8941778495e850432625fbb56021a1669e3c8a99ac39a6fe588f81e1e2b3a466

Analysis

max time kernel
143s
max time network
135s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
12/02/2024, 12:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9727801374a44ae88ec7d74a74def920.exe
Size

147KB
MD5

9727801374a44ae88ec7d74a74def920
SHA1

b3ec9b122e449618dd687f3aff7f684d5d08883b
SHA256

8941778495e850432625fbb56021a1669e3c8a99ac39a6fe588f81e1e2b3a466
SHA512

9148c8828328c9df962ca237f070a76eaf4bd95dd681646551188edd0b37b546195aaaffa0856279f1b43640014711a87606b5cb0019047cb8c2a1b42cfbbb5d
SSDEEP

3072:sZWPad475RBWESv2QBoQZB3P9AK3RY8BO+xvh:e8aK75RBZQ91j3RY8BD

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 20 IoCs

pid	Process
2280	tel.exe
1996	tel.exe
2580	tel.exe
2532	tel.exe
1100	tel.exe
792	tel.exe
2756	tel.exe
2796	tel.exe
2936	tel.exe
1528	tel.exe
964	tel.exe
1808	tel.exe
1556	tel.exe
752	tel.exe
2512	tel.exe
1600	tel.exe
2696	tel.exe
2976	tel.exe
1372	tel.exe
2704	tel.exe

Loads dropped DLL 27 IoCs

pid	Process
1684	9727801374a44ae88ec7d74a74def920.exe
1684	9727801374a44ae88ec7d74a74def920.exe
2732	notepad.exe
2912	notepad.exe
2912	notepad.exe
2732	notepad.exe
2912	notepad.exe
2732	notepad.exe
608	notepad.exe
608	notepad.exe
2912	notepad.exe
608	notepad.exe
2876	notepad.exe
2876	notepad.exe
2732	notepad.exe
2912	notepad.exe
608	notepad.exe
1524	notepad.exe
2876	notepad.exe
1524	notepad.exe
2732	notepad.exe
2912	notepad.exe
608	notepad.exe
1252	notepad.exe
2876	notepad.exe
1524	notepad.exe
1252	notepad.exe

Adds Run key to start application 2 TTPs 12 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\keylogger = "C:\\Users\\Admin\\AppData\\Roaming\\tel.exe"	9727801374a44ae88ec7d74a74def920.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\keylogger = "C:\\Users\\Admin\\AppData\\Roaming\\tel.exe"	tel.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\keylogger = "C:\\Users\\Admin\\AppData\\Roaming\\tel.exe"	tel.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\keylogger = "C:\\Users\\Admin\\AppData\\Roaming\\tel.exe"	tel.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\keylogger = "C:\\Users\\Admin\\AppData\\Roaming\\tel.exe"	notepad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\keylogger = "C:\\Users\\Admin\\AppData\\Roaming\\tel.exe"	tel.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\keylogger = "C:\\Users\\Admin\\AppData\\Roaming\\tel.exe"	notepad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\keylogger = "C:\\Users\\Admin\\AppData\\Roaming\\tel.exe"	notepad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\keylogger = "C:\\Users\\Admin\\AppData\\Roaming\\tel.exe"	notepad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\keylogger = "C:\\Users\\Admin\\AppData\\Roaming\\tel.exe"	notepad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\keylogger = "C:\\Users\\Admin\\AppData\\Roaming\\tel.exe"	tel.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\keylogger = "C:\\Users\\Admin\\AppData\\Roaming\\tel.exe"	notepad.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10d7023caf5dda01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "413902853"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd76917334189000000000200000000001066000000010000200000007eca0a468e13177325f296ed58210316d4a05a5f429e1165a21b9bb6315d0ffb000000000e80000000020000200000000fc33cf5c2ff3dd3ddce9e06a608cbd3b6661d0bed472e19f334fd3dd11afce220000000c8d1860ce5c947623954ca42c963690dfc5565af84befbdfb31792288a60c2184000000077b6a617091ed2cb8f421beb318c9151b3c7a6ce81123f168b81192125d2f2c0afbbaf32a2745dee3b802e3d78c6861da2b819f8faae6322007839d753255e23	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd769173341890000000002000000000010660000000100002000000022979cbed5c0a30b40a92ec8eece8b3f16ebcfab09e26f8414754131526aa642000000000e80000000020000200000004ab04d2fbccf4cce91ac5dfd4cdcf03ff124bc27c004e1eefb72dd800acd724f9000000034830896e5220849d226b822fa2099fef1fdf9ab050f2b61392d3a2edf7ee8f4ed725aff7f59a5f1a6bfa83e9ecbc7a103fb848d5e2519a784b40fa98c5e8c1280e0d9231957238a24286b5ea4d211319b256d50f508c2867beff2f47d3b79b578e522d5907e5b7ec28128441a325633b1cdacb0a3955b370ec70630395f1856db657e7aa4d420e35db21f8436c472ff40000000122556a163b172cd3ad496d96d44da582b20202e929893ca5ca8d9789165c417a3c5d60fdb5a7b0e15e9f115e826e29a8115e5f89d259120a3efb5efd7940f57	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{66E71FE1-C9A2-11EE-A20D-FA7D6BB1EAA3} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2672	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2672	iexplore.exe
2672	iexplore.exe
1984	IEXPLORE.EXE
1984	IEXPLORE.EXE
1984	IEXPLORE.EXE
1984	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1684 wrote to memory of 2280	1684	9727801374a44ae88ec7d74a74def920.exe	28
PID 1684 wrote to memory of 2280	1684	9727801374a44ae88ec7d74a74def920.exe	28
PID 1684 wrote to memory of 2280	1684	9727801374a44ae88ec7d74a74def920.exe	28
PID 1684 wrote to memory of 2280	1684	9727801374a44ae88ec7d74a74def920.exe	28
PID 1684 wrote to memory of 2012	1684	9727801374a44ae88ec7d74a74def920.exe	29
PID 1684 wrote to memory of 2012	1684	9727801374a44ae88ec7d74a74def920.exe	29
PID 1684 wrote to memory of 2012	1684	9727801374a44ae88ec7d74a74def920.exe	29
PID 1684 wrote to memory of 2012	1684	9727801374a44ae88ec7d74a74def920.exe	29
PID 1684 wrote to memory of 2012	1684	9727801374a44ae88ec7d74a74def920.exe	29
PID 2280 wrote to memory of 2764	2280	tel.exe	30
PID 2280 wrote to memory of 2764	2280	tel.exe	30
PID 2280 wrote to memory of 2764	2280	tel.exe	30
PID 2280 wrote to memory of 2764	2280	tel.exe	30
PID 2280 wrote to memory of 2764	2280	tel.exe	30
PID 1684 wrote to memory of 2732	1684	9727801374a44ae88ec7d74a74def920.exe	31
PID 1684 wrote to memory of 2732	1684	9727801374a44ae88ec7d74a74def920.exe	31
PID 1684 wrote to memory of 2732	1684	9727801374a44ae88ec7d74a74def920.exe	31
PID 1684 wrote to memory of 2732	1684	9727801374a44ae88ec7d74a74def920.exe	31
PID 2280 wrote to memory of 2912	2280	tel.exe	32
PID 2280 wrote to memory of 2912	2280	tel.exe	32
PID 2280 wrote to memory of 2912	2280	tel.exe	32
PID 2280 wrote to memory of 2912	2280	tel.exe	32
PID 1684 wrote to memory of 2732	1684	9727801374a44ae88ec7d74a74def920.exe	31
PID 2280 wrote to memory of 2912	2280	tel.exe	32
PID 2912 wrote to memory of 1996	2912	notepad.exe	33
PID 2912 wrote to memory of 1996	2912	notepad.exe	33
PID 2912 wrote to memory of 1996	2912	notepad.exe	33
PID 2912 wrote to memory of 1996	2912	notepad.exe	33
PID 2732 wrote to memory of 2580	2732	notepad.exe	34
PID 2732 wrote to memory of 2580	2732	notepad.exe	34
PID 2732 wrote to memory of 2580	2732	notepad.exe	34
PID 2732 wrote to memory of 2580	2732	notepad.exe	34
PID 1684 wrote to memory of 2672	1684	9727801374a44ae88ec7d74a74def920.exe	35
PID 1684 wrote to memory of 2672	1684	9727801374a44ae88ec7d74a74def920.exe	35
PID 1684 wrote to memory of 2672	1684	9727801374a44ae88ec7d74a74def920.exe	35
PID 1684 wrote to memory of 2672	1684	9727801374a44ae88ec7d74a74def920.exe	35
PID 2672 wrote to memory of 1984	2672	iexplore.exe	36
PID 2672 wrote to memory of 1984	2672	iexplore.exe	36
PID 2672 wrote to memory of 1984	2672	iexplore.exe	36
PID 2672 wrote to memory of 1984	2672	iexplore.exe	36
PID 2912 wrote to memory of 2532	2912	notepad.exe	38
PID 2912 wrote to memory of 2532	2912	notepad.exe	38
PID 2912 wrote to memory of 2532	2912	notepad.exe	38
PID 2912 wrote to memory of 2532	2912	notepad.exe	38
PID 2732 wrote to memory of 1100	2732	notepad.exe	39
PID 2732 wrote to memory of 1100	2732	notepad.exe	39
PID 2732 wrote to memory of 1100	2732	notepad.exe	39
PID 2732 wrote to memory of 1100	2732	notepad.exe	39
PID 1100 wrote to memory of 904	1100	tel.exe	40
PID 1100 wrote to memory of 904	1100	tel.exe	40
PID 1100 wrote to memory of 904	1100	tel.exe	40
PID 1100 wrote to memory of 904	1100	tel.exe	40
PID 1100 wrote to memory of 904	1100	tel.exe	40
PID 1100 wrote to memory of 608	1100	tel.exe	41
PID 1100 wrote to memory of 608	1100	tel.exe	41
PID 1100 wrote to memory of 608	1100	tel.exe	41
PID 1100 wrote to memory of 608	1100	tel.exe	41
PID 1100 wrote to memory of 608	1100	tel.exe	41
PID 608 wrote to memory of 792	608	notepad.exe	42
PID 608 wrote to memory of 792	608	notepad.exe	42
PID 608 wrote to memory of 792	608	notepad.exe	42
PID 608 wrote to memory of 792	608	notepad.exe	42
PID 2912 wrote to memory of 2756	2912	notepad.exe	45
PID 2912 wrote to memory of 2756	2912	notepad.exe	45

