Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
19-12-2023 10:33
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
07e66076479143a29bbaec9da8864b2c.exe
Resource
win7-20231215-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
07e66076479143a29bbaec9da8864b2c.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
10 signatures
150 seconds
General
-
Target
07e66076479143a29bbaec9da8864b2c.exe
-
Size
383KB
-
MD5
07e66076479143a29bbaec9da8864b2c
-
SHA1
ea87030e928ce37dc60918c21d90b52b1989f9ba
-
SHA256
1c7235c940de810ecc7a9399ee35cb5d9c92c8c1d63736d42ecbe3e9c5e03c40
-
SHA512
0dcfd97a1091ba88d845e06c33eb677b7ded09563c8a9fd99d19c2213b99e92c8c4cc8ee71c7c9c65de83d254a4fe380d6e059cdf75ea56d965d4b192a57df97
-
SSDEEP
3072:B7puEEMoTEqTY9VfrW7puEEMoTEqTY9VfrWqilLoME2PLgx4HS9aukflTOAx06Np:ppMM8EV1GpMM8EV1WoME1ESbkflTOASa
Score
8/10
Malware Config
Signatures
-
Contacts a large (1221) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ati display driver = "ÔN@" 07e66076479143a29bbaec9da8864b2c.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\unlodctr.exe- 07e66076479143a29bbaec9da8864b2c.exe File created C:\Windows\SysWOW64\more.com_ 07e66076479143a29bbaec9da8864b2c.exe File created C:\Windows\SysWOW64\rasphone.exe 07e66076479143a29bbaec9da8864b2c.exe File created C:\Windows\SysWOW64\systray.exe_ 07e66076479143a29bbaec9da8864b2c.exe File created C:\Windows\SysWOW64\relog.exe- 07e66076479143a29bbaec9da8864b2c.exe File created C:\Windows\SysWOW64\EaseOfAccessDialog.exe_ 07e66076479143a29bbaec9da8864b2c.exe File created C:\Windows\SysWOW64\hdwwiz.exe_ 07e66076479143a29bbaec9da8864b2c.exe File created C:\Windows\SysWOW64\ipconfig.exe_ 07e66076479143a29bbaec9da8864b2c.exe File created C:\Windows\SysWOW64\Netplwiz.exe- 07e66076479143a29bbaec9da8864b2c.exe File created C:\Windows\SysWOW64\OpenWith.exe- 07e66076479143a29bbaec9da8864b2c.exe File created C:\Windows\SysWOW64\ReAgentc.exe 07e66076479143a29bbaec9da8864b2c.exe File created C:\Windows\SysWOW64\secinit.exe- 07e66076479143a29bbaec9da8864b2c.exe File created C:\Windows\SysWOW64\certutil.exe_ 07e66076479143a29bbaec9da8864b2c.exe File created C:\Windows\SysWOW64\dfrgui.exe- 07e66076479143a29bbaec9da8864b2c.exe File created C:\Windows\SysWOW64\logman.exe- 07e66076479143a29bbaec9da8864b2c.exe File created C:\Windows\SysWOW64\InfDefaultInstall.exe 07e66076479143a29bbaec9da8864b2c.exe File created C:\Windows\SysWOW64\SystemPropertiesPerformance.exe_ 07e66076479143a29bbaec9da8864b2c.exe File created C:\Windows\SysWOW64\comp.exe_ 07e66076479143a29bbaec9da8864b2c.exe File created C:\Windows\SysWOW64\rundll32.exe- 07e66076479143a29bbaec9da8864b2c.exe File created C:\Windows\SysWOW64\TpmInit.exe_ 07e66076479143a29bbaec9da8864b2c.exe File created C:\Windows\SysWOW64\OpenWith.exe_ 07e66076479143a29bbaec9da8864b2c.exe File created C:\Windows\SysWOW64\ByteCodeGenerator.exe_ 07e66076479143a29bbaec9da8864b2c.exe File created C:\Windows\SysWOW64\dxdiag.exe 07e66076479143a29bbaec9da8864b2c.exe File created C:\Windows\SysWOW64\IME\SHARED\imecfmui.exe- 07e66076479143a29bbaec9da8864b2c.exe File created C:\Windows\SysWOW64\typeperf.exe_ 07e66076479143a29bbaec9da8864b2c.exe File created C:\Windows\SysWOW64\clip.exe- 07e66076479143a29bbaec9da8864b2c.exe File created C:\Windows\SysWOW64\IME\SHARED\IMCCPHR.exe_ 07e66076479143a29bbaec9da8864b2c.exe File created C:\Windows\SysWOW64\mountvol.exe- 07e66076479143a29bbaec9da8864b2c.exe File created C:\Windows\SysWOW64\wbem\WmiPrvSE.exe- 07e66076479143a29bbaec9da8864b2c.exe File created C:\Windows\SysWOW64\odbcconf.exe- 07e66076479143a29bbaec9da8864b2c.exe File created C:\Windows\SysWOW64\SyncHost.exe- 07e66076479143a29bbaec9da8864b2c.exe File created C:\Windows\SysWOW64\tasklist.exe_ 07e66076479143a29bbaec9da8864b2c.exe File created C:\Windows\SysWOW64\GameBarPresenceWriter.exe 07e66076479143a29bbaec9da8864b2c.exe File created C:\Windows\SysWOW64\CameraSettingsUIHost.exe 07e66076479143a29bbaec9da8864b2c.exe File created C:\Windows\SysWOW64\ctfmon.exe 07e66076479143a29bbaec9da8864b2c.exe File created C:\Windows\SysWOW64\eudcedit.exe- 07e66076479143a29bbaec9da8864b2c.exe File created C:\Windows\SysWOW64\InstallShield\setup.exe_ 07e66076479143a29bbaec9da8864b2c.exe File created C:\Windows\SysWOW64\SecEdit.exe_ 07e66076479143a29bbaec9da8864b2c.exe File created C:\Windows\SysWOW64\wbem\WmiPrvSE.exe_ 07e66076479143a29bbaec9da8864b2c.exe File created C:\Windows\SysWOW64\SystemPropertiesProtection.exe- 07e66076479143a29bbaec9da8864b2c.exe File created C:\Windows\SysWOW64\cscript.exe_ 07e66076479143a29bbaec9da8864b2c.exe File created C:\Windows\SysWOW64\Dism\DismHost.exe 07e66076479143a29bbaec9da8864b2c.exe File created C:\Windows\SysWOW64\reg.exe_ 07e66076479143a29bbaec9da8864b2c.exe File created C:\Windows\SysWOW64\cleanmgr.exe- 07e66076479143a29bbaec9da8864b2c.exe File created C:\Windows\SysWOW64\ctfmon.exe- 07e66076479143a29bbaec9da8864b2c.exe File created C:\Windows\SysWOW64\Dism.exe- 07e66076479143a29bbaec9da8864b2c.exe File created C:\Windows\SysWOW64\poqexec.exe_ 07e66076479143a29bbaec9da8864b2c.exe File created C:\Windows\SysWOW64\raserver.exe_ 07e66076479143a29bbaec9da8864b2c.exe File created C:\Windows\SysWOW64\appidtel.exe_ 07e66076479143a29bbaec9da8864b2c.exe File created C:\Windows\SysWOW64\autochk.exe 07e66076479143a29bbaec9da8864b2c.exe File created C:\Windows\SysWOW64\net.exe_ 07e66076479143a29bbaec9da8864b2c.exe File created C:\Windows\SysWOW64\scrnsave.scr_ 07e66076479143a29bbaec9da8864b2c.exe File created C:\Windows\SysWOW64\sort.exe_ 07e66076479143a29bbaec9da8864b2c.exe File created C:\Windows\SysWOW64\iscsicpl.exe_ 07e66076479143a29bbaec9da8864b2c.exe File created C:\Windows\SysWOW64\TRACERT.EXE_ 07e66076479143a29bbaec9da8864b2c.exe File created C:\Windows\SysWOW64\PING.EXE 07e66076479143a29bbaec9da8864b2c.exe File created C:\Windows\SysWOW64\waitfor.exe 07e66076479143a29bbaec9da8864b2c.exe File created C:\Windows\SysWOW64\WerFault.exe_ 07e66076479143a29bbaec9da8864b2c.exe File created C:\Windows\SysWOW64\doskey.exe 07e66076479143a29bbaec9da8864b2c.exe File created C:\Windows\SysWOW64\IME\SHARED\IMEWDBLD.EXE- 07e66076479143a29bbaec9da8864b2c.exe File created C:\Windows\SysWOW64\perfhost.exe- 07e66076479143a29bbaec9da8864b2c.exe File created C:\Windows\SysWOW64\mode.com- 07e66076479143a29bbaec9da8864b2c.exe File created C:\Windows\SysWOW64\rekeywiz.exe_ 07e66076479143a29bbaec9da8864b2c.exe File created C:\Windows\SysWOW64\takeown.exe- 07e66076479143a29bbaec9da8864b2c.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe_ 07e66076479143a29bbaec9da8864b2c.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe_ 07e66076479143a29bbaec9da8864b2c.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE- 07e66076479143a29bbaec9da8864b2c.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe 07e66076479143a29bbaec9da8864b2c.exe File created C:\Program Files (x86)\Internet Explorer\ieinstal.exe_ 07e66076479143a29bbaec9da8864b2c.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.181.5\MicrosoftEdgeUpdateCore.exe 07e66076479143a29bbaec9da8864b2c.exe File created C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE 07e66076479143a29bbaec9da8864b2c.exe File created C:\Program Files\Java\jdk-1.8\bin\javadoc.exe 07e66076479143a29bbaec9da8864b2c.exe File created C:\Program Files\Java\jdk-1.8\bin\kinit.exe_ 07e66076479143a29bbaec9da8864b2c.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe_ 07e66076479143a29bbaec9da8864b2c.exe File created C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\onenoteim.exe- 07e66076479143a29bbaec9da8864b2c.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe 07e66076479143a29bbaec9da8864b2c.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe_ 07e66076479143a29bbaec9da8864b2c.exe File created C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE 07e66076479143a29bbaec9da8864b2c.exe File created C:\Program Files\Windows Media Player\wmplayer.exe- 07e66076479143a29bbaec9da8864b2c.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe- 07e66076479143a29bbaec9da8864b2c.exe File created C:\Program Files\Java\jdk-1.8\bin\wsimport.exe 07e66076479143a29bbaec9da8864b2c.exe File created C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe- 07e66076479143a29bbaec9da8864b2c.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe- 07e66076479143a29bbaec9da8864b2c.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe 07e66076479143a29bbaec9da8864b2c.exe File created C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeApp.exe- 07e66076479143a29bbaec9da8864b2c.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Time.exe_ 07e66076479143a29bbaec9da8864b2c.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe 07e66076479143a29bbaec9da8864b2c.exe File created C:\Program Files\Java\jre-1.8\bin\javacpl.exe 07e66076479143a29bbaec9da8864b2c.exe File created C:\Program Files\Java\jdk-1.8\bin\idlj.exe_ 07e66076479143a29bbaec9da8864b2c.exe File created C:\Program Files\Java\jdk-1.8\bin\jjs.exe- 07e66076479143a29bbaec9da8864b2c.exe File created C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe_ 07e66076479143a29bbaec9da8864b2c.exe File created C:\Program Files\Java\jre-1.8\bin\orbd.exe 07e66076479143a29bbaec9da8864b2c.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe 07e66076479143a29bbaec9da8864b2c.exe File created C:\Program Files\Java\jdk-1.8\bin\klist.exe- 07e66076479143a29bbaec9da8864b2c.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe- 07e66076479143a29bbaec9da8864b2c.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe_ 07e66076479143a29bbaec9da8864b2c.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe 07e66076479143a29bbaec9da8864b2c.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe_ 07e66076479143a29bbaec9da8864b2c.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe- 07e66076479143a29bbaec9da8864b2c.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe- 07e66076479143a29bbaec9da8864b2c.exe File created C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Microsoft.Photos.exe- 07e66076479143a29bbaec9da8864b2c.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\PilotshubApp.exe_ 07e66076479143a29bbaec9da8864b2c.exe File created C:\Program Files\Java\jdk-1.8\bin\orbd.exe- 07e66076479143a29bbaec9da8864b2c.exe File created C:\Program Files\Mozilla Firefox\crashreporter.exe_ 07e66076479143a29bbaec9da8864b2c.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe 07e66076479143a29bbaec9da8864b2c.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\msedge_pwa_launcher.exe 07e66076479143a29bbaec9da8864b2c.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\pwahelper.exe_ 07e66076479143a29bbaec9da8864b2c.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.181.5\MicrosoftEdgeUpdateOnDemand.exe- 07e66076479143a29bbaec9da8864b2c.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.181.5\MicrosoftEdgeUpdateSetup.exe_ 07e66076479143a29bbaec9da8864b2c.exe File created C:\Program Files\Java\jdk-1.8\bin\javac.exe 07e66076479143a29bbaec9da8864b2c.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE- 07e66076479143a29bbaec9da8864b2c.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe_ 07e66076479143a29bbaec9da8864b2c.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe_ 07e66076479143a29bbaec9da8864b2c.exe File created C:\Program Files\Java\jdk-1.8\bin\keytool.exe_ 07e66076479143a29bbaec9da8864b2c.exe File created C:\Program Files (x86)\Windows Media Player\wmpshare.exe- 07e66076479143a29bbaec9da8864b2c.exe File created C:\Program Files\Java\jdk-1.8\bin\idlj.exe- 07e66076479143a29bbaec9da8864b2c.exe File created C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe_ 07e66076479143a29bbaec9da8864b2c.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\msedge.exe- 07e66076479143a29bbaec9da8864b2c.exe File created C:\Program Files\7-Zip\7z.exe_ 07e66076479143a29bbaec9da8864b2c.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE- 07e66076479143a29bbaec9da8864b2c.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE 07e66076479143a29bbaec9da8864b2c.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe 07e66076479143a29bbaec9da8864b2c.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxTsr.exe- 07e66076479143a29bbaec9da8864b2c.exe File created C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.46.11001.0_x64__8wekyb3d8bbwe\GameBar.exe- 07e66076479143a29bbaec9da8864b2c.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe_ 07e66076479143a29bbaec9da8864b2c.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE 07e66076479143a29bbaec9da8864b2c.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe 07e66076479143a29bbaec9da8864b2c.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe- 07e66076479143a29bbaec9da8864b2c.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-onecore-d..ectxdatabaseupdater_31bf3856ad364e35_10.0.19041.84_none_2d21e26a18d595c7\directxdatabaseupdater.exe_ 07e66076479143a29bbaec9da8864b2c.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..ation-wincomponents_31bf3856ad364e35_10.0.19041.746_none_79bfc5cb57157e98\WindowsActionDialog.exe- 07e66076479143a29bbaec9da8864b2c.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-provisioning-platform_31bf3856ad364e35_10.0.19041.844_none_487fcc4fe2c3cfbb\provlaunch.exe- 07e66076479143a29bbaec9da8864b2c.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-com-surrogate-core_31bf3856ad364e35_10.0.19041.546_none_1d38815769c81e5a\dllhost.exe- 07e66076479143a29bbaec9da8864b2c.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..me-japanese-setting_31bf3856ad364e35_10.0.19041.1_none_7275aff6509d3c66\IMJPSET.EXE- 07e66076479143a29bbaec9da8864b2c.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..onment-core-tcbboot_31bf3856ad364e35_10.0.19041.1288_none_75442af2fe19577c\r\tcblaunch.exe_ 07e66076479143a29bbaec9da8864b2c.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-networkbridge_31bf3856ad364e35_10.0.19041.746_none_e5e33ba764e4ddec\bridgeunattend.exe- 07e66076479143a29bbaec9da8864b2c.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..ed-telemetry-client_31bf3856ad364e35_10.0.19041.264_none_7dd490aa65cdf624\r\runexehelper.exe_ 07e66076479143a29bbaec9da8864b2c.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-msconfig-exe_31bf3856ad364e35_10.0.19041.1110_none_4f46693352ed3250\r\msconfig.exe- 07e66076479143a29bbaec9da8864b2c.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..alservices-webproxy_31bf3856ad364e35_10.0.19041.746_none_0f70f5a5b71ec478\r\TSWbPrxy.exe_ 07e66076479143a29bbaec9da8864b2c.exe File created C:\Windows\SystemApps\Microsoft.AsyncTextService_8wekyb3d8bbwe\Microsoft.AsyncTextService.exe_ 07e66076479143a29bbaec9da8864b2c.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-castserver_31bf3856ad364e35_10.0.19041.746_none_a5986eca8fd4063b\r\CastSrv.exe_ 07e66076479143a29bbaec9da8864b2c.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mediaplayer-setup_31bf3856ad364e35_10.0.19041.1_none_63e4d70575e86068\unregmp2.exe- 07e66076479143a29bbaec9da8864b2c.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tabletpc-inputpanel_31bf3856ad364e35_10.0.19041.844_none_ef8661e4d6535c5c\r\TabTip.exe- 07e66076479143a29bbaec9da8864b2c.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-verclsid_31bf3856ad364e35_10.0.19041.1_none_71d7deb9b2d1d29b\verclsid.exe- 07e66076479143a29bbaec9da8864b2c.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe 07e66076479143a29bbaec9da8864b2c.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.19041.1202_none_4132a4047d5d53b2\f\AppVStreamingUX.exe_ 07e66076479143a29bbaec9da8864b2c.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_10.0.19041.1_none_3d62a57d3b12dcf1\print.exe_ 07e66076479143a29bbaec9da8864b2c.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-errorreportingcore_31bf3856ad364e35_10.0.19041.264_none_fe5852f864c5941f\r\wermgr.exe- 07e66076479143a29bbaec9da8864b2c.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-shell-previewhost_31bf3856ad364e35_10.0.19041.746_none_2136afef5fadeaa4\prevhost.exe_ 07e66076479143a29bbaec9da8864b2c.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe 07e66076479143a29bbaec9da8864b2c.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-taskkill_31bf3856ad364e35_10.0.19041.1_none_db6f0c88fb6e127a\taskkill.exe- 07e66076479143a29bbaec9da8864b2c.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-legacyhwui_31bf3856ad364e35_10.0.19041.1_none_a2b9da391bff31c4\hdwwiz.exe_ 07e66076479143a29bbaec9da8864b2c.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-sethc_31bf3856ad364e35_10.0.19041.746_none_4b0e3418084b5511\f\EaseOfAccessDialog.exe_ 07e66076479143a29bbaec9da8864b2c.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-fileexplorer.appxmain_31bf3856ad364e35_10.0.19041.153_none_47569e595c44e70c\f\FileExplorer.exe- 07e66076479143a29bbaec9da8864b2c.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lua_31bf3856ad364e35_10.0.19041.1_none_5c3b6ab5fc28f1f3\consent.exe_ 07e66076479143a29bbaec9da8864b2c.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-unp_31bf3856ad364e35_10.0.19041.264_none_8adc8bd8b75d383f\UpdateNotificationMgr.exe- 07e66076479143a29bbaec9da8864b2c.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wpd-shellextension_31bf3856ad364e35_10.0.19041.1_none_c719fa2e662738e0\WPDShextAutoplay.exe_ 07e66076479143a29bbaec9da8864b2c.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_10.0.19041.1_none_3d62a57d3b12dcf1\subst.exe- 07e66076479143a29bbaec9da8864b2c.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-microsoftedge_31bf3856ad364e35_10.0.19041.264_none_ef195f564f00d259\r\MicrosoftEdge.exe- 07e66076479143a29bbaec9da8864b2c.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..alcontrols.appxmain_31bf3856ad364e35_10.0.19041.1_none_595f2a7acaf53bba\WpcUapApp.exe_ 07e66076479143a29bbaec9da8864b2c.exe File created C:\Windows\WinSxS\amd64_windows-senseclient-service_31bf3856ad364e35_10.0.19041.1288_none_1cec63974464878f\n\SenseNdr.exe_ 07e66076479143a29bbaec9da8864b2c.exe File created C:\Windows\WinSxS\x86_aspnet_regbrowsers_b03f5f7f11d50a3a_10.0.19041.1_none_ca50a32caa12ab10\aspnet_regbrowsers.exe- 07e66076479143a29bbaec9da8864b2c.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-unp_31bf3856ad364e35_10.0.19041.1266_none_21c0be7c0dad3632\UNPUXLauncher.exe_ 07e66076479143a29bbaec9da8864b2c.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmi-core_31bf3856ad364e35_10.0.19041.1_none_6f451098bef6266e\mofcomp.exe_ 07e66076479143a29bbaec9da8864b2c.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-a..l-systemuwplauncher_31bf3856ad364e35_10.0.19041.746_none_ed5986fc58f1b817\f\SystemUWPLauncher.exe_ 07e66076479143a29bbaec9da8864b2c.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.19041.1266_none_8a8440f738abd1b9\r\wmplayer.exe_ 07e66076479143a29bbaec9da8864b2c.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..eldebugger-recorder_31bf3856ad364e35_10.0.19041.746_none_4cb1ff2aa122b5dd\r\tttracer.exe_ 07e66076479143a29bbaec9da8864b2c.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-settingsynchost_31bf3856ad364e35_10.0.19041.1202_none_fef803c70cc0b37b\r\SettingSyncHost.exe_ 07e66076479143a29bbaec9da8864b2c.exe File created C:\Windows\WinSxS\wow64_microsoft-xbox-gameoverlay_31bf3856ad364e35_10.0.19041.746_none_2703bed0ba809808\r\GamePanel.exe_ 07e66076479143a29bbaec9da8864b2c.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..andlinepropertytool_31bf3856ad364e35_10.0.19041.844_none_e9349b06dfab6fdc\f\imjpuexc.exe_ 07e66076479143a29bbaec9da8864b2c.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ie-setup-support_31bf3856ad364e35_11.0.19041.1081_none_7e66aef13d0cb227\f\ie4uinit.exe_ 07e66076479143a29bbaec9da8864b2c.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-virtualdiskservice_31bf3856ad364e35_10.0.19041.1202_none_dfaaff89afe4f3d4\f\vdsldr.exe- 07e66076479143a29bbaec9da8864b2c.exe File created C:\Windows\WinSxS\amd64_vmconnect6.3_31bf3856ad364e35_10.0.19041.1_none_5c4ad75abbc47892\vmconnect6.3.exe_ 07e66076479143a29bbaec9da8864b2c.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-netbt_31bf3856ad364e35_10.0.19041.746_none_48b2bd808a742e25\netbtugc.exe_ 07e66076479143a29bbaec9da8864b2c.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-host-service_31bf3856ad364e35_10.0.19041.264_none_d58a0ca50a94510c\f\vmcompute.exe_ 07e66076479143a29bbaec9da8864b2c.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-deviceenroller_31bf3856ad364e35_10.0.19041.1202_none_36057e94c281704a\DeviceEnroller.exe_ 07e66076479143a29bbaec9da8864b2c.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-filtermanager-utils_31bf3856ad364e35_10.0.19041.546_none_f786fa028426f858\f\fltMC.exe_ 07e66076479143a29bbaec9da8864b2c.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ldifde_31bf3856ad364e35_10.0.19041.1_none_d6d84e47a8300235\ldifde.exe- 07e66076479143a29bbaec9da8864b2c.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..eldebugger-recorder_31bf3856ad364e35_10.0.19041.746_none_4cb1ff2aa122b5dd\ttdinject.exe_ 07e66076479143a29bbaec9da8864b2c.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-os-kernel_31bf3856ad364e35_10.0.19041.1288_none_e0f8082a6952ce81\ntoskrnl.exe- 07e66076479143a29bbaec9da8864b2c.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-atbroker_31bf3856ad364e35_10.0.19041.1023_none_4478665ed379a3fc\AtBroker.exe_ 07e66076479143a29bbaec9da8864b2c.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-office-csp_31bf3856ad364e35_10.0.19041.1_none_735c6874d3056a0a\ofdeploy.exe- 07e66076479143a29bbaec9da8864b2c.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-shellhost_31bf3856ad364e35_10.0.19041.746_none_f47187f881cbaf7d\r\sihost.exe_ 07e66076479143a29bbaec9da8864b2c.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..environment-windows_31bf3856ad364e35_10.0.19041.1_none_1f29a4ae2c282494\winresume.exe- 07e66076479143a29bbaec9da8864b2c.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedaccess_31bf3856ad364e35_10.0.19041.746_none_e2c6a972a81b8d2c\r\icsunattend.exe- 07e66076479143a29bbaec9da8864b2c.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..eldebugger-recorder_31bf3856ad364e35_10.0.19041.746_none_425d54d86cc1f3e2\f\tttracer.exe- 07e66076479143a29bbaec9da8864b2c.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-virtualdiskservice_31bf3856ad364e35_10.0.19041.1202_none_dfaaff89afe4f3d4\f\vdsldr.exe_ 07e66076479143a29bbaec9da8864b2c.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-openfiles_31bf3856ad364e35_10.0.19041.1_none_a76c1ed6be227279\openfiles.exe_ 07e66076479143a29bbaec9da8864b2c.exe File created C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMConfigInstaller.exe_ 07e66076479143a29bbaec9da8864b2c.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\DataSvcUtil.exe 07e66076479143a29bbaec9da8864b2c.exe File created C:\Windows\WinSxS\amd64_microsoft-hyper-v-drivers-hypervisor_31bf3856ad364e35_10.0.19041.264_none_0e32f443c4669fed\f\hvax64.exe- 07e66076479143a29bbaec9da8864b2c.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-uevagent_31bf3856ad364e35_10.0.19041.1288_none_71734bf99a2a6955\r\ApplySettingsTemplateCatalog.exe- 07e66076479143a29bbaec9da8864b2c.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-coresystem-wpr_31bf3856ad364e35_10.0.19041.746_none_4028b8f4f6c0b829\r\wpr.exe- 07e66076479143a29bbaec9da8864b2c.exe -
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" IEXPLORE.exe Set value (int) \REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31076980" IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames IEXPLORE.exe Set value (int) \REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1203965765" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409752739" IEXPLORE.exe Set value (int) \REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" IEXPLORE.exe Set value (int) \REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{7311FD8A-9E67-11EE-9963-D2066D8F1295} = "0" IEXPLORE.exe Set value (int) \REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31076980" IEXPLORE.exe Set value (data) \REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60cad2487432da01 IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\Software\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.exe Set value (str) \REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.exe Set value (str) \REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1198496894" IEXPLORE.exe Set value (int) \REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" IEXPLORE.exe Set value (data) \REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" IEXPLORE.exe Set value (data) \REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000025ba558cff15364f83b59eef6d4e53a4000000000200000000001066000000010000200000001d2f1bb703276df2d10137ac3adcefd28399e55f1e646b918188f4d75d7fd760000000000e8000000002000020000000a2ab4a91360bc306e970725477a568bf1ecf4de139985c9dcb92893cd8f03db120000000c615ebeb52400044fff0e1fac0ed52f99b830aebfc001dac4d4324a8b8180d0e400000008205776de74a5d53de3f77695f6907f3d2f135932b722b25cab48aa8010d19ea1d0eb9407ff6816d8ac1bcce3f44aa3e172066d467f56e190fb438a1d386e57d IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive IEXPLORE.exe Set value (str) \REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1198496894" IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31076980" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000025ba558cff15364f83b59eef6d4e53a400000000020000000000106600000001000020000000db4e5aa71612a503ff79b15e1cbc5994f01a8c0a031e8b82639cb8984a43983f000000000e8000000002000020000000fb4c90550d30566667b638726b12e0abc11d659704a56d3a92df8d2ca40cb5792000000035e659d3ae3a56e3f6462db3b1c9f8360d5ed416f2804f0851c55f1e7a30873a40000000c1ed441aaedb5aa9cf4a1e12977c6d77a1c1b5abc849ecb1f7e41b22117f5c3fc26b1ac58e781cad8bfc0b82e3acbcb3abfd6df7447ceb85892c502152cea937 IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing IEXPLORE.exe Set value (data) \REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 709ecb487432da01 IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.exe Set value (int) \REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage IEXPLORE.exe Set value (str) \REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" IEXPLORE.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4548 IEXPLORE.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 4548 IEXPLORE.exe 4548 IEXPLORE.exe 3112 IEXPLORE.EXE 3112 IEXPLORE.EXE 3112 IEXPLORE.EXE 3112 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 1092 wrote to memory of 4548 1092 07e66076479143a29bbaec9da8864b2c.exe 88 PID 1092 wrote to memory of 4548 1092 07e66076479143a29bbaec9da8864b2c.exe 88 PID 4548 wrote to memory of 3112 4548 IEXPLORE.exe 89 PID 4548 wrote to memory of 3112 4548 IEXPLORE.exe 89 PID 4548 wrote to memory of 3112 4548 IEXPLORE.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\07e66076479143a29bbaec9da8864b2c.exe"C:\Users\Admin\AppData\Local\Temp\07e66076479143a29bbaec9da8864b2c.exe"1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1092 -
C:\Program Files\Internet Explorer\IEXPLORE.exe"C:\Program Files\Internet Explorer\IEXPLORE" 212.33.237.86/images/1/report.php2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4548 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4548 CREDAT:17410 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3112
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
-
Filesize
4.3MB
MD53dc4e95c1eca5b1dea28ed0673f37ecb
SHA1f90a151eae5895fb71bd79ad961bff6c2cfbb015
SHA256f2c5dcb24c7fda3dbc650a4327a3796ed0b947f89ca4c1a9483b66f132dce3cd
SHA512013f86400e75968ef291c5259d02a2be9b440ba028167c5b2f5751cf2c62cbdfcca329beaaf923c4f6076e94490244d6fa476ab1ace6a473462c175e4a1e77fa