resource	yara_rule
behavioral1/memory/1848-0-0x00000000006D0000-0x0000000000722000-memory.dmp	upx
behavioral1/memory/1848-1-0x00000000006D0000-0x0000000000722000-memory.dmp	upx
behavioral1/memory/1984-9-0x0000000001F10000-0x0000000001F62000-memory.dmp	upx
behavioral1/memory/1188-13-0x0000000000600000-0x0000000000652000-memory.dmp	upx

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\2500 = "3"	notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2500 = "3"	notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\2500 = "3"	notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\2500 = "3"	notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\2500 = "3"	notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\2500 = "3"	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\2500 = "3"	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2500 = "3"	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\2500 = "3"	notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2500 = "3"	notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\2500 = "3"	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\2500 = "3"	notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\2500 = "3"	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\2500 = "3"	notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\2500 = "3"	notepad.exe

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{46F06211-E0A3-11EE-B238-4AE872E97954} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50234924b074da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a96069000000000200000000001066000000010000200000003ea4619b96b753e9f24e9af70690b3746e8fe94215979309a97152098de3f990000000000e8000000002000020000000aa3f5ca3c5cdff0ec9f8f733e4fe2ed654429f1f9a8706e8cb915a7f16cf9f892000000008dd2bd38bfad375964e390d1d6f54525d4a7748caf0087fa65a971346337a3d400000005c142653dec7735a142ce072faac687b88059759f6d4f101d175a2f07e4f43a68808fd23ffa64bc2b97b9e396fd221fe5e063363eb9f3eb8c950325cbc0c78fc	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a960690000000002000000000010660000000100002000000079a49b32bb00116dffd0ebf36a838855fddb37b8d32819195494ffe7717ed118000000000e800000000200002000000033ee7f9e0683a149e7751338d24497d02578685cfa8ad5e37d9725f62487e47990000000f183443f3dbee4a853b2aefa6d5003afe6706ed1ea2939fbe96ffc6233c0cb60ed12abc505264fa1deb49be6aac22d2aa200e32f739bd0040c17e7554a86cc6f93513184974c26aa3e2c2cbdcd7fa1d04d91ca530a38cd4712150da0427a7f5d74919532be409928946d212e5637b6bfe51019bf5ba6afcc62355ab7014936d2c80b099e0801178e17a11326b9e76280400000009d0df510afcc9fdaca67e5063d70fe1013ae1a8aa795e0a350224a7aa7c8ebbff80f336c2ebaca041cc620841a6edda66e07a5d0b56638bc49502251389c12fd	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "416432128"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	notepad.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	notepad.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe

pid	Process
1848	rundll32.exe
1984	notepad.exe
1984	notepad.exe
1984	notepad.exe
1984	notepad.exe
1984	notepad.exe
1984	notepad.exe
1188	notepad.exe
1984	notepad.exe
1984	notepad.exe
1984	notepad.exe
1984	notepad.exe
1984	notepad.exe
1984	notepad.exe
1984	notepad.exe
1848	rundll32.exe
1848	rundll32.exe
1984	notepad.exe
1984	notepad.exe
1984	notepad.exe
1984	notepad.exe
1984	notepad.exe
1984	notepad.exe
1984	notepad.exe
1984	notepad.exe
1984	notepad.exe
1984	notepad.exe
1984	notepad.exe
1984	notepad.exe
1984	notepad.exe
1984	notepad.exe
1984	notepad.exe
1984	notepad.exe
1984	notepad.exe
1984	notepad.exe
1984	notepad.exe
1984	notepad.exe
1984	notepad.exe
1984	notepad.exe
1984	notepad.exe
1984	notepad.exe
1984	notepad.exe
1984	notepad.exe
1984	notepad.exe
1984	notepad.exe
1984	notepad.exe
1984	notepad.exe
1984	notepad.exe
1984	notepad.exe
1984	notepad.exe
1984	notepad.exe
1984	notepad.exe
1984	notepad.exe
1984	notepad.exe
1984	notepad.exe
1984	notepad.exe
1984	notepad.exe
1984	notepad.exe
1984	notepad.exe
1984	notepad.exe
1984	notepad.exe
1984	notepad.exe
1984	notepad.exe
1984	notepad.exe

pid	Process
2536	iexplore.exe
2536	iexplore.exe
2536	iexplore.exe
2536	iexplore.exe
2536	iexplore.exe
2536	iexplore.exe
2536	iexplore.exe
2536	iexplore.exe
2536	iexplore.exe
2536	iexplore.exe
2636	ctfmon.exe
2636	ctfmon.exe

description	pid	Process	procid_target
PID 2000 wrote to memory of 1848	2000	rundll32.exe	28
PID 2000 wrote to memory of 1848	2000	rundll32.exe	28
PID 2000 wrote to memory of 1848	2000	rundll32.exe	28
PID 2000 wrote to memory of 1848	2000	rundll32.exe	28
PID 2000 wrote to memory of 1848	2000	rundll32.exe	28
PID 2000 wrote to memory of 1848	2000	rundll32.exe	28
PID 2000 wrote to memory of 1848	2000	rundll32.exe	28
PID 1848 wrote to memory of 2924	1848	rundll32.exe	29
PID 1848 wrote to memory of 2924	1848	rundll32.exe	29
PID 1848 wrote to memory of 2924	1848	rundll32.exe	29
PID 1848 wrote to memory of 2924	1848	rundll32.exe	29
PID 1848 wrote to memory of 1984	1848	rundll32.exe	30
PID 1848 wrote to memory of 1984	1848	rundll32.exe	30
PID 1848 wrote to memory of 1984	1848	rundll32.exe	30
PID 1848 wrote to memory of 1984	1848	rundll32.exe	30
PID 2508 wrote to memory of 2636	2508	explorer.exe	32
PID 2508 wrote to memory of 2636	2508	explorer.exe	32
PID 2508 wrote to memory of 2636	2508	explorer.exe	32
PID 1848 wrote to memory of 1984	1848	rundll32.exe	30
PID 2536 wrote to memory of 1692	2536	iexplore.exe	35
PID 2536 wrote to memory of 1692	2536	iexplore.exe	35
PID 2536 wrote to memory of 1692	2536	iexplore.exe	35
PID 2536 wrote to memory of 1692	2536	iexplore.exe	35
PID 1848 wrote to memory of 1188	1848	rundll32.exe	36
PID 1848 wrote to memory of 1188	1848	rundll32.exe	36
PID 1848 wrote to memory of 1188	1848	rundll32.exe	36
PID 1848 wrote to memory of 1188	1848	rundll32.exe	36
PID 1848 wrote to memory of 1188	1848	rundll32.exe	36
PID 1848 wrote to memory of 2536	1848	rundll32.exe	33

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.