Analysis
- max time kernel
145s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system - submitted
05/01/2023, 12:28
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20220812-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
29 signatures
150 seconds
General
- Target file.exe
- Size 214KB
- Sample230105-pna63afd61
- SHA256 e975e50bca8e7cfed1b995e93c44873823ef8fdf30fce0b0c980ca4159458ee1
- MD5 e9af36f4885c2635b694bae3cbb2f6f9
- SHA1 aeb31b13de4c99cc8f635bb17c327a6ebb8682c5
- SHA512 ad8d394bdf2c29cc514bf53311bd9f92d07a4ab8bfe6ba581d96a0d45c4ae29fd71138a54b2d6e85afb23bb337810c74dd85fcfa61849364b263bffb52535227
- SSDEEP 3072:WXJaV7U0LKWcJUHV2y5DpQKN5nNSFJmU2h6+0mcTdLXl:+0LKmHV2GXsJIc
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detects Smokeloader packer 1 IoCs
resource yara_rule behavioral2/memory/5076-133-0x0000000004790000-0x0000000004799000-memory.dmp family_smokeloader - SmokeLoader
Modular backdoor trojan in use since 2014.
- Blocklisted process makes network request 3 IoCs
flow pid Process 59 3352 rundll32.exe 62 3352 rundll32.exe 119 3352 rundll32.exe - Downloads MZ/PE file
- Executes dropped EXE 2 IoCs
pid Process 4748 D0E1.exe 3796 affjctc - Loads dropped DLL 1 IoCs
pid Process 3352 rundll32.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts rundll32.exe - Accesses Microsoft Outlook profiles 1 TTPs 4 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 rundll32.exe Key opened \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 rundll32.exe Key opened \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 rundll32.exe Key opened \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook rundll32.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3352 set thread context of 3184 3352 rundll32.exe 92 - Drops file in Program Files directory 23 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ccme_asym.dll rundll32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\ENU\Dynamic.pdf rundll32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\duplicate.svg rundll32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\tl.gif rundll32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\email_all.gif rundll32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\A12_Spinner.gif rundll32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\download.svg rundll32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\Close.png rundll32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\Stamp.aapp rundll32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\PMP\AdobePDF417.pmp rundll32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\BIBUtils.dll rundll32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\ENU\StandardBusiness.pdf rundll32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Acrofx32.dll rundll32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\EPDF_RHP.aapp rundll32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\ENU\license.html rundll32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ccme_ecc.dll rundll32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\cef_100_percent.pak rundll32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\Protect_R_RHP.aapp rundll32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\PMP\QRCode.pmp rundll32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\trash.gif rundll32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\turnOffNotificationInTray.gif rundll32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\comment.svg rundll32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\server_ok.gif rundll32.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Program crash 1 IoCs
pid pid_target Process procid_target 2736 4748 WerFault.exe 87 - Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI affjctc Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI affjctc Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI affjctc - Checks processor information in registry 2 TTPs 23 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Previous Update Revision rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz rundll32.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Previous Update Revision rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Configuration Data rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Identifier rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\VendorIdentifier rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\FeatureSet rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz rundll32.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 rundll32.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Platform Specific Field 1 rundll32.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 Process not Found Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Toolbar Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1" Process not Found - Modifies registry class 30 IoCs
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\MRUListEx = ffffffff Process not Found Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ Process not Found Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic" Process not Found Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 Process not Found Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1 Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 50003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014000000 Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = 00000000ffffffff Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff Process not Found Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 Process not Found Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\NodeSlot = "1" Process not Found Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags Process not Found Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell rundll32.exe Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 = 4e003100000000002556966b100054656d7000003a0009000400efbe0c55199925569a6b2e0000000000000000000000000000000000000000000000000044912d01540065006d007000000014000000 Process not Found Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings rundll32.exe Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 Process not Found Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell Process not Found Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU rundll32.exe Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 820074001c0043465346160031000000000000000000100041707044617461000000741a595e96dfd3488d671733bcee28bac5cdfadf9f6756418947c5c76bc0b67f400009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004100700070004400610074006100000042000000 Process not Found Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\WorkFolders Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f44471a0359723fa74489c55595fe6b30ee0000 Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff Process not Found - Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 1084 Process not Found - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5076 file.exe 5076 file.exe 1084 Process not Found 1084 Process not Found 1084 Process not Found 1084 Process not Found 1084 Process not Found 1084 Process not Found 1084 Process not Found 1084 Process not Found 1084 Process not Found 1084 Process not Found 1084 Process not Found 1084 Process not Found 1084 Process not Found 1084 Process not Found 1084 Process not Found 1084 Process not Found 1084 Process not Found 1084 Process not Found 1084 Process not Found 1084 Process not Found 1084 Process not Found 1084 Process not Found 1084 Process not Found 1084 Process not Found 1084 Process not Found 1084 Process not Found 1084 Process not Found 1084 Process not Found 1084 Process not Found 1084 Process not Found 1084 Process not Found 1084 Process not Found 1084 Process not Found 1084 Process not Found 1084 Process not Found 1084 Process not Found 1084 Process not Found 1084 Process not Found 1084 Process not Found 1084 Process not Found 1084 Process not Found 1084 Process not Found 1084 Process not Found 1084 Process not Found 1084 Process not Found 1084 Process not Found 1084 Process not Found 1084 Process not Found 1084 Process not Found 1084 Process not Found 1084 Process not Found 1084 Process not Found 1084 Process not Found 1084 Process not Found 1084 Process not Found 1084 Process not Found 1084 Process not Found 1084 Process not Found 1084 Process not Found 1084 Process not Found 1084 Process not Found 1084 Process not Found - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1084 Process not Found - Suspicious behavior: MapViewOfSection 2 IoCs
pid Process 5076 file.exe 3796 affjctc - Suspicious use of AdjustPrivilegeToken 19 IoCs
description pid Process Token: SeShutdownPrivilege 1084 Process not Found Token: SeCreatePagefilePrivilege 1084 Process not Found Token: SeDebugPrivilege 3352 rundll32.exe Token: SeShutdownPrivilege 1084 Process not Found Token: SeCreatePagefilePrivilege 1084 Process not Found Token: SeShutdownPrivilege 1084 Process not Found Token: SeCreatePagefilePrivilege 1084 Process not Found Token: SeShutdownPrivilege 1084 Process not Found Token: SeCreatePagefilePrivilege 1084 Process not Found Token: SeShutdownPrivilege 1084 Process not Found Token: SeCreatePagefilePrivilege 1084 Process not Found Token: SeShutdownPrivilege 1084 Process not Found Token: SeCreatePagefilePrivilege 1084 Process not Found Token: SeShutdownPrivilege 1084 Process not Found Token: SeCreatePagefilePrivilege 1084 Process not Found Token: SeShutdownPrivilege 1084 Process not Found Token: SeCreatePagefilePrivilege 1084 Process not Found Token: SeShutdownPrivilege 1084 Process not Found Token: SeCreatePagefilePrivilege 1084 Process not Found - Suspicious use of FindShellTrayWindow 10 IoCs
pid Process 1084 Process not Found 1084 Process not Found 1084 Process not Found 1084 Process not Found 1084 Process not Found 1084 Process not Found 1084 Process not Found 1084 Process not Found 3352 rundll32.exe 3184 rundll32.exe - Suspicious use of SendNotifyMessage 1 IoCs
pid Process 1084 Process not Found - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1084 Process not Found 1084 Process not Found - Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 1084 wrote to memory of 4748 1084 Process not Found 87 PID 1084 wrote to memory of 4748 1084 Process not Found 87 PID 1084 wrote to memory of 4748 1084 Process not Found 87 PID 4748 wrote to memory of 3352 4748 D0E1.exe 88 PID 4748 wrote to memory of 3352 4748 D0E1.exe 88 PID 4748 wrote to memory of 3352 4748 D0E1.exe 88 PID 3352 wrote to memory of 3184 3352 rundll32.exe 92 PID 3352 wrote to memory of 3184 3352 rundll32.exe 92 PID 3352 wrote to memory of 3184 3352 rundll32.exe 92 PID 3352 wrote to memory of 3416 3352 rundll32.exe 93 PID 3352 wrote to memory of 3416 3352 rundll32.exe 93 PID 3352 wrote to memory of 3416 3352 rundll32.exe 93 PID 3352 wrote to memory of 2984 3352 rundll32.exe 96 PID 3352 wrote to memory of 2984 3352 rundll32.exe 96 PID 3352 wrote to memory of 2984 3352 rundll32.exe 96 - outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 rundll32.exe - outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 rundll32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:5076
-
C:\Users\Admin\AppData\Local\Temp\D0E1.exeC:\Users\Admin\AppData\Local\Temp\D0E1.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4748 -
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Users\Admin\AppData\Local\Temp\Pyupydeoe.tmp",Uprsprhaot2⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Accesses Microsoft Outlook accounts
- Accesses Microsoft Outlook profiles
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
PID:3352 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61 239893⤵
- Modifies registry class
- Suspicious use of FindShellTrayWindow
PID:3184
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /End /tn \Microsoft\Windows\Wininet\CacheTask3⤵PID:3416
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Run /tn \Microsoft\Windows\Wininet\CacheTask3⤵PID:2984
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /End /tn \Microsoft\Windows\Wininet\CacheTask3⤵PID:2380
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4748 -s 5202⤵
- Program crash
PID:2736
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4748 -ip 47481⤵PID:740
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:4116
-
C:\Users\Admin\AppData\Roaming\affjctcC:\Users\Admin\AppData\Roaming\affjctc1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:3796
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k LocalService1⤵PID:4448
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\WindowsPowerShell\Modules\review_shared.dll
- Size 784KB
- SHA256 b3e9e1d3a78a377ca2f4fd78f14c86e78c1376333f1b63bd5633ee9174527e07
- MD5 1b23b46cef0643a8b78de4394b426709
- SHA1 f7af7c973f1b784c4b7653e2a79ed4b92662bbf0
- SHA512 8e3d5546f218643da2975bb152ceaadd1b16ed6496c66c99b23b9e74f1db1329cca23345ee7024db9f218de51c08962126298b03932b3bf84c3e82bed39c03c2
- SSDEEP 24576:C8Jr+SgWH5UB/VdYQ/N7WqpWaQxYZYBsFn:dJrSBYqLY
- MD5 SHA1 SHA512 SSDEEP
- Path C:\ProgramData\{E6FB8490-097E-1893-E5D7-72BBB5B030D6}\Oreqhqoupyrw.tmp
- Size 3.5MB
- SHA256 46126e3cbbce7ead1a4ab48edf7a0d8cdb7fbed4a72269b6b0d5b854f4b85b56
- MD5 6b882cd8ed3be0f3402bae7516e826e3
- SHA1 0ba6287b2779bf5c90adee50aa0448fef4a2876e
- SHA512 25fba75c098a50da1b9b8cb7cfa6037a83a7f661b4b8c5c5eacfc1707a94ba86516ac0827f1c0c45d57567f8f5a672cf6c9a876493a4150dd349e6a2d59c4d75
- SSDEEP 98304:6k+jMy5cDDKB933r/oXqKBbPJFbR/siRsfag052W/FFYE:F+YUeDKBhoX5FNsyAaTMuUE
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\D0E1.exe
- Size 1015KB
- SHA256 ef0655351e9f8c17c51c04d64c362441f2091bfe1c2ec75fa69533c2725abe2d
- MD5 66d5ac1c479a9745c0c9d427a42f91a4
- SHA1 a642f4fe7ce908df8134318d49945da1d52627d2
- SHA512 3ceac1d7453b378d560c33da94520f4d3a12de6535e6ce9e36128bd5709deaab9c40a1ea25dcea78e1111e4cc629f939709750c417e8348c82acb70a4d428e84
- SSDEEP 12288:VYnqll8e4kiHO7hEdbxFGnl3h7ydcS2eVqhyWtIUzTVkqyLx1evVjswe5eh4GLzo:VJn8ergO7hsb34h73eVszA4VJlLz/c
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\D0E1.exe
- Size 1015KB
- SHA256 ef0655351e9f8c17c51c04d64c362441f2091bfe1c2ec75fa69533c2725abe2d
- MD5 66d5ac1c479a9745c0c9d427a42f91a4
- SHA1 a642f4fe7ce908df8134318d49945da1d52627d2
- SHA512 3ceac1d7453b378d560c33da94520f4d3a12de6535e6ce9e36128bd5709deaab9c40a1ea25dcea78e1111e4cc629f939709750c417e8348c82acb70a4d428e84
- SSDEEP 12288:VYnqll8e4kiHO7hEdbxFGnl3h7ydcS2eVqhyWtIUzTVkqyLx1evVjswe5eh4GLzo:VJn8ergO7hsb34h73eVszA4VJlLz/c
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\Pyupydeoe.tmp
- Size 784KB
- SHA256 20dc61c5456ea5756f432aebecf74660acebf5ace0f7c8d1b360757ed79075d8
- MD5 c50c2f17112b6c6b0892cb2c1f502108
- SHA1 3dd1444384bf790f5aa90ae95ef7745fa4cfaf72
- SHA512 bfbfc3a13816a12e25c373f6739215b9dff559fecfdf26c3358a452bdc833b6eaa64bbae316f4b29b9e9ce802e9f50c66b533c8c3c1b372025a7f0b7d8b452f1
- SSDEEP 24576:l8Jr+SgWH5UB/VdYQ/N7WqpWaQxYZYBsFn:OJrSBYqLY
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\Pyupydeoe.tmp
- Size 784KB
- SHA256 20dc61c5456ea5756f432aebecf74660acebf5ace0f7c8d1b360757ed79075d8
- MD5 c50c2f17112b6c6b0892cb2c1f502108
- SHA1 3dd1444384bf790f5aa90ae95ef7745fa4cfaf72
- SHA512 bfbfc3a13816a12e25c373f6739215b9dff559fecfdf26c3358a452bdc833b6eaa64bbae316f4b29b9e9ce802e9f50c66b533c8c3c1b372025a7f0b7d8b452f1
- SSDEEP 24576:l8Jr+SgWH5UB/VdYQ/N7WqpWaQxYZYBsFn:OJrSBYqLY
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\affjctc
- Size 214KB
- SHA256 e975e50bca8e7cfed1b995e93c44873823ef8fdf30fce0b0c980ca4159458ee1
- MD5 e9af36f4885c2635b694bae3cbb2f6f9
- SHA1 aeb31b13de4c99cc8f635bb17c327a6ebb8682c5
- SHA512 ad8d394bdf2c29cc514bf53311bd9f92d07a4ab8bfe6ba581d96a0d45c4ae29fd71138a54b2d6e85afb23bb337810c74dd85fcfa61849364b263bffb52535227
- SSDEEP 3072:WXJaV7U0LKWcJUHV2y5DpQKN5nNSFJmU2h6+0mcTdLXl:+0LKmHV2GXsJIc
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\affjctc
- Size 214KB
- SHA256 e975e50bca8e7cfed1b995e93c44873823ef8fdf30fce0b0c980ca4159458ee1
- MD5 e9af36f4885c2635b694bae3cbb2f6f9
- SHA1 aeb31b13de4c99cc8f635bb17c327a6ebb8682c5
- SHA512 ad8d394bdf2c29cc514bf53311bd9f92d07a4ab8bfe6ba581d96a0d45c4ae29fd71138a54b2d6e85afb23bb337810c74dd85fcfa61849364b263bffb52535227
- SSDEEP 3072:WXJaV7U0LKWcJUHV2y5DpQKN5nNSFJmU2h6+0mcTdLXl:+0LKmHV2GXsJIc
- MD5 SHA1 SHA512 SSDEEP
- Path \??\c:\program files (x86)\windowspowershell\modules\review_shared.dll
- Size 784KB
- SHA256 b3e9e1d3a78a377ca2f4fd78f14c86e78c1376333f1b63bd5633ee9174527e07
- MD5 1b23b46cef0643a8b78de4394b426709
- SHA1 f7af7c973f1b784c4b7653e2a79ed4b92662bbf0
- SHA512 8e3d5546f218643da2975bb152ceaadd1b16ed6496c66c99b23b9e74f1db1329cca23345ee7024db9f218de51c08962126298b03932b3bf84c3e82bed39c03c2
- SSDEEP 24576:C8Jr+SgWH5UB/VdYQ/N7WqpWaQxYZYBsFn:dJrSBYqLY
- MD5 SHA1 SHA512 SSDEEP