Analysis
- max time kernel
148s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20221111-en - resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system - submitted
19/01/2023, 23:42
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20220812-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20221111-en
windows10-2004-x64
30 signatures
150 seconds
General
- Target file.exe
- Size 192KB
- Sample230119-3p1d8sef6x
- SHA256 567d4bf7dddbfbe906662cb71a45ed7d737cee2d83904349538d2d6ea2f004bd
- MD5 cfa1587949c1bf435672e83cfa46784d
- SHA1 11298d2457da5e25f6dc307593db5aaeae9d2347
- SHA512 aa5dbb7ae8a80a3075074401361a7462a0e1d818d6dc36d09e8dd333ec5d1cefb3e2312395d7c38c7595d1e2bded0402cf9ec6d00c169937db50e8e541d419f8
- SSDEEP 3072:QEZBN4X3+EJ30DfZGylUbSUW5hutH4T9Fb2IITfSX5Wh7pXc:ZqxJE7UbVcwH4T90gA7
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detects Smokeloader packer 1 IoCs
resource yara_rule behavioral2/memory/3440-133-0x0000000002C10000-0x0000000002C19000-memory.dmp family_smokeloader - SmokeLoader
Modular backdoor trojan in use since 2014.
- Blocklisted process makes network request 3 IoCs
flow pid Process 33 2588 rundll32.exe 35 2588 rundll32.exe 62 2588 rundll32.exe - Downloads MZ/PE file
- Executes dropped EXE 1 IoCs
pid Process 3768 F457.exe - Sets DLL path for service in the registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\review_same_reviewers\Parameters\ServiceDll = "C:\\Program Files (x86)\\Google\\Update\\review_same_reviewers.dll琀" rundll32.exe - Sets service image path in registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\review_same_reviewers\ImagePath = "C:\\Windows\\system32\\svchost.exe -k LocalService" rundll32.exe - Loads dropped DLL 1 IoCs
pid Process 2588 rundll32.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts rundll32.exe - Accesses Microsoft Outlook profiles 1 TTPs 4 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 rundll32.exe Key opened \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook rundll32.exe Key opened \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 rundll32.exe Key opened \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 rundll32.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2588 set thread context of 60 2588 rundll32.exe 92 - Drops file in Program Files directory 17 IoCs
description ioc Process File created C:\Program Files (x86)\Google\Update\aic_file_icons_retina_thumb_highContrast_bow.png rundll32.exe File created C:\Program Files (x86)\Google\Update\review_same_reviewers.dll rundll32.exe File created C:\Program Files (x86)\Google\Update\MCIMPP.mpp rundll32.exe File created C:\Program Files (x86)\Google\Update\Close.png rundll32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\hi_contrast\aic_file_icons_retina_thumb_highContrast_bow.png rundll32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\MPP\MCIMPP.mpp rundll32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\natives_blob.bin rundll32.exe File created C:\Program Files (x86)\Google\Update\br.gif rundll32.exe File created C:\Program Files (x86)\Google\Update\open_original_form.gif rundll32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\AppCenter_R.aapp rundll32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\br.gif rundll32.exe File created C:\Program Files (x86)\Google\Update\CPDF_RHP.aapp rundll32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\CPDF_RHP.aapp rundll32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\Close.png rundll32.exe File created C:\Program Files (x86)\Google\Update\Checkers.api rundll32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Checkers.api rundll32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\open_original_form.gif rundll32.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Program crash 1 IoCs
