf770be414031d6b4672e3701b59d8fe545a8a2181b0b8ae9a1edf94392807c3eac032eb2a11b27221f3bcb7b3105a3d3f5c
- SSDEEP 3072:oX5t99JLgxsidZQ5+0xRirQLfp42EqnmqSgVI27hZY:8NLKdZcxRir48hgDZY
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Detects Smokeloader packer 1 IoCs
resource yara_rule behavioral2/memory/2068-133-0x00000000006F0000-0x00000000006F9000-memory.dmp family_smokeloader - SmokeLoader
Modular backdoor trojan in use since 2014.
- Downloads MZ/PE file
- Executes dropped EXE 2 IoCs
pid Process 3600 2B46.exe 1700 Iqpoqhfidqa.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation 2B46.exe - Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 2248 Process not Found 456 chrome.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3600 set thread context of 4088 3600 2B46.exe 103 - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Program crash 9 IoCs
pid pid_target Process procid_target 2488 3600 WerFault.exe 88 1896 3600 WerFault.exe 88 4868 3600 WerFault.exe 88 968 3600 WerFault.exe 88 1280 3600 WerFault.exe 88 3756 3600 WerFault.exe 88 2992 3600 WerFault.exe 88 3208 1700 WerFault.exe 101 548 456 WerFault.exe 107 - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe - Checks processor information in registry 2 TTPs 39 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\VendorIdentifier 2B46.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 2B46.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\FeatureSet 2B46.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor 2B46.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Configuration Data 2B46.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 rundll32.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 rundll32.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 rundll32.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 2B46.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet 2B46.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision 2B46.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information 2B46.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Configuration Data rundll32.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 2B46.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 2B46.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\VendorIdentifier rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Platform Specific Field 1 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString 2B46.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier 2B46.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Status 2B46.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Status rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Previous Update Revision rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 2B46.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor 2B46.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Previous Update Revision 2B46.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Identifier 2B46.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 2B46.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Identifier rundll32.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 Process not Found Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Toolbar Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1" Process not Found - Modifies registry class 19 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000 Process not Found Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 Process not Found Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff Process not Found Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags Process not Found Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ Process not Found Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings rundll32.exe Set value (data) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 19002f433a5c000000000000000000000000000000000000000000 Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff Process not Found Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1" Process not Found Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell Process not Found Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1 Process not Found Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic" Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 Process not Found - Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2248 Process not Found - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2068 file.exe 2068 file.exe 2248 Process not Found 2248 Process not Found 2248 Process not Found 2248 Process not Found 2248 Process not Found 2248 Process not Found 2248 Process not Found 2248 Process not Found 2248 Process not Found 2248 Process not Found 2248 Process not Found 2248 Process not Found 2248 Process not Found 2248 Process not Found 2248 Process not Found 2248 Process not Found 2248 Process not Found 2248 Process not Found 2248 Process not Found 2248 Process not Found 2248 Process not Found 2248 Process not Found 2248 Process not Found 2248 Process not Found 2248 Process not Found 2248 Process not Found 2248 Process not Found 2248 Process not Found 2248 Process not Found 2248 Process not Found 2248 Process not Found 2248 Process not Found 2248 Process not Found 2248 Process not Found 2248 Process not Found 2248 Process not Found 2248 Process not Found 2248 Process not Found 2248 Process not Found 2248 Process not Found 2248 Process not Found 2248 Process not Found 2248 Process not Found 2248 Process not Found 2248 Process not Found 2248 Process not Found 2248 Process not Found 2248 Process not Found 2248 Process not Found 2248 Process not Found 2248 Process not Found 2248 Process not Found 2248 Process not Found 2248 Process not Found 2248 Process not Found 2248 Process not Found 2248 Process not Found 2248 Process not Found 2248 Process not Found 2248 Process not Found 2248 Process not Found 2248 Process not Found - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2248 Process not Found - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 2068 file.exe - Suspicious use of AdjustPrivilegeToken 48 IoCs
description pid Process Token: SeShutdownPrivilege 2248 Process not Found Token: SeCreatePagefilePrivilege 2248 Process not Found Token: SeShutdownPrivilege 2248 Process not Found Token: SeCreatePagefilePrivilege 2248 Process not Found Token: SeShutdownPrivilege 2248 Process not Found Token: SeCreatePagefilePrivilege 2248 Process not Found Token: SeShutdownPrivilege 2248 Process not Found Token: SeCreatePagefilePrivilege 2248 Process not Found Token: SeShutdownPrivilege 2248 Process not Found Token: SeCreatePagefilePrivilege 2248 Process not Found Token: SeShutdownPrivilege 2248 Process not Found Token: SeCreatePagefilePrivilege 2248 Process not Found Token: SeShutdownPrivilege 2248 Process not Found Token: SeCreatePagefilePrivilege 2248 Process not Found Token: SeShutdownPrivilege 2248 Process not Found Token: SeCreatePagefilePrivilege 2248 Process not Found Token: SeShutdownPrivilege 2248 Process not Found Token: SeCreatePagefilePrivilege 2248 Process not Found Token: SeShutdownPrivilege 2248 Process not Found Token: SeCreatePagefilePrivilege 2248 Process not Found Token: SeShutdownPrivilege 2248 Process not Found Token: SeCreatePagefilePrivilege 2248 Process not Found Token: SeShutdownPrivilege 2248 Process not Found Token: SeCreatePagefilePrivilege 2248 Process not Found Token: SeShutdownPrivilege 2248 Process not Found Token: SeCreatePagefilePrivilege 2248 Process not Found Token: SeDebugPrivilege 1700 Iqpoqhfidqa.exe Token: SeShutdownPrivilege 2248 Process not Found Token: SeCreatePagefilePrivilege 2248 Process not Found Token: SeShutdownPrivilege 2248 Process not Found Token: SeCreatePagefilePrivilege 2248 Process not Found Token: SeShutdownPrivilege 2248 Process not Found Token: SeCreatePagefilePrivilege 2248 Process not Found Token: SeShutdownPrivilege 2248 Process not Found Token: SeCreatePagefilePrivilege 2248 Process not Found Token: SeDebugPrivilege 2248 Process not Found Token: SeShutdownPrivilege 2248 Process not Found Token: SeCreatePagefilePrivilege 2248 Process not Found Token: SeShutdownPrivilege 2248 Process not Found Token: SeCreatePagefilePrivilege 2248 Process not Found Token: SeShutdownPrivilege 2248 Process not Found Token: SeCreatePagefilePrivilege 2248 Process not Found Token: SeShutdownPrivilege 2248 Process not Found Token: SeCreatePagefilePrivilege 2248 Process not Found Token: SeShutdownPrivilege 2248 Process not Found Token: SeCreatePagefilePrivilege 2248 Process not Found Token: SeShutdownPrivilege 2248 Process not Found Token: SeCreatePagefilePrivilege 2248 Process not Found - Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 4088 rundll32.exe 1700 Iqpoqhfidqa.exe 456 chrome.exe - Suspicious use of SendNotifyMessage 1 IoCs
pid Process 1700 Iqpoqhfidqa.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2248 Process not Found 2248 Process not Found 456 chrome.exe - Suspicious use of UnmapMainImage 1 IoCs
pid Process 2248 Process not Found - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2248 wrote to memory of 3600 2248 Process not Found 88 PID 2248 wrote to memory of 3600 2248 Process not Found 88 PID 2248 wrote to memory of 3600 2248 Process not Found 88 PID 3600 wrote to memory of 1700 3600 2B46.exe 101 PID 3600 wrote to memory of 1700 3600 2B46.exe 101 PID 3600 wrote to memory of 1700 3600 2B46.exe 101 PID 3600 wrote to memory of 4088 3600 2B46.exe 103 PID 3600 wrote to memory of 4088 3600 2B46.exe 103 PID 3600 wrote to memory of 4088 3600 2B46.exe 103 PID 3600 wrote to memory of 4088 3600 2B46.exe 103 PID 2248 wrote to memory of 456 2248 Process not Found 107 PID 2248 wrote to memory of 456 2248 Process not Found 107 PID 456 wrote to memory of 2540 456 chrome.exe 108 PID 456 wrote to memory of 2540 456 chrome.exe 108 PID 456 wrote to memory of 3228 456 chrome.exe 110 PID 456 wrote to memory of 3228 456 chrome.exe 110 PID 456 wrote to memory of 3228 456 chrome.exe 110 PID 456 wrote to memory of 3228 456 chrome.exe 110 PID 456 wrote to memory of 3228 456 chrome.exe 110 PID 456 wrote to memory of 3228 456 chrome.exe 110 PID 456 wrote to memory of 3228 456 chrome.exe 110 PID 456 wrote to memory of 3228 456 chrome.exe 110 PID 456 wrote to memory of 3228 456 chrome.exe 110 PID 456 wrote to memory of 3228 456 chrome.exe 110 PID 456 wrote to memory of 3228 456 chrome.exe 110 PID 456 wrote to memory of 3228 456 chrome.exe 110 PID 456 wrote to memory of 3228 456 chrome.exe 110 PID 456 wrote to memory of 3228 456 chrome.exe 110 PID 456 wrote to memory of 3228 456 chrome.exe 110 PID 456 wrote to memory of 3228 456 chrome.exe 110 PID 456 wrote to memory of 3228 456 chrome.exe 110 PID 456 wrote to memory of 3228 456 chrome.exe 110 PID 456 wrote to memory of 3228 456 chrome.exe 110 PID 456 wrote to memory of 3228 456 chrome.exe 110 PID 456 wrote to memory of 3228 456 chrome.exe 110 PID 456 wrote to memory of 3228 456 chrome.exe 110 PID 456 wrote to memory of 3228 456 chrome.exe 110 PID 456 wrote to memory of 3228 456 chrome.exe 110 PID 456 wrote to memory of 3228 456 chrome.exe 110 PID 456 wrote to memory of 3228 456 chrome.exe 110 PID 456 wrote to memory of 3228 456 chrome.exe 110 PID 456 wrote to memory of 3228 456 chrome.exe 110 PID 456 wrote to memory of 3228 456 chrome.exe 110 PID 456 wrote to memory of 3228 456 chrome.exe 110 PID 456 wrote to memory of 3228 456 chrome.exe 110 PID 456 wrote to memory of 3228 456 chrome.exe 110 PID 456 wrote to memory of 3228 456 chrome.exe 110 PID 456 wrote to memory of 3228 456 chrome.exe 110 PID 456 wrote to memory of 3228 456 chrome.exe 110 PID 456 wrote to memory of 3228 456 chrome.exe 110 PID 456 wrote to memory of 3228 456 chrome.exe 110 PID 456 wrote to memory of 3228 456 chrome.exe 110 PID 456 wrote to memory of 3228 456 chrome.exe 110 PID 456 wrote to memory of 3228 456 chrome.exe 110 PID 456 wrote to memory of 4988 456 chrome.exe 111 PID 456 wrote to memory of 4988 456 chrome.exe 111 PID 456 wrote to memory of 3812 456 chrome.exe 112 PID 456 wrote to memory of 3812 456 chrome.exe 112 PID 456 wrote to memory of 3812 456 chrome.exe 112 PID 456 wrote to memory of 3812 456 chrome.exe 112 PID 456 wrote to memory of 3812 456 chrome.exe 112 PID 456 wrote to memory of 3812 456 chrome.exe 112 PID 456 wrote to memory of 3812 456 chrome.exe 112 PID 456 wrote to memory of 3812 456 chrome.exe 112
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2068
-
C:\Users\Admin\AppData\Local\Temp\2B46.exeC:\Users\Admin\AppData\Local\Temp\2B46.exe1⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetThreadContext
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:3600 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3600 -s 10162⤵
- Program crash
PID:2488
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3600 -s 10602⤵
- Program crash
PID:1896
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3600 -s 11402⤵
- Program crash
PID:4868
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3600 -s 11522⤵
- Program crash
PID:968
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3600 -s 11522⤵
- Program crash
PID:1280
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3600 -s 11682⤵
- Program crash
PID:3756
-
-
C:\Users\Admin\AppData\Local\Temp\Iqpoqhfidqa.exe"C:\Users\Admin\AppData\Local\Temp\Iqpoqhfidqa.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1700 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1700 -s 4723⤵
- Program crash
PID:3208
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\syswow64\rundll32.exe" "C:\Windows\syswow64\shell32.dll",#612⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of FindShellTrayWindow
PID:4088
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3600 -s 14562⤵
- Program crash
PID:2992
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 3600 -ip 36001⤵PID:2364
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 3600 -ip 36001⤵PID:956
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 3600 -ip 36001⤵PID:2872
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 3600 -ip 36001⤵PID:3156
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 3600 -ip 36001⤵PID:1472
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 3600 -ip 36001⤵PID:4032
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 3600 -ip 36001⤵PID:2944
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 1700 -ip 17001⤵PID:2460
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --no-default-browser-check --silent-launch --disable-backgrounding-occluded-windows --disable-background-timer-throttling --ran-launcher --profile-directory="Default"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Enumerates system info in registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:456 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa98524f50,0x7ffa98524f60,0x7ffa98524f702⤵PID:2540
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1660,7691519650014929016,7034785449617338124,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1676 /prefetch:22⤵PID:3228
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1660,7691519650014929016,7034785449617338124,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1840 /prefetch:82⤵PID:4988
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1660,7691519650014929016,7034785449617338124,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2448 /prefetch:82⤵PID:3812
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1660,7691519650014929016,7034785449617338124,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3348 /prefetch:82⤵PID:3368
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 456 -s 36882⤵
- Program crash
PID:548
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:220
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 484 -p 456 -ip 4561⤵PID:1780
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\2B46.exe
- Size 6.6MB
- SHA256 060bb0c4c5958b9852f13d9901c148adff477c02cf2a62a4678fa722840c1d63
- MD5 bfe9d96c5063a3f6bb6b45b3bf25f318
- SHA1 8c17924fa2c044fac7ffeab4ce52ff6493734afa
- SHA512 45525156ad72d3607ab7dc13ed8c3b5efcb0ca161542eeb3b7b5e3c94175917a12be79717b803b006b2a1e6f4a57da2ecc8f0d39604b8df3bcb82395e3e66107
- SSDEEP 196608:j0bPxjIoaYyIVYuM/9hHYiEoM+xTpi/Fytjpav5:j0dIoavxz4DIxtwytVav
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\2B46.exe
- Size 6.6MB
- SHA256 060bb0c4c5958b9852f13d9901c148adff477c02cf2a62a4678fa722840c1d63