C:\Users\Admin\AppData\Local\Temp\9727801374a44ae88ec7d74a74def920.exe
"C:\Users\Admin\AppData\Local\Temp\9727801374a44ae88ec7d74a74def920.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1684
- C:\Users\Admin\AppData\Roaming\tel.exe
  "C:\Users\Admin\AppData\Roaming\tel.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:2280
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe"
    3⤵
    PID:2764
- - C:\Windows\SysWOW64\notepad.exe
    C:\Windows\system32\notepad.exe
    3⤵
    - Loads dropped DLL
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:2912
  - - C:\Users\Admin\AppData\Roaming\tel.exe
      "C:\Users\Admin\AppData\Roaming\tel.exe"
      4⤵
      Executes dropped EXE
      PID:1996
  - - C:\Users\Admin\AppData\Roaming\tel.exe
      "C:\Users\Admin\AppData\Roaming\tel.exe"
      4⤵
      Executes dropped EXE
      PID:2532
  - - C:\Users\Admin\AppData\Roaming\tel.exe
      "C:\Users\Admin\AppData\Roaming\tel.exe"
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      PID:2756
    - - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        5⤵
        
        PID:2740
    - - C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\system32\notepad.exe
        5⤵
        Loads dropped DLL
        Adds Run key to start application
        
        PID:2876
      - C:\Users\Admin\AppData\Roaming\tel.exe
        
        "C:\Users\Admin\AppData\Roaming\tel.exe"
        6⤵
        Executes dropped EXE
        
        PID:2936
      - C:\Users\Admin\AppData\Roaming\tel.exe
        
        "C:\Users\Admin\AppData\Roaming\tel.exe"
        6⤵
        Executes dropped EXE
        
        PID:1556
      - C:\Users\Admin\AppData\Roaming\tel.exe
        
        "C:\Users\Admin\AppData\Roaming\tel.exe"
        6⤵
        Executes dropped EXE
        
        PID:2976
  - - C:\Users\Admin\AppData\Roaming\tel.exe
      "C:\Users\Admin\AppData\Roaming\tel.exe"
      4⤵
      Executes dropped EXE
      PID:964
  - - C:\Users\Admin\AppData\Roaming\tel.exe
      "C:\Users\Admin\AppData\Roaming\tel.exe"
      4⤵
      Executes dropped EXE
      PID:1600
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe"
  2⤵
  PID:2012
- C:\Windows\SysWOW64\notepad.exe
  C:\Windows\system32\notepad.exe
  2⤵
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:2732
- - C:\Users\Admin\AppData\Roaming\tel.exe
    "C:\Users\Admin\AppData\Roaming\tel.exe"
    3⤵
    - Executes dropped EXE
    PID:2580
- - C:\Users\Admin\AppData\Roaming\tel.exe
    "C:\Users\Admin\AppData\Roaming\tel.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:1100
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe"
      4⤵
      PID:904
  - - C:\Windows\SysWOW64\notepad.exe
      C:\Windows\system32\notepad.exe
      4⤵
      Loads dropped DLL
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:608
    - - C:\Users\Admin\AppData\Roaming\tel.exe
        
        "C:\Users\Admin\AppData\Roaming\tel.exe"
        5⤵
        Executes dropped EXE
        
        PID:792
    - - C:\Users\Admin\AppData\Roaming\tel.exe
        
        "C:\Users\Admin\AppData\Roaming\tel.exe"
        5⤵
        Executes dropped EXE
        
        PID:2796
    - - C:\Users\Admin\AppData\Roaming\tel.exe
        
        "C:\Users\Admin\AppData\Roaming\tel.exe"
        5⤵
        Executes dropped EXE
        
        PID:1808
    - - C:\Users\Admin\AppData\Roaming\tel.exe
        
        "C:\Users\Admin\AppData\Roaming\tel.exe"
        5⤵
        Executes dropped EXE
        
        PID:2696
- - C:\Users\Admin\AppData\Roaming\tel.exe
    "C:\Users\Admin\AppData\Roaming\tel.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    PID:1528
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe"
      4⤵
      PID:1580
  - - C:\Windows\SysWOW64\notepad.exe
      C:\Windows\system32\notepad.exe
      4⤵
      Loads dropped DLL
      Adds Run key to start application
      PID:1524
    - - C:\Users\Admin\AppData\Roaming\tel.exe
        
        "C:\Users\Admin\AppData\Roaming\tel.exe"
        5⤵
        Executes dropped EXE
        
        PID:752
    - - C:\Users\Admin\AppData\Roaming\tel.exe
        
        "C:\Users\Admin\AppData\Roaming\tel.exe"
        5⤵
        Executes dropped EXE
        
        PID:1372
- - C:\Users\Admin\AppData\Roaming\tel.exe
    "C:\Users\Admin\AppData\Roaming\tel.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    PID:2512
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe"
      4⤵
      PID:1884
  - - C:\Windows\SysWOW64\notepad.exe
      C:\Windows\system32\notepad.exe
      4⤵
      Loads dropped DLL
      Adds Run key to start application
      PID:1252
    - - C:\Users\Admin\AppData\Roaming\tel.exe
        
