Analysis
-
max time kernel
118s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
02-03-2024 15:36
Behavioral task
behavioral1
Sample
80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe
Resource
win7-20240221-en
General
-
Target
80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe
-
Size
893KB
-
MD5
1e79d9bf5b01707fd8b3081e69f5f7f8
-
SHA1
58bcef993a3c58808afc4affb1c2fa6948f7a5c7
-
SHA256
80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a
-
SHA512
1799d68dc22e29790f49d4ea848fb5708716fe4dd8532994bc72805e2c85271762f7a92cc23cd04b394ce79e9d569231bc4ef8f7536d8b5c05370e82a3ce11bc
-
SSDEEP
24576:UX0hD34ShYVRyg0l6h4Zo7EEasEiDA4ONxjQTDpGTlbcm5:UEcShYV90l6J7DasEdrjQXpGpbD
Malware Config
Signatures
-
Possible privilege escalation attempt 3 IoCs
Processes:
takeown.exeicacls.exetakeown.exepid process 112 takeown.exe 2608 icacls.exe 2156 takeown.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 2636 cmd.exe -
Executes dropped EXE 1 IoCs
Processes:
sms.exepid process 1280 sms.exe -
Loads dropped DLL 1 IoCs
Processes:
80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exepid process 1284 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe -
Modifies file permissions 1 TTPs 3 IoCs
Processes:
takeown.exeicacls.exetakeown.exepid process 112 takeown.exe 2608 icacls.exe 2156 takeown.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
resource yara_rule behavioral1/memory/1284-0-0x0000000000E00000-0x0000000000F59000-memory.dmp upx behavioral1/memory/1284-18-0x0000000000E00000-0x0000000000F59000-memory.dmp upx -
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exedescription ioc process File opened (read-only) \??\D: 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe -
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule behavioral1/memory/1284-18-0x0000000000E00000-0x0000000000F59000-memory.dmp autoit_exe -
Drops file in Windows directory 2 IoCs
Processes:
80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exedescription ioc process File created C:\Windows\Web\sms.exe 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe File opened for modification C:\Windows\Web\sms.exe 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies File Icons 1 IoCs
Processes:
80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Shell Icons 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe -
Processes:
80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exeregini.exeregini.exeregini.exedescription ioc process Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\INTERNET EXPLORER\SEARCHSCOPES\{0633EE93-D776-472F-A0FF-E1416B8B2E3A} 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\URL = "http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC" 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\Version = "2" 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\{A481937F-4D99-4B11-86E6-5B0F1007C557}\ 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\{A481937F-4D99-4B11-86E6-5B0F1007C557}\Codepage = "65001" 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{A481937F-4D99-4B11-86E6-5B0F1007C557}\URL = "http://www.456020.com/s.htm?wd={searchTerms}&ie=utf-8" 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DefaultScope = "{A481937F-4D99-4B11-86E6-5B0F1007C557}" 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes regini.exe Key deleted \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SEARCHSCOPES\{0633EE93-D776-472F-A0FF-E1416B8B2E3A} 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\DefaultScope = "{A481937F-4D99-4B11-86E6-5B0F1007C557}" 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe Key deleted \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\ 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\URL = "http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC" 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\{A481937F-4D99-4B11-86E6-5B0F1007C557}\URL = "http://www.456020.com/s.htm?wd={searchTerms}&ie=utf-8" 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\{A481937F-4D99-4B11-86E6-5B0F1007C557}\SortIndex = "1" 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{A481937F-4D99-4B11-86E6-5B0F1007C557}\Codepage = "65001" 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadUpdates = "1" 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\{A481937F-4D99-4B11-86E6-5B0F1007C557}\ShowSearchSuggestions = "1" 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\{A481937F-4D99-4B11-86E6-5B0F1007C557}\SuggestionsURL_JSON = "http://suggestion.baidu.com/su?wd={searchTerms}&action=opensearch&ie=utf-8&from=ie8" 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\{A481937F-4D99-4B11-86E6-5B0F1007C557}\FaviconURL = "http://www.baidu.com/favicon.ico" 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{A481937F-4D99-4B11-86E6-5B0F1007C557}\ 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{A481937F-4D99-4B11-86E6-5B0F1007C557}\DisplayName = "百度搜索" 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\SuggestionsURLFallback = "http://bj1.api.bing.com/qsml.aspx?query={searchTerms}&src={referrer:source}&maxwidth={ie:maxWidth}&rowheight={ie:rowHeight}§ionHeight={ie:sectionHeight}&FORM=IE8SSC&market={Language}" 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconURLFallback = "http://www.bing.com/favicon.ico" 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\DisplayName = "Bing" 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\{A481937F-4D99-4B11-86E6-5B0F1007C557} regini.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\{5CE25775-92B7-477d-9603-852F0B34D8B0} 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\{5CE25775-92B7-477d-9603-852F0B34D8B0} regini.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\DisplayName = "@ieframe.dll,-12512" 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{A481937F-4D99-4B11-86E6-5B0F1007C557}\ShowSearchSuggestions = "1" 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{A481937F-4D99-4B11-86E6-5B0F1007C557}\FaviconURL = "http://www.baidu.com/favicon.ico" 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\UpgradeTime = da4b9550aecdcb01 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Program Files\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico" 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\{A481937F-4D99-4B11-86E6-5B0F1007C557} 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ = "Bing" 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{A481937F-4D99-4B11-86E6-5B0F1007C557} 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{A481937F-4D99-4B11-86E6-5B0F1007C557}\SuggestionsURL_JSON = "http://suggestion.baidu.com/su?wd={searchTerms}&action=opensearch&ie=utf-8&from=ie8" 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{A481937F-4D99-4B11-86E6-5B0F1007C557}\SortIndex = "1" 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "0" 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\{A481937F-4D99-4B11-86E6-5B0F1007C557}\DisplayName = "百度搜索" 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\{A481937F-4D99-4B11-86E6-5B0F1007C557}\FaviconPath = "C:\\Program Files\\Internet Explorer\\Services\\search_{A481937F-4D99-4B11-86E6-5B0F1007C557}.ico" 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\Version = "1" 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
takeown.exedescription pid process Token: SeTakeOwnershipPrivilege 2156 takeown.exe -
Suspicious use of FindShellTrayWindow 6 IoCs
Processes:
80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exepid process 1284 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe 1284 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe 1284 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe 1284 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe 1284 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe 1284 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe -
Suspicious use of SendNotifyMessage 6 IoCs
Processes:
80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exepid process 1284 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe 1284 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe 1284 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe 1284 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe 1284 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe 1284 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.execmd.execmd.execmd.execmd.exedescription pid process target process PID 1284 wrote to memory of 1748 1284 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe cmd.exe PID 1284 wrote to memory of 1748 1284 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe cmd.exe PID 1284 wrote to memory of 1748 1284 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe cmd.exe PID 1284 wrote to memory of 1748 1284 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe cmd.exe PID 1748 wrote to memory of 112 1748 cmd.exe takeown.exe PID 1748 wrote to memory of 112 1748 cmd.exe takeown.exe PID 1748 wrote to memory of 112 1748 cmd.exe takeown.exe PID 1748 wrote to memory of 112 1748 cmd.exe takeown.exe PID 1748 wrote to memory of 2608 1748 cmd.exe icacls.exe PID 1748 wrote to memory of 2608 1748 cmd.exe icacls.exe PID 1748 wrote to memory of 2608 1748 cmd.exe icacls.exe PID 1748 wrote to memory of 2608 1748 cmd.exe icacls.exe PID 1284 wrote to memory of 2032 1284 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe cmd.exe PID 1284 wrote to memory of 2032 1284 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe cmd.exe PID 1284 wrote to memory of 2032 1284 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe cmd.exe PID 1284 wrote to memory of 2032 1284 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe cmd.exe PID 2032 wrote to memory of 2156 2032 cmd.exe takeown.exe PID 2032 wrote to memory of 2156 2032 cmd.exe takeown.exe PID 2032 wrote to memory of 2156 2032 cmd.exe takeown.exe PID 2032 wrote to memory of 2156 2032 cmd.exe takeown.exe PID 1284 wrote to memory of 2576 1284 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe cmd.exe PID 1284 wrote to memory of 2576 1284 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe cmd.exe PID 1284 wrote to memory of 2576 1284 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe cmd.exe PID 1284 wrote to memory of 2576 1284 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe cmd.exe PID 1284 wrote to memory of 2720 1284 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe cmd.exe PID 1284 wrote to memory of 2720 1284 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe cmd.exe PID 1284 wrote to memory of 2720 1284 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe cmd.exe PID 1284 wrote to memory of 2720 1284 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe cmd.exe PID 1284 wrote to memory of 2932 1284 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe cmd.exe PID 1284 wrote to memory of 2932 1284 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe cmd.exe PID 1284 wrote to memory of 2932 1284 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe cmd.exe PID 1284 wrote to memory of 2932 1284 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe cmd.exe PID 1284 wrote to memory of 2756 1284 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe cmd.exe PID 1284 wrote to memory of 2756 1284 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe cmd.exe PID 1284 wrote to memory of 2756 1284 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe cmd.exe PID 1284 wrote to memory of 2756 1284 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe cmd.exe PID 2756 wrote to memory of 2424 2756 cmd.exe regini.exe PID 2756 wrote to memory of 2424 2756 cmd.exe regini.exe PID 2756 wrote to memory of 2424 2756 cmd.exe regini.exe PID 2756 wrote to memory of 2424 2756 cmd.exe regini.exe PID 1284 wrote to memory of 2436 1284 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe cmd.exe PID 1284 wrote to memory of 2436 1284 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe cmd.exe PID 1284 wrote to memory of 2436 1284 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe cmd.exe PID 1284 wrote to memory of 2436 1284 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe cmd.exe PID 1284 wrote to memory of 2488 1284 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe cmd.exe PID 1284 wrote to memory of 2488 1284 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe cmd.exe PID 1284 wrote to memory of 2488 1284 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe cmd.exe PID 1284 wrote to memory of 2488 1284 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe cmd.exe PID 1284 wrote to memory of 2852 1284 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe cmd.exe PID 1284 wrote to memory of 2852 1284 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe cmd.exe PID 1284 wrote to memory of 2852 1284 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe cmd.exe PID 1284 wrote to memory of 2852 1284 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe cmd.exe PID 1284 wrote to memory of 3044 1284 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe cmd.exe PID 1284 wrote to memory of 3044 1284 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe cmd.exe PID 1284 wrote to memory of 3044 1284 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe cmd.exe PID 1284 wrote to memory of 3044 1284 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe cmd.exe PID 1284 wrote to memory of 860 1284 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe cmd.exe PID 1284 wrote to memory of 860 1284 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe cmd.exe PID 1284 wrote to memory of 860 1284 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe cmd.exe PID 1284 wrote to memory of 860 1284 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe cmd.exe PID 860 wrote to memory of 572 860 cmd.exe regini.exe PID 860 wrote to memory of 572 860 cmd.exe regini.exe PID 860 wrote to memory of 572 860 cmd.exe regini.exe PID 860 wrote to memory of 572 860 cmd.exe regini.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe"C:\Users\Admin\AppData\Local\Temp\80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe"1⤵
- Loads dropped DLL
- Enumerates connected drives
- Drops file in Windows directory
- Modifies File Icons
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1284 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c takeown /f "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup" && icacls "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup" /grant administrators:F /t2⤵
- Suspicious use of WriteProcessMemory
PID:1748 -
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup"3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:112
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup" /grant administrators:F /t3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:2608
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c takeown /f "C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup" && icacls "C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup" /grant administrators:F /t2⤵
- Suspicious use of WriteProcessMemory
PID:2032 -
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup"3⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:2156
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c @echo off2⤵PID:2576
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c if exist regset.ini @del /q /f regset.ini2⤵PID:2720
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{5CE25775-92B7-477d-9603-852F0B34D8B0} [2 8 19] >regset.ini2⤵PID:2932
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c regini regset.ini2⤵
- Suspicious use of WriteProcessMemory
PID:2756 -
C:\Windows\SysWOW64\regini.exeregini regset.ini3⤵
- Modifies Internet Explorer settings
PID:2424
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c @del /q /f regset.ini2⤵PID:2436
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c @echo off2⤵PID:2488
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c if exist regset.ini @del /q /f regset.ini2⤵PID:2852
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{A481937F-4D99-4B11-86E6-5B0F1007C557} [2 8 19] >regset.ini2⤵PID:3044
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c regini regset.ini2⤵
- Suspicious use of WriteProcessMemory
PID:860 -
C:\Windows\SysWOW64\regini.exeregini regset.ini3⤵
- Modifies Internet Explorer settings
PID:572
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c @del /q /f regset.ini2⤵PID:552
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c @echo off2⤵PID:2408
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c if exist regset.ini @del /q /f regset.ini2⤵PID:532
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes [2 8 19] >regset.ini2⤵PID:1388
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c regini regset.ini2⤵PID:920
-
C:\Windows\SysWOW64\regini.exeregini regset.ini3⤵
- Modifies Internet Explorer settings
PID:1680
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c @del /q /f regset.ini2⤵PID:2492
-
-
C:\Windows\web\sms.exeC:\Windows\web\sms.exe2⤵
- Executes dropped EXE
PID:1280
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping 127.0.0.1 -n 2&del /q "C:\Users\Admin\AppData\Local\Temp\80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe"2⤵
- Deletes itself
PID:2636 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 23⤵
- Runs ping.exe
PID:2344
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
118B
MD506697bf2f4f5395a9af659f50df00e3b
SHA101925ffbeed3e54e134e1fafaef8ff640dda9107
SHA2568868e97e8dfbc08e681ab68b6b5b1a756cd352354d8ed6c5ce1cb6dee07e55f1
SHA5129c32faff9e7d4b0c82b92ea87c03cff3bd1548ea07728bb7c1fda828db6be857f4101c94e6cffd70f16e2d4fef93c641f4a7edb8cc62c1edda23b54218affd73
-
Filesize
118B
MD5b141c6974c48fadca812a060e03f8200
SHA1bfc010eeda61bd2bd6d3b7963570cbc7d7539037
SHA25668a17dd52a94c7807e46ec191f4481f330eba25303daba341316ac389c17282e
SHA512353288737aca756f1e78b7143711a87917509a3290bf62c789e4de03275b4684eff9027d5d668996b7bc47e3ae7d4f2fc85c523a16795b90a94a9f5d6ed8f138
-
Filesize
79B
MD52c545704057f619fa7fb3f994862f181
SHA1b820cf6d3e8cbc30ef87632370ed60ef4a5f0bbd
SHA2560a31ed19b74d461d0819477eb328af5f8ef3508974df347cf4304fa62977d1a0
SHA5125875c2626b6172d6059faa391efb4bfcd9c6c35ec15aa002becff0cef7f05b928f9690ed8edd19f790e056d8d19a3f5c7a5402213ae649577202a7f025388a84
-
Filesize
775KB
MD5628ca25523c98eb00cee7503787f78ee
SHA17b1c2393002e35ea36f4e20c5d6dd87d14542408
SHA2566f01b51d56b152362ad864e5c4e3f8979aa60c565021e0eff2b34fba422d4870
SHA51207eca622f5d10b2d5892417dc872ecce2d1b0b8e6a1c6916186770c685038e8cdf4ebc01c50fd6ad47e981f8b7a7c9bdc05e1e71fbba54cab1d5b34cb8edc639