Overview
overview
10Static
static
3000.exe
windows7-x64
000.exe
windows10-2004-x64
Ana.exe
windows7-x64
8Ana.exe
windows10-2004-x64
Bad Rabit.exe
windows7-x64
10Bad Rabit.exe
windows10-2004-x64
10Desktop Puzzle.exe
windows7-x64
1Desktop Puzzle.exe
windows10-2004-x64
1Memz.exe
windows7-x64
6Memz.exe
windows10-2004-x64
7NoEscape.exe
windows7-x64
NoEscape.exe
windows10-2004-x64
WannaCrypt0r.exe
windows7-x64
10WannaCrypt0r.exe
windows10-2004-x64
10Resubmissions
08-06-2024 08:50
240608-krvyesae91 1008-05-2024 16:15
240508-tqnx6ach3w 1008-05-2024 16:07
240508-tkr3mafa54 1001-05-2024 18:02
240501-wmf49acg3s 627-04-2024 08:46
240427-kpfeysff8s 1025-04-2024 21:25
240425-z9y55afb7v 1025-04-2024 21:16
240425-z4pphafa97 1025-04-2024 18:27
240425-w3929sde33 1025-04-2024 18:17
240425-ww4a5sdc8x 10Analysis
-
max time kernel
313s -
max time network
313s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
25-04-2024 17:57
Static task
static1
Behavioral task
behavioral1
Sample
000.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
000.exe
Resource
win10v2004-20240412-en
Behavioral task
behavioral3
Sample
Ana.exe
Resource
win7-20240220-en
Behavioral task
behavioral4
Sample
Ana.exe
Resource
win10v2004-20240412-en
Behavioral task
behavioral5
Sample
Bad Rabit.exe
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
Bad Rabit.exe
Resource
win10v2004-20240412-en
Behavioral task
behavioral7
Sample
Desktop Puzzle.exe
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
Desktop Puzzle.exe
Resource
win10v2004-20240412-en
Behavioral task
behavioral9
Sample
Memz.exe
Resource
win7-20240220-en
Behavioral task
behavioral10
Sample
Memz.exe
Resource
win10v2004-20240412-en
Behavioral task
behavioral11
Sample
NoEscape.exe
Resource
win7-20231129-en
Behavioral task
behavioral12
Sample
NoEscape.exe
Resource
win10v2004-20240412-en
Behavioral task
behavioral13
Sample
WannaCrypt0r.exe
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
WannaCrypt0r.exe
Resource
win10v2004-20240412-en
Errors
General
-
Target
NoEscape.exe
-
Size
666KB
-
MD5
989ae3d195203b323aa2b3adf04e9833
-
SHA1
31a45521bc672abcf64e50284ca5d4e6b3687dc8
-
SHA256
d30d7676a3b4c91b77d403f81748ebf6b8824749db5f860e114a8a204bca5b8f
-
SHA512
e9d4e6295869f3a456c7ea2850c246d0c22afa65c2dd5161744ee5b3e29e44d9a2d758335f98001cdb348eaa51a71cd441b4ddc12c8d72509388657126e69305
-
SSDEEP
12288:85J5X487qJUtcWfkVJ6g5s/cD01oKHQyis2AePsr8nP712TB:s487pcZEgwcDpg1L2tbPR2t
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\RESTART_STICKY_NOTES = "C:\\Windows\\system32\\StikyNot.exe" StikyNot.exe -
Enumerates system info in registry 2 TTPs 4 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe -
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\MenuExt EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command EXCEL.EXE -
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32 EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohevi.dll" EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\ = "[open(\"%1\")]" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\ = "&Open" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\ShellEx EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\ = "[open(\"%1\")]" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shellex\IconHandler EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\ = "&Edit" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\ = "&Print" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shellex\IconHandler EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14 EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32\ThreadingModel = "Apartment" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\ = "&Edit" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shellex\IconHandler\ = "{42042206-2D85-11D3-8CFF-005004838597}" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon\mhtmlfile EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic\ = "system" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ = "&Open" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic\ = "system" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ = "&Open" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\application\ = "Excel" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" %1" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application\ = "Excel" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\ = "&Open" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\ = "&Open" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 1188 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1216 chrome.exe 1216 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1216 chrome.exe Token: SeShutdownPrivilege 1216 chrome.exe Token: SeShutdownPrivilege 1216 chrome.exe Token: SeShutdownPrivilege 1216 chrome.exe Token: SeShutdownPrivilege 1216 chrome.exe Token: SeShutdownPrivilege 1216 chrome.exe Token: SeShutdownPrivilege 1216 chrome.exe Token: SeShutdownPrivilege 1216 chrome.exe Token: SeShutdownPrivilege 1216 chrome.exe Token: SeShutdownPrivilege 1216 chrome.exe Token: SeShutdownPrivilege 1216 chrome.exe Token: SeShutdownPrivilege 1216 chrome.exe Token: SeShutdownPrivilege 1216 chrome.exe Token: SeShutdownPrivilege 1216 chrome.exe Token: SeShutdownPrivilege 1216 chrome.exe Token: SeShutdownPrivilege 1216 chrome.exe Token: SeShutdownPrivilege 1216 chrome.exe Token: SeShutdownPrivilege 1216 chrome.exe Token: SeShutdownPrivilege 1216 chrome.exe Token: SeShutdownPrivilege 1216 chrome.exe Token: SeShutdownPrivilege 1216 chrome.exe Token: SeShutdownPrivilege 1216 chrome.exe Token: SeShutdownPrivilege 1216 chrome.exe Token: SeShutdownPrivilege 1216 chrome.exe Token: SeShutdownPrivilege 1216 chrome.exe Token: SeShutdownPrivilege 1216 chrome.exe Token: SeShutdownPrivilege 1216 chrome.exe Token: SeShutdownPrivilege 1216 chrome.exe Token: SeShutdownPrivilege 1216 chrome.exe Token: SeShutdownPrivilege 1216 chrome.exe Token: SeShutdownPrivilege 1216 chrome.exe Token: SeShutdownPrivilege 1216 chrome.exe Token: SeShutdownPrivilege 1216 chrome.exe Token: SeShutdownPrivilege 1216 chrome.exe Token: SeShutdownPrivilege 1216 chrome.exe Token: SeShutdownPrivilege 1216 chrome.exe Token: SeShutdownPrivilege 1216 chrome.exe Token: SeShutdownPrivilege 1216 chrome.exe Token: SeShutdownPrivilege 1216 chrome.exe Token: SeShutdownPrivilege 1216 chrome.exe Token: SeShutdownPrivilege 1216 chrome.exe Token: SeShutdownPrivilege 1216 chrome.exe Token: SeShutdownPrivilege 1216 chrome.exe Token: SeShutdownPrivilege 1216 chrome.exe Token: SeShutdownPrivilege 1216 chrome.exe Token: SeShutdownPrivilege 1216 chrome.exe Token: SeShutdownPrivilege 1216 chrome.exe Token: SeShutdownPrivilege 1216 chrome.exe Token: SeShutdownPrivilege 1216 chrome.exe Token: SeShutdownPrivilege 1216 chrome.exe Token: SeShutdownPrivilege 1216 chrome.exe Token: SeShutdownPrivilege 1216 chrome.exe Token: SeShutdownPrivilege 1216 chrome.exe Token: SeShutdownPrivilege 1216 chrome.exe Token: SeShutdownPrivilege 1216 chrome.exe Token: SeShutdownPrivilege 1216 chrome.exe Token: SeShutdownPrivilege 1216 chrome.exe Token: SeShutdownPrivilege 1216 chrome.exe Token: SeShutdownPrivilege 1216 chrome.exe Token: SeShutdownPrivilege 1216 chrome.exe Token: SeShutdownPrivilege 1216 chrome.exe Token: SeShutdownPrivilege 1216 chrome.exe Token: SeShutdownPrivilege 1216 chrome.exe Token: SeShutdownPrivilege 1216 chrome.exe -
Suspicious use of FindShellTrayWindow 35 IoCs
pid Process 1216 chrome.exe 1216 chrome.exe 1216 chrome.exe 1216 chrome.exe 1216 chrome.exe 1216 chrome.exe 1216 chrome.exe 1216 chrome.exe 1216 chrome.exe 1216 chrome.exe 1216 chrome.exe 1216 chrome.exe 1216 chrome.exe 1216 chrome.exe 1216 chrome.exe 1216 chrome.exe 1216 chrome.exe 1216 chrome.exe 1216 chrome.exe 1216 chrome.exe 1216 chrome.exe 1216 chrome.exe 1216 chrome.exe 1216 chrome.exe 1216 chrome.exe 1216 chrome.exe 1216 chrome.exe 1216 chrome.exe 1216 chrome.exe 1216 chrome.exe 1216 chrome.exe 1216 chrome.exe 1216 chrome.exe 1216 chrome.exe 1216 chrome.exe -
Suspicious use of SendNotifyMessage 32 IoCs
pid Process 1216 chrome.exe 1216 chrome.exe 1216 chrome.exe 1216 chrome.exe 1216 chrome.exe 1216 chrome.exe 1216 chrome.exe 1216 chrome.exe 1216 chrome.exe 1216 chrome.exe 1216 chrome.exe 1216 chrome.exe 1216 chrome.exe 1216 chrome.exe 1216 chrome.exe 1216 chrome.exe 1216 chrome.exe 1216 chrome.exe 1216 chrome.exe 1216 chrome.exe 1216 chrome.exe 1216 chrome.exe 1216 chrome.exe 1216 chrome.exe 1216 chrome.exe 1216 chrome.exe 1216 chrome.exe 1216 chrome.exe 1216 chrome.exe 1216 chrome.exe 1216 chrome.exe 1216 chrome.exe -
Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 1188 EXCEL.EXE 1188 EXCEL.EXE 1188 EXCEL.EXE 1188 EXCEL.EXE 1188 EXCEL.EXE 1188 EXCEL.EXE 1188 EXCEL.EXE 1188 EXCEL.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1216 wrote to memory of 3000 1216 chrome.exe 29 PID 1216 wrote to memory of 3000 1216 chrome.exe 29 PID 1216 wrote to memory of 3000 1216 chrome.exe 29 PID 1216 wrote to memory of 2556 1216 chrome.exe 31 PID 1216 wrote to memory of 2556 1216 chrome.exe 31 PID 1216 wrote to memory of 2556 1216 chrome.exe 31 PID 1216 wrote to memory of 2556 1216 chrome.exe 31 PID 1216 wrote to memory of 2556 1216 chrome.exe 31 PID 1216 wrote to memory of 2556 1216 chrome.exe 31 PID 1216 wrote to memory of 2556 1216 chrome.exe 31 PID 1216 wrote to memory of 2556 1216 chrome.exe 31 PID 1216 wrote to memory of 2556 1216 chrome.exe 31 PID 1216 wrote to memory of 2556 1216 chrome.exe 31 PID 1216 wrote to memory of 2556 1216 chrome.exe 31 PID 1216 wrote to memory of 2556 1216 chrome.exe 31 PID 1216 wrote to memory of 2556 1216 chrome.exe 31 PID 1216 wrote to memory of 2556 1216 chrome.exe 31 PID 1216 wrote to memory of 2556 1216 chrome.exe 31 PID 1216 wrote to memory of 2556 1216 chrome.exe 31 PID 1216 wrote to memory of 2556 1216 chrome.exe 31 PID 1216 wrote to memory of 2556 1216 chrome.exe 31 PID 1216 wrote to memory of 2556 1216 chrome.exe 31 PID 1216 wrote to memory of 2556 1216 chrome.exe 31 PID 1216 wrote to memory of 2556 1216 chrome.exe 31 PID 1216 wrote to memory of 2556 1216 chrome.exe 31 PID 1216 wrote to memory of 2556 1216 chrome.exe 31 PID 1216 wrote to memory of 2556 1216 chrome.exe 31 PID 1216 wrote to memory of 2556 1216 chrome.exe 31 PID 1216 wrote to memory of 2556 1216 chrome.exe 31 PID 1216 wrote to memory of 2556 1216 chrome.exe 31 PID 1216 wrote to memory of 2556 1216 chrome.exe 31 PID 1216 wrote to memory of 2556 1216 chrome.exe 31 PID 1216 wrote to memory of 2556 1216 chrome.exe 31 PID 1216 wrote to memory of 2556 1216 chrome.exe 31 PID 1216 wrote to memory of 2556 1216 chrome.exe 31 PID 1216 wrote to memory of 2556 1216 chrome.exe 31 PID 1216 wrote to memory of 2556 1216 chrome.exe 31 PID 1216 wrote to memory of 2556 1216 chrome.exe 31 PID 1216 wrote to memory of 2556 1216 chrome.exe 31 PID 1216 wrote to memory of 2556 1216 chrome.exe 31 PID 1216 wrote to memory of 2556 1216 chrome.exe 31 PID 1216 wrote to memory of 2556 1216 chrome.exe 31 PID 1216 wrote to memory of 2476 1216 chrome.exe 32 PID 1216 wrote to memory of 2476 1216 chrome.exe 32 PID 1216 wrote to memory of 2476 1216 chrome.exe 32 PID 1216 wrote to memory of 2656 1216 chrome.exe 33 PID 1216 wrote to memory of 2656 1216 chrome.exe 33 PID 1216 wrote to memory of 2656 1216 chrome.exe 33 PID 1216 wrote to memory of 2656 1216 chrome.exe 33 PID 1216 wrote to memory of 2656 1216 chrome.exe 33 PID 1216 wrote to memory of 2656 1216 chrome.exe 33 PID 1216 wrote to memory of 2656 1216 chrome.exe 33 PID 1216 wrote to memory of 2656 1216 chrome.exe 33 PID 1216 wrote to memory of 2656 1216 chrome.exe 33 PID 1216 wrote to memory of 2656 1216 chrome.exe 33 PID 1216 wrote to memory of 2656 1216 chrome.exe 33 PID 1216 wrote to memory of 2656 1216 chrome.exe 33 PID 1216 wrote to memory of 2656 1216 chrome.exe 33 PID 1216 wrote to memory of 2656 1216 chrome.exe 33 PID 1216 wrote to memory of 2656 1216 chrome.exe 33 PID 1216 wrote to memory of 2656 1216 chrome.exe 33 PID 1216 wrote to memory of 2656 1216 chrome.exe 33 PID 1216 wrote to memory of 2656 1216 chrome.exe 33 PID 1216 wrote to memory of 2656 1216 chrome.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\NoEscape.exe"C:\Users\Admin\AppData\Local\Temp\NoEscape.exe"1⤵PID:2360
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1216 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef7019758,0x7fef7019768,0x7fef70197782⤵PID:3000
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1188 --field-trial-handle=1376,i,8199946296249220698,10173471813653671822,131072 /prefetch:22⤵PID:2556
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1520 --field-trial-handle=1376,i,8199946296249220698,10173471813653671822,131072 /prefetch:82⤵PID:2476
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1596 --field-trial-handle=1376,i,8199946296249220698,10173471813653671822,131072 /prefetch:82⤵PID:2656
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2240 --field-trial-handle=1376,i,8199946296249220698,10173471813653671822,131072 /prefetch:12⤵PID:2388
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2244 --field-trial-handle=1376,i,8199946296249220698,10173471813653671822,131072 /prefetch:12⤵PID:1676
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1392 --field-trial-handle=1376,i,8199946296249220698,10173471813653671822,131072 /prefetch:22⤵PID:1748
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=2956 --field-trial-handle=1376,i,8199946296249220698,10173471813653671822,131072 /prefetch:12⤵PID:484
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3384 --field-trial-handle=1376,i,8199946296249220698,10173471813653671822,131072 /prefetch:82⤵PID:1812
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3676 --field-trial-handle=1376,i,8199946296249220698,10173471813653671822,131072 /prefetch:82⤵PID:1612
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3652 --field-trial-handle=1376,i,8199946296249220698,10173471813653671822,131072 /prefetch:82⤵PID:944
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=3960 --field-trial-handle=1376,i,8199946296249220698,10173471813653671822,131072 /prefetch:12⤵PID:2376
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:1528
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1188
-
C:\Windows\system32\StikyNot.exe"C:\Windows\system32\StikyNot.exe"1⤵
- Adds Run key to start application
PID:2844
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x01⤵PID:2724
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x4f81⤵PID:788
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x11⤵PID:1136
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
16B
MD5aefd77f47fb84fae5ea194496b44c67a
SHA1dcfbb6a5b8d05662c4858664f81693bb7f803b82
SHA2564166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611
SHA512b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3
-
Filesize
264KB
MD5f50f89a0a91564d0b8a211f8921aa7de
SHA1112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
-
Filesize
6KB
MD52afe60837d14e0aa74a6c4aba384a654
SHA1e356ac5176b652e82c137f578dffdb55d5bc33ca
SHA256b9fed2336036142b1cf6e855ee25ffa9e84e1a73d7a1a6016f84b3609e11c88d
SHA512528a5b549163b993e877b8b99581330f6a722614612dd9f65c6de5098d96cd583131f792884805a8f2f0933511726492618cc79d2deb12160aa0336ef8f96ea2
-
Filesize
6KB
MD54ac9e08ba4cdcadc96faabd5aaf57800
SHA11b7cc50492aac6b855dc291588c5d8ba18015506
SHA25669cc9308f30849d57ef5cb8fe3464524adefbc82c986e9f55ea746bcaae51bd0
SHA5121d8549919cc128e3efcdb6d07234df7f973ac2a4259e297c5272f70191f21b4f9b67e33d0b42be97c0f2af4af7761f932585d5853eaabe4f1f100539841d338f
-
Filesize
5KB
MD551a823ade74f2f3a341e1b399b8572ca
SHA1e19f7f15655ec07f2d82fddbec7be027455efe9b
SHA2569f16ab50b1be0ab32fd70e0006c0c5f581cb90f932436d3f8a185d404a184697
SHA5126d1a2dce19530b997d7ce6a31efc64c1ee2808a55c1e143ad832d44133df48d056386af8689b4c09397fb9730f7fca2acc5f89df96d5e9f96d0a3f74389ffb8e
-
Filesize
16B
MD518e723571b00fb1694a3bad6c78e4054
SHA1afcc0ef32d46fe59e0483f9a3c891d3034d12f32
SHA2568af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa
SHA51243bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2
-
Filesize
140KB
MD5ecb756b78a2f57ff7bf3ced6ed71bbdf
SHA1f0f9e6bf1a4778282597401568306aab193384e6
SHA2566eff1175c88b06936ce8e8055de54b33cc8ef9e0db8151bcc11e4580c424cb37
SHA512086d794ecfeaf58e493c60d431487c6e4681e50f96bab05b75d0212f0816ecf8350079a0674800485f95985b763363a74eff6f298eb5300654709cc5fcfefc4e
-
Filesize
140KB
MD55113c31c3c099a12c8b41232310cb989
SHA12fde5d025244ffe0396b09bb357fa993cb6bb568
SHA256c53595de430cae52188b1198f84a256e688f8ee397ce17a519d7b1c782c19c92
SHA5126261dd334e13cae9d891a3ba365bf7167159113564572755b37792478cc0cd769fbc9c4347be22b2ea1bc8749148d912a83160dbfeedbeafac1874e6298b05ad