betabot | 6ecc88149dfdad0b296e7aee3c554fc191b1371d09c51ee2e47ac0e145ee38ba

Analysis

max time kernel
156s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
07/01/2024, 20:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6ecc88149dfdad0b296e7aee3c554fc191b1371d09c51ee2e47ac0e145ee38ba.exe
Size 7.1MB
Sample240107-yrmtpsdccj
SHA256 6ecc88149dfdad0b296e7aee3c554fc191b1371d09c51ee2e47ac0e145ee38ba
MD5 460ad51c283bf0d1fdf8f49ff13e104b
SHA1 a525d26607b13a0eeed7ce027ad3f7bf920111d2
SHA512 425c993170885e496120e177285a13ac76d2e982f987ebf91cc8b91bc614d76f1624935e61cd1913723dab6ad652cf23609d2b8c5dc6cebc63981de61918c004
SSDEEP 196608:GmWgOGj3+UtqxMrp+2f4f3D1K+tHG7wv7ew:PsGj3kMrp+2f4PpKsHGs7
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

betabot fabookie glupteba smokeloader stealc up3 backdoor botnet discovery dropper evasion loader persistence spyware stealer trojan

Malware Config

Extracted

Family

stealc

http://185.172.128.79

Attributes

url_path
/3886d2276f6914c4.php

rc4.plain

Extracted

Family

smokeloader

Botnet

Extracted

Family

smokeloader

Version

2020

http://host-file-host6.com/
http://host-host-file8.com/

rc4.i32

Signatures

BetaBot
Beta Bot is a Trojan that infects computers and disables Antivirus.
trojan backdoor botnet betabot

Detect Fabookie payload 2 IoCs

resource	yara_rule
behavioral2/memory/4212-214-0x0000000003530000-0x0000000003661000-memory.dmp	family_fabookie
behavioral2/memory/4212-247-0x0000000003530000-0x0000000003661000-memory.dmp	family_fabookie

Fabookie
Fabookie is facebook account info stealer.
spyware stealer fabookie
Glupteba
Glupteba is a modular loader written in Golang with various components.
loader dropper glupteba

Glupteba payload 8 IoCs

resource	yara_rule
behavioral2/memory/1160-81-0x0000000002DB0000-0x000000000369B000-memory.dmp	family_glupteba
behavioral2/memory/1160-82-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/1160-105-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/1160-159-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/1160-174-0x0000000002DB0000-0x000000000369B000-memory.dmp	family_glupteba
behavioral2/memory/1160-199-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/1160-205-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/492-320-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba

Modifies firewall policy service 2 TTPs 12 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\EnableFirewall = "0"	explorer.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\EnableFirewall = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\EnableFirewall = "0"	explorer.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	explorer.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile	explorer.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	explorer.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	explorer.exe

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Stealc
Stealc is an infostealer written in C++.
stealer stealc
Downloads MZ/PE file

Looks for VMWare services registry key. 1 TTPs 2 IoCs

evasion

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VMware	nsbC64C.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\VMware	InstallSetup8.exe

Modifies Windows Firewall 1 TTPs 1 IoCs

evasion

Windows Service

T1543.003

pid	Process
892	netsh.exe

Sets file execution options in registry 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe\Debugger = "mzhotwi.exe"	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\399c11q93uk.exe	745B.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\399c11q93uk.exe\DisableExceptionChainValidation	745B.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe\Debugger = "lwflrucazs.exe"	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe\Debugger = "clwvzepahx.exe"	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe	explorer.exe

Checks BIOS information in registry 2 TTPs 3 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorer.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation	898A.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation	nsbC64C.tmp
Key value queried	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation	6ecc88149dfdad0b296e7aee3c554fc191b1371d09c51ee2e47ac0e145ee38ba.exe

Executes dropped EXE 13 IoCs

pid	Process
3876	InstallSetup8.exe
4212	rty27.exe
3244	toolspub2.exe
1160	e0cbefcb1af40c7d4aff4aca26621a98.exe
2760	BroomSetup.exe
3308	nsbC64C.tmp
492	e0cbefcb1af40c7d4aff4aca26621a98.exe
2096	745B.exe
3748	898A.exe
3672	WindowsUpdater.exe
2444	399c11q93uk.exe
692	csrss.exe
776	399c11q93uk.exe

Loads dropped DLL 9 IoCs

pid	Process
3876	InstallSetup8.exe
3876	InstallSetup8.exe
3876	InstallSetup8.exe
3672	WindowsUpdater.exe
3672	WindowsUpdater.exe
3308	nsbC64C.tmp
3308	nsbC64C.tmp
3876	InstallSetup8.exe
3876	InstallSetup8.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 9 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Java Updater = "\"C:\\ProgramData\\Java Updater\\399c11q93uk.exe\""	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Java Updater = "\"C:\\ProgramData\\Java Updater\\399c11q93uk.exe\""	nsbC64C.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Java Updater = "C:\\ProgramData\\Java Updater\\399c11q93uk.exe"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Java Updater = "C:\\ProgramData\\Java Updater\\399c11q93uk.exe"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Java Updater = "C:\\ProgramData\\Java Updater\\399c11q93uk.exe"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Java Updater = "\"C:\\ProgramData\\Java Updater\\399c11q93uk.exe\""	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	e0cbefcb1af40c7d4aff4aca26621a98.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Java Updater = "\"C:\\ProgramData\\Java Updater\\399c11q93uk.exe\""	InstallSetup8.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Java Updater = "\"C:\\ProgramData\\Java Updater\\399c11q93uk.exe\""	explorer.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 5 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	745B.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	nsbC64C.tmp
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	399c11q93uk.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	InstallSetup8.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	399c11q93uk.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
40	api.ipify.org

Maps connected drives based on registry 3 TTPs 4 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	InstallSetup8.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum	nsbC64C.tmp
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	nsbC64C.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum	InstallSetup8.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 32 IoCs

pid	Process
2096	745B.exe
3544	explorer.exe
3544	explorer.exe
3544	explorer.exe
3544	explorer.exe
3544	explorer.exe
3544	explorer.exe
3544	explorer.exe
3308	nsbC64C.tmp
3308	nsbC64C.tmp
3308	nsbC64C.tmp
3308	nsbC64C.tmp
2444	399c11q93uk.exe
4844	explorer.exe
4844	explorer.exe
4844	explorer.exe
4844	explorer.exe
4844	explorer.exe
4844	explorer.exe
4844	explorer.exe
3876	InstallSetup8.exe
3876	InstallSetup8.exe
3876	InstallSetup8.exe
3876	InstallSetup8.exe
776	399c11q93uk.exe
100	explorer.exe
100	explorer.exe
100	explorer.exe
100	explorer.exe
100	explorer.exe
100	explorer.exe
100	explorer.exe

Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\VBoxMiniRdrDN	e0cbefcb1af40c7d4aff4aca26621a98.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\rss	e0cbefcb1af40c7d4aff4aca26621a98.exe
File created	C:\Windows\rss\csrss.exe	e0cbefcb1af40c7d4aff4aca26621a98.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 4 IoCs

pid	pid_target	Process	procid_target
3332	3544	WerFault.exe	113
1076	4844	WerFault.exe	123
1096	3308	WerFault.exe	100
3572	100	WerFault.exe	141

NSIS installer 3 IoCs

installer

resource	yara_rule
behavioral2/files/0x0008000000023143-245.dat	nsis_installer_2
behavioral2/files/0x0006000000023144-253.dat	nsis_installer_1
behavioral2/files/0x0006000000023144-253.dat	nsis_installer_2

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	toolspub2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	toolspub2.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	toolspub2.exe

Checks processor information in registry 2 TTPs 14 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	399c11q93uk.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	explorer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	nsbC64C.tmp
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	745B.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	explorer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	399c11q93uk.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	745B.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	nsbC64C.tmp
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	explorer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	explorer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	explorer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	399c11q93uk.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	explorer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	399c11q93uk.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
4068	timeout.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	explorer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	explorer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	explorer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	explorer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	explorer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	explorer.exe

Modifies Internet Explorer Protected Mode 1 TTPs 12 IoCs

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\2500 = "3"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\2500 = "3"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\2500 = "3"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2500 = "3"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\2500 = "3"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2500 = "3"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\2500 = "3"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\2500 = "3"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2500 = "3"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\2500 = "3"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\2500 = "3"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\2500 = "3"	explorer.exe

Modifies Internet Explorer Protected Mode Banner 1 TTPs 3 IoCs

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\Main\NoProtectedModeBanner = "1"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\Main\NoProtectedModeBanner = "1"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\Main\NoProtectedModeBanner = "1"	explorer.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Software\Microsoft\Internet Explorer\Main	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Software\Microsoft\Internet Explorer\Main	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Software\Microsoft\Internet Explorer\Main	explorer.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-121 = "SA Pacific Daylight Time"	e0cbefcb1af40c7d4aff4aca26621a98.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-931 = "Coordinated Universal Time"	e0cbefcb1af40c7d4aff4aca26621a98.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-402 = "Arabic Standard Time"	e0cbefcb1af40c7d4aff4aca26621a98.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-541 = "Myanmar Daylight Time"	e0cbefcb1af40c7d4aff4aca26621a98.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-832 = "SA Eastern Standard Time"	e0cbefcb1af40c7d4aff4aca26621a98.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-151 = "Central America Daylight Time"	e0cbefcb1af40c7d4aff4aca26621a98.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-42 = "E. South America Standard Time"	e0cbefcb1af40c7d4aff4aca26621a98.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-912 = "Mauritius Standard Time"	e0cbefcb1af40c7d4aff4aca26621a98.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-262 = "GMT Standard Time"	e0cbefcb1af40c7d4aff4aca26621a98.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2842 = "Saratov Standard Time"	e0cbefcb1af40c7d4aff4aca26621a98.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2392 = "Aleutian Standard Time"	e0cbefcb1af40c7d4aff4aca26621a98.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2611 = "Bougainville Daylight Time"	e0cbefcb1af40c7d4aff4aca26621a98.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2372 = "Easter Island Standard Time"	e0cbefcb1af40c7d4aff4aca26621a98.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-601 = "Taipei Daylight Time"	e0cbefcb1af40c7d4aff4aca26621a98.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-392 = "Arab Standard Time"	e0cbefcb1af40c7d4aff4aca26621a98.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2002 = "Cabo Verde Standard Time"	e0cbefcb1af40c7d4aff4aca26621a98.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-252 = "Dateline Standard Time"	e0cbefcb1af40c7d4aff4aca26621a98.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-772 = "Montevideo Standard Time"	e0cbefcb1af40c7d4aff4aca26621a98.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-841 = "Argentina Daylight Time"	e0cbefcb1af40c7d4aff4aca26621a98.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2001 = "Cabo Verde Daylight Time"	e0cbefcb1af40c7d4aff4aca26621a98.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-105 = "Central Brazilian Standard Time"	e0cbefcb1af40c7d4aff4aca26621a98.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-231 = "Hawaiian Daylight Time"	e0cbefcb1af40c7d4aff4aca26621a98.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-71 = "Newfoundland Daylight Time"	e0cbefcb1af40c7d4aff4aca26621a98.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-215 = "Pacific Standard Time (Mexico)"	e0cbefcb1af40c7d4aff4aca26621a98.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-222 = "Alaskan Standard Time"	e0cbefcb1af40c7d4aff4aca26621a98.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-661 = "Cen. Australia Daylight Time"	e0cbefcb1af40c7d4aff4aca26621a98.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-572 = "China Standard Time"	e0cbefcb1af40c7d4aff4aca26621a98.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1822 = "Russia TZ 1 Standard Time"	e0cbefcb1af40c7d4aff4aca26621a98.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-561 = "SE Asia Daylight Time"	e0cbefcb1af40c7d4aff4aca26621a98.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2572 = "Turks and Caicos Standard Time"	e0cbefcb1af40c7d4aff4aca26621a98.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2391 = "Aleutian Daylight Time"	e0cbefcb1af40c7d4aff4aca26621a98.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2872 = "Magallanes Standard Time"	e0cbefcb1af40c7d4aff4aca26621a98.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-3142 = "South Sudan Standard Time"	e0cbefcb1af40c7d4aff4aca26621a98.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1412 = "Syria Standard Time"	e0cbefcb1af40c7d4aff4aca26621a98.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-671 = "AUS Eastern Daylight Time"	e0cbefcb1af40c7d4aff4aca26621a98.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-292 = "Central European Standard Time"	e0cbefcb1af40c7d4aff4aca26621a98.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-391 = "Arab Daylight Time"	e0cbefcb1af40c7d4aff4aca26621a98.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3244	toolspub2.exe
3244	toolspub2.exe
3308	nsbC64C.tmp
3308	nsbC64C.tmp
3464	Process not Found
3464	Process not Found
3464	Process not Found
3464	Process not Found
3464	Process not Found
3464	Process not Found
3464	Process not Found
3464	Process not Found
3464	Process not Found
3464	Process not Found
3464	Process not Found
3464	Process not Found
3464	Process not Found
3464	Process not Found
3464	Process not Found
3464	Process not Found
3464	Process not Found
3464	Process not Found
3464	Process not Found
3464	Process not Found
3464	Process not Found
3464	Process not Found
3464	Process not Found
3464	Process not Found
3464	Process not Found
3464	Process not Found
3464	Process not Found
3464	Process not Found
3464	Process not Found
3464	Process not Found
3464	Process not Found
3464	Process not Found
3464	Process not Found
3464	Process not Found
3464	Process not Found
3464	Process not Found
3464	Process not Found
3464	Process not Found
3464	Process not Found
3464	Process not Found
3464	Process not Found
3464	Process not Found
3464	Process not Found
3464	Process not Found
3464	Process not Found
3464	Process not Found
3464	Process not Found
3464	Process not Found
3464	Process not Found
3464	Process not Found
3464	Process not Found
3464	Process not Found
3464	Process not Found
3464	Process not Found
3464	Process not Found
3464	Process not Found
3464	Process not Found
3464	Process not Found
3464	Process not Found
3464	Process not Found

Suspicious behavior: MapViewOfSection 12 IoCs

pid	Process
3244	toolspub2.exe
2096	745B.exe
2096	745B.exe
3544	explorer.exe
3544	explorer.exe
3544	explorer.exe
3544	explorer.exe
3544	explorer.exe
2444	399c11q93uk.exe
2444	399c11q93uk.exe
776	399c11q93uk.exe
776	399c11q93uk.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	448	powershell.exe
Token: SeShutdownPrivilege	3464	Process not Found
Token: SeCreatePagefilePrivilege	3464	Process not Found
Token: SeDebugPrivilege	1160	e0cbefcb1af40c7d4aff4aca26621a98.exe
Token: SeImpersonatePrivilege	1160	e0cbefcb1af40c7d4aff4aca26621a98.exe
Token: SeDebugPrivilege	2096	745B.exe
Token: SeRestorePrivilege	2096	745B.exe
Token: SeBackupPrivilege	2096	745B.exe
Token: SeLoadDriverPrivilege	2096	745B.exe
Token: SeCreatePagefilePrivilege	2096	745B.exe
Token: SeShutdownPrivilege	2096	745B.exe
Token: SeTakeOwnershipPrivilege	2096	745B.exe
Token: SeChangeNotifyPrivilege	2096	745B.exe
Token: SeCreateTokenPrivilege	2096	745B.exe
Token: SeMachineAccountPrivilege	2096	745B.exe
Token: SeSecurityPrivilege	2096	745B.exe
Token: SeAssignPrimaryTokenPrivilege	2096	745B.exe
Token: SeCreateGlobalPrivilege	2096	745B.exe
Token: 33	2096	745B.exe
Token: SeDebugPrivilege	3544	explorer.exe
Token: SeRestorePrivilege	3544	explorer.exe
Token: SeBackupPrivilege	3544	explorer.exe
Token: SeLoadDriverPrivilege	3544	explorer.exe
Token: SeCreatePagefilePrivilege	3544	explorer.exe
Token: SeShutdownPrivilege	3544	explorer.exe
Token: SeTakeOwnershipPrivilege	3544	explorer.exe
Token: SeChangeNotifyPrivilege	3544	explorer.exe
Token: SeCreateTokenPrivilege	3544	explorer.exe
Token: SeMachineAccountPrivilege	3544	explorer.exe
Token: SeSecurityPrivilege	3544	explorer.exe
Token: SeAssignPrimaryTokenPrivilege	3544	explorer.exe
Token: SeCreateGlobalPrivilege	3544	explorer.exe
Token: 33	3544	explorer.exe
Token: SeShutdownPrivilege	3464	Process not Found
Token: SeCreatePagefilePrivilege	3464	Process not Found
Token: SeDebugPrivilege	436	powershell.exe
Token: SeDebugPrivilege	2444	399c11q93uk.exe
Token: SeRestorePrivilege	2444	399c11q93uk.exe
Token: SeBackupPrivilege	2444	399c11q93uk.exe
Token: SeLoadDriverPrivilege	2444	399c11q93uk.exe
Token: SeCreatePagefilePrivilege	2444	399c11q93uk.exe
Token: SeShutdownPrivilege	2444	399c11q93uk.exe
Token: SeTakeOwnershipPrivilege	2444	399c11q93uk.exe
Token: SeChangeNotifyPrivilege	2444	399c11q93uk.exe
Token: SeCreateTokenPrivilege	2444	399c11q93uk.exe
Token: SeMachineAccountPrivilege	2444	399c11q93uk.exe
Token: SeSecurityPrivilege	2444	399c11q93uk.exe
Token: SeAssignPrimaryTokenPrivilege	2444	399c11q93uk.exe
Token: SeCreateGlobalPrivilege	2444	399c11q93uk.exe
Token: 33	2444	399c11q93uk.exe
Token: SeDebugPrivilege	4844	explorer.exe
Token: SeRestorePrivilege	4844	explorer.exe
Token: SeBackupPrivilege	4844	explorer.exe
Token: SeLoadDriverPrivilege	4844	explorer.exe
Token: SeCreatePagefilePrivilege	4844	explorer.exe
Token: SeShutdownPrivilege	4844	explorer.exe
Token: SeTakeOwnershipPrivilege	4844	explorer.exe
Token: SeChangeNotifyPrivilege	4844	explorer.exe
Token: SeCreateTokenPrivilege	4844	explorer.exe
Token: SeMachineAccountPrivilege	4844	explorer.exe
Token: SeSecurityPrivilege	4844	explorer.exe
Token: SeAssignPrimaryTokenPrivilege	4844	explorer.exe
Token: SeCreateGlobalPrivilege	4844	explorer.exe
Token: 33	4844	explorer.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2760	BroomSetup.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
3464	Process not Found

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1096 wrote to memory of 3876	1096	6ecc88149dfdad0b296e7aee3c554fc191b1371d09c51ee2e47ac0e145ee38ba.exe	92
PID 1096 wrote to memory of 3876	1096	6ecc88149dfdad0b296e7aee3c554fc191b1371d09c51ee2e47ac0e145ee38ba.exe	92
PID 1096 wrote to memory of 3876	1096	6ecc88149dfdad0b296e7aee3c554fc191b1371d09c51ee2e47ac0e145ee38ba.exe	92
PID 1096 wrote to memory of 4212	1096	6ecc88149dfdad0b296e7aee3c554fc191b1371d09c51ee2e47ac0e145ee38ba.exe	93
PID 1096 wrote to memory of 4212	1096	6ecc88149dfdad0b296e7aee3c554fc191b1371d09c51ee2e47ac0e145ee38ba.exe	93
PID 1096 wrote to memory of 3244	1096	6ecc88149dfdad0b296e7aee3c554fc191b1371d09c51ee2e47ac0e145ee38ba.exe	94
PID 1096 wrote to memory of 3244	1096	6ecc88149dfdad0b296e7aee3c554fc191b1371d09c51ee2e47ac0e145ee38ba.exe	94
PID 1096 wrote to memory of 3244	1096	6ecc88149dfdad0b296e7aee3c554fc191b1371d09c51ee2e47ac0e145ee38ba.exe	94
PID 1096 wrote to memory of 1160	1096	6ecc88149dfdad0b296e7aee3c554fc191b1371d09c51ee2e47ac0e145ee38ba.exe	95
PID 1096 wrote to memory of 1160	1096	6ecc88149dfdad0b296e7aee3c554fc191b1371d09c51ee2e47ac0e145ee38ba.exe	95
PID 1096 wrote to memory of 1160	1096	6ecc88149dfdad0b296e7aee3c554fc191b1371d09c51ee2e47ac0e145ee38ba.exe	95
PID 3876 wrote to memory of 2760	3876	InstallSetup8.exe	97
PID 3876 wrote to memory of 2760	3876	InstallSetup8.exe	97
PID 3876 wrote to memory of 2760	3876	InstallSetup8.exe	97
PID 3876 wrote to memory of 3308	3876	InstallSetup8.exe	100
PID 3876 wrote to memory of 3308	3876	InstallSetup8.exe	100
PID 3876 wrote to memory of 3308	3876	InstallSetup8.exe	100
PID 1160 wrote to memory of 448	1160	e0cbefcb1af40c7d4aff4aca26621a98.exe	102
PID 1160 wrote to memory of 448	1160	e0cbefcb1af40c7d4aff4aca26621a98.exe	102
PID 1160 wrote to memory of 448	1160	e0cbefcb1af40c7d4aff4aca26621a98.exe	102
PID 3464 wrote to memory of 2096	3464	Process not Found	112
PID 3464 wrote to memory of 2096	3464	Process not Found	112
PID 3464 wrote to memory of 2096	3464	Process not Found	112
PID 2096 wrote to memory of 3544	2096	745B.exe	113
PID 2096 wrote to memory of 3544	2096	745B.exe	113
PID 2096 wrote to memory of 3544	2096	745B.exe	113
PID 3464 wrote to memory of 3748	3464	Process not Found	116
PID 3464 wrote to memory of 3748	3464	Process not Found	116
PID 3464 wrote to memory of 3748	3464	Process not Found	116
PID 3748 wrote to memory of 3672	3748	898A.exe	117
PID 3748 wrote to memory of 3672	3748	898A.exe	117
PID 3748 wrote to memory of 3672	3748	898A.exe	117
PID 3544 wrote to memory of 3876	3544	explorer.exe	92
PID 3544 wrote to memory of 3876	3544	explorer.exe	92
PID 3544 wrote to memory of 1160	3544	explorer.exe	95
PID 3544 wrote to memory of 1160	3544	explorer.exe	95
PID 3544 wrote to memory of 2760	3544	explorer.exe	97
PID 3544 wrote to memory of 2760	3544	explorer.exe	97
PID 3544 wrote to memory of 3308	3544	explorer.exe	100
PID 3544 wrote to memory of 3308	3544	explorer.exe	100
PID 3544 wrote to memory of 3672	3544	explorer.exe	117
PID 3544 wrote to memory of 3672	3544	explorer.exe	117
PID 492 wrote to memory of 436	492	e0cbefcb1af40c7d4aff4aca26621a98.exe	120
PID 492 wrote to memory of 436	492	e0cbefcb1af40c7d4aff4aca26621a98.exe	120
PID 492 wrote to memory of 436	492	e0cbefcb1af40c7d4aff4aca26621a98.exe	120
PID 3308 wrote to memory of 2444	3308	nsbC64C.tmp	122
PID 3308 wrote to memory of 2444	3308	nsbC64C.tmp	122
PID 3308 wrote to memory of 2444	3308	nsbC64C.tmp	122
PID 2444 wrote to memory of 4844	2444	399c11q93uk.exe	123
PID 2444 wrote to memory of 4844	2444	399c11q93uk.exe	123
PID 2444 wrote to memory of 4844	2444	399c11q93uk.exe	123
PID 492 wrote to memory of 4348	492	e0cbefcb1af40c7d4aff4aca26621a98.exe	124
PID 492 wrote to memory of 4348	492	e0cbefcb1af40c7d4aff4aca26621a98.exe	124
PID 4348 wrote to memory of 892	4348	cmd.exe	126
PID 4348 wrote to memory of 892	4348	cmd.exe	126
PID 492 wrote to memory of 3168	492	e0cbefcb1af40c7d4aff4aca26621a98.exe	127
PID 492 wrote to memory of 3168	492	e0cbefcb1af40c7d4aff4aca26621a98.exe	127
PID 492 wrote to memory of 3168	492	e0cbefcb1af40c7d4aff4aca26621a98.exe	127
PID 492 wrote to memory of 3188	492	e0cbefcb1af40c7d4aff4aca26621a98.exe	131
PID 492 wrote to memory of 3188	492	e0cbefcb1af40c7d4aff4aca26621a98.exe	131
PID 492 wrote to memory of 3188	492	e0cbefcb1af40c7d4aff4aca26621a98.exe	131
PID 492 wrote to memory of 692	492	e0cbefcb1af40c7d4aff4aca26621a98.exe	133
PID 492 wrote to memory of 692	492	e0cbefcb1af40c7d4aff4aca26621a98.exe	133
PID 492 wrote to memory of 692	492	e0cbefcb1af40c7d4aff4aca26621a98.exe	133

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\6ecc88149dfdad0b296e7aee3c554fc191b1371d09c51ee2e47ac0e145ee38ba.exe
"C:\Users\Admin\AppData\Local\Temp\6ecc88149dfdad0b296e7aee3c554fc191b1371d09c51ee2e47ac0e145ee38ba.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1096
- C:\Users\Admin\AppData\Local\Temp\InstallSetup8.exe
  "C:\Users\Admin\AppData\Local\Temp\InstallSetup8.exe"
  2⤵
  - Looks for VMWare services registry key.
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Checks whether UAC is enabled
  - Maps connected drives based on registry
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of WriteProcessMemory
  PID:3876
- - C:\Users\Admin\AppData\Local\Temp\BroomSetup.exe
    C:\Users\Admin\AppData\Local\Temp\BroomSetup.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2760
- - C:\Users\Admin\AppData\Local\Temp\nsbC64C.tmp
    C:\Users\Admin\AppData\Local\Temp\nsbC64C.tmp
    3⤵
    - Looks for VMWare services registry key.
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Checks whether UAC is enabled
    - Maps connected drives based on registry
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:3308
  - - C:\ProgramData\Java Updater\399c11q93uk.exe
      /prstb
      4⤵
      Executes dropped EXE
      Checks whether UAC is enabled
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Checks processor information in registry
      Suspicious behavior: MapViewOfSection
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2444
    - - C:\Windows\SysWOW64\explorer.exe
        
