3fa4dec95c282d7aadf80ea9573ad0b79fcc037348e25ba427000bb884a84afa

Analysis

max time kernel
117s
max time network
130s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 07:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

12833057a651cc13e0ca13c5e787e865.exe
Size

684KB
MD5

12833057a651cc13e0ca13c5e787e865
SHA1

91b893de10365e5103c0af1dacc3ead518bf312d
SHA256

3fa4dec95c282d7aadf80ea9573ad0b79fcc037348e25ba427000bb884a84afa
SHA512

a42bdd2ee642d8bc789641163b5fe5ba4b3d79322d9e079ae937a93a5841adcd290dd5c895ea2da74c24869aae8f6dc11ec9d0de9398cf5204824824f73bdd2c
SSDEEP

12288:QCspLBd4fGi46m/X9J1OaSYeGtpJmvtSvLQTtrcntmwfgEepwuNIifZ:gVUVm/XT17SYHnGqQTtAVfVOIix

Score

7^/10

adware discovery spyware stealer upx

Malware Config

Signatures

Executes dropped EXE 9 IoCs

pid	Process
2712	gacutil.exe
2628	gacutil.exe
2676	gacutil.exe
2920	gacutil.exe
744	gacutil.exe
292	gacutil.exe
1976	gacutil.exe
1604	gacutil.exe
2128	gacutil.exe

Loads dropped DLL 27 IoCs

pid	Process
2440	12833057a651cc13e0ca13c5e787e865.exe
744	gacutil.exe
744	gacutil.exe
292	gacutil.exe
292	gacutil.exe
1976	gacutil.exe
1976	gacutil.exe
1604	gacutil.exe
1604	gacutil.exe
2128	gacutil.exe
2128	gacutil.exe
3020	regAsm.exe
3020	regAsm.exe
3020	regAsm.exe
3020	regAsm.exe
3020	regAsm.exe
3020	regAsm.exe
3020	regAsm.exe
3020	regAsm.exe
3020	regAsm.exe
3020	regAsm.exe
3020	regAsm.exe
1792	regAsm.exe
1792	regAsm.exe
1792	regAsm.exe
1792	regAsm.exe
1792	regAsm.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2440-0-0x0000000000400000-0x000000000059C000-memory.dmp	upx
behavioral1/memory/2440-47-0x0000000000400000-0x000000000059C000-memory.dmp	upx
behavioral1/memory/2440-97-0x0000000000400000-0x000000000059C000-memory.dmp	upx
behavioral1/memory/2440-50-0x0000000000400000-0x000000000059C000-memory.dmp	upx

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Installs/modifies Browser Helper Object 2 TTPs 2 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{cb2469cc-f407-419f-833f-6decb2cd2d11}	regAsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{cb2469cc-f407-419f-833f-6decb2cd2d11}\NoExplorer = "1"	regAsm.exe

Drops file in Windows directory 17 IoCs

description	ioc	Process
File created	C:\Windows\Microsoft.NET\Framework\v2.0.50727\gacutil.exe	12833057a651cc13e0ca13c5e787e865.exe
File created	C:\Windows\assembly\GACLock.dat	gacutil.exe
File created	C:\Windows\assembly\tmp\5ZY4HSUI\BandObjectLib.dll	gacutil.exe
File created	C:\Windows\assembly\ngenlock.dat	gacutil.exe
File created	C:\Windows\assembly\tmp\5ZY4HSUI\HtmlEditor.dll	gacutil.exe
File created	C:\Windows\assembly\ngenlock.dat	gacutil.exe
File created	C:\Windows\assembly\tmp\5ZY4HSUI\ShowConnectBar2.dll	gacutil.exe
File created	C:\Windows\assembly\tmp\5ZY4HSUI\Interop.SHDocVw.dll	gacutil.exe
File created	C:\Windows\assembly\ngenlock.dat	gacutil.exe
File created	C:\Windows\assembly\GACLock.dat	gacutil.exe
File created	C:\Windows\assembly\tmp\5ZY4HSUI\ConnectBar2.dll	gacutil.exe
File created	C:\Windows\assembly\ngenlock.dat	gacutil.exe
File created	C:\Windows\assembly\GACLock.dat	gacutil.exe
File created	C:\Windows\Microsoft.NET\Framework\v2.0.50727\gacutil.exe.config	12833057a651cc13e0ca13c5e787e865.exe
File created	C:\Windows\assembly\GACLock.dat	gacutil.exe
File created	C:\Windows\assembly\GACLock.dat	gacutil.exe
File created	C:\Windows\assembly\ngenlock.dat	gacutil.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 40 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{428CCC11-A88E-11EE-BB33-CEEF1DCBEAFA} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410265827"	iexplore.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar\{c117de0b-22ce-4ab3-bbae-b2b3fedc26a8} = "ConnectBar beta"	regAsm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C117DE0B-22CE-4AB3-BBAE-B2B3FEDC26A8}\AppName = "C:\\Users\\Admin\\AppData\\Roaming\\ConnectBar\\ConnectBarBroker.exe"	12833057a651cc13e0ca13c5e787e865.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c193000000000020000000000106600000001000020000000f160839003e659b76838192c4a400eb6a84c900c119d7349470f270ae7a89499000000000e80000000020000200000004976512b324f7500eb54467f9ce7febd7e35ba2a5916c492ee45ad72f6228329200000005c228d60608d52bfda6bd3cb9d1e541473eb4ee435e5d514b6d6f5495d32fce540000000d6bba9bcca09f52e1f3514a6ed3242f246cb116feed435af296f9f665c6b7469ab46d69a913a41623597a59e026c69ad0b62724c92d7c1cd114fc787cbd5ecb3	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c19300000000002000000000010660000000100002000000019efa1f3f28fb7ef3e31a6fb08204a4e6af6d780cb474ae7957888d89da5af4e000000000e8000000002000020000000950ece65fbd882b72b0313874776cbc602ede2ce5a5de192786bdb56e8cae367900000007e57ec5436bc8751f5431c7f548c16624113baf1efbde0e8ba7ed4ba852252e82054aedd219d7f4d4376a999bee6dd991af18b69d1426fbb7f4c83b9c3ac649a67c9f903d4404e06015d7e13e7ff53524b18955fbcb8e486b630af0fb757bb9773a73feac542d9f1113c0dd82372bcbaae46d8135b6385c82653e6556db94f856de7312d18330d71b0727346c01491e840000000968c3cda7bbc52b2efa0544dbe2e8720661eec8303d29eb76c034af532c45dc98a82df05d6de57aa0ebaae748bd9f38d61a1e547c9ef6142ba5e0fde7426c075	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C117DE0B-22CE-4AB3-BBAE-B2B3FEDC26A8}\AppPath = "C:\\Users\\Admin\\AppData\\Roaming\\ConnectBar"	12833057a651cc13e0ca13c5e787e865.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d047191b9b3cda01	iexplore.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar	regAsm.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C117DE0B-22CE-4AB3-BBAE-B2B3FEDC26A8}	12833057a651cc13e0ca13c5e787e865.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C117DE0B-22CE-4AB3-BBAE-B2B3FEDC26A8}\Policy = "3"	12833057a651cc13e0ca13c5e787e865.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ConnectBar2.Communication.ServerSubmitter	regAsm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{90C5238F-C02A-3F25-BA2C-154235BB20BC}\ProgId\ = "ConnectBar2.Communication.ServerSubmitter"	regAsm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{109168B4-30EB-3512-BF3C-79C71BD9AF77}	regAsm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ConnectBar2.UpdateProductDlg\ = "ConnectBar2.UpdateProductDlg"	regAsm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3E475B55-7811-33CA-AA57-9DAAA7CC75D4}\ = "ConnectBar2.UpdateProductDlg"	regAsm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{783A5E3E-06DA-3EC2-909C-BEA1BD08FC9F}\1.0.2.0	regAsm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ConnectBar2.Base.IEFrame\CLSID	regAsm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ConnectBar2.Communication.ServerSubmitter\CLSID	regAsm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{109168B4-30EB-3512-BF3C-79C71BD9AF77}\1.0.2.0	regAsm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ConnectBar2.Helper\CLSID\ = "{CB2469CC-F407-419F-833F-6DECB2CD2D11}"	regAsm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3E475B55-7811-33CA-AA57-9DAAA7CC75D4}\ProgId\ = "ConnectBar2.UpdateProductDlg"	regAsm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F27C7849-F2AF-3528-8AE8-7C29972C7AEF}\InprocServer32\ = "mscoree.dll"	regAsm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ConnectBar2.Helper\ = "ConnectBar2.Helper"	regAsm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{F32033D4-A092-32AF-9AE7-B751AD4D386B}\1.0.2.0\Class = "ConnectBar2.Advertising.AdvertisementInfo"	regAsm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CB2469CC-F407-419F-833F-6DECB2CD2D11}\InprocServer32\1.0.4067.32280\Class = "ConnectBar2.Helper"	regAsm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{4DA46140-9D7C-362B-9CAE-95B0298DACBB}	regAsm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F27C7849-F2AF-3528-8AE8-7C29972C7AEF}\InprocServer32\1.0.2.0\RuntimeVersion = "v2.0.50727"	regAsm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CB2469CC-F407-419F-833F-6DECB2CD2D11}\Implemented Categories	regAsm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{4DA46140-9D7C-362B-9CAE-95B0298DACBB}\1.0.2.0\Assembly = "ConnectBar2, Version=1.0.2.0, Culture=neutral, PublicKeyToken=fcf1044954010473"	regAsm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C117DE0B-22CE-4AB3-BBAE-B2B3FEDC26A8}\InprocServer32\1.0.2.0\Assembly = "ConnectBar2, Version=1.0.2.0, Culture=neutral, PublicKeyToken=fcf1044954010473"	regAsm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CB2469CC-F407-419F-833F-6DECB2CD2D11}\InprocServer32\ThreadingModel = "Both"	regAsm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ConnectBar2.ToolbarUI\CLSID\ = "{C117DE0B-22CE-4AB3-BBAE-B2B3FEDC26A8}"	regAsm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C117DE0B-22CE-4AB3-BBAE-B2B3FEDC26A8}\InprocServer32\Assembly = "ConnectBar2, Version=1.0.2.0, Culture=neutral, PublicKeyToken=fcf1044954010473"	regAsm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3E475B55-7811-33CA-AA57-9DAAA7CC75D4}\InprocServer32\1.0.2.0\Assembly = "ConnectBar2, Version=1.0.2.0, Culture=neutral, PublicKeyToken=fcf1044954010473"	regAsm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F27C7849-F2AF-3528-8AE8-7C29972C7AEF}\InprocServer32\Assembly = "ConnectBar2, Version=1.0.2.0, Culture=neutral, PublicKeyToken=fcf1044954010473"	regAsm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F27C7849-F2AF-3528-8AE8-7C29972C7AEF}\Implemented Categories	regAsm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{90C5238F-C02A-3F25-BA2C-154235BB20BC}\InprocServer32\RuntimeVersion = "v2.0.50727"	regAsm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{109168B4-30EB-3512-BF3C-79C71BD9AF77}\1.0.2.0\Class = "ConnectBar2.Communication.ServerSubmitter+PostTypeEnum"	regAsm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CB2469CC-F407-419F-833F-6DECB2CD2D11}\ProgId\ = "ConnectBar2.Helper"	regAsm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C117DE0B-22CE-4AB3-BBAE-B2B3FEDC26A8}\InprocServer32\1.0.2.0	regAsm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C117DE0B-22CE-4AB3-BBAE-B2B3FEDC26A8}\InprocServer32\1.0.2.0\RuntimeVersion = "v2.0.50727"	regAsm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3E475B55-7811-33CA-AA57-9DAAA7CC75D4}\ProgId	regAsm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F27C7849-F2AF-3528-8AE8-7C29972C7AEF}\InprocServer32\1.0.2.0\Class = "ConnectBar2.Base.IEFrame"	regAsm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{CD82E72E-B091-3A64-A635-1A29E4D073DF}\1.0.2.0\Class = "ConnectBar2.Base.WindowsVersion"	regAsm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Component Categories\{62C8FE65-4EBB-45e7-B440-6E39B2CDBF29}\0 = ".NET Category"	regAsm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ConnectBar2.ToolbarUI	regAsm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3E475B55-7811-33CA-AA57-9DAAA7CC75D4}\InprocServer32\RuntimeVersion = "v2.0.50727"	regAsm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{90C5238F-C02A-3F25-BA2C-154235BB20BC}\InprocServer32\1.0.2.0	regAsm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{109168B4-30EB-3512-BF3C-79C71BD9AF77}\1.0.2.0\Assembly = "ConnectBar2, Version=1.0.2.0, Culture=neutral, PublicKeyToken=fcf1044954010473"	regAsm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CB2469CC-F407-419F-833F-6DECB2CD2D11}\ProgId	regAsm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{4DA46140-9D7C-362B-9CAE-95B0298DACBB}\1.0.2.0\RuntimeVersion = "v2.0.50727"	regAsm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C117DE0B-22CE-4AB3-BBAE-B2B3FEDC26A8}	regAsm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3E475B55-7811-33CA-AA57-9DAAA7CC75D4}\InprocServer32\ = "mscoree.dll"	regAsm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3E475B55-7811-33CA-AA57-9DAAA7CC75D4}\Implemented Categories\{62C8FE65-4EBB-45e7-B440-6E39B2CDBF29}	regAsm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F27C7849-F2AF-3528-8AE8-7C29972C7AEF}\ = "ConnectBar2.Base.IEFrame"	regAsm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{90C5238F-C02A-3F25-BA2C-154235BB20BC}\InprocServer32\1.0.2.0\Assembly = "ConnectBar2, Version=1.0.2.0, Culture=neutral, PublicKeyToken=fcf1044954010473"	regAsm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{90C5238F-C02A-3F25-BA2C-154235BB20BC}\Implemented Categories\{62C8FE65-4EBB-45e7-B440-6E39B2CDBF29}	regAsm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C117DE0B-22CE-4AB3-BBAE-B2B3FEDC26A8}\ = "ConnectBar2.ToolbarUI"	regAsm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ConnectBar2.Base.IEFrame	regAsm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ConnectBar2.UpdateProductDlg	regAsm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ConnectBar2.UpdateProductDlg\CLSID	regAsm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3E475B55-7811-33CA-AA57-9DAAA7CC75D4}\InprocServer32\ThreadingModel = "Both"	regAsm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{90C5238F-C02A-3F25-BA2C-154235BB20BC}\InprocServer32	regAsm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{F32033D4-A092-32AF-9AE7-B751AD4D386B}\1.0.2.0\Assembly = "ConnectBar2, Version=1.0.2.0, Culture=neutral, PublicKeyToken=fcf1044954010473"	regAsm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3E475B55-7811-33CA-AA57-9DAAA7CC75D4}\InprocServer32\Class = "ConnectBar2.UpdateProductDlg"	regAsm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3E475B55-7811-33CA-AA57-9DAAA7CC75D4}\InprocServer32\1.0.2.0	regAsm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{783A5E3E-06DA-3EC2-909C-BEA1BD08FC9F}	regAsm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ConnectBar2.Communication.ServerSubmitter\ = "ConnectBar2.Communication.ServerSubmitter"	regAsm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{90C5238F-C02A-3F25-BA2C-154235BB20BC}\ = "ConnectBar2.Communication.ServerSubmitter"	regAsm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{90C5238F-C02A-3F25-BA2C-154235BB20BC}\InprocServer32\1.0.2.0\RuntimeVersion = "v2.0.50727"	regAsm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3E475B55-7811-33CA-AA57-9DAAA7CC75D4}	regAsm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{783A5E3E-06DA-3EC2-909C-BEA1BD08FC9F}\1.0.2.0\Assembly = "ConnectBar2, Version=1.0.2.0, Culture=neutral, PublicKeyToken=fcf1044954010473"	regAsm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F27C7849-F2AF-3528-8AE8-7C29972C7AEF}\ProgId	regAsm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ConnectBar2.Helper	regAsm.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2280	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2280	iexplore.exe
2280	iexplore.exe
1092	IEXPLORE.EXE
1092	IEXPLORE.EXE
1092	IEXPLORE.EXE
1092	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2440 wrote to memory of 2680	2440	12833057a651cc13e0ca13c5e787e865.exe	27
PID 2440 wrote to memory of 2680	2440	12833057a651cc13e0ca13c5e787e865.exe	27
PID 2440 wrote to memory of 2680	2440	12833057a651cc13e0ca13c5e787e865.exe	27
PID 2440 wrote to memory of 2680	2440	12833057a651cc13e0ca13c5e787e865.exe	27
PID 2440 wrote to memory of 2680	2440	12833057a651cc13e0ca13c5e787e865.exe	27
PID 2440 wrote to memory of 2680	2440	12833057a651cc13e0ca13c5e787e865.exe	27
PID 2440 wrote to memory of 2680	2440	12833057a651cc13e0ca13c5e787e865.exe	27
PID 2440 wrote to memory of 2684	2440	12833057a651cc13e0ca13c5e787e865.exe	29
PID 2440 wrote to memory of 2684	2440	12833057a651cc13e0ca13c5e787e865.exe	29
PID 2440 wrote to memory of 2684	2440	12833057a651cc13e0ca13c5e787e865.exe	29
PID 2440 wrote to memory of 2684	2440	12833057a651cc13e0ca13c5e787e865.exe	29
PID 2440 wrote to memory of 2684	2440	12833057a651cc13e0ca13c5e787e865.exe	29
PID 2440 wrote to memory of 2684	2440	12833057a651cc13e0ca13c5e787e865.exe	29
PID 2440 wrote to memory of 2684	2440	12833057a651cc13e0ca13c5e787e865.exe	29
PID 2440 wrote to memory of 2860	2440	12833057a651cc13e0ca13c5e787e865.exe	31
PID 2440 wrote to memory of 2860	2440	12833057a651cc13e0ca13c5e787e865.exe	31
PID 2440 wrote to memory of 2860	2440	12833057a651cc13e0ca13c5e787e865.exe	31
PID 2440 wrote to memory of 2860	2440	12833057a651cc13e0ca13c5e787e865.exe	31
PID 2440 wrote to memory of 2860	2440	12833057a651cc13e0ca13c5e787e865.exe	31
PID 2440 wrote to memory of 2860	2440	12833057a651cc13e0ca13c5e787e865.exe	31
PID 2440 wrote to memory of 2860	2440	12833057a651cc13e0ca13c5e787e865.exe	31
PID 2440 wrote to memory of 2780	2440	12833057a651cc13e0ca13c5e787e865.exe	33
PID 2440 wrote to memory of 2780	2440	12833057a651cc13e0ca13c5e787e865.exe	33
PID 2440 wrote to memory of 2780	2440	12833057a651cc13e0ca13c5e787e865.exe	33
PID 2440 wrote to memory of 2780	2440	12833057a651cc13e0ca13c5e787e865.exe	33
PID 2440 wrote to memory of 2780	2440	12833057a651cc13e0ca13c5e787e865.exe	33
PID 2440 wrote to memory of 2780	2440	12833057a651cc13e0ca13c5e787e865.exe	33
PID 2440 wrote to memory of 2780	2440	12833057a651cc13e0ca13c5e787e865.exe	33
PID 2440 wrote to memory of 2712	2440	12833057a651cc13e0ca13c5e787e865.exe	35
PID 2440 wrote to memory of 2712	2440	12833057a651cc13e0ca13c5e787e865.exe	35
PID 2440 wrote to memory of 2712	2440	12833057a651cc13e0ca13c5e787e865.exe	35
PID 2440 wrote to memory of 2712	2440	12833057a651cc13e0ca13c5e787e865.exe	35
PID 2440 wrote to memory of 2588	2440	12833057a651cc13e0ca13c5e787e865.exe	37
PID 2440 wrote to memory of 2588	2440	12833057a651cc13e0ca13c5e787e865.exe	37
PID 2440 wrote to memory of 2588	2440	12833057a651cc13e0ca13c5e787e865.exe	37
PID 2440 wrote to memory of 2588	2440	12833057a651cc13e0ca13c5e787e865.exe	37
PID 2440 wrote to memory of 2648	2440	12833057a651cc13e0ca13c5e787e865.exe	40
PID 2440 wrote to memory of 2648	2440	12833057a651cc13e0ca13c5e787e865.exe	40
PID 2440 wrote to memory of 2648	2440	12833057a651cc13e0ca13c5e787e865.exe	40
PID 2440 wrote to memory of 2648	2440	12833057a651cc13e0ca13c5e787e865.exe	40
PID 2440 wrote to memory of 2628	2440	12833057a651cc13e0ca13c5e787e865.exe	58
PID 2440 wrote to memory of 2628	2440	12833057a651cc13e0ca13c5e787e865.exe	58
PID 2440 wrote to memory of 2628	2440	12833057a651cc13e0ca13c5e787e865.exe	58
PID 2440 wrote to memory of 2628	2440	12833057a651cc13e0ca13c5e787e865.exe	58
PID 2440 wrote to memory of 612	2440	12833057a651cc13e0ca13c5e787e865.exe	57
PID 2440 wrote to memory of 612	2440	12833057a651cc13e0ca13c5e787e865.exe	57
PID 2440 wrote to memory of 612	2440	12833057a651cc13e0ca13c5e787e865.exe	57
PID 2440 wrote to memory of 612	2440	12833057a651cc13e0ca13c5e787e865.exe	57
PID 2440 wrote to memory of 2036	2440	12833057a651cc13e0ca13c5e787e865.exe	48
PID 2440 wrote to memory of 2036	2440	12833057a651cc13e0ca13c5e787e865.exe	48
PID 2440 wrote to memory of 2036	2440	12833057a651cc13e0ca13c5e787e865.exe	48
PID 2440 wrote to memory of 2036	2440	12833057a651cc13e0ca13c5e787e865.exe	48
PID 2440 wrote to memory of 2676	2440	12833057a651cc13e0ca13c5e787e865.exe	45
PID 2440 wrote to memory of 2676	2440	12833057a651cc13e0ca13c5e787e865.exe	45
PID 2440 wrote to memory of 2676	2440	12833057a651cc13e0ca13c5e787e865.exe	45
PID 2440 wrote to memory of 2676	2440	12833057a651cc13e0ca13c5e787e865.exe	45
PID 2440 wrote to memory of 2948	2440	12833057a651cc13e0ca13c5e787e865.exe	47
PID 2440 wrote to memory of 2948	2440	12833057a651cc13e0ca13c5e787e865.exe	47
PID 2440 wrote to memory of 2948	2440	12833057a651cc13e0ca13c5e787e865.exe	47
PID 2440 wrote to memory of 2948	2440	12833057a651cc13e0ca13c5e787e865.exe	47
PID 2440 wrote to memory of 2952	2440	12833057a651cc13e0ca13c5e787e865.exe	50
PID 2440 wrote to memory of 2952	2440	12833057a651cc13e0ca13c5e787e865.exe	50
PID 2440 wrote to memory of 2952	2440	12833057a651cc13e0ca13c5e787e865.exe	50
PID 2440 wrote to memory of 2952	2440	12833057a651cc13e0ca13c5e787e865.exe	50

