Analysis
-
max time kernel
143s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
02-03-2024 15:36
Behavioral task
behavioral1
Sample
80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe
Resource
win7-20240221-en
General
-
Target
80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe
-
Size
893KB
-
MD5
1e79d9bf5b01707fd8b3081e69f5f7f8
-
SHA1
58bcef993a3c58808afc4affb1c2fa6948f7a5c7
-
SHA256
80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a
-
SHA512
1799d68dc22e29790f49d4ea848fb5708716fe4dd8532994bc72805e2c85271762f7a92cc23cd04b394ce79e9d569231bc4ef8f7536d8b5c05370e82a3ce11bc
-
SSDEEP
24576:UX0hD34ShYVRyg0l6h4Zo7EEasEiDA4ONxjQTDpGTlbcm5:UEcShYV90l6J7DasEdrjQXpGpbD
Malware Config
Signatures
-
Possible privilege escalation attempt 3 IoCs
Processes:
takeown.exeicacls.exetakeown.exepid process 3080 takeown.exe 4732 icacls.exe 3668 takeown.exe -
Executes dropped EXE 1 IoCs
Processes:
sms.exepid process 4560 sms.exe -
Modifies file permissions 1 TTPs 3 IoCs
Processes:
takeown.exeicacls.exetakeown.exepid process 3080 takeown.exe 4732 icacls.exe 3668 takeown.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
resource yara_rule behavioral2/memory/2568-0-0x0000000000B40000-0x0000000000C99000-memory.dmp upx behavioral2/memory/2568-1-0x0000000000B40000-0x0000000000C99000-memory.dmp upx behavioral2/memory/2568-31-0x0000000000B40000-0x0000000000C99000-memory.dmp upx -
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exedescription ioc process File opened (read-only) \??\D: 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe -
AutoIT Executable 2 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule behavioral2/memory/2568-1-0x0000000000B40000-0x0000000000C99000-memory.dmp autoit_exe behavioral2/memory/2568-31-0x0000000000B40000-0x0000000000C99000-memory.dmp autoit_exe -
Drops file in Windows directory 2 IoCs
Processes:
80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exedescription ioc process File created C:\Windows\Web\sms.exe 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe File opened for modification C:\Windows\Web\sms.exe 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 956 taskkill.exe -
Modifies File Icons 1 IoCs
Processes:
80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Shell Icons 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe -
Processes:
80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exeregini.exeregini.exeregini.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\ 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\Version = "1" 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\SearchScopes regini.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\URL = "http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC" 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\SearchScopes\{A481937F-4D99-4B11-86E6-5B0F1007C557}\URL = "http://www.456020.com/s.htm?wd={searchTerms}&ie=utf-8" 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\SearchScopes\{A481937F-4D99-4B11-86E6-5B0F1007C557}\ShowSearchSuggestions = "1" 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\SearchScopes\{A481937F-4D99-4B11-86E6-5B0F1007C557}\SortIndex = "1" 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\SearchScopes 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\URL = "http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC" 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\SearchScopes\{A481937F-4D99-4B11-86E6-5B0F1007C557} 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{A481937F-4D99-4B11-86E6-5B0F1007C557}\URL = "http://www.456020.com/s.htm?wd={searchTerms}&ie=utf-8" 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{A481937F-4D99-4B11-86E6-5B0F1007C557} 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\SearchScopes\{A481937F-4D99-4B11-86E6-5B0F1007C557}\ 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\SearchScopes\{A481937F-4D99-4B11-86E6-5B0F1007C557}\FaviconURL = "http://www.baidu.com/favicon.ico" 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\DownloadUpdates = "1" 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\SuggestionsURLFallback = "http://bj1.api.bing.com/qsml.aspx?query={searchTerms}&src={referrer:source}&maxwidth={ie:maxWidth}&rowheight={ie:rowHeight}§ionHeight={ie:sectionHeight}&FORM=IE8SSC&market={Language}" 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{0633EE93-D776-472F-A0FF-E1416B8B2E3A} 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\DefaultScope = "{A481937F-4D99-4B11-86E6-5B0F1007C557}" 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe Set value (data) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\UpgradeTime = da4b9550aecdcb01 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{A481937F-4D99-4B11-86E6-5B0F1007C557}\FaviconPath = "C:\\Program Files\\Internet Explorer\\Services\\search_{A481937F-4D99-4B11-86E6-5B0F1007C557}.ico" 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe Key deleted \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{0633EE93-D776-472F-A0FF-E1416B8B2E3A} 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\SearchScopes\DefaultScope = "{A481937F-4D99-4B11-86E6-5B0F1007C557}" 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ = "Bing" 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\SearchScopes\{A481937F-4D99-4B11-86E6-5B0F1007C557}\DisplayName = "百度搜索" 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "0" 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\SearchScopes\{A481937F-4D99-4B11-86E6-5B0F1007C557} regini.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{A481937F-4D99-4B11-86E6-5B0F1007C557}\DisplayName = "百度搜索" 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{A481937F-4D99-4B11-86E6-5B0F1007C557}\Codepage = "65001" 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{A481937F-4D99-4B11-86E6-5B0F1007C557}\FaviconURL = "http://www.baidu.com/favicon.ico" 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\DisplayName = "@ieframe.dll,-12512" 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\SearchScopes\{A481937F-4D99-4B11-86E6-5B0F1007C557}\Codepage = "65001" 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconURLFallback = "http://www.bing.com/favicon.ico" 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\DisplayName = "Bing" 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\SearchScopes\{5CE25775-92B7-477d-9603-852F0B34D8B0} regini.exe Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\Version = "2" 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\SearchScopes\{A481937F-4D99-4B11-86E6-5B0F1007C557}\SuggestionsURL_JSON = "http://suggestion.baidu.com/su?wd={searchTerms}&action=opensearch&ie=utf-8&from=ie8" 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{A481937F-4D99-4B11-86E6-5B0F1007C557}\ShowSearchSuggestions = "1" 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{A481937F-4D99-4B11-86E6-5B0F1007C557}\SortIndex = "1" 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe Key deleted \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\SearchScopes\{5CE25775-92B7-477d-9603-852F0B34D8B0} 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Program Files\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico" 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{A481937F-4D99-4B11-86E6-5B0F1007C557}\ 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{A481937F-4D99-4B11-86E6-5B0F1007C557}\SuggestionsURL_JSON = "http://suggestion.baidu.com/su?wd={searchTerms}&action=opensearch&ie=utf-8&from=ie8" 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
takeown.exetaskkill.exedescription pid process Token: SeTakeOwnershipPrivilege 3668 takeown.exe Token: SeDebugPrivilege 956 taskkill.exe -
Suspicious use of FindShellTrayWindow 11 IoCs
Processes:
80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exepid process 2568 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe 2568 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe 2568 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe 2568 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe 2568 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe 2568 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe 2568 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe 2568 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe 2568 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe 2568 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe 2568 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe -
Suspicious use of SendNotifyMessage 11 IoCs
Processes:
80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exepid process 2568 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe 2568 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe 2568 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe 2568 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe 2568 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe 2568 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe 2568 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe 2568 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe 2568 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe 2568 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe 2568 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.execmd.execmd.execmd.execmd.execmd.exedescription pid process target process PID 2568 wrote to memory of 3552 2568 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe cmd.exe PID 2568 wrote to memory of 3552 2568 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe cmd.exe PID 2568 wrote to memory of 3552 2568 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe cmd.exe PID 3552 wrote to memory of 3080 3552 cmd.exe takeown.exe PID 3552 wrote to memory of 3080 3552 cmd.exe takeown.exe PID 3552 wrote to memory of 3080 3552 cmd.exe takeown.exe PID 3552 wrote to memory of 4732 3552 cmd.exe icacls.exe PID 3552 wrote to memory of 4732 3552 cmd.exe icacls.exe PID 3552 wrote to memory of 4732 3552 cmd.exe icacls.exe PID 2568 wrote to memory of 3924 2568 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe cmd.exe PID 2568 wrote to memory of 3924 2568 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe cmd.exe PID 2568 wrote to memory of 3924 2568 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe cmd.exe PID 3924 wrote to memory of 3668 3924 cmd.exe takeown.exe PID 3924 wrote to memory of 3668 3924 cmd.exe takeown.exe PID 3924 wrote to memory of 3668 3924 cmd.exe takeown.exe PID 2568 wrote to memory of 3404 2568 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe cmd.exe PID 2568 wrote to memory of 3404 2568 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe cmd.exe PID 2568 wrote to memory of 3404 2568 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe cmd.exe PID 2568 wrote to memory of 1100 2568 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe cmd.exe PID 2568 wrote to memory of 1100 2568 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe cmd.exe PID 2568 wrote to memory of 1100 2568 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe cmd.exe PID 2568 wrote to memory of 4664 2568 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe cmd.exe PID 2568 wrote to memory of 4664 2568 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe cmd.exe PID 2568 wrote to memory of 4664 2568 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe cmd.exe PID 2568 wrote to memory of 3592 2568 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe cmd.exe PID 2568 wrote to memory of 3592 2568 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe cmd.exe PID 2568 wrote to memory of 3592 2568 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe cmd.exe PID 3592 wrote to memory of 1008 3592 cmd.exe regini.exe PID 3592 wrote to memory of 1008 3592 cmd.exe regini.exe PID 3592 wrote to memory of 1008 3592 cmd.exe regini.exe PID 2568 wrote to memory of 100 2568 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe cmd.exe PID 2568 wrote to memory of 100 2568 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe cmd.exe PID 2568 wrote to memory of 100 2568 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe cmd.exe PID 2568 wrote to memory of 3604 2568 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe cmd.exe PID 2568 wrote to memory of 3604 2568 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe cmd.exe PID 2568 wrote to memory of 3604 2568 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe cmd.exe PID 2568 wrote to memory of 2064 2568 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe cmd.exe PID 2568 wrote to memory of 2064 2568 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe cmd.exe PID 2568 wrote to memory of 2064 2568 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe cmd.exe PID 2568 wrote to memory of 756 2568 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe cmd.exe PID 2568 wrote to memory of 756 2568 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe cmd.exe PID 2568 wrote to memory of 756 2568 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe cmd.exe PID 2568 wrote to memory of 1796 2568 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe cmd.exe PID 2568 wrote to memory of 1796 2568 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe cmd.exe PID 2568 wrote to memory of 1796 2568 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe cmd.exe PID 1796 wrote to memory of 1800 1796 cmd.exe regini.exe PID 1796 wrote to memory of 1800 1796 cmd.exe regini.exe PID 1796 wrote to memory of 1800 1796 cmd.exe regini.exe PID 2568 wrote to memory of 1520 2568 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe cmd.exe PID 2568 wrote to memory of 1520 2568 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe cmd.exe PID 2568 wrote to memory of 1520 2568 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe cmd.exe PID 2568 wrote to memory of 2144 2568 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe cmd.exe PID 2568 wrote to memory of 2144 2568 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe cmd.exe PID 2568 wrote to memory of 2144 2568 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe cmd.exe PID 2568 wrote to memory of 4832 2568 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe cmd.exe PID 2568 wrote to memory of 4832 2568 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe cmd.exe PID 2568 wrote to memory of 4832 2568 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe cmd.exe PID 2568 wrote to memory of 3396 2568 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe cmd.exe PID 2568 wrote to memory of 3396 2568 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe cmd.exe PID 2568 wrote to memory of 3396 2568 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe cmd.exe PID 2568 wrote to memory of 4400 2568 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe cmd.exe PID 2568 wrote to memory of 4400 2568 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe cmd.exe PID 2568 wrote to memory of 4400 2568 80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe cmd.exe PID 4400 wrote to memory of 5100 4400 cmd.exe regini.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe"C:\Users\Admin\AppData\Local\Temp\80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe"1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies File Icons
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2568 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c takeown /f "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup" && icacls "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup" /grant administrators:F /t2⤵
- Suspicious use of WriteProcessMemory
PID:3552 -
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup"3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:3080
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup" /grant administrators:F /t3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:4732
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c takeown /f "C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup" && icacls "C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup" /grant administrators:F /t2⤵
- Suspicious use of WriteProcessMemory
PID:3924 -
C:\Windows\SysWOW64\takeown.exetakeown /f "C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup"3⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:3668
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c @echo off2⤵PID:3404
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c if exist regset.ini @del /q /f regset.ini2⤵PID:1100
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{5CE25775-92B7-477d-9603-852F0B34D8B0} [2 8 19] >regset.ini2⤵PID:4664
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c regini regset.ini2⤵
- Suspicious use of WriteProcessMemory
PID:3592 -
C:\Windows\SysWOW64\regini.exeregini regset.ini3⤵
- Modifies Internet Explorer settings
PID:1008
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c @del /q /f regset.ini2⤵PID:100
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c @echo off2⤵PID:3604
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c if exist regset.ini @del /q /f regset.ini2⤵PID:2064
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{A481937F-4D99-4B11-86E6-5B0F1007C557} [2 8 19] >regset.ini2⤵PID:756
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c regini regset.ini2⤵
- Suspicious use of WriteProcessMemory
PID:1796 -
C:\Windows\SysWOW64\regini.exeregini regset.ini3⤵
- Modifies Internet Explorer settings
PID:1800
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c @del /q /f regset.ini2⤵PID:1520
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c @echo off2⤵PID:2144
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c if exist regset.ini @del /q /f regset.ini2⤵PID:4832
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes [2 8 19] >regset.ini2⤵PID:3396
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c regini regset.ini2⤵
- Suspicious use of WriteProcessMemory
PID:4400 -
C:\Windows\SysWOW64\regini.exeregini regset.ini3⤵
- Modifies Internet Explorer settings
PID:5100
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c @del /q /f regset.ini2⤵PID:4104
-
-
C:\Windows\web\sms.exeC:\Windows\web\sms.exe2⤵
- Executes dropped EXE
PID:4560 -
C:\Windows\SysWOW64\cmd.execmd /C taskkill /f /im msedge.exe3⤵PID:5088
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im msedge.exe4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:956
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping 127.0.0.1 -n 2&del /q "C:\Users\Admin\AppData\Local\Temp\80ac8da6cd68d70640b3344da6e7884b25fc3c588162ae589d194599030f481a.exe"2⤵PID:4580
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 23⤵
- Runs ping.exe
PID:4980
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
118B
MD506697bf2f4f5395a9af659f50df00e3b
SHA101925ffbeed3e54e134e1fafaef8ff640dda9107
SHA2568868e97e8dfbc08e681ab68b6b5b1a756cd352354d8ed6c5ce1cb6dee07e55f1
SHA5129c32faff9e7d4b0c82b92ea87c03cff3bd1548ea07728bb7c1fda828db6be857f4101c94e6cffd70f16e2d4fef93c641f4a7edb8cc62c1edda23b54218affd73
-
Filesize
118B
MD5b141c6974c48fadca812a060e03f8200
SHA1bfc010eeda61bd2bd6d3b7963570cbc7d7539037
SHA25668a17dd52a94c7807e46ec191f4481f330eba25303daba341316ac389c17282e
SHA512353288737aca756f1e78b7143711a87917509a3290bf62c789e4de03275b4684eff9027d5d668996b7bc47e3ae7d4f2fc85c523a16795b90a94a9f5d6ed8f138
-
Filesize
79B
MD52c545704057f619fa7fb3f994862f181
SHA1b820cf6d3e8cbc30ef87632370ed60ef4a5f0bbd
SHA2560a31ed19b74d461d0819477eb328af5f8ef3508974df347cf4304fa62977d1a0
SHA5125875c2626b6172d6059faa391efb4bfcd9c6c35ec15aa002becff0cef7f05b928f9690ed8edd19f790e056d8d19a3f5c7a5402213ae649577202a7f025388a84
-
Filesize
775KB
MD5628ca25523c98eb00cee7503787f78ee
SHA17b1c2393002e35ea36f4e20c5d6dd87d14542408
SHA2566f01b51d56b152362ad864e5c4e3f8979aa60c565021e0eff2b34fba422d4870
SHA51207eca622f5d10b2d5892417dc872ecce2d1b0b8e6a1c6916186770c685038e8cdf4ebc01c50fd6ad47e981f8b7a7c9bdc05e1e71fbba54cab1d5b34cb8edc639