lumma | 12ca778b2f964c751dedf8211fb4959be500022d1b26ce2d427b4736bb3fa9f2

Analysis

max time kernel
116s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
16/01/2023, 00:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 210KB
Sample230116-av7raaee22
SHA256 12ca778b2f964c751dedf8211fb4959be500022d1b26ce2d427b4736bb3fa9f2
MD5 a272c2456368521390a3b920e88cd39e
SHA1 1eb4a8adb3fbb1a6a5478a97054865a17e596e17
SHA512 eff3f09fb644ab3e78b8ca9b6c838cc81efaa25d7a430444812f445e27f71cf5e14ac1ac33da00ee5b8f83865eb6abf47083e28cd1dd49dcc65fa1bbb1dfb65f
SSDEEP 3072:8YXj7gW0W5hed5Yu/BvIiER1Q50VM3MUAMOgbytz6yW0i:8sIWXfu5vJERO50VFUnOwoz2
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

lumma smokeloader backdoor collection discovery persistence spyware stealer trojan

Malware Config

Extracted

Family

lumma

77.73.134.68

Signatures

Detects Smokeloader packer 1 IoCs

resource	yara_rule
behavioral2/memory/2200-133-0x0000000002C60000-0x0000000002C69000-memory.dmp	family_smokeloader

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma
SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

Blocklisted process makes network request 4 IoCs

flow	pid	Process
26	4836	rundll32.exe
29	4836	rundll32.exe
30	4836	rundll32.exe
43	4836	rundll32.exe

Downloads MZ/PE file

Executes dropped EXE 2 IoCs

pid	Process
216	D064.exe
4356	A3D2.exe

Sets DLL path for service in the registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\ahclient\Parameters\ServiceDll = "C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\ahclient.dll"	rundll32.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\ahclient\ImagePath = "C:\\Windows\\system32\\svchost.exe -k LocalService"	rundll32.exe

Loads dropped DLL 3 IoCs

pid	Process
4836	rundll32.exe
3084	svchost.exe
4748	rundll32.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	rundll32.exe

Accesses Microsoft Outlook profiles 1 TTPs 4 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	rundll32.exe
Key opened	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	rundll32.exe
Key opened	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	rundll32.exe
Key opened	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	rundll32.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 4836 set thread context of 1668	4836	rundll32.exe	94
PID 4836 set thread context of 2280	4836	rundll32.exe	97
PID 4836 set thread context of 1236	4836	rundll32.exe	104
PID 4836 set thread context of 4252	4836	rundll32.exe	110

Drops file in Program Files directory 12 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\hi_contrast\aic_file_icons_retina_thumb_highContrast_wob.png	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	rundll32.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\sendforcomments.svg	rundll32.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\ccloud.png	rundll32.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\ahclient.dll	rundll32.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\32BitMAPIBroker.exe	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\ccloud.png	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeLinguistic.dll	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ACE.dll	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\sendforcomments.svg	rundll32.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\aic_file_icons_retina_thumb_highContrast_wob.png	rundll32.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\ACE.dll	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3644	216	WerFault.exe	87
3820	4356	WerFault.exe	101

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	file.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	file.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	file.exe

Checks processor information in registry 2 TTPs 64 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Revision	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Revision	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Previous Update Revision	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\VendorIdentifier	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information	svchost.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Previous Update Revision	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\VendorIdentifier	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\FeatureSet	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Previous Update Revision	rundll32.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	rundll32.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Previous Update Revision	svchost.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	svchost.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	rundll32.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\FeatureSet	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Previous Update Revision	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Component Information	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Configuration Data	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\FeatureSet	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Previous Update Revision	rundll32.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Status	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Component Information	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Configuration Data	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Status	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\VendorIdentifier	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Status	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Identifier	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	rundll32.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	svchost.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Status	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Platform Specific Field 1	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	rundll32.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Component Information	rundll32.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Internet Explorer\Toolbar	Process not Found
Set value (int)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser	Process not Found

Modifies registry class 57 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	Process not Found
Set value (data)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f44471a0359723fa74489c55595fe6b30ee0000	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	Process not Found
Set value (data)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	Process not Found
Set value (data)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = 00000000ffffffff	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	Process not Found
Set value (data)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\WorkFolders	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0	Process not Found
Set value (data)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	Process not Found
Set value (data)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\MRUListEx = ffffffff	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 820074001c0043465346160031000000000000000000100041707044617461000000741a595e96dfd3488d671733bcee28bac5cdfadf9f6756418947c5c76bc0b67f400009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004100700070004400610074006100000042000000	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff	Process not Found
Set value (int)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\NodeSlot = "1"	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	Process not Found
Set value (data)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 50003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014000000	Process not Found
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 = 4e003100000000003056400c100054656d7000003a0009000400efbe6b55586c3056450c2e000000000000000000000000000000000000000000000000003fd96600540065006d007000000014000000	Process not Found
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic"	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	rundll32.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1068	Process not Found

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2200	file.exe
2200	file.exe
1068	Process not Found
1068	Process not Found
1068	Process not Found
1068	Process not Found
1068	Process not Found
1068	Process not Found
1068	Process not Found
1068	Process not Found
1068	Process not Found
1068	Process not Found
1068	Process not Found
1068	Process not Found
1068	Process not Found
1068	Process not Found
1068	Process not Found
1068	Process not Found
1068	Process not Found
1068	Process not Found
1068	Process not Found
1068	Process not Found
1068	Process not Found
1068	Process not Found
1068	Process not Found
1068	Process not Found
1068	Process not Found
1068	Process not Found
1068	Process not Found
1068	Process not Found
1068	Process not Found
1068	Process not Found
1068	Process not Found
1068	Process not Found
1068	Process not Found
1068	Process not Found
1068	Process not Found
1068	Process not Found
1068	Process not Found
1068	Process not Found
1068	Process not Found
1068	Process not Found
1068	Process not Found
1068	Process not Found
1068	Process not Found
1068	Process not Found
1068	Process not Found
1068	Process not Found
1068	Process not Found
1068	Process not Found
1068	Process not Found
1068	Process not Found
1068	Process not Found
1068	Process not Found
1068	Process not Found
1068	Process not Found
1068	Process not Found
1068	Process not Found
1068	Process not Found
1068	Process not Found
1068	Process not Found
1068	Process not Found
1068	Process not Found
1068	Process not Found

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1068	Process not Found

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2200	file.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1068	Process not Found
Token: SeCreatePagefilePrivilege	1068	Process not Found
Token: SeDebugPrivilege	4836	rundll32.exe
Token: SeShutdownPrivilege	1068	Process not Found
Token: SeCreatePagefilePrivilege	1068	Process not Found
Token: SeShutdownPrivilege	1068	Process not Found
Token: SeCreatePagefilePrivilege	1068	Process not Found
Token: SeShutdownPrivilege	1068	Process not Found
Token: SeCreatePagefilePrivilege	1068	Process not Found
Token: SeShutdownPrivilege	1068	Process not Found
Token: SeCreatePagefilePrivilege	1068	Process not Found
Token: SeShutdownPrivilege	1068	Process not Found
Token: SeCreatePagefilePrivilege	1068	Process not Found
Token: SeShutdownPrivilege	1068	Process not Found
Token: SeCreatePagefilePrivilege	1068	Process not Found
Token: SeShutdownPrivilege	1068	Process not Found
Token: SeCreatePagefilePrivilege	1068	Process not Found
Token: SeShutdownPrivilege	1068	Process not Found
Token: SeCreatePagefilePrivilege	1068	Process not Found
Token: SeShutdownPrivilege	1068	Process not Found
Token: SeCreatePagefilePrivilege	1068	Process not Found
Token: SeShutdownPrivilege	1068	Process not Found
Token: SeCreatePagefilePrivilege	1068	Process not Found
Token: SeShutdownPrivilege	1068	Process not Found
Token: SeCreatePagefilePrivilege	1068	Process not Found
Token: SeShutdownPrivilege	1068	Process not Found
Token: SeCreatePagefilePrivilege	1068	Process not Found
Token: SeShutdownPrivilege	1068	Process not Found
Token: SeCreatePagefilePrivilege	1068	Process not Found
Token: SeShutdownPrivilege	1068	Process not Found
Token: SeCreatePagefilePrivilege	1068	Process not Found
Token: SeShutdownPrivilege	1068	Process not Found
Token: SeCreatePagefilePrivilege	1068	Process not Found
Token: SeShutdownPrivilege	1068	Process not Found
Token: SeCreatePagefilePrivilege	1068	Process not Found
Token: SeShutdownPrivilege	1068	Process not Found
Token: SeCreatePagefilePrivilege	1068	Process not Found
Token: SeShutdownPrivilege	1068	Process not Found
Token: SeCreatePagefilePrivilege	1068	Process not Found
Token: SeShutdownPrivilege	1068	Process not Found
Token: SeCreatePagefilePrivilege	1068	Process not Found
Token: SeShutdownPrivilege	1068	Process not Found
Token: SeCreatePagefilePrivilege	1068	Process not Found
Token: SeShutdownPrivilege	1068	Process not Found
Token: SeCreatePagefilePrivilege	1068	Process not Found
Token: SeShutdownPrivilege	1068	Process not Found
Token: SeCreatePagefilePrivilege	1068	Process not Found
Token: SeShutdownPrivilege	1068	Process not Found
Token: SeCreatePagefilePrivilege	1068	Process not Found
Token: SeShutdownPrivilege	1068	Process not Found
Token: SeCreatePagefilePrivilege	1068	Process not Found
Token: SeShutdownPrivilege	1068	Process not Found
Token: SeCreatePagefilePrivilege	1068	Process not Found
Token: SeShutdownPrivilege	1068	Process not Found
Token: SeCreatePagefilePrivilege	1068	Process not Found
Token: SeShutdownPrivilege	1068	Process not Found
Token: SeCreatePagefilePrivilege	1068	Process not Found
Token: SeShutdownPrivilege	1068	Process not Found
Token: SeCreatePagefilePrivilege	1068	Process not Found
Token: SeShutdownPrivilege	1068	Process not Found
Token: SeCreatePagefilePrivilege	1068	Process not Found
Token: SeShutdownPrivilege	1068	Process not Found
Token: SeCreatePagefilePrivilege	1068	Process not Found
Token: SeShutdownPrivilege	1068	Process not Found

Suspicious use of FindShellTrayWindow 18 IoCs

pid	Process
1668	rundll32.exe
1068	Process not Found
1068	Process not Found
1068	Process not Found
1068	Process not Found
4836	rundll32.exe
1068	Process not Found
1068	Process not Found
1068	Process not Found
1068	Process not Found
2280	rundll32.exe
4836	rundll32.exe
1236	rundll32.exe
4836	rundll32.exe
4252	rundll32.exe
4836	rundll32.exe
4836	rundll32.exe
4836	rundll32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1068	Process not Found
1068	Process not Found

Suspicious use of WriteProcessMemory 60 IoCs

description	pid	Process	procid_target
PID 1068 wrote to memory of 216	1068	Process not Found	87
PID 1068 wrote to memory of 216	1068	Process not Found	87
PID 1068 wrote to memory of 216	1068	Process not Found	87
PID 216 wrote to memory of 4836	216	D064.exe	89
PID 216 wrote to memory of 4836	216	D064.exe	89
PID 216 wrote to memory of 4836	216	D064.exe	89
PID 3084 wrote to memory of 4748	3084	svchost.exe	93
PID 3084 wrote to memory of 4748	3084	svchost.exe	93
PID 3084 wrote to memory of 4748	3084	svchost.exe	93
PID 4836 wrote to memory of 1668	4836	rundll32.exe	94
PID 4836 wrote to memory of 1668	4836	rundll32.exe	94
PID 4836 wrote to memory of 1668	4836	rundll32.exe	94
PID 4836 wrote to memory of 3228	4836	rundll32.exe	95
PID 4836 wrote to memory of 3228	4836	rundll32.exe	95
PID 4836 wrote to memory of 3228	4836	rundll32.exe	95
PID 4836 wrote to memory of 2280	4836	rundll32.exe	97
PID 4836 wrote to memory of 2280	4836	rundll32.exe	97
PID 4836 wrote to memory of 2280	4836	rundll32.exe	97
PID 4836 wrote to memory of 4996	4836	rundll32.exe	99
PID 4836 wrote to memory of 4996	4836	rundll32.exe	99
PID 4836 wrote to memory of 4996	4836	rundll32.exe	99
PID 1068 wrote to memory of 4356	1068	Process not Found	101
PID 1068 wrote to memory of 4356	1068	Process not Found	101
PID 1068 wrote to memory of 4356	1068	Process not Found	101
PID 4836 wrote to memory of 4592	4836	rundll32.exe	102
PID 4836 wrote to memory of 4592	4836	rundll32.exe	102
PID 4836 wrote to memory of 4592	4836	rundll32.exe	102
PID 4836 wrote to memory of 1236	4836	rundll32.exe	104
PID 4836 wrote to memory of 1236	4836	rundll32.exe	104
PID 4836 wrote to memory of 1236	4836	rundll32.exe	104
PID 4836 wrote to memory of 2016	4836	rundll32.exe	105
PID 4836 wrote to memory of 2016	4836	rundll32.exe	105
PID 4836 wrote to memory of 2016	4836	rundll32.exe	105
PID 4836 wrote to memory of 2268	4836	rundll32.exe	109
PID 4836 wrote to memory of 2268	4836	rundll32.exe	109
PID 4836 wrote to memory of 2268	4836	rundll32.exe	109
PID 4836 wrote to memory of 4252	4836	rundll32.exe	110
PID 4836 wrote to memory of 4252	4836	rundll32.exe	110
PID 4836 wrote to memory of 4252	4836	rundll32.exe	110
PID 4836 wrote to memory of 3660	4836	rundll32.exe	112
PID 4836 wrote to memory of 3660	4836	rundll32.exe	112
PID 4836 wrote to memory of 3660	4836	rundll32.exe	112
PID 4836 wrote to memory of 2724	4836	rundll32.exe	114
PID 4836 wrote to memory of 2724	4836	rundll32.exe	114
PID 4836 wrote to memory of 2724	4836	rundll32.exe	114
PID 4836 wrote to memory of 2332	4836	rundll32.exe	116
PID 4836 wrote to memory of 2332	4836	rundll32.exe	116
PID 4836 wrote to memory of 2332	4836	rundll32.exe	116
PID 4836 wrote to memory of 1228	4836	rundll32.exe	118
PID 4836 wrote to memory of 1228	4836	rundll32.exe	118
PID 4836 wrote to memory of 1228	4836	rundll32.exe	118
PID 4836 wrote to memory of 3648	4836	rundll32.exe	120
PID 4836 wrote to memory of 3648	4836	rundll32.exe	120
PID 4836 wrote to memory of 3648	4836	rundll32.exe	120
PID 4836 wrote to memory of 1204	4836	rundll32.exe	122
PID 4836 wrote to memory of 1204	4836	rundll32.exe	122
PID 4836 wrote to memory of 1204	4836	rundll32.exe	122
PID 4836 wrote to memory of 936	4836	rundll32.exe	124
PID 4836 wrote to memory of 936	4836	rundll32.exe	124
PID 4836 wrote to memory of 936	4836	rundll32.exe	124

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	rundll32.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2200

C:\Users\Admin\AppData\Local\Temp\D064.exe
C:\Users\Admin\AppData\Local\Temp\D064.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:216
- C:\Windows\SysWOW64\rundll32.exe
  "C:\Windows\system32\rundll32.exe" "C:\Users\Admin\AppData\Local\Temp\Sdaaysrpyefiy.tmp",Qowsuiaedfeupa
  2⤵
  - Blocklisted process makes network request
  - Sets DLL path for service in the registry
  - Sets service image path in registry
  - Loads dropped DLL
  - Accesses Microsoft Outlook accounts
  - Accesses Microsoft Outlook profiles
  - Suspicious use of SetThreadContext
  - Drops file in Program Files directory
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  - outlook_office_path
  - outlook_win_path
  PID:4836
- - C:\Windows\system32\rundll32.exe
    "C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61 18657
    3⤵
    - Modifies registry class
    - Suspicious use of FindShellTrayWindow
    PID:1668
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /End /tn \Microsoft\Windows\Wininet\CacheTask
    3⤵
    PID:3228
- - C:\Windows\system32\rundll32.exe
    "C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61 18657
    3⤵
    - Modifies registry class
    - Suspicious use of FindShellTrayWindow
    PID:2280
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /Run /tn \Microsoft\Windows\Wininet\CacheTask
    3⤵
    PID:4996
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /End /tn \Microsoft\Windows\Wininet\CacheTask
    3⤵
    PID:4592
- - C:\Windows\system32\rundll32.exe
    "C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61 18657
    3⤵
    - Modifies registry class
    - Suspicious use of FindShellTrayWindow
    PID:1236
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /Run /tn \Microsoft\Windows\Wininet\CacheTask
    3⤵
    PID:2016
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /End /tn \Microsoft\Windows\Wininet\CacheTask
    3⤵
    PID:2268
- - C:\Windows\system32\rundll32.exe
    "C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61 18657
    3⤵
    - Modifies registry class
    - Suspicious use of FindShellTrayWindow
    PID:4252
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /Run /tn \Microsoft\Windows\Wininet\CacheTask
    3⤵
    PID:3660
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /End /tn \Microsoft\Windows\Wininet\CacheTask
    3⤵
    PID:2724
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /Run /tn \Microsoft\Windows\Wininet\CacheTask
    3⤵
    PID:2332
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /End /tn \Microsoft\Windows\Wininet\CacheTask
    3⤵
    PID:1228
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /Run /tn \Microsoft\Windows\Wininet\CacheTask
    3⤵
    PID:3648
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /End /tn \Microsoft\Windows\Wininet\CacheTask
    3⤵
    PID:1204
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /Run /tn \Microsoft\Windows\Wininet\CacheTask
    3⤵
    PID:936
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /End /tn \Microsoft\Windows\Wininet\CacheTask
    3⤵
    PID:3384
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /Run /tn \Microsoft\Windows\Wininet\CacheTask
    3⤵
    PID:4100
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /End /tn \Microsoft\Windows\Wininet\CacheTask
    3⤵
    PID:3788
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /Run /tn \Microsoft\Windows\Wininet\CacheTask
    3⤵
    PID:4576
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /End /tn \Microsoft\Windows\Wininet\CacheTask
    3⤵
    PID:3244
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /Run /tn \Microsoft\Windows\Wininet\CacheTask
    3⤵
    PID:3092
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /End /tn \Microsoft\Windows\Wininet\CacheTask
    3⤵
    PID:3656
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /Run /tn \Microsoft\Windows\Wininet\CacheTask
    3⤵
    PID:4796
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /End /tn \Microsoft\Windows\Wininet\CacheTask
    3⤵
    PID:876
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /Run /tn \Microsoft\Windows\Wininet\CacheTask
    3⤵
    PID:4888
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 216 -s 528
  2⤵
  - Program crash
  PID:3644

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 216 -ip 216
1⤵
PID:3484

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k LocalService
1⤵
- Loads dropped DLL
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:3084
- C:\Windows\SysWOW64\rundll32.exe
  "C:\Windows\system32\rundll32.exe" "c:\program files (x86)\windowspowershell\modules\ahclient.dll",XV0AczNFNlY=
  2⤵
  - Loads dropped DLL
  - Checks processor information in registry
  PID:4748

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3488

C:\Users\Admin\AppData\Local\Temp\A3D2.exe
C:\Users\Admin\AppData\Local\Temp\A3D2.exe
1⤵
- Executes dropped EXE
PID:4356
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4356 -s 1344
  2⤵
  - Program crash
  PID:3820

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 4356 -ip 4356
1⤵
PID:2700

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ahclient.dll

Path C:\Program Files (x86)\WindowsPowerShell\Modules\ahclient.dll
Size 774KB
SHA256 75ad22802365c0466cac4de935ec1e8f324008271dff8c9ffc4a001daa10b584
MD5 52b5575b2570b558f5f8acfbefd0defa
SHA1 ca3cc764a45b19f620b2b824095246247bef8f67
SHA512 225224790a476e3c10ff0e675388f6f3cf73f6e342f841c2e3f9605ad04a825f12da36530a506ed95a2917b982501eea8c30e3a05457f1d1e3f39bda5e9acde4
SSDEEP 12288:0d7mJ1sUbiUgrsGjhBgekOC/JHJajwvUNzY4x2mEcn2JAjOufhCTmIQ/6wW4U62C:0pUvgX2ZJp9UdLUm32fZzPt3wKF2
MD5 SHA1 SHA512 SSDEEP

Submit Download

ahclient.dll

Path C:\Program Files (x86)\WindowsPowerShell\Modules\ahclient.dll
Size 774KB
SHA256 75ad22802365c0466cac4de935ec1e8f324008271dff8c9ffc4a001daa10b584
MD5 52b5575b2570b558f5f8acfbefd0defa
SHA1 ca3cc764a45b19f620b2b824095246247bef8f67
SHA512 225224790a476e3c10ff0e675388f6f3cf73f6e342f841c2e3f9605ad04a825f12da36530a506ed95a2917b982501eea8c30e3a05457f1d1e3f39bda5e9acde4
SSDEEP 12288:0d7mJ1sUbiUgrsGjhBgekOC/JHJajwvUNzY4x2mEcn2JAjOufhCTmIQ/6wW4U62C:0pUvgX2ZJp9UdLUm32fZzPt3wKF2
MD5 SHA1 SHA512 SSDEEP

Submit Download

Active.GRL

Path C:\ProgramData\{AD22A7C3-A288-2107-49C0-5B9511BAC117}\Active.GRL
Size 14KB
SHA256 bda9df3591bf7f67d4b31d23cffdcf927da6f00ae1b393f07aea69ba1c4344bc
MD5 fffde3df0d91311b7fe3f9bc8642a9ec
SHA1 50987906817aab51e2cc29fbce47ac5f0936a44e
SHA512 5e0766c25f54b03ca0325966ba059cbfb9cdb0aeae567106583fdff944d67522516acabb9b261e2fd434c1a5af5c5453a09c9dc494008253b0553a993c01d3d3
SSDEEP 96:kOtDPyPBBxaweu+WyzuNOGBrI+7Jpgreuj0rpb/VE8hbzy6weu+WyzuNOGBrI+7M:RuhRjuQEar/hbSRjuQEar/hbvQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

CiST0000.002

Path C:\ProgramData\{AD22A7C3-A288-2107-49C0-5B9511BAC117}\CiST0000.002
Size 64KB
SHA256 0ff9f58a1277b6e92cb5f2c016f92f0ace2b750367434bc5b5119589f6de8580
MD5 f2896182a74e8e8402e890172c9e90ae
SHA1 2929cd1f29ca5805406c001ce61209db8977470f
SHA512 dc27bb76da9dcad0c38ce33e11ae045c7da131a112e9b17e6e0606c4daac150813cfea4eed537c84d9eeeabdca40c5eadb46a0f73b9076f29f5c52d1af6988e0
SSDEEP 192:Q0IwRQoFGmm/FNoflQDZ3TpBxkFONkSpW1cjkmHVLwFASnaG1G4uXbbCfNb7jud6:Q16QJyQd31BLWyCy2YQrMM/R7J
MD5 SHA1 SHA512 SSDEEP

Submit Download

EventStore.db

Path C:\ProgramData\{AD22A7C3-A288-2107-49C0-5B9511BAC117}\EventStore.db
Size 20KB
SHA256 61986768c35b97c771b1a9cf2df03055f2cf3099a0c9d11dd657b8ff615d4ccc
MD5 3aee4f856582f8548c3c910d1112c8ca
SHA1 f7a2af6e15359a0752d4a971a442008ae0f583ed
SHA512 0a80ce18344a09a59d42f615e51a27cbf51c081f2273611bcaad1c73681f8161e94175ecb06d3e16e1283f4a556e239b726013176898039c8160e77f72d8b235
SSDEEP 96:kuwMk9q3SfLtJUKoUX5HpNMvotWEeHbw8p2qSkJyU:kuuqi5JUyXNvMvw5e7+U
MD5 SHA1 SHA512 SSDEEP

Submit Download

MicrosoftOffice2016Win32.xml

Path C:\ProgramData\{AD22A7C3-A288-2107-49C0-5B9511BAC117}\MicrosoftOffice2016Win32.xml
Size 64KB
SHA256 bc964a0306fbeca377d20bafd127425c0700ee293a2c5caf9b28285f1b1d75e5
MD5 fb54ecf5bbc8554d4218fce2b5863f04
SHA1 5a43e92271d69b66f97c12d977c10bc78991f76f
SHA512 c13e3d7c8801b9a865952708af0fe4272e2034be0ebc40e94f4bdccd13b3075ef8d2b5ec8af68d51fe11d87ce84183275d031390aa00e6cefd02407a03436a40
SSDEEP 768:2Xm4YPEwb02Q1KzM9SEMu+4BpREtUy70Ak4LF3Hw:QRYPEwHQ1YMkEMu5BaTxLFA
MD5 SHA1 SHA512 SSDEEP

Submit Download

Uqioyhuair.tmp

Path C:\ProgramData\{AD22A7C3-A288-2107-49C0-5B9511BAC117}\Uqioyhuair.tmp
Size 3.5MB
SHA256 f615170a8c8bad94d6bb3097bddb37c350796665503d4a77b12e276cdd2248b8
MD5 ab3437e671bbeb419b80505d0b82a61f
SHA1 48ba259544d758ba37f4385b84f4a36c356a3988
SHA512 c93c7836a90779730ece0040078bb5e893191a300566a3db189870bc117d64e6705b0f4ca34f1666169a836966015bf1e9051e0c30e405e48034f8d7bf814842
SSDEEP 49152:eVkEQ7GQsLZWoFCQ8ZcHVkgkzWufZ5hds+2/PoJRrNwz05Mj1jqqfGw62OVC:J/sLEoh8qH+WuB5DE/PgRrNktffV6v8
MD5 SHA1 SHA512 SSDEEP

Submit Download

Uqioyhuair.tmp

Path C:\ProgramData\{AD22A7C3-A288-2107-49C0-5B9511BAC117}\Uqioyhuair.tmp
Size 3.5MB
SHA256 01a5aae5e1e7e65e938c26614f4e5178cd58e060fe41170c304bddbff61feb76
MD5 51779a40d4afaaab5c1cb13b0e6ba862
SHA1 2cba9fa96fdfa3ef7a5c4311395dfbcea2b7efe5
SHA512 ae64e0465c76a3689f35b4ee3fdd67a67eff42d11bc008e9069754c528b0a1a33783ad64a6073de2481bf05ba1a649323027e264ecd136efc79536c15faf27c6
SSDEEP 49152:eVkEQ7GQsLZWoFCQ8ZcHVkgkzWufZ5hds+2/PoJRrNwz05Mj1jqqfGw62OVE:J/sLEoh8qH+WuB5DE/PgRrNktffV6vG
MD5 SHA1 SHA512 SSDEEP

Submit Download

telemetry.P-Eco3PTelDefault.json

Path C:\ProgramData\{AD22A7C3-A288-2107-49C0-5B9511BAC117}\telemetry.P-Eco3PTelDefault.json
Size 57B
SHA256 29633ff726d1c72f895545fd97d546035e7045a046b3d2888ff0950e67b8eb82
MD5 b658c06c14ff523bce634e14236c9441
SHA1 aa15105fc5cbee478303c5a1d8814a88197573be
SHA512 3326a97db218aa09814e80317c1150f8a6808e8b6aab07af27c8126688b30964cc85936940d310c1d4d6190c49eaa01ee51d598775ec8c156676bbfd53f8f4cc
MD5 SHA1 SHA512

Submit Download

A3D2.exe

Path C:\Users\Admin\AppData\Local\Temp\A3D2.exe
Size 248KB
SHA256 73cfa816bd989fa7dd51fc1aeff7657323836d86fdc30da54f3d0140376096c5
MD5 d4371171249f45f3af6095825378c055
SHA1 7c38214ddc9fdf6598f5247272997dd682147717
SHA512 96f1118afbc83d3738ac00e4b9b9e08f9773fa47edcd422d9951168341f61a63c1e388d775595a23325b6a227a0704a333de14855286cc7a13bc37406b8aba22
SSDEEP 3072:cYXykb1N+5d5bGN9i8olYgxTNsRUd62GSHfSokyxMTZrVwb+sbi:cs9N+ZGNZFgxTN8c629/SokwMFr
MD5 SHA1 SHA512 SSDEEP

Submit Download

A3D2.exe

Path C:\Users\Admin\AppData\Local\Temp\A3D2.exe
Size 248KB
SHA256 73cfa816bd989fa7dd51fc1aeff7657323836d86fdc30da54f3d0140376096c5
MD5 d4371171249f45f3af6095825378c055
SHA1 7c38214ddc9fdf6598f5247272997dd682147717
SHA512 96f1118afbc83d3738ac00e4b9b9e08f9773fa47edcd422d9951168341f61a63c1e388d775595a23325b6a227a0704a333de14855286cc7a13bc37406b8aba22
SSDEEP 3072:cYXykb1N+5d5bGN9i8olYgxTNsRUd62GSHfSokyxMTZrVwb+sbi:cs9N+ZGNZFgxTN8c629/SokwMFr
MD5 SHA1 SHA512 SSDEEP

Submit Download

D064.exe

Path C:\Users\Admin\AppData\Local\Temp\D064.exe
Size 1.1MB
SHA256 2db83ad9f102f66c542f56c46ca4920993cea54a6ece548bfc085b7561b3f3a1
MD5 f6c1a5208bea4086420d914af78044ff
SHA1 38ac98440892bfaf778ce20d7df1502f3f5f72b9
SHA512 8b0c4c192c1a2fe38c83911ef48fe83221e9af93662ff3aa2057ef51d086a96dbd314f93740e56294f5763e57363db914008e6800c0c5a097314647791be84e3
SSDEEP 24576:E/g2DcUnwCiGAtbNCMqGkrHwKFCwdZBLxm4RKOeXlmHIEFomG9B/FqW:Eo2DcUnw1LtbNqrHvFHB1RKOi1P9H
MD5 SHA1 SHA512 SSDEEP

Submit Download

D064.exe

Path C:\Users\Admin\AppData\Local\Temp\D064.exe
Size 1.1MB
SHA256 2db83ad9f102f66c542f56c46ca4920993cea54a6ece548bfc085b7561b3f3a1
MD5 f6c1a5208bea4086420d914af78044ff
SHA1 38ac98440892bfaf778ce20d7df1502f3f5f72b9
SHA512 8b0c4c192c1a2fe38c83911ef48fe83221e9af93662ff3aa2057ef51d086a96dbd314f93740e56294f5763e57363db914008e6800c0c5a097314647791be84e3
SSDEEP 24576:E/g2DcUnwCiGAtbNCMqGkrHwKFCwdZBLxm4RKOeXlmHIEFomG9B/FqW:Eo2DcUnw1LtbNqrHvFHB1RKOi1P9H
MD5 SHA1 SHA512 SSDEEP

Submit Download

Sdaaysrpyefiy.tmp

Path C:\Users\Admin\AppData\Local\Temp\Sdaaysrpyefiy.tmp
Size 774KB
SHA256 b282eb3f05d375d3487d20596d783fa52aa27013e8b2b407db32d9a3a751319d
MD5 e06fb66bfbe1444cc091f0297b8d32db
SHA1 c3e13e3edcbbf30cdc51ce96cc7a802fc88e83af
SHA512 c639b62f417d46148c3a84ae5ff2cc7018c653424cc1d643a983c41d4a12f6015df0f4359c5e078c2c3e5b1d42de18acfb6aab432266a8c4e37aa5449e961d95
SSDEEP 12288:Nd7mJ1sUbiUgrsGjhBgekOC/JHJajwvUNzY4x2mEcn2JAjOufhCTmIQ/6wW4U62C:NpUvgX2ZJp9UdLUm32fZzPt3wKF2
MD5 SHA1 SHA512 SSDEEP

Submit Download

Sdaaysrpyefiy.tmp

Path C:\Users\Admin\AppData\Local\Temp\Sdaaysrpyefiy.tmp
Size 774KB
SHA256 b282eb3f05d375d3487d20596d783fa52aa27013e8b2b407db32d9a3a751319d
MD5 e06fb66bfbe1444cc091f0297b8d32db
SHA1 c3e13e3edcbbf30cdc51ce96cc7a802fc88e83af
SHA512 c639b62f417d46148c3a84ae5ff2cc7018c653424cc1d643a983c41d4a12f6015df0f4359c5e078c2c3e5b1d42de18acfb6aab432266a8c4e37aa5449e961d95
SSDEEP 12288:Nd7mJ1sUbiUgrsGjhBgekOC/JHJajwvUNzY4x2mEcn2JAjOufhCTmIQ/6wW4U62C:NpUvgX2ZJp9UdLUm32fZzPt3wKF2
MD5 SHA1 SHA512 SSDEEP

Submit Download

ahclient.dll

Path \??\c:\program files (x86)\windowspowershell\modules\ahclient.dll
Size 774KB
SHA256 75ad22802365c0466cac4de935ec1e8f324008271dff8c9ffc4a001daa10b584
MD5 52b5575b2570b558f5f8acfbefd0defa
SHA1 ca3cc764a45b19f620b2b824095246247bef8f67
SHA512 225224790a476e3c10ff0e675388f6f3cf73f6e342f841c2e3f9605ad04a825f12da36530a506ed95a2917b982501eea8c30e3a05457f1d1e3f39bda5e9acde4
SSDEEP 12288:0d7mJ1sUbiUgrsGjhBgekOC/JHJajwvUNzY4x2mEcn2JAjOufhCTmIQ/6wW4U62C:0pUvgX2ZJp9UdLUm32fZzPt3wKF2
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/216-145-0x0000000000400000-0x0000000002C76000-memory.dmp

Download

memory/216-144-0x0000000000400000-0x0000000002C76000-memory.dmp

Download

memory/216-143-0x0000000004A20000-0x0000000004B4E000-memory.dmp

Download

memory/216-142-0x0000000004932000-0x0000000004A1B000-memory.dmp

Download

memory/1236-198-0x0000022ECE0C0000-0x0000022ECE375000-memory.dmp

Download

memory/1236-197-0x0000022ECFB20000-0x0000022ECFC60000-memory.dmp

Download

memory/1236-203-0x0000022ECE0C0000-0x0000022ECE375000-memory.dmp

Download

memory/1236-196-0x0000022ECFB20000-0x0000022ECFC60000-memory.dmp

Download

memory/1668-170-0x000001C96EE70000-0x000001C96EFB0000-memory.dmp

Download

memory/1668-175-0x000001C96D410000-0x000001C96D6C5000-memory.dmp

Download

memory/1668-171-0x000001C96EE70000-0x000001C96EFB0000-memory.dmp

Download

memory/1668-172-0x0000000000040000-0x00000000002E4000-memory.dmp

Download

memory/1668-173-0x000001C96D410000-0x000001C96D6C5000-memory.dmp

Download

memory/2200-135-0x0000000000400000-0x0000000002B9D000-memory.dmp

Download

memory/2200-134-0x0000000000400000-0x0000000002B9D000-memory.dmp

Download

memory/2200-133-0x0000000002C60000-0x0000000002C69000-memory.dmp

Download

memory/2200-132-0x0000000002C99000-0x0000000002CAA000-memory.dmp

Download

memory/2280-182-0x000002ABF65D0000-0x000002ABF6710000-memory.dmp

Download

memory/2280-181-0x000002ABF65D0000-0x000002ABF6710000-memory.dmp

Download

memory/2280-189-0x000002ABF4B70000-0x000002ABF4E25000-memory.dmp

Download

memory/2280-185-0x000002ABF4B70000-0x000002ABF4E25000-memory.dmp

Download

memory/3084-184-0x00000000039B0000-0x0000000004505000-memory.dmp

Download

memory/3084-152-0x00000000039B0000-0x0000000004505000-memory.dmp

Download

memory/3084-162-0x00000000039B0000-0x0000000004505000-memory.dmp

Download

memory/4252-214-0x0000027977C80000-0x0000027977F35000-memory.dmp

Download

memory/4252-213-0x0000027977C80000-0x0000027977F35000-memory.dmp

Download

memory/4252-212-0x00000279796E0000-0x0000027979820000-memory.dmp

Download

memory/4252-211-0x00000279796E0000-0x0000027979820000-memory.dmp

Download

memory/4356-202-0x0000000000400000-0x0000000002BA6000-memory.dmp

Download

memory/4356-200-0x0000000002DC0000-0x0000000002DEA000-memory.dmp

Download

memory/4356-206-0x0000000000400000-0x0000000002BA6000-memory.dmp

Download

memory/4356-199-0x0000000002E99000-0x0000000002EB3000-memory.dmp

Download

memory/4748-163-0x0000000004940000-0x0000000005495000-memory.dmp

Download

memory/4748-164-0x0000000004940000-0x0000000005495000-memory.dmp

Download

memory/4836-207-0x0000000007300000-0x0000000007440000-memory.dmp

Download

memory/4836-147-0x0000000005970000-0x0000000005AB0000-memory.dmp

Download

memory/4836-194-0x0000000005970000-0x0000000005AB0000-memory.dmp

Download

memory/4836-193-0x0000000005970000-0x0000000005AB0000-memory.dmp

Download

memory/4836-192-0x0000000005970000-0x0000000005AB0000-memory.dmp

Download

memory/4836-191-0x0000000005970000-0x0000000005AB0000-memory.dmp

Download

memory/4836-209-0x0000000005970000-0x0000000005AB0000-memory.dmp

Download

memory/4836-166-0x0000000005970000-0x0000000005AB0000-memory.dmp

Download

memory/4836-167-0x0000000005970000-0x0000000005AB0000-memory.dmp

Download

memory/4836-148-0x0000000005970000-0x0000000005AB0000-memory.dmp

Download

memory/4836-208-0x0000000005970000-0x0000000005AB0000-memory.dmp

Download

memory/4836-165-0x0000000005970000-0x0000000005AB0000-memory.dmp

Download

memory/4836-146-0x0000000004D50000-0x00000000058A5000-memory.dmp

Download

memory/4836-168-0x0000000005970000-0x0000000005AB0000-memory.dmp

Download

memory/4836-179-0x0000000005970000-0x0000000005AB0000-memory.dmp

Download

memory/4836-205-0x0000000007300000-0x0000000007440000-memory.dmp

Download

memory/4836-178-0x0000000005970000-0x0000000005AB0000-memory.dmp

Download

memory/4836-177-0x0000000005970000-0x0000000005AB0000-memory.dmp

Download

memory/4836-176-0x0000000005970000-0x0000000005AB0000-memory.dmp

Download

memory/4836-161-0x0000000004D50000-0x00000000058A5000-memory.dmp

Download