pid pid_target Process procid_target 4272 3768 WerFault.exe 87 - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe - Checks processor information in registry 2 TTPs 23 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Component Information rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Status rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\FeatureSet rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Identifier rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Platform Specific Field 1 rundll32.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\VendorIdentifier rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Previous Update Revision rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Configuration Data rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information rundll32.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor rundll32.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Status rundll32.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Internet Explorer\Toolbar Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1" Process not Found Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 Process not Found - Modifies registry class 30 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU Process not Found Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\NodeSlot = "1" Process not Found Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU rundll32.exe Set value (data) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 = 4e0031000000000034565805100054656d7000003a0009000400efbe6b558a6c34565c052e00000000000000000000000000000000000000000000000000fdc90801540065006d007000000014000000 Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = 00000000ffffffff Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f44471a0359723fa74489c55595fe6b30ee0000 Process not Found Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 Process not Found Set value (str) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic" Process not Found Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags Process not Found Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell rundll32.exe Set value (data) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 50003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014000000 Process not Found Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1 Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 820074001c0043465346160031000000000000000000100041707044617461000000741a595e96dfd3488d671733bcee28bac5cdfadf9f6756418947c5c76bc0b67f400009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004100700070004400610074006100000042000000 Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 Process not Found Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ Process not Found Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\WorkFolders Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\MRUListEx = ffffffff Process not Found Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell Process not Found Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings rundll32.exe Set value (data) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff Process not Found Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 Process not Found - Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2628 Process not Found - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3440 file.exe 3440 file.exe 2628 Process not Found 2628 Process not Found 2628 Process not Found 2628 Process not Found 2628 Process not Found 2628 Process not Found 2628 Process not Found 2628 Process not Found 2628 Process not Found 2628 Process not Found 2628 Process not Found 2628 Process not Found 2628 Process not Found 2628 Process not Found 2628 Process not Found 2628 Process not Found 2628 Process not Found 2628 Process not Found 2628 Process not Found 2628 Process not Found 2628 Process not Found 2628 Process not Found 2628 