Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
14/02/2024, 03:43
Static task
static1
Behavioral task
behavioral1
Sample
9aab74021fae67b0ec355bbc9138b1c4.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
9aab74021fae67b0ec355bbc9138b1c4.exe
Resource
win10v2004-20231215-en
General
-
Target
setup_installer.exe
-
Size
4.6MB
-
MD5
0182d7dcdb4e1d8c87ef13ccca528b16
-
SHA1
f0f3d321a0829992d81bba5460abad5c555439cd
-
SHA256
1f4d8c3b8625c3506e6907a4e50e2f43cd851cbde208af218e50a9994b35388b
-
SHA512
f21c3d8792e805ef3aceaf294385c383e0db4964d36a51654f82b97a448349631a1b829e9602ca78e60caa89311d85a7b569636766521c9f2de167e28860beb9
-
SSDEEP
98304:x4CvLUBsg2sNW92XS1SgEjpAqU5m7WNHCBqW0N010hh8O7ayZsJc:xlLUCg1U8S1SLjpB6Fmd0kqh8oR
Malware Config
Extracted
nullmixer
http://watira.xyz/
Extracted
socelars
http://www.iyiqian.com/
http://www.xxhufdc.top/
http://www.uefhkice.xyz/
http://www.fcektsy.top/
Extracted
smokeloader
pub5
Extracted
vidar
39.9
706
https://prophefliloc.tumblr.com/
-
profile_id
706
Extracted
smokeloader
2020
http://aucmoney.com/upload/
http://thegymmum.com/upload/
http://atvcampingtrips.com/upload/
http://kuapakualaman.com/upload/
http://renatazarazua.com/upload/
http://nasufmutlu.com/upload/
Signatures
-
PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Socelars payload 6 IoCs
resource yara_rule behavioral4/files/0x000600000002322a-14.dat family_socelars behavioral4/files/0x000600000002322a-17.dat family_socelars behavioral4/files/0x000600000002322a-18.dat family_socelars behavioral4/files/0x000900000001e583-85.dat family_socelars behavioral4/files/0x000900000001e583-80.dat family_socelars behavioral4/memory/3924-167-0x0000000000400000-0x0000000000BD8000-memory.dmp family_socelars -
Vidar Stealer 2 IoCs
resource yara_rule behavioral4/memory/4004-151-0x0000000000400000-0x0000000002CC9000-memory.dmp family_vidar behavioral4/memory/4004-162-0x0000000004910000-0x00000000049AD000-memory.dmp family_vidar -
resource yara_rule behavioral4/files/0x0006000000023225-22.dat aspack_v212_v242 behavioral4/files/0x0006000000023226-20.dat aspack_v212_v242 behavioral4/files/0x0006000000023228-30.dat aspack_v212_v242 -
Checks computer location settings 2 TTPs 4 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\Control Panel\International\Geo\Nation setup_installer.exe Key value queried \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\Control Panel\International\Geo\Nation 08240101651be7e010.exe Key value queried \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\Control Panel\International\Geo\Nation 1710990cbc64.exe Key value queried \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\Control Panel\International\Geo\Nation BUILD1~1.EXE -
Executes dropped EXE 17 IoCs
pid Process 3924 setup_install.exe 5040 53516815d3135fe3.exe 4240 08240101651be7e1.exe 3228 1710990cbc64.exe 4700 08240101651be7e010.exe 4528 9aa6e16872.exe 4584 4f5baa1083db067.exe 4936 1cr.exe 1312 c862a054a35.exe 4008 453c5fa76a849.exe 4004 e4b2f18fb52218.exe 3440 f34b9ab9db6d16.exe 1964 1710990cbc64.exe 4076 chrome2.exe 4876 setup.exe 1672 winnetdriv.exe 1540 BUILD1~1.EXE -
Loads dropped DLL 6 IoCs
pid Process 3924 setup_install.exe 3924 setup_install.exe 3924 setup_install.exe 3924 setup_install.exe 3924 setup_install.exe 3924 setup_install.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 08240101651be7e1.exe -
Drops Chrome extension 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\kjkfjbddnkpfcflenfcleijhgaaiapaf\8.66.88_0\manifest.json 9aa6e16872.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs
flow ioc 33 iplogger.org 36 iplogger.org 61 iplogger.org 32 iplogger.org -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 17 ipinfo.io 18 ipinfo.io -
Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.
-
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\winnetdriv.exe setup.exe File opened for modification C:\Windows\winnetdriv.exe setup.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 2 IoCs
pid pid_target Process procid_target 2660 3924 WerFault.exe 87 2660 4008 WerFault.exe 103 -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 453c5fa76a849.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 453c5fa76a849.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 453c5fa76a849.exe -
Kills process with taskkill 1 IoCs
pid Process 1784 taskkill.exe -
Modifies data under HKEY_USERS 8 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\ExternalFeatureOverrides\officeclicktorun OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\FirstSession\officeclicktorun OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentEcs\Overrides OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentEcs\officeclicktorun\Overrides OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentEcs\all\Overrides OfficeClickToRun.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4008 453c5fa76a849.exe 4008 453c5fa76a849.exe 3364 Process not Found 3364 Process not Found 3364 Process not Found 3364 Process not Found 3364 Process not Found 3364 Process not Found 3364 Process not Found 3364 Process not Found 3364 Process not Found 3364 Process not Found 3364 Process not Found 3364 Process not Found 3364 Process not Found 3364 Process not Found 3364 Process not Found 3364 Process not Found 3364 Process not Found 3364 Process not Found 3364 Process not Found 3364 Process not Found 3364 Process not Found 3364 Process not Found 3364 Process not Found 3364 Process not Found 3364 Process not Found 3364 Process not Found 3364 Process not Found 3364 Process not Found 3364 Process not Found 3364 Process not Found 3364 Process not Found 3364 Process not Found 3364 Process not Found 3364 Process not Found 3364 Process not Found 3364 Process not Found 3364 Process not Found 3364 Process not Found 3364 Process not Found 3364 Process not Found 3364 Process not Found 3364 Process not Found 3364 Process not Found 3364 Process not Found 3364 Process not Found 3364 Process not Found 3364 Process not Found 3364 Process not Found 3364 Process not Found 3364 Process not Found 3364 Process not Found 3364 Process not Found 3364 Process not Found 3364 Process not Found 3364 Process not Found 3364 Process not Found 3364 Process not Found 3364 Process not Found 3364 Process not Found 3364 Process not Found 3364 Process not Found 3364 Process not Found -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 4008 453c5fa76a849.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeCreateTokenPrivilege 4528 9aa6e16872.exe Token: SeAssignPrimaryTokenPrivilege 4528 9aa6e16872.exe Token: SeLockMemoryPrivilege 4528 9aa6e16872.exe Token: SeIncreaseQuotaPrivilege 4528 9aa6e16872.exe Token: SeMachineAccountPrivilege 4528 9aa6e16872.exe Token: SeTcbPrivilege 4528 9aa6e16872.exe Token: SeSecurityPrivilege 4528 9aa6e16872.exe Token: SeTakeOwnershipPrivilege 4528 9aa6e16872.exe Token: SeLoadDriverPrivilege 4528 9aa6e16872.exe Token: SeSystemProfilePrivilege 4528 9aa6e16872.exe Token: SeSystemtimePrivilege 4528 9aa6e16872.exe Token: SeProfSingleProcessPrivilege 4528 9aa6e16872.exe Token: SeIncBasePriorityPrivilege 4528 9aa6e16872.exe Token: SeCreatePagefilePrivilege 4528 9aa6e16872.exe Token: SeCreatePermanentPrivilege 4528 9aa6e16872.exe Token: SeBackupPrivilege 4528 9aa6e16872.exe Token: SeRestorePrivilege 4528 9aa6e16872.exe Token: SeShutdownPrivilege 4528 9aa6e16872.exe Token: SeDebugPrivilege 4528 9aa6e16872.exe Token: SeAuditPrivilege 4528 9aa6e16872.exe Token: SeSystemEnvironmentPrivilege 4528 9aa6e16872.exe Token: SeChangeNotifyPrivilege 4528 9aa6e16872.exe Token: SeRemoteShutdownPrivilege 4528 9aa6e16872.exe Token: SeUndockPrivilege 4528 9aa6e16872.exe Token: SeSyncAgentPrivilege 4528 9aa6e16872.exe Token: SeEnableDelegationPrivilege 4528 9aa6e16872.exe Token: SeManageVolumePrivilege 4528 9aa6e16872.exe Token: SeImpersonatePrivilege 4528 9aa6e16872.exe Token: SeCreateGlobalPrivilege 4528 9aa6e16872.exe Token: 31 4528 9aa6e16872.exe Token: 32 4528 9aa6e16872.exe Token: 33 4528 9aa6e16872.exe Token: 34 4528 9aa6e16872.exe Token: 35 4528 9aa6e16872.exe Token: SeDebugPrivilege 4584 4f5baa1083db067.exe Token: SeDebugPrivilege 1312 c862a054a35.exe Token: SeDebugPrivilege 1784 taskkill.exe Token: SeShutdownPrivilege 3364 Process not Found Token: SeCreatePagefilePrivilege 3364 Process not Found Token: SeShutdownPrivilege 3364 Process not Found Token: SeCreatePagefilePrivilege 3364 Process not Found Token: SeShutdownPrivilege 3364 Process not Found Token: SeCreatePagefilePrivilege 3364 Process not Found Token: SeShutdownPrivilege 3364 Process not Found Token: SeCreatePagefilePrivilege 3364 Process not Found Token: SeShutdownPrivilege 3364 Process not Found Token: SeCreatePagefilePrivilege 3364 Process not Found Token: SeShutdownPrivilege 3364 Process not Found Token: SeCreatePagefilePrivilege 3364 Process not Found Token: SeShutdownPrivilege 3364 Process not Found Token: SeCreatePagefilePrivilege 3364 Process not Found Token: SeShutdownPrivilege 3364 Process not Found Token: SeCreatePagefilePrivilege 3364 Process not Found Token: SeShutdownPrivilege 3364 Process not Found Token: SeCreatePagefilePrivilege 3364 Process not Found Token: SeShutdownPrivilege 3364 Process not Found Token: SeCreatePagefilePrivilege 3364 Process not Found Token: SeShutdownPrivilege 3364 Process not Found Token: SeCreatePagefilePrivilege 3364 Process not Found Token: SeShutdownPrivilege 3364 Process not Found Token: SeCreatePagefilePrivilege 3364 Process not Found Token: SeShutdownPrivilege 3364 Process not Found Token: SeCreatePagefilePrivilege 3364 Process not Found Token: SeShutdownPrivilege 3364 Process not Found -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3364 Process not Found -
Suspicious use of SendNotifyMessage 2 IoCs
pid Process 3364 Process not Found 3364 Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4224 wrote to memory of 3924 4224 setup_installer.exe 87 PID 4224 wrote to memory of 3924 4224 setup_installer.exe 87 PID 4224 wrote to memory of 3924 4224 setup_installer.exe 87 PID 3924 wrote to memory of 2208 3924 setup_install.exe 90 PID 3924 wrote to memory of 2208 3924 setup_install.exe 90 PID 3924 wrote to memory of 2208 3924 setup_install.exe 90 PID 3924 wrote to memory of 3848 3924 setup_install.exe 99 PID 3924 wrote to memory of 3848 3924 setup_install.exe 99 PID 3924 wrote to memory of 3848 3924 setup_install.exe 99 PID 3924 wrote to memory of 2904 3924 setup_install.exe 98 PID 3924 wrote to memory of 2904 3924 setup_install.exe 98 PID 3924 wrote to memory of 2904 3924 setup_install.exe 98 PID 3924 wrote to memory of 704 3924 setup_install.exe 91 PID 3924 wrote to memory of 704 3924 setup_install.exe 91 PID 3924 wrote to memory of 704 3924 setup_install.exe 91 PID 3924 wrote to memory of 3628 3924 setup_install.exe 97 PID 3924 wrote to memory of 3628 3924 setup_install.exe 97 PID 3924 wrote to memory of 3628 3924 setup_install.exe 97 PID 3924 wrote to memory of 4600 3924 setup_install.exe 96 PID 3924 wrote to memory of 4600 3924 setup_install.exe 96 PID 3924 wrote to memory of 4600 3924 setup_install.exe 96 PID 3924 wrote to memory of 2000 3924 setup_install.exe 95 PID 3924 wrote to memory of 2000 3924 setup_install.exe 95 PID 3924 wrote to memory of 2000 3924 setup_install.exe 95 PID 3924 wrote to memory of 1960 3924 setup_install.exe 94 PID 3924 wrote to memory of 1960 3924 setup_install.exe 94 PID 3924 wrote to memory of 1960 3924 setup_install.exe 94 PID 3924 wrote to memory of 1504 3924 setup_install.exe 93 PID 3924 wrote to memory of 1504 3924 setup_install.exe 93 PID 3924 wrote to memory of 1504 3924 setup_install.exe 93 PID 3924 wrote to memory of 1296 3924 setup_install.exe 92 PID 3924 wrote to memory of 1296 3924 setup_install.exe 92 PID 3924 wrote to memory of 1296 3924 setup_install.exe 92 PID 704 wrote to memory of 5040 704 cmd.exe 112 PID 704 wrote to memory of 5040 704 cmd.exe 112 PID 2208 wrote to memory of 4240 2208 cmd.exe 111 PID 2208 wrote to memory of 4240 2208 cmd.exe 111 PID 1296 wrote to memory of 4700 1296 cmd.exe 109 PID 1296 wrote to memory of 4700 1296 cmd.exe 109 PID 1296 wrote to memory of 4700 1296 cmd.exe 109 PID 3848 wrote to memory of 4528 3848 cmd.exe 100 PID 3848 wrote to memory of 4528 3848 cmd.exe 100 PID 3848 wrote to memory of 4528 3848 cmd.exe 100 PID 2904 wrote to memory of 3228 2904 cmd.exe 110 PID 2904 wrote to memory of 3228 2904 cmd.exe 110 PID 2904 wrote to memory of 3228 2904 cmd.exe 110 PID 4600 wrote to memory of 4584 4600 cmd.exe 101 PID 4600 wrote to memory of 4584 4600 cmd.exe 101 PID 4240 wrote to memory of 4936 4240 08240101651be7e1.exe 107 PID 4240 wrote to memory of 4936 4240 08240101651be7e1.exe 107 PID 4240 wrote to memory of 4936 4240 08240101651be7e1.exe 107 PID 3628 wrote to memory of 1312 3628 cmd.exe 102 PID 3628 wrote to memory of 1312 3628 cmd.exe 102 PID 1504 wrote to memory of 4008 1504 cmd.exe 103 PID 1504 wrote to memory of 4008 1504 cmd.exe 103 PID 1504 wrote to memory of 4008 1504 cmd.exe 103 PID 1960 wrote to memory of 4004 1960 cmd.exe 106 PID 1960 wrote to memory of 4004 1960 cmd.exe 106 PID 1960 wrote to memory of 4004 1960 cmd.exe 106 PID 2000 wrote to memory of 3440 2000 cmd.exe 105 PID 2000 wrote to memory of 3440 2000 cmd.exe 105 PID 2000 wrote to memory of 3440 2000 cmd.exe 105 PID 4700 wrote to memory of 4076 4700 08240101651be7e010.exe 114 PID 4700 wrote to memory of 4076 4700 08240101651be7e010.exe 114 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4224 -
C:\Users\Admin\AppData\Local\Temp\7zS080ED067\setup_install.exe"C:\Users\Admin\AppData\Local\Temp\7zS080ED067\setup_install.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3924 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c 08240101651be7e1.exe3⤵
- Suspicious use of WriteProcessMemory
PID:2208 -
C:\Users\Admin\AppData\Local\Temp\7zS080ED067\08240101651be7e1.exe08240101651be7e1.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4240 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\BUILD1~1.EXEC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\BUILD1~1.EXE5⤵
- Checks computer location settings
- Executes dropped EXE
PID:1540 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7zS1A0B.tmp\Install.cmd" "6⤵PID:3388
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c 53516815d3135fe3.exe3⤵
- Suspicious use of WriteProcessMemory
PID:704 -
C:\Users\Admin\AppData\Local\Temp\7zS080ED067\53516815d3135fe3.exe53516815d3135fe3.exe4⤵
- Executes dropped EXE
PID:5040
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c 08240101651be7e010.exe3⤵
- Suspicious use of WriteProcessMemory
PID:1296 -
C:\Users\Admin\AppData\Local\Temp\7zS080ED067\08240101651be7e010.exe08240101651be7e010.exe4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4700 -
C:\Users\Admin\AppData\Local\Temp\chrome2.exe"C:\Users\Admin\AppData\Local\Temp\chrome2.exe"5⤵
- Executes dropped EXE
PID:4076
-
-
C:\Users\Admin\AppData\Local\Temp\setup.exe"C:\Users\Admin\AppData\Local\Temp\setup.exe"5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4876 -
C:\Windows\winnetdriv.exe"C:\Users\Admin\AppData\Local\Temp\setup.exe" 1707882197 06⤵
- Executes dropped EXE
PID:1672
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c 453c5fa76a849.exe3⤵
- Suspicious use of WriteProcessMemory
PID:1504 -
C:\Users\Admin\AppData\Local\Temp\7zS080ED067\453c5fa76a849.exe453c5fa76a849.exe4⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:4008 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4008 -s 3765⤵
- Program crash
PID:2660
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c e4b2f18fb52218.exe3⤵
- Suspicious use of WriteProcessMemory
PID:1960 -
C:\Users\Admin\AppData\Local\Temp\7zS080ED067\e4b2f18fb52218.exee4b2f18fb52218.exe4⤵
- Executes dropped EXE
PID:4004
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c f34b9ab9db6d16.exe3⤵
- Suspicious use of WriteProcessMemory
PID:2000 -
C:\Users\Admin\AppData\Local\Temp\7zS080ED067\f34b9ab9db6d16.exef34b9ab9db6d16.exe4⤵
- Executes dropped EXE
PID:3440
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c 4f5baa1083db067.exe3⤵
- Suspicious use of WriteProcessMemory
PID:4600 -
C:\Users\Admin\AppData\Local\Temp\7zS080ED067\4f5baa1083db067.exe4f5baa1083db067.exe4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4584
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c c862a054a35.exe3⤵
- Suspicious use of WriteProcessMemory
PID:3628 -
C:\Users\Admin\AppData\Local\Temp\7zS080ED067\c862a054a35.exec862a054a35.exe4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1312
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c 1710990cbc64.exe3⤵
- Suspicious use of WriteProcessMemory
PID:2904 -
C:\Users\Admin\AppData\Local\Temp\7zS080ED067\1710990cbc64.exe1710990cbc64.exe4⤵
- Checks computer location settings
- Executes dropped EXE
PID:3228 -
C:\Users\Admin\AppData\Local\Temp\7zS080ED067\1710990cbc64.exe"C:\Users\Admin\AppData\Local\Temp\7zS080ED067\1710990cbc64.exe" -a5⤵
- Executes dropped EXE
PID:1964
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c 9aa6e16872.exe3⤵
- Suspicious use of WriteProcessMemory
PID:3848 -
C:\Users\Admin\AppData\Local\Temp\7zS080ED067\9aa6e16872.exe9aa6e16872.exe4⤵
- Executes dropped EXE
- Drops Chrome extension
- Suspicious use of AdjustPrivilegeToken
PID:4528 -
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe5⤵PID:3760
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe6⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1784
-
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3924 -s 5083⤵
- Program crash
PID:2660
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3924 -ip 39241⤵PID:2088
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1cr.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1cr.exe1⤵
- Executes dropped EXE
PID:4936
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4008 -ip 40081⤵PID:1412
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service1⤵
- Modifies data under HKEY_USERS
PID:4984
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
768KB
MD5cff92412354020e28b44e0b867a39a5c
SHA15971ea0233be5ac2d99bb1ef061e06118324e417
SHA2562be6913f0a9229344936ba36a1e6d64d4691976a96bea0272cd6ef51c3f25322
SHA5124d231b8b8f41b9e959bf6197479f47c0c3ed3b078af262f840302e633304283d687bd32367e8ef5f3616ced9cd5481a6361477fab93e061ded30f397da529ac9
-
Filesize
896KB
MD5741a8aa1965a8c78fc56b6c2e7dd2cc2
SHA1419696902f33418362d83ffa716947e50e67ed58
SHA2560900ab067bdcc240bcf1df8bae7d6e2d9fb6f81ad48fb08b151d70e0049b5842
SHA512dd78d177e6eb5ee3f45c05f9906bfe78c403ca7db79896153fb942acc38470b91764c31354c2ebc2db9ab8852a4ec1733501bdadffd008d711da1556cab8bc2a
-
Filesize
896KB
MD5498b530b8f8fdeed68acc96892eec554
SHA139d644a45695bf54f8d648d6e5b9facd1ff22757
SHA256a0249920cfd1785233bfe75d16f23aab99b72ea3656b540d9b9071c1b5a54c7e
SHA512fbb91036fdc44edd71f7b3ccaf670aaa6641470a72327871b1d099e288de00918ec79ba9d62d2acc3e8d11beada48702263936726135a404c87c09aee8c95795
-
Filesize
768KB
MD52ce3fc5d3ffbbee2e4d1e570682d2df2
SHA16bbc120dc9e09a5d3df5d26e53193dc8aec22cc9
SHA2563fe656e05e83146f15ac6eb191de86ea10e387cb081549ec1c9a18149e2881dc
SHA512a95ab43b43ac3b3762bc776f9bf3194bc93f5b9357a42ed4c18b3b5a39fc18123a3932e523ba7870fb24051b0b570bce8b4cfcbc56a90a86054e11df2b50cbdb
-
Filesize
56KB
MD5c0d18a829910babf695b4fdaea21a047
SHA1236a19746fe1a1063ebe077c8a0553566f92ef0f
SHA25678958d664b1c140f2b45e56c4706108eeb5f14756977e2efd3409f8a788d3c98
SHA512cca06a032d8232c0046c6160f47b8792370745b47885c2fa75308abc3df76dcc5965858b004c1aad05b8cd8fbb9a359077be1b97ec087a05d740145030675823
-
Filesize
222KB
MD546e9d76672b9d24ba14ea963574cc6a2
SHA1caf88d470dc1241aca2b159b26953194a8d59cca
SHA2562f21e720e8fd2c591fdd52d7267370a2f0894bb4d3ca564392271cc025102ba7
SHA5123e940ccdc588f0a284ce9c94106161845fb878c42db983b13fffbcac8c5620626ca58d745527309213716889546c4de4777c24f8c706dfe74ece7aa1772022c6
-
Filesize
8KB
MD57aaf005f77eea53dc227734db8d7090b
SHA1b6be1dde4cf73bbf0d47c9e07734e96b3442ed59
SHA256a5f373f8bcfae3d9f4895c477206de63f66f08e66b413114cf2666bed798eb71
SHA51219dc8764c5347a73767caed67a8a3f2fe0ecb07cacf2f7b2a27a48592780dede684cfb52932695a79725a047f2c092b29a52b5fd0c7dc024a0166e6ada25633d
-
Filesize
896KB
MD575d516f32681c8c2475a3867a3c2cd51
SHA156469557b8e5c3e43621f12e2ebfe7d446683284
SHA2568b0d2966a6e9f14a0b76886974e301b2199184e6b4d6fa159d5bdefa09d08116
SHA512d2a0f497b9823a4f09ac85a6d5b3b6c3e8d5cecbfe1d567e030b7d54b3954137bd4a4473b9289be87933c2c35d6b47b1a9760296a71d3e5289c6c7e12c40cbe3
-
Filesize
832KB
MD5a8f4b17887273a9b29cdaa0e99845a42
SHA1024e84b4402105e8e8d4c1c54d8ba40bc5cf42bb
SHA256ae74f279001bc602ca38608dc4b40f672cf3d33104cbc6a4ff1a002d050c752e
SHA51227bc33b2760f3cae8b159067b502cf53ec25186efd8e3ee88f24d7232b705582428a2bae774c47dd4a8361e96c59ce9c425631c6484c461ba8f8e2af207b8299
-
Filesize
768KB
MD55e29ccd6d6e308c4fffedec7a268d135
SHA1a383b33082f20e155e99ade317a29a08810975fb
SHA256b73050f4d4bdfd6af9db60ecaaef7a7c3d4ee884014c4658408bd215ce58e9f8
SHA51275162a5dfd28c17a888bfcc7a84684c1ee80ffaffea4de41ae499a86cd20abd8fb1aed0e1775f48cdce30c30103b374b46a106003732ee9bf300776fde621bcb
-
Filesize
704KB
MD5df24c20eb9f43cacbbfa2cfd3ed9f0de
SHA1dc66b3eedd767f19d57a23daab0a663940045afd
SHA256066eb5333a4c0d8eace6b9bc7d3e3160fb9e8c538f4ae15a1a3f67ea29c671c3
SHA512f9fe88d517220c308989a34dec1b4681571387691e1587c9109d6b96fcec8e209cbd727f569e44d76aacaf90dfcebd21dc7a7e541f7c54a3df97b1153b2a0cfc
-
Filesize
155KB
MD50f3487e49d6f3a5c1846cd9eebc7e3fc
SHA117ba797b3d36960790e7b983c432f81ffb9df709
SHA256fa64075d63724c29bd96e172b3a59c4db6bc80462f8d4408b0676436958a4f1a
SHA512fe5959d83d8d106675c8ca5ceb424648148ee812ce79f667b25439ef82bf2373fd08342b8d06e40c04e718209ef32a057804c80da0e3a7aac2d88f5ab29df37f
-
Filesize
589KB
MD5e2213d70937e476e7a778f1712912131
SHA1f8f09b6965c83c361210a1b11c8039b7ca9a30b9
SHA2567312ff88c5eb0eb108cc0f04b91f871f59faed40d28cc5364ff456b0b063c37b
SHA512cd97ff1cf43462b05461c3c5b3c2efe6aea8645968eae89c1936cf0f2657a05bbdcced863e1b68049c4b4624387f2b1d265257d5ce154053ecd31a032a74611f
-
Filesize
1.6MB
MD50965da18bfbf19bafb1c414882e19081
SHA1e4556bac206f74d3a3d3f637e594507c30707240
SHA2561cdddf182f161ab789edfcc68a0706d0b8412a9ba67a3f918fe60fab270eabff
SHA512fe4702a2fde36b4fb0015ad7d3e2169a1ccbf5e29d7edef40f104ed47661b4b0365b13b1913e9f4e0ab7bc9ac542ee86c02a802a13567dfd0b8f5485a5be829b
-
Filesize
896KB
MD5e96a85b1a58ddd9545c152401c034bf0
SHA1d912f7fbeb858a8d335820f778818d64dfbf79ee
SHA256c3757aaa81e324e2e371eaf8f13f5260ed2062e9d3514db2351132e2bb76b4d9
SHA512bddccb32fa70deb5085a717e663dec59696c277b08efdf186e52a851d5f3c9889b0145211e3033ad604c60a7c4be58329867c30522ca5e7cd4c6c5df5c9c6a2e
-
Filesize
218KB
MD5d09be1f47fd6b827c81a4812b4f7296f
SHA1028ae3596c0790e6d7f9f2f3c8e9591527d267f7
SHA2560de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e
SHA512857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595
-
Filesize
54KB
MD5e6e578373c2e416289a8da55f1dc5e8e
SHA1b601a229b66ec3d19c2369b36216c6f6eb1c063e
SHA25643e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f
SHA5129df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89
-
Filesize
113KB
MD59aec524b616618b0d3d00b27b6f51da1
SHA164264300801a353db324d11738ffed876550e1d3
SHA25659a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e
SHA5120648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0
-
Filesize
647KB
MD55e279950775baae5fea04d2cc4526bcc
SHA18aef1e10031c3629512c43dd8b0b5d9060878453
SHA25697de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87
SHA512666325e9ed71da4955058aea31b91e2e848be43211e511865f393b7f537c208c6b31c182f7d728c2704e9fc87e7d1be3f98f5fee4d34f11c56764e1c599afd02
-
Filesize
69KB
MD51e0d62c34ff2e649ebc5c372065732ee
SHA1fcfaa36ba456159b26140a43e80fbd7e9d9af2de
SHA256509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723
SHA5123653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61
-
Filesize
8.9MB
MD5aaaf685d045b423d4d96ecaca344b4d5
SHA1f2264a40421e66029db1cdf7fe8bb8ada2614862
SHA256f77fee8eef443261bc896ac6f10c099277a5fd31baa88f4fa171905157c5d6d8
SHA5128e01c8cf6623250050c099f2cb139aeac6b6318841d23d7701e6ceffc0dcdba79220533af1e84a34750ac7efc2d56750aeb9a5468ca12a12dab9ce2f1899ec4e
-
Filesize
5.9MB
MD5b3860bf322e226647467646c7523e281
SHA13c5c1871665de12fa28f161e36f3291b81f31cf8
SHA25685a8604c03906186f99c7b6719ac986354a4bc5edb9afe8f327cb2d63a1118ac
SHA512ae48a21b6245e72c3a4ed6473afc2599c739cb02cbb4fe766c02f73193a7040e7c2fad388b22f7716dc6dcab790e9178f47e1afb01282239b02909b3955ef9b8
-
Filesize
1.9MB
MD5a6a30adb1f43e4698954504ff9cfc17c
SHA1db6f987950a1559f8cbde858194698b2e69c6c53
SHA256df3cfb0ac0d8e5ff62c1c3ae6ea58ecc1d719d446bd13e2e8aae8676f594b1ca
SHA5128ec1e313c884e985f93cf503c0a2fc5afe5f653ddac14b0cf059b029132bfbe497a12cb028e683d788d213e8a60993058cfa08b67659d0fee56fd08249ba1023
-
Filesize
51B
MD5a3c236c7c80bbcad8a4efe06a5253731
SHA1f48877ba24a1c5c5e070ca5ecb4f1fb4db363c07
SHA2569a9e87561a30b24ad4ad95c763ec931a7cfcc0f4a5c23d12336807a61b089d7d
SHA512dc73af4694b0d8390bcae0e9fd673b982d2c39f20ca4382fddc6475a70891ce9d8e86c2501d149e308c18cd4d3a335cc3411157de23acf6557ed21578c5f49cc
-
Filesize
704KB
MD5d6af2f280ba8765939fbd292116d4322
SHA168f8927bea04a1d4079bca6c4ce3f9fb1cd6142b
SHA25608e3a367c74c88f4023d8ad49624306212ba21f7777dd3027b28fddf7dce6df2
SHA512e4546a9e63b6c34d1226b02ea38add9048f52a7c61cc6b6b69e6a2207482987696172c905967298765a6cd6973a87a7897b38be35b3ffdf5ecefd08e5966b58e
-
Filesize
960KB
MD56adaf063505b67abb57e2e47b6bab17c
SHA193585c7ea6ea8fdc8032b7e3ab4d40000d866462
SHA256f29ae18a0bd9c3c557ef28e2593b9868f665ce013a9ddd01d0d87acf18887c0a
SHA512d580c5f3803d6dfc859ffb7ff0da232ba95b3e26fd4c6c577dbd4fc7084ed7d3e07038c0ac63658dedc8caca09e49a76175abe41ff99358d4777ffc7c96e67ee
-
Filesize
117KB
MD5a628baa97881fa5528009c9470cadee0
SHA1583aa730e302fe0015cdb0dee4e279f193d66d87
SHA256e2bb9ee3616cd827cc3ee297cbe24cfbd2ded4d9efe894e68453f6cfbf18e4c5
SHA512c84e496e13d30c24efd020f25f4cd55b6157feb529f7285d97445c386fd50a50e943b0f67745a861a97c5bf0c4ff7dee7b5240d52c59b66421a9bdc26de58faf
-
Filesize
43KB
MD5ad0aca1934f02768fd5fedaf4d9762a3
SHA10e5b8372015d81200c4eff22823e854d0030f305
SHA256dc10f50f9761f6fbafe665e75a331b2048a285b1857ad95e0611ace825cba388
SHA5122fba342010ba85440784190245f74ea9e7c70974df12c241ccb6b72a6e1006a72bd1fa2e657f434d7479758f9508edb315398f6e95d167a78b788cea732be3b7
-
Filesize
869KB
MD501ad10e59fa396af2d5443c5a14c1b21
SHA1f209a4f0bb2a96e3ee6a55689e7f00e79c04f722
SHA256bef1cffaba8186ce62265e0b322ca9fd9326a8929591df569a4953456c752137
SHA5121e067ade999ff933a644fde66c6ab9abb8a960ce1c8064368adcde4c09d924bd22d1b43c68b7c968e982fc75937969a2876e9e2a024f72e693f9ba397d449e02