C:\Users\Admin\AppData\Local\Temp\12833057a651cc13e0ca13c5e787e865.exe
"C:\Users\Admin\AppData\Local\Temp\12833057a651cc13e0ca13c5e787e865.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:2440
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\regAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\regAsm.exe" /unregister "C:\Users\Admin\AppData\Roaming\ConnectBar\ConnectBar2.dll"
  2⤵
  PID:2680
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\regAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\regAsm.exe" /unregister "C:\Users\Admin\AppData\Roaming\ConnectBar\ShowConnectBar2.dll"
  2⤵
  PID:2684
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\regAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\regAsm.exe" /unregister "C:\Users\Admin\AppData\Roaming\ConnectBar\ConnectBar.dll"
  2⤵
  PID:2860
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\regAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\regAsm.exe" /unregister "C:\Users\Admin\AppData\Roaming\ConnectBar\ConnectBarShower.dll"
  2⤵
  PID:2780
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\gacutil.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\gacutil.exe" /u "C:\Users\Admin\AppData\Roaming\ConnectBar\ConnectBar2.dll"
  2⤵
  - Executes dropped EXE
  PID:2712
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c rd /s /q "C:\Windows\assembly\GAC_MSIL\C:\Users\Admin\AppData\Roaming\ConnectBar\ConnectBar2.dll"
  2⤵
  PID:2588
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c rd /s /q "C:\Windows\assembly\C:\Users\Admin\AppData\Roaming\ConnectBar\ConnectBar2.dll"
  2⤵
  PID:2648
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\gacutil.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\gacutil.exe" /u "C:\Users\Admin\AppData\Roaming\ConnectBar\ConnectBar.dll"
  2⤵
  - Executes dropped EXE
  PID:2676
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c rd /s /q "C:\Windows\assembly\GAC_MSIL\C:\Users\Admin\AppData\Roaming\ConnectBar\ConnectBar.dll"
  2⤵
  PID:2948
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c rd /s /q "C:\Windows\assembly\C:\Users\Admin\AppData\Roaming\ConnectBar\ShowConnectBar2.dll"
  2⤵
  PID:2036
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c rd /s /q "C:\Windows\assembly\C:\Users\Admin\AppData\Roaming\ConnectBar\ConnectBar.dll"
  2⤵
  PID:2952
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c rd /s /q "C:\Windows\assembly\GAC_MSIL\C:\Users\Admin\AppData\Roaming\ConnectBar\ConnectBarShower.dll"
  2⤵
  PID:2616
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c rd /s /q "C:\Windows\assembly\C:\Users\Admin\AppData\Roaming\ConnectBar\ConnectBarShower.dll"
  2⤵
  PID:1808
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\gacutil.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\gacutil.exe" /u "C:\Users\Admin\AppData\Roaming\ConnectBar\ConnectBarShower.dll"
  2⤵
  - Executes dropped EXE
  PID:2920
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c rd /s /q "C:\Windows\assembly\GAC_MSIL\C:\Users\Admin\AppData\Roaming\ConnectBar\ShowConnectBar2.dll"
  2⤵
  PID:612
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\gacutil.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\gacutil.exe" /u "C:\Users\Admin\AppData\Roaming\ConnectBar\ShowConnectBar2.dll"
  2⤵
  - Executes dropped EXE
  PID:2628
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\gacutil.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\gacutil.exe" /if "C:\Users\Admin\AppData\Roaming\ConnectBar\Interop.SHDocVw.dll"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:744
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\gacutil.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\gacutil.exe" /if "C:\Users\Admin\AppData\Roaming\ConnectBar\HtmlEditor.dll"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:292
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\gacutil.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\gacutil.exe" /if "C:\Users\Admin\AppData\Roaming\ConnectBar\ShowConnectBar2.dll"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:2128
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\regAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\regAsm.exe" "C:\Users\Admin\AppData\Roaming\ConnectBar\ConnectBar2.dll"
  2⤵
  - Loads dropped DLL
  - Modifies Internet Explorer settings
  - Modifies registry class
  PID:3020
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\regAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\regAsm.exe" "C:\Users\Admin\AppData\Roaming\ConnectBar\ShowConnectBar2.dll"
  2⤵
  - Loads dropped DLL
  - Installs/modifies Browser Helper Object
  - Modifies registry class
  PID:1792
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://connectbar.net/thankyou.html
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  PID:2280
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2280 CREDAT:275457 /prefetch:2
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:1092
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\gacutil.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\gacutil.exe" /if "C:\Users\Admin\AppData\Roaming\ConnectBar\ConnectBar2.dll"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:1604
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\gacutil.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\gacutil.exe" /if "C:\Users\Admin\AppData\Roaming\ConnectBar\BandObjectLib.dll"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:1976

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Browser Extensions

T1176

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
637507b6e6188d2a55f2128c80a1fa35

SHA1
fe6b0d9ba2a37a2dcb0a643ebb852bda57f20da6

SHA256
312b164c8a15ebb43a6fc2d986e5eeccf8f7f4273ccdccad4d92fa26765a742c

SHA512
c9f2ad27db7de17acd9a23c754758ce772d59d22f809f696e8c0872b3b2cb8be789336482f3ef3121ab8ccb9a795b8dbbed0b3192645939c9c1986eae442624e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ee6d7728be96977b3a53e320a3cf9952

SHA1
8c660c11bb12c4f9b12c569839a37568536127f4

SHA256
8964ac305568146dc31a19357628d6ef1f68f7d999ee256cd87dc8d19183f5d1

SHA512
746fa638278d04806a6cbd846ce2f38807dfbeeb79194c1f78fe9d3e80ca7334c6ce7eb7abb95f37150cbf54d68cfffcb74792cf1daa0c91e93ed9bf775c1e00

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
292b2ee38d53ed3ae2b602d46954f390

SHA1
bd409558b573294a35b086c4a0be13280da7674a

SHA256
b90eeb913997072bf79fd6a8d7a598f29352af02bfb21b4450b2492f84d6e1ef

SHA512
f0e8ebf028970feb1e84fc8df20743fc5d7f788016c9d2325d9ac59418c7634145f9706631f4a8ad1e4e95ad0b5b130e85a37338fa148e7a424bfac69d2c9e98

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4b8083e207536dc97538edd5f51ba7ba

SHA1
78926b96ef65944e8df5761931f5ab1794fa2b59

SHA256
8fb2524bdc85ecd06e1a39784afeec66645761690d55e303593500468ab675a0

SHA512
fca6965737d232ea534e33a6906ca8ab12794af35df9358209e3a55b29a6a398b9583f15162c597da0e7a7452dee660d642aeb5a8081b8f7adb38017dcafa614

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c7876aaf632d0b176809183831b6a049

SHA1
c2dd0739438733773c3cafc3e640c9593039f460

SHA256
b1fae111679b10894fbde13be2bed42544e7e848ddf1501eb30de0a0fc322846

SHA512
e67140c812a0c96deb16ab9ae1a5f946a5be4566843fc090436d8fe9d2facd22a333152919b8c01b1aac28ca49f305e624e917cf5cc91142a613e09c91c8bbd9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0cd7fb090b78785e6724d24bae5e8a19

SHA1
39df03064a63fc5ea62717a6ade601a0e3a67cff

SHA256
3a64a0cc63170fb4a6d4881315b4499819f6ff89798719288a5f858f044452cd

SHA512
2d024263a1c302107f1fd20606facf63a159a429f1781fcdabc95aed2a479ee4d79b709718ee6a583ba9e581700d3ae077843408341c8f9d611cf753fd147a65

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
22a06f9882207ad9e439a3382d0f345e

SHA1
71c7683171fd267590de93630d8c5b03e25bed90

SHA256
c7796fa732586bdd99016e24153cd9c3b8c6713e7e3966034224a6be408377ec

SHA512
4c9ae508435279c0b25e7c897c78d5997b1a962b287c4bda3e8c940ffc112da907ac2270d929bcee8fe0508b6f16f07edf13b371ddfef96803ce9e71d1f8ca74

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabFCF6.tmp

Filesize
36KB

MD5
e0e5cee4ce9975f7a4460893261eefd3

SHA1
7093be7372594240edb78cc8f02862368e4b65a6

SHA256
5f225560b271d9c94882e2fd9da9accbc331cc8e20e1771d51df369d76084a24

SHA512
d36a30e9cd49ab2cbc48f3da7c6f0a027aaf9147a08630206fd59e94606e45c550c18c52308027c466458cb9942ed11f13585ea3be32d60277a740cae30d9be4

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarFD88.tmp

Filesize
9KB

MD5
7be67a915cfe85f79123438c66319aab

SHA1
1e66e1e6fcad6f367d9793971944a26ec2bc9c8d

SHA256
13c798fb94fe0250b26ed288de9a521e5db6c554f07328a6633ef42fb8e4d4d2

SHA512
64cf71e10325bd663c45fbf24d9a11da13c885677f23dd943b1a719e61a6c06e2e4112241720b24cafc3e648258a7767f44c07f7c315dbcafd4be20f3a6d8105

Download Submit
C:\Users\Admin\AppData\Roaming\ConnectBar\ConnectBar2.dll

Filesize
219KB

MD5
505c6029883210141b7ad6db5c124fcf

SHA1
642780f6c83cfa640c80487084c321410d87cc0c

SHA256
e8a78fdf7abfe35b0f3635b94c873a136d7b67b1a3896768660e67bb14ca6469

SHA512
91442b7520be7f15a0be71616c1851859eb655d7f3256725c34f28699c74a8a0abad5ad792505f4bcbe00621bb523e9118daba219768651fbd1a51f579b867dc

Download Submit
C:\Users\Admin\AppData\Roaming\ConnectBar\HtmlEditor.dll

Filesize
111KB

MD5
a978364f6f2f50aa08b679e792161ab7

SHA1
35f091d41852f6d077dd9cdface44a002be6861a

SHA256
51f0d0a3a2b45eff8f664b634c0881517f9c68676c6478f63e4b0f4796be093c

SHA512
38e0c7ffff0ba19b869a2254279aebe3232905c108d83f235bee3a9d977eb678e68f9e2d6a7f10310bdea155241c1691dbaf249a940d10edca87f6504b729350

Download Submit
C:\Users\Admin\AppData\Roaming\ConnectBar\Interop.SHDocVw.dll

Filesize
131KB

MD5
01b1fa94c3fa2cdea134712f1e96d433

SHA1
60c059b304d7cdfcbf25446f3d434f05d4d238e6

SHA256
3ba3548ec752ad567d8af3427d358aa53d96942dd2b950fcfeebdf1a83c5a36a

SHA512
fa4b496c3be15c7deffe1006f94b38fb4066ba37bf27611ce51519ee1efb25247b0aae359026cdedfbfd76bced4aacc18a277f4dcf05a7a6034c658cf6d3a687

Download Submit
C:\Windows\Microsoft.NET\Framework\v2.0.50727\gacutil.exe

Filesize
100KB

MD5
6df9edc869963b5c10cd1a8d55de2cfb

SHA1
59836c3941f62fc4ed0246eaed30e0742495e580

SHA256
577c3bee466b3023104803741de0f0b68256f9e3afd6b9612d6f10dce98df85a

SHA512
2491ecbfd851fa01824d626ca7be298dc87105505e55d5676535aacc07b1cd12fe614ba8d173d3173e7ae73fda17763da57f82dfa1b0f7a194aa86eb4ba5b55f

Download Submit
C:\Windows\Microsoft.NET\Framework\v2.0.50727\gacutil.exe

Filesize
90KB

MD5
93ac2930c075d8b6a612e793abaf9b0b

SHA1
e97c1d90f510f9f1a55cfa0c142d29f2604ef556

SHA256
af6f0839a8f3375c8351f6818b6d2f2620454609ac7b247e599b7b1b79be1465

SHA512
afc54c274c01f2ee1bc46fc2562ff662bfb46d43597f38df88fa049e0597236f67894f6445635c51374cbeff29fc9b1254b806f1bdc12a4533c0e79bbeb07764

Download Submit
C:\Windows\Microsoft.NET\Framework\v2.0.50727\gacutil.exe

Filesize
67KB

MD5
428360445474ffa24563c0e731cd05aa

SHA1
0b10a21be5a87a07d0a91e49929eff5e9b96bbc3

SHA256
961961455b5ecba7fb8c3d5f7ca7a5e0a93e822b45ef62993bf066f5942be90c

SHA512
262cc513ed0a9f7398a4f93187403b7c216bf1f4008f34ca681b921b64eaa22b9825831f4b6cf007ec1ea5ea4637e79fc1cb78cf81a2cf61f2bff3e19d4cc8b6

Download Submit
C:\Windows\Microsoft.NET\Framework\v2.0.50727\gacutil.exe.config

Filesize
181B

MD5
0366f988e5ea426d80338070d8fa241b

SHA1
153b90af59d0598a0d5f5e083cb7ff24e2f7adcf

SHA256
325b14941e79aeb570eb4062714d446f70b51db3c14fa58c5d2f90c8dafe3c3e

SHA512
563a39c5958ae6f507e37923959a8a2608c7e9a6f338053edc142d8038849043c6050df2946116876102704ff14d6b36314aca468d91a7f3279754df2aba0bc2

Download Submit
C:\Windows\assembly\GAC_MSIL\BandObjectLib\1.0.0.0__4b827ebe229d539f\BandObjectLib.dll

Filesize
28KB

MD5
488511b9d27fdcf7fb341178610fe12d

SHA1
0c99beca591a73b9688dff3adca829671455a450

SHA256
7169f4300805667febdfa30f8850cd00ca222607192cb2020562ace6fc7dcadb

SHA512
2efa66b70b8d677c6a1c96c5bca8e106f89f5b87792c7af36cecf4cff353938c792b3342533799226bf06fe1b45bd652dfa662222e1863a127f2d882a8c6d255

Download Submit
C:\Windows\assembly\GAC_MSIL\ConnectBar2\1.0.2.0__fcf1044954010473\ConnectBar2.dll

Filesize
23KB

MD5
e8f0407e52cd73c81ca8294a15d02f00

SHA1
7120df02fb0f1c38fa8cf51d6df89c18275cb3a4

SHA256
8a85f4bd6c2fcc6165d37642fc23a9b34f08e2d8dc38d043d656dfa41f708b2b

SHA512
4d078e239566458e747a1377f40e61e71daf8119288d7498730435fcffe6f2d29e12b0a81f495ac2130f605418e72b66d1f7f36bd4619fddad9479ef16b683b3

Download Submit
C:\Windows\assembly\GAC_MSIL\Interop.SHDocVw\1.1.0.0__4b827ebe229d539f\Interop.SHDocVw.dll

Filesize
63KB

MD5
f568205478e8e8f94770480f3e2fa9e0

SHA1
f50e7ef04ccf1d804b0fcf01c252cff564029031

SHA256
c3cf94930c34df7f4413c6ed95eff6ef65de3e37c4db7e7541bd6a682f5fb83e

SHA512
755115502297b50e172527202fd42026b7cdedee32e410b537a9663f66dbf087d3c1b3eda0dcbbe8ea9cd33546c324a15041ffead078af031ff68b3e2ba03bc8

Download Submit
\Users\Admin\AppData\Roaming\ConnectBar\ConnectBar2.dll

Filesize
222KB

MD5
c62c4e9f1b5ac076556c94f7d46fdc32

SHA1
0bef112d419e399ace3aa10faad162af2f6c133e

SHA256
00c6052cf2d109230a8a3d77661de1a8e686614215745d3f8aabddffa4949edc

SHA512
9aa048ab110d7b2e79790825ccae70832c9ddaa1ae41a24102c074c7120b002a1c2b7d6a85a7ffba84f714f5f676040d196eb08b3d77d9278ff13b89ebd60ebb

Download Submit
\Users\Admin\AppData\Roaming\ConnectBar\ConnectBar2.dll

Filesize
68KB

MD5
63580494f29a57abb42f0b0227cf26a1

SHA1
942f3883cf466075b70d4f097933ecc26ffb6301

SHA256
bab7ce98247b1976c3f734587f24528d9f804f18b78c981b45947a39809d2f95

SHA512
874d8fa57f0f2d536fbfddeeaa98dc14264f5eae328dfb2378a7183294f1ee465f5e4e6ed48d926faea9850b9187d8e656e4fb51a0296705e7e92cbf8be61cca

Download Submit
\Users\Admin\AppData\Roaming\ConnectBar\ConnectBar2.dll

Filesize
35KB

MD5
4a681c4258c1ae1cb8e3026cdca0c2f7

SHA1
e5e3af3546ddef50a0afb17e6a7aaa1834d0fcca

SHA256
653a3fab0fa2a042b16fdb03148355ae7a79c6227c65fe2264a7fabb63b79c61

SHA512
6c1acbbefaa9dedf532bedb88b8f8d225a9d518d2a98b02be08ecbf8e90f1eb87410cdf24feef075c1ce23db78b91f614685b57ed465ad6568c8e7aeeb2552ea

Download Submit
\Users\Admin\AppData\Roaming\ConnectBar\ConnectBar2.dll

Filesize
75KB

MD5
4a1d64abae547fbdfad21f739c46136a

SHA1
1869c1cc682d13ea78abe473dd5ef07ada4894ed

SHA256
ec3af9b1e374cff7a651f59478f0e9a624aa1440ced071e7876bd4995847823c

SHA512
0588a9c4eac0664ace8afbb86d3b9c68ac25efc58180b6fe85c9d1bd302087c5c9fda3bd86299f244d14703d53d068e635fe5e5b9df410857674eec589388b59

Download Submit
\Users\Admin\AppData\Roaming\ConnectBar\HtmlEditor.dll

Filesize
47KB

MD5
524a19330a69bcba34e8d4e0f4c113f6

SHA1
eaa2beacb494198d76caa749f17c9f64516b041c

SHA256
985ac0d9600284df80a9fb1d102257fd16ea201b2865d47db451d917cc504ea6

SHA512
265d0af6e8a41fe3250672255fc72eb3e512103c0b18f231423e35d675aa4a6c582282dfba99e234714aba90c3901f7095316300383bc5c576db98fc3feca143

Download Submit
\Users\Admin\AppData\Roaming\ConnectBar\HtmlEditor.dll

Filesize
64KB

MD5
3da1cb5fe9f442311e7684d939cfe3ee

SHA1
88659b5da8611a5ba484d97d8881964b1de1f9b8

SHA256
29d8d8cbecf9136c4ed517165f296def312b28ace05e76d01cdac33e6ed92589

SHA512
f424b2f41b96ac9208d1fdbdbc0ac762d659abe2e893a859ea005434c4a6c8e05f07ae32b136e9564324ab97ef12901966457273a38b046985b7967c70ce352a

Download Submit
\Users\Admin\AppData\Roaming\ConnectBar\Interop.SHDocVw.dll

Filesize
101KB

MD5
bc0f866fc76bd83e1d5ae6c1874abbc9

SHA1
cc1d8272949525ad9bc9eb0e946acd8fc1218482

SHA256
b9868f34adde866f044d229922cd4dc14d19ee491a566b036b9a4ca4e0df62fc

SHA512
1c1e03eca331ea2120f66c32585e465d9318378b31dfde34087f90d8710f7856dabf09fc5ab458678be59894b80f64664bf6718689028d216426e3115d03db2a

Download Submit
\Users\Admin\AppData\Roaming\ConnectBar\Interop.SHDocVw.dll

Filesize
136KB

MD5
92b9e317c1fbe25e8b6b8d83ab80b10d

SHA1
84c3035be5dc4b9b427ee35dc77eaaada761aff9

SHA256
a8f96a9cb8c081d5a83bfcb9d79c38aeae9b52c9f2162308450c395a7e145e33

SHA512
c2c72b842ad381cf74ffee487fd9515e9b367decb272cf394d7863995118e9d74f252ae0845907c7720f6c099288ec5707c541d6fe9acf4d83c7abd9e7fee0ad

Download Submit
\Users\Admin\AppData\Roaming\ConnectBar\ShowConnectBar2.dll

Filesize
6KB

MD5
9010710ecbe2f6718bb7f24d7370b22b

SHA1
e3188e1a90f809905f17ce5c77c43d71a796dfe1

SHA256
6266d541f24f3f91d51406d888735841f0a97f3b6e0610af36dfd1b2fde7a11d

SHA512
d5a743ebe2a552e56be1dda0e32d48728df9b02bcbbe6eeb36532652356835b3217a2ee2c895a3c71fe52e8846ac67df986b56ff6e5654d0859a2f605317bf44

Download Submit
\Windows\assembly\GAC_MSIL\BandObjectLib\1.0.0.0__4b827ebe229d539f\BandObjectLib.dll

Filesize
21KB

MD5
ab4977909d69b9a3736721e7daba9096

SHA1
0021f09b63be80d4cad5e838d760e6ca9a4391c9

SHA256
3a247b0e795b13ecd8e5b5630bcbb8294d0d4a28dce28f10442134bac3e379fc

SHA512
cab0a7dc07e81695b1501914026c3b1b747b2252110b2c527f59dfed7c0a4214a06a074c114302f3f6f0b50f2c2b2b36d017baccd981978343752765dc3cd91a

Download Submit
\Windows\assembly\GAC_MSIL\ConnectBar2\1.0.2.0__fcf1044954010473\ConnectBar2.dll

Filesize
105KB

MD5
b441aaff2fc3cec3843e9a015146f1d3

SHA1
66e78ba5287a7988f7b6d0628e41281f1e850257

SHA256
fc3706d9218be7f3be9532356dd0dda4d10c9f2d23e9c89edde7d2695fd8e267

SHA512
0cc484e1e382dd9fa92910de26264577c35ca813f5f0903b07ffb55a8e342c85f69b13731b6bd603d78f89de923fd218a0bdcd8ec3c08177c1c5611cafa31b4e

Download Submit
\Windows\assembly\GAC_MSIL\ConnectBar2\1.0.2.0__fcf1044954010473\ConnectBar2.dll

Filesize
88KB

MD5
5b2d3d708d5cafc86116dc1ab5525b96

SHA1
56839092150125af3b66a154b5fe26c4d240cb75

SHA256
93e60100adaaca5e8c649475869db17a9377664b85e5a90153f6c28f0d7ab329

SHA512
a44caa96dc2af2e59892534e222173d8ba2d12e5d4582168bd55d191144706d8e6cae17f1d715eb65eb339f0642771b9ec1415cc8fae3cc0ac16ed867c47b78b

Download Submit
\Windows\assembly\GAC_MSIL\ConnectBar2\1.0.2.0__fcf1044954010473\ConnectBar2.dll

Filesize
62KB

MD5
926cf8cef2e6312d936657c56c41572e

SHA1
88a5cdee50a4c9998a614c6c84fb2e1d1152f69e

SHA256
4e5d9a90a747d30119422c577bc038b3f289129bd06579740ee2528adb215428

SHA512
be3233e97b542d6f486a3a5a40bf3c53f86ded915120c20c816486d27430a890b5f11aed768342006a2d9468f208f024014556613118080c6cbc6e4d21992ad7

Download Submit
\Windows\assembly\GAC_MSIL\Interop.SHDocVw\1.1.0.0__4b827ebe229d539f\Interop.SHDocVw.dll

Filesize
42KB

MD5
6b8c06f07a0acd7d8a49a178e2ecb329

SHA1
30eeb930eb3c00c5ce78d00f7e6ec7ddcd4140fc

SHA256
fbe9fd9e4505f9ab83e797c338fcca321799cb6cc0c979a33796edf88b63a914

SHA512
5754bb7c7de1e82300dc4b0dd7d246f958a5d979b70f16b82c1b66d69ee5999a458fa70ef975181cbdd808efa9d5af952e3b0f8f21723eeedec24c3aa34acc44

Download Submit
\Windows\assembly\GAC_MSIL\Interop.SHDocVw\1.1.0.0__4b827ebe229d539f\Interop.SHDocVw.dll

Filesize
47KB

MD5
111f108845ea4bec0f363652317e2a0a

SHA1
395d494bfe963e163665945faa5ba888d3f1a14c

SHA256
30db538d01ab98bd5d8164229ade092c7247f947039c099177d574d24c66c40b

SHA512
3d346f3aa98be290ac0c26499dabe368f30bc2d24959b346ca185be8ebe5076c9e5eb67d94693e5f14d4a77a3e2fc791b726018462c47c1a2f2bd1d044b678aa

Download Submit
\Windows\assembly\GAC_MSIL\Interop.SHDocVw\1.1.0.0__4b827ebe229d539f\Interop.SHDocVw.dll

Filesize
42KB

MD5
6f97f93220350ddcb61b0f9da6b89958

SHA1
3905750f7b9b80a3a150d2a7ffd02564630f1f3a

SHA256
56a3c46a5f1f50b01578e14cfb2dabc8398bfec5b51232b0b8df86155de4c846

SHA512
b4fc3b63789de7cca70a1ac9ff1527791e45ed3ba6dea9bec543b3052003b7e371969c70c2954daf6d2b7a3b83f6cf739bebdf425d148c24d078c2f5ef4875d6

Download Submit
memory/292-39-0x0000000000540000-0x0000000000580000-memory.dmp

Filesize
256KB

Download
memory/744-31-0x0000000000C00000-0x0000000000C40000-memory.dmp

Filesize
256KB

Download
memory/1604-59-0x0000000000930000-0x0000000000970000-memory.dmp

Filesize
256KB

Download
memory/1792-531-0x00000000745A0000-0x0000000074B4B000-memory.dmp

Filesize
5.7MB

Download
memory/1792-94-0x00000000745A0000-0x0000000074B4B000-memory.dmp

Filesize
5.7MB

Download
memory/2128-69-0x00000000022D0000-0x0000000002310000-memory.dmp

Filesize
256KB

Download
memory/2128-530-0x00000000022D0000-0x0000000002310000-memory.dmp

Filesize
256KB

Download
memory/2440-47-0x0000000000400000-0x000000000059C000-memory.dmp

Filesize
1.6MB

Download
memory/2440-50-0x0000000000400000-0x000000000059C000-memory.dmp

Filesize
1.6MB

Download
memory/2440-56-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2440-1-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2440-97-0x0000000000400000-0x000000000059C000-memory.dmp

Filesize
1.6MB

Download
memory/2440-0-0x0000000000400000-0x000000000059C000-memory.dmp

Filesize
1.6MB

Download
memory/2680-5-0x00000000745A0000-0x0000000074B4B000-memory.dmp

Filesize
5.7MB

Download
memory/2680-4-0x00000000745A0000-0x0000000074B4B000-memory.dmp

Filesize
5.7MB

Download
memory/2684-70-0x0000000074580000-0x0000000074B2B000-memory.dmp

Filesize
5.7MB

Download
memory/2684-6-0x0000000074580000-0x0000000074B2B000-memory.dmp

Filesize
5.7MB

Download
memory/2780-10-0x0000000074580000-0x0000000074B2B000-memory.dmp

Filesize
5.7MB

Download
memory/2860-7-0x00000000745A0000-0x0000000074B4B000-memory.dmp

Filesize
5.7MB

Download
memory/2860-87-0x00000000745A0000-0x0000000074B4B000-memory.dmp

Filesize
5.7MB

Download
memory/3020-81-0x0000000074480000-0x0000000074A2B000-memory.dmp

Filesize
5.7MB

Download
memory/3020-86-0x0000000074480000-0x0000000074A2B000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads