Overview
overview
10Static
static
3Fattura 00...df.exe
windows7-x64
10Fattura 00...df.exe
windows10-2004-x64
7$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3NsResize.dll
windows7-x64
3NsResize.dll
windows10-2004-x64
3default_hash.js
ubuntu-18.04-amd64
1default_hash.js
debian-9-armhf
1default_hash.js
debian-9-mips
default_hash.js
debian-9-mipsel
Analysis
- max time kernel
145s - max time network
103s - platform
windows10-2004_x64 - resource
win10v2004-20240419-en - resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system - submitted
01/05/2024, 03:36
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
Fattura 00384788-0849838.pdf.exe
Resource
win7-20240221-en
windows7-x64
24 signatures
150 seconds
Behavioral task
behavioral2
Sample
Fattura 00384788-0849838.pdf.exe
Resource
win10v2004-20240419-en
windows10-2004-x64
15 signatures
150 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240215-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240419-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral5
Sample
NsResize.dll
Resource
win7-20240221-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral6
Sample
NsResize.dll
Resource
win10v2004-20240426-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral7
Sample
default_hash.js
Resource
ubuntu1804-amd64-20240226-en
ubuntu-18.04-amd64
0 signatures
150 seconds
Behavioral task
behavioral8
Sample
default_hash.js
Resource
debian9-armhf-20240226-en
debian-9-armhf
0 signatures
150 seconds
Behavioral task
behavioral9
Sample
default_hash.js
Resource
debian9-mipsbe-20240418-en
debian-9-mips
0 signatures
150 seconds
Behavioral task
behavioral10
Sample
default_hash.js
Resource
debian9-mipsel-20240418-en
debian-9-mipsel
0 signatures
150 seconds
General
- Target Fattura 00384788-0849838.pdf.exe
- Size 867KB
- Sample240501-d5zefafa2s
- SHA256 a2deb60615b3bd20beeb9253547a41c0a970139bfb59d9f88854b8b61880ead1
- MD5 921023d253b6dfac1eaabe38f3b36a45
- SHA1 82ae601f2eb5202a5314feffb2a9bd07c5f33327
- SHA512 86229692b51a24e3f29aec482f6aca2109cf98031011a5bc71b756ee1417fe0200c179bde3adfd9dd72dcb5edd553abb98a5c6845b1c42d3e7672038fb7bc115
- SSDEEP 24576:+XH+j3CgxpmJI+QhQ3r+HVqQUEHpGzOUPZ:Jj3CgxpNhN16EHpCx
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
pid Process 4224 dkyedvf.exe 2320 dkyedvf.exe - Loads dropped DLL 6 IoCs
pid Process 3272 Fattura 00384788-0849838.pdf.exe 3272 Fattura 00384788-0849838.pdf.exe 3272 Fattura 00384788-0849838.pdf.exe 4224 dkyedvf.exe 4224 dkyedvf.exe 4224 dkyedvf.exe - Drops desktop.ini file(s) 2 IoCs
description ioc Process File opened for modification C:\$RECYCLE.BIN\S-1-5-18\desktop.ini svchost.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-18\desktop.ini svchost.exe - Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\F: svchost.exe - Drops file in System32 directory 56 IoCs
description ioc Process File created C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\refentry.source.name.profile.enabled.xml dkyedvf.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\html.ext.xml dkyedvf.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\LICENSE_en_US.txt dkyedvf.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\use.id.as.filename.xml dkyedvf.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\brzphon.env dkyedvf.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\page.width.xml dkyedvf.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\use.role.as.xrefstyle.xml dkyedvf.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\manifest.xml dkyedvf.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\qanda.title.level3.properties.xml dkyedvf.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\Warm Gray 11 bl 3.ADO dkyedvf.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\CurveFitting.vbw dkyedvf.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\zy______.pfm dkyedvf.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\SequenceFrequency.mm dkyedvf.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\xslthl-config.xml dkyedvf.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\NsResize.dll dkyedvf.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\16ps.png dkyedvf.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\25.svg dkyedvf.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\LoadLayers.exv dkyedvf.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\zy______.pfm dkyedvf.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\49-sansserif.conf dkyedvf.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\multiframe.xml dkyedvf.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\pass.png dkyedvf.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\P_AutoAlign_Interactive_87x38.png dkyedvf.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\refentry.generate.name.xml dkyedvf.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\ExampleXML2PDF.java dkyedvf.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\South_Georgia dkyedvf.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\VsUntexturedInstanced.hlsl dkyedvf.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\variablelist.max.termlength.xml dkyedvf.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\f20.png dkyedvf.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\tweakBIOSDriversFirmwareUpdate_ru.p5p dkyedvf.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\qanda.title.level2.properties.xml dkyedvf.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\Bosun.mNa dkyedvf.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\htmlhelp.use.hhk.xml dkyedvf.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\slvphon.env dkyedvf.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\root.properties.xml dkyedvf.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\g1_1366 x 768 px 72 ppi.IMZ dkyedvf.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\DuelOmmatidium.Jsg dkyedvf.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\g2_Letter 8.5 x 11 in 300 dpi.IMZ dkyedvf.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\setup.iss dkyedvf.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\Ext-RKSJ-V dkyedvf.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\pcdrsound.p5m dkyedvf.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\inventory_3.png dkyedvf.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\htmlhelp.title.xml dkyedvf.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\README-en dkyedvf.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\green 3405 bl 4.ADO dkyedvf.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\Sydney dkyedvf.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\refentry.separator.xml dkyedvf.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\Kiev dkyedvf.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\BMY brown 2.ADO dkyedvf.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\PSNormalMap.hlsl dkyedvf.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\cations dkyedvf.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\README_kn_IN.txt dkyedvf.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\GMT+8 dkyedvf.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\Windows.act dkyedvf.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\default_hash.js dkyedvf.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\green 349 bl 1.ADO dkyedvf.exe - Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 3272 set thread context of 2144 3272 Fattura 00384788-0849838.pdf.exe 93 PID 4224 set thread context of 2320 4224 dkyedvf.exe 98 - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\ dkyedvf.exe File opened for modification C:\Windows\ Fattura 00384788-0849838.pdf.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 2 IoCs
pid pid_target Process procid_target 3104 2320 WerFault.exe 98 1960 2320 WerFault.exe 98 - NSIS installer 2 IoCs
resource yara_rule behavioral2/files/0x0014000000023ba5-75.dat nsis_installer_1 behavioral2/files/0x0014000000023ba5-75.dat nsis_installer_2 - Modifies data under HKEY_USERS 23 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{a8f5de66-0000-0000-0000-f0ff3a000000}\NukeOnDelete = "0" svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{a8f5de66-0000-0000-0000-f0ff3a000000} svchost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\LastEnum = 30002c007b00610038006600350064006500360036002d0030003000300030002d0030003000300030002d0030003000300030002d006400300031003200300030003000300030003000300030007d00000030002c007b00610038006600350064006500360036002d0030003000300030002d0030003000300030002d0030003000300030002d006600300066006600330061003000300030003000300030007d0000000000 svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\DefaultIcon svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{a8f5de66-0000-0000-0000-d01200000000}\MaxCapacity = "14116" svchost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\DefaultIcon\ = "%SystemRoot%\\System32\\imageres.dll,-55" svchost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\DefaultIcon\Full = "%SystemRoot%\\System32\\imageres.dll,-54" svchost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Control Panel\Desktop\TileWallpaper = "0" svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{645FF040-5081-101B-9F08-00AA002F954E} svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{a8f5de66-0000-0000-0000-f0ff3a000000}\MaxCapacity = "2047" svchost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\DefaultIcon\Empty = "%SystemRoot%\\System32\\imageres.dll,-55" svchost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@%SystemRoot%\system32\shell32.dll,-50176 = "File Operation" svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{a8f5de66-0000-0000-0000-d01200000000}\NukeOnDelete = "0" svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft svchost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Control Panel\Desktop\WallpaperStyle = "0" svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{a8f5de66-0000-0000-0000-d01200000000} svchost.exe - Modifies registry class 32 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App\V1\LU\PCT = "133590082416847439" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App\V1