- MD5 bfe9d96c5063a3f6bb6b45b3bf25f318
- SHA1 8c17924fa2c044fac7ffeab4ce52ff6493734afa
- SHA512 45525156ad72d3607ab7dc13ed8c3b5efcb0ca161542eeb3b7b5e3c94175917a12be79717b803b006b2a1e6f4a57da2ecc8f0d39604b8df3bcb82395e3e66107
- SSDEEP 196608:j0bPxjIoaYyIVYuM/9hHYiEoM+xTpi/Fytjpav5:j0dIoavxz4DIxtwytVav
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\IYMUGYHL-20220901-1118.log
- Size 60KB
- SHA256 e4719d7a31c12efba8e48ab3484f0f7c392b3f58eb99d1e1697a709ece0920cb
- MD5 6eeab2ccd2a2b86fd7c279e3fa2f7110
- SHA1 e57fa49ee5ad7e560831751a776eaa659f2ff11a
- SHA512 4cd009dc9ed283d217ad4c3558098bedf1511e87d2e96d7089dd33e482222b524a26c5db7ad76bcfa429901ff8838d4799c20474f3bc35041e126f4e21eaa9da
- SSDEEP 1536:P/PUtJGdVyPmHWHt4cYjeXIWbQx0qsT1xhth5iTrRUT4S9nKcDFKhzwJppdClUrH:f/KP/Cuxhthcg
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\IYMUGYHL-20220901-1118a.log
- Size 182KB
- SHA256 bbaa20497843b541ff16df5d313d0ae09a07753533de70b364672eff60d919ca
- MD5 fc884470343819d1ce5d38d0d731c141
- SHA1 3665ddbe5619e9027f0ea87dd58a50177decd9cc
- SHA512 fe7a3a1410f83b11023a74b6cbb0b9512ced6111d5a5f33f6247db315901a7d62b9e9e63ea27be44b130dbab0a38fb2f08bb4efd22a509b03593de64f8ff60ae
- SSDEEP 1536:94U2r1FUKQpRMDL2TIrL2u7qDvuoxKoy58p8ak09+vdcGGXEi2/ci283irSi29iA:ygAF8tk09+vdcGGUwc5w1/OX/LyDE/tf
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\Iqpoqhfidqa.exe
- Size 1.4MB
- SHA256 57c3c745da3abd3efb910c157bad430f5dc74a3aab48334e4f8f1a93c68d7d67
- MD5 526b7ca434081a2cde3a52401145e6d1
- SHA1 4a56c2f0a375fd61e8c735b8e01b82c5d937f23d
- SHA512 57b54dcdd7f99cde495e202e2e8f85278afdd6a4bd31c9593975d890942cecac0a482602ddf0e6f04dc4b37517414b65949a2c506c9c7f04197ec53845834f2d
- SSDEEP 24576:K/DzDFUkZ6Zoqsd3hF23sTxcG9zF+4ibcnnSizPU6pnKKM0:KXDmkZAoqsd36mRXBTZzPxlM
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\Iqpoqhfidqa.exe
- Size 1.4MB
- SHA256 57c3c745da3abd3efb910c157bad430f5dc74a3aab48334e4f8f1a93c68d7d67
- MD5 526b7ca434081a2cde3a52401145e6d1
- SHA1 4a56c2f0a375fd61e8c735b8e01b82c5d937f23d
- SHA512 57b54dcdd7f99cde495e202e2e8f85278afdd6a4bd31c9593975d890942cecac0a482602ddf0e6f04dc4b37517414b65949a2c506c9c7f04197ec53845834f2d
- SSDEEP 24576:K/DzDFUkZ6Zoqsd3hF23sTxcG9zF+4ibcnnSizPU6pnKKM0:KXDmkZAoqsd36mRXBTZzPxlM
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\Iqpoqhfidqa.tmp
- Size 3.5MB
- SHA256 c34565954052e885c9978fc2b50cf32cc98a67ba9851689101ed5bfffa9bdce4
- MD5 e46489e6f67972c624a8ef215d26db53
- SHA1 304fdfc6918d97480f65c80891baeb63e55ee3e0
- SHA512 6c65ad50bde38b2d6b5880f998e67ac431daa783be6baf925a84f1bb439b04806d1a612f4537363940325bb2aa6d1e692379215a63d1e80ac997fc1a9eb47ac1
- SSDEEP 49152:GRptgqJtySbKTpj5ADb4QR3YTsAyTGQn++LKzqoJMhT2gmhsyBPX5+q65XNTwO7F:GCSbIeuT9yTGQ+ZzqAlB/a51px
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\StructuredQuery.log
- Size 4KB
- SHA256 c7ac663de6c20c909c93ed1fa786259400c56bee376191eeb3c1534ea66a2357
- MD5 b2c73bb7e8ac5639eec536a1cee5abd5
- SHA1 27ac80503aa3827fef879b5ae4e8546da1285f3d
- SHA512 57c6314370840a96847d16f26a1f60b1e57647b67692f8deab92e4120b657a3eac7d001cdca0467c32cefe74a0450f1076d7eb484712a4e45edc0d0bd3db3de8
- SSDEEP 48:Klx9Vz69T0oXIGXTWGXsP9JEX98TNw9PT78lx9Vz69T0oXIGXTWGXsP9JEX98T4T:NvTlxvTlv
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\dd_NDP472-KB4054530-x86-x64-AllOS-ENU_decompression_log.txt
- Size 1KB
- SHA256 72322baaa14f01ab12ba14b00d66e2b2178f3f3d249bb0542a0f49fc59de808c
- MD5 e949db8f55991884a153aaf3888575bc
- SHA1 e493e81e97c9589339046d5418a5dcf0fab1e660
- SHA512 368c7c3f68d8c15ded551ed9b87bc78b79bc0aed7fa3d7ef4006a130c5cf69caec0e5f29962882a5fcaed43580adb2da574cc2c9b178b96d64147b8ecf6ba97c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\dd_vcredistUI7626.txt
- Size 11KB
- SHA256 c1806d15c75249bf5c76a2119add70bc35932fa352195e869336c875729fd91b
- MD5 3c93e285f3bbe6e86160089a0a7ecc11
- SHA1 8de0d9f28e092e4cc12a343c1a01331b3c83901b
- SHA512 027e65e768f04c310b094e9dd029ac59bda27aef30605856336354b5490f0982267a8e5743a15bd7cfebe60dfe169f7c1d8ec7b5b492dd9008a15521023b55b2
- SSDEEP 192:RQBt1of6YhXn/nDln/ntM4pnNns/QP8pxDr8VP:RQBt1of6YhX/Z/tM4pNBEMVP
- MD5 SHA1 SHA512 SSDEEP