hxxp://185[.]215[.]113[.]66/npp[.]exe

Resubmissions

31-05-2024 02:35

240531-c2575sdc55 10

28-04-2024 02:14

28-04-2024 02:13

28-04-2024 02:12

26-04-2024 00:04

26-04-2024 00:01

25-04-2024 23:58

25-04-2024 23:54

Analysis

max time kernel
76s
max time network
80s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
25-04-2024 23:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://185.215.113.66/npp.exe

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Modifies security service 2 TTPs 1 IoCs
evasion

Modify Registry
T1112

Windows Service
T1543.003

Processes:

973616285.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Start = "4" 973616285.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Start = "4"	973616285.exe

Windows security bypass 2 TTPs 12 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

973616285.exe3299913357.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	973616285.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesOverride = "1"	973616285.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	3299913357.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	3299913357.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	3299913357.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesOverride = "1"	3299913357.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	973616285.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	973616285.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	973616285.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	973616285.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	3299913357.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	3299913357.exe

Downloads MZ/PE file
Executes dropped EXE 7 IoCs

Processes:

npp.exe973616285.exe1348521519.exe3299913357.exe2535922855.exe3115514132.exe3143138075.exe

pid process

2568 npp.exe
3056 973616285.exe
2148 1348521519.exe
2040 3299913357.exe
1104 2535922855.exe
1996 3115514132.exe
748 3143138075.exe
Loads dropped DLL 8 IoCs

Processes:

npp.exe973616285.exe3299913357.exe

pid process

2568 npp.exe
2568 npp.exe
3056 973616285.exe
3056 973616285.exe
3056 973616285.exe
2040 3299913357.exe
2040 3299913357.exe
2040 3299913357.exe

pid	process
2568	npp.exe
3056	973616285.exe
2148	1348521519.exe
2040	3299913357.exe
1104	2535922855.exe
1996	3115514132.exe
748	3143138075.exe

pid	process
2568	npp.exe
2568	npp.exe
3056	973616285.exe
3056	973616285.exe
3056	973616285.exe
2040	3299913357.exe
2040	3299913357.exe
2040	3299913357.exe

Windows security modification 2 TTPs 14 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

973616285.exe3299913357.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	973616285.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	973616285.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	973616285.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesOverride = "1"	973616285.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	973616285.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	3299913357.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiSpywareOverride = "1"	3299913357.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	973616285.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	3299913357.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	3299913357.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesOverride = "1"	3299913357.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiSpywareOverride = "1"	973616285.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	3299913357.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	3299913357.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

973616285.exe3299913357.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Settings = "C:\\Windows\\sysvratrel.exe"	973616285.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Settings = "C:\\Users\\Admin\\sysvratrel.exe"	973616285.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Service = "C:\\Windows\\winploravr.exe"	3299913357.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Service = "C:\\Users\\Admin\\winploravr.exe"	3299913357.exe

Drops file in Windows directory 4 IoCs

Processes:

973616285.exe3299913357.exe

description	ioc	process
File created	C:\Windows\sysvratrel.exe	973616285.exe
File opened for modification	C:\Windows\sysvratrel.exe	973616285.exe
File created	C:\Windows\winploravr.exe	3299913357.exe
File opened for modification	C:\Windows\winploravr.exe	3299913357.exe

Modifies Internet Explorer Phishing Filter 1 TTPs 2 IoCs

Modify Registry

T1112

Processes:

iexplore.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PhishingFilter	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PhishingFilter\ClientSupported_MigrationTime = 4056c6776c97da01	iexplore.exe

Modifies Internet Explorer settings 1 TTPs 51 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TypedURLsTime\url4 = 0000000000000000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TypedURLsTime\url5 = 0000000000000000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TypedURLsTime\url6 = 0000000000000000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000a8d48f8c0f2499eac36d08f9b83e8d911febfb8f8a4b6dc93cb1aa2642c80c5e000000000e8000000002000020000000ed1c08d0eaa6c3822fa5d3970d0ed361ae9a34fb85b942ca8bb1130ef2bbde4f200000008d939f3a8be23bf5d1e60d19f885fd7d343e56ec1fa357202e94a42079189f9240000000b839daa952ee2813db6c8ae09ee8c8ab052276d86dc5eb85c182bfcf1e0b0bad7fd26bce4188ee8d12c2a10dff00f3ee2ea61260fe5bfa49d04d272e4b580ca6	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b0000000002000000000010660000000100002000000037df0c3e7b3cff8231dcb62ed71cc90bc1d362a6bb4c7e6107e109c27677c2a2000000000e8000000002000020000000b7b450ce5e0f83f80766bd1af2f2a9e1fd1bb215c7edbb71f00d4367a613c6fd900000008e1049390542e1611af90e3635e836d9f814b429d3e7376c3986bd74f231d02e0a849ae888ba470594787d0a8d682561ccd80c31c6bcb585d57e00e3d84682d14f46974d91817e3edcfb73d56fbbf5497a29146f5254f5540c2ab3d92f5a0f81b1ea7c58cec662770d6047ac3d060a0d034c7acd34dfda94e114773028bf7ffab9711a379d93f16907bb63b2bcbf07a1400000009aa0281bc3b395b89cb5641cfe60e1ec487f6e1929fff264a190de70faf2a20be75f1a2f2cbd88564a9d559fc698c0acdd80c088552d5e7e7145cdec96b5fe53	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TypedURLs\url5 = "https://login.live.com/"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TypedURLsTime\url3 = 0000000000000000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\DownloadWindowPlacement = 2c0000000000000000000000ffffffffffffffffffffffffffffffff100100003d000000900300001d020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TypedURLs\url2 = "https://www.facebook.com/"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40a6a0896c97da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TypedURLsTime	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TypedURLsTime\url1 = 601cac8d6c97da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TypedURLs	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TypedURLsTime\url2 = 0000000000000000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TypedURLs\url6 = "https://twitter.com/"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TypedURLs\url1 = "http://www.google.com/"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B4B50F61-035F-11EF-9667-569FD5A164C1} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TypedURLs\url3 = "https://login.aliexpress.com/"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TypedURLs\url4 = "https://signin.ebay.com/ws/ebayisapi.dll"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

vlc.exe

pid process

2252 vlc.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

vlc.exe

pid process

2252 vlc.exe
Suspicious use of FindShellTrayWindow 7 IoCs

Processes:

iexplore.exevlc.exe

pid process

2776 iexplore.exe
2776 iexplore.exe
2776 iexplore.exe
2252 vlc.exe
2252 vlc.exe
2252 vlc.exe
2252 vlc.exe
Suspicious use of SendNotifyMessage 3 IoCs

Processes:

vlc.exe

pid process

2252 vlc.exe
2252 vlc.exe
2252 vlc.exe

pid	process
2252	vlc.exe

pid	process
2252	vlc.exe

pid	process
2252	vlc.exe
2252	vlc.exe
2252	vlc.exe

Suspicious use of SetWindowsHookEx 12 IoCs

Processes:

iexplore.exeIEXPLORE.EXEvlc.exe

pid	process
2776	iexplore.exe
2776	iexplore.exe
940	IEXPLORE.EXE
940	IEXPLORE.EXE
2776	iexplore.exe
2776	iexplore.exe
940	IEXPLORE.EXE
940	IEXPLORE.EXE
2776	iexplore.exe
940	IEXPLORE.EXE
940	IEXPLORE.EXE
2252	vlc.exe

Suspicious use of WriteProcessMemory 32 IoCs

Processes:

iexplore.exenpp.exe973616285.exe3299913357.exe

description	pid	process	target process
PID 2776 wrote to memory of 940	2776	iexplore.exe	IEXPLORE.EXE
PID 2776 wrote to memory of 940	2776	iexplore.exe	IEXPLORE.EXE
PID 2776 wrote to memory of 940	2776	iexplore.exe	IEXPLORE.EXE
PID 2776 wrote to memory of 940	2776	iexplore.exe	IEXPLORE.EXE
PID 2776 wrote to memory of 2568	2776	iexplore.exe	npp.exe
PID 2776 wrote to memory of 2568	2776	iexplore.exe	npp.exe
PID 2776 wrote to memory of 2568	2776	iexplore.exe	npp.exe
PID 2776 wrote to memory of 2568	2776	iexplore.exe	npp.exe
PID 2568 wrote to memory of 3056	2568	npp.exe	973616285.exe
PID 2568 wrote to memory of 3056	2568	npp.exe	973616285.exe
PID 2568 wrote to memory of 3056	2568	npp.exe	973616285.exe
PID 2568 wrote to memory of 3056	2568	npp.exe	973616285.exe
PID 3056 wrote to memory of 2148	3056	973616285.exe	1348521519.exe
PID 3056 wrote to memory of 2148	3056	973616285.exe	1348521519.exe
PID 3056 wrote to memory of 2148	3056	973616285.exe	1348521519.exe
PID 3056 wrote to memory of 2148	3056	973616285.exe	1348521519.exe
PID 3056 wrote to memory of 2040	3056	973616285.exe	3299913357.exe
PID 3056 wrote to memory of 2040	3056	973616285.exe	3299913357.exe
PID 3056 wrote to memory of 2040	3056	973616285.exe	3299913357.exe
PID 3056 wrote to memory of 2040	3056	973616285.exe	3299913357.exe
PID 2040 wrote to memory of 1104	2040	3299913357.exe	2535922855.exe
PID 2040 wrote to memory of 1104	2040	3299913357.exe	2535922855.exe
PID 2040 wrote to memory of 1104	2040	3299913357.exe	2535922855.exe
PID 2040 wrote to memory of 1104	2040	3299913357.exe	2535922855.exe
PID 2040 wrote to memory of 1996	2040	3299913357.exe	3115514132.exe
PID 2040 wrote to memory of 1996	2040	3299913357.exe	3115514132.exe
PID 2040 wrote to memory of 1996	2040	3299913357.exe	3115514132.exe
PID 2040 wrote to memory of 1996	2040	3299913357.exe	3115514132.exe
PID 2040 wrote to memory of 748	2040	3299913357.exe	3143138075.exe
PID 2040 wrote to memory of 748	2040	3299913357.exe	3143138075.exe
PID 2040 wrote to memory of 748	2040	3299913357.exe	3143138075.exe
PID 2040 wrote to memory of 748	2040	3299913357.exe	3143138075.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://185.215.113.66/npp.exe
1⤵
- Modifies Internet Explorer Phishing Filter
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2776

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2776 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:940

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5DKX8QD5\npp.exe
"C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5DKX8QD5\npp.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2568

C:\Users\Admin\AppData\Local\Temp\973616285.exe
C:\Users\Admin\AppData\Local\Temp\973616285.exe
3⤵
- Modifies security service
- Windows security bypass
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3056

C:\Users\Admin\AppData\Local\Temp\1348521519.exe
C:\Users\Admin\AppData\Local\Temp\1348521519.exe
4⤵
- Executes dropped EXE
PID:2148

C:\Users\Admin\AppData\Local\Temp\3299913357.exe
C:\Users\Admin\AppData\Local\Temp\3299913357.exe
4⤵
- Windows security bypass
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2040

C:\Users\Admin\AppData\Local\Temp\2535922855.exe
C:\Users\Admin\AppData\Local\Temp\2535922855.exe
5⤵
- Executes dropped EXE
PID:1104

C:\Users\Admin\AppData\Local\Temp\3115514132.exe
C:\Users\Admin\AppData\Local\Temp\3115514132.exe
5⤵
- Executes dropped EXE
PID:1996

C:\Users\Admin\AppData\Local\Temp\3143138075.exe
C:\Users\Admin\AppData\Local\Temp\3143138075.exe
5⤵
- Executes dropped EXE
PID:748

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
1⤵
PID:2232

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\UnpublishSelect.wvx"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2252

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
a8c1598768e7d9a458609bd1c6ab485f

SHA1
4306953252074a1a99cf14ea66ed0306571fcbf2

SHA256
f06a95c7dbcbc0789f4c15d24e15128ee0c939ce963a1e63936d8661a4c0afe6

SHA512
81db46e95acfac7fd7b77d3d64fcfaeb0cf3b46be12c36afa04b163c662bdac08d36ff4fe39a84241a1a368e80713da3e878d33e3172f4e5f0cd0723b363682b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
cd61271f8fc7de714cfab5379d9e169c

SHA1
51fba842b5badff2c0d9cea399bc903d99a1d48d

SHA256
bf64de0b2a3d81fb8192e4f8d4a48c59a8d74ca08ad4b9af5c06459aa9a277f1

SHA512
5b0623fda2511124cb705e1ba6e05cc734f37366f09586004beb4334c55a346de3a56155e263ac6f3e4e632bf85678d680f153aeb7ac74777e7a97d6adb7dffc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
9ff8f3e9575b2206b5452c13d469337e

SHA1
1c9a0ca1067483e0878d584eefbcfd1926a85af4

SHA256
a507935a699ba6b85ad1b16da7794033bf2783ead2429361b061ea67c6fa2fbb

SHA512
1ea695ee319807b176df7ac1f2be750233ed8d7e4fcea4be4aa7bcdd40a8a6bd9845146e8a78b7a53043e1e131b2f2629d5049ed2732ee5af2565bd0e80cd0fd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
344a79ef7e1d6c503b7e8e32d0cd543c

SHA1
e79c7a5f98f7c0b04cd403b705cea26680dd9fad

SHA256
5bf2acd6073d4364a443968ad9f11e824d49a75b24ee3d87d13136e67ac65070

SHA512
fda2121573544690d01797a7d43f467da91c1cf3393da84ed415e31384ffde29fdb6b3dac7b7bbf279f15e83acc72178c8315051e010d5c1a3dcc8b508eddbb7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
5de82709c46821edcb7cd09248cc00fe

SHA1
24f5979b26ea6a062b188cc4db1926323f90f899

SHA256
cdac9c8fa9c0e61470494917240041f19e436e05eb6991eac9eb59ba35da1efe

SHA512
088792fa8c9aa85d7e5e796253989ede43c5dfa08bd9914f84ad6b7022cafd684e343640adee59bd8b5f39dab8c34cb03afb194f8733c59fb0c230e51864cd83

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
868747cbe10c09251aaef9e68d62fa00

SHA1
bc6c99c19620225951fdc198060b1ae8abdb63af

SHA256
7a90b966f780c959e54f7a8da149e620f842c0ac15a455274f0ccc52a34ced97

SHA512
37f8c4325ca9b4c3966007b431c70624590f5d080b6e7ce95dc815502d3c8e19343053ed5b203dc565e43751b4965416d2c4466b8f1b01d299909b3118238bf3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
b353ebef5509971cff29029098257f60

SHA1
b2b6022015baca8ba23fcc9a303ad43920e536e5

SHA256
83e00599fe50f58fad71787dd97b0d39eb32e219fc60acb4196a8eb829d86bea

SHA512
3f032cf29af36bb2fcd089bfbde6603896b83d316e561c422c6c98b6f0627d13e9cacd591a7b4b969188abef7c40f8e8e3c93ab5924a367c8763688483c9d4fd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
ee5a06a48c9a2e474238a046d0e03a5f

SHA1
e375c9568e661a586da1a55f35a2d82f44e9bee1

SHA256
d0d863b7180ac835a2b228a5e643e50075b17cc655d441317aa6410c9c8a14a2

SHA512
babe57e9d1f20014c66e5206819544f4f339c26a41702749a758a12f4fd56cc4e520a21b899049514e395f1db3e46ba9353b867a82a3a248333c3374c17517e2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
0578329072f9599071424542c9cd0cf2

SHA1
5092bfc900c678b0790fa6e6935b528a11119158

SHA256
50df78ffbb6efabcea223dcf6acdc846e14a81fe27cbfd4faf3cfef8d4be29af

SHA512
0f8b39abc3cb7947ec0567e22d22f6064d4939e8b8e810189f35991a090b3606aec784d01519763d5976a47378ec072c35b88eb534a720d126bba8bfd3b82eed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\q905y6j\imagestore.dat
Filesize
5KB

MD5
47148de793b82b5f9d96eaa95d9b6493

SHA1
2f5615ae7c6b9b1295f9de629e6d386df5e922f9

SHA256
990568ee474fd31df6b201ae8239e1c841f88305bd42aeb3fbfa029b841f16c0

SHA512
8a27b69baa2dfbe5c2348c02f681030612a9485235d9db79ed8b2386047110d1100619abbf5766d2ed037c518d9305feb690a919fd1acc6f182b3986ecd11c0f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5DKX8QD5\_3[1]
Filesize
8KB

MD5
6eacd33bee969b1ca75e7255804819e4

SHA1
b89d21fe64f2a36f2022fe905a072bdfe432f392

SHA256
b0cd888ec409d1c25055a7f1e9ca5f65309f782557844d245da2b4637f17f41b

SHA512
1c126fdcef507f0bfaf4b5dd74594a0be26422cceaea399bf0e411a86157ba8811e8eb4215a0a0a21e55e6b13fc275d62cece9f22cb89dbe4d9cc9638209e674

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5DKX8QD5\qsml[1].xml
Filesize
514B

MD5
15f78d673da93352d982b053a3d2e316

SHA1
20a2ad0a7a2aeb62844b0f7b6d3ec517d0c0cea8

SHA256
7506f2f255be383df429b4f0afea6326940791380798c80aaf6959c9b3428587

SHA512
0ba001a67ff51c3a841026b348e1842fad434a0420d860b2238266494141f45be58ba5e34d5ccb2091d1ee6fce70051bf677964af04ea180fbf8f1058f52a7f9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5DKX8QD5\qsml[2].xml
Filesize
530B

MD5
2ee67a481b23648724d4a3a5b9fa1766

SHA1
1d484a4526cb4958c7294effa4d8c4c32292f333

SHA256
0318840d6e1a58f513867ecc885db8f20097d4b292b2a2b26802d15268a2eb07

SHA512
b46f446a94d35ab00df10551802ec0f087c0ed18eb0bd7397c27fcc898ba0dd3b5bef4e5557467336886ba5f690aeb507453f289077514d923e28a2d8c2d6377

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5DKX8QD5\qsml[3].xml
Filesize
558B

MD5
9d16e4af0e56e362e191ee2451b24bbc

SHA1
31f973bf70da2fac659a3fbab0ad4ec48c4c3ce7

SHA256
8588afbd7e214c493028cc59214c7382ad26fdf1b175d0c1a9548fef887eb265

SHA512
30db4cfc821917604ef0544ce7edb09c386fc726e77324e5010f596c4851f57a0a24ceaa65b97108ce47ffcaad96b7e182f46751f3fac33695fb0042f2fe1bf5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5DKX8QD5\qsml[4].xml
Filesize
580B

MD5
d078ea9919c008dd5c9e5728579c55c6

SHA1
45fecc2b03c41baa914a60a362d78abb3e2b7cfc

SHA256
c9fb515bd1cea741430a4b510c9f60e09b3d40bd97294fe13743d86ef3e098d5

SHA512
9423af941f34dc248feda24efa9bf316e3437dc1239431e6432a0015b199a66f09ecf7d336fabd3f51ec41f2c7c26f6e36ba61365f7aac7781ef9dff5bc8885b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\L9PN2QMY\favicon[1].ico
Filesize
5KB

MD5
f3418a443e7d841097c714d69ec4bcb8

SHA1
49263695f6b0cdd72f45cf1b775e660fdc36c606

SHA256
6da5620880159634213e197fafca1dde0272153be3e4590818533fab8d040770

SHA512
82d017c4b7ec8e0c46e8b75da0ca6a52fd8bce7fcf4e556cbdf16b49fc81be9953fe7e25a05f63ecd41c7272e8bb0a9fd9aedf0ac06cb6032330b096b3702563

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\L9PN2QMY\npp[1].exe
Filesize
9KB

MD5
2ea6c5e97869622dfe70d2b34daf564e

SHA1
45500603bf8093676b66f056924a71e04793827a

SHA256
5f28bba8bd23cdb5c8a3fa018727bcf365eaf31c06b7bc8d3f3097a85db037f3

SHA512
f8f82b5875e8257206561de22ddbd8b5d9a2393e0da62f57c5a429ca233c7443c34647cc2253cf766bfaaf8177acb5c0627ab2f2418f5968f0a6fdec54244d43

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab9EB0.tmp
Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab9F8F.tmp
Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9FB4.tmp
Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit
C:\Users\Admin\AppData\Local\Temp\~DF074762DF6D2BF454.TMP
Filesize
16KB

MD5
0135896e3340f1366d59032b2d38efd8

SHA1
dcd6332aeff23eeb4daa6caed91a9fc6a01339c8

SHA256
01bc41e9fa6b2f83bce6a6892829ab87f958359c0cbc73ec5fadee7a2a2b5dd4

SHA512
df56b3fb33575a94608161ea1639323dc75be3087bfe093bcc1b72f2bd3557d76311f80bf19122bdcfa82c3fe5f3bf239838a82d52219b5b93337d84b58c34d3

Download Submit
\Users\Admin\AppData\Local\Temp\1348521519.exe
Filesize
84KB

MD5
cd1d9c0ed8763e6bb3ee7efb133dc60e

SHA1
f6f3bea085ba7c13a2956fc0810c2034792f2ddf

SHA256
19ee79b7852c54de5883404f049f9e85cb0085bae8132ada3e46d6f75b24b100

SHA512
77b675fdbfc11bff45e2438cb1bd73b7fbfa03771c600e37171f684141c82f356e392ba2694285390aedbb3ecd3306a3c0f8687d0a1940d8d44cae3a7fc41591

Download Submit
\Users\Admin\AppData\Local\Temp\2535922855.exe
Filesize
7KB

MD5
5a3abf2d99e1d6ebace7ae59d286ec17

SHA1
4fafd267a828ba66bb8ba0ec620b2bfff93f77d1

SHA256
3775c7888a3571a039b1415779a915e6dc806eaf0459eb551cbfb9b78c68f9f6

SHA512
1775cc5e2f5c8ad36437b086523e191fe31c441c99c39cf21af672e2beaa7987808b24a99960720731749dc33f8cb976e9ef6de5840a7f4e92c02b3c4b073bc1

Download Submit
\Users\Admin\AppData\Local\Temp\3299913357.exe
Filesize
14KB

MD5
d085f41fe497a63dc2a4882b485a2caf

SHA1
9dc111412129833495f19d7b8a5500cf7284ad68

SHA256
fb11b4e2d26812e26ea7428f3b0b9bb8a16814188250fa60697c7aec40a49bd0

SHA512
ed4d8e297094248fb536154ed0427f4cc1832f339ce29d0f782971ede42fa2b9e5f953f73e71d0cfc026e5fd2ec0f7062410af359fd940a14f277adca37fc106

Download Submit
\Users\Admin\AppData\Local\Temp\973616285.exe
Filesize
84KB

MD5
36010b83bccfcd1032971df9fc5082a1

SHA1
9967b83065e3ad82cd6c0c3b02cf08ab707fde3e

SHA256
99c140f3dbd18b65457bc398730516f3a8c1d0e5ba68aa46c194505bf0f12a98

SHA512
c8008923315d86c06b57e47d9bf81cec47cda0dec6d9f8aa57d7b4c57c7138997486a6f60eb0015bc99755afeb3d943bc8d9ba83dbb8c9219fa4990296de1def

Download Submit
memory/2252-662-0x000000013FAD0000-0x000000013FBC8000-memory.dmp

Filesize
992KB

Download
memory/2252-663-0x000007FEF7C30000-0x000007FEF7C64000-memory.dmp

Filesize
208KB

Download
memory/2252-664-0x000007FEF6220000-0x000007FEF64D4000-memory.dmp

Filesize
2.7MB

Download
memory/2252-665-0x000007FEF4E00000-0x000007FEF5EAB000-memory.dmp

Filesize
16.7MB

Download
memory/2252-666-0x000007FEF3D60000-0x000007FEF3E72000-memory.dmp

Filesize
1.1MB

Download