Analysis
- max time kernel
149s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system - submitted
05/01/2023, 03:17
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20220812-en
windows7-x64
5 signatures
150 seconds
General
- Target file.exe
- Size 362KB
- Sample230105-ds2n2aag45
- SHA256 cecb830c2f302dc4400bdde5a8a9381dea71488e328ebade0f1b53d68a7cfdd7
- MD5 e210f9cfde5adaae6b4590826888a4fb
- SHA1 6e041a73502f24df9e00d697dc10320b9660ad1e
- SHA512 fd55e9bceafc7ac88824516eb5cbc675f74a6137d7d1d817b9aeee7ec320a552d74a2d74c59de0fe7eac65bf767a8eaf48ce6b366bfd8960e2b827212d915cf0
- SSDEEP 3072:FtXqvQQLxlL0IUff5nFa/uIZUgWxwRLeWrPkxjGkv6o6UGY8jdA4upFldiLLk9XH:zELxDUffuuI72qMxiHCoxupmLnbBEjT
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detects Smokeloader packer 1 IoCs
resource yara_rule behavioral2/memory/4656-133-0x0000000002DA0000-0x0000000002DA9000-memory.dmp family_smokeloader - SmokeLoader
Modular backdoor trojan in use since 2014.
- Blocklisted process makes network request 3 IoCs
flow pid Process 58 2344 rundll32.exe 60 2344 rundll32.exe 121 2344 rundll32.exe - Downloads MZ/PE file
- Executes dropped EXE 2 IoCs
pid Process 216 E004.exe 4528 2E16.exe - Loads dropped DLL 1 IoCs
pid Process 2344 rundll32.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2344 set thread context of 3096 2344 rundll32.exe 94 - Drops file in Program Files directory 34 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ViewerPS.dll rundll32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\add_reviewer.gif rundll32.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\PDFSigQFormalRep.pdf rundll32.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\back-arrow-disabled.svg rundll32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\MoreTools.aapp rundll32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\dd_arrow_small.png rundll32.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\Search.api rundll32.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\main.css rundll32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\main.css rundll32.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\sendforsignature.svg rundll32.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\br.gif rundll32.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\MoreTools.aapp rundll32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\PDDom.api rundll32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\PMP\DataMatrix.pmp rundll32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\libEGL.dll rundll32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ccme_ecc.dll rundll32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\br.gif rundll32.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\DataMatrix.pmp rundll32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\PDFSigQFormalRep.pdf rundll32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\Combine_R_RHP.aapp rundll32.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\back-arrow-focus.svg rundll32.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\libEGL.dll rundll32.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\manifest.json rundll32.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\dd_arrow_small.png rundll32.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\add_reviewer.gif rundll32.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\PDFPrevHndlr.dll rundll32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\back-arrow-focus.svg rundll32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\manifest.json rundll32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Search.api rundll32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\back-arrow-disabled.svg rundll32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\sendforsignature.svg rundll32.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\ViewerPS.dll rundll32.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\PDDom.api rundll32.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\Combine_R_RHP.aapp rundll32.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Program crash 2 IoCs
pid pid_target Process procid_target 3652 216 WerFault.exe 88 868 4528 WerFault.exe 93 - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe - Checks processor information in registry 2 TTPs 25 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Revision rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\FeatureSet rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Platform Specific Field 1 rundll32.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\VendorIdentifier rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Status rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor rundll32.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Component Information rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Identifier rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Previous Update Revision rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Status rundll32.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString rundll32.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Toolbar Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1" Process not Found Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 Process not Found - Modifies registry class 30 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings rundll32.exe Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 820074001c0043465346160031000000000000000000100041707044617461000000741a595e96dfd3488d671733bcee28bac5cdfadf9f6756418947c5c76bc0b67f400009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004100700070004400610074006100000042000000 Process not Found Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\WorkFolders Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff Process not Found Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 = 4e0031000000000025563d22100054656d7000003a0009000400efbe0c551999255643222e00000000000000000000000000000000000000000000000000ee2b4800540065006d007000000014000000 Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ Process not Found Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f44471a0359723fa74489c55595fe6b30ee0000 Process not Found Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1 Process not Found Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic" Process not Found Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\NodeSlot = "1" Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU Process not Found Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = 00000000ffffffff Process not Found Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags Process not Found Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell rundll32.exe Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\MRUListEx = ffffffff Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff rundll32.exe Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff Process not Found Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 Process not Found Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 Process not Found Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU rundll32.exe Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 50003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014000000 Process not Found - Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 684 Process not Found - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4656 file.exe 4656 file.exe 684 Process not Found 684 Process not Found 684 Process not Found 684 Process not Found 684 Process not Found 684 Process not Found 684 Process not Found 684 Process not Found 684 Process not Found 684 Process not Found 684 Process not Found 684 Process not Found 684 Process not Found 684 Process not Found 684 Process not Found 684 Process not Found 684 Process not Found 684 Process not Found 684 Process not Found 684 Process not Found 684 Process not Found 684 Process not Found 684 Process not Found 684 Process not Found 684 Process not Found 684 Process not Found 684 Process not Found 684 Process not Found 684 Process not Found 684 Process not Found 684 Process not Found 684 Process not Found 684 Process not Found 684 Process not Found 684 Process not Found 684 Process not Found 684 Process not Found 684 Process not Found 684 Process not Found 684 Process not Found 684 Process not Found 684 Process not Found 684 Process not Found 684 Process not Found 684 Process not Found 684 Process not Found 684 Process not Found 684 Process not Found 684 Process not Found 684 Process not Found 684 Process not Found 684 Process not Found 684 Process not Found 684 Process not Found 684 Process not Found 684 Process not Found 684 Process not Found 684 Process not Found 684 Process not Found 684 Process not Found 684 Process not Found 684 Process not Found - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 684 Process not Found - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 4656 file.exe - Suspicious use of AdjustPrivilegeToken 18 IoCs
description pid Process Token: SeShutdownPrivilege 684 Process not Found Token: SeCreatePagefilePrivilege 684 Process not Found Token: SeShutdownPrivilege 684 Process not Found Token: SeCreatePagefilePrivilege 684 Process not Found Token: SeShutdownPrivilege 684 Process not Found Token: SeCreatePagefilePrivilege 684 Process not Found Token: SeShutdownPrivilege 684 Process not Found Token: SeCreatePagefilePrivilege 684 Process not Found Token: SeShutdownPrivilege 684 Process not Found Token: SeCreatePagefilePrivilege 684 Process not Found Token: SeShutdownPrivilege 684 Process not Found Token: SeCreatePagefilePrivilege 684 Process not Found Token: SeShutdownPrivilege 684 Process not Found Token: SeCreatePagefilePrivilege 684 Process not Found Token: SeShutdownPrivilege 684 Process not Found Token: SeCreatePagefilePrivilege 684 Process not Found Token: SeShutdownPrivilege 684 Process not Found Token: SeCreatePagefilePrivilege 684 Process not Found - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3096 rundll32.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 684 Process not Found 684 Process not Found - Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 684 wrote to memory of 216 684 Process not Found 88 PID 684 wrote to memory of 216 684 Process not Found 88 PID 684 wrote to memory of 216 684 Process not Found 88 PID 216 wrote to memory of 2344 216 E004.exe 89 PID 216 wrote to memory of 2344 216 E004.exe 89 PID 216 wrote to memory of 2344 216 E004.exe 89 PID 684 wrote to memory of 4528 684 Process not Found 93 PID 684 wrote to memory of 4528 684 Process not Found 93 PID 684 wrote to memory of 4528 684 Process not Found 93 PID 2344 wrote to memory of 3096 2344 rundll32.exe 94 PID 2344 wrote to memory of 3096 2344 rundll32.exe 94 PID 2344 wrote to memory of 3096 2344 rundll32.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:4656
-
C:\Users\Admin\AppData\Local\Temp\E004.exeC:\Users\Admin\AppData\Local\Temp\E004.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:216 -
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Users\Admin\AppData\Local\Temp\Pyupydeoe.tmp",Uprsprhaot2⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:2344 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61 239893⤵
- Modifies registry class
- Suspicious use of FindShellTrayWindow
PID:3096
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 216 -s 5362⤵
- Program crash
PID:3652
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 216 -ip 2161⤵PID:4508
-
C:\Users\Admin\AppData\Local\Temp\2E16.exeC:\Users\Admin\AppData\Local\Temp\2E16.exe1⤵
- Executes dropped EXE
PID:4528 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4528 -s 12802⤵
- Program crash
PID:868
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4528 -ip 45281⤵PID:1676
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:2608
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k LocalService1⤵PID:3344
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\WindowsPowerShell\Modules\PDFPrevHndlr.dll
- Size 784KB
- SHA256 ca22829369cc1b633ad7db4a21bedd590b11b459ef65041264997c75484b16b6
- MD5 f663f1c3109fdb88849e4193d68fd429
- SHA1 dbcf8d9a3bd5a266413b40cb7e245b801d89e98a
- SHA512 8602e5c4cea1d95f5af63d582a343ef575d12c726b2d359bc2e9f345e35f58048967c749cb50b8077f5a8538b2fa85b88368dba98597b9532192bf21d41ef74b
- SSDEEP 24576:68Jr+SgWH5UB/VdYQ/N7WqpWaQxYZYBsFn:VJrSBYqLY
- MD5 SHA1 SHA512 SSDEEP
- Path C:\ProgramData\{E6FB8490-097E-1893-E5D7-72BBB5B030D6}\Oreqhqoupyrw.tmp
- Size 192KB
- SHA256 c267dcd8b8e41ea9a70708815f8d6bd7472f0f05d750ef440e161fc109971bad
- MD5 2b833352f7c6849d5477a19228049b1d
- SHA1 9085cbd45b65b7e58e3368b388b679bcc62ceb1c
- SHA512 62c60d8957d3fd04c6c6bbfdd214f389feb001212c69970a75f13029a00dfb3df5d0fe3607d33d7267faec5fff96e82d55f8a712629a98d0cf334853708fdf2a
- SSDEEP 3072:3tRtDSb60zOGWt4lnJ6ZdXvFjjulsyI6g+P9Nsdp+VDegHdAOD:3R9VZw8dXvFels0g+j8khZHdAOD
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\2E16.exe
- Size 379KB
- SHA256 7af994c3a375025de38e3b2bc62db5d4e2cc6a2e7e5b163482218281d0239f7b
- MD5 20653bebce54161a38b1f7fcc68d2e2f
- SHA1 cef22c99066ef7bfd899656c7d17cd2bc2aacdd9
- SHA512 48b0bdbc7bc5f6196adec5f5310a720f9f530e29e8da031999d07a9a695b649506613145a42ce5068cc6de965c22ccb80cc8014995b0ff2ecad96fa75bb12a7f
- SSDEEP 3072:ckX/+vRqLTr9VTe2H5ThFu1hGJY4Bmd9n9ekhqZPB6MY8jdA4upFldiLLk1caw/p:hnLTne2zFuv4BqpwzPGoxupmLicBpjT
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\2E16.exe
- Size 379KB
- SHA256 7af994c3a375025de38e3b2bc62db5d4e2cc6a2e7e5b163482218281d0239f7b
- MD5 20653bebce54161a38b1f7fcc68d2e2f
- SHA1 cef22c99066ef7bfd899656c7d17cd2bc2aacdd9
- SHA512 48b0bdbc7bc5f6196adec5f5310a720f9f530e29e8da031999d07a9a695b649506613145a42ce5068cc6de965c22ccb80cc8014995b0ff2ecad96fa75bb12a7f
- SSDEEP 3072:ckX/+vRqLTr9VTe2H5ThFu1hGJY4Bmd9n9ekhqZPB6MY8jdA4upFldiLLk1caw/p:hnLTne2zFuv4BqpwzPGoxupmLicBpjT
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\E004.exe
- Size 1.1MB
- SHA256 0b9ea2a28774249fce63e4d2008f53bb2258d228460e1456a4d03eb9c36c4d6a
- MD5 8d4492a7f9c345bb23e7dc53fc7a1c18
- SHA1 81383641584d8450cdff396826b7ec176a600320
- SHA512 6ae097f092b7bcdbfdbd05f2c1a3bfe04a0384c03deed745a485be57759ee73f8f279b411917b93d899fc230de3298bee634aa9cb3ee69e99956af423c00a5de
- SSDEEP 24576:0fMYAQ6csJ8aktHaqyuclglBOwNjw8YcFwPKoUYL:0F699kt6qCGJNpYcFwPKop
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\E004.exe
- Size 1.1MB
- SHA256 0b9ea2a28774249fce63e4d2008f53bb2258d228460e1456a4d03eb9c36c4d6a
- MD5 8d4492a7f9c345bb23e7dc53fc7a1c18
- SHA1 81383641584d8450cdff396826b7ec176a600320
- SHA512 6ae097f092b7bcdbfdbd05f2c1a3bfe04a0384c03deed745a485be57759ee73f8f279b411917b93d899fc230de3298bee634aa9cb3ee69e99956af423c00a5de
- SSDEEP 24576:0fMYAQ6csJ8aktHaqyuclglBOwNjw8YcFwPKoUYL:0F699kt6qCGJNpYcFwPKop
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\Pyupydeoe.tmp
- Size 784KB
- SHA256 20dc61c5456ea5756f432aebecf74660acebf5ace0f7c8d1b360757ed79075d8
- MD5 c50c2f17112b6c6b0892cb2c1f502108
- SHA1 3dd1444384bf790f5aa90ae95ef7745fa4cfaf72
- SHA512 bfbfc3a13816a12e25c373f6739215b9dff559fecfdf26c3358a452bdc833b6eaa64bbae316f4b29b9e9ce802e9f50c66b533c8c3c1b372025a7f0b7d8b452f1
- SSDEEP 24576:l8Jr+SgWH5UB/VdYQ/N7WqpWaQxYZYBsFn:OJrSBYqLY
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\Pyupydeoe.tmp
- Size 784KB
- SHA256 20dc61c5456ea5756f432aebecf74660acebf5ace0f7c8d1b360757ed79075d8
- MD5 c50c2f17112b6c6b0892cb2c1f502108
- SHA1 3dd1444384bf790f5aa90ae95ef7745fa4cfaf72
- SHA512 bfbfc3a13816a12e25c373f6739215b9dff559fecfdf26c3358a452bdc833b6eaa64bbae316f4b29b9e9ce802e9f50c66b533c8c3c1b372025a7f0b7d8b452f1
- SSDEEP 24576:l8Jr+SgWH5UB/VdYQ/N7WqpWaQxYZYBsFn:OJrSBYqLY
- MD5 SHA1 SHA512 SSDEEP
- Path \??\c:\program files (x86)\windowspowershell\modules\pdfprevhndlr.dll
- Size 704KB
- SHA256 3a78a7f504e6554de5c6c5123892c782119054f0f7809baf440d60f7bbd35f5b
- MD5 cdcd36f24b64643748a51adc3eeb16ad
- SHA1 b0279463f845fda41c5a690906af2133403d0296
- SHA512 e3ff176ae7422cd237583b5aab7501e6cf0d12fd884528f0831d3621f59fd090bcd71d4171787efb1aaf19fb99b1567d03a77ccac10eeb786d94e319c30ff3c3
- SSDEEP 12288:6rYq6rVISg4e4mGt35UB/VdYZmz7N9K4PWqpWvCZ+MOYqYy15nQym:68Jr+SgWH5UB/VdYQ/N7WqpWaQxYZYBg
- MD5 SHA1 SHA512 SSDEEP