Analysis
-
max time kernel
149s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
19/03/2024, 08:54
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d5b5fc6fddcfec0860d29558ac2bc8f7.exe
Resource
win7-20240220-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
d5b5fc6fddcfec0860d29558ac2bc8f7.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
d5b5fc6fddcfec0860d29558ac2bc8f7.exe
-
Size
226KB
-
MD5
d5b5fc6fddcfec0860d29558ac2bc8f7
-
SHA1
2d3ffedd820f8039e8705a7c108c98fcdc644f17
-
SHA256
6324a3ae7be406da03c391a83c0562d438c62a1cbed0d2fcbe0e2a1144ab7e84
-
SHA512
0dfe4d7a55454ddcbec1e8c8ac981933ec1f5eb9e8ce42eb74caaf221d42ea5d77dc99492e9b5c9d20818bce081a12685b3a3a7e2f5025416d36f07ea76a6374
-
SSDEEP
6144:iBRT6zO0Q6zmTBy4/BbBVp/Qnxn6byocKIWCW:D5UL4nxnGcLTW
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.bat" d5b5fc6fddcfec0860d29558ac2bc8f7.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.bat" d5b5fc6fddcfec0860d29558ac2bc8f7.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.bat" d5b5fc6fddcfec0860d29558ac2bc8f7.exe -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\N: d5b5fc6fddcfec0860d29558ac2bc8f7.exe File opened (read-only) \??\O: d5b5fc6fddcfec0860d29558ac2bc8f7.exe File opened (read-only) \??\N: d5b5fc6fddcfec0860d29558ac2bc8f7.exe File opened (read-only) \??\A: d5b5fc6fddcfec0860d29558ac2bc8f7.exe File opened (read-only) \??\O: d5b5fc6fddcfec0860d29558ac2bc8f7.exe File opened (read-only) \??\W: d5b5fc6fddcfec0860d29558ac2bc8f7.exe File opened (read-only) \??\S: d5b5fc6fddcfec0860d29558ac2bc8f7.exe File opened (read-only) \??\L: d5b5fc6fddcfec0860d29558ac2bc8f7.exe File opened (read-only) \??\U: d5b5fc6fddcfec0860d29558ac2bc8f7.exe File opened (read-only) \??\Q: d5b5fc6fddcfec0860d29558ac2bc8f7.exe File opened (read-only) \??\G: d5b5fc6fddcfec0860d29558ac2bc8f7.exe File opened (read-only) \??\H: d5b5fc6fddcfec0860d29558ac2bc8f7.exe File opened (read-only) \??\M: d5b5fc6fddcfec0860d29558ac2bc8f7.exe File opened (read-only) \??\Y: d5b5fc6fddcfec0860d29558ac2bc8f7.exe File opened (read-only) \??\V: d5b5fc6fddcfec0860d29558ac2bc8f7.exe File opened (read-only) \??\G: d5b5fc6fddcfec0860d29558ac2bc8f7.exe File opened (read-only) \??\O: d5b5fc6fddcfec0860d29558ac2bc8f7.exe File opened (read-only) \??\P: d5b5fc6fddcfec0860d29558ac2bc8f7.exe File opened (read-only) \??\X: d5b5fc6fddcfec0860d29558ac2bc8f7.exe File opened (read-only) \??\Y: d5b5fc6fddcfec0860d29558ac2bc8f7.exe File opened (read-only) \??\I: d5b5fc6fddcfec0860d29558ac2bc8f7.exe File opened (read-only) \??\T: d5b5fc6fddcfec0860d29558ac2bc8f7.exe File opened (read-only) \??\B: d5b5fc6fddcfec0860d29558ac2bc8f7.exe File opened (read-only) \??\B: d5b5fc6fddcfec0860d29558ac2bc8f7.exe File opened (read-only) \??\K: d5b5fc6fddcfec0860d29558ac2bc8f7.exe File opened (read-only) \??\J: d5b5fc6fddcfec0860d29558ac2bc8f7.exe File opened (read-only) \??\Z: d5b5fc6fddcfec0860d29558ac2bc8f7.exe File opened (read-only) \??\N: d5b5fc6fddcfec0860d29558ac2bc8f7.exe File opened (read-only) \??\I: d5b5fc6fddcfec0860d29558ac2bc8f7.exe File opened (read-only) \??\M: d5b5fc6fddcfec0860d29558ac2bc8f7.exe File opened (read-only) \??\X: d5b5fc6fddcfec0860d29558ac2bc8f7.exe File opened (read-only) \??\R: d5b5fc6fddcfec0860d29558ac2bc8f7.exe File opened (read-only) \??\E: d5b5fc6fddcfec0860d29558ac2bc8f7.exe File opened (read-only) \??\R: d5b5fc6fddcfec0860d29558ac2bc8f7.exe File opened (read-only) \??\X: d5b5fc6fddcfec0860d29558ac2bc8f7.exe File opened (read-only) \??\L: d5b5fc6fddcfec0860d29558ac2bc8f7.exe File opened (read-only) \??\Z: d5b5fc6fddcfec0860d29558ac2bc8f7.exe File opened (read-only) \??\S: d5b5fc6fddcfec0860d29558ac2bc8f7.exe File opened (read-only) \??\V: d5b5fc6fddcfec0860d29558ac2bc8f7.exe File opened (read-only) \??\E: d5b5fc6fddcfec0860d29558ac2bc8f7.exe File opened (read-only) \??\U: d5b5fc6fddcfec0860d29558ac2bc8f7.exe File opened (read-only) \??\H: d5b5fc6fddcfec0860d29558ac2bc8f7.exe File opened (read-only) \??\A: d5b5fc6fddcfec0860d29558ac2bc8f7.exe File opened (read-only) \??\Q: d5b5fc6fddcfec0860d29558ac2bc8f7.exe File opened (read-only) \??\H: d5b5fc6fddcfec0860d29558ac2bc8f7.exe File opened (read-only) \??\K: d5b5fc6fddcfec0860d29558ac2bc8f7.exe File opened (read-only) \??\W: d5b5fc6fddcfec0860d29558ac2bc8f7.exe File opened (read-only) \??\A: d5b5fc6fddcfec0860d29558ac2bc8f7.exe File opened (read-only) \??\L: d5b5fc6fddcfec0860d29558ac2bc8f7.exe File opened (read-only) \??\P: d5b5fc6fddcfec0860d29558ac2bc8f7.exe File opened (read-only) \??\S: d5b5fc6fddcfec0860d29558ac2bc8f7.exe File opened (read-only) \??\Y: d5b5fc6fddcfec0860d29558ac2bc8f7.exe File opened (read-only) \??\V: d5b5fc6fddcfec0860d29558ac2bc8f7.exe File opened (read-only) \??\M: d5b5fc6fddcfec0860d29558ac2bc8f7.exe File opened (read-only) \??\U: d5b5fc6fddcfec0860d29558ac2bc8f7.exe File opened (read-only) \??\Q: d5b5fc6fddcfec0860d29558ac2bc8f7.exe File opened (read-only) \??\K: d5b5fc6fddcfec0860d29558ac2bc8f7.exe File opened (read-only) \??\W: d5b5fc6fddcfec0860d29558ac2bc8f7.exe File opened (read-only) \??\R: d5b5fc6fddcfec0860d29558ac2bc8f7.exe File opened (read-only) \??\J: d5b5fc6fddcfec0860d29558ac2bc8f7.exe File opened (read-only) \??\T: d5b5fc6fddcfec0860d29558ac2bc8f7.exe File opened (read-only) \??\I: d5b5fc6fddcfec0860d29558ac2bc8f7.exe File opened (read-only) \??\T: d5b5fc6fddcfec0860d29558ac2bc8f7.exe File opened (read-only) \??\B: d5b5fc6fddcfec0860d29558ac2bc8f7.exe -
Drops file in System32 directory 11 IoCs
description ioc Process File created C:\Windows\SysWOW64\userinits.exe d5b5fc6fddcfec0860d29558ac2bc8f7.exe File opened for modification C:\Windows\SysWOW64\userinits.exe d5b5fc6fddcfec0860d29558ac2bc8f7.exe File created C:\Windows\SysWOW64\wuptray.exe cmd.exe File created C:\Windows\SysWOW64\userinit.bat d5b5fc6fddcfec0860d29558ac2bc8f7.exe File created C:\Windows\SysWOW64\Updata.log d5b5fc6fddcfec0860d29558ac2bc8f7.exe File opened for modification C:\Windows\SysWOW64\wuptray.exe cmd.exe File opened for modification C:\Windows\SysWOW64\userinits.exe d5b5fc6fddcfec0860d29558ac2bc8f7.exe File opened for modification C:\Windows\SysWOW64\userinit.bat d5b5fc6fddcfec0860d29558ac2bc8f7.exe File opened for modification C:\Windows\SysWOW64\wuptray.exe cmd.exe File opened for modification C:\Windows\SysWOW64\userinits.exe d5b5fc6fddcfec0860d29558ac2bc8f7.exe File opened for modification C:\Windows\SysWOW64\userinit.bat d5b5fc6fddcfec0860d29558ac2bc8f7.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\PopupsUseNewWindow = "2" d5b5fc6fddcfec0860d29558ac2bc8f7.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\Enabled = "1" d5b5fc6fddcfec0860d29558ac2bc8f7.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPageShow = "2" d5b5fc6fddcfec0860d29558ac2bc8f7.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\QuickTabsThreshold = "2" d5b5fc6fddcfec0860d29558ac2bc8f7.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\ShortcutBehavior = "0" d5b5fc6fddcfec0860d29558ac2bc8f7.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\Enabled = "1" d5b5fc6fddcfec0860d29558ac2bc8f7.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\OpenInForeground = "0" d5b5fc6fddcfec0860d29558ac2bc8f7.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\OpenAllHomePages = "1" d5b5fc6fddcfec0860d29558ac2bc8f7.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing d5b5fc6fddcfec0860d29558ac2bc8f7.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\ShortcutBehavior = "0" d5b5fc6fddcfec0860d29558ac2bc8f7.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\WarnOnClose = "1" d5b5fc6fddcfec0860d29558ac2bc8f7.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main d5b5fc6fddcfec0860d29558ac2bc8f7.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\OpenInForeground = "0" d5b5fc6fddcfec0860d29558ac2bc8f7.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\OpenInForeground = "0" d5b5fc6fddcfec0860d29558ac2bc8f7.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\Enabled = "1" d5b5fc6fddcfec0860d29558ac2bc8f7.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing d5b5fc6fddcfec0860d29558ac2bc8f7.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\PopupsUseNewWindow = "2" d5b5fc6fddcfec0860d29558ac2bc8f7.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPageShow = "2" d5b5fc6fddcfec0860d29558ac2bc8f7.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPageShow = "2" d5b5fc6fddcfec0860d29558ac2bc8f7.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\QuickTabsThreshold = "2" d5b5fc6fddcfec0860d29558ac2bc8f7.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main d5b5fc6fddcfec0860d29558ac2bc8f7.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" d5b5fc6fddcfec0860d29558ac2bc8f7.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main d5b5fc6fddcfec0860d29558ac2bc8f7.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing d5b5fc6fddcfec0860d29558ac2bc8f7.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\OpenAllHomePages = "1" d5b5fc6fddcfec0860d29558ac2bc8f7.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\PopupsUseNewWindow = "2" d5b5fc6fddcfec0860d29558ac2bc8f7.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\WarnOnClose = "1" d5b5fc6fddcfec0860d29558ac2bc8f7.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\WarnOnClose = "1" d5b5fc6fddcfec0860d29558ac2bc8f7.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\QuickTabsThreshold = "2" d5b5fc6fddcfec0860d29558ac2bc8f7.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\ShortcutBehavior = "0" d5b5fc6fddcfec0860d29558ac2bc8f7.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch d5b5fc6fddcfec0860d29558ac2bc8f7.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\OpenAllHomePages = "1" d5b5fc6fddcfec0860d29558ac2bc8f7.exe -
Suspicious behavior: EnumeratesProcesses 15 IoCs
pid Process 2644 d5b5fc6fddcfec0860d29558ac2bc8f7.exe 2644 d5b5fc6fddcfec0860d29558ac2bc8f7.exe 2644 d5b5fc6fddcfec0860d29558ac2bc8f7.exe 2644 d5b5fc6fddcfec0860d29558ac2bc8f7.exe 2644 d5b5fc6fddcfec0860d29558ac2bc8f7.exe 1784 d5b5fc6fddcfec0860d29558ac2bc8f7.exe 1784 d5b5fc6fddcfec0860d29558ac2bc8f7.exe 1784 d5b5fc6fddcfec0860d29558ac2bc8f7.exe 1784 d5b5fc6fddcfec0860d29558ac2bc8f7.exe 1784 d5b5fc6fddcfec0860d29558ac2bc8f7.exe 2848 d5b5fc6fddcfec0860d29558ac2bc8f7.exe 2848 d5b5fc6fddcfec0860d29558ac2bc8f7.exe 2848 d5b5fc6fddcfec0860d29558ac2bc8f7.exe 2848 d5b5fc6fddcfec0860d29558ac2bc8f7.exe 2848 d5b5fc6fddcfec0860d29558ac2bc8f7.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 2644 d5b5fc6fddcfec0860d29558ac2bc8f7.exe Token: SeDebugPrivilege 1784 d5b5fc6fddcfec0860d29558ac2bc8f7.exe Token: SeDebugPrivilege 2848 d5b5fc6fddcfec0860d29558ac2bc8f7.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2644 d5b5fc6fddcfec0860d29558ac2bc8f7.exe 2644 d5b5fc6fddcfec0860d29558ac2bc8f7.exe 1784 d5b5fc6fddcfec0860d29558ac2bc8f7.exe 1784 d5b5fc6fddcfec0860d29558ac2bc8f7.exe 2848 d5b5fc6fddcfec0860d29558ac2bc8f7.exe 2848 d5b5fc6fddcfec0860d29558ac2bc8f7.exe -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 2644 wrote to memory of 2724 2644 d5b5fc6fddcfec0860d29558ac2bc8f7.exe 28 PID 2644 wrote to memory of 2724 2644 d5b5fc6fddcfec0860d29558ac2bc8f7.exe 28 PID 2644 wrote to memory of 2724 2644 d5b5fc6fddcfec0860d29558ac2bc8f7.exe 28 PID 2644 wrote to memory of 2724 2644 d5b5fc6fddcfec0860d29558ac2bc8f7.exe 28 PID 2644 wrote to memory of 1784 2644 d5b5fc6fddcfec0860d29558ac2bc8f7.exe 33 PID 2644 wrote to memory of 1784 2644 d5b5fc6fddcfec0860d29558ac2bc8f7.exe 33 PID 2644 wrote to memory of 1784 2644 d5b5fc6fddcfec0860d29558ac2bc8f7.exe 33 PID 2644 wrote to memory of 1784 2644 d5b5fc6fddcfec0860d29558ac2bc8f7.exe 33 PID 1784 wrote to memory of 1624 1784 d5b5fc6fddcfec0860d29558ac2bc8f7.exe 34 PID 1784 wrote to memory of 1624 1784 d5b5fc6fddcfec0860d29558ac2bc8f7.exe 34 PID 1784 wrote to memory of 1624 1784 d5b5fc6fddcfec0860d29558ac2bc8f7.exe 34 PID 1784 wrote to memory of 1624 1784 d5b5fc6fddcfec0860d29558ac2bc8f7.exe 34 PID 1784 wrote to memory of 2848 1784 d5b5fc6fddcfec0860d29558ac2bc8f7.exe 40 PID 1784 wrote to memory of 2848 1784 d5b5fc6fddcfec0860d29558ac2bc8f7.exe 40 PID 1784 wrote to memory of 2848 1784 d5b5fc6fddcfec0860d29558ac2bc8f7.exe 40 PID 1784 wrote to memory of 2848 1784 d5b5fc6fddcfec0860d29558ac2bc8f7.exe 40 PID 2848 wrote to memory of 1912 2848 d5b5fc6fddcfec0860d29558ac2bc8f7.exe 41 PID 2848 wrote to memory of 1912 2848 d5b5fc6fddcfec0860d29558ac2bc8f7.exe 41 PID 2848 wrote to memory of 1912 2848 d5b5fc6fddcfec0860d29558ac2bc8f7.exe 41 PID 2848 wrote to memory of 1912 2848 d5b5fc6fddcfec0860d29558ac2bc8f7.exe 41
Processes
-
C:\Users\Admin\AppData\Local\Temp\d5b5fc6fddcfec0860d29558ac2bc8f7.exe"C:\Users\Admin\AppData\Local\Temp\d5b5fc6fddcfec0860d29558ac2bc8f7.exe"1⤵
- Modifies WinLogon for persistence
- Enumerates connected drives
- Drops file in System32 directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\Windows\SysWOW64\cmd.execmd /c _dcp.bat2⤵
- Drops file in System32 directory
PID:2724
-
-
C:\Users\Admin\AppData\Local\Temp\d5b5fc6fddcfec0860d29558ac2bc8f7.exeC:\Users\Admin\AppData\Local\Temp\d5b5fc6fddcfec0860d29558ac2bc8f7.exe2⤵
- Modifies WinLogon for persistence
- Enumerates connected drives
- Drops file in System32 directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1784 -
C:\Windows\SysWOW64\cmd.execmd /c _dcp.bat3⤵
- Drops file in System32 directory
PID:1624
-
-
C:\Users\Admin\AppData\Local\Temp\d5b5fc6fddcfec0860d29558ac2bc8f7.exeC:\Users\Admin\AppData\Local\Temp\d5b5fc6fddcfec0860d29558ac2bc8f7.exe3⤵
- Modifies WinLogon for persistence
- Enumerates connected drives
- Drops file in System32 directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\Windows\SysWOW64\cmd.execmd /c _dcp.bat4⤵PID:1912
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\CY2G78MW\httpErrorPagesScripts[1]
Filesize8KB
MD53f57b781cb3ef114dd0b665151571b7b
SHA1ce6a63f996df3a1cccb81720e21204b825e0238c
SHA25646e019fa34465f4ed096a9665d1827b54553931ad82e98be01edb1ddbc94d3ad
SHA5128cbf4ef582332ae7ea605f910ad6f8a4bc28513482409fa84f08943a72cac2cf0fa32b6af4c20c697e1fac2c5ba16b5a64a23af0c11eefbf69625b8f9f90c8fa
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RSAB58HZ\NewErrorPageTemplate[1]
Filesize1KB
MD5cdf81e591d9cbfb47a7f97a2bcdb70b9
SHA18f12010dfaacdecad77b70a3e781c707cf328496
SHA256204d95c6fb161368c795bb63e538fe0b11f9e406494bb5758b3b0d60c5f651bd
SHA512977dcc2c6488acaf0e5970cef1a7a72c9f9dc6bb82da54f057e0853c8e939e4ab01b163eb7a5058e093a8bc44ecad9d06880fdc883e67e28ac67fee4d070a4cc
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RSAB58HZ\dnserrordiagoff[1]
Filesize1KB
MD547f581b112d58eda23ea8b2e08cf0ff0
SHA16ec1df5eaec1439573aef0fb96dabfc953305e5b
SHA256b1c947d00db5fce43314c56c663dbeae0ffa13407c9c16225c17ccefc3afa928
SHA512187383eef3d646091e9f68eff680a11c7947b3d9b54a78cc6de4a04629d7037e9c97673ac054a6f1cf591235c110ca181a6b69ecba0e5032168f56f4486fff92
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RYNL6UIN\errorPageStrings[1]
Filesize2KB
MD5e3e4a98353f119b80b323302f26b78fa
SHA120ee35a370cdd3a8a7d04b506410300fd0a6a864
SHA2569466d620dc57835a2475f8f71e304f54aee7160e134ba160baae0f19e5e71e66
SHA512d8e4d73c76804a5abebd5dbc3a86dcdb6e73107b873175a8de67332c113fb7c4899890bf7972e467866fa4cd100a7e2a10a770e5a9c41cbf23b54351b771dcee
-
Filesize
121B
MD5de937f28070fb33562610c4f1ededdef
SHA1b056d3bf292716572f9313a4601e085a8e3f3299
SHA256f1b6cce184f0ba6d2abaa9a5135cff49c65f3deb7a061b718175f57ef85c59d4
SHA5129b1bc39e7f268dbe4639cc15c8f3666e88164f2e33cf03670aeda4392e9efa3cbb04c82bfb24a5c8fe050c7521f1464c86faf361efa80f94604b436f21c1665b
-
Filesize
26KB
MD561ac3efdfacfdd3f0f11dd4fd4044223
SHA1211295ccda6cf6409189279bf66a212bd53fc650
SHA256538fe1012fedc72727a8de0c2c01944b3d35c29812ecef88e95aac07235e0b0b
SHA512754aefaa81b2435e05037c0a7d057fd86ef8f62d49aad399d7fc4ead1e68793e5cc9ba639245a133cfb6f67d1f4bb6a95a972da3ef4ed92855cb1742241f89eb
-
Filesize
26KB
MD5a3d7983aba25a30a72a2ef804db5623b
SHA1809ad7dadbfc46988dd8138a81fcba4f652e3b20
SHA2560c35865eec2cf793b54c4c420887951a56ee651be16a620d880ea7bd9772bb26
SHA512fc779e2a8132cf39ac6abbbabbb70294e90f683c32e43ec31f15caab00b7f8fcb258f4f22fabbaf0c5bda4ce59f2b22be452fff53b75dafdbb66a2e9ef0aeb1d
-
Filesize
226KB
MD5d5b5fc6fddcfec0860d29558ac2bc8f7
SHA12d3ffedd820f8039e8705a7c108c98fcdc644f17
SHA2566324a3ae7be406da03c391a83c0562d438c62a1cbed0d2fcbe0e2a1144ab7e84
SHA5120dfe4d7a55454ddcbec1e8c8ac981933ec1f5eb9e8ce42eb74caaf221d42ea5d77dc99492e9b5c9d20818bce081a12685b3a3a7e2f5025416d36f07ea76a6374