16302786e3373669844875d73dbbf99f632d4f748cdafcebd8434cc2d5450394

Analysis

max time kernel
150s
max time network
147s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30-12-2023 14:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1ae3206072ef33e6417ca78a8b8ec71b.dll
Size

224KB
MD5

1ae3206072ef33e6417ca78a8b8ec71b
SHA1

9ce4f5b38bf23f2a4e7a4b38fa687a221cddbf99
SHA256

16302786e3373669844875d73dbbf99f632d4f748cdafcebd8434cc2d5450394
SHA512

30589d0a2c65231967370c4f57134c1f739d05dd8970f584f542317eabb0cbf134769ca4d64c1cb683c8552ada185b92e883e004fbe59cad8ad406fc8d805e0f
SSDEEP

6144:TA5DS5BdexpUj3RDXu+Rlblfa9p6U7wAK/8n26:Tau5BdebUjBDe0lbU7Pn2

Score

8^/10

evasion upx

Malware Config

Signatures

Disables Task Manager via registry modification
evasion

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/2264-0-0x0000000000700000-0x000000000075A000-memory.dmp	upx
behavioral1/memory/2264-1-0x0000000000700000-0x000000000075A000-memory.dmp	upx
behavioral1/memory/2376-9-0x0000000000270000-0x00000000002CA000-memory.dmp	upx
behavioral1/memory/1056-13-0x0000000000590000-0x00000000005EA000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer Protected Mode 1 TTPs 15 IoCs

Modify Registry

T1112

Processes:

notepad.exerundll32.exenotepad.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\2500 = "3"	notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\2500 = "3"	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2500 = "3"	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\2500 = "3"	notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\2500 = "3"	notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\2500 = "3"	notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\2500 = "3"	notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2500 = "3"	notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\2500 = "3"	notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\2500 = "3"	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\2500 = "3"	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\2500 = "3"	notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2500 = "3"	notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\2500 = "3"	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\2500 = "3"	notepad.exe

Modifies Internet Explorer Protected Mode Banner 1 TTPs 3 IoCs

Modify Registry

T1112

Processes:

rundll32.exenotepad.exenotepad.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\NoProtectedModeBanner = "1"	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\NoProtectedModeBanner = "1"	notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\NoProtectedModeBanner = "1"	notepad.exe

Modifies Internet Explorer settings 1 TTPs 40 IoCs

adware spyware

Modify Registry

T1112

Processes:

explorer.exeiexplore.exenotepad.exenotepad.exerundll32.exeIEXPLORE.EXE

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410234232"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	notepad.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	notepad.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c1930000000000200000000001066000000010000200000001caba82aac936f3656069fcb47a5b268110d2b10f99154d5fac7c25c7e162959000000000e8000000002000020000000efebf2cf70471e18cbbf473ef86ea7c8453aa13557b025cb2369d218a929bad990000000576bd09ed7a223a0c3ef9b5f51ae134ae9660335c826a3c9e93af17c60644d6636bceb4702e0f75b0a0d75da3a31b0673a1cbc370eee35d8984222d8cd405a62bc414b9dc2b7fc993c575d7abc26abcf63a757d8d522f3318648570fa9cbf3c3b4a0b3c5ae611a5d7f3e862908d1b545f2ce0a09f1420e31c1f091de31e18a3f75568dc2ab8bab380faeae5ad9f71735400000002fb269cb30e79c1b7cf913184ba85c4b1117986c7d571afbfce8f64a6d80279b2895891dda247f9145dfe6297837cae1a898dce6a434d43fe20960b573346181	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c193000000000020000000000106600000001000020000000aa3054b9fd33af1675fda1238bee00b412e0f6b3e9db0fe6f579fca6ea2bf045000000000e8000000002000020000000f8f9352edfdfc122a337971afe575d8d9d5d24a8015fd1cd02ac5a31516711e32000000022b5b29d4ebfd05a7db146c09648b44de175064ed8f94af17e0dbc8cfbdd976b400000009666013a42bea496c8bcd470a949dec0db3439d1a83c8bbe5be6c0f2bc6d82227776a0d3f3997078189fffcf6713cf70391c0c922d46fd3d3f34acaec7279fde	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B7FFC821-A844-11EE-8097-6E3D54FB2439} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a01634a6513cda01	iexplore.exe

Modifies registry class 5 IoCs

Processes:

explorer.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000_Classes\Local Settings	explorer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

rundll32.exenotepad.exenotepad.exe

pid	process
2264	rundll32.exe
2376	notepad.exe
2376	notepad.exe
2376	notepad.exe
2376	notepad.exe
2376	notepad.exe
2376	notepad.exe
2376	notepad.exe
1056	notepad.exe
2376	notepad.exe
2376	notepad.exe
2376	notepad.exe
2376	notepad.exe
2376	notepad.exe
2376	notepad.exe
2264	rundll32.exe
2264	rundll32.exe
2376	notepad.exe
2376	notepad.exe
2376	notepad.exe
2376	notepad.exe
2376	notepad.exe
2376	notepad.exe
2376	notepad.exe
2376	notepad.exe
2376	notepad.exe
2376	notepad.exe
2376	notepad.exe
2376	notepad.exe
2376	notepad.exe
2376	notepad.exe
2376	notepad.exe
2376	notepad.exe
2376	notepad.exe
2376	notepad.exe
2376	notepad.exe
2376	notepad.exe
2376	notepad.exe
2376	notepad.exe
2376	notepad.exe
2376	notepad.exe
2376	notepad.exe
2376	notepad.exe
2376	notepad.exe
2376	notepad.exe
2376	notepad.exe
2376	notepad.exe
2376	notepad.exe
2376	notepad.exe
2376	notepad.exe
2376	notepad.exe
2376	notepad.exe
2376	notepad.exe
2376	notepad.exe
2376	notepad.exe
2376	notepad.exe
2376	notepad.exe
2376	notepad.exe
2376	notepad.exe
2376	notepad.exe
2376	notepad.exe
2376	notepad.exe
2376	notepad.exe
2376	notepad.exe

Suspicious use of FindShellTrayWindow 12 IoCs

Processes:

iexplore.exectfmon.exe

pid	process
2208	iexplore.exe
2208	iexplore.exe
2208	iexplore.exe
2208	iexplore.exe
2208	iexplore.exe
2208	iexplore.exe
2208	iexplore.exe
2208	iexplore.exe
2208	iexplore.exe
2208	iexplore.exe
2808	ctfmon.exe
2808	ctfmon.exe

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

2208 iexplore.exe
2208 iexplore.exe
2572 IEXPLORE.EXE
2572 IEXPLORE.EXE

Suspicious use of WriteProcessMemory 29 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exeiexplore.exe

description	pid	process	target process
PID 2168 wrote to memory of 2264	2168	rundll32.exe	rundll32.exe
PID 2168 wrote to memory of 2264	2168	rundll32.exe	rundll32.exe
PID 2168 wrote to memory of 2264	2168	rundll32.exe	rundll32.exe
PID 2168 wrote to memory of 2264	2168	rundll32.exe	rundll32.exe
PID 2168 wrote to memory of 2264	2168	rundll32.exe	rundll32.exe
PID 2168 wrote to memory of 2264	2168	rundll32.exe	rundll32.exe
PID 2168 wrote to memory of 2264	2168	rundll32.exe	rundll32.exe
PID 2264 wrote to memory of 2644	2264	rundll32.exe	explorer.exe
PID 2264 wrote to memory of 2644	2264	rundll32.exe	explorer.exe
PID 2264 wrote to memory of 2644	2264	rundll32.exe	explorer.exe
PID 2264 wrote to memory of 2644	2264	rundll32.exe	explorer.exe
PID 2264 wrote to memory of 2376	2264	rundll32.exe	notepad.exe
PID 2264 wrote to memory of 2376	2264	rundll32.exe	notepad.exe
PID 2264 wrote to memory of 2376	2264	rundll32.exe	notepad.exe
PID 2264 wrote to memory of 2376	2264	rundll32.exe	notepad.exe
PID 2680 wrote to memory of 2808	2680	explorer.exe	ctfmon.exe
PID 2680 wrote to memory of 2808	2680	explorer.exe	ctfmon.exe
PID 2680 wrote to memory of 2808	2680	explorer.exe	ctfmon.exe
PID 2264 wrote to memory of 2376	2264	rundll32.exe	notepad.exe
PID 2208 wrote to memory of 2572	2208	iexplore.exe	IEXPLORE.EXE
PID 2208 wrote to memory of 2572	2208	iexplore.exe	IEXPLORE.EXE
PID 2208 wrote to memory of 2572	2208	iexplore.exe	IEXPLORE.EXE
PID 2208 wrote to memory of 2572	2208	iexplore.exe	IEXPLORE.EXE
PID 2264 wrote to memory of 1056	2264	rundll32.exe	notepad.exe
PID 2264 wrote to memory of 1056	2264	rundll32.exe	notepad.exe
PID 2264 wrote to memory of 1056	2264	rundll32.exe	notepad.exe
PID 2264 wrote to memory of 1056	2264	rundll32.exe	notepad.exe
PID 2264 wrote to memory of 1056	2264	rundll32.exe	notepad.exe
PID 2264 wrote to memory of 2208	2264	rundll32.exe	iexplore.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1ae3206072ef33e6417ca78a8b8ec71b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2168

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1ae3206072ef33e6417ca78a8b8ec71b.dll,#1
2⤵
- Modifies Internet Explorer Protected Mode
- Modifies Internet Explorer Protected Mode Banner
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2264

C:\Windows\SysWOW64\explorer.exe
explorer.exe
3⤵
PID:2644

C:\Windows\SysWOW64\notepad.exe
notepad.exe
3⤵
- Modifies Internet Explorer Protected Mode
- Modifies Internet Explorer Protected Mode Banner
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
PID:2376

C:\Windows\SysWOW64\notepad.exe
notepad.exe
3⤵
- Modifies Internet Explorer Protected Mode
- Modifies Internet Explorer Protected Mode Banner
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
PID:1056

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{682159d9-c321-47ca-b3f1-30e36b2ec8b9} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2680

C:\Windows\system32\ctfmon.exe
ctfmon.exe
2⤵
- Suspicious use of FindShellTrayWindow
PID:2808

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2208

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2208 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2572

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
56d3cb3c024728db47d6f911e6ff7256

SHA1
7c0d3a20fe5f4e5ed322d4e79ffbc977954745ad

SHA256
a190d80773246106cacb4e158fea73e9e10708f6c1df9d218948de16c81fffb6

SHA512
5e3eed86d83f5fc3fc6722b311a675c6532d565a87d93a5c21d2c97f995605ca3148b5012baf9cb155bd659d401cf38bd5b2a9b8cbc2203d4c90d6fed8a52db2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
f44595c1d44a7fd5569a70b962cf9270

SHA1
87f8773440b6fd140fd92b5b0290817b79781818

SHA256
a3d7fbac36cf39db7c234b6f8a1d7e49e2a8fd7ae2e32b1916acd0709c15ba75

SHA512
81aa356dfc39bc5ec970c469d53991dec865d7aaf5a99d1b28b7df5f1fbcc0b6426098f3ead212dbc8c2c937d097d82bacfb0e46c8aa377ba21ab21bc4be63ed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
edc93f214a991dfeed2e509154a19812

SHA1
12dac32073dd35b7e0c1875391d3558b2176b1a9

SHA256
ffc52f7ee400ed2190c8750c0f427f1ec23c9b46064ddae7550da3e69fbc65f9

SHA512
0359b9237f9c9b78ca46001154b628dac0e00dd2a7f104ee71dc74124f8e4fb89a031e41649de0778bc9e1f8f59a197de5be9a94574f72d09f5130cdaa527431

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
00015d2a7f0f813f0fb4d98a8668817d

SHA1
17b014c26ed36b700ea756a178959346e179ab38

SHA256
078a36afb9af8bda7b6ba67fdf3d3776059aaff498fce3caddd87e1b668e1677

SHA512
44153858ef6893557829ce151a11c59745875aeae05cb11bdc28bfcb9b16e7074e9aecc65425b7629462a823f70690d98384bb8cf2939703952fd9624946c475

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
4a99decf4dcbad5e43cccbee005b05e3

SHA1
83ced210adc301b207ec4fb0ab1d76b950ee47ef

SHA256
78afcbba8248c5132dbf57cb067a3e8a6e1c84bf0bcc528edb66998e272622bf

SHA512
65479fbf454f6cd43ffd51b0f9be09ced99c05eb7fca9f36922371b561d22bff63732129f9b61f50bc07718ea9339ca80e97c1e75e099876758040fcb35be741

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
f00e2c2c5e26901e93bddbd22fcfd4de

SHA1
86ca563455753d0e7b7f8848018cdb51140f772e

SHA256
2ba348fa6ad2f1e849d1a972ef6622123f12852b5e20ca4d85d46e1c6eab205e

SHA512
576f895a8d4b21cd9f6f02817f47b36e1f0d72174b85bb3405b27d7c1dfeb9462ce942a431707b7e036d5f2bb0b3d5ca4d4cb64681e4f12ae901e7f7467ccfc7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
ac1db72b1e4488a1638e1bab07968532

SHA1
ce9a038adc51c3046c0e9414079a750d6b5f2269

SHA256
e982ec88c64e2bea848f35ed7d86b2fb0bf11a6d796a9ee0bf4a4e8cd93c561c

SHA512
6b91e96fca7b5a2d0213f1e2016ca038529c419ecbc2a782e9df3d53d7ff35cef4e83df601c7ac7b07329da8b2c83a27b3b6237c33f6188fe5afc5bb5e469536

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
8dedbd750dcac457ec249dcd663e7d55

SHA1
12b4f867f6a16575bb4ebe09cec21c43c1bf8fe6

SHA256
66d065ccee860b70443cb58728dddec98e4761874530d76b73be01fae9d78783

SHA512
3ed859be667536823aded0115d83ae07d1b25d31847fae3622882e04f5972c3e859340b0a44003abb380666e96b989a4f0e0e03ce71f24260286a370d1437294

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2FE.tmp
Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1B54.tmp
Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
memory/1056-13-0x0000000000590000-0x00000000005EA000-memory.dmp

Filesize
360KB

Download
memory/1056-14-0x0000000000590000-0x00000000005EA000-memory.dmp

Filesize
360KB

Download
memory/1056-16-0x0000000000590000-0x00000000005EA000-memory.dmp

Filesize
360KB

Download
memory/2264-0-0x0000000000700000-0x000000000075A000-memory.dmp

Filesize
360KB

Download
memory/2264-3-0x0000000000700000-0x000000000075A000-memory.dmp

Filesize
360KB

Download
memory/2264-2-0x0000000000290000-0x00000000002A4000-memory.dmp

Filesize
80KB

Download
memory/2264-1-0x0000000000700000-0x000000000075A000-memory.dmp

Filesize
360KB

Download
memory/2376-7-0x0000000000130000-0x0000000000131000-memory.dmp

Filesize
4KB

Download
memory/2376-15-0x0000000000270000-0x00000000002CA000-memory.dmp

Filesize
360KB

Download
memory/2376-11-0x00000000002E0000-0x00000000002E2000-memory.dmp

Filesize
8KB

Download
memory/2376-10-0x0000000000270000-0x00000000002CA000-memory.dmp

Filesize
360KB

Download
memory/2376-9-0x0000000000270000-0x00000000002CA000-memory.dmp

Filesize
360KB

Download
memory/2680-18-0x00000000037B0000-0x00000000037B1000-memory.dmp

Filesize
4KB

Download
memory/2680-5-0x00000000037B0000-0x00000000037B1000-memory.dmp

Filesize
4KB

Download
memory/2680-6-0x00000000037C0000-0x00000000037D0000-memory.dmp

Filesize
64KB

Download