Process not Found 2628 Process not Found 2628 Process not Found 2628 Process not Found 2628 Process not Found 2628 Process not Found 2628 Process not Found 2628 Process not Found 2628 Process not Found 2628 Process not Found 2628 Process not Found 2628 Process not Found 2628 Process not Found 2628 Process not Found 2628 Process not Found 2628 Process not Found 2628 Process not Found 2628 Process not Found 2628 Process not Found 2628 Process not Found 2628 Process not Found 2628 Process not Found 2628 Process not Found 2628 Process not Found 2628 Process not Found 2628 Process not Found 2628 Process not Found 2628 Process not Found 2628 Process not Found 2628 Process not Found 2628 Process not Found 2628 Process not Found 2628 Process not Found 2628 Process not Found 2628 Process not Found 2628 Process not Found 2628 Process not Found 2628 Process not Found 2628 Process not Found 2628 Process not Found - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2628 Process not Found - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 3440 file.exe - Suspicious use of AdjustPrivilegeToken 23 IoCs
description pid Process Token: SeShutdownPrivilege 2628 Process not Found Token: SeCreatePagefilePrivilege 2628 Process not Found Token: SeDebugPrivilege 2588 rundll32.exe Token: SeShutdownPrivilege 2628 Process not Found Token: SeCreatePagefilePrivilege 2628 Process not Found Token: SeShutdownPrivilege 2628 Process not Found Token: SeCreatePagefilePrivilege 2628 Process not Found Token: SeShutdownPrivilege 2628 Process not Found Token: SeCreatePagefilePrivilege 2628 Process not Found Token: SeShutdownPrivilege 2628 Process not Found Token: SeCreatePagefilePrivilege 2628 Process not Found Token: SeShutdownPrivilege 2628 Process not Found Token: SeCreatePagefilePrivilege 2628 Process not Found Token: SeShutdownPrivilege 2628 Process not Found Token: SeCreatePagefilePrivilege 2628 Process not Found Token: SeShutdownPrivilege 2628 Process not Found Token: SeCreatePagefilePrivilege 2628 Process not Found Token: SeShutdownPrivilege 2628 Process not Found Token: SeCreatePagefilePrivilege 2628 Process not Found Token: SeShutdownPrivilege 2628 Process not Found Token: SeCreatePagefilePrivilege 2628 Process not Found Token: SeShutdownPrivilege 2628 Process not Found Token: SeCreatePagefilePrivilege 2628 Process not Found - Suspicious use of FindShellTrayWindow 10 IoCs
pid Process 2628 Process not Found 2628 Process not Found 2628 Process not Found 2628 Process not Found 2628 Process not Found 2628 Process not Found 2628 Process not Found 2628 Process not Found 2588 rundll32.exe 60 rundll32.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2628 Process not Found 2628 Process not Found - Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 2628 wrote to memory of 3768 2628 Process not Found 87 PID 2628 wrote to memory of 3768 2628 Process not Found 87 PID 2628 wrote to memory of 3768 2628 Process not Found 87 PID 3768 wrote to memory of 2588 3768 F457.exe 89 PID 3768 wrote to memory of 2588 3768 F457.exe 89 PID 3768 wrote to memory of 2588 3768 F457.exe 89 PID 2588 wrote to memory of 60 2588 rundll32.exe 92 PID 2588 wrote to memory of 60 2588 rundll32.exe 92 PID 2588 wrote to memory of 60 2588 rundll32.exe 92 PID 2588 wrote to memory of 1704 2588 rundll32.exe 93 PID 2588 wrote to memory of 1704 2588 rundll32.exe 93 PID 2588 wrote to memory of 1704 2588 rundll32.exe 93 PID 2588 wrote to memory of 4080 2588 rundll32.exe 96 PID 2588 wrote to memory of 4080 2588 rundll32.exe 96 PID 2588 wrote to memory of 4080 2588 rundll32.exe 96 - outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 rundll32.exe - outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 rundll32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:3440
-
C:\Users\Admin\AppData\Local\Temp\F457.exeC:\Users\Admin\AppData\Local\Temp\F457.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3768 -