        C:\Windows\SysWOW64\explorer.exe
        5⤵
        Modifies firewall policy service
        Sets file execution options in registry
        Checks BIOS information in registry
        Adds Run key to start application
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Checks processor information in registry
        Enumerates system info in registry
        Modifies Internet Explorer Protected Mode
        Modifies Internet Explorer Protected Mode Banner
        Modifies Internet Explorer settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:4844
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4844 -s 1156
        6⤵
        Program crash
        
        PID:1076
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\AppData\Local\Temp\nsbC64C.tmp" & del "C:\ProgramData\*.dll"" & exit
      4⤵
      PID:1300
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 5
        5⤵
        Delays execution with timeout.exe
        
        PID:4068
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3308 -s 2516
      4⤵
      Program crash
      PID:1096
- - C:\ProgramData\Java Updater\399c11q93uk.exe
    /prstb
    3⤵
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Checks processor information in registry
    - Suspicious behavior: MapViewOfSection
    PID:776
  - - C:\Windows\SysWOW64\explorer.exe
      C:\Windows\SysWOW64\explorer.exe
      4⤵
      Modifies firewall policy service
      Sets file execution options in registry
      Checks BIOS information in registry
      Adds Run key to start application
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Checks processor information in registry
      Enumerates system info in registry
      Modifies Internet Explorer Protected Mode
      Modifies Internet Explorer Protected Mode Banner
      Modifies Internet Explorer settings
      PID:100
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 100 -s 1144
        5⤵
        Program crash
        
        PID:3572
- C:\Users\Admin\AppData\Local\Temp\rty27.exe
  "C:\Users\Admin\AppData\Local\Temp\rty27.exe"
  2⤵
  - Executes dropped EXE
  PID:4212
- C:\Users\Admin\AppData\Local\Temp\toolspub2.exe
  "C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  PID:3244
- C:\Users\Admin\AppData\Local\Temp\e0cbefcb1af40c7d4aff4aca26621a98.exe
  "C:\Users\Admin\AppData\Local\Temp\e0cbefcb1af40c7d4aff4aca26621a98.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1160
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:448
- - C:\Users\Admin\AppData\Local\Temp\e0cbefcb1af40c7d4aff4aca26621a98.exe
    "C:\Users\Admin\AppData\Local\Temp\e0cbefcb1af40c7d4aff4aca26621a98.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Checks for VirtualBox DLLs, possible anti-VM trick
    - Drops file in Windows directory
    - Modifies data under HKEY_USERS
    - Suspicious use of WriteProcessMemory
    PID:492
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Drops file in System32 directory
      Modifies data under HKEY_USERS
      Suspicious use of AdjustPrivilegeToken
      PID:436
  - - C:\Windows\system32\cmd.exe
      C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4348
    - - C:\Windows\system32\netsh.exe
        
        netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
        5⤵
        Modifies Windows Firewall
        
        PID:892
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Drops file in System32 directory
      Modifies data under HKEY_USERS
      PID:3168
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Drops file in System32 directory
      Modifies data under HKEY_USERS
      PID:3188
  - - C:\Windows\rss\csrss.exe
      C:\Windows\rss\csrss.exe
      4⤵
      Executes dropped EXE
      PID:692

C:\Users\Admin\AppData\Local\Temp\745B.exe
C:\Users\Admin\AppData\Local\Temp\745B.exe
1⤵
- Sets file execution options in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2096
- C:\Windows\SysWOW64\explorer.exe
  C:\Windows\SysWOW64\explorer.exe
  2⤵
  - Modifies firewall policy service
  - Sets file execution options in registry
  - Checks BIOS information in registry
  - Adds Run key to start application
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies Internet Explorer Protected Mode
  - Modifies Internet Explorer Protected Mode Banner
  - Modifies Internet Explorer settings
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3544
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3544 -s 1144
    3⤵
    - Program crash
    PID:3332

C:\Users\Admin\AppData\Local\Temp\898A.exe
C:\Users\Admin\AppData\Local\Temp\898A.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3748
- C:\Users\Admin\AppData\Local\Temp\WindowsUpdater.exe
  "C:\Users\Admin\AppData\Local\Temp\WindowsUpdater.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:3672

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 3544 -ip 3544
1⤵
PID:1712

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 4844 -ip 4844
1⤵
PID:3584

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 3308 -ip 3308
1⤵
PID:952

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 100 -ip 100
1⤵
PID:5000

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Are.docx

Path C:\ProgramData\Are.docx
Size 11KB
SHA256 5abf8e3d1f78de7b09d7f6fb87f9e80e60caacf13ef3c1289665653dacd7c454
MD5 a33e5b189842c5867f46566bdbf7a095
SHA1 e1c06359f6a76da90d19e8fd95e79c832edb3196
SHA512 f2ad3812ec9b915e9618539b0f103f2e9acaad25fbbacd84941c954ce070af231324e83a4621e951c1dbae8d40d50410954e40dd52bbd46e34c54b0d1957407b
SSDEEP 192:CtNCEE33S7Ok0CMSYbcBVk6tqM16iPBkeawLWdxd7o3Lp:aNwC78uYbcBv6akwLWdxdE3Lp
MD5 SHA1 SHA512 SSDEEP

Submit Download

mozglue.dll

Path C:\ProgramData\mozglue.dll
Size 593KB
SHA256 ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
MD5 c8fd9be83bc728cc04beffafc2907fe9
SHA1 95ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA512 fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040
SSDEEP 12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5 SHA1 SHA512 SSDEEP

Submit Download

nss3.dll

Path C:\ProgramData\nss3.dll
Size 2.0MB
SHA256 ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
MD5 1cc453cdf74f31e4d913ff9c10acdde2
SHA1 6e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA512 dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571
SSDEEP 49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5 SHA1 SHA512 SSDEEP

Submit Download

745B.exe

Path C:\Users\Admin\AppData\Local\Temp\745B.exe
Size 360KB
SHA256 6d99cec56614b6b8a23dfa84a50c6bbfde535411c6366ac2bcc20c9f5af62880
MD5 80c413180b6bd0dd664adc4e0665b494
SHA1 e791e4a3391fc6b7bcb58399cd4fa3c52a06b940
SHA512 347f4ae6f308b37d055a6177478e45ab3838d7020abed70c7aa138d2c3771e709de204da8550aebdcaa6139d869dc7328cc7e645c4dd48d1066f9ad70225644a
SSDEEP 6144:VuWFksgTOzEV6zs1hfk8MIcG1Zb7d+0PuSCU4CzmJkdVds:5FkRTOzEV6zs1hfk8oYVd+Dj4mYVds
MD5 SHA1 SHA512 SSDEEP

Submit Download

898A.exe

Path C:\Users\Admin\AppData\Local\Temp\898A.exe
Size 5.6MB
SHA256 4e07a3356bb6ffaa23224884b2ec5d79b6f956acc186475adac89867c0d623d9
MD5 f7c6d870f0de20c40388b493d2b315d2
SHA1 1b25397776ae0481184f151ec3e608f3b65ac8e6
SHA512 0619a22579ee70745034c547c53180d4319c3dc5db326dfecc275cd3b3025f354a3e6fac093a925611a5e0cca5ff9dbcfbfe246d376bb173829f332b670f5655
SSDEEP 98304:keMUmbMp/oC4lzgpl6caZK+YsYA5ReZwyxg+UdtDiDeFTX:ke9tzYzgpl6X7/YAFuDM7
MD5 SHA1 SHA512 SSDEEP

Submit Download

BroomSetup.exe

Path C:\Users\Admin\AppData\Local\Temp\BroomSetup.exe
Size 5.3MB
SHA256 ff3025f9cf19323c5972d14f00f01296d6d7a71547eca7e4016bfd0e1f27b504
MD5 00e93456aa5bcf9f60f84b0c0760a212
SHA1 6096890893116e75bd46fea0b8c3921ceb33f57d
SHA512 abd2be819c7d93bd6097155cf84eaf803e3133a7e0ca71f9d9cbc3c65e4e4a26415d2523a36adafdd19b0751e25ea1a99b8d060cad61cdfd1f79adf9cd4b4eca
SSDEEP 98304:X4zVE2GO5za356R7mgdqMhW8hQjqb0It:gl7mg1WO
MD5 SHA1 SHA512 SSDEEP

Submit Download

InstallSetup8.exe

Path C:\Users\Admin\AppData\Local\Temp\InstallSetup8.exe
Size 2.4MB
SHA256 0198998df660ee268a694a15874d5f4d19c3ed7d3446c482d8665657693bdc9d
MD5 1b7371528055d2f89c782f621c60d2e6
SHA1 96f7d347c4aadd5bbe131ab91ae4ae9c86dee8bc
SHA512 a5105da332ad6be005f7a5fba829d18f05f1d0d6089ec49535212d0c00342b2129bd041c78a1f2155135856387f4d77e221d407268799d0a256bf945ce148869
SSDEEP 49152:vk2s5FXQ4EmojLjCRELVf7Avil+dHIsLp1thIikN+6u2hsy:v8zX71oDCRAZUviAHImDqia7hsy
MD5 SHA1 SHA512 SSDEEP

Submit Download

WindowsUpdater.exe

Path C:\Users\Admin\AppData\Local\Temp\WindowsUpdater.exe
Size 2.2MB
SHA256 5ebb608342d1306743d1ab56bb587b00d7e14737f5af48be3fa738a98cf29668
MD5 0badb0e573d95db49ac23c11163d9386
SHA1 d86dd20e4498ba5576272df07cd71dd9ed40bf8d
SHA512 a83d397fdcf2b749aac8f1db38a991b06a70c58d21c84d09cd8a732ee744287e7d7d58edeb817006b6ee245ed313993a3280aea32fd4c5a079b4f960ab35eff8
SSDEEP 49152:4cX0jpE9mUm1VMp/h+U9b34lzgplaVunjmZ9s+/vIsBiAi4Rem:YeMUmbMp/oC4lzgpl6caZK+YsYA5Rem
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_d0cf5jif.k0f.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_d0cf5jif.k0f.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

e0cbefcb1af40c7d4aff4aca26621a98.exe

Path C:\Users\Admin\AppData\Local\Temp\e0cbefcb1af40c7d4aff4aca26621a98.exe
Size 4.1MB
SHA256 22ad7d2ac9ade5c5c25e030fa5d76d62dff95c5cb550a8c71433c31348aabd04
MD5 6fd15032c68ab45af5da2f585e37e6e3
SHA1 b2cb11289b5c90e0feb32be9782475297acca2f6
SHA512 ad4f3d163b4287ddcb185934ee309536edb858024a48a2c824da7fe5e2b9512f4b4e7dd4ac085fb0fc7df27dd7bf77647c72a48038f6f11e8a9d1e6d9e4ec30f
SSDEEP 98304:Y2KRBzq7ig3cmy2iWGMbvwJSA/qlz6wvdV75g1gi/5:YNBpgMR+w9odV75Kx
MD5 SHA1 SHA512 SSDEEP

Submit Download

lib.dll

Path C:\Users\Admin\AppData\Local\Temp\lib.dll
Size 2.2MB
SHA256 fdbd693e2a9eab791967e78eef8e1a3423c63b570d6fc8ccd9367be931c779c4
MD5 bc94fe5f3a7d234dceefa5a25c109358
SHA1 eefd19123cb554bd975d9848eff08f195c7794bb
SHA512 650632899edc1bce009244cf228500c26df33c2036f774f60529c10bf7b277a49d3e635846097cf2d821a54e066a07f5f6ef2be055e1054e8c4a1a938fad9c69
SSDEEP 49152:79Kjpo9mMG19gF/7+w9bRcpLgnB+36nT+51s+/vIkdIcCCteX:kyMMGvgF/aCcpLgnBuo65y+okuc5teX
MD5 SHA1 SHA512 SSDEEP

Submit Download

nsbC64C.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsbC64C.tmp
Size 314KB
SHA256 b0810d72555442341dd38d894b2551d1823613bcb747e19ce511da4d5fde3903
MD5 7d03e5cd75616615792ff5da7f630d43
SHA1 20dbe01340369c1e10fabf28c898c6f9fff1ae34
SHA512 d942769fc2ed3e4a1f6b170a538e8695471857c3c2148ed6c16ed9b148ce962119320e61744e82993c7f73e690828a0022b251ec5ac8d86253f1aeb2d0e43a01
SSDEEP 6144:TARL0o0AGim9r1FTMOI8qdDPhfTgYn79oUq:TARX0AGisfQOIfDln7a
MD5 SHA1 SHA512 SSDEEP

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsg909F.tmp\System.dll
Size 12KB
SHA256 7fb0f8d452fefaac789986b933df050f3d3e4feb8a8d9944ada995f572dcdca1
MD5 dd87a973e01c5d9f8e0fcc81a0af7c7a
SHA1 c9206ced48d1e5bc648b1d0f54cccc18bf643a14
SHA512 4910b39b1a99622ac8b3c42f173bbe7035ac2f8d40c946468e7db7e2868a2da81ea94da453857f06f39957dd690c7f1ba498936a7aaa0039975e472376f92e8f
SSDEEP 192:VFiQJ77pJp17C8F1A5xjGNxrgFOgb7lrT/993:97pJp48F2exrg5F/9
MD5 SHA1 SHA512 SSDEEP

Submit Download

INetC.dll

Path C:\Users\Admin\AppData\Local\Temp\nsr6167.tmp\INetC.dll
Size 25KB
SHA256 85e03805f90f72257dd41bfdaa186237218bbb0ec410ad3b6576a88ea11dccb9
MD5 40d7eca32b2f4d29db98715dd45bfac5
SHA1 124df3f617f562e46095776454e1c0c7bb791cc7
SHA512 5fd4f516ce23fb7e705e150d5c1c93fc7133694ba495fb73101674a528883a013a34ab258083aa7ce6072973b067a605158316a4c9159c1b4d765761f91c513d
SSDEEP 384:pjj9e9dE95XD+iTx58Y5oMM3O9MEoLr1VcQZ/ZwcSyekMRlZ4L4:dAvE90GuY2tO93oLrJRM7Z4E
MD5 SHA1 SHA512 SSDEEP

Submit Download

Math.dll

Path C:\Users\Admin\AppData\Local\Temp\nsr6167.tmp\Math.dll
Size 67KB
SHA256 fb6a0072377325b5da0d1da236d9da2610608e9ab74318e15540cc7aca75f837
MD5 ebd8a7a5042ae1d4ce1aa9071859c851
SHA1 ee508ce7cbe8b1b0bd471bee43e1ec19d21e8ad6
SHA512 daebecc30e91b19737b346ed7ac85ada87757f53fa67fdd262ba617b29c24ebde4058171f71bf1bc8d0d8b39a9a346c7ef2a9968908dbc16723069d8f9507b0e
SSDEEP 1536:+UZ5ku7V7IGMp2ZmtSLZp9IeB7FSM+tq:bB7WSBhdFAt
MD5 SHA1 SHA512 SSDEEP

Submit Download

rty27.exe

Path C:\Users\Admin\AppData\Local\Temp\rty27.exe
Size 420KB
SHA256 0bcbd70a1b5dbec77ffbb14aaba62202b9736fb1f77c5e48a064afc5e2ffe01a
MD5 afee6eeb6863a20a615d24406e563b6c
SHA1 8175c07e6c4154734e0512718dc6898437f4001c
SHA512 e1ec83688bbf4916bcd7a185a0a7e03278a426bce355c14ba886d2ac20322bc073c257ba599e01af0645d1a4535ec062021f58c44bd74593cee5cf8d937b47a4
SSDEEP 6144:yl0CoZ3gYx1K2teOwrZDWN4t0+eoJAbB3T+cbJp:WoZwYHKVrlL0+5cCIJp
MD5 SHA1 SHA512 SSDEEP

Submit Download

toolspub2.exe

Path C:\Users\Admin\AppData\Local\Temp\toolspub2.exe
Size 201KB
SHA256 5e325be4bc51d83b75cb6e3182a8820a5f841a89b5d3e00969ce2a5f831ba5dc
MD5 6aa6732f8a7ffe321b4e43d5702800e9
SHA1 1582c0f3d8c2f589d27d7f5c19f682bfd04e75d1
SHA512 456f31eac21a5435f9fbc35ddc88a8026094ad3b46a72e3f28835bf7004993b7625b56ef036456a2319cb83dfa190c087bec6dd5cb23512effe064104863c459
SSDEEP 3072:TUKxaOcfLqC1wWAamvl6OJQeIJ56kJdoiE0U/SXeSygB5XAfE09:oqaLh2WAamvMOJQXJNXq/SRyom
MD5 SHA1 SHA512 SSDEEP

Submit Download

powershell.exe.log

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 2KB
SHA256 6f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69
MD5 3d086a433708053f9bf9523e1d87a4e8
SHA1 b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28
SHA512 931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd
MD5 SHA1 SHA512

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 19KB
SHA256 24932744768511cb83e84bce9160a05fa93ec3f832ff7b6515d334270d934e48
MD5 9cb6e05e441faaf03f778a729632183c
SHA1 dee0dff98d42c71f149204384cb76d3a790bbf59
SHA512 8142cef523e05771d5c8853ae9e87c0a6ed3922cfee0380f9d17287c21e982784ca16225ed6da1ec445247a2f4cc3a0b1ee0e98b5aa64f87db683ec094f22639
SSDEEP 384:K6+BV9m+bUdDYvAhcZ00kkKo9o2TJK6seYbneW8v/ZNwM0tOqEIjaipqZbObTUSd:X4U9Y4hQwkfo2TJN+nsvYOqEI54qMB2
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 19KB
SHA256 1a4ba42d8266956cf2a6de8285268ab36113daa419bfa5b74b53bcc0c34d81e0
MD5 b2570c1570bec3dc95bec7bb5501c59d
SHA1 d46da317638b36349cba4a04dd8696c4868d04b1
SHA512 f25ca5431e470f505cb05728b0e3366037d68284c3bcc6306199991eefe89620400cf2240181054e0dc46f4aa0a5585f3ab4faa8713253d4f17f1cd13abcd3ce
SSDEEP 384:Xsf+BnRBJNGskii0Jkjo9oONYPNpfemRc7/Zocm0owJO1E4+nFbOuj3lu0Og:8fUJNfTi1UoONiNpfs7B7w1q4ublb
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/448-194-0x0000000007AE0000-0x0000000007AF1000-memory.dmp

Download

memory/448-173-0x00000000079A0000-0x00000000079D2000-memory.dmp

Download

memory/448-202-0x0000000073C20000-0x00000000743D0000-memory.dmp

Download

memory/448-198-0x0000000007B80000-0x0000000007B88000-memory.dmp

Download

memory/448-197-0x0000000007B90000-0x0000000007BAA000-memory.dmp

Download

memory/448-196-0x0000000007B40000-0x0000000007B54000-memory.dmp

Download

memory/448-195-0x0000000007B20000-0x0000000007B2E000-memory.dmp

Download

memory/448-190-0x0000000007BE0000-0x0000000007C76000-memory.dmp

Download

memory/448-189-0x0000000007AD0000-0x0000000007ADA000-memory.dmp

Download

memory/448-120-0x0000000073C20000-0x00000000743D0000-memory.dmp

Download

memory/448-188-0x00000000079E0000-0x0000000007A83000-memory.dmp

Download

memory/448-127-0x0000000004D90000-0x0000000004DA0000-memory.dmp

Download

memory/448-126-0x0000000004DA0000-0x0000000004DD6000-memory.dmp

Download

memory/448-187-0x0000000007980000-0x000000000799E000-memory.dmp

Download

memory/448-129-0x0000000004D90000-0x0000000004DA0000-memory.dmp

Download

memory/448-136-0x0000000005410000-0x0000000005A38000-memory.dmp

Download

memory/448-137-0x0000000005270000-0x0000000005292000-memory.dmp

Download

memory/448-138-0x0000000005AB0000-0x0000000005B16000-memory.dmp

Download

memory/448-139-0x0000000005C90000-0x0000000005CF6000-memory.dmp

Download

memory/448-177-0x0000000071A70000-0x0000000071DC4000-memory.dmp

Download

memory/448-152-0x0000000005DC0000-0x0000000006114000-memory.dmp

Download

memory/448-175-0x000000007EE90000-0x000000007EEA0000-memory.dmp

Download

memory/448-176-0x00000000718D0000-0x000000007191C000-memory.dmp

Download

memory/448-162-0x0000000006260000-0x000000000627E000-memory.dmp

Download

memory/448-163-0x00000000064B0000-0x00000000064FC000-memory.dmp

Download

memory/448-164-0x00000000068F0000-0x0000000006934000-memory.dmp

Download

memory/448-172-0x00000000077C0000-0x00000000077DA000-memory.dmp

Download

memory/448-166-0x0000000004D90000-0x0000000004DA0000-memory.dmp

Download

memory/448-167-0x00000000074B0000-0x0000000007526000-memory.dmp

Download

memory/448-171-0x0000000007E40000-0x00000000084BA000-memory.dmp

Download

memory/492-320-0x0000000000400000-0x0000000000D1C000-memory.dmp

Download

memory/1096-0-0x0000000074F70000-0x0000000075720000-memory.dmp

Download

memory/1096-1-0x00000000007E0000-0x0000000000EF6000-memory.dmp

Download

memory/1096-40-0x0000000074F70000-0x0000000075720000-memory.dmp

Download

memory/1160-174-0x0000000002DB0000-0x000000000369B000-memory.dmp

Download

memory/1160-159-0x0000000000400000-0x0000000000D1C000-memory.dmp

Download

memory/1160-165-0x00000000028B0000-0x0000000002CAF000-memory.dmp

Download

memory/1160-265-0x000000002C6C0000-0x000000002C784000-memory.dmp

Download

memory/1160-205-0x0000000000400000-0x0000000000D1C000-memory.dmp

Download

memory/1160-80-0x00000000028B0000-0x0000000002CAF000-memory.dmp

Download

memory/1160-82-0x0000000000400000-0x0000000000D1C000-memory.dmp

Download

memory/1160-105-0x0000000000400000-0x0000000000D1C000-memory.dmp

Download

memory/1160-199-0x0000000000400000-0x0000000000D1C000-memory.dmp

Download

memory/1160-81-0x0000000002DB0000-0x000000000369B000-memory.dmp

Download

memory/2096-220-0x0000000000010000-0x000000000006D000-memory.dmp

Download

memory/2096-230-0x00000000009D0000-0x00000000009D1000-memory.dmp

Download

memory/2096-235-0x00000000026E0000-0x00000000026E1000-memory.dmp

Download

memory/2096-239-0x0000000000700000-0x0000000000766000-memory.dmp

Download

memory/2096-232-0x0000000000700000-0x0000000000766000-memory.dmp

Download

memory/2096-231-0x00000000026F0000-0x00000000026FC000-memory.dmp

Download

memory/2096-229-0x0000000077A84000-0x0000000077A85000-memory.dmp

Download

memory/2096-228-0x00000000005D0000-0x00000000005DD000-memory.dmp

Download

memory/2096-226-0x0000000000700000-0x0000000000766000-memory.dmp

Download

memory/2760-76-0x0000000000F80000-0x0000000000F81000-memory.dmp

Download

memory/2760-46-0x0000000000F80000-0x0000000000F81000-memory.dmp

Download

memory/2760-61-0x0000000000400000-0x0000000000965000-memory.dmp

Download

memory/2760-266-0x0000000000B60000-0x0000000000C24000-memory.dmp

Download

memory/3244-77-0x0000000000AE0000-0x0000000000BE0000-memory.dmp

Download

memory/3244-89-0x0000000000400000-0x0000000000854000-memory.dmp

Download

memory/3244-78-0x0000000000970000-0x0000000000979000-memory.dmp

Download

memory/3244-79-0x0000000000400000-0x0000000000854000-memory.dmp

Download

memory/3308-107-0x0000000000400000-0x000000000062E000-memory.dmp

Download

memory/3308-161-0x0000000000400000-0x000000000062E000-memory.dmp

Download

memory/3308-119-0x00000000007C0000-0x00000000007DC000-memory.dmp

Download

memory/3308-302-0x0000000000400000-0x000000000062E000-memory.dmp

Download

memory/3308-125-0x00000000006A0000-0x00000000007A0000-memory.dmp

Download

memory/3308-299-0x000000002CDE0000-0x000000002CEA4000-memory.dmp

Download

memory/3308-73-0x00000000006A0000-0x00000000007A0000-memory.dmp

Download

memory/3308-74-0x00000000007C0000-0x00000000007DC000-memory.dmp

Download

memory/3308-75-0x0000000000400000-0x000000000062E000-memory.dmp

Download

memory/3308-83-0x0000000061E00000-0x0000000061EF3000-memory.dmp

Download

memory/3308-207-0x0000000000400000-0x000000000062E000-memory.dmp

Download

memory/3308-312-0x000000002CDE0000-0x000000002CEA4000-memory.dmp

Download

memory/3308-267-0x000000002CDE0000-0x000000002CEA4000-memory.dmp

Download

memory/3308-128-0x0000000000400000-0x000000000062E000-memory.dmp

Download

memory/3464-85-0x0000000000FB0000-0x0000000000FC6000-memory.dmp

Download

memory/3544-238-0x0000000000C00000-0x0000000000CC4000-memory.dmp

Download

memory/3544-283-0x0000000000D00000-0x0000000001133000-memory.dmp

Download

memory/3544-233-0x0000000000D00000-0x0000000001134000-memory.dmp

Download

memory/3544-242-0x0000000000C00000-0x0000000000CC4000-memory.dmp

Download

memory/3544-240-0x0000000000C00000-0x0000000000CC4000-memory.dmp

Download

memory/3544-236-0x0000000000D00000-0x0000000001134000-memory.dmp

Download

memory/3672-268-0x0000000002760000-0x0000000002824000-memory.dmp

Download

memory/3672-270-0x0000000002760000-0x0000000002824000-memory.dmp

Download

memory/3876-264-0x0000000000730000-0x00000000007F4000-memory.dmp

Download

memory/4212-213-0x00000000032F0000-0x00000000033FC000-memory.dmp

Download

memory/4212-214-0x0000000003530000-0x0000000003661000-memory.dmp

Download

memory/4212-247-0x0000000003530000-0x0000000003661000-memory.dmp

Download

memory/4212-20-0x00007FF6C7BB0000-0x00007FF6C7C1F000-memory.dmp

Download