resource	yara_rule
behavioral1/memory/2336-0-0x0000000000400000-0x0000000000452000-memory.dmp	UPX
behavioral1/memory/2336-1-0x0000000000400000-0x0000000000452000-memory.dmp	UPX
behavioral1/memory/2336-2-0x0000000000400000-0x0000000000452000-memory.dmp	UPX
behavioral1/memory/2184-10-0x0000000000400000-0x0000000000452000-memory.dmp	UPX
behavioral1/memory/2476-15-0x0000000001D50000-0x0000000001DA2000-memory.dmp	UPX

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2500 = "3"	notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\2500 = "3"	notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\2500 = "3"	notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\2500 = "3"	notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\2500 = "3"	notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\2500 = "3"	notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\2500 = "3"	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\2500 = "3"	notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2500 = "3"	notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\2500 = "3"	notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2500 = "3"	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\2500 = "3"	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\2500 = "3"	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\2500 = "3"	notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\2500 = "3"	rundll32.exe

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	notepad.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80a7f6e28c59da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "413448294"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000e133c42ef8b6467f117e9439101740f694f91c42139a2c10ef496b9a6008fdf4000000000e8000000002000020000000cec5ec7c4c1a5c5101d62a9b4bc011ca2dec4bb82aea71d3d1cdf93c9404cd4a90000000a08aac5f0462056a9238316ebe35c4cfdaa73e8bdee50774b7fc78a357e32b046eaf50b9226b93e5347e2538686c7b38e531a617a4ef062bee2d0074c67c6f498db64b5048775961cc5be0bc5cb56b00d4c1b6e8ba5e31634635cdf5aafabcccb476b5b659f1b9591463ae39833b18bac6e0798bf522920252af1fef9598aba2a5322efc0e3a02ada69cb03078810a2440000000711f27561fcaeb49ff57a7c83e91817a5e9e6172109933a4991323d886ae75de329a5335f3c0a520ac13aa6dfe570e05e7e052c095140f00f6aa8db6ef3ceb73	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0C228A21-C580-11EE-9D00-76D8C56D161B} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	notepad.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000a5f0592b759ed2498bfbe1765d630bd97bdb2c13cff58acbeea9fe9ba122ae20000000000e80000000020000200000005e0a96bd8db6be3259200ff3271a4bdef143099da8f6059813915373b16d2b002000000017c0710890809fa70f081e1215b5cbbfa45d0a9489bc31bae6bf5dbb6bda021440000000c9d0ee14118adeae1e33aed350e044e3d0176162756939172741c9371f808eda04e3044c85d4657ca5bbbde42f5f7c4eda8294d9f61d432247301c3944dc7a1b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

pid	Process
2336	rundll32.exe
2184	notepad.exe
2184	notepad.exe
2184	notepad.exe
2184	notepad.exe
2184	notepad.exe
2184	notepad.exe
2476	notepad.exe
2184	notepad.exe
2184	notepad.exe
2184	notepad.exe
2184	notepad.exe
2184	notepad.exe
2184	notepad.exe
2336	rundll32.exe
2336	rundll32.exe
2184	notepad.exe
2184	notepad.exe
2184	notepad.exe
2184	notepad.exe
2184	notepad.exe
2184	notepad.exe
2184	notepad.exe
2184	notepad.exe
2184	notepad.exe
2184	notepad.exe
2184	notepad.exe
2184	notepad.exe
2184	notepad.exe
2184	notepad.exe
2184	notepad.exe
2184	notepad.exe
2184	notepad.exe
2184	notepad.exe
2184	notepad.exe
2184	notepad.exe
2184	notepad.exe
2184	notepad.exe
2184	notepad.exe
2184	notepad.exe
2184	notepad.exe
2184	notepad.exe
2184	notepad.exe
2184	notepad.exe
2184	notepad.exe
2184	notepad.exe
2184	notepad.exe
2184	notepad.exe
2184	notepad.exe
2184	notepad.exe
2184	notepad.exe
2184	notepad.exe
2184	notepad.exe
2184	notepad.exe
2184	notepad.exe
2184	notepad.exe
2184	notepad.exe
2184	notepad.exe
2184	notepad.exe
2184	notepad.exe
2184	notepad.exe
2184	notepad.exe
2184	notepad.exe
2184	notepad.exe

pid	Process
2792	iexplore.exe
2792	iexplore.exe
2792	iexplore.exe
2792	iexplore.exe
2792	iexplore.exe
2792	iexplore.exe
2792	iexplore.exe
2792	iexplore.exe
2792	iexplore.exe
2792	iexplore.exe
2168	ctfmon.exe
2168	ctfmon.exe

description	pid	Process	procid_target
PID 2356 wrote to memory of 2336	2356	rundll32.exe	28
PID 2356 wrote to memory of 2336	2356	rundll32.exe	28
PID 2356 wrote to memory of 2336	2356	rundll32.exe	28
PID 2356 wrote to memory of 2336	2356	rundll32.exe	28
PID 2356 wrote to memory of 2336	2356	rundll32.exe	28
PID 2356 wrote to memory of 2336	2356	rundll32.exe	28
PID 2356 wrote to memory of 2336	2356	rundll32.exe	28
PID 2336 wrote to memory of 1672	2336	rundll32.exe	29
PID 2336 wrote to memory of 1672	2336	rundll32.exe	29
PID 2336 wrote to memory of 1672	2336	rundll32.exe	29
PID 2336 wrote to memory of 1672	2336	rundll32.exe	29
PID 2336 wrote to memory of 2184	2336	rundll32.exe	30
PID 2336 wrote to memory of 2184	2336	rundll32.exe	30
PID 2336 wrote to memory of 2184	2336	rundll32.exe	30
PID 2336 wrote to memory of 2184	2336	rundll32.exe	30
PID 2104 wrote to memory of 2168	2104	explorer.exe	32
PID 2104 wrote to memory of 2168	2104	explorer.exe	32
PID 2104 wrote to memory of 2168	2104	explorer.exe	32
PID 2336 wrote to memory of 2184	2336	rundll32.exe	30
PID 2792 wrote to memory of 2832	2792	iexplore.exe	35
PID 2792 wrote to memory of 2832	2792	iexplore.exe	35
PID 2792 wrote to memory of 2832	2792	iexplore.exe	35
PID 2792 wrote to memory of 2832	2792	iexplore.exe	35
PID 2336 wrote to memory of 2476	2336	rundll32.exe	36
PID 2336 wrote to memory of 2476	2336	rundll32.exe	36
PID 2336 wrote to memory of 2476	2336	rundll32.exe	36
PID 2336 wrote to memory of 2476	2336	rundll32.exe	36
PID 2336 wrote to memory of 2476	2336	rundll32.exe	36
PID 2336 wrote to memory of 2792	2336	rundll32.exe	33

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.