        "C:\Users\Admin\AppData\Roaming\tel.exe"
        5⤵
        Executes dropped EXE
        
        PID:2704
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://tarjetasnico.com/xx_es/aw/1xxna121.php
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2672
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2672 CREDAT:275457 /prefetch:2
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:1984

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
40b31ec1b8713bf0f9eeb232717218bb

SHA1
3920c9e82bbb325b081f6035449720f83b61ff23

SHA256
57c2d57eb700f1e7cb5de7149ea516cf0953f46572e63a480b230550ffceaabc

SHA512
b757982c1cb83bfd9983d1fc0314e9892da1ef973a0ecfb20c01b23ad8fb0f1cf641b08697cfec302ca0817536c7c91fec5d04704c095f671e32ca306172ebf1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2773f03efc48853317ad01560cdfecb1

SHA1
2f3ccbc54d37475d9de38d1a221fa8e6735aae84

SHA256
0e25d38ef84450f8ed701767c2f333b1b62be0a6248cea29a7b9b057e804409d

SHA512
5f55a50506502f2e0e222f083a5002b56af99454fa3ac8b55c7991d209b38edd848683a29768c7f79687b703149800c5941aa6079df857d432da16ca08e7272e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5e15c126be474183b325fba7656b3a24

SHA1
4b92ffb869cde592e00a2297e81d78389dc8523a

SHA256
9ffa3aa90a00517e2757479dbe243d3cf852d95aedb498d31fd87c05674f2dd7

SHA512
e41db13cf16ef42cac1e7af74305ed1a030bd06520ae89784a8d889cb08cd5837b5c1d15c48ceb3ca87948083fadc14d8e761f4ace64b55e0c15850089eb754a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
32a13ed8dfa81af281d07340802fba46

SHA1
4c8e99db3096005b5231817b92c31c54337c383b

SHA256
0b0297ca75a8e5af80cb757a4b3897bc87830af6160c1a6755518b1bfcb26114

SHA512
8da3e6800ccdf6dcb9e83feaa5bbf196cae0eee6c54e21f24147d02cae050c200f50c1962522086aa3f77276646aff836afa3c0673666d60742b1f5f945c4e2b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2e11ae7c9413e0b5bf39209e295cfc27

SHA1
cf046601a642452ac4fa6dbbd7ba1996dbedbfb5

SHA256
a093720166ac62793e59887257d1152f014032d3fc86f8b91558d9941bee0f3e

SHA512
497b4e440a7b0584acf7e02d640dc070db2af4819998ebd5d5cbdc337806cb6409e457f6547506111848c5c9a78735060c2b2b0c72be489e4482208430fddc4b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dfaa44d2d1baf5c5c372aca0d8d25768

SHA1
74b7bc99cdec7c1707dceb87216f4d73e8f53dfc

SHA256
cfd874aaade44a976b29a9de49fd0bf62204f82ca7a0e12b336c680257477223

SHA512
c972cc43dbff9ea0878b3f09458224620f07fcb029848a591cda128e047ad91aadc0481fcb846648b156526b475deb43fe8fe7022808d65fb8e1002bd00c65e0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b3135f17a9fef85e7aef032ded6a1219

SHA1
a46658b0c4e4d38c32dc6aa0e2377812ae020591

SHA256
c8596f7549c5cf63ad8f709dd6c8758971b49d0aac10d8f68271cac9ec39d3e1

SHA512
fea103f1b9643db9e3d2d5387688e2783a89de0eb1a87895a0331eba41b1b1b772ab98dcea7557567a9cd0b3b02cc8b8dc63e77b7d089e8c53bdbda9cd9f99f9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c307a32438ea19f7d55b268826490a25

SHA1
8d419b0330a8da1e8e576a9a616c5367acdaa0fa

SHA256
3ba2d897bfea182a8b9c994cc3fcd84e13c75c50c2cee0350634a0e822a9b286

SHA512
427f33a211739661b41f50ec2c887bfecb2ef3748d8a77c02f2ce07ec680433f81d7922427208aca2ed24ca2d73c1e3685a3bedbd6b79d2087f642db6b5302e6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ff45d21a5da2dfc58a7dca6e02c4e9f9

SHA1
54f3779f7daedfe68f3e30f68f51fa0cbd80664f

SHA256
4cf03e8b2779fa25785155f413d5a80431f976354858f6782351160552360240

SHA512
8c6015343498ee9fdb7e20e94638e773d4a4cc0b1aa3e5da85b3187398a47c1674536f4f56e6bb991337aca60591df2c26717d41de1b55e0ce687dfdf01004e6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9a63f7681efc34276cb130be121b8326

SHA1
15fec219396779be5cacfc60fca23b28e2d1bd83

SHA256
bd7964f52e96e6a6fa22aebef27b515e77966fc4c2adb108ca8024af731994ce

SHA512
07bd4a534a2586a65c75e7c4e18879797cc7752d638a06d5705283bab8f816b8d887c1823cf3164867245d5d6b000e44897ac4d7f09ea3f4b3f63651e6485808

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9be50bda76e83df92f41e5c1f1a33bd2

SHA1
95ab6baf627786f69dc43644321b6235534842fc

SHA256
1db574766ca7bac81c814c83cbef534bc24418f3f7a744a1b32e8fb581c79000

SHA512
f2d7524a9d9428327f2efe552c2015f3d81d7f6e703677f05652dd4d63caa76f84618ad37b616925f80df249cf577b99315f781b2e4db638e30a72d257284369

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5fa6423d697a4e23662bb2311f563d08

SHA1
f1069815a8a739ee1ef7c4b68d9c1e7878e64fa3

SHA256
2eee75a1b707752d924a3b1fe3112069bd90c7e26c1a629b19de8e941ef5430b

SHA512
da39a63a1f228a40deb57ccb9b809c41bd52f7e76389d2f68150cf7e94b6bb4a211db85313680b2b9378f93dc7e3bede2cf50c77f5a03a30fce88f22c08cae09

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
284bcba10632973a7773ce4e5cf545c5

SHA1
94e9cc1f548d904c7f94ccf4fe3991d8f3b076b5

SHA256
293533268903b6853d4b7b0d5e8e592bdd329f9b5a8a3bf08b8291e1d1504983

SHA512
6e094d7440863e7e230fc458623e8e1b90ef002e8df7017a494b8c110e8c6464af1f288d230aae0aa2cb017a651c9f733ec63a2e7b506834ca21e7bfc298960b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e1e6091bf50b7cff8f82b7ac7a7c7469

SHA1
54c3066456a5d0d2946749ef8b3daf78569fe0f6

SHA256
382837ac8f9c4c5678e180ebf9b20dcbcd599f9363e47012a3a0e8511db6cf52

SHA512
598a5ca8e4920004b7a308d9604ef9d3d8bc279b8bcb9190062c9628efc98afa644d0a5895d2edcdfb8200f1d36f4fa1e8876ee19e6d6d4ddbd9518a2d5e5f02

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d5ea28354c0828b62e4f0883016fb819

SHA1
52718db613de7162a8f204940ee4300d98a168eb

SHA256
5adfea3a5655155fd47f21d8e50badafa79a1a460bc5f5a532e28516d608bff9

SHA512
4d5fbff893d27c42859306b1f7996972e4d86e559a5f7f7242a0d04a3608fe2fb1058acd936ef7f555005944d28eb984a5c4df6ec05d9ee1b06e5eb60b1462ca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
884ff60cc89ce256a7a2c47f8e4535d1

SHA1
7481ba8a9a82f9245efa3012352ee38ddbcf8d2b

SHA256
d97f8814dfb86596931f7b4bb4b2cbc0537a9f6f67b588b4014bf32e329b8081

SHA512
12659b6eca467c8cc3d5e481721a4e19abeb6f337c1e7ed5d6fd493c2af24f73b77653a80f218abf01b8e66a8c4035a0aaa90f0d4d7af655648d1bc93d0a5137

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e3572a8a75b47b79d44ba60ef88ca73f

SHA1
991ba52f44836a70f4a2840204da1bf6d7480a07

SHA256
0c7e0a8e092611793649de19d4152152e169f51eb47b2240054c44607f28e64d

SHA512
eb30120485869343a077dd22ea0633fb07590f835ae5a4ae44c074c88da0601f728b72af03e33ad84eb50569afbc3ab97b2eaf9b27bc885d73341b0ac7a9936b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6c3987246d70c958f8f04abdd651ae98

SHA1
c6f99433346e83657b8ba3ad8d0d33580feffbf1

SHA256
34f19f3efa4dcd58d14631436d0d5128cf4508b7d07ce4c3685f45ff35cbdb1a

SHA512
f27b98a741762cde7c68c2c151cbb2e32d579985500d57c69370a2f6bc945730581125f2890b42cf596cc727351f5af4c8aa68e94fa8094e2eb25cac2658e350

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5E87.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5EF8.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
C:\Users\Admin\AppData\Roaming\klg1.dll

Filesize
84KB

MD5
f3950a1fc9ce1ffa55cbd8a92edb72f8

SHA1
1b48ddca9c67176edc8f5207e05b7970d47f1edb

SHA256
0423040b2bc30ac8579ff52a3b874866c3ab4e033ca785dbd565a88f02edb80a

SHA512
cd62786f0f860ecb2bcb6825855f1704eaf4833e16941cda8b585349afec4680960a9f5f92528bf93ba764ed587e246fe48461eeb75657eec1a9e05c401e69cb

Download Submit
C:\Users\Admin\AppData\Roaming\tel.exe

Filesize
147KB

MD5
9727801374a44ae88ec7d74a74def920

SHA1
b3ec9b122e449618dd687f3aff7f684d5d08883b

SHA256
8941778495e850432625fbb56021a1669e3c8a99ac39a6fe588f81e1e2b3a466

SHA512
9148c8828328c9df962ca237f070a76eaf4bd95dd681646551188edd0b37b546195aaaffa0856279f1b43640014711a87606b5cb0019047cb8c2a1b42cfbbb5d

Download Submit
C:\Users\Admin\AppData\Roaming\xoong3.dll

Filesize
17KB

MD5
9c02327abcd5ffa0ed311f1db3834176

SHA1
8d041c0cfff919c5756f849b462bace99ddb13c1

SHA256
5db1f76267dc6a5bfb762de4a41eb3b17e8f91649120776ad2b910caafa25e7d

SHA512
f1d6501168929b1742c4c098712e184133d9a23136cbdbf234504add6af19e3cb46aba8133e491f15b9a5992d7dc582e34b82eeb5b4b54689ec9da8ca9528c60

Download Submit
memory/608-489-0x00000000000A0000-0x00000000000AA000-memory.dmp

Filesize
40KB

Download
memory/752-972-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/792-485-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/964-960-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1100-488-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1100-490-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1524-978-0x0000000000190000-0x000000000019A000-memory.dmp

Filesize
40KB

Download
memory/1528-975-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1556-971-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1684-324-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1684-311-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1808-970-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1996-25-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2280-327-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2280-315-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2532-480-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2580-26-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2732-15-0x00000000000C0000-0x00000000000C1000-memory.dmp

Filesize
4KB

Download
memory/2732-322-0x00000000000E0000-0x00000000000EA000-memory.dmp

Filesize
40KB

Download
memory/2756-944-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2756-946-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2796-507-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2876-945-0x0000000000110000-0x000000000011A000-memory.dmp

Filesize
40KB

Download
memory/2912-323-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2912-986-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2936-508-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads