Overview
overview
10Static
static
3Fattura 00...df.exe
windows7-x64
10Fattura 00...df.exe
windows10-2004-x64
7$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3NsResize.dll
windows7-x64
3NsResize.dll
windows10-2004-x64
3default_hash.js
ubuntu-18.04-amd64
1default_hash.js
debian-9-armhf
1default_hash.js
debian-9-mips
default_hash.js
debian-9-mipsel
Analysis
-
max time kernel
145s -
max time network
103s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
01-05-2024 03:36
Static task
static1
Behavioral task
behavioral1
Sample
Fattura 00384788-0849838.pdf.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
Fattura 00384788-0849838.pdf.exe
Resource
win10v2004-20240419-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240215-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240419-en
Behavioral task
behavioral5
Sample
NsResize.dll
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
NsResize.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral7
Sample
default_hash.js
Resource
ubuntu1804-amd64-20240226-en
Behavioral task
behavioral8
Sample
default_hash.js
Resource
debian9-armhf-20240226-en
Behavioral task
behavioral9
Sample
default_hash.js
Resource
debian9-mipsbe-20240418-en
Behavioral task
behavioral10
Sample
default_hash.js
Resource
debian9-mipsel-20240418-en
General
-
Target
Fattura 00384788-0849838.pdf.exe
-
Size
867KB
-
MD5
921023d253b6dfac1eaabe38f3b36a45
-
SHA1
82ae601f2eb5202a5314feffb2a9bd07c5f33327
-
SHA256
a2deb60615b3bd20beeb9253547a41c0a970139bfb59d9f88854b8b61880ead1
-
SHA512
86229692b51a24e3f29aec482f6aca2109cf98031011a5bc71b756ee1417fe0200c179bde3adfd9dd72dcb5edd553abb98a5c6845b1c42d3e7672038fb7bc115
-
SSDEEP
24576:+XH+j3CgxpmJI+QhQ3r+HVqQUEHpGzOUPZ:Jj3CgxpNhN16EHpCx
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 4224 dkyedvf.exe 2320 dkyedvf.exe -
Loads dropped DLL 6 IoCs
pid Process 3272 Fattura 00384788-0849838.pdf.exe 3272 Fattura 00384788-0849838.pdf.exe 3272 Fattura 00384788-0849838.pdf.exe 4224 dkyedvf.exe 4224 dkyedvf.exe 4224 dkyedvf.exe -
Drops desktop.ini file(s) 2 IoCs
description ioc Process File opened for modification C:\$RECYCLE.BIN\S-1-5-18\desktop.ini svchost.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-18\desktop.ini svchost.exe -
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\F: svchost.exe -
Drops file in System32 directory 56 IoCs
description ioc Process File created C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\refentry.source.name.profile.enabled.xml dkyedvf.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\html.ext.xml dkyedvf.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\LICENSE_en_US.txt dkyedvf.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\use.id.as.filename.xml dkyedvf.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\brzphon.env dkyedvf.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\page.width.xml dkyedvf.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\use.role.as.xrefstyle.xml dkyedvf.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\manifest.xml dkyedvf.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\qanda.title.level3.properties.xml dkyedvf.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\Warm Gray 11 bl 3.ADO dkyedvf.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\CurveFitting.vbw dkyedvf.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\zy______.pfm dkyedvf.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\SequenceFrequency.mm dkyedvf.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\xslthl-config.xml dkyedvf.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\NsResize.dll dkyedvf.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\16ps.png dkyedvf.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\25.svg dkyedvf.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\LoadLayers.exv dkyedvf.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\zy______.pfm dkyedvf.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\49-sansserif.conf dkyedvf.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\multiframe.xml dkyedvf.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\pass.png dkyedvf.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\P_AutoAlign_Interactive_87x38.png dkyedvf.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\refentry.generate.name.xml dkyedvf.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\ExampleXML2PDF.java dkyedvf.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\South_Georgia dkyedvf.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\VsUntexturedInstanced.hlsl dkyedvf.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\variablelist.max.termlength.xml dkyedvf.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\f20.png dkyedvf.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\tweakBIOSDriversFirmwareUpdate_ru.p5p dkyedvf.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\qanda.title.level2.properties.xml dkyedvf.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\Bosun.mNa dkyedvf.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\htmlhelp.use.hhk.xml dkyedvf.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\slvphon.env dkyedvf.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\root.properties.xml dkyedvf.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\g1_1366 x 768 px 72 ppi.IMZ dkyedvf.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\DuelOmmatidium.Jsg dkyedvf.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\g2_Letter 8.5 x 11 in 300 dpi.IMZ dkyedvf.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\setup.iss dkyedvf.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\Ext-RKSJ-V dkyedvf.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\pcdrsound.p5m dkyedvf.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\inventory_3.png dkyedvf.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\htmlhelp.title.xml dkyedvf.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\README-en dkyedvf.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\green 3405 bl 4.ADO dkyedvf.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\Sydney dkyedvf.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\refentry.separator.xml dkyedvf.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\Kiev dkyedvf.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\BMY brown 2.ADO dkyedvf.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\PSNormalMap.hlsl dkyedvf.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\cations dkyedvf.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\README_kn_IN.txt dkyedvf.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\GMT+8 dkyedvf.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\Windows.act dkyedvf.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\default_hash.js dkyedvf.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\green 349 bl 1.ADO dkyedvf.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 3272 set thread context of 2144 3272 Fattura 00384788-0849838.pdf.exe 93 PID 4224 set thread context of 2320 4224 dkyedvf.exe 98 -
Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\ dkyedvf.exe File opened for modification C:\Windows\ Fattura 00384788-0849838.pdf.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 2 IoCs
pid pid_target Process procid_target 3104 2320 WerFault.exe 98 1960 2320 WerFault.exe 98 -
NSIS installer 2 IoCs
resource yara_rule behavioral2/files/0x0014000000023ba5-75.dat nsis_installer_1 behavioral2/files/0x0014000000023ba5-75.dat nsis_installer_2 -
Modifies data under HKEY_USERS 23 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{a8f5de66-0000-0000-0000-f0ff3a000000}\NukeOnDelete = "0" svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{a8f5de66-0000-0000-0000-f0ff3a000000} svchost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\LastEnum = 30002c007b00610038006600350064006500360036002d0030003000300030002d0030003000300030002d0030003000300030002d006400300031003200300030003000300030003000300030007d00000030002c007b00610038006600350064006500360036002d0030003000300030002d0030003000300030002d0030003000300030002d006600300066006600330061003000300030003000300030007d0000000000 svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\DefaultIcon svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{a8f5de66-0000-0000-0000-d01200000000}\MaxCapacity = "14116" svchost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\DefaultIcon\ = "%SystemRoot%\\System32\\imageres.dll,-55" svchost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\DefaultIcon\Full = "%SystemRoot%\\System32\\imageres.dll,-54" svchost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Control Panel\Desktop\TileWallpaper = "0" svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{645FF040-5081-101B-9F08-00AA002F954E} svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{a8f5de66-0000-0000-0000-f0ff3a000000}\MaxCapacity = "2047" svchost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\DefaultIcon\Empty = "%SystemRoot%\\System32\\imageres.dll,-55" svchost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@%SystemRoot%\system32\shell32.dll,-50176 = "File Operation" svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{a8f5de66-0000-0000-0000-d01200000000}\NukeOnDelete = "0" svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft svchost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Control Panel\Desktop\WallpaperStyle = "0" svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{a8f5de66-0000-0000-0000-d01200000000} svchost.exe -
Modifies registry class 32 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App\V1\LU\PCT = "133590082416847439" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App\V1\LU\PCT = "133590082428722526" svchost.exe Key created \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI svchost.exe Set value (int) \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App\V1\LU\PTT = "133590082099191501" svchost.exe Key created \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.Search_cw5n1h2txyewy svchost.exe Key created \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.Search_cw5n1h2txyewy\HAM\AUI\CortanaUI svchost.exe Set value (int) \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.Search_cw5n1h2txyewy\HAM\AUI\CortanaUI\V1\LU\PCT = "133579883954402836" svchost.exe Key created \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\HAM\AUI svchost.exe Key created \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\HAM\AUI\App\V1 svchost.exe Set value (int) \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\HAM\AUI\App\V1\LU\PTT = "133590083158253856" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App\V1\LU\PCT = "133590082082785528" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App\V1\LU\PCT = "133590082423253689" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App\V1\LU\PTT = "133590082758566541" svchost.exe Key created \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy svchost.exe Key created \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.Search_cw5n1h2txyewy\HAM\AUI svchost.exe Key created \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy svchost.exe Key created \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.Search_cw5n1h2txyewy\HAM\AUI\CortanaUI\V1\LU svchost.exe Set value (int) \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App\V1\LU\PCT = "133590082757472467" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App\V1\LU\PCT = "133590082768410047" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App\V1\LU\PCT = "133590083155441354" svchost.exe Key created \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\HAM\AUI\App svchost.exe Key created \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App\V1\LU svchost.exe Set value (int) \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App\V1\LU\PTT = "133590082433097517" svchost.exe Key created \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App svchost.exe Key created \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App\V1 svchost.exe Key created \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.Search_cw5n1h2txyewy\HAM\AUI\CortanaUI\V1 svchost.exe Set value (int) \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.Search_cw5n1h2txyewy\HAM\AUI\CortanaUI\V1\LU\ICT = "133579883957059138" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App\V1\LU\PCT = "133590082746847558" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App\V1\LU\PTT = "133590082775129047" svchost.exe Key created \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\HAM\AUI\App\V1\LU svchost.exe Set value (int) \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\HAM\AUI\App\V1\LU\PCT = "133590083157159953" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App\V1\LU\PTT = "133590083165128992" svchost.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 2144 Fattura 00384788-0849838.pdf.exe 2144 Fattura 00384788-0849838.pdf.exe 2320 dkyedvf.exe 2320 dkyedvf.exe 2320 dkyedvf.exe 2320 dkyedvf.exe 2320 dkyedvf.exe 2320 dkyedvf.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2320 dkyedvf.exe Token: SeTcbPrivilege 780 svchost.exe Token: SeTcbPrivilege 780 svchost.exe Token: SeTcbPrivilege 780 svchost.exe Token: SeTcbPrivilege 780 svchost.exe Token: SeTcbPrivilege 780 svchost.exe Token: SeTcbPrivilege 780 svchost.exe Token: SeTcbPrivilege 780 svchost.exe Token: SeTcbPrivilege 780 svchost.exe Token: SeTcbPrivilege 780 svchost.exe Token: SeTcbPrivilege 780 svchost.exe Token: SeTcbPrivilege 780 svchost.exe Token: SeTcbPrivilege 780 svchost.exe Token: SeTcbPrivilege 780 svchost.exe Token: SeTcbPrivilege 780 svchost.exe Token: SeTcbPrivilege 780 svchost.exe Token: SeTcbPrivilege 780 svchost.exe Token: SeTcbPrivilege 780 svchost.exe Token: SeTcbPrivilege 780 svchost.exe Token: SeTcbPrivilege 780 svchost.exe Token: SeTcbPrivilege 780 svchost.exe Token: SeTcbPrivilege 780 svchost.exe Token: SeTcbPrivilege 780 svchost.exe Token: SeTcbPrivilege 780 svchost.exe Token: SeTcbPrivilege 780 svchost.exe Token: SeTcbPrivilege 780 svchost.exe Token: SeTcbPrivilege 780 svchost.exe Token: SeTcbPrivilege 780 svchost.exe Token: SeTcbPrivilege 780 svchost.exe Token: SeTcbPrivilege 780 svchost.exe Token: SeTcbPrivilege 780 svchost.exe Token: SeTcbPrivilege 780 svchost.exe Token: SeTcbPrivilege 780 svchost.exe Token: SeTcbPrivilege 780 svchost.exe Token: SeTcbPrivilege 780 svchost.exe Token: SeTcbPrivilege 780 svchost.exe Token: SeTcbPrivilege 780 svchost.exe Token: SeTcbPrivilege 780 svchost.exe Token: SeTcbPrivilege 780 svchost.exe Token: SeTcbPrivilege 780 svchost.exe Token: SeTcbPrivilege 780 svchost.exe Token: SeTcbPrivilege 780 svchost.exe Token: SeTcbPrivilege 780 svchost.exe Token: SeTcbPrivilege 780 svchost.exe Token: SeTcbPrivilege 780 svchost.exe Token: SeTcbPrivilege 780 svchost.exe Token: SeTcbPrivilege 780 svchost.exe Token: SeTcbPrivilege 780 svchost.exe Token: SeTcbPrivilege 780 svchost.exe Token: SeTcbPrivilege 780 svchost.exe Token: SeTcbPrivilege 780 svchost.exe Token: SeTcbPrivilege 780 svchost.exe Token: SeTcbPrivilege 780 svchost.exe Token: SeTcbPrivilege 780 svchost.exe Token: SeTcbPrivilege 780 svchost.exe Token: SeTcbPrivilege 780 svchost.exe Token: SeTcbPrivilege 780 svchost.exe Token: SeTcbPrivilege 780 svchost.exe Token: SeTcbPrivilege 780 svchost.exe Token: SeTcbPrivilege 780 svchost.exe Token: SeTcbPrivilege 780 svchost.exe Token: SeTcbPrivilege 780 svchost.exe Token: SeTcbPrivilege 780 svchost.exe Token: SeTcbPrivilege 780 svchost.exe -
Suspicious use of WriteProcessMemory 51 IoCs
description pid Process procid_target PID 3272 wrote to memory of 2144 3272 Fattura 00384788-0849838.pdf.exe 93 PID 3272 wrote to memory of 2144 3272 Fattura 00384788-0849838.pdf.exe 93 PID 3272 wrote to memory of 2144 3272 Fattura 00384788-0849838.pdf.exe 93 PID 3272 wrote to memory of 2144 3272 Fattura 00384788-0849838.pdf.exe 93 PID 3272 wrote to memory of 2144 3272 Fattura 00384788-0849838.pdf.exe 93 PID 3272 wrote to memory of 2144 3272 Fattura 00384788-0849838.pdf.exe 93 PID 4224 wrote to memory of 2320 4224 dkyedvf.exe 98 PID 4224 wrote to memory of 2320 4224 dkyedvf.exe 98 PID 4224 wrote to memory of 2320 4224 dkyedvf.exe 98 PID 4224 wrote to memory of 2320 4224 dkyedvf.exe 98 PID 4224 wrote to memory of 2320 4224 dkyedvf.exe 98 PID 4224 wrote to memory of 2320 4224 dkyedvf.exe 98 PID 2320 wrote to memory of 780 2320 dkyedvf.exe 8 PID 780 wrote to memory of 2020 780 svchost.exe 106 PID 780 wrote to memory of 2020 780 svchost.exe 106 PID 780 wrote to memory of 4860 780 svchost.exe 107 PID 780 wrote to memory of 4860 780 svchost.exe 107 PID 780 wrote to memory of 4860 780 svchost.exe 107 PID 780 wrote to memory of 5036 780 svchost.exe 108 PID 780 wrote to memory of 5036 780 svchost.exe 108 PID 780 wrote to memory of 5036 780 svchost.exe 108 PID 780 wrote to memory of 4152 780 svchost.exe 109 PID 780 wrote to memory of 4152 780 svchost.exe 109 PID 780 wrote to memory of 4152 780 svchost.exe 109 PID 780 wrote to memory of 4568 780 svchost.exe 110 PID 780 wrote to memory of 4568 780 svchost.exe 110 PID 780 wrote to memory of 4568 780 svchost.exe 110 PID 780 wrote to memory of 3304 780 svchost.exe 111 PID 780 wrote to memory of 3304 780 svchost.exe 111 PID 780 wrote to memory of 3304 780 svchost.exe 111 PID 780 wrote to memory of 1796 780 svchost.exe 113 PID 780 wrote to memory of 1796 780 svchost.exe 113 PID 780 wrote to memory of 1796 780 svchost.exe 113 PID 780 wrote to memory of 4140 780 svchost.exe 114 PID 780 wrote to memory of 4140 780 svchost.exe 114 PID 780 wrote to memory of 4140 780 svchost.exe 114 PID 780 wrote to memory of 4552 780 svchost.exe 115 PID 780 wrote to memory of 4552 780 svchost.exe 115 PID 780 wrote to memory of 4552 780 svchost.exe 115 PID 780 wrote to memory of 1800 780 svchost.exe 116 PID 780 wrote to memory of 1800 780 svchost.exe 116 PID 780 wrote to memory of 1800 780 svchost.exe 116 PID 780 wrote to memory of 4444 780 svchost.exe 117 PID 780 wrote to memory of 4444 780 svchost.exe 117 PID 780 wrote to memory of 4444 780 svchost.exe 117 PID 780 wrote to memory of 2976 780 svchost.exe 118 PID 780 wrote to memory of 2976 780 svchost.exe 118 PID 780 wrote to memory of 2976 780 svchost.exe 118 PID 780 wrote to memory of 436 780 svchost.exe 119 PID 780 wrote to memory of 436 780 svchost.exe 119 PID 780 wrote to memory of 436 780 svchost.exe 119
Processes
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p1⤵
- Drops desktop.ini file(s)
- Enumerates connected drives
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:780 -
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}2⤵PID:2020
-
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca2⤵PID:4860
-
-
C:\Windows\system32\BackgroundTransferHost.exe"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.12⤵PID:5036
-
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca2⤵PID:4152
-
-
C:\Windows\system32\BackgroundTransferHost.exe"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.12⤵PID:4568
-
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca2⤵PID:3304
-
-
C:\Windows\system32\BackgroundTransferHost.exe"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.12⤵PID:1796
-
-
C:\Windows\system32\BackgroundTransferHost.exe"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.12⤵PID:4140
-
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca2⤵PID:4552
-
-
C:\Windows\system32\BackgroundTransferHost.exe"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.12⤵PID:1800
-
-
C:\Windows\system32\BackgroundTransferHost.exe"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.12⤵PID:4444
-
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca2⤵PID:2976
-
-
C:\Windows\system32\BackgroundTaskHost.exe"C:\Windows\system32\BackgroundTaskHost.exe" -ServerName:BackgroundTaskHost.WebAccountProvider2⤵PID:436
-
-
C:\Users\Admin\AppData\Local\Temp\Fattura 00384788-0849838.pdf.exe"C:\Users\Admin\AppData\Local\Temp\Fattura 00384788-0849838.pdf.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3272 -
C:\Users\Admin\AppData\Local\Temp\Fattura 00384788-0849838.pdf.exe"C:\Users\Admin\AppData\Local\Temp\Fattura 00384788-0849838.pdf.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2144
-
-
C:\Users\Admin\AppData\Local\Temp\dkyedvf.exeC:\Users\Admin\AppData\Local\Temp\dkyedvf.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4224 -
C:\Users\Admin\AppData\Local\Temp\dkyedvf.exeC:\Users\Admin\AppData\Local\Temp\dkyedvf.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2320 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2320 -s 6363⤵
- Program crash
PID:3104
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2320 -s 6523⤵
- Program crash
PID:1960
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2320 -ip 23201⤵PID:3128
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 2320 -ip 23201⤵PID:216
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
654B
MD52d18045636569317c440a98a1dfe8924
SHA176c687fb67972b8f2e7277351b410f1270312a1a
SHA256e97e45480be43f772878c2624d1548f2b6ad25db626a4ecdcd75285a3c8e810e
SHA5126446c99a4f511415145a3888398557edd4197b65823382a34efb6aa4011e1a92a91553e96a3502e39833ef74c9955d08ab79040d73bb39b4aad24d4348ed56df
-
Filesize
867KB
MD5921023d253b6dfac1eaabe38f3b36a45
SHA182ae601f2eb5202a5314feffb2a9bd07c5f33327
SHA256a2deb60615b3bd20beeb9253547a41c0a970139bfb59d9f88854b8b61880ead1
SHA51286229692b51a24e3f29aec482f6aca2109cf98031011a5bc71b756ee1417fe0200c179bde3adfd9dd72dcb5edd553abb98a5c6845b1c42d3e7672038fb7bc115
-
Filesize
11KB
MD5883eff06ac96966270731e4e22817e11
SHA1523c87c98236cbc04430e87ec19b977595092ac8
SHA25644e5dfd551b38e886214bd6b9c8ee913c4c4d1f085a6575d97c3e892b925da82
SHA51260333253342476911c84bbc1d9bf8a29f811207787fdd6107dce8d2b6e031669303f28133ffc811971ed7792087fe90fb1faabc0af4e91c298ba51e28109a390
-
Filesize
2KB
MD500d7ffb88aeb3f3fa5ae3178591139ef
SHA1b5edc99a205912d98207c1314d696dfe48192118
SHA256f8dfac00ca2636f16dbb824c1626a607308bb582356fb736d1ee3f5f2656d861
SHA51203e9df7a1cd6b214b03830b184bf0e7c0abb48da36a184402f2bb3590991bb027cff95cc8751d83cb5c7f7fcddc6969e746056a307d30cfc9fe937010f9a4fa7
-
Filesize
60KB
MD59c655b0c142db0494026c1ebb1b3923f
SHA12dbebe42968e78200688e40ab5b8d25bf8e0b4df
SHA256ef2d114896f07fc20aed5c3045754de0103813aa31bedb188262cec6fb3263dd
SHA51251d7efab18f6909daf61534befa2e20eec437c24114f7c21b383004806d4b8869dc12395a972965c89dbeb66fe0282833207b5aa93ec7f085ca7054d0a0d9f1d
-
Filesize
409B
MD5ade6c65fd0eeb73a60e279fdc7da023b
SHA14af90b3176b51d1e70e5561e27a2a2fd2277edcb
SHA25656c2ecc106829db1020d48fe49a4802a4ee24875a8a873fff86ff0c413a3e226
SHA5126bce13814640b256b83fa54b9d8df0e34076734baaa090b9aa433eefff87324b6782dd36567ea1c231480714c15df30dafb0cc665ea8194c1ada2f956ec0b83e
-
Filesize
136B
MD506a09bda9d5dd7dba611b2dd460d545e
SHA173946d0150e298464b8a55a107bb22be6368029c
SHA256c062646586359c92950920a9e5a51bcec73afeb863dc01337a88adadc789f05e
SHA512b104418ebc3eabf7a3d4aae3a23bdeea63d0118f56397e3763318397baa0b59ed5756a354a922c2c6206636ab761197e379e6fa5b4aa7cf2a60c24416a2ad459
-
Filesize
241B
MD5698f513c0c9d50ac789cfbe4bde1b467
SHA1122acd3c51b72fc2bf4dc556cac09f9e6c6445fa
SHA256f19b204261a5524ed3f5204fbd01d91f06fe1b2181b2fa2c2c7629ccb4e54b16
SHA512c2b5ef941d332d2faa780d044ee5fee6f59d7852e5b0a5974fa47c9b9f03c2b3d867423004eae788ac765f30dbe65bc3b71cd9b679b1ff5dee78eb8fc82f41fc
-
Filesize
684B
MD57d3be2ec810fa01a9ea7d2a26551cff7
SHA17962465ce36a83666fe7a3edcb31e125ed597e93
SHA2561a5660f3f8bb9d18fd6a710d70af26cf1e167fe040d7daf3ce41e527236e1fec
SHA512cd4ba616364f37aa8294c9a2a6b64ed3cf0b011cfcffa9056295b5fc23348c2b3cfa96a25954c6dc472053daa1f9f4b08176a515c95abab6ffd7077deb8d7959