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Users\Admin\AppData\Local\Temp\Thhqeqq.tmp",Yeytaeyds2⤵
- Blocklisted process makes network request
- Sets DLL path for service in the registry
- Sets service image path in registry
- Loads dropped DLL
- Accesses Microsoft Outlook accounts
- Accesses Microsoft Outlook profiles
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
PID:2588 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61 138343⤵
- Modifies registry class
- Suspicious use of FindShellTrayWindow
PID:60
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /End /tn \Microsoft\Windows\Wininet\CacheTask3⤵PID:1704
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Run /tn \Microsoft\Windows\Wininet\CacheTask3⤵PID:4080
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3768 -s 5282⤵
- Program crash
PID:4272
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3768 -ip 37681⤵PID:4500
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:2928
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k LocalService1⤵PID:3172
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\system32\rundll32.exe" "c:\program files (x86)\google\update\review_same_reviewers.dll",dhldZks5SQ==2⤵PID:4732
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Google\Update\review_same_reviewers.dll
- Size 762KB
- SHA256 e70ed6cd7206fbe8b9779f42f5583b8b2eda1c43bf24e7274298087f7d48f8cd
- MD5 18a43ad7ac29a615830c6afd6580f92c
- SHA1 1d636a48a5e39c2c187aa712415b556a4db297f6
- SHA512 e5566b644fe03fe3d914a613197fc37227613e942552d39d4ee562be303d70e81dc0661bc502e1da5868d2260b85ac1b71f4774215cce1076ff524da978d76ac
- SSDEEP 12288:6U8AxrHLRhARUrlIVniLwcXOCMN9xpDNuWfGHKhKMOJE6o4BcOe4RPX9:6J4zHAR2OnmwCmXvDNuWOqhKK6o4Bp5/
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Google\Update\review_same_reviewers.dll
- Size 762KB
- SHA256 e70ed6cd7206fbe8b9779f42f5583b8b2eda1c43bf24e7274298087f7d48f8cd
- MD5 18a43ad7ac29a615830c6afd6580f92c
- SHA1 1d636a48a5e39c2c187aa712415b556a4db297f6
- SHA512 e5566b644fe03fe3d914a613197fc37227613e942552d39d4ee562be303d70e81dc0661bc502e1da5868d2260b85ac1b71f4774215cce1076ff524da978d76ac
- SSDEEP 12288:6U8AxrHLRhARUrlIVniLwcXOCMN9xpDNuWfGHKhKMOJE6o4BcOe4RPX9:6J4zHAR2OnmwCmXvDNuWOqhKK6o4Bp5/
- MD5 SHA1 SHA512 SSDEEP
- Path C:\ProgramData\{20975B9B-A8E0-9ADF-1023-6C9A2360079C}\Microsoft.People_2019.305.632.0_neutral_~_8wekyb3d8bbwe.xml
- Size 15KB
- SHA256 1ee54a9294af6727770aff79f2c901cd40ca23dfb4803788042aada54146e355
- MD5 c73eeb9dedd94a612969e003260e6341
- SHA1 0451277183bad12e3179c12c0a14694fab52bc8d
- SHA512 d78542d9c74efeac1d925d9d05c691c5543d04e6b671a5ef160f0fafc3b4444d327cf37206d78f43b607f817b6545cb9673b85d713b8c59d0c97103aee55245a
- SSDEEP 384:Q7yL07yLH7p7Y7h7b7u7h7F7oR7Z7m7H7b+7e7q7c7p7w7TQ707Z7V7p7FH7r7X6:Q7yL07yLH7p7Y7h7b7u7h7F7oR7Z7m7n
- MD5 SHA1 SHA512 SSDEEP
- Path C:\ProgramData\{20975B9B-A8E0-9ADF-1023-6C9A2360079C}\MicrosoftInternetExplorer2013.xml
- Size 3KB
- SHA256 30224904419fbc821d52e4e78ceed00115c5a74aa3581b89dc5026223194171a
- MD5 39809802833d898662c89d1d8ae84404
- SHA1 d58f9d9ee2bd76ef129e48266cf94b72a28d0bb5
- SHA512 907515f52c1c2e88862a2d1ce5fb2554eae5accd0c6bf0ce64ff011e9d62f1c06160118890e749e601338abb7d29498b4fe28ce8b5ed35a79c412349aa9e7b95
- MD5 SHA1 SHA512
- Path C:\ProgramData\{20975B9B-A8E0-9ADF-1023-6C9A2360079C}\SmsInterceptStore.jfm
- Size 16KB
- SHA256 9d6bac58cea0733dd170ce5aa77c11217f00bb395cf569f8a5f645ac2919445a
- MD5 8ad8eabf315217362a2392acce762345
- SHA1 1a2dafdf90dd56fd53dc623b7cfa00f13f1d24e8
- SHA512 6da2b3309f948e2244840ccc7301eafaf7e0db2426f8b6cc01027d821d89f6fc724fc1043ddfa645ea23991c64ea5a82d356baaddb43dd76a77be89955f01e77
- SSDEEP 3:FyQHbpvMoMlzFoougcTNM/eNMlYllvKWvsllF/w5/ll:USNkLXoztNFNMew1qt
- MD5 SHA1 SHA512 SSDEEP
- Path C:\ProgramData\{20975B9B-A8E0-9ADF-1023-6C9A2360079C}\Tqeowahqrywaui.tmp
- Size 3.5MB
- SHA256 a32ad57cac86e5ddc14d29473fd19e4b4a7f1aee3b409d18ee16e5f72c8157fc
- MD5 69f6682297e751697d1254ab2d221b3c
- SHA1 60ab87a13c33ce3686cd57e53bd7df0f360bd4ce
- SHA512 b24ced9ddf2f44d29dec1d45b00ef3a258075f0c31aff4f5aa077d3ab5d9f8db0afefcbe7eb3484f0c37bdee027566c98d1d88ec1d1ee9b469449734a88321b5
- SSDEEP 98304:0VWsiWdrvixgf6AghKy+9GD9BHlfjSTkN64lLY4SWYwh:0NraPNU9GD3Rkkg4lLYpm
- MD5 SHA1 SHA512 SSDEEP
- Path C:\ProgramData\{20975B9B-A8E0-9ADF-1023-6C9A2360079C}\Tqeowahqrywaui.tmp
- Size 3.5MB
- SHA256 a32ad57cac86e5ddc14d29473fd19e4b4a7f1aee3b409d18ee16e5f72c8157fc
- MD5 69f6682297e751697d1254ab2d221b3c
- SHA1 60ab87a13c33ce3686cd57e53bd7df0f360bd4ce
- SHA512 b24ced9ddf2f44d29dec1d45b00ef3a258075f0c31aff4f5aa077d3ab5d9f8db0afefcbe7eb3484f0c37bdee027566c98d1d88ec1d1ee9b469449734a88321b5
- SSDEEP 98304:0VWsiWdrvixgf6AghKy+9GD9BHlfjSTkN64lLY4SWYwh:0NraPNU9GD3Rkkg4lLYpm
- MD5 SHA1 SHA512 SSDEEP
- Path C:\ProgramData\{20975B9B-A8E0-9ADF-1023-6C9A2360079C}\stream.x64.en-us.man.dat
- Size 622KB
- SHA256 d21c0fb073320a1a17e0c9a7dc5a0346af74b6e002be4ae1a626e6f3ec0efa85
- MD5 18b7413b8d54bceff3c29565622d6e63
- SHA1 cbf2e4bf2c3f65035d4060a9dcaefdc710f4e04e
- SHA512 ef0e765d41ce07b17289cbae6afe3ec90b53fc0b5f3491113988d443c00fe0dd189cd74013d3c9b36b56375958d5730afb257b99e5612cee4b3e106a1c45fd3c
- SSDEEP 6144:/ZS7x+eUM6l4uNPoqaHH5+YvC8yPcLJ/mJQLxZRL+:ENUM6l4QglHXvly0hRy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\F457.exe
- Size 1.0MB
- SHA256 e364258d2687c91bb74d246419612ded19e832d2e4cf613cfa5859d300aca470
- MD5 65564c8de1e1527c0509f438aa4ac1d8
- SHA1 1fc12d1273e4ca0f8f3fa4d1dae90cc5bfb8d6de
- SHA512 b03f360cea964be91b1cf80449b238fc869d0967cf33a39faeb4790b495a7fcce56ba6174c56222fd82b1df0c7d538f1557e33541ae72fd9d55ae203627e775d
- SSDEEP 24576:ePEEt2e24KKz6ByT4VnmBHSWPvN5Kg9+MdVW7BMBc6o30aFqX1+0kTmYouT+:es+2eMWHSISWNoM+u87BMBOE1+Tqu
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\F457.exe
- Size 1.0MB
- SHA256 e364258d2687c91bb74d246419612ded19e832d2e4cf613cfa5859d300aca470
- MD5 65564c8de1e1527c0509f438aa4ac1d8
- SHA1 1fc12d1273e4ca0f8f3fa4d1dae90cc5bfb8d6de
- SHA512 b03f360cea964be91b1cf80449b238fc869d0967cf33a39faeb4790b495a7fcce56ba6174c56222fd82b1df0c7d538f1557e33541ae72fd9d55ae203627e775d
- SSDEEP 24576:ePEEt2e24KKz6ByT4VnmBHSWPvN5Kg9+MdVW7BMBc6o30aFqX1+0kTmYouT+:es+2eMWHSISWNoM+u87BMBOE1+Tqu
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\Thhqeqq.tmp
- Size 762KB
- SHA256 fdafcea4a906ec7204c7b6991ca6c9640c9a54f1679bc1df6684f6716cef56ef
- MD5 8e97014f76ad5d0c5ef82a2dd677d148
- SHA1 ed5840eee43db643be3573a545f64c9cae28898c
- SHA512 b518ff57c6c9c739bfb02c80c700b229e7a31ce6b4ca7553856aab1d35cbbd457705a56e88a0d4e3f78ae3ed6b7d987b43d4456eb724c44aa8e9e7812b5f0111
- SSDEEP 12288:VU8AxrHLRhARUrlIVniLwcXOCMN9xpDNuWfGHKhKMOJE6o4BcOe4RPX9:VJ4zHAR2OnmwCmXvDNuWOqhKK6o4Bp5/
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\Thhqeqq.tmp
- Size 762KB
- SHA256 fdafcea4a906ec7204c7b6991ca6c9640c9a54f1679bc1df6684f6716cef56ef
- MD5 8e97014f76ad5d0c5ef82a2dd677d148
- SHA1 ed5840eee43db643be3573a545f64c9cae28898c
- SHA512 b518ff57c6c9c739bfb02c80c700b229e7a31ce6b4ca7553856aab1d35cbbd457705a56e88a0d4e3f78ae3ed6b7d987b43d4456eb724c44aa8e9e7812b5f0111
- SSDEEP 12288:VU8AxrHLRhARUrlIVniLwcXOCMN9xpDNuWfGHKhKMOJE6o4BcOe4RPX9:VJ4zHAR2OnmwCmXvDNuWOqhKK6o4Bp5/
- MD5 SHA1 SHA512 SSDEEP
- Path \??\c:\program files (x86)\google\update\review_same_reviewers.dll
- Size 762KB
- SHA256 e70ed6cd7206fbe8b9779f42f5583b8b2eda1c43bf24e7274298087f7d48f8cd
- MD5 18a43ad7ac29a615830c6afd6580f92c
- SHA1 1d636a48a5e39c2c187aa712415b556a4db297f6
- SHA512 e5566b644fe03fe3d914a613197fc37227613e942552d39d4ee562be303d70e81dc0661bc502e1da5868d2260b85ac1b71f4774215cce1076ff524da978d76ac
- SSDEEP 12288:6U8AxrHLRhARUrlIVniLwcXOCMN9xpDNuWfGHKhKMOJE6o4BcOe4RPX9:6J4zHAR2OnmwCmXvDNuWOqhKK6o4Bp5/
- MD5 SHA1 SHA512 SSDEEP