Analysis
- max time kernel
156s - max time network
160s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system - submitted
04/02/2024, 12:05
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
8f1c5bb58c6f86f668ed6b0703aadf94.exe
Resource
win7-20231215-en
windows7-x64
15 signatures
150 seconds
Behavioral task
behavioral2
Sample
8f1c5bb58c6f86f668ed6b0703aadf94.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
15 signatures
150 seconds
General
- Target 8f1c5bb58c6f86f668ed6b0703aadf94.exe
- Size 28.9MB
- Sample240204-n9dzeabacl
- SHA256 3c219e01c865a8a44936a06cf0e25c822c8b399a0b91d9b2bd7cbacb1add7cc8
- MD5 8f1c5bb58c6f86f668ed6b0703aadf94
- SHA1 52762df89f057021f264381d57dcd1e89306a030
- SHA512 2c1aa5cf3d6fc0a22466a0c2b33f931cfefac7256d9f7ebd4bd0e1f1c18b301c3bb9bde0e100880e7e920de14e92ef566987d4af7ce2d39b59210ce9dca913cc
- SSDEEP 12288:9Tvddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddz:5D
- MD5 SHA1 SHA512 SSDEEP
Score
8/10
Malware Config
Signatures
- Adds policy Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\recovery = "C:\\Windows\\system32\\srvlsainfo.exe" 8f1c5bb58c6f86f668ed6b0703aadf94.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run 8f1c5bb58c6f86f668ed6b0703aadf94.exe - Modifies Installed Components in the registry 2 TTPs 8 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{22d7f312-b0f6-11d2-94ab-0080c33c7e95}\ = "Themes Setup" 8f1c5bb58c6f86f668ed6b0703aadf94.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{22d7f312-b0f6-11d2-94ab-0080c33c7e95} 8f1c5bb58c6f86f668ed6b0703aadf94.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{22d7f312-b0f6-11d2-94ab-0080c33c7e95}\StubPath = "rundll32.exe C:\\Windows\\system32\\themeuichk.dll,ThemesSetupInstallCheck" 8f1c5bb58c6f86f668ed6b0703aadf94.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{22d7f312-b0f6-11d2-94ab-0080c33c7e95}\IconsBinary = "C:\\Windows\\system32\\ctfsrvpool.exe" 8f1c5bb58c6f86f668ed6b0703aadf94.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{22d7f312-b0f6-11d2-94ab-0080c33c7e95}\Version = "1,1,1,2" 8f1c5bb58c6f86f668ed6b0703aadf94.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{22d7f312-b0f6-11d2-94ab-0080c33c7e95}\ComponentID = "DOTNETFRAMEWORKS" 8f1c5bb58c6f86f668ed6b0703aadf94.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{22d7f312-b0f6-11d2-94ab-0080c33c7e95}\DontAsk = "2" 8f1c5bb58c6f86f668ed6b0703aadf94.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{22d7f312-b0f6-11d2-94ab-0080c33c7e95}\IsInstalled = "1" 8f1c5bb58c6f86f668ed6b0703aadf94.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\recovery = "C:\\Windows\\system32\\srvlsainfo.exe" 8f1c5bb58c6f86f668ed6b0703aadf94.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Installs/modifies Browser Helper Object 2 TTPs 3 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3} 8f1c5bb58c6f86f668ed6b0703aadf94.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}\ = "AcroIEHelperStub" 8f1c5bb58c6f86f668ed6b0703aadf94.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}\NoExplorer = "1" 8f1c5bb58c6f86f668ed6b0703aadf94.exe - Drops file in System32 directory 10 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\hostlsams.ocx 8f1c5bb58c6f86f668ed6b0703aadf94.exe File created C:\Windows\SysWOW64\ctfsrvpool.exe 8f1c5bb58c6f86f668ed6b0703aadf94.exe File opened for modification C:\Windows\SysWOW64\ctfsrvpool.exe 8f1c5bb58c6f86f668ed6b0703aadf94.exe File created C:\Windows\SysWOW64\dhcppoolsvc.exe 8f1c5bb58c6f86f668ed6b0703aadf94.exe File opened for modification C:\Windows\SysWOW64\dhcppoolsvc.exe 8f1c5bb58c6f86f668ed6b0703aadf94.exe File created C:\Windows\SysWOW64\ctffwcpptp.exe 8f1c5bb58c6f86f668ed6b0703aadf94.exe File opened for modification C:\Windows\SysWOW64\ctffwcpptp.exe 8f1c5bb58c6f86f668ed6b0703aadf94.exe File created C:\Windows\SysWOW64\srvlsainfo.exe 8f1c5bb58c6f86f668ed6b0703aadf94.exe File opened for modification C:\Windows\SysWOW64\srvlsainfo.exe 8f1c5bb58c6f86f668ed6b0703aadf94.exe File created C:\Windows\SysWOW64\hostlsams.ocx 8f1c5bb58c6f86f668ed6b0703aadf94.exe - Modifies Control Panel 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\Control Panel\Desktop\ForegroundLockTimeout = "53018344" 8f1c5bb58c6f86f668ed6b0703aadf94.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\Software\Microsoft\Internet Explorer\Main 8f1c5bb58c6f86f668ed6b0703aadf94.exe Set value (int) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31086434" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3420089654" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31086434" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Key created \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Check_Associations = "no" 8f1c5bb58c6f86f668ed6b0703aadf94.exe Set value (int) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{F3A1C058-C355-11EE-B7F4-4EA1437444E8} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Key created \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3420089654" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31086434" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3646339997" IEXPLORE.EXE - Modifies registry class 9 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{18DF081C-E8AD-4283-A596-FA578C2EBDC3} 8f1c5bb58c6f86f668ed6b0703aadf94.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}\InprocServer32 8f1c5bb58c6f86f668ed6b0703aadf94.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}\InprocServer32\ = "C:\\Windows\\SysWow64\\hostlsams.ocx" 8f1c5bb58c6f86f668ed6b0703aadf94.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}\ProgID 8f1c5bb58c6f86f668ed6b0703aadf94.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}\ProgID\ = "AcroIEHelperShim.AcroIEHelperShimObj.1" 8f1c5bb58c6f86f668ed6b0703aadf94.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}\ = "Adobe PDF Link Helper" 8f1c5bb58c6f86f668ed6b0703aadf94.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}\InprocServer32\ThreadingModel = "Apartment" 8f1c5bb58c6f86f668ed6b0703aadf94.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}\VersionIndependentProgID 8f1c5bb58c6f86f668ed6b0703aadf94.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}\VersionIndependentProgID\ = "AcroIEHelperShim.AcroIEHelperShimObj" 8f1c5bb58c6f86f668ed6b0703aadf94.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1140 8f1c5bb58c6f86f668ed6b0703aadf94.exe 1140 8f1c5bb58c6f86f668ed6b0703aadf94.exe 1140 8f1c5bb58c6f86f668ed6b0703aadf94.exe 1140 8f1c5bb58c6f86f668ed6b0703aadf94.exe 1140 8f1c5bb58c6f86f668ed6b0703aadf94.exe 1140 8f1c5bb58c6f86f668ed6b0703aadf94.exe 1140 8f1c5bb58c6f86f668ed6b0703aadf94.exe 1140 8f1c5bb58c6f86f668ed6b0703aadf94.exe 1140 8f1c5bb58c6f86f668ed6b0703aadf94.exe 1140 8f1c5bb58c6f86f668ed6b0703aadf94.exe 1140 8f1c5bb58c6f86f668ed6b0703aadf94.exe 1140 8f1c5bb58c6f86f668ed6b0703aadf94.exe 1140 8f1c5bb58c6f86f668ed6b0703aadf94.exe 1140 8f1c5bb58c6f86f668ed6b0703aadf94.exe 1140 8f1c5bb58c6f86f668ed6b0703aadf94.exe 1140 8f1c5bb58c6f86f668ed6b0703aadf94.exe 1140 8f1c5bb58c6f86f668ed6b0703aadf94.exe 1140 8f1c5bb58c6f86f668ed6b0703aadf94.exe 1140 8f1c5bb58c6f86f668ed6b0703aadf94.exe 1140 8f1c5bb58c6f86f668ed6b0703aadf94.exe 1140 8f1c5bb58c6f86f668ed6b0703aadf94.exe 1140 8f1c5bb58c6f86f668ed6b0703aadf94.exe 1140 8f1c5bb58c6f86f668ed6b0703aadf94.exe 1140 8f1c5bb58c6f86f668ed6b0703aadf94.exe 1140 8f1c5bb58c6f86f668ed6b0703aadf94.exe 1140 8f1c5bb58c6f86f668ed6b0703aadf94.exe 1140 8f1c5bb58c6f86f668ed6b0703aadf94.exe 1140 8f1c5bb58c6f86f668ed6b0703aadf94.exe 1140 8f1c5bb58c6f86f668ed6b0703aadf94.exe 1140 8f1c5bb58c6f86f668ed6b0703aadf94.exe 1140 8f1c5bb58c6f86f668ed6b0703aadf94.exe 1140 8f1c5bb58c6f86f668ed6b0703aadf94.exe 1140 8f1c5bb58c6f86f668ed6b0703aadf94.exe 1140 8f1c5bb58c6f86f668ed6b0703aadf94.exe 1140 8f1c5bb58c6f86f668ed6b0703aadf94.exe 1140 8f1c5bb58c6f86f668ed6b0703aadf94.exe 1140 8f1c5bb58c6f86f668ed6b0703aadf94.exe 1140 8f1c5bb58c6f86f668ed6b0703aadf94.exe 1140 8f1c5bb58c6f86f668ed6b0703aadf94.exe 1140 8f1c5bb58c6f86f668ed6b0703aadf94.exe 1140 8f1c5bb58c6f86f668ed6b0703aadf94.exe 1140 8f1c5bb58c6f86f668ed6b0703aadf94.exe 1140 8f1c5bb58c6f86f668ed6b0703aadf94.exe 1140 8f1c5bb58c6f86f668ed6b0703aadf94.exe 1140 8f1c5bb58c6f86f668ed6b0703aadf94.exe 1140 8f1c5bb58c6f86f668ed6b0703aadf94.exe 1140 8f1c5bb58c6f86f668ed6b0703aadf94.exe 1140 8f1c5bb58c6f86f668ed6b0703aadf94.exe 1140 8f1c5bb58c6f86f668ed6b0703aadf94.exe 1140 8f1c5bb58c6f86f668ed6b0703aadf94.exe 1140 8f1c5bb58c6f86f668ed6b0703aadf94.exe 1140 8f1c5bb58c6f86f668ed6b0703aadf94.exe 1140 8f1c5bb58c6f86f668ed6b0703aadf94.exe 1140 8f1c5bb58c6f86f668ed6b0703aadf94.exe 1140 8f1c5bb58c6f86f668ed6b0703aadf94.exe 1140 8f1c5bb58c6f86f668ed6b0703aadf94.exe 1140 8f1c5bb58c6f86f668ed6b0703aadf94.exe 1140 8f1c5bb58c6f86f668ed6b0703aadf94.exe 1140 8f1c5bb58c6f86f668ed6b0703aadf94.exe 1140 8f1c5bb58c6f86f668ed6b0703aadf94.exe 1140 8f1c5bb58c6f86f668ed6b0703aadf94.exe 1140 8f1c5bb58c6f86f668ed6b0703aadf94.exe 1140 8f1c5bb58c6f86f668ed6b0703aadf94.exe 1140 8f1c5bb58c6f86f668ed6b0703aadf94.exe - Suspicious use of AdjustPrivilegeToken 48 IoCs
description pid Process Token: SeDebugPrivilege 1140 8f1c5bb58c6f86f668ed6b0703aadf94.exe Token: SeBackupPrivilege 1140 8f1c5bb58c6f86f668ed6b0703aadf94.exe Token: SeBackupPrivilege 1140 8f1c5bb58c6f86f668ed6b0703aadf94.exe Token: SeBackupPrivilege 1140 8f1c5bb58c6f86f668ed6b0703aadf94.exe Token: SeBackupPrivilege 1140 8f1c5bb58c6f86f668ed6b0703aadf94.exe Token: SeBackupPrivilege 1140 8f1c5bb58c6f86f668ed6b0703aadf94.exe Token: SeBackupPrivilege 1140 8f1c5bb58c6f86f668ed6b0703aadf94.exe Token: SeBackupPrivilege 1140 8f1c5bb58c6f86f668ed6b0703aadf94.exe Token: SeBackupPrivilege 1140 8f1c5bb58c6f86f668ed6b0703aadf94.exe Token: SeBackupPrivilege 1140 8f1c5bb58c6f86f668ed6b0703aadf94.exe Token: SeBackupPrivilege 1140 8f1c5bb58c6f86f668ed6b0703aadf94.exe Token: SeBackupPrivilege 1140 8f1c5bb58c6f86f668ed6b0703aadf94.exe Token: SeBackupPrivilege 1140 8f1c5bb58c6f86f668ed6b0703aadf94.exe Token: SeBackupPrivilege 1140 8f1c5bb58c6f86f668ed6b0703aadf94.exe Token: SeBackupPrivilege 1140 8f1c5bb58c6f86f668ed6b0703aadf94.exe Token: SeBackupPrivilege 1140 8f1c5bb58c6f86f668ed6b0703aadf94.exe Token: SeBackupPrivilege 1140 8f1c5bb58c6f86f668ed6b0703aadf94.exe Token: SeBackupPrivilege 1140 8f1c5bb58c6f86f668ed6b0703aadf94.exe Token: SeBackupPrivilege 1140 8f1c5bb58c6f86f668ed6b0703aadf94.exe Token: SeBackupPrivilege 1140 8f1c5bb58c6f86f668ed6b0703aadf94.exe Token: SeBackupPrivilege 1140 8f1c5bb58c6f86f668ed6b0703aadf94.exe Token: SeBackupPrivilege 1140 8f1c5bb58c6f86f668ed6b0703aadf94.exe Token: SeBackupPrivilege 1140 8f1c5bb58c6f86f668ed6b0703aadf94.exe Token: SeBackupPrivilege 1140 8f1c5bb58c6f86f668ed6b0703aadf94.exe Token: SeBackupPrivilege 1140 8f1c5bb58c6f86f668ed6b0703aadf94.exe Token: SeBackupPrivilege 1140 8f1c5bb58c6f86f668ed6b0703aadf94.exe Token: SeBackupPrivilege 1140 8f1c5bb58c6f86f668ed6b0703aadf94.exe Token: SeBackupPrivilege 1140 8f1c5bb58c6f86f668ed6b0703aadf94.exe Token: SeBackupPrivilege 1140 8f1c5bb58c6f86f668ed6b0703aadf94.exe Token: SeBackupPrivilege 1140 8f1c5bb58c6f86f668ed6b0703aadf94.exe Token: SeBackupPrivilege 1140 8f1c5bb58c6f86f668ed6b0703aadf94.exe Token: SeBackupPrivilege 1140 8f1c5bb58c6f86f668ed6b0703aadf94.exe Token: SeBackupPrivilege 1140 8f1c5bb58c6f86f668ed6b0703aadf94.exe Token: SeBackupPrivilege 1140 8f1c5bb58c6f86f668ed6b0703aadf94.exe Token: SeBackupPrivilege 1140 8f1c5bb58c6f86f668ed6b0703aadf94.exe Token: SeBackupPrivilege 1140 8f1c5bb58c6f86f668ed6b0703aadf94.exe Token: SeBackupPrivilege 1140 8f1c5bb58c6f86f668ed6b0703aadf94.exe Token: SeBackupPrivilege 1140 8f1c5bb58c6f86f668ed6b0703aadf94.exe Token: SeBackupPrivilege 1140 8f1c5bb58c6f86f668ed6b0703aadf94.exe Token: SeBackupPrivilege 1140 8f1c5bb58c6f86f668ed6b0703aadf94.exe Token: SeBackupPrivilege 1140 8f1c5bb58c6f86f668ed6b0703aadf94.exe Token: SeBackupPrivilege 1140 8f1c5bb58c6f86f668ed6b0703aadf94.exe Token: SeBackupPrivilege 1140 8f1c5bb58c6f86f668ed6b0703aadf94.exe Token: SeBackupPrivilege 1140 8f1c5bb58c6f86f668ed6b0703aadf94.exe Token: SeBackupPrivilege 1140 8f1c5bb58c6f86f668ed6b0703aadf94.exe Token: SeBackupPrivilege 1140 8f1c5bb58c6f86f668ed6b0703aadf94.exe Token: SeBackupPrivilege 1140 8f1c5bb58c6f86f668ed6b0703aadf94.exe Token: SeBackupPrivilege 1140 8f1c5bb58c6f86f668ed6b0703aadf94.