Analysis
- max time kernel
145s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system - submitted
08/01/2023, 07:22
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20220901-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
27 signatures
150 seconds
General
- Target file.exe
- Size 264KB
- Sample230108-h683gsda52
- SHA256 4381432a0b7b1cd7d90206fecbf8c543ebcb23746ea13c23eb8433894bce8217
- MD5 083f46b85199f799c041f5aad914e960
- SHA1 304ef35ae2cad3149c8254f70138e312082110bb
- SHA512 e64ca93362d1f0b297b0292c474fd804747158a948636492951965de26ca2e152e1c5a7578cc7fd16cbc8a29d610e7da1e26ccb74923a814b0a75aaf2e2f559d
- SSDEEP 3072:bXhfCSoL4BnrOez3Aj52syLdiMvsHidP4aZclA8aZdiq0B73pxOo5NThUUZNTKXX:z8L4Bqez3AnyLdxvBfZcH2i335ZOuN
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detects Smokeloader packer 1 IoCs
resource yara_rule behavioral2/memory/2424-133-0x00000000048E0000-0x00000000048E9000-memory.dmp family_smokeloader - SmokeLoader
Modular backdoor trojan in use since 2014.
- Blocklisted process makes network request 3 IoCs
flow pid Process 80 3644 rundll32.exe 88 3644 rundll32.exe 111 3644 rundll32.exe - Downloads MZ/PE file
- Executes dropped EXE 1 IoCs
pid Process 3828 D66F.exe - Loads dropped DLL 1 IoCs
pid Process 3644 rundll32.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts rundll32.exe - Accesses Microsoft Outlook profiles 1 TTPs 4 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook rundll32.exe Key opened \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 rundll32.exe Key opened \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 rundll32.exe Key opened \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 rundll32.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3644 set thread context of 4172 3644 rundll32.exe 92 - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Program crash 1 IoCs
pid pid_target Process procid_target 3656 3828 WerFault.exe 86 - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe - Checks processor information in registry 2 TTPs 26 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Revision rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 rundll32.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Identifier rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Platform Specific Field 1 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Configuration Data rundll32.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\FeatureSet rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Status rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Previous Update Revision rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Status rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Previous Update Revision rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor rundll32.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString rundll32.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Toolbar Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1" Process not Found Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 Process not Found - Modifies registry class 30 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\MRUListEx = ffffffff Process not Found Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic" Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f44471a0359723fa74489c55595fe6b30ee0000 Process not Found Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots Process not Found Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU rundll32.exe Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\NodeSlot = "1" Process not Found Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell rundll32.exe Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 = 4e003100000000002856d742100054656d7000003a0009000400efbe0c5519992856db422e0000000000000000000000000000000000000000000000000027e30d01540065006d007000000014000000 Process not Found Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\WorkFolders Process not Found Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff rundll32.exe Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 820074001c0043465346160031000000000000000000100041707044617461000000741a595e96dfd3488d671733bcee28bac5cdfadf9f6756418947c5c76bc0b67f400009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004100700070004400610074006100000042000000 Process not Found Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1 Process not Found Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ Process not Found Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 Process not Found Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = 00000000ffffffff Process not Found Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots rundll32.exe Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 50003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014000000 Process not Found Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell Process not Found Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings rundll32.exe - Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2724 Process not Found - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2424 file.exe 2424 file.exe 2724 Process not Found 2724 Process not Found 2724 Process not Found 2724 Process not Found 2724 Process not Found 2724 Process not Found 2724 Process not Found 2724 Process not Found 2724 Process not Found 2724 Process not Found 2724 Process not Found 2724 Process not Found 2724 Process not Found 2724 Process not Found 2724 Process not Found 2724 Process not Found 2724 Process not Found 2724 Process not Found 2724 Process not Found 2724 Process not Found 2724 Process not Found 2724 Process not Found 2724 Process not Found 2724 Process not Found 2724 Process not Found 2724 Process not Found 2724 Process not Found 2724 Process not Found 2724 Process not Found 2724 Process not Found 2724 Process not Found 2724 Process not Found 2724 Process not Found 2724 Process not Found 2724 Process not Found 2724 Process not Found 2724 Process not Found 2724 Process not Found 2724 Process not Found 2724 Process not Found 2724 Process not Found 2724 Process not Found 2724 Process not Found 2724 Process not Found 2724 Process not Found 2724 Process not Found 2724 Process not Found 2724 Process not Found 2724 Process not Found 2724 Process not Found 2724 Process not Found 2724 Process not Found 2724 Process not Found 2724 Process not Found 2724 Process not Found 2724 Process not Found 2724 Process not Found 2724 Process not Found 2724 Process not Found 2724 Process not Found 2724 Process not Found 2724 Process not Found - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2724 Process not Found - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 2424 file.exe - Suspicious use of AdjustPrivilegeToken 23 IoCs
description pid Process Token: SeShutdownPrivilege 2724 Process not Found Token: SeCreatePagefilePrivilege 2724 Process not Found Token: SeDebugPrivilege 3644 rundll32.exe Token: SeShutdownPrivilege 2724 Process not Found Token: SeCreatePagefilePrivilege 2724 Process not Found Token: SeShutdownPrivilege 2724 Process not Found Token: SeCreatePagefilePrivilege 2724 Process not Found Token: SeShutdownPrivilege 2724 Process not Found Token: SeCreatePagefilePrivilege 2724 Process not Found Token: SeShutdownPrivilege 2724 Process not Found Token: SeCreatePagefilePrivilege 2724 Process not Found Token: SeShutdownPrivilege 2724 Process not Found Token: SeCreatePagefilePrivilege 2724 Process not Found Token: SeShutdownPrivilege 2724 Process not Found Token: SeCreatePagefilePrivilege 2724 Process not Found Token: SeShutdownPrivilege 2724 Process not Found Token: SeCreatePagefilePrivilege 2724 Process not Found Token: SeShutdownPrivilege 2724 Process not Found Token: SeCreatePagefilePrivilege 2724 Process not Found Token: SeShutdownPrivilege 2724 Process not Found Token: SeCreatePagefilePrivilege 2724 Process not Found Token: SeShutdownPrivilege 2724 Process not Found Token: SeCreatePagefilePrivilege 2724 Process not Found - Suspicious use of FindShellTrayWindow 10 IoCs
pid Process 4172 rundll32.exe 2724 Process not Found 2724 Process not Found 2724 Process not Found 2724 Process not Found 3644 rundll32.exe 2724 Process not Found 2724 Process not Found 2724 Process not Found 2724 Process not Found - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2724 Process not Found 2724 Process not Found - Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 2724 wrote to memory of 3828 2724 Process not Found 86 PID 2724 wrote to memory of 3828 2724 Process not Found 86 PID 2724 wrote to memory of 3828 2724 Process not Found 86 PID 3828 wrote to memory of 3644 3828 D66F.exe 87 PID 3828 wrote to memory of 3644 3828 D66F.exe 87 PID 3828 wrote to memory of 3644 3828 D66F.exe 87 PID 3644 wrote to memory of 4172 3644 rundll32.exe 92 PID 3644 wrote to memory of 4172 3644 rundll32.exe 92 PID 3644 wrote to memory of 4172 3644 rundll32.exe 92 PID 3644 wrote to memory of 4524 3644 rundll32.exe 93 PID 3644 wrote to memory of 4524 3644 rundll32.exe 93 PID 3644 wrote to memory of 4524 3644 rundll32.exe 93 PID 3644 wrote to memory of 3844 3644 rundll32.exe 95 PID 3644 wrote to memory of 3844 3644 rundll32.exe 95 PID 3644 wrote to memory of 3844 3644 rundll32.exe 95 - outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 rundll32.exe - outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 rundll32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2424
-
C:\Users\Admin\AppData\Local\Temp\D66F.exeC:\Users\Admin\AppData\Local\Temp\D66F.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3828 -
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Users\Admin\AppData\Local\Temp\Wtfoiq.tmp",Iyidwoiowsw2⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Accesses Microsoft Outlook accounts
- Accesses Microsoft Outlook profiles
- Suspicious use of SetThreadContext
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
PID:3644 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61 156053⤵
- Modifies registry class
- Suspicious use of FindShellTrayWindow
PID:4172
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /End /tn \Microsoft\Windows\Wininet\CacheTask3⤵PID:4524
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Run /tn \Microsoft\Windows\Wininet\CacheTask3⤵PID:3844
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /End /tn \Microsoft\Windows\Wininet\CacheTask3⤵PID:1716
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3828 -s 4682⤵
- Program crash
PID:3656
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 3828 -ip 38281⤵PID:3632
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:4084
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k LocalService1⤵PID:1804
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\system32\rundll32.exe" "c:\program files (x86)\windowspowershell\modules\spelling.dll",VkYQZEQx2⤵PID:2028
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\WindowsPowerShell\Modules\Spelling.dll
- Size 714KB
- SHA256 aa3c3c4f2552f7a17eacb967fd758b1b9bbccb443f6c8024c3778794f9d6fdf6
- MD5 474f16e5d4160b579003e752d1f6faa6
- SHA1 bb77ca6059379523b32de510ccbff03abde82030
- SHA512 9770e79acafaf32b787335bef3a1a041cbf8441411def05d9ce8b9da6de52603e0926806e101525792ebe1d56c1f38b282e67cf86a5f103dca4da84e16b44997
- SSDEEP 12288:G8jfuQWjK3lYRk52K/iAkyshv2zjTywBZmAUYiUy+Cz1yVBMjiItbNFNIJOI/rFu:G8DWK3l4kkEPjfywBLTvFFMjiItbNrdr
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\WindowsPowerShell\Modules\Spelling.dll
- Size 714KB
- SHA256 aa3c3c4f2552f7a17eacb967fd758b1b9bbccb443f6c8024c3778794f9d6fdf6
- MD5 474f16e5d4160b579003e752d1f6faa6
- SHA1 bb77ca6059379523b32de510ccbff03abde82030
- SHA512 9770e79acafaf32b787335bef3a1a041cbf8441411def05d9ce8b9da6de52603e0926806e101525792ebe1d56c1f38b282e67cf86a5f103dca4da84e16b44997
- SSDEEP 12288:G8jfuQWjK3lYRk52K/iAkyshv2zjTywBZmAUYiUy+Cz1yVBMjiItbNFNIJOI/rFu:G8DWK3l4kkEPjfywBLTvFFMjiItbNrdr
- MD5 SHA1 SHA512 SSDEEP
- Path C:\ProgramData\{B7E8E476-349D-60AA-651B-798B40E3CAEC}\E2A4F912-2574-4A75-9BB0-0D023378592B_10.0.19041.1023_neutral_neutral_cw5n1h2txyewy.xml
- Size 2KB
- SHA256 c8c2ac11232a448dd5d78c34752f56b8f5b8e18fe79b3176fdd88759d5b703d5
- MD5 1f8001c5a3ab09524c8185d2657e471c
- SHA1 2297cd6ba695d3fa72f2a70a7db95f2e241116ab
- SHA512 d038b9b97a96b267684ba1a7d2458ddf63d3fd3ea8c58a213b5085196da9c7001fe1dbadfc75d2364befc09c9618c133b331ed487fcb043b6a923f3951be0b37
- MD5 SHA1 SHA512
- Path C:\ProgramData\{B7E8E476-349D-60AA-651B-798B40E3CAEC}\Microsoft.BingWeather_4.25.20211.0_neutral_split.scale-100_8wekyb3d8bbwe.xml
- Size 849B
- SHA256 0b9ef96887d1143ced0048b15f5437eaf878c932dd89a05794a742ce8f905fe6
- MD5 bd5949f7138558f33eeadec17d3605a1
- SHA1 7089296812fd9348b62936a6eea5928809f26d63
- SHA512 6be4a51529e882a8f6c3001a8598ce41d00f401bc53ec3e38b1122cf2e61076ef3a780c077f672faae774078a4dc68e6481f1ad660342d2836dde9b38c6752d8
- MD5 SHA1 SHA512
- Path C:\ProgramData\{B7E8E476-349D-60AA-651B-798B40E3CAEC}\Microsoft.MicrosoftStickyNotes_3.6.73.0_neutral_split.scale-125_8wekyb3d8bbwe.xml
- Size 827B
- SHA256 ffc4b3afeec6909f2b6e167d903c624448bb8b5e3540142a0a762953dc758c85
- MD5 ded8a0ae2ade3e3cab8bfbfea00b969f
- SHA1 73752c78795a78ef3b742ad41737959e6f51ee42
- SHA512 3c687dd555e18bfc59bc544bcaae9f27d7eae55aae62c8f6517e263052f72d1679b097cc02faa6514a3a03619b23910ba78af3b3955cf3fe79d2c1f7e8aca72a
- MD5 SHA1 SHA512
- Path C:\ProgramData\{B7E8E476-349D-60AA-651B-798B40E3CAEC}\MicrosoftOffice2016Win32.xml
- Size 64KB
- SHA256 bc964a0306fbeca377d20bafd127425c0700ee293a2c5caf9b28285f1b1d75e5
- MD5 fb54ecf5bbc8554d4218fce2b5863f04
- SHA1 5a43e92271d69b66f97c12d977c10bc78991f76f
- SHA512 c13e3d7c8801b9a865952708af0fe4272e2034be0ebc40e94f4bdccd13b3075ef8d2b5ec8af68d51fe11d87ce84183275d031390aa00e6cefd02407a03436a40
- SSDEEP 768:2Xm4YPEwb02Q1KzM9SEMu+4BpREtUy70Ak4LF3Hw:QRYPEwHQ1YMkEMu5BaTxLFA
- MD5 SHA1 SHA512 SSDEEP
- Path C:\ProgramData\{B7E8E476-349D-60AA-651B-798B40E3CAEC}\Rwdfud.tmp
- Size 3.5MB
- SHA256 a6adeb87a7382261b33f7862faac0cb6e8fd137daacc4f2584fd9b27818baee2
- MD5 9964491ced0562cef271afed05329992
- SHA1 23f600ccea78078ba714fe4e482c9530eb2a8b47
- SHA512 ee73e946c62f529875e819de189a8fef3f2f1f89a6b79a2cfc900860bed5d868510649e5443e76ff2c033bbda351a23af06a888f3eddb607a70b3d5b6a48fa11
- SSDEEP 49152:vRtnfJ3ux/CmGfE2gbb7JSJ497G44iPFeqlwz9Tf2KtS2WBoyzcDeH/01rY+Y9AK:vTfJ3ux/HTn7UipXeF9T5WqyI20RYrnP
- MD5 SHA1 SHA512 SSDEEP
- Path C:\ProgramData\{B7E8E476-349D-60AA-651B-798B40E3CAEC}\background.png
- Size 126KB
- SHA256 d3e8d47e8c1622ec10adef672ca7a8992748c4f0a4e75f877462e7e661069698
- MD5 9adaf3a844ce0ce36bfed07fa2d7ef66
- SHA1 3a804355d5062a6d2ed9653d66e9e4aebaf90bc0
- SHA512 e6988737153a0996b14e6baa45e8010ff46714fe7679d05a2676cc18e1c653e99227e7507cdae4f2b6a99b3c31478630e7e1ae13d0f7c12525406d8cf9867ca5
- SSDEEP 3072:fyUCC0XrT/ltzUKWzzsnQjjEWHUZ/HIO5tg9MlHuPPDF:fdoT/ltIXnsnQjjE4I/HIOrtOP7F
- MD5 SHA1 SHA512 SSDEEP
- Path C:\ProgramData\{B7E8E476-349D-60AA-651B-798B40E3CAEC}\edbres00001.jrs
- Size 64KB
- SHA256 de2f256064a0af797747c2b97505dc0b9f3df0de4f489eac731c23ae9ca9cc31
- MD5 fcd6bcb56c1689fcef28b57c22475bad
- SHA1 1adc95bebe9eea8c112d40cd04ab7a8d75c4f961
- SHA512 73e4153936dab198397b74ee9efc26093dda721eaab2f8d92786891153b45b04265a161b169c988edb0db2c53124607b6eaaa816559c5ce54f3dbc9fa6a7a4b2
- SSDEEP 3::
- MD5 SHA1 SHA512 SSDEEP
- Path C:\ProgramData\{B7E8E476-349D-60AA-651B-798B40E3CAEC}\edbtmp.log
- Size 64KB
- SHA256 fc4893227a67c20d08a4e6b88ea87a909dbe011c9c82298548d2f25054da23b3
- MD5 e8df291f8666c604c10200a09d3419d6
- SHA1 591f33c8f38ae7b44810cd5b7ded6e8b7f190789
- SHA512 e5495c6c2c0a3f2df45b764450e215d97eee902fabab88623ba589bab1c9a8e58ede031bdb1222a5bcc3600ecda1bdea4c6c4e8a8cd9e59396c6a92e3ccd868c
- SSDEEP 768:D23xvR1drEBmHl4aDopGw4WESdo3tC+0CK3p8+N8+:D23VR1drEBmHlTDulSSdQC+0CKh9
- MD5 SHA1 SHA512 SSDEEP
- Path C:\ProgramData\{B7E8E476-349D-60AA-651B-798B40E3CAEC}\guest.png
- Size 5KB
- SHA256 98817a572430813ca4ca2787dab20573f7864c5168ac6912f34d14b49e7bd7c9
- MD5 d7ee4543371744836d520e0ce24a9ee6
- SHA1 a6cda6aac3e480b269b9da2bd616bdb4d6fa87f0
- SHA512 e15b6a50d9d498918a81488bf8d60860027f9a38f4d87e239f1c6e9d20fe4938e75861dad35c69e4087370c18b2cd5b482ab6ca694dfe205d053f1d303d17808
- SSDEEP 96:WjhppppppppppppYgPTcHPzAia33mWn41j35kqbV+xkdqA3T0VczHZMKUz4k7Gcu:Wjhpppppppppppp1PoHc33hn4rbV1dqA
- MD5 SHA1 SHA512 SSDEEP
- Path C:\ProgramData\{B7E8E476-349D-60AA-651B-798B40E3CAEC}\settings.ico
- Size 66KB
- SHA256 1160a3a774b52f07453bde44755fbf76a8b1534c5ade19402f05857c249056b3
- MD5 4896c2ad8ca851419425b06ec0fd95f2
- SHA1 7d52e9355998f1b4487f8ef2b1b3785dec35d981
- SHA512 271f40a273bc98738d450a8585cc84d097d88bbb6417fd20b4417d31b4e19b1b8fe860d044f70a3e4096588b9615c8cc588b1cab651ab1b4320d7ce1d74eb8f2
- SSDEEP 768:ydh6plm3G+4b8aA6LaVPX8lblfteJzvdzj2pila/wIl/CyfaaCcykxKa8jzh5G9Y:jplm3j6ulGF8zi5j9CkHd/KBjzh5Cb+X
- MD5 SHA1 SHA512 SSDEEP
- Path C:\ProgramData\{B7E8E476-349D-60AA-651B-798B40E3CAEC}\superbar.png
- Size 38KB
- SHA256 0f35ace5268db33940ed18e946a9c65be4e31ec0ae31faa6e60122859c5cb5ca
- MD5 45b3b7ada6575d1623bd52d029d7cf96
- SHA1 ae4810a660e18d7e40594d1e8e0fe33b46a7f2a4
- SHA512 c7d39db201687940bcbf8e3afb90becf5389640d7948e0cf3518bfae98fda1496650fa59a490631fcad894a9aa0f3d78e4d8b5bb9df57812abbc010c638926a8
- SSDEEP 768:935RFO1NmgxH4WD6bK72pizILEF7P4ieb0MCquyQ6trGJipd9yS/xkXoZiHZmgi3:No1NtJ4WGb/i8LOPLeAJft6trwioowKz
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\D66F.exe
- Size 1.0MB
- SHA256 6c71ea1c2da61692b2f287f38847437398ff38b12fe5a8b26f2307bb27d45002
- MD5 daf95364b48f25a4fe290738942f660c
- SHA1 c8e3a89dc7699cdd1aff45d9784fafa688730441
- SHA512 914de678e5828bfd5643ec4066a853c92c8dde430e02c3c71809a910397de8d958f60c40ef90242cce09f0c06951aba72c589f841ddf084e5facecfae88a09af
- SSDEEP 24576:Q2zSAYyEQAA3fifQgD6/cYP3jC7RcgTcyxAUiZJ:Q2GYEPX6EmOVcgAyZiX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\D66F.exe
- Size 1.0MB
- SHA256 6c71ea1c2da61692b2f287f38847437398ff38b12fe5a8b26f2307bb27d45002
- MD5 daf95364b48f25a4fe290738942f660c
- SHA1 c8e3a89dc7699cdd1aff45d9784fafa688730441
- SHA512 914de678e5828bfd5643ec4066a853c92c8dde430e02c3c71809a910397de8d958f60c40ef90242cce09f0c06951aba72c589f841ddf084e5facecfae88a09af
- SSDEEP 24576:Q2zSAYyEQAA3fifQgD6/cYP3jC7RcgTcyxAUiZJ:Q2GYEPX6EmOVcgAyZiX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\Wtfoiq.tmp
- Size 714KB
- SHA256 d0ac0e9021c6e231c60256198309b7f72ce4c5e772cf343b5456c2ce0664b9bd
- MD5 9dd70d24b2657a9254b9fd536a4d06d5
- SHA1 348a1d210d7c4daef8ecdb692eadf3975971e8ee
- SHA512 dee5bfe83fdf196c78ee255e50a25994220ce9ecac22eb24323df70e668714d7a810b67ddace7809d9d7e2160a35c4603deedb64b1660d82dde58586c34d2ab6
- SSDEEP 12288:V8jfuQWjK3lYRk52K/iAkyshv2zjTywBZmAUYiUy+Cz1yVBMjiItbNFNIJOI/rFu:V8DWK3l4kkEPjfywBLTvFFMjiItbNrdr
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\Wtfoiq.tmp
- Size 714KB
- SHA256 d0ac0e9021c6e231c60256198309b7f72ce4c5e772cf343b5456c2ce0664b9bd
- MD5 9dd70d24b2657a9254b9fd536a4d06d5
- SHA1 348a1d210d7c4daef8ecdb692eadf3975971e8ee
- SHA512 dee5bfe83fdf196c78ee255e50a25994220ce9ecac22eb24323df70e668714d7a810b67ddace7809d9d7e2160a35c4603deedb64b1660d82dde58586c34d2ab6
- SSDEEP 12288:V8jfuQWjK3lYRk52K/iAkyshv2zjTywBZmAUYiUy+Cz1yVBMjiItbNFNIJOI/rFu:V8DWK3l4kkEPjfywBLTvFFMjiItbNrdr
- MD5 SHA1 SHA512 SSDEEP
- Path \??\c:\program files (x86)\windowspowershell\modules\spelling.dll
- Size 714KB
- SHA256 aa3c3c4f2552f7a17eacb967fd758b1b9bbccb443f6c8024c3778794f9d6fdf6
- MD5 474f16e5d4160b579003e752d1f6faa6
- SHA1 bb77ca6059379523b32de510ccbff03abde82030
- SHA512 9770e79acafaf32b787335bef3a1a041cbf8441411def05d9ce8b9da6de52603e0926806e101525792ebe1d56c1f38b282e67cf86a5f103dca4da84e16b44997
- SSDEEP 12288:G8jfuQWjK3lYRk52K/iAkyshv2zjTywBZmAUYiUy+Cz1yVBMjiItbNFNIJOI/rFu:G8DWK3l4kkEPjfywBLTvFFMjiItbNrdr
- MD5 SHA1 SHA512 SSDEEP