Analysis
-
max time kernel
133s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
07/01/2024, 19:21
Static task
static1
Behavioral task
behavioral1
Sample
a169003918d23a41e228f8030b458f9e.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
a169003918d23a41e228f8030b458f9e.exe
Resource
win10v2004-20231222-en
General
-
Target
a169003918d23a41e228f8030b458f9e.exe
-
Size
314KB
-
MD5
a169003918d23a41e228f8030b458f9e
-
SHA1
cdea2fbc475659219ca14fc9d26f2a361c5c2162
-
SHA256
cfe2b6781d8cbc4cd1bc34c2a5ee42c966ce0ba9d84c6ef69942d5a050111860
-
SHA512
6095e63a6d8f0ba4a1b924213db29cd283800f08f32b6a948376b3a875573a0a75ac260ccbad397f12be20313d4f855c4b668d7db2c7e1ce075f349a88b85c5a
-
SSDEEP
6144:CpJXjd9rDT+YyQBmBf4DYSfok1AAUaIxQOwUFk:STd9DDyQBmvIpCAdI5u
Malware Config
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\bokpkov = "{70249986-5370-4D56-BE4F-6F8163E6B721}" eotk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\altvxvm = "{9E1AE6A9-15B9-4A57-8D1B-799AE9A86C1D}" eotk.exe -
Modifies Installed Components in the registry 2 TTPs 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe -
Deletes itself 1 IoCs
pid Process 3048 cmd.exe -
Executes dropped EXE 4 IoCs
pid Process 2656 eotk.exe 2200 eotk.exe 3068 fmsxwqs.exe 1672 eotk.exe -
Loads dropped DLL 28 IoCs
pid Process 2324 a169003918d23a41e228f8030b458f9e.exe 2324 a169003918d23a41e228f8030b458f9e.exe 2324 a169003918d23a41e228f8030b458f9e.exe 2324 a169003918d23a41e228f8030b458f9e.exe 2324 a169003918d23a41e228f8030b458f9e.exe 2324 a169003918d23a41e228f8030b458f9e.exe 2324 a169003918d23a41e228f8030b458f9e.exe 2324 a169003918d23a41e228f8030b458f9e.exe 2324 a169003918d23a41e228f8030b458f9e.exe 2324 a169003918d23a41e228f8030b458f9e.exe 2324 a169003918d23a41e228f8030b458f9e.exe 2876 cmd.exe 2876 cmd.exe 2656 eotk.exe 2656 eotk.exe 2876 cmd.exe 2876 cmd.exe 2200 eotk.exe 2200 eotk.exe 2876 cmd.exe 2876 cmd.exe 3068 fmsxwqs.exe 3068 fmsxwqs.exe 2876 cmd.exe 2876 cmd.exe 1672 eotk.exe 1672 eotk.exe 2324 a169003918d23a41e228f8030b458f9e.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Installs/modifies Browser Helper Object 2 TTPs 1 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{5908DD9F-AB4F-4244-9799-435AD9B55220} regsvr32.exe -
Drops file in Windows directory 10 IoCs
description ioc Process File opened for modification C:\Windows\drnpfdxqvm.dll cmd.exe File created C:\Windows\fmsxwqs.exe cmd.exe File opened for modification C:\Windows\etlrlws.dll cmd.exe File created C:\Windows\altvxvm.dll cmd.exe File created C:\Windows\drnpfdxqvm.dll cmd.exe File opened for modification C:\Windows\altvxvm.dll cmd.exe File opened for modification C:\Windows\fmsxwqs.exe cmd.exe File created C:\Windows\bokpkov.dll cmd.exe File opened for modification C:\Windows\bokpkov.dll cmd.exe File created C:\Windows\etlrlws.dll cmd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
description ioc Process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Toolbar regsvr32.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar\{8853C284-DF46-469C-837F-6C9FDC2A3029} regsvr32.exe -
Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9DBBFB6B-1A0D-4875-BF43-0FBE1138F812}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8853C284-DF46-469C-837F-6C9FDC2A3029}\ProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9DBBFB6B-1A0D-4875-BF43-0FBE1138F812}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5908DD9F-AB4F-4244-9799-435AD9B55220}\VersionIndependentProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{01B9CA2B-180E-400D-9338-A5D6AECC5893}\1.0\0\win32\ = "C:\\Windows\\drnpfdxqvm.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MSVPS.MSVPSApp\CurVer\ = "GNX.Rolex" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{26944CB2-7AEB-4C11-A0A2-25F099CE103F}\ = "_IavdsEvents" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B3449DEC-5477-4D4F-BC27-04B4A4365225}\1.0\ = "etlrlws" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9DBBFB6B-1A0D-4875-BF43-0FBE1138F812}\TypeLib\ = "{B3449DEC-5477-4D4F-BC27-04B4A4365225}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5908DD9F-AB4F-4244-9799-435AD9B55220}\TypeLib\ = "{01B9CA2B-180E-400D-9338-A5D6AECC5893}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9DBBFB6B-1A0D-4875-BF43-0FBE1138F812} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MSVPS.MSVPSApp\ = "GNX" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{70967210-9B9D-414A-8539-CD526765D4EF}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{70249986-5370-4D56-BE4F-6F8163E6B721}\InProcServer32 eotk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{70967210-9B9D-414A-8539-CD526765D4EF}\TypeLib\ = "{01B9CA2B-180E-400D-9338-A5D6AECC5893}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{70249986-5370-4D56-BE4F-6F8163E6B721}\InProcServer32\ = "C:\\Windows\\bokpkov.dll" eotk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9E1AE6A9-15B9-4A57-8D1B-799AE9A86C1D} eotk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{70967210-9B9D-414A-8539-CD526765D4EF}\ = "Iavds" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8853C284-DF46-469C-837F-6C9FDC2A3029}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9DBBFB6B-1A0D-4875-BF43-0FBE1138F812} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9E1AE6A9-15B9-4A57-8D1B-799AE9A86C1D}\InProcServer32\ = "C:\\Windows\\altvxvm.dll" eotk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MSVPS.MSVPSApp\CLSID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{26944CB2-7AEB-4C11-A0A2-25F099CE103F}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{70967210-9B9D-414A-8539-CD526765D4EF}\ = "Iavds" regsvr32.exe Set value (data) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\etlrlws.ToolBar.1 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8853C284-DF46-469C-837F-6C9FDC2A3029}\VersionIndependentProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B3449DEC-5477-4D4F-BC27-04B4A4365225}\1.0\HELPDIR\ = "C:\\Windows\\" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9DBBFB6B-1A0D-4875-BF43-0FBE1138F812}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9DBBFB6B-1A0D-4875-BF43-0FBE1138F812}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{26944CB2-7AEB-4C11-A0A2-25F099CE103F}\TypeLib\ = "{01B9CA2B-180E-400D-9338-A5D6AECC5893}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{70967210-9B9D-414A-8539-CD526765D4EF}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\etlrlws.ToolBar.1\ = "etlrlws" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8853C284-DF46-469C-837F-6C9FDC2A3029}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9DBBFB6B-1A0D-4875-BF43-0FBE1138F812}\ = "Ibqnw" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9E1AE6A9-15B9-4A57-8D1B-799AE9A86C1D}\InProcServer32 eotk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{26944CB2-7AEB-4C11-A0A2-25F099CE103F}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{70967210-9B9D-414A-8539-CD526765D4EF}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8853C284-DF46-469C-837F-6C9FDC2A3029}\ProgID\ = "etlrlws.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B3449DEC-5477-4D4F-BC27-04B4A4365225}\1.0\FLAGS regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5908DD9F-AB4F-4244-9799-435AD9B55220}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{01B9CA2B-180E-400D-9338-A5D6AECC5893}\1.0\FLAGS\ = "0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{26944CB2-7AEB-4C11-A0A2-25F099CE103F}\TypeLib\ = "{01B9CA2B-180E-400D-9338-A5D6AECC5893}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8853C284-DF46-469C-837F-6C9FDC2A3029}\ = "etlrlws" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9DBBFB6B-1A0D-4875-BF43-0FBE1138F812}\ = "Ibqnw" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node eotk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID eotk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{01B9CA2B-180E-400D-9338-A5D6AECC5893}\1.0\FLAGS regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{26944CB2-7AEB-4C11-A0A2-25F099CE103F}\ = "_IavdsEvents" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\etlrlws.bqnw\CLSID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8853C284-DF46-469C-837F-6C9FDC2A3029}\TypeLib\ = "{B3449DEC-5477-4D4F-BC27-04B4A4365225}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{01B9CA2B-180E-400D-9338-A5D6AECC5893}\1.0\HELPDIR\ = "C:\\Windows\\" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{26944CB2-7AEB-4C11-A0A2-25F099CE103F}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{01B9CA2B-180E-400D-9338-A5D6AECC5893}\1.0 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{70967210-9B9D-414A-8539-CD526765D4EF}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MSVPS.MSVPSApp regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5908DD9F-AB4F-4244-9799-435AD9B55220}\Programmable regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8853C284-DF46-469C-837F-6C9FDC2A3029}\Programmable regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8853C284-DF46-469C-837F-6C9FDC2A3029}\InprocServer32\ = "C:\\Windows\\etlrlws.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B3449DEC-5477-4D4F-BC27-04B4A4365225}\1.0\0 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B3449DEC-5477-4D4F-BC27-04B4A4365225}\1.0\HELPDIR regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9DBBFB6B-1A0D-4875-BF43-0FBE1138F812}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID eotk.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1672 eotk.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2192 explorer.exe -
Suspicious use of AdjustPrivilegeToken 12 IoCs
description pid Process Token: SeShutdownPrivilege 2192 explorer.exe Token: SeShutdownPrivilege 2192 explorer.exe Token: SeShutdownPrivilege 2192 explorer.exe Token: SeShutdownPrivilege 2192 explorer.exe Token: SeShutdownPrivilege 2192 explorer.exe Token: SeShutdownPrivilege 2192 explorer.exe Token: SeShutdownPrivilege 2192 explorer.exe Token: SeShutdownPrivilege 2192 explorer.exe Token: SeShutdownPrivilege 2192 explorer.exe Token: SeShutdownPrivilege 2192 explorer.exe Token: SeShutdownPrivilege 2192 explorer.exe Token: SeShutdownPrivilege 2192 explorer.exe -
Suspicious use of FindShellTrayWindow 29 IoCs
pid Process 2192 explorer.exe 2192 explorer.exe 2192 explorer.exe 2192 explorer.exe 2192 explorer.exe 2192 explorer.exe 2192 explorer.exe 2192 explorer.exe 2192 explorer.exe 2192 explorer.exe 2192 explorer.exe 2192 explorer.exe 2192 explorer.exe 2192 explorer.exe 2192 explorer.exe 2192 explorer.exe 2192 explorer.exe 2192 explorer.exe 2192 explorer.exe 2192 explorer.exe 2192 explorer.exe 2192 explorer.exe 2192 explorer.exe 2192 explorer.exe 2192 explorer.exe 2192 explorer.exe 2192 explorer.exe 2192 explorer.exe 2192 explorer.exe -
Suspicious use of SendNotifyMessage 22 IoCs
pid Process 2192 explorer.exe 2192 explorer.exe 2192 explorer.exe 2192 explorer.exe 2192 explorer.exe 2192 explorer.exe 2192 explorer.exe 2192 explorer.exe 2192 explorer.exe 2192 explorer.exe 2192 explorer.exe 2192 explorer.exe 2192 explorer.exe 2192 explorer.exe 2192 explorer.exe 2192 explorer.exe 2192 explorer.exe 2192 explorer.exe 2192 explorer.exe 2192 explorer.exe 2192 explorer.exe 2192 explorer.exe -
Suspicious use of WriteProcessMemory 56 IoCs
description pid Process procid_target PID 2324 wrote to memory of 2876 2324 a169003918d23a41e228f8030b458f9e.exe 28 PID 2324 wrote to memory of 2876 2324 a169003918d23a41e228f8030b458f9e.exe 28 PID 2324 wrote to memory of 2876 2324 a169003918d23a41e228f8030b458f9e.exe 28 PID 2324 wrote to memory of 2876 2324 a169003918d23a41e228f8030b458f9e.exe 28 PID 2324 wrote to memory of 2876 2324 a169003918d23a41e228f8030b458f9e.exe 28 PID 2324 wrote to memory of 2876 2324 a169003918d23a41e228f8030b458f9e.exe 28 PID 2324 wrote to memory of 2876 2324 a169003918d23a41e228f8030b458f9e.exe 28 PID 2876 wrote to memory of 2636 2876 cmd.exe 30 PID 2876 wrote to memory of 2636 2876 cmd.exe 30 PID 2876 wrote to memory of 2636 2876 cmd.exe 30 PID 2876 wrote to memory of 2636 2876 cmd.exe 30 PID 2876 wrote to memory of 2636 2876 cmd.exe 30 PID 2876 wrote to memory of 2636 2876 cmd.exe 30 PID 2876 wrote to memory of 2636 2876 cmd.exe 30 PID 2876 wrote to memory of 2656 2876 cmd.exe 31 PID 2876 wrote to memory of 2656 2876 cmd.exe 31 PID 2876 wrote to memory of 2656 2876 cmd.exe 31 PID 2876 wrote to memory of 2656 2876 cmd.exe 31 PID 2876 wrote to memory of 2656 2876 cmd.exe 31 PID 2876 wrote to memory of 2656 2876 cmd.exe 31 PID 2876 wrote to memory of 2656 2876 cmd.exe 31 PID 2876 wrote to memory of 2200 2876 cmd.exe 37 PID 2876 wrote to memory of 2200 2876 cmd.exe 37 PID 2876 wrote to memory of 2200 2876 cmd.exe 37 PID 2876 wrote to memory of 2200 2876 cmd.exe 37 PID 2876 wrote to memory of 2200 2876 cmd.exe 37 PID 2876 wrote to memory of 2200 2876 cmd.exe 37 PID 2876 wrote to memory of 2200 2876 cmd.exe 37 PID 2876 wrote to memory of 2476 2876 cmd.exe 36 PID 2876 wrote to memory of 2476 2876 cmd.exe 36 PID 2876 wrote to memory of 2476 2876 cmd.exe 36 PID 2876 wrote to memory of 2476 2876 cmd.exe 36 PID 2876 wrote to memory of 2476 2876 cmd.exe 36 PID 2876 wrote to memory of 2476 2876 cmd.exe 36 PID 2876 wrote to memory of 2476 2876 cmd.exe 36 PID 2876 wrote to memory of 3068 2876 cmd.exe 35 PID 2876 wrote to memory of 3068 2876 cmd.exe 35 PID 2876 wrote to memory of 3068 2876 cmd.exe 35 PID 2876 wrote to memory of 3068 2876 cmd.exe 35 PID 2876 wrote to memory of 3068 2876 cmd.exe 35 PID 2876 wrote to memory of 3068 2876 cmd.exe 35 PID 2876 wrote to memory of 3068 2876 cmd.exe 35 PID 2876 wrote to memory of 1672 2876 cmd.exe 34 PID 2876 wrote to memory of 1672 2876 cmd.exe 34 PID 2876 wrote to memory of 1672 2876 cmd.exe 34 PID 2876 wrote to memory of 1672 2876 cmd.exe 34 PID 2876 wrote to memory of 1672 2876 cmd.exe 34 PID 2876 wrote to memory of 1672 2876 cmd.exe 34 PID 2876 wrote to memory of 1672 2876 cmd.exe 34 PID 2324 wrote to memory of 3048 2324 a169003918d23a41e228f8030b458f9e.exe 33 PID 2324 wrote to memory of 3048 2324 a169003918d23a41e228f8030b458f9e.exe 33 PID 2324 wrote to memory of 3048 2324 a169003918d23a41e228f8030b458f9e.exe 33 PID 2324 wrote to memory of 3048 2324 a169003918d23a41e228f8030b458f9e.exe 33 PID 2324 wrote to memory of 3048 2324 a169003918d23a41e228f8030b458f9e.exe 33 PID 2324 wrote to memory of 3048 2324 a169003918d23a41e228f8030b458f9e.exe 33 PID 2324 wrote to memory of 3048 2324 a169003918d23a41e228f8030b458f9e.exe 33 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\a169003918d23a41e228f8030b458f9e.exe"C:\Users\Admin\AppData\Local\Temp\a169003918d23a41e228f8030b458f9e.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2324 -
C:\Windows\SysWOW64\cmd.execmd.exe /Q /C "C:\Users\Admin\AppData\Local\Temp\ac8zt2\install.bat"2⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2876 -
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /s etlrlws.dll3⤵
- Modifies Internet Explorer settings
- Modifies registry class
PID:2636
-
-
C:\Users\Admin\AppData\Local\Temp\ac8zt2\eotk.exeeotk.exe C:\Windows\bokpkov.dll bokpkov3⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:2656
-
-
C:\Users\Admin\AppData\Local\Temp\ac8zt2\eotk.exeeotk.exe resot3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:1672
-
-
C:\Users\Admin\AppData\Local\Temp\ac8zt2\fmsxwqs.exefmsxwqs.exe reg3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3068
-
-
C:\Windows\SysWOW64\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\drnpfdxqvm.dll3⤵
- Installs/modifies Browser Helper Object
- Modifies registry class
PID:2476
-
-
C:\Users\Admin\AppData\Local\Temp\ac8zt2\eotk.exeeotk.exe C:\Windows\altvxvm.dll altvxvm3⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:2200
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /Q /C C:\Users\Admin\AppData\Local\Temp\nsd1068.tmp.bat "C:\Users\Admin\AppData\Local\Temp\a169003918d23a41e228f8030b458f9e.exe"2⤵
- Deletes itself
PID:3048
-
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2192
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
224KB
MD55adbeca70b6fd47a7a7d226b6c07db35
SHA1adf21cc56d6a2875f0f3163e019663a69a62883e
SHA256fabab4b8a1627aa01f94997b5243322b9bb527d05890474bf638f16debc2478b
SHA512326301d81ada859305dde00c78e08c487432f06d1029ef2a78422e331c1526806df2f6f163b864df323ca7ebe3079bf9a90c94e86bda196ab8c7d4bb6f3c51c9
-
Filesize
212KB
MD50f2a9b99c1ee35460fa8342abeb811cf
SHA1aed04b62c5f190b42e3e097a4b4f0e4050b1d379
SHA256dc72b09de1605b453f29c2be22698d609ec250664b13f7efba67d5f7583a60cc
SHA51270c69cbcd8bcb35e5e1854c18f0a3dfa205a7e84bfdeb766935b86636741392d4093df9bedbc3b02aaf94989e0eae79539f66954911b8919b2dc26a9c44ada7a
-
Filesize
240KB
MD5a191063294b95df9c5f1734243a3abcb
SHA1d6539737335d698259cf132509178fae42bcf930
SHA25679c3827b60856aed73ce04a3c7fd3474a1a0f4f8caf90b2f9ce03b1e9de78026
SHA5126d6b27d305d15b77a6f19f7f527cdadeb61ee33c33d6c2231d5c7a65f82d267d812717589841252aacf31968ff63b922aa14c337cfe4481307262d75750ebc37
-
Filesize
88KB
MD5b4603bf962319153e1b7e78c88d9c8ce
SHA120af0d302057e0ff5eb1fa2eb80078e1941f99de
SHA256ce8050818ad6f1a97326642679076c73a66d82ce288ce51ae4fae54bce786ef2
SHA51249ff00a7187413d3b4e3c2b57e858a0dcf374987971e8ca7c3c9dc4dfe658a6a0bb3e1e9e56c6b291c1cd1c23ee03409412d6c4291e9b32cb6582e34351a6a40
-
Filesize
172KB
MD5c93de9f81b4bcad2a3b662b816ea515b
SHA1e5c560fa6fdfb544318a6fcd478ee071fa0bdb9f
SHA2563993623c186dc28c79dff4a3837f889352481e8e0bbc25878498bd3738f51b34
SHA512c3a676c4ecf135d36b5b42d7ee871ad5e45426a763aa190c86e4d1aa88e8ef62facd76ff3487eca97ca01e6c329826e8c03f42dddd9837833b194b79fab1bed7
-
Filesize
96KB
MD549f1cf8df1a47e9991d3ad3eeff7180f
SHA1b23470a749df6d2a33ad97116510bcce2df44a4a
SHA256d38afd2ce3a785e5e580cef69db96365ac83b17591c249252c7c0e9c5103fc24
SHA512d4380995748abfdc7b12f48a9f2321cefb2079834218195f6a307432c2775de5e481b1c6f94390c71b207467da032afae40ada2c85ce31b6da4ca6b25f8a7e48
-
Filesize
1014B
MD5b39297d67ace2dfcbe18f05a9305fcdd
SHA115ea67c95d502cc21370145d610f313928da8e40
SHA256fa36cc0c0abeb34917492e91c4761f5728b09202cc22e0ce693b380a97d4a2ca
SHA5127a5ea05c4b65cf9366ee71118b4ab1c12d57c678bb7903ce48a21f8e44796e94abc2e9759a4f828a8c61085388259055cc20952a1eea176b72f8834d29464cee
-
Filesize
113B
MD54c11940d880aa2b65bf4532ac6b7d90a
SHA14bc01f898d6720ea5b754d080c1cda9815343f0b
SHA256f71df0264de7e5f8f487929531066182bd19e375feeef0456593ba973abddc8b
SHA51260a03ea5692782841cf514a8e951378dbffcdc5ab5b3f0a6a2db6b3290edc8012ea3490920dfd984778db371f53342fc15c71c548952caa2c5c5a4f4b77ba1c7
-
Filesize
10KB
MD57d85b1f619a3023cc693a88f040826d2
SHA109f5d32f8143e7e0d9270430708db1b9fc8871a8
SHA256dc198967b0fb2bc7aaab0886a700c7f4d8cb346c4f9d48b9b220487b0dfe8a18
SHA5125465804c56d6251bf369609e1b44207b717228a8ac36c7992470b9daf4a231256c0ce95e0b027c4164e62d9656742a56e2b51e9347c8b17ab51ff40f32928c85
-
Filesize
22KB
MD55afd4a9b7e69e7c6e312b2ce4040394a
SHA1fbd07adb3f02f866dc3a327a86b0f319d4a94502
SHA256053b4487d22aacf8274bab448ae1d665fe7926102197b47bfba6c7ed5493b3ae
SHA512f78efe9d1fa7d2ffc731d5f878f81e4dcbfaf0c561fdfbf4c133ba2ce1366c95c4672d67cae6a8bd8fcc7d04861a9da389d98361055ac46fc9793828d9776511