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1944 iexplore.exe - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 1944 iexplore.exe 1944 iexplore.exe 2408 IEXPLORE.EXE 2408 IEXPLORE.EXE - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1944 wrote to memory of 2408 1944 iexplore.exe 94 PID 1944 wrote to memory of 2408 1944 iexplore.exe 94 PID 1944 wrote to memory of 2408 1944 iexplore.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\8f1c5bb58c6f86f668ed6b0703aadf94.exe"C:\Users\Admin\AppData\Local\Temp\8f1c5bb58c6f86f668ed6b0703aadf94.exe"1⤵
- Adds policy Run key to start application
- Modifies Installed Components in the registry
- Adds Run key to start application
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1140
-
C:\Program Files (x86)\Internet Explorer\ielowutil.exe"C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding1⤵PID:4120
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1944 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1944 CREDAT:17410 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2408
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
- Size 471B
- SHA256 821420f187b512f853c8b73d9439e940e6e04c499532561343a739717a9a76ee
- MD5 7bde92ff965b73dc76190e608c2fbb93
- SHA1 95547789d183bbf9ea20ef6ba4c6b2f0249fb30d
- SHA512 21406b04613e8be9f2036f5057d6d3de568ec1aa4eb6471cd457e70e6ddadfc3b988d5f4c2d316e548b21b2850944a78d75a44ec3bf929e71fe61fb6b0de4ec6
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
- Size 404B
- SHA256 d6d2785792b62e56df8a7be7b569d1e5b803baee908c8e13aa03402beddd39e7
- MD5 230e02309c58e66d617fa0660f0d3435
- SHA1 18add694d8f3ea4139f9ea8235a86bb8a2acade2
- SHA512 335c3cde943bfb2777712a8b71f42f5f492b8ac049d00bf8566444ff4bbc22935fe1257dac2e702838cd432d791ef75726f769bb4ad57d815ee9dc4f36dd2c48
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\advsec32.dll
- Size 4KB
- SHA256 eed7377eb708d163ad0e8c50ef40d8ea8d15124832904ac1318a3fd10728ffd3
- MD5 97c92f4457dd94d678d4c9e4bdd8352f
- SHA1 8d80f3cead2b0c5b2b80feb548131daf4d33297d
- SHA512 f07bc6be6a70ee28c5dddfcc036c6f3c17abc89f1240a688519c2d39a3012016b13689577dd62f2391153f837cbed5ed127568f14523ac0d6b33c516e0f51e75
- MD5 SHA1 SHA512
- Path C:\Windows\SysWOW64\dhcppoolsvc.exe
- Size 64KB
- SHA256 164cb27f88db7963bbd4c4f43b15434640499bc508a3b642aaa8d85381fb005d
- MD5 414ededbd30014fc8a8571f34de65e45
- SHA1 5e54f7f6d9a920619c7c75306557e62028aa6080
- SHA512 af5c4708354520f8b87e7229214dfa5bf4bae43200bce3dcf75813d757e44fb89795fb80449296e10d0017b186c17afcdb39c9345c63e1e06e3f46c123b3e177
- SSDEEP 1536:mzJ6tfmWZ3s1Gs4L46wu2vAz5LivluVI1eoL8qDTQ:m9AfWb6Ta2ivlLeAQ
- MD5 SHA1 SHA512 SSDEEP