ae2a04f94bd9c46c979ac213edcc026692c54f9ec2afbeaa8b03752ae4f792bc

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 05:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

1048b55d549d456b05d057b067faa185.exe
Size

54KB
MD5

1048b55d549d456b05d057b067faa185
SHA1

e14b56b39d4ea871b17e19d9ffaeac1fa6381a83
SHA256

ae2a04f94bd9c46c979ac213edcc026692c54f9ec2afbeaa8b03752ae4f792bc
SHA512

f7021f00e9c4f5f7069aaac72f09a3df4c2775d417f0c9f199272b43e44aa8e00f77c4d78e4a99f533af908a0cf559c2913bc08dd06edb8e17920c0e415f6726
SSDEEP

768:gNh5DfiT2+IXeIt1wgOP+kw+tNwsxQkHPrz+N35yKNQbJItygam7RIEMrOQYz0+w:gZWKJJMguNNdxzHni3gkkJIv7R9wg0a0

Score

8^/10

evasion persistence

Malware Config

Signatures

Sets file to hidden 1 TTPs 2 IoCs

Modifies file attributes to stop it showing in Explorer etc.

evasion

Hidden Files and Directories

T1564.001

pid	Process
4384	attrib.exe
1008	attrib.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Control Panel\International\Geo\Nation	1048b55d549d456b05d057b067faa185.exe
Key value queried	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Control Panel\International\Geo\Nation	inlE675.tmp

Executes dropped EXE 1 IoCs

pid	Process
2204	inlE675.tmp

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\hsdfasd = "\"C:\\Users\\Admin\\AppData\\Roaming\\datread\\tmp.\\a.{971C5380-92A0-5A69-B3EE-C3002B33309E}\" hh.exe"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\GrpConv = "grpconv -o"	rundll32.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\PROGRA~1\INTERN~1\ieframe.dll	cmd.exe
File opened for modification	C:\PROGRA~1\INTERN~1\ieframe.dll	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	runonce.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	runonce.exe

Modifies Internet Explorer settings 1 TTPs 32 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Main	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3634574217"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0f30fda5b3cda01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31079515"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Software\Microsoft\Internet Explorer\Main	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31079515"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40cee9d95b3cda01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000056c0f093da428f4099809f3dbcc1bfee00000000020000000000106600000001000020000000e9b1a630939ceb877c09f7c484e0311e9995046af5c47f0bc98bc08404dd898f000000000e8000000002000020000000785c08042bbd3218656ad2231ce26fafb715042d0b92f2d84f6ebbab2533dc4b20000000cc8c0a959cda896e94bc922b6cb6c188606a1c4b30bcd5572cfc94b45fa7fd4340000000d89f2b33b2ec83899a45c80c3f4181d2b2daf895f4f020c9ece601a6d972917a868b08ed33ccff73fa355073ba30abf9f0f78a3c0042105112c7c864927184e2	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000056c0f093da428f4099809f3dbcc1bfee00000000020000000000106600000001000020000000a187c23a3416a5a9831304b61e1962c40ff9b88c3e45413bb8cb2e78be2608f8000000000e80000000020000200000005e961378ee6435f85a8a74ef1c4e299cc2976460c3dd0eb7e0414a7019a5728d2000000056e16bf38d0de4592be4c801ed9096e85834b31b96c093d94c4eebb057e1f6f54000000062b6056de597811573b3acc67cbfd5ab2c2b75bce5e1f4e69db76308175c0b245c0f9adafca0365e48ae9f8da84ed33c4a9a39f3bce17c9213f47826661f6b81	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3612698905"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31079515"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\""	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3612698905"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{02B76352-A84F-11EE-9BE3-5A16FF4F52D9} = "0"	iexplore.exe

Modifies Internet Explorer start page 1 TTPs 2 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Start Page = "http://www.82133.com/?S"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://www.82133.com/?S"	reg.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}\Shell	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}\IsShortCut	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}\Shell\open(&H)	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}\Shell\open(&H)\Command\ = "wscript -e:vbs \"C:\\Users\\Admin\\AppData\\Roaming\\datread\\3.bat\""	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}\Shell\open(&H)\Command	reg.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	1972	1048b55d549d456b05d057b067faa185.exe
Token: SeIncBasePriorityPrivilege	2204	inlE675.tmp

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4336	iexplore.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4336	iexplore.exe
4336	iexplore.exe
1552	IEXPLORE.EXE
1552	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 59 IoCs

description	pid	Process	procid_target
PID 1972 wrote to memory of 3408	1972	1048b55d549d456b05d057b067faa185.exe	105
PID 1972 wrote to memory of 3408	1972	1048b55d549d456b05d057b067faa185.exe	105
PID 1972 wrote to memory of 3408	1972	1048b55d549d456b05d057b067faa185.exe	105
PID 3408 wrote to memory of 5112	3408	cmd.exe	107
PID 3408 wrote to memory of 5112	3408	cmd.exe	107
PID 3408 wrote to memory of 5112	3408	cmd.exe	107
PID 5112 wrote to memory of 4336	5112	cmd.exe	109
PID 5112 wrote to memory of 4336	5112	cmd.exe	109
PID 5112 wrote to memory of 4208	5112	cmd.exe	111
PID 5112 wrote to memory of 4208	5112	cmd.exe	111
PID 5112 wrote to memory of 4208	5112	cmd.exe	111
PID 5112 wrote to memory of 4916	5112	cmd.exe	112
PID 5112 wrote to memory of 4916	5112	cmd.exe	112
PID 5112 wrote to memory of 4916	5112	cmd.exe	112
PID 1972 wrote to memory of 2204	1972	1048b55d549d456b05d057b067faa185.exe	110
PID 1972 wrote to memory of 2204	1972	1048b55d549d456b05d057b067faa185.exe	110
PID 1972 wrote to memory of 2204	1972	1048b55d549d456b05d057b067faa185.exe	110
PID 1972 wrote to memory of 4444	1972	1048b55d549d456b05d057b067faa185.exe	115
PID 1972 wrote to memory of 4444	1972	1048b55d549d456b05d057b067faa185.exe	115
PID 1972 wrote to memory of 4444	1972	1048b55d549d456b05d057b067faa185.exe	115
PID 4336 wrote to memory of 1552	4336	iexplore.exe	114
PID 4336 wrote to memory of 1552	4336	iexplore.exe	114
PID 4336 wrote to memory of 1552	4336	iexplore.exe	114
PID 4916 wrote to memory of 564	4916	cmd.exe	117
PID 4916 wrote to memory of 564	4916	cmd.exe	117
PID 4916 wrote to memory of 564	4916	cmd.exe	117
PID 4916 wrote to memory of 1120	4916	cmd.exe	118
PID 4916 wrote to memory of 1120	4916	cmd.exe	118
PID 4916 wrote to memory of 1120	4916	cmd.exe	118
PID 4916 wrote to memory of 3124	4916	cmd.exe	119
PID 4916 wrote to memory of 3124	4916	cmd.exe	119
PID 4916 wrote to memory of 3124	4916	cmd.exe	119
PID 4916 wrote to memory of 2200	4916	cmd.exe	120
PID 4916 wrote to memory of 2200	4916	cmd.exe	120
PID 4916 wrote to memory of 2200	4916	cmd.exe	120
PID 4916 wrote to memory of 5072	4916	cmd.exe	121
PID 4916 wrote to memory of 5072	4916	cmd.exe	121
PID 4916 wrote to memory of 5072	4916	cmd.exe	121
PID 4916 wrote to memory of 4384	4916	cmd.exe	122
PID 4916 wrote to memory of 4384	4916	cmd.exe	122
PID 4916 wrote to memory of 4384	4916	cmd.exe	122
PID 4916 wrote to memory of 1008	4916	cmd.exe	123
PID 4916 wrote to memory of 1008	4916	cmd.exe	123
PID 4916 wrote to memory of 1008	4916	cmd.exe	123
PID 4916 wrote to memory of 3352	4916	cmd.exe	125
PID 4916 wrote to memory of 3352	4916	cmd.exe	125
PID 4916 wrote to memory of 3352	4916	cmd.exe	125
PID 4916 wrote to memory of 5056	4916	cmd.exe	124
PID 4916 wrote to memory of 5056	4916	cmd.exe	124
PID 4916 wrote to memory of 5056	4916	cmd.exe	124
PID 3352 wrote to memory of 4436	3352	rundll32.exe	126
PID 3352 wrote to memory of 4436	3352	rundll32.exe	126
PID 3352 wrote to memory of 4436	3352	rundll32.exe	126
PID 4436 wrote to memory of 748	4436	runonce.exe	127
PID 4436 wrote to memory of 748	4436	runonce.exe	127
PID 4436 wrote to memory of 748	4436	runonce.exe	127
PID 2204 wrote to memory of 856	2204	inlE675.tmp	133
PID 2204 wrote to memory of 856	2204	inlE675.tmp	133
PID 2204 wrote to memory of 856	2204	inlE675.tmp	133

Views/modifies file attributes 1 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
4384	attrib.exe
1008	attrib.exe

C:\Users\Admin\AppData\Local\Temp\1048b55d549d456b05d057b067faa185.exe
"C:\Users\Admin\AppData\Local\Temp\1048b55d549d456b05d057b067faa185.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1972
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\glk_300_211.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3408
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Roaming\datread\1.bat
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5112
  - - C:\PROGRA~1\INTERN~1\iexplore.exe
      C:\PROGRA~1\INTERN~1\IEXPLORE.EXE http://wWW.cnkankan.com/?82133
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4336
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4336 CREDAT:17410 /prefetch:2
        5⤵
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:1552
  - - C:\Windows\SysWOW64\rundll32.exe
      rundll32 syssetup,SetupInfObjectInstallAction DefaultInstall 128 C:\Users\Admin\AppData\Roaming\datread\1.inf
      4⤵
      PID:4208
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Roaming\datread\2.bat
      4⤵
      Drops file in Program Files directory
      Suspicious use of WriteProcessMemory
      PID:4916
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\Software\Microsoft\Internet Explorer\Main" /v "Start Page" /d ""http://www.82133.com/?S"" /f
        5⤵
        Modifies Internet Explorer settings
        Modifies Internet Explorer start page
        
        PID:564
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Internet Explorer\Main" /v "Start Page" /d ""http://www.82133.com/?S"" /f
        5⤵
        Modifies Internet Explorer settings
        Modifies Internet Explorer start page
        
        PID:1120
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\tmp" /v "key" /d ""http://www.82133.com/?S"" /f
        5⤵
        
        PID:3124
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCR\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}" /v "IsShortCut" /d "" /f
        5⤵
        Modifies registry class
        
        PID:2200
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCR\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}\Shell\open(&H)\Command" /v "" /d "wscript -e:vbs ""C:\Users\Admin\AppData\Roaming\datread\3.bat""" /f
        5⤵
        Modifies registry class
        
        PID:5072
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib +s +h C:\Users\Admin\AppData\Roaming\datread\tmp\a.{971C5380-92A0-5A69-B3EE-C3002B33309E}
        5⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:4384
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib +s +h C:\Users\Admin\AppData\Roaming\datread\tmp
        5⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:1008
    - - C:\Windows\SysWOW64\rundll32.exe
        
        rundll32 D:\VolumeDH\inj.dat,MainLoad
        5⤵
        
        PID:5056
    - - C:\Windows\SysWOW64\rundll32.exe
        
        rundll32 syssetup,SetupInfObjectInstallAction DefaultInstall 128 C:\Users\Admin\AppData\Roaming\datread\2.inf
        5⤵
        Adds Run key to start application
        Suspicious use of WriteProcessMemory
        
        PID:3352
      - C:\Windows\SysWOW64\runonce.exe
        
        "C:\Windows\system32\runonce.exe" -r
        6⤵
        Checks processor information in registry
        Suspicious use of WriteProcessMemory
        
        PID:4436
        
        C:\Windows\SysWOW64\grpconv.exe
        
        "C:\Windows\System32\grpconv.exe" -o
        7⤵
        
        PID:748
- C:\Users\Admin\AppData\Local\Temp\inlE675.tmp
  C:\Users\Admin\AppData\Local\Temp\inlE675.tmp
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2204
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\inlE675.tmp > nul
    3⤵
    PID:856
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\1048B5~1.EXE > nul
  2⤵
  PID:4444

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\360mohesetup.exe

Filesize
794B

MD5
1bc415b31cdff50d79ea2a3d7b4ff2c1

SHA1
f5ebab61deebc3d7a4a6676a23b982f1418ae6a6

SHA256
582ea6421c80adc1de2dcb34fb8db1926e34b49219d99306693166a6b268d412

SHA512
ee9718e829fa7c6b2e3b208fe99acd390d704a4ad037fd9b5ae231db184f48146792fb1ac028a69224ddca2c3195ef2aa5353ee6bc7abe01157773f4a6e50e84

Download Submit
C:\Users\Admin\AppData\Local\Temp\cdf1912.tmp

Filesize
858B

MD5
d727e34e3f5eb5ee1ce17fe4c66bf617

SHA1
ea796e8b305510775d244f30758e125a01569626

SHA256
d0cd1c2b674ee72b000ecacb181addd7735f4c3478731c23f4649e312e4c607d

SHA512
ae3028364bf02b3e7c78d7a44a3305537c16d7feefb9dd968296b86425babaccee81af0c40eb7f8f374266df0e2c3c1a08b6b951ceaddc55572d6f0f1e85705c

Download Submit
C:\Users\Admin\AppData\Local\Temp\glk_300_211.bat

Filesize
54B

MD5
5dd457b845e53fce36e6b543764337e4

SHA1
eb7f8ce82274afa5702b20eb5ba133bb71bcb8d6

SHA256
0a2c605c32f2e9b3eda6f18df3d8c1fc2d87922b9bb23d6c3a9de3aa3f383992

SHA512
0fea97ddf333c178ca4805fc85f8b66f81a7906d1cc7bf440206aff50cc711643e90115f046077a323b3cc78deeb704f7eb8a934d0a1cd011f6a3ad67057c9f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\inlE675.tmp

Filesize
1023KB

MD5
d4ed8a8b7c2064d9014808abcbc323ca

SHA1
8807a146da1b2f6c49d29ee73d1d6fc0b2a27bdd

SHA256
c11ad00bc9854a7232ddde8156ae0e7c3d2cf307dadd170e86adc240ef07f3ef

SHA512
d1aead0a5b2cbcf8c48f604c6777be312cdef9c87f08efd6821586c31baedd3bd2f6e7608066d015968ba98cb3298867bae5b997acc7ba32d3015076dcf8658e

Download Submit
C:\Users\Admin\AppData\Local\Temp\inlE675.tmp

Filesize
1.1MB

MD5
6f4eddf1d1c75637f5f74d087086c8c3

SHA1
3e640e81ddb841a7e8d2d67a57eac327215f38b8

SHA256
84a01330a47dce14019d9c38e0448cac4f79297198678475daf84d61d642344f

SHA512
7b940ac859cb93b4a91cfeb6f54fedf24eed70f4fd2b932e067bb21dbef557383848d46c1d612f6855b3200fc6902f309cfc25fc6952761b9ad41012d1f1e9da

Download Submit
C:\Users\Admin\AppData\Roaming\datread\1.bat

Filesize
3KB

MD5
70c32a548388769424935af37d73cabc

SHA1
2411e148d5bc6b82403e1d7491293810ba76c8a2

SHA256
bd69b2f6f82d1ef3e608423e03c51f40290bdc9e6c2c27b72fa068ca2a9fb8ee

SHA512
785184d29875bb7c89f0bc3ed6ed00bab3cc919af42af0a8e34c05b948be2e14a33b2256a7e6083325571b55e4a19321666fe6243909dd6e96ad9bf0767bf006

Download Submit
C:\Users\Admin\AppData\Roaming\datread\1.inf

Filesize
410B

MD5
66a1f0147fed7ddd19e9bb7ff93705c5

SHA1
9d803c81ea2195617379b880b227892ba30b0bf6

SHA256
4f45ce85e221352f7fe26e04968c7f7267dc24b55cf2b72b929b4c90e48cb764

SHA512
cfe51756ddec75d240249980a4d27870d15983add25058e4d0da4d8a3ea11384d4d228d6cbc95091f91e516e1ab4dfb1e315941dbd95bf717d4b31936311d597

Download Submit
C:\Users\Admin\AppData\Roaming\datread\2.bat

Filesize
3KB

MD5
2dccbc7c9d8e6493c16fab45e323b10c

SHA1
b64f49270de7be232bfdce99cd7670af82baf73e

SHA256
36b2154f812901d1b2dc99d91c960a012a30411fc8b39fa32c74157fef53d3f7

SHA512
90e03bad493dc480f9d6bc976bf9028589522f3b04c5dd0222efffea4b237941b0e594ba51e880c657945c80ff80bb136d6caae6b3841398e9753c7fa47c3f3a

Download Submit
C:\Users\Admin\AppData\Roaming\datread\2.inf

Filesize
248B

MD5
c5eaacddf7fe93d130f1eb67f3fc2d9d

SHA1
ce20a3a2d9925fa4672884ffda2ee200c06ad7ce

SHA256
c740a578ef5867e18bc914ef724c8258a324b4f35591690e91329a10d17f6b45

SHA512
1f9529123cf74f1c53f75d81b9b6dabb127fcef0067c104c5ca044e28450083fa379c256d63d07d4e4053f197c24e02f9e2ab4507f8bb1068032598b52bbbf77

Download Submit
C:\Users\Admin\AppData\Roaming\datread\4.bat

Filesize
228KB

MD5
b2ae87f21c64a409357cb04ceb342ba1

SHA1
c4a6fb63157b3563ba67c2fccbb60ca42697b0d7

SHA256
42546e502df466a339ae99f1617d177039ea60eda0411f8143b1ae33c0712e85

SHA512
9d7e62a17609d41fcb67dfa8ff69dc50962044213d946c6c9481222803d54386a4c5051b799417a33f252bf97ab48969e19e3317b9dbd3f8956494bca70cc09b

Download Submit
memory/1972-103-0x0000000000660000-0x0000000000685000-memory.dmp

Filesize
148KB

Download
memory/1972-1-0x0000000000630000-0x0000000000633000-memory.dmp

Filesize
12KB

Download
memory/1972-5-0x0000000000660000-0x0000000000685000-memory.dmp

Filesize
148KB

Download
memory/1972-0-0x0000000000660000-0x0000000000685000-memory.dmp

Filesize
148KB

Download
memory/1972-24-0x0000000000660000-0x0000000000685000-memory.dmp

Filesize
148KB

Download
memory/1972-7-0x0000000000630000-0x0000000000633000-memory.dmp

Filesize
12KB

Download
memory/4336-92-0x00007FFCD7900000-0x00007FFCD796E000-memory.dmp

Filesize
440KB

Download
memory/4336-67-0x00007FFCD7900000-0x00007FFCD796E000-memory.dmp

Filesize
440KB

Download
memory/4336-78-0x00007FFCD7900000-0x00007FFCD796E000-memory.dmp

Filesize
440KB

Download
memory/4336-80-0x00007FFCD7900000-0x00007FFCD796E000-memory.dmp

Filesize
440KB

Download
memory/4336-81-0x00007FFCD7900000-0x00007FFCD796E000-memory.dmp

Filesize
440KB

Download
memory/4336-82-0x00007FFCD7900000-0x00007FFCD796E000-memory.dmp

Filesize
440KB

Download
memory/4336-75-0x00007FFCD7900000-0x00007FFCD796E000-memory.dmp

Filesize
440KB

Download
memory/4336-87-0x00007FFCD7900000-0x00007FFCD796E000-memory.dmp

Filesize
440KB

Download
memory/4336-71-0x00007FFCD7900000-0x00007FFCD796E000-memory.dmp

Filesize
440KB

Download
memory/4336-70-0x00007FFCD7900000-0x00007FFCD796E000-memory.dmp

Filesize
440KB

Download
memory/4336-69-0x00007FFCD7900000-0x00007FFCD796E000-memory.dmp

Filesize
440KB

Download
memory/4336-93-0x00007FFCD7900000-0x00007FFCD796E000-memory.dmp

Filesize
440KB

Download
memory/4336-84-0x00007FFCD7900000-0x00007FFCD796E000-memory.dmp

Filesize
440KB

Download
memory/4336-66-0x00007FFCD7900000-0x00007FFCD796E000-memory.dmp

Filesize
440KB

Download
memory/4336-95-0x00007FFCD7900000-0x00007FFCD796E000-memory.dmp

Filesize
440KB

Download
memory/4336-97-0x00007FFCD7900000-0x00007FFCD796E000-memory.dmp

Filesize
440KB

Download
memory/4336-100-0x00007FFCD7900000-0x00007FFCD796E000-memory.dmp

Filesize
440KB

Download
memory/4336-102-0x00007FFCD7900000-0x00007FFCD796E000-memory.dmp

Filesize
440KB

Download
memory/4336-101-0x00007FFCD7900000-0x00007FFCD796E000-memory.dmp

Filesize
440KB

Download
memory/4336-77-0x00007FFCD7900000-0x00007FFCD796E000-memory.dmp

Filesize
440KB

Download
memory/4336-104-0x00007FFCD7900000-0x00007FFCD796E000-memory.dmp

Filesize
440KB

Download
memory/4336-105-0x00007FFCD7900000-0x00007FFCD796E000-memory.dmp

Filesize
440KB

Download
memory/4336-113-0x00007FFCD7900000-0x00007FFCD796E000-memory.dmp

Filesize
440KB

Download
memory/4336-64-0x00007FFCD7900000-0x00007FFCD796E000-memory.dmp

Filesize
440KB

Download
memory/4336-117-0x00007FFCD7900000-0x00007FFCD796E000-memory.dmp

Filesize
440KB

Download
memory/4336-112-0x00007FFCD7900000-0x00007FFCD796E000-memory.dmp

Filesize
440KB

Download
memory/4336-108-0x00007FFCD7900000-0x00007FFCD796E000-memory.dmp

Filesize
440KB

Download
memory/4336-125-0x00007FFCD7900000-0x00007FFCD796E000-memory.dmp

Filesize
440KB

Download
memory/4336-54-0x00007FFCD7900000-0x00007FFCD796E000-memory.dmp

Filesize
440KB

Download
memory/4336-126-0x00007FFCD7900000-0x00007FFCD796E000-memory.dmp

Filesize
440KB

Download
memory/4336-107-0x00007FFCD7900000-0x00007FFCD796E000-memory.dmp

Filesize
440KB

Download
memory/4336-132-0x00007FFCD7900000-0x00007FFCD796E000-memory.dmp

Filesize
440KB

Download
memory/4336-106-0x00007FFCD7900000-0x00007FFCD796E000-memory.dmp

Filesize
440KB

Download
memory/4336-139-0x00007FFCD7900000-0x00007FFCD796E000-memory.dmp

Filesize
440KB

Download
memory/4336-142-0x00007FFCD7900000-0x00007FFCD796E000-memory.dmp

Filesize
440KB

Download
memory/4336-141-0x00007FFCD7900000-0x00007FFCD796E000-memory.dmp

Filesize
440KB

Download
memory/4336-143-0x00007FFCD7900000-0x00007FFCD796E000-memory.dmp

Filesize
440KB

Download
memory/4336-140-0x00007FFCD7900000-0x00007FFCD796E000-memory.dmp

Filesize
440KB

Download
memory/4336-51-0x00007FFCD7900000-0x00007FFCD796E000-memory.dmp

Filesize
440KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads