3ce58199dc4481c972c623f85520c7040d22476a2ec0ed32117e5af7ec6d0d71

Analysis

max time kernel
151s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 21:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1d7369b89cb7f8d0822a5193e8f1312a.exe
Size

25KB
MD5

1d7369b89cb7f8d0822a5193e8f1312a
SHA1

c16a65020f3411fb768c853d6a975ee005673a20
SHA256

3ce58199dc4481c972c623f85520c7040d22476a2ec0ed32117e5af7ec6d0d71
SHA512

4f46622eebb061b68a37563dff0d55fe6f61ab780d1e60184f665288c836986c7f399675f13af81f4f187ab5270d33fde3bc87b6c9cf413e12048e498ad5c32f
SSDEEP

768:B6CR40yNqWCOcRPXDUHdxUdNt+4zN4npvjxz4gKLY:B6C+0yQWtkPXDIdqzJ4vzJ

Score

7^/10

persistence

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
3480	IEXPLORE.EXE

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Program Files\\Common Files\\Services\\svchost.exe"	1d7369b89cb7f8d0822a5193e8f1312a.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\M:	1d7369b89cb7f8d0822a5193e8f1312a.exe
File opened (read-only)	\??\R:	1d7369b89cb7f8d0822a5193e8f1312a.exe
File opened (read-only)	\??\S:	1d7369b89cb7f8d0822a5193e8f1312a.exe
File opened (read-only)	\??\U:	1d7369b89cb7f8d0822a5193e8f1312a.exe
File opened (read-only)	\??\Y:	1d7369b89cb7f8d0822a5193e8f1312a.exe
File opened (read-only)	\??\A:	1d7369b89cb7f8d0822a5193e8f1312a.exe
File opened (read-only)	\??\G:	1d7369b89cb7f8d0822a5193e8f1312a.exe
File opened (read-only)	\??\I:	1d7369b89cb7f8d0822a5193e8f1312a.exe
File opened (read-only)	\??\N:	1d7369b89cb7f8d0822a5193e8f1312a.exe
File opened (read-only)	\??\W:	1d7369b89cb7f8d0822a5193e8f1312a.exe
File opened (read-only)	\??\Z:	1d7369b89cb7f8d0822a5193e8f1312a.exe
File opened (read-only)	\??\B:	1d7369b89cb7f8d0822a5193e8f1312a.exe
File opened (read-only)	\??\E:	1d7369b89cb7f8d0822a5193e8f1312a.exe
File opened (read-only)	\??\K:	1d7369b89cb7f8d0822a5193e8f1312a.exe
File opened (read-only)	\??\J:	1d7369b89cb7f8d0822a5193e8f1312a.exe
File opened (read-only)	\??\O:	1d7369b89cb7f8d0822a5193e8f1312a.exe
File opened (read-only)	\??\P:	1d7369b89cb7f8d0822a5193e8f1312a.exe
File opened (read-only)	\??\T:	1d7369b89cb7f8d0822a5193e8f1312a.exe
File opened (read-only)	\??\V:	1d7369b89cb7f8d0822a5193e8f1312a.exe
File opened (read-only)	\??\X:	1d7369b89cb7f8d0822a5193e8f1312a.exe
File opened (read-only)	\??\H:	1d7369b89cb7f8d0822a5193e8f1312a.exe
File opened (read-only)	\??\L:	1d7369b89cb7f8d0822a5193e8f1312a.exe
File opened (read-only)	\??\Q:	1d7369b89cb7f8d0822a5193e8f1312a.exe

Drops autorun.inf file 1 TTPs 4 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File created	C:\autorun.inf	1d7369b89cb7f8d0822a5193e8f1312a.exe
File opened for modification	C:\autorun.inf	1d7369b89cb7f8d0822a5193e8f1312a.exe
File created	F:\autorun.inf	1d7369b89cb7f8d0822a5193e8f1312a.exe
File opened for modification	F:\autorun.inf	1d7369b89cb7f8d0822a5193e8f1312a.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\DirectX10.dll	1d7369b89cb7f8d0822a5193e8f1312a.exe
File opened for modification	C:\Windows\SysWOW64\DirectX10.dll	1d7369b89cb7f8d0822a5193e8f1312a.exe

Drops file in Program Files directory 28 IoCs

description	ioc	Process
File created	C:\Program Files\KjQfEViq.exe	IEXPLORE.EXE
File created	C:\Program Files\USDUKb38.exe	IEXPLORE.EXE
File created	C:\Program Files\89A6edoc.exe	IEXPLORE.EXE
File opened for modification	C:\Program Files\Common Files\Services\svchost.exe	1d7369b89cb7f8d0822a5193e8f1312a.exe
File created	C:\Program Files\zUiGHVst.exe	IEXPLORE.EXE
File created	C:\Program Files\nSqAoWNH.exe	IEXPLORE.EXE
File created	C:\Program Files\LNDMKxKF.exe	IEXPLORE.EXE
File created	C:\Program Files\BHIHkm2H.exe	IEXPLORE.EXE
File created	C:\Program Files\MlOrgMfH.exe	IEXPLORE.EXE
File created	C:\Program Files\ZKZqc4Bw.exe	IEXPLORE.EXE
File created	C:\Program Files\c270ovBD.exe	IEXPLORE.EXE
File created	C:\Program Files\o0pv8I4d.exe	IEXPLORE.EXE
File created	C:\Program Files\Common Files\Services\svchost.exe	1d7369b89cb7f8d0822a5193e8f1312a.exe
File created	C:\Program Files\IibVeWF8.exe	IEXPLORE.EXE
File created	C:\Program Files\NSu8Xa3f.exe	IEXPLORE.EXE
File created	C:\Program Files\awI55Bmy.exe	IEXPLORE.EXE
File created	C:\Program Files\22dXXJfr.exe	IEXPLORE.EXE
File created	C:\Program Files\axv61Of6.exe	IEXPLORE.EXE
File created	C:\Program Files\UrKBtZpd.exe	IEXPLORE.EXE
File created	C:\Program Files\C4YlPPRt.exe	IEXPLORE.EXE
File created	C:\Program Files\z5lRefEu.exe	IEXPLORE.EXE
File created	C:\Program Files\IMdGnjrI.exe	IEXPLORE.EXE
File created	C:\Program Files\Gok7owyV.exe	IEXPLORE.EXE
File created	C:\Program Files\JgGhFae3.exe	IEXPLORE.EXE
File created	C:\Program Files\4oihdE5e.exe	IEXPLORE.EXE
File created	C:\Program Files\GAmWvDL3.exe	IEXPLORE.EXE
File created	C:\Program Files\O7BEoquQ.exe	IEXPLORE.EXE
File created	C:\Program Files\PPAVc8NV.exe	IEXPLORE.EXE

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	IEXPLORE.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	IEXPLORE.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	IEXPLORE.EXE

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	IEXPLORE.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 32 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "2857173935"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2932640622"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2857173935"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31080219"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{D299D256-AB0E-11EE-BB4F-72AE6231743A} = "0"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "2039660691"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\""	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31080219"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31080219"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31080219"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "2932640622"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	IEXPLORE.EXE

Runs net.exe

Suspicious behavior: EnumeratesProcesses 44 IoCs

pid	Process
4292	1d7369b89cb7f8d0822a5193e8f1312a.exe
4292	1d7369b89cb7f8d0822a5193e8f1312a.exe
4292	1d7369b89cb7f8d0822a5193e8f1312a.exe
4292	1d7369b89cb7f8d0822a5193e8f1312a.exe
4292	1d7369b89cb7f8d0822a5193e8f1312a.exe
4292	1d7369b89cb7f8d0822a5193e8f1312a.exe
4292	1d7369b89cb7f8d0822a5193e8f1312a.exe
4292	1d7369b89cb7f8d0822a5193e8f1312a.exe
4292	1d7369b89cb7f8d0822a5193e8f1312a.exe
4292	1d7369b89cb7f8d0822a5193e8f1312a.exe
4292	1d7369b89cb7f8d0822a5193e8f1312a.exe
4292	1d7369b89cb7f8d0822a5193e8f1312a.exe
4292	1d7369b89cb7f8d0822a5193e8f1312a.exe
4292	1d7369b89cb7f8d0822a5193e8f1312a.exe
4292	1d7369b89cb7f8d0822a5193e8f1312a.exe
4292	1d7369b89cb7f8d0822a5193e8f1312a.exe
4292	1d7369b89cb7f8d0822a5193e8f1312a.exe
4292	1d7369b89cb7f8d0822a5193e8f1312a.exe
4292	1d7369b89cb7f8d0822a5193e8f1312a.exe
4292	1d7369b89cb7f8d0822a5193e8f1312a.exe
4292	1d7369b89cb7f8d0822a5193e8f1312a.exe
4292	1d7369b89cb7f8d0822a5193e8f1312a.exe
4292	1d7369b89cb7f8d0822a5193e8f1312a.exe
4292	1d7369b89cb7f8d0822a5193e8f1312a.exe
4292	1d7369b89cb7f8d0822a5193e8f1312a.exe
4292	1d7369b89cb7f8d0822a5193e8f1312a.exe
4292	1d7369b89cb7f8d0822a5193e8f1312a.exe
4292	1d7369b89cb7f8d0822a5193e8f1312a.exe
4292	1d7369b89cb7f8d0822a5193e8f1312a.exe
4292	1d7369b89cb7f8d0822a5193e8f1312a.exe
4292	1d7369b89cb7f8d0822a5193e8f1312a.exe
4292	1d7369b89cb7f8d0822a5193e8f1312a.exe
4292	1d7369b89cb7f8d0822a5193e8f1312a.exe
4292	1d7369b89cb7f8d0822a5193e8f1312a.exe
4292	1d7369b89cb7f8d0822a5193e8f1312a.exe
4292	1d7369b89cb7f8d0822a5193e8f1312a.exe
4292	1d7369b89cb7f8d0822a5193e8f1312a.exe
4292	1d7369b89cb7f8d0822a5193e8f1312a.exe
4292	1d7369b89cb7f8d0822a5193e8f1312a.exe
4292	1d7369b89cb7f8d0822a5193e8f1312a.exe
4292	1d7369b89cb7f8d0822a5193e8f1312a.exe
4292	1d7369b89cb7f8d0822a5193e8f1312a.exe
4292	1d7369b89cb7f8d0822a5193e8f1312a.exe
4292	1d7369b89cb7f8d0822a5193e8f1312a.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeDebugPrivilege	4292	1d7369b89cb7f8d0822a5193e8f1312a.exe
Token: SeDebugPrivilege	4292	1d7369b89cb7f8d0822a5193e8f1312a.exe
Token: SeDebugPrivilege	4292	1d7369b89cb7f8d0822a5193e8f1312a.exe
Token: SeDebugPrivilege	4292	1d7369b89cb7f8d0822a5193e8f1312a.exe
Token: SeDebugPrivilege	4292	1d7369b89cb7f8d0822a5193e8f1312a.exe
Token: SeDebugPrivilege	4292	1d7369b89cb7f8d0822a5193e8f1312a.exe
Token: SeDebugPrivilege	4292	1d7369b89cb7f8d0822a5193e8f1312a.exe
Token: SeDebugPrivilege	4292	1d7369b89cb7f8d0822a5193e8f1312a.exe
Token: SeDebugPrivilege	4292	1d7369b89cb7f8d0822a5193e8f1312a.exe
Token: SeSystemtimePrivilege	4292	1d7369b89cb7f8d0822a5193e8f1312a.exe
Token: SeDebugPrivilege	4292	1d7369b89cb7f8d0822a5193e8f1312a.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5036	IEXPLORE.EXE

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
5036	IEXPLORE.EXE
5036	IEXPLORE.EXE
3480	IEXPLORE.EXE
3480	IEXPLORE.EXE
3480	IEXPLORE.EXE
3480	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4292 wrote to memory of 4680	4292	1d7369b89cb7f8d0822a5193e8f1312a.exe	102
PID 4292 wrote to memory of 4680	4292	1d7369b89cb7f8d0822a5193e8f1312a.exe	102
PID 4292 wrote to memory of 4680	4292	1d7369b89cb7f8d0822a5193e8f1312a.exe	102
PID 4292 wrote to memory of 1472	4292	1d7369b89cb7f8d0822a5193e8f1312a.exe	104
PID 4292 wrote to memory of 1472	4292	1d7369b89cb7f8d0822a5193e8f1312a.exe	104
PID 4292 wrote to memory of 1472	4292	1d7369b89cb7f8d0822a5193e8f1312a.exe	104
PID 4292 wrote to memory of 1964	4292	1d7369b89cb7f8d0822a5193e8f1312a.exe	103
PID 4292 wrote to memory of 1964	4292	1d7369b89cb7f8d0822a5193e8f1312a.exe	103
PID 4292 wrote to memory of 1964	4292	1d7369b89cb7f8d0822a5193e8f1312a.exe	103
PID 4292 wrote to memory of 3360	4292	1d7369b89cb7f8d0822a5193e8f1312a.exe	105
PID 4292 wrote to memory of 3360	4292	1d7369b89cb7f8d0822a5193e8f1312a.exe	105
PID 4292 wrote to memory of 3360	4292	1d7369b89cb7f8d0822a5193e8f1312a.exe	105
PID 4292 wrote to memory of 4248	4292	1d7369b89cb7f8d0822a5193e8f1312a.exe	111
PID 4292 wrote to memory of 4248	4292	1d7369b89cb7f8d0822a5193e8f1312a.exe	111
PID 4292 wrote to memory of 4248	4292	1d7369b89cb7f8d0822a5193e8f1312a.exe	111
PID 4292 wrote to memory of 5036	4292	1d7369b89cb7f8d0822a5193e8f1312a.exe	112
PID 4292 wrote to memory of 5036	4292	1d7369b89cb7f8d0822a5193e8f1312a.exe	112
PID 1964 wrote to memory of 3644	1964	net.exe	113
PID 1964 wrote to memory of 3644	1964	net.exe	113
PID 1964 wrote to memory of 3644	1964	net.exe	113
PID 3360 wrote to memory of 3796	3360	net.exe	114
PID 3360 wrote to memory of 3796	3360	net.exe	114
PID 3360 wrote to memory of 3796	3360	net.exe	114
PID 1472 wrote to memory of 1464	1472	Net.exe	115
PID 1472 wrote to memory of 1464	1472	Net.exe	115
PID 1472 wrote to memory of 1464	1472	Net.exe	115
PID 4248 wrote to memory of 3888	4248	net.exe	117
PID 4248 wrote to memory of 3888	4248	net.exe	117
PID 4248 wrote to memory of 3888	4248	net.exe	117
PID 4680 wrote to memory of 2248	4680	Net.exe	116
PID 4680 wrote to memory of 2248	4680	Net.exe	116
PID 4680 wrote to memory of 2248	4680	Net.exe	116
PID 5036 wrote to memory of 3480	5036	IEXPLORE.EXE	118
PID 5036 wrote to memory of 3480	5036	IEXPLORE.EXE	118
PID 5036 wrote to memory of 3480	5036	IEXPLORE.EXE	118
PID 4292 wrote to memory of 3480	4292	1d7369b89cb7f8d0822a5193e8f1312a.exe	118
PID 4292 wrote to memory of 3480	4292	1d7369b89cb7f8d0822a5193e8f1312a.exe	118
PID 4292 wrote to memory of 3480	4292	1d7369b89cb7f8d0822a5193e8f1312a.exe	118
PID 4292 wrote to memory of 3480	4292	1d7369b89cb7f8d0822a5193e8f1312a.exe	118
PID 4292 wrote to memory of 3480	4292	1d7369b89cb7f8d0822a5193e8f1312a.exe	118
PID 4292 wrote to memory of 3480	4292	1d7369b89cb7f8d0822a5193e8f1312a.exe	118
PID 4292 wrote to memory of 3480	4292	1d7369b89cb7f8d0822a5193e8f1312a.exe	118
PID 4292 wrote to memory of 3480	4292	1d7369b89cb7f8d0822a5193e8f1312a.exe	118
PID 4292 wrote to memory of 3480	4292	1d7369b89cb7f8d0822a5193e8f1312a.exe	118
PID 4292 wrote to memory of 3480	4292	1d7369b89cb7f8d0822a5193e8f1312a.exe	118
PID 4292 wrote to memory of 3480	4292	1d7369b89cb7f8d0822a5193e8f1312a.exe	118
PID 4292 wrote to memory of 3480	4292	1d7369b89cb7f8d0822a5193e8f1312a.exe	118
PID 4292 wrote to memory of 3480	4292	1d7369b89cb7f8d0822a5193e8f1312a.exe	118
PID 4292 wrote to memory of 3480	4292	1d7369b89cb7f8d0822a5193e8f1312a.exe	118
PID 4292 wrote to memory of 3480	4292	1d7369b89cb7f8d0822a5193e8f1312a.exe	118
PID 4292 wrote to memory of 3480	4292	1d7369b89cb7f8d0822a5193e8f1312a.exe	118
PID 4292 wrote to memory of 3480	4292	1d7369b89cb7f8d0822a5193e8f1312a.exe	118
PID 4292 wrote to memory of 3480	4292	1d7369b89cb7f8d0822a5193e8f1312a.exe	118
PID 4292 wrote to memory of 3480	4292	1d7369b89cb7f8d0822a5193e8f1312a.exe	118
PID 4292 wrote to memory of 3480	4292	1d7369b89cb7f8d0822a5193e8f1312a.exe	118
PID 4292 wrote to memory of 3480	4292	1d7369b89cb7f8d0822a5193e8f1312a.exe	118
PID 4292 wrote to memory of 3480	4292	1d7369b89cb7f8d0822a5193e8f1312a.exe	118
PID 4292 wrote to memory of 3480	4292	1d7369b89cb7f8d0822a5193e8f1312a.exe	118
PID 4292 wrote to memory of 3480	4292	1d7369b89cb7f8d0822a5193e8f1312a.exe	118
PID 4292 wrote to memory of 3480	4292	1d7369b89cb7f8d0822a5193e8f1312a.exe	118
PID 4292 wrote to memory of 3480	4292	1d7369b89cb7f8d0822a5193e8f1312a.exe	118
PID 4292 wrote to memory of 3480	4292	1d7369b89cb7f8d0822a5193e8f1312a.exe	118
PID 4292 wrote to memory of 3480	4292	1d7369b89cb7f8d0822a5193e8f1312a.exe	118
PID 4292 wrote to memory of 3480	4292	1d7369b89cb7f8d0822a5193e8f1312a.exe	118

C:\Users\Admin\AppData\Local\Temp\1d7369b89cb7f8d0822a5193e8f1312a.exe
"C:\Users\Admin\AppData\Local\Temp\1d7369b89cb7f8d0822a5193e8f1312a.exe"
1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4292
- C:\Windows\SysWOW64\Net.exe
  Net Stop Norton Antivirus Auto Protect Service
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4680
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 Stop Norton Antivirus Auto Protect Service
    3⤵
    PID:2248
- C:\Windows\SysWOW64\net.exe
  net stop "Security Center"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1964
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Security Center"
    3⤵
    PID:3644
- C:\Windows\SysWOW64\Net.exe
  Net Stop mcshield
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1472
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 Stop mcshield
    3⤵
    PID:1464
- C:\Windows\SysWOW64\net.exe
  net stop "Windows Firewall/Internet Connection Sharing (ICS)"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3360
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"
    3⤵
    PID:3796
- C:\Windows\SysWOW64\net.exe
  net stop System Restore Service
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4248
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop System Restore Service
    3⤵
    PID:3888
- C:\Program Files\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files\Internet Explorer\IEXPLORE.EXE"
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5036
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:5036 CREDAT:17410 /prefetch:2
    3⤵
    - Loads dropped DLL
    - Drops file in Program Files directory
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:3480

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Common Files\Services\svchost.exe

Filesize
25KB

MD5
1d7369b89cb7f8d0822a5193e8f1312a

SHA1
c16a65020f3411fb768c853d6a975ee005673a20

SHA256
3ce58199dc4481c972c623f85520c7040d22476a2ec0ed32117e5af7ec6d0d71

SHA512
4f46622eebb061b68a37563dff0d55fe6f61ab780d1e60184f665288c836986c7f399675f13af81f4f187ab5270d33fde3bc87b6c9cf413e12048e498ad5c32f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\VersionManager\ver891.tmp

Filesize
15KB

MD5
1a545d0052b581fbb2ab4c52133846bc

SHA1
62f3266a9b9925cd6d98658b92adec673cbe3dd3

SHA256
557472aeaebf4c1c800b9df14c190f66d62cbabb011300dbedde2dcddd27a6c1

SHA512
bd326d111589d87cd6d019378ec725ac9ac7ad4c36f22453941f7d52f90b747ede4783a83dfff6cae1b3bb46690ad49cffa77f2afda019b22863ac485b406e8d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\MCZQJD7V\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\MCZQJD7V\z2[1].htm

Filesize
803B

MD5
130269b3f31854c5d77370e9fb0ca93d

SHA1
24a8e6428b13cef776b301a62fa9a91c6448b3e5

SHA256
ece5fa02466ddac7c75644b08379608a228017afa3a0a60e3d06e43c7c414047

SHA512
5224f41cce2c698c3d41b6bd5916d70072b6c84f654066595b6c36de772b54f121f55f9d66279099742661a5eadb52095f4179576406b4a0c3deaace0b81b137

Download Submit
C:\Windows\SysWOW64\DirectX10.dll

Filesize
832KB

MD5
c57de030547fbfb2bf2771ccd0c8a506

SHA1
949b80ca15de0a78ce9cebb200b9914eaa6c70ff

SHA256
065050048db71956afbe83dd7da5be78f2fcd524e7ed5bc24e9ace3d71748d55

SHA512
79fb2f69a443a7b623ac188780bef599b1cb6e32ece10d888bf707482c6e0dbc5e2ecbebc92fcae45d0a44cef26700cc3ec477b70087dfac712dba549be34b19

Download Submit
C:\Windows\SysWOW64\DirectX10.dll

Filesize
193KB

MD5
cea5135c8a6b8dfc3b8c2b757954ea54

SHA1
ddd32cd63fa09c4b718d8606f864dfdf3626cc75

SHA256
9a1017cdba0f471546d5658fbcdd067e52de879f6f8f6ab1f20ee9ce5cc00273

SHA512
01c8304f5aebb8cf6f39d77f6a7dccb06f0eb6b955f206842f513a4a6b31fa17d7cb0d1d083674a0f5bbf074e9f65991ad54de8ae3524c0f59f949a19a6787ee

Download Submit