Analysis
-
max time kernel
151s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
23-04-2024 04:02
Static task
static1
Behavioral task
behavioral1
Sample
cd7c18a8df57946a2e161a8b9f2e45d8d1a98377298dd4cc678e0faba8357124.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
cd7c18a8df57946a2e161a8b9f2e45d8d1a98377298dd4cc678e0faba8357124.exe
Resource
win10v2004-20240226-en
General
-
Target
cd7c18a8df57946a2e161a8b9f2e45d8d1a98377298dd4cc678e0faba8357124.exe
-
Size
5.9MB
-
MD5
2e059dba0c532c7a5b25c15b7d05ff1e
-
SHA1
c44e87fd2efcc1ffc180ef95fae719fe1e90a7f9
-
SHA256
cd7c18a8df57946a2e161a8b9f2e45d8d1a98377298dd4cc678e0faba8357124
-
SHA512
508d869f972b7a384564501995f9eed62cf0df2ef88fdaa5a92e0f293ddd54938feb1f66761510e5f892f5a36a58fd42ad20472ede3f808f2fc8955989207034
-
SSDEEP
98304:mn4fMJBeiJ9a3N8rP4S18frP3wbzWFimaI7dloh:iPBeiJ9ad9gbzWFimaI7dl+
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
Processes:
explorer.exesvchost.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" svchost.exe -
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 1 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\cd7c18a8df57946a2e161a8b9f2e45d8d1a98377298dd4cc678e0faba8357124.exe INDICATOR_SUSPICIOUS_Binary_References_Browsers -
Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\cd7c18a8df57946a2e161a8b9f2e45d8d1a98377298dd4cc678e0faba8357124.exe INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
cd7c18a8df57946a2e161a8b9f2e45d8d1a98377298dd4cc678e0faba8357124.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation cd7c18a8df57946a2e161a8b9f2e45d8d1a98377298dd4cc678e0faba8357124.exe -
Executes dropped EXE 6 IoCs
Processes:
cd7c18a8df57946a2e161a8b9f2e45d8d1a98377298dd4cc678e0faba8357124.exe icsys.icn.exeexplorer.exespoolsv.exesvchost.exespoolsv.exepid process 4340 cd7c18a8df57946a2e161a8b9f2e45d8d1a98377298dd4cc678e0faba8357124.exe 3164 icsys.icn.exe 2900 explorer.exe 3876 spoolsv.exe 3488 svchost.exe 432 spoolsv.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 5 IoCs
Processes:
explorer.exesvchost.execd7c18a8df57946a2e161a8b9f2e45d8d1a98377298dd4cc678e0faba8357124.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\IDMan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cd7c18a8df57946a2e161a8b9f2e45d8d1a98377298dd4cc678e0faba8357124.exe\u00a0 /onboot" cd7c18a8df57946a2e161a8b9f2e45d8d1a98377298dd4cc678e0faba8357124.exe -
Installs/modifies Browser Helper Object 2 TTPs 8 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
Processes:
cd7c18a8df57946a2e161a8b9f2e45d8d1a98377298dd4cc678e0faba8357124.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\ = "IDM Helper" cd7c18a8df57946a2e161a8b9f2e45d8d1a98377298dd4cc678e0faba8357124.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\NoExplorer = "1" cd7c18a8df57946a2e161a8b9f2e45d8d1a98377298dd4cc678e0faba8357124.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects cd7c18a8df57946a2e161a8b9f2e45d8d1a98377298dd4cc678e0faba8357124.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8} cd7c18a8df57946a2e161a8b9f2e45d8d1a98377298dd4cc678e0faba8357124.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\ = "IDM Helper" cd7c18a8df57946a2e161a8b9f2e45d8d1a98377298dd4cc678e0faba8357124.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\NoExplorer = "1" cd7c18a8df57946a2e161a8b9f2e45d8d1a98377298dd4cc678e0faba8357124.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects cd7c18a8df57946a2e161a8b9f2e45d8d1a98377298dd4cc678e0faba8357124.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8} cd7c18a8df57946a2e161a8b9f2e45d8d1a98377298dd4cc678e0faba8357124.exe -
Drops file in System32 directory 2 IoCs
Processes:
explorer.exesvchost.exedescription ioc process File opened for modification C:\Windows\SysWOW64\explorer.exe explorer.exe File opened for modification C:\Windows\SysWOW64\explorer.exe svchost.exe -
Drops file in Windows directory 5 IoCs
Processes:
explorer.exespoolsv.execd7c18a8df57946a2e161a8b9f2e45d8d1a98377298dd4cc678e0faba8357124.exeicsys.icn.exedescription ioc process File opened for modification \??\c:\windows\resources\spoolsv.exe explorer.exe File opened for modification \??\c:\windows\resources\svchost.exe spoolsv.exe File opened for modification C:\Windows\Resources\tjud.exe explorer.exe File opened for modification C:\Windows\Resources\Themes\icsys.icn.exe cd7c18a8df57946a2e161a8b9f2e45d8d1a98377298dd4cc678e0faba8357124.exe File opened for modification \??\c:\windows\resources\themes\explorer.exe icsys.icn.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 5 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
firefox.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe -
Processes:
cd7c18a8df57946a2e161a8b9f2e45d8d1a98377298dd4cc678e0faba8357124.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\Download with IDM cd7c18a8df57946a2e161a8b9f2e45d8d1a98377298dd4cc678e0faba8357124.exe Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\Download with IDM\contexts = "243" cd7c18a8df57946a2e161a8b9f2e45d8d1a98377298dd4cc678e0faba8357124.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\AppName = "IEMonitor.exe" cd7c18a8df57946a2e161a8b9f2e45d8d1a98377298dd4cc678e0faba8357124.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\AppName = "cd7c18a8df57946a2e161a8b9f2e45d8d1a98377298dd4cc678e0faba8357124.exe\u00a0" cd7c18a8df57946a2e161a8b9f2e45d8d1a98377298dd4cc678e0faba8357124.exe Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\Policy = "3" cd7c18a8df57946a2e161a8b9f2e45d8d1a98377298dd4cc678e0faba8357124.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\AppPath = "c:\\users\\admin\\appdata\\local\\temp" cd7c18a8df57946a2e161a8b9f2e45d8d1a98377298dd4cc678e0faba8357124.exe Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\Policy = "3" cd7c18a8df57946a2e161a8b9f2e45d8d1a98377298dd4cc678e0faba8357124.exe Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote cd7c18a8df57946a2e161a8b9f2e45d8d1a98377298dd4cc678e0faba8357124.exe Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\Low Rights cd7c18a8df57946a2e161a8b9f2e45d8d1a98377298dd4cc678e0faba8357124.exe Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy cd7c18a8df57946a2e161a8b9f2e45d8d1a98377298dd4cc678e0faba8357124.exe Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4} cd7c18a8df57946a2e161a8b9f2e45d8d1a98377298dd4cc678e0faba8357124.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\AppName = "cd7c18a8df57946a2e161a8b9f2e45d8d1a98377298dd4cc678e0faba8357124.exe\u00a0" cd7c18a8df57946a2e161a8b9f2e45d8d1a98377298dd4cc678e0faba8357124.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\DownloadUI = "{7D11E719-FF90-479C-B0D7-96EB43EE55D7}" cd7c18a8df57946a2e161a8b9f2e45d8d1a98377298dd4cc678e0faba8357124.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\DownloadUI = "{7D11E719-FF90-479C-B0D7-96EB43EE55D7}" cd7c18a8df57946a2e161a8b9f2e45d8d1a98377298dd4cc678e0faba8357124.exe Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel cd7c18a8df57946a2e161a8b9f2e45d8d1a98377298dd4cc678e0faba8357124.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\Download with IDM\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\IEExt.htm" cd7c18a8df57946a2e161a8b9f2e45d8d1a98377298dd4cc678e0faba8357124.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\AppPath = "c:\\users\\admin\\appdata\\local\\temp" cd7c18a8df57946a2e161a8b9f2e45d8d1a98377298dd4cc678e0faba8357124.exe Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop cd7c18a8df57946a2e161a8b9f2e45d8d1a98377298dd4cc678e0faba8357124.exe Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006} cd7c18a8df57946a2e161a8b9f2e45d8d1a98377298dd4cc678e0faba8357124.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\AppPath = "c:\\users\\admin\\appdata\\local\\temp" cd7c18a8df57946a2e161a8b9f2e45d8d1a98377298dd4cc678e0faba8357124.exe Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A} cd7c18a8df57946a2e161a8b9f2e45d8d1a98377298dd4cc678e0faba8357124.exe Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\Policy = "3" cd7c18a8df57946a2e161a8b9f2e45d8d1a98377298dd4cc678e0faba8357124.exe -
Modifies registry class 16 IoCs
Processes:
cd7c18a8df57946a2e161a8b9f2e45d8d1a98377298dd4cc678e0faba8357124.exe firefox.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter\CLSID\ = "{AC746233-E9D3-49CD-862F-068F7B7CCCA4}" cd7c18a8df57946a2e161a8b9f2e45d8d1a98377298dd4cc678e0faba8357124.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ = "IDMan.CIDMLinkTransmitter" cd7c18a8df57946a2e161a8b9f2e45d8d1a98377298dd4cc678e0faba8357124.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\LocalServer32 cd7c18a8df57946a2e161a8b9f2e45d8d1a98377298dd4cc678e0faba8357124.exe Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\WOW6432Node\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7} cd7c18a8df57946a2e161a8b9f2e45d8d1a98377298dd4cc678e0faba8357124.exe Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\WOW6432Node\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}\Therad = "1" cd7c18a8df57946a2e161a8b9f2e45d8d1a98377298dd4cc678e0faba8357124.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter\CLSID cd7c18a8df57946a2e161a8b9f2e45d8d1a98377298dd4cc678e0faba8357124.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4} cd7c18a8df57946a2e161a8b9f2e45d8d1a98377298dd4cc678e0faba8357124.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ = "IDMan" cd7c18a8df57946a2e161a8b9f2e45d8d1a98377298dd4cc678e0faba8357124.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\RunAs = "Interactive User" cd7c18a8df57946a2e161a8b9f2e45d8d1a98377298dd4cc678e0faba8357124.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter cd7c18a8df57946a2e161a8b9f2e45d8d1a98377298dd4cc678e0faba8357124.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\AppID = "{AC746233-E9D3-49CD-862F-068F7B7CCCA4}" cd7c18a8df57946a2e161a8b9f2e45d8d1a98377298dd4cc678e0faba8357124.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cd7c18a8df57946a2e161a8b9f2e45d8d1a98377298dd4cc678e0faba8357124.exe\u00a0" cd7c18a8df57946a2e161a8b9f2e45d8d1a98377298dd4cc678e0faba8357124.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4} cd7c18a8df57946a2e161a8b9f2e45d8d1a98377298dd4cc678e0faba8357124.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ROTFlags = "1" cd7c18a8df57946a2e161a8b9f2e45d8d1a98377298dd4cc678e0faba8357124.exe Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings firefox.exe Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\WOW6432Node\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}\Model = "113" cd7c18a8df57946a2e161a8b9f2e45d8d1a98377298dd4cc678e0faba8357124.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
cd7c18a8df57946a2e161a8b9f2e45d8d1a98377298dd4cc678e0faba8357124.exeicsys.icn.exepid process 4292 cd7c18a8df57946a2e161a8b9f2e45d8d1a98377298dd4cc678e0faba8357124.exe 4292 cd7c18a8df57946a2e161a8b9f2e45d8d1a98377298dd4cc678e0faba8357124.exe 4292 cd7c18a8df57946a2e161a8b9f2e45d8d1a98377298dd4cc678e0faba8357124.exe 4292 cd7c18a8df57946a2e161a8b9f2e45d8d1a98377298dd4cc678e0faba8357124.exe 4292 cd7c18a8df57946a2e161a8b9f2e45d8d1a98377298dd4cc678e0faba8357124.exe 4292 cd7c18a8df57946a2e161a8b9f2e45d8d1a98377298dd4cc678e0faba8357124.exe 4292 cd7c18a8df57946a2e161a8b9f2e45d8d1a98377298dd4cc678e0faba8357124.exe 4292 cd7c18a8df57946a2e161a8b9f2e45d8d1a98377298dd4cc678e0faba8357124.exe 4292 cd7c18a8df57946a2e161a8b9f2e45d8d1a98377298dd4cc678e0faba8357124.exe 4292 cd7c18a8df57946a2e161a8b9f2e45d8d1a98377298dd4cc678e0faba8357124.exe 4292 cd7c18a8df57946a2e161a8b9f2e45d8d1a98377298dd4cc678e0faba8357124.exe 4292 cd7c18a8df57946a2e161a8b9f2e45d8d1a98377298dd4cc678e0faba8357124.exe 4292 cd7c18a8df57946a2e161a8b9f2e45d8d1a98377298dd4cc678e0faba8357124.exe 4292 cd7c18a8df57946a2e161a8b9f2e45d8d1a98377298dd4cc678e0faba8357124.exe 4292 cd7c18a8df57946a2e161a8b9f2e45d8d1a98377298dd4cc678e0faba8357124.exe 4292 cd7c18a8df57946a2e161a8b9f2e45d8d1a98377298dd4cc678e0faba8357124.exe 4292 cd7c18a8df57946a2e161a8b9f2e45d8d1a98377298dd4cc678e0faba8357124.exe 4292 cd7c18a8df57946a2e161a8b9f2e45d8d1a98377298dd4cc678e0faba8357124.exe 4292 cd7c18a8df57946a2e161a8b9f2e45d8d1a98377298dd4cc678e0faba8357124.exe 4292 cd7c18a8df57946a2e161a8b9f2e45d8d1a98377298dd4cc678e0faba8357124.exe 4292 cd7c18a8df57946a2e161a8b9f2e45d8d1a98377298dd4cc678e0faba8357124.exe 4292 cd7c18a8df57946a2e161a8b9f2e45d8d1a98377298dd4cc678e0faba8357124.exe 4292 cd7c18a8df57946a2e161a8b9f2e45d8d1a98377298dd4cc678e0faba8357124.exe 4292 cd7c18a8df57946a2e161a8b9f2e45d8d1a98377298dd4cc678e0faba8357124.exe 4292 cd7c18a8df57946a2e161a8b9f2e45d8d1a98377298dd4cc678e0faba8357124.exe 4292 cd7c18a8df57946a2e161a8b9f2e45d8d1a98377298dd4cc678e0faba8357124.exe 4292 cd7c18a8df57946a2e161a8b9f2e45d8d1a98377298dd4cc678e0faba8357124.exe 4292 cd7c18a8df57946a2e161a8b9f2e45d8d1a98377298dd4cc678e0faba8357124.exe 4292 cd7c18a8df57946a2e161a8b9f2e45d8d1a98377298dd4cc678e0faba8357124.exe 4292 cd7c18a8df57946a2e161a8b9f2e45d8d1a98377298dd4cc678e0faba8357124.exe 4292 cd7c18a8df57946a2e161a8b9f2e45d8d1a98377298dd4cc678e0faba8357124.exe 4292 cd7c18a8df57946a2e161a8b9f2e45d8d1a98377298dd4cc678e0faba8357124.exe 3164 icsys.icn.exe 3164 icsys.icn.exe 3164 icsys.icn.exe 3164 icsys.icn.exe 3164 icsys.icn.exe 3164 icsys.icn.exe 3164 icsys.icn.exe 3164 icsys.icn.exe 3164 icsys.icn.exe 3164 icsys.icn.exe 3164 icsys.icn.exe 3164 icsys.icn.exe 3164 icsys.icn.exe 3164 icsys.icn.exe 3164 icsys.icn.exe 3164 icsys.icn.exe 3164 icsys.icn.exe 3164 icsys.icn.exe 3164 icsys.icn.exe 3164 icsys.icn.exe 3164 icsys.icn.exe 3164 icsys.icn.exe 3164 icsys.icn.exe 3164 icsys.icn.exe 3164 icsys.icn.exe 3164 icsys.icn.exe 3164 icsys.icn.exe 3164 icsys.icn.exe 3164 icsys.icn.exe 3164 icsys.icn.exe 3164 icsys.icn.exe 3164 icsys.icn.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
Processes:
explorer.exesvchost.exepid process 2900 explorer.exe 3488 svchost.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
cd7c18a8df57946a2e161a8b9f2e45d8d1a98377298dd4cc678e0faba8357124.exe firefox.exedescription pid process Token: SeRestorePrivilege 4340 cd7c18a8df57946a2e161a8b9f2e45d8d1a98377298dd4cc678e0faba8357124.exe Token: SeDebugPrivilege 2676 firefox.exe Token: SeDebugPrivilege 2676 firefox.exe Token: SeDebugPrivilege 2676 firefox.exe Token: SeDebugPrivilege 2676 firefox.exe Token: SeDebugPrivilege 2676 firefox.exe -
Suspicious use of FindShellTrayWindow 5 IoCs
Processes:
firefox.execd7c18a8df57946a2e161a8b9f2e45d8d1a98377298dd4cc678e0faba8357124.exepid process 2676 firefox.exe 2676 firefox.exe 2676 firefox.exe 2676 firefox.exe 4340 cd7c18a8df57946a2e161a8b9f2e45d8d1a98377298dd4cc678e0faba8357124.exe -
Suspicious use of SendNotifyMessage 4 IoCs
Processes:
firefox.execd7c18a8df57946a2e161a8b9f2e45d8d1a98377298dd4cc678e0faba8357124.exepid process 2676 firefox.exe 2676 firefox.exe 2676 firefox.exe 4340 cd7c18a8df57946a2e161a8b9f2e45d8d1a98377298dd4cc678e0faba8357124.exe -
Suspicious use of SetWindowsHookEx 24 IoCs
Processes:
cd7c18a8df57946a2e161a8b9f2e45d8d1a98377298dd4cc678e0faba8357124.exeicsys.icn.exeexplorer.exespoolsv.exesvchost.exespoolsv.execd7c18a8df57946a2e161a8b9f2e45d8d1a98377298dd4cc678e0faba8357124.exe firefox.exepid process 4292 cd7c18a8df57946a2e161a8b9f2e45d8d1a98377298dd4cc678e0faba8357124.exe 4292 cd7c18a8df57946a2e161a8b9f2e45d8d1a98377298dd4cc678e0faba8357124.exe 3164 icsys.icn.exe 3164 icsys.icn.exe 2900 explorer.exe 2900 explorer.exe 3876 spoolsv.exe 3876 spoolsv.exe 3488 svchost.exe 3488 svchost.exe 432 spoolsv.exe 432 spoolsv.exe 4340 cd7c18a8df57946a2e161a8b9f2e45d8d1a98377298dd4cc678e0faba8357124.exe 4340 cd7c18a8df57946a2e161a8b9f2e45d8d1a98377298dd4cc678e0faba8357124.exe 4340 cd7c18a8df57946a2e161a8b9f2e45d8d1a98377298dd4cc678e0faba8357124.exe 2676 firefox.exe 4340 cd7c18a8df57946a2e161a8b9f2e45d8d1a98377298dd4cc678e0faba8357124.exe 4340 cd7c18a8df57946a2e161a8b9f2e45d8d1a98377298dd4cc678e0faba8357124.exe 4340 cd7c18a8df57946a2e161a8b9f2e45d8d1a98377298dd4cc678e0faba8357124.exe 4340 cd7c18a8df57946a2e161a8b9f2e45d8d1a98377298dd4cc678e0faba8357124.exe 4340 cd7c18a8df57946a2e161a8b9f2e45d8d1a98377298dd4cc678e0faba8357124.exe 4340 cd7c18a8df57946a2e161a8b9f2e45d8d1a98377298dd4cc678e0faba8357124.exe 4340 cd7c18a8df57946a2e161a8b9f2e45d8d1a98377298dd4cc678e0faba8357124.exe 4340 cd7c18a8df57946a2e161a8b9f2e45d8d1a98377298dd4cc678e0faba8357124.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
cd7c18a8df57946a2e161a8b9f2e45d8d1a98377298dd4cc678e0faba8357124.exeicsys.icn.exeexplorer.exespoolsv.exesvchost.execd7c18a8df57946a2e161a8b9f2e45d8d1a98377298dd4cc678e0faba8357124.exe firefox.exefirefox.exedescription pid process target process PID 4292 wrote to memory of 4340 4292 cd7c18a8df57946a2e161a8b9f2e45d8d1a98377298dd4cc678e0faba8357124.exe cd7c18a8df57946a2e161a8b9f2e45d8d1a98377298dd4cc678e0faba8357124.exe PID 4292 wrote to memory of 4340 4292 cd7c18a8df57946a2e161a8b9f2e45d8d1a98377298dd4cc678e0faba8357124.exe cd7c18a8df57946a2e161a8b9f2e45d8d1a98377298dd4cc678e0faba8357124.exe PID 4292 wrote to memory of 4340 4292 cd7c18a8df57946a2e161a8b9f2e45d8d1a98377298dd4cc678e0faba8357124.exe cd7c18a8df57946a2e161a8b9f2e45d8d1a98377298dd4cc678e0faba8357124.exe PID 4292 wrote to memory of 3164 4292 cd7c18a8df57946a2e161a8b9f2e45d8d1a98377298dd4cc678e0faba8357124.exe icsys.icn.exe PID 4292 wrote to memory of 3164 4292 cd7c18a8df57946a2e161a8b9f2e45d8d1a98377298dd4cc678e0faba8357124.exe icsys.icn.exe PID 4292 wrote to memory of 3164 4292 cd7c18a8df57946a2e161a8b9f2e45d8d1a98377298dd4cc678e0faba8357124.exe icsys.icn.exe PID 3164 wrote to memory of 2900 3164 icsys.icn.exe explorer.exe PID 3164 wrote to memory of 2900 3164 icsys.icn.exe explorer.exe PID 3164 wrote to memory of 2900 3164 icsys.icn.exe explorer.exe PID 2900 wrote to memory of 3876 2900 explorer.exe spoolsv.exe PID 2900 wrote to memory of 3876 2900 explorer.exe spoolsv.exe PID 2900 wrote to memory of 3876 2900 explorer.exe spoolsv.exe PID 3876 wrote to memory of 3488 3876 spoolsv.exe svchost.exe PID 3876 wrote to memory of 3488 3876 spoolsv.exe svchost.exe PID 3876 wrote to memory of 3488 3876 spoolsv.exe svchost.exe PID 3488 wrote to memory of 432 3488 svchost.exe spoolsv.exe PID 3488 wrote to memory of 432 3488 svchost.exe spoolsv.exe PID 3488 wrote to memory of 432 3488 svchost.exe spoolsv.exe PID 4340 wrote to memory of 1936 4340 cd7c18a8df57946a2e161a8b9f2e45d8d1a98377298dd4cc678e0faba8357124.exe regsvr32.exe PID 4340 wrote to memory of 1936 4340 cd7c18a8df57946a2e161a8b9f2e45d8d1a98377298dd4cc678e0faba8357124.exe regsvr32.exe PID 4340 wrote to memory of 1936 4340 cd7c18a8df57946a2e161a8b9f2e45d8d1a98377298dd4cc678e0faba8357124.exe regsvr32.exe PID 4340 wrote to memory of 3584 4340 cd7c18a8df57946a2e161a8b9f2e45d8d1a98377298dd4cc678e0faba8357124.exe firefox.exe PID 4340 wrote to memory of 3584 4340 cd7c18a8df57946a2e161a8b9f2e45d8d1a98377298dd4cc678e0faba8357124.exe firefox.exe PID 3584 wrote to memory of 2676 3584 firefox.exe firefox.exe PID 3584 wrote to memory of 2676 3584 firefox.exe firefox.exe PID 3584 wrote to memory of 2676 3584 firefox.exe firefox.exe PID 3584 wrote to memory of 2676 3584 firefox.exe firefox.exe PID 3584 wrote to memory of 2676 3584 firefox.exe firefox.exe PID 3584 wrote to memory of 2676 3584 firefox.exe firefox.exe PID 3584 wrote to memory of 2676 3584 firefox.exe firefox.exe PID 3584 wrote to memory of 2676 3584 firefox.exe firefox.exe PID 3584 wrote to memory of 2676 3584 firefox.exe firefox.exe PID 3584 wrote to memory of 2676 3584 firefox.exe firefox.exe PID 3584 wrote to memory of 2676 3584 firefox.exe firefox.exe PID 2676 wrote to memory of 2344 2676 firefox.exe firefox.exe PID 2676 wrote to memory of 2344 2676 firefox.exe firefox.exe PID 2676 wrote to memory of 2124 2676 firefox.exe firefox.exe PID 2676 wrote to memory of 2124 2676 firefox.exe firefox.exe PID 2676 wrote to memory of 2124 2676 firefox.exe firefox.exe PID 2676 wrote to memory of 2124 2676 firefox.exe firefox.exe PID 2676 wrote to memory of 2124 2676 firefox.exe firefox.exe PID 2676 wrote to memory of 2124 2676 firefox.exe firefox.exe PID 2676 wrote to memory of 2124 2676 firefox.exe firefox.exe PID 2676 wrote to memory of 2124 2676 firefox.exe firefox.exe PID 2676 wrote to memory of 2124 2676 firefox.exe firefox.exe PID 2676 wrote to memory of 2124 2676 firefox.exe firefox.exe PID 2676 wrote to memory of 2124 2676 firefox.exe firefox.exe PID 2676 wrote to memory of 2124 2676 firefox.exe firefox.exe PID 2676 wrote to memory of 2124 2676 firefox.exe firefox.exe PID 2676 wrote to memory of 2124 2676 firefox.exe firefox.exe PID 2676 wrote to memory of 2124 2676 firefox.exe firefox.exe PID 2676 wrote to memory of 2124 2676 firefox.exe firefox.exe PID 2676 wrote to memory of 2124 2676 firefox.exe firefox.exe PID 2676 wrote to memory of 2124 2676 firefox.exe firefox.exe PID 2676 wrote to memory of 2124 2676 firefox.exe firefox.exe PID 2676 wrote to memory of 2124 2676 firefox.exe firefox.exe PID 2676 wrote to memory of 2124 2676 firefox.exe firefox.exe PID 2676 wrote to memory of 2124 2676 firefox.exe firefox.exe PID 2676 wrote to memory of 2124 2676 firefox.exe firefox.exe PID 2676 wrote to memory of 2124 2676 firefox.exe firefox.exe PID 2676 wrote to memory of 2124 2676 firefox.exe firefox.exe PID 2676 wrote to memory of 2124 2676 firefox.exe firefox.exe PID 2676 wrote to memory of 2124 2676 firefox.exe firefox.exe PID 2676 wrote to memory of 2124 2676 firefox.exe firefox.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\cd7c18a8df57946a2e161a8b9f2e45d8d1a98377298dd4cc678e0faba8357124.exe"C:\Users\Admin\AppData\Local\Temp\cd7c18a8df57946a2e161a8b9f2e45d8d1a98377298dd4cc678e0faba8357124.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\users\admin\appdata\local\temp\cd7c18a8df57946a2e161a8b9f2e45d8d1a98377298dd4cc678e0faba8357124.exec:\users\admin\appdata\local\temp\cd7c18a8df57946a2e161a8b9f2e45d8d1a98377298dd4cc678e0faba8357124.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Installs/modifies Browser Helper Object
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMShellExt64.dll"3⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html3⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html4⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2676.0.1181016548\1645234152" -parentBuildID 20221007134813 -prefsHandle 1900 -prefMapHandle 1892 -prefsLen 20749 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a0d857ed-60ef-4aa6-bdc9-eec2a44ac1f2} 2676 "\\.\pipe\gecko-crash-server-pipe.2676" 1980 299c27d2f58 gpu5⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2676.1.905505408\227677902" -parentBuildID 20221007134813 -prefsHandle 2384 -prefMapHandle 2380 -prefsLen 21565 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1bff89ff-7e9c-4cf6-82f5-25ef2b8e2b5a} 2676 "\\.\pipe\gecko-crash-server-pipe.2676" 2404 299c270a558 socket5⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2676.2.823740863\1663788771" -childID 1 -isForBrowser -prefsHandle 3148 -prefMapHandle 3144 -prefsLen 21668 -prefMapSize 233444 -jsInitHandle 1368 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d7490313-20ea-4302-8275-bc35134fdac1} 2676 "\\.\pipe\gecko-crash-server-pipe.2676" 3160 299c67d6958 tab5⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2676.3.1477204717\136260818" -childID 2 -isForBrowser -prefsHandle 3944 -prefMapHandle 3940 -prefsLen 26066 -prefMapSize 233444 -jsInitHandle 1368 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4b427151-7016-467d-9feb-a9625c11ef18} 2676 "\\.\pipe\gecko-crash-server-pipe.2676" 1328 299ae962b58 tab5⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2676.4.702408826\888426991" -childID 3 -isForBrowser -prefsHandle 4556 -prefMapHandle 4564 -prefsLen 26125 -prefMapSize 233444 -jsInitHandle 1368 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ffd080ec-6770-4084-8cf5-a07ebe2931f0} 2676 "\\.\pipe\gecko-crash-server-pipe.2676" 4712 299c8b8d158 tab5⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2676.5.392525642\1247525400" -childID 4 -isForBrowser -prefsHandle 5084 -prefMapHandle 5080 -prefsLen 26206 -prefMapSize 233444 -jsInitHandle 1368 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d8f75355-4018-4592-a280-763b8d677a8d} 2676 "\\.\pipe\gecko-crash-server-pipe.2676" 5060 299c933b558 tab5⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2676.6.1170367565\572939344" -childID 5 -isForBrowser -prefsHandle 5204 -prefMapHandle 5208 -prefsLen 26206 -prefMapSize 233444 -jsInitHandle 1368 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f788754c-2d8e-478e-ace0-0a3a4beafa8a} 2676 "\\.\pipe\gecko-crash-server-pipe.2676" 5192 299c94cfb58 tab5⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2676.7.1336040444\1422127572" -childID 6 -isForBrowser -prefsHandle 5404 -prefMapHandle 5408 -prefsLen 26206 -prefMapSize 233444 -jsInitHandle 1368 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {dd72acdd-7151-4950-ac63-c26205838cea} 2676 "\\.\pipe\gecko-crash-server-pipe.2676" 5392 299c94cfe58 tab5⤵
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMShellExt64.dll"3⤵
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMIECC64.dll"3⤵
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMGetAll64.dll"3⤵
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\downlWithIDM64.dll"3⤵
-
C:\Windows\Resources\Themes\icsys.icn.exeC:\Windows\Resources\Themes\icsys.icn.exe2⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\themes\explorer.exec:\windows\resources\themes\explorer.exe3⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe SE4⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\svchost.exec:\windows\resources\svchost.exe5⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe PR6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4080 --field-trial-handle=2252,i,16504368816373493055,9578615028378602855,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Browser Extensions
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\cd7c18a8df57946a2e161a8b9f2e45d8d1a98377298dd4cc678e0faba8357124.exeFilesize
5.7MB
MD50c889b8415364665b7bc6e5fc62725af
SHA1a93e0c73c53b5f80d9d62b403999794479fab716
SHA2561e273066687517e46447b352dd2f6c836e7c8109ef7053d286c0dd3432eb8cca
SHA512922a89714e7cd86e05c62579344cda82cdd531556ab5255ff41a85a58c9cbfe294f9dbb00d4a9cfd94420993587920eb04ef850951cb961612980e049e40f618
-
C:\Users\Admin\AppData\Local\Temp\tmpaddonFilesize
442KB
MD585430baed3398695717b0263807cf97c
SHA1fffbee923cea216f50fce5d54219a188a5100f41
SHA256a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e
SHA51206511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1
-
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1Filesize
8.0MB
MD5a01c5ecd6108350ae23d2cddf0e77c17
SHA1c6ac28a2cd979f1f9a75d56271821d5ff665e2b6
SHA256345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42
SHA512b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\datareporting\glean\db\data.safe.binFilesize
2KB
MD5a586f3c5d6fb42ac813b16d416af69b1
SHA174ccf2125903721e46aa010117216aadadcf2dbf
SHA256222610938f63fe5cafdab94eb60be346ecbc20ed841ea8542936c1fc251819e3
SHA512a6d76ec18e67381d1f7267cbb4b2ea3b5082f343b4ab728b985183d8b678b57105cd6b69fb0e059dd8ae69dcd476921775c9302dc03acb90fac532f28d116189
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\datareporting\glean\pending_pings\85966345-d8d2-419b-a063-fe63e8077aaeFilesize
10KB
MD52d254f5c4378efc9f33c70d4a1f3d05e
SHA163dc2863de0fd6c04cf8e95cbe9e1ed3a6b63044
SHA25626785b19c303848eadc5e93a43574fef346f42acb07a1f39deb107be8ff58a03
SHA512026d1710cb91201d97060f8fe806131584c2b3a3742ff0ae9f359d9bd13e587a7fd8454665fa54eb547d4ae028a23ab56955da469abf7c20d189ee6cad5ee079
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\datareporting\glean\pending_pings\e60c83e8-b9f8-49fa-b98b-d188483dfa70Filesize
746B
MD56c98d9d4c3cf88517d8482e0eff8750f
SHA1aa0ae3c9cfa9056ad20f99382696a273016fa509
SHA2562e6a000f592d9deada21b92fb65f7f6579160a16800df2b2af6e86c3d72d055f
SHA512e66fe2bdadf3e43c3b7ea5345b7f07fab3c6c2fe04834e259b387abcfc5d17af9d28372f3d76bd5350ea05d11490a19a460dc725e18d9f9664d2f263cdd08c19
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dllFilesize
997KB
MD5fe3355639648c417e8307c6d051e3e37
SHA1f54602d4b4778da21bc97c7238fc66aa68c8ee34
SHA2561ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e
SHA5128f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.infoFilesize
116B
MD53d33cdc0b3d281e67dd52e14435dd04f
SHA14db88689282fd4f9e9e6ab95fcbb23df6e6485db
SHA256f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b
SHA512a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txtFilesize
479B
MD549ddb419d96dceb9069018535fb2e2fc
SHA162aa6fea895a8b68d468a015f6e6ab400d7a7ca6
SHA2562af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539
SHA51248386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\gmp-widevinecdm\4.10.2557.0\manifest.jsonFilesize
372B
MD58be33af717bb1b67fbd61c3f4b807e9e
SHA17cf17656d174d951957ff36810e874a134dd49e0
SHA256e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd
SHA5126125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dllFilesize
11.8MB
MD533bf7b0439480effb9fb212efce87b13
SHA1cee50f2745edc6dc291887b6075ca64d716f495a
SHA2568ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e
SHA512d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.libFilesize
1KB
MD5688bed3676d2104e7f17ae1cd2c59404
SHA1952b2cdf783ac72fcb98338723e9afd38d47ad8e
SHA25633899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237
SHA5127a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sigFilesize
1KB
MD5937326fead5fd401f6cca9118bd9ade9
SHA14526a57d4ae14ed29b37632c72aef3c408189d91
SHA25668a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81
SHA512b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\prefs-1.jsFilesize
6KB
MD5b4f77da135f90b95056525eaf6be231f
SHA1854a7e9911d7303b0d496ad6c63603eecbad8886
SHA2561876b343aa7b4c3dc2ef4d9b6f35562ff73ad5d28c34b1cef266662475f29294
SHA5125326251bd0916403bab1f438a8fe95fa9b5546add561cbf7218f9e1f40d61b06408fc32c2a4b7d6f7fc3b66fb781ec66de8242a65f945e585c539e5f07abeebc
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\prefs-1.jsFilesize
6KB
MD5ed289931cc22eb002dea24ac0201f963
SHA138cfeb66fed9274d50c230ab12713f163fa12cfe
SHA256ff7fd0499618739b9cd5de1b928d70bd5af0b8ccf5d94e26874a86a5ff992ef2
SHA5121804a7d44908b093399327f82ee4faa5a04a05e17cb48a15b81483182c88424987c5c2d1b26d26fc3d86d9e2e706bcbd936b7ae7146476a4b2b0716795fdabb3
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\prefs.jsFilesize
6KB
MD5bb2204172c059dd0dd2e6c9d10c20ab8
SHA1d25a3751237f28cfd93473b096bff589b3e0f6a3
SHA2561d78282fc0b388023d7df41b09199124d08027f0caee59bf4e2b47bb4e6c6ec8
SHA5128c1fcef22f21a08a084a2aca2fdcea6ad44e836bee05010249015799fcfa357e9b67df28224211858c667f8cc0d9351283176ea5573adf42973ca88b3553b32d
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\sessionstore-backups\recovery.jsonlz4Filesize
3KB
MD50473a5ba1d95fee3c2f9d6c9daacafc8
SHA1437cd461102934e866ad0e545f37f1d2f2836bcc
SHA256814a912243f9e8dc5d43e0a02387ea1fa373d86ebc74bba63ecf79f85f42ad82
SHA5127fc91f60f001750a7a418b9f78b618d2bff312fa7f980c97257cff28244bf5aaad49e791c5da4fb47e14278b938c48c21b2ee1ad9dfef6c1627c90e58691d7d6
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\sessionstore-backups\recovery.jsonlz4Filesize
3KB
MD5569cebd2e41804626875bf0169ef1e9c
SHA14e9c9dbd38f554e43484af5872b8da204f576439
SHA2561fe277759c1cebb9279a15d1fb838f49cd4ff3e4886e1061a11bc66fe4d69ba8
SHA512ebd620b8de74ab179ebf7dbeea6731afcee16e53d666401dae085932014be6358903052dc2fc002fb7a30217746c416b7c591140c3c19c163b680e80ccf01157
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqliteFilesize
184KB
MD589fb414d778d11d3a12991de60301815
SHA11d7a63ca92d9ad28930ce2feaac8c71c3f699ef7
SHA256935ba660008416f0b46a028a709944f11f9c2858243a2f7bc0b57aa1d96314be
SHA51249f06dc78f2e08621ba4ed19925d8c7ed040502f13edaeedc7df3d675e77417d8b7b3c0b3feaf7f4fcef989091b363f5af1fa9258de57cee5bd904e1d7a31f9b
-
C:\Windows\Resources\Themes\explorer.exeFilesize
135KB
MD56dcf0aaffa8fcfae7bc23cdf3fabc8e1
SHA1ffb63de4fb924de589ac44deb9481e306a729b8a
SHA256d8bc2fd661e1a674e29719e8896fd925a208bf56a50650d939f8ca7c3d32bd47
SHA512c27ebe7e912d84345f128ce5b4ce936f76fcc5c94e2685f5112d1f6eafdea91b33503aff6f4ee5d497d6800e7a44e0218c49c5c6579c36c681732e91240da3b7
-
C:\Windows\Resources\Themes\icsys.icn.exeFilesize
135KB
MD5a62fc56abb4fd9bf87c0ec9c26907294
SHA1c8ff2b48983208d96c996ddd8eea972e4d3329fe
SHA256b8298629e3c2de9493dcc939f45c31e8e5a254bfd8a987c12efb5e05541046c7
SHA512e211161a423605c7f129c075ba9c4a9476e01e18d26708663281a9566ff7b73516e7a8028bf15c5b377e7865860d0497607cf478998e6af14405af87cd963b10
-
C:\Windows\Resources\spoolsv.exeFilesize
135KB
MD510aa979037c4baadbc524b2084d52932
SHA17624473f9268f469c2969684f71706fa9f97432c
SHA256b941f9b53e015c8b071e774f344fb06515f706e710e7d8cb3fa66e7fddecafb2
SHA512e5e6c5a32643411b8c12cac899f7a4c7095469066b5ec43a3cd4810c8582521099a025c2ab5552a477eec390c6e8aaaea402f5a17757d359062598dd69a0b613
-
C:\Windows\Resources\svchost.exeFilesize
135KB
MD586af8077bba86d4e0c6254cc6718ae07
SHA104469aa39885506732ea486d0f4d850397f07cbb
SHA2568af75a98d0df3ef8160f6b2baa85003ef27e4418e2ae3704c843094c6340915a
SHA5125c954e9bfaab0fc32dce581165911870605a2d82dabb7bc64865e5969f32d156e8a54e85c311d6c61b19bc7d619add15aaed25c0bbab57f68648bdda64f0dfd4
-
memory/432-43-0x0000000000400000-0x000000000041F000-memory.dmpFilesize
124KB
-
memory/2900-19-0x0000000000400000-0x000000000041F000-memory.dmpFilesize
124KB
-
memory/3164-45-0x0000000000400000-0x000000000041F000-memory.dmpFilesize
124KB
-
memory/3876-44-0x0000000000400000-0x000000000041F000-memory.dmpFilesize
124KB
-
memory/4292-0-0x0000000000400000-0x000000000041F000-memory.dmpFilesize
124KB
-
memory/4292-46-0x0000000000400000-0x000000000041F000-memory.dmpFilesize
124KB