799e1908d6d147e10b31d1e8d662fe3158d65738a218bd3b0105af1b455d256c

Analysis

max time kernel
150s
max time network
142s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
13/01/2023, 17:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4e9b005252de59cacab5996c9e138f69.exe
Size 1.1MB
Sample230113-whe2dsfa5y
SHA256 799e1908d6d147e10b31d1e8d662fe3158d65738a218bd3b0105af1b455d256c
MD5 4e9b005252de59cacab5996c9e138f69
SHA1 647d8244d351a329213d0c4fd032f2260c95693e
SHA512 0594042d656ae76b13cda7d64b60b50338b2a6e1eb7b55fa02fb66a61b18a6aa09404e3fa9d9d3edb3cba2257dc4c1ed245baf66d5cabba50c2636d8b8fda5b4
SSDEEP 24576:V/mMSK5ZvvucuwBS9OvPxE0zIxMBmwcboDs17dZ91:VTSK5Z3rPwx0mwe1z
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

collection discovery persistence spyware stealer

Malware Config

Signatures

Blocklisted process makes network request 4 IoCs

flow	pid	Process
2	1988	rundll32.exe
5	1988	rundll32.exe
9	1988	rundll32.exe
11	1988	rundll32.exe

Sets DLL path for service in the registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\ApplicationInstaller\Parameters\ServiceDll = "C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\ApplicationInstaller.dll"	rundll32.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\ApplicationInstaller\ImagePath = "C:\\Windows\\system32\\svchost.exe -k LocalService"	rundll32.exe

Loads dropped DLL 6 IoCs

pid	Process
1988	rundll32.exe
1068	svchost.exe
672	rundll32.exe
672	rundll32.exe
672	rundll32.exe
672	rundll32.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	rundll32.exe

Accesses Microsoft Outlook profiles 1 TTPs 4 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	rundll32.exe
Key opened	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	rundll32.exe
Key opened	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	rundll32.exe
Key opened	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	rundll32.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Desktop.ini	rundll32.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1988 set thread context of 1884	1988	rundll32.exe	31

Drops file in Program Files directory 12 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\9.0\helpmap.txt	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroBroker.exe	rundll32.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\odffilt.dll	rundll32.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\GREEK.TXT	rundll32.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\ApplicationInstaller.dll	rundll32.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Filters\odffilt.dll	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\GREEK.TXT	rundll32.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\CP1252.TXT	rundll32.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\AcroIEHelper.dll	rundll32.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\CP1252.TXT	rundll32.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\AcroBroker.exe	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 64 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Previous Update Signature	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Signature	svchost.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	rundll32.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Status	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform ID	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Component Information	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Status	rundll32.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data	rundll32.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Previous Update Signature	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\FeatureSet	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Status	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Previous Update Signature	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform ID	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	svchost.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information	svchost.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	rundll32.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Previous Update Signature	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Identifier	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Identifier	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\VendorIdentifier	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	rundll32.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Configuration Data	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\FeatureSet	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	rundll32.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Component Information	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Signature	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Configuration Data	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Status	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Component Information	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Platform ID	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Status	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\FeatureSet	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Signature	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Previous Update Signature	rundll32.exe

Modifies registry class 24 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f44471a0359723fa74489c55595fe6b30ee0000	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 7e0074001c0043465346160031000000000000000000100041707044617461000000741a595e96dfd3488d671733bcee28bac5cdfadf9f6756418947c5c76bc0b67f3c0008000400efbe00000000000000002a000000000000000000000000000000000000000000000000004100700070004400610074006100000042000000	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\NodeSlot = "1"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_Classes\Local Settings	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\MRUListEx = ffffffff	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 4c003100000000000000000010004c6f63616c00380008000400efbe00000000000000002a000000000000000000000000000000000000000000000000004c006f00630061006c00000014000000	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\KnownFolderDerivedFolderType = "{57807898-8C4F-4462-BB63-71042380B109}"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 = 4a0031000000000000000000102054656d700000360008000400efbe00000000000000002a00000000000000000000000000000000000000000000000000540065006d007000000014000000	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = 00000000ffffffff	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	rundll32.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
1988	rundll32.exe
1988	rundll32.exe
1068	svchost.exe
1988	rundll32.exe
1988	rundll32.exe
1068	svchost.exe
1068	svchost.exe
1068	svchost.exe
1068	svchost.exe
1068	svchost.exe
1068	svchost.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1988	rundll32.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
1884	rundll32.exe
1988	rundll32.exe
1988	rundll32.exe

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 1700 wrote to memory of 1988	1700	4e9b005252de59cacab5996c9e138f69.exe	28
PID 1700 wrote to memory of 1988	1700	4e9b005252de59cacab5996c9e138f69.exe	28
PID 1700 wrote to memory of 1988	1700	4e9b005252de59cacab5996c9e138f69.exe	28
PID 1700 wrote to memory of 1988	1700	4e9b005252de59cacab5996c9e138f69.exe	28
PID 1700 wrote to memory of 1988	1700	4e9b005252de59cacab5996c9e138f69.exe	28
PID 1700 wrote to memory of 1988	1700	4e9b005252de59cacab5996c9e138f69.exe	28
PID 1700 wrote to memory of 1988	1700	4e9b005252de59cacab5996c9e138f69.exe	28
PID 1988 wrote to memory of 1884	1988	rundll32.exe	31
PID 1988 wrote to memory of 1884	1988	rundll32.exe	31
PID 1988 wrote to memory of 1884	1988	rundll32.exe	31
PID 1988 wrote to memory of 1884	1988	rundll32.exe	31
PID 1988 wrote to memory of 1884	1988	rundll32.exe	31
PID 1988 wrote to memory of 952	1988	rundll32.exe	33
PID 1988 wrote to memory of 952	1988	rundll32.exe	33
PID 1988 wrote to memory of 952	1988	rundll32.exe	33
PID 1988 wrote to memory of 952	1988	rundll32.exe	33
PID 1988 wrote to memory of 1572	1988	rundll32.exe	35
PID 1988 wrote to memory of 1572	1988	rundll32.exe	35
PID 1988 wrote to memory of 1572	1988	rundll32.exe	35
PID 1988 wrote to memory of 1572	1988	rundll32.exe	35
PID 1068 wrote to memory of 672	1068	svchost.exe	38
PID 1068 wrote to memory of 672	1068	svchost.exe	38
PID 1068 wrote to memory of 672	1068	svchost.exe	38
PID 1068 wrote to memory of 672	1068	svchost.exe	38
PID 1068 wrote to memory of 672	1068	svchost.exe	38
PID 1068 wrote to memory of 672	1068	svchost.exe	38
PID 1068 wrote to memory of 672	1068	svchost.exe	38
PID 1988 wrote to memory of 524	1988	rundll32.exe	40
PID 1988 wrote to memory of 524	1988	rundll32.exe	40
PID 1988 wrote to memory of 524	1988	rundll32.exe	40
PID 1988 wrote to memory of 524	1988	rundll32.exe	40

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	rundll32.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\4e9b005252de59cacab5996c9e138f69.exe
"C:\Users\Admin\AppData\Local\Temp\4e9b005252de59cacab5996c9e138f69.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1700
- C:\Windows\SysWOW64\rundll32.exe
  "C:\Windows\system32\rundll32.exe" "C:\Users\Admin\AppData\Local\Temp\Rruwtqrefy.tmp",Uuhpdwiyer
  2⤵
  - Blocklisted process makes network request
  - Sets DLL path for service in the registry
  - Sets service image path in registry
  - Loads dropped DLL
  - Accesses Microsoft Outlook accounts
  - Accesses Microsoft Outlook profiles
  - Drops desktop.ini file(s)
  - Suspicious use of SetThreadContext
  - Drops file in Program Files directory
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  - outlook_office_path
  - outlook_win_path
  PID:1988
- - C:\Windows\system32\rundll32.exe
    "C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61 17228
    3⤵
    - Modifies registry class
    - Suspicious use of FindShellTrayWindow
    PID:1884
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /End /tn \Microsoft\Windows\Wininet\CacheTask
    3⤵
    PID:952
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /Run /tn \Microsoft\Windows\Wininet\CacheTask
    3⤵
    PID:1572
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /End /tn \Microsoft\Windows\Wininet\CacheTask
    3⤵
    PID:524

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k LocalService
1⤵
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1068
- C:\Windows\SysWOW64\rundll32.exe
  "C:\Windows\system32\rundll32.exe" "c:\program files (x86)\reference assemblies\microsoft\applicationinstaller.dll",YTcq
  2⤵
  - Loads dropped DLL
  - Checks processor information in registry
  PID:672

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CiPT0000.001

Path C:\ProgramData\{D0B46527-7C45-A967-1A4D-5BBD0FF57755}\CiPT0000.001
Size 64KB
SHA256 ff90fd374351fda0564c78232deadb6c7ead13743c96faaffdaccc348a7364dc
MD5 f1e25120fc2cfc90f2bd7be15a8601fe
SHA1 dbddccd08310cbf909fe64596397e3cb83452430
SHA512 526083d41f038780bacd523dfc4b419de5b1617e41c3956f92a45a3342508f17f4840ab1dd3ee335ff1451df25473a2ffcc3811accba8b594d83facdc1087b21
SSDEEP 192:twtN0APpN263PFS6nhOUArNaRj1Kmc6qsRxZxbfDB7sWST:tQ+mT263P06nhtAhaI6q2/xt5
MD5 SHA1 SHA512 SSDEEP

Submit Download

ENVELOPR.DLL.trx_dll

Path C:\ProgramData\{D0B46527-7C45-A967-1A4D-5BBD0FF57755}\ENVELOPR.DLL.trx_dll
Size 13KB
SHA256 0d3c16cbd05a5cd725e44f5053f69bf1901260eee7ae306a376dc87f2b452509
MD5 d9cec19cdbe418dc49759eddf7572a2e
SHA1 96b165af2f03dbd70825997321f4e0fd1d20a6d8
SHA512 dcf6ea16210e723875dea2e6526399a61398c34bc60f35dbc7eed3ae27c7f6a9c3d8ce55dde24bf4105c8298d9f25fddfb511dce5b5add0dd347817e038c6e00
SSDEEP 192:x+WGAOW8Ad0tVWY5pu/lH4QKPnEtObMacxc8hjeyveCf6eu:x+WGAOWNdEVXuqLXci2jpvAH
MD5 SHA1 SHA512 SSDEEP

Submit Download

Help_MKWD_AssetId.H1W

Path C:\ProgramData\{D0B46527-7C45-A967-1A4D-5BBD0FF57755}\Help_MKWD_AssetId.H1W
Size 229KB
SHA256 0dced7fbf5a0aea0663ea433e3fc140e3f8e0e74e122566c607827a522e197de
MD5 89de0635af20f6c3e6cdb9992609dc02
SHA1 8c2a60fab87daec0cd9919c8530dee912bf86c2c
SHA512 fd36c42480024557723d044ad47d7cdceead7bf96af52457701187b7df4e7505add94ffd6d834b30d4b2041534caec01c9f024fdd8f20ea0a294874569935542
SSDEEP 3072:llcaCt2/FPC/LlvadpxHgL02ktwNCurbEdTvcx:ll1CE/ElwfgL5rotUx
MD5 SHA1 SHA512 SSDEEP

Submit Download

PUBWZINT.REST.trx_dll

Path C:\ProgramData\{D0B46527-7C45-A967-1A4D-5BBD0FF57755}\PUBWZINT.REST.trx_dll
Size 351KB
SHA256 d22b1049b8b325fcac1cff7ae5665fbaabe478f87f73f4d2e33786d3345c9b27
MD5 df07fbdc5d5f16e15fdfa09d2cd244df
SHA1 bffce809985c030a06c10b87eae3389d951cedbd
SHA512 a9399572fc81d152e038a020eccede88ff47a73a7d9f0f34c52bb68df880756a6853ec8767b2e3afc885ac12507137d6af973be6b716779f6aaa17ac95dff609
SSDEEP 6144:RNrX5owDzzzLGGGGA9oooEFaVLtNaY8BTmYXXxfffftZfffZBc5bEVvGlDR7TdZk:dH4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Peqquspi.tmp

Path C:\ProgramData\{D0B46527-7C45-A967-1A4D-5BBD0FF57755}\Peqquspi.tmp
Size 3.5MB
SHA256 2a5634bd03096ebbe8e7c608ab839b5c09c89b92486d1c9ba942cda000048b4a
MD5 e6df425104c975e035cbb1f1fbbeece0
SHA1 070ce72153550b928f19ea6738d8722750d0aa92
SHA512 8e9d18ff10c6f30ae5df78f6c83599cb2d7d7ef62ed4efa97f2a8f1854e3841f50ec89db1888851c3e5f98cb25c53d613ccfb8775812c1e15340b26200d81c6c
SSDEEP 98304:XJAOOU2uv81OlWe+ZcQ0qzd7l0TNzqHWGvSWpmXJGA:ZcUdv8cse+Zd72RqHWGvSWYXJX
MD5 SHA1 SHA512 SSDEEP

Submit Download

Peqquspi.tmp

Path C:\ProgramData\{D0B46527-7C45-A967-1A4D-5BBD0FF57755}\Peqquspi.tmp
Size 3.5MB
SHA256 2a5634bd03096ebbe8e7c608ab839b5c09c89b92486d1c9ba942cda000048b4a
MD5 e6df425104c975e035cbb1f1fbbeece0
SHA1 070ce72153550b928f19ea6738d8722750d0aa92
SHA512 8e9d18ff10c6f30ae5df78f6c83599cb2d7d7ef62ed4efa97f2a8f1854e3841f50ec89db1888851c3e5f98cb25c53d613ccfb8775812c1e15340b26200d81c6c
SSDEEP 98304:XJAOOU2uv81OlWe+ZcQ0qzd7l0TNzqHWGvSWpmXJGA:ZcUdv8cse+Zd72RqHWGvSWYXJX
MD5 SHA1 SHA512 SSDEEP

Submit Download

{776C3A09-497D-40AA-82FC-751514904008}.2.ver0x0000000000000001.db

Path C:\ProgramData\{D0B46527-7C45-A967-1A4D-5BBD0FF57755}\{776C3A09-497D-40AA-82FC-751514904008}.2.ver0x0000000000000001.db
Size 1KB
SHA256 b8651ccec5bf8e644d9b224bdd72095f5fd286b74b1f316f4b6226e9d6f2ed4d
MD5 46b66d571fffc86fd03646c0ebe3c29e
SHA1 1c887901e08fbff9d7f56c35f42f759e33dfd9ae
SHA512 5b2f250f6b16b08c9bd3f6030f4b34bb325e29e70a49dd7db8f432eeed200c5c1b0d0f774bfaf775ad88e0c803003b0c0daaf5ba2cd4c4d50e814df85eee984f
MD5 SHA1 SHA512

Submit Download

Rruwtqrefy.tmp

Path C:\Users\Admin\AppData\Local\Temp\Rruwtqrefy.tmp
Size 805KB
SHA256 c5cd7d52ba95127c18556a2ddca64e4ef80a2945e6579545c0067abdab3a0ad0
MD5 44d724c9ad9ae3149d4997852eea3e96
SHA1 dcd92e1b704b3f25ba455e079004c5a5aaf903f9
SHA512 791c3b62685a475799a991b2f0f9535781c888d48d1dd47b5b2cd407ff46e15231247f07ceb63c012bd923bf88fffaecf29030186e3d569b9886048881012e44
SSDEEP 12288:z+e7xdjlJTEabNIY4nU2BWHGugNQDljcsKBDzd+9EmF78+kGjdd:imxdjRqlUeWGuJc/BD5yJ78+BJd
MD5 SHA1 SHA512 SSDEEP

Submit Download

applicationinstaller.dll

Path \??\c:\program files (x86)\reference assemblies\microsoft\applicationinstaller.dll
Size 805KB
SHA256 74601da452fe19e5140c309ec276bee80b8cfdfb2ac1732000dea947bbf3ca19
MD5 52c8f4b4eaae7808b949a5d8ca0504c9
SHA1 307de559a7d77af97f6c02c9c930c6eeee5a4eeb
SHA512 82b90215ba31f64806098a2f9671764b9346b0ed18ad1b94f91076fd57a803900da0e2180efdfe0fe2128af55ebb07cb1e0d9dc9103e3c35f85da3df17f1c1f0
SSDEEP 12288:M+e7xdjlJTEabNIY4nU2BWHGugNQDljcsKBDzd+9EmF78+kGjdd:BmxdjRqlUeWGuJc/BD5yJ78+BJd
MD5 SHA1 SHA512 SSDEEP

Submit Download

ApplicationInstaller.dll

Path \Program Files (x86)\Reference Assemblies\Microsoft\ApplicationInstaller.dll
Size 805KB
SHA256 74601da452fe19e5140c309ec276bee80b8cfdfb2ac1732000dea947bbf3ca19
MD5 52c8f4b4eaae7808b949a5d8ca0504c9
SHA1 307de559a7d77af97f6c02c9c930c6eeee5a4eeb
SHA512 82b90215ba31f64806098a2f9671764b9346b0ed18ad1b94f91076fd57a803900da0e2180efdfe0fe2128af55ebb07cb1e0d9dc9103e3c35f85da3df17f1c1f0
SSDEEP 12288:M+e7xdjlJTEabNIY4nU2BWHGugNQDljcsKBDzd+9EmF78+kGjdd:BmxdjRqlUeWGuJc/BD5yJ78+BJd
MD5 SHA1 SHA512 SSDEEP

Submit Download

ApplicationInstaller.dll

Path \Program Files (x86)\Reference Assemblies\Microsoft\ApplicationInstaller.dll
Size 805KB
SHA256 74601da452fe19e5140c309ec276bee80b8cfdfb2ac1732000dea947bbf3ca19
MD5 52c8f4b4eaae7808b949a5d8ca0504c9
SHA1 307de559a7d77af97f6c02c9c930c6eeee5a4eeb
SHA512 82b90215ba31f64806098a2f9671764b9346b0ed18ad1b94f91076fd57a803900da0e2180efdfe0fe2128af55ebb07cb1e0d9dc9103e3c35f85da3df17f1c1f0
SSDEEP 12288:M+e7xdjlJTEabNIY4nU2BWHGugNQDljcsKBDzd+9EmF78+kGjdd:BmxdjRqlUeWGuJc/BD5yJ78+BJd
MD5 SHA1 SHA512 SSDEEP

Submit Download

ApplicationInstaller.dll

Path \Program Files (x86)\Reference Assemblies\Microsoft\ApplicationInstaller.dll
Size 805KB
SHA256 74601da452fe19e5140c309ec276bee80b8cfdfb2ac1732000dea947bbf3ca19
MD5 52c8f4b4eaae7808b949a5d8ca0504c9
SHA1 307de559a7d77af97f6c02c9c930c6eeee5a4eeb
SHA512 82b90215ba31f64806098a2f9671764b9346b0ed18ad1b94f91076fd57a803900da0e2180efdfe0fe2128af55ebb07cb1e0d9dc9103e3c35f85da3df17f1c1f0
SSDEEP 12288:M+e7xdjlJTEabNIY4nU2BWHGugNQDljcsKBDzd+9EmF78+kGjdd:BmxdjRqlUeWGuJc/BD5yJ78+BJd
MD5 SHA1 SHA512 SSDEEP

Submit Download

ApplicationInstaller.dll

Path \Program Files (x86)\Reference Assemblies\Microsoft\ApplicationInstaller.dll
Size 805KB
SHA256 74601da452fe19e5140c309ec276bee80b8cfdfb2ac1732000dea947bbf3ca19
MD5 52c8f4b4eaae7808b949a5d8ca0504c9
SHA1 307de559a7d77af97f6c02c9c930c6eeee5a4eeb
SHA512 82b90215ba31f64806098a2f9671764b9346b0ed18ad1b94f91076fd57a803900da0e2180efdfe0fe2128af55ebb07cb1e0d9dc9103e3c35f85da3df17f1c1f0
SSDEEP 12288:M+e7xdjlJTEabNIY4nU2BWHGugNQDljcsKBDzd+9EmF78+kGjdd:BmxdjRqlUeWGuJc/BD5yJ78+BJd
MD5 SHA1 SHA512 SSDEEP

Submit Download

ApplicationInstaller.dll

Path \Program Files (x86)\Reference Assemblies\Microsoft\ApplicationInstaller.dll
Size 805KB
SHA256 74601da452fe19e5140c309ec276bee80b8cfdfb2ac1732000dea947bbf3ca19
MD5 52c8f4b4eaae7808b949a5d8ca0504c9
SHA1 307de559a7d77af97f6c02c9c930c6eeee5a4eeb
SHA512 82b90215ba31f64806098a2f9671764b9346b0ed18ad1b94f91076fd57a803900da0e2180efdfe0fe2128af55ebb07cb1e0d9dc9103e3c35f85da3df17f1c1f0
SSDEEP 12288:M+e7xdjlJTEabNIY4nU2BWHGugNQDljcsKBDzd+9EmF78+kGjdd:BmxdjRqlUeWGuJc/BD5yJ78+BJd
MD5 SHA1 SHA512 SSDEEP

Submit Download

Rruwtqrefy.tmp

Path \Users\Admin\AppData\Local\Temp\Rruwtqrefy.tmp
Size 805KB
SHA256 c5cd7d52ba95127c18556a2ddca64e4ef80a2945e6579545c0067abdab3a0ad0
MD5 44d724c9ad9ae3149d4997852eea3e96
SHA1 dcd92e1b704b3f25ba455e079004c5a5aaf903f9
SHA512 791c3b62685a475799a991b2f0f9535781c888d48d1dd47b5b2cd407ff46e15231247f07ceb63c012bd923bf88fffaecf29030186e3d569b9886048881012e44
SSDEEP 12288:z+e7xdjlJTEabNIY4nU2BWHGugNQDljcsKBDzd+9EmF78+kGjdd:imxdjRqlUeWGuJc/BD5yJ78+BJd
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/672-110-0x00000000040F0000-0x0000000004C1F000-memory.dmp

Download

memory/672-107-0x00000000040F0000-0x0000000004C1F000-memory.dmp

Download

memory/672-109-0x00000000040F0000-0x0000000004C1F000-memory.dmp

Download

memory/1068-94-0x0000000004190000-0x0000000004CBF000-memory.dmp

Download

memory/1068-93-0x0000000004190000-0x0000000004CBF000-memory.dmp

Download

memory/1068-91-0x0000000004190000-0x0000000004CBF000-memory.dmp

Download

memory/1068-111-0x0000000004190000-0x0000000004CBF000-memory.dmp

Download

memory/1700-54-0x0000000001D00000-0x0000000001DE4000-memory.dmp

Download

memory/1700-60-0x0000000000400000-0x0000000000525000-memory.dmp

Download

memory/1700-59-0x0000000001E00000-0x0000000001F24000-memory.dmp

Download

memory/1700-57-0x0000000001D00000-0x0000000001DE4000-memory.dmp

Download

memory/1700-55-0x0000000076651000-0x0000000076653000-memory.dmp

Download

memory/1884-82-0x0000000001E70000-0x0000000002119000-memory.dmp

Download

memory/1884-81-0x000007FEFC241000-0x000007FEFC243000-memory.dmp

Download

memory/1884-80-0x00000000000E0000-0x0000000000378000-memory.dmp

Download

memory/1884-70-0x00000000000E0000-0x0000000000378000-memory.dmp

Download

memory/1884-77-0x0000000002120000-0x0000000002260000-memory.dmp

Download

memory/1884-76-0x0000000002120000-0x0000000002260000-memory.dmp

Download

memory/1988-68-0x0000000005220000-0x0000000005360000-memory.dmp

Download

memory/1988-84-0x0000000005236000-0x0000000005238000-memory.dmp

Download

memory/1988-83-0x00000000046F0000-0x000000000521F000-memory.dmp

Download

memory/1988-78-0x0000000005236000-0x0000000005238000-memory.dmp

Download

memory/1988-79-0x0000000005236000-0x0000000005238000-memory.dmp

Download

memory/1988-74-0x0000000005220000-0x0000000005360000-memory.dmp

Download

memory/1988-73-0x0000000005220000-0x0000000005360000-memory.dmp

Download

memory/1988-72-0x0000000005220000-0x0000000005360000-memory.dmp

Download

memory/1988-69-0x0000000005220000-0x0000000005360000-memory.dmp

Download

memory/1988-67-0x0000000005220000-0x0000000005360000-memory.dmp

Download

memory/1988-66-0x00000000046F0000-0x000000000521F000-memory.dmp

Download

memory/1988-65-0x00000000046F0000-0x000000000521F000-memory.dmp

Download

memory/1988-63-0x00000000046F0000-0x000000000521F000-memory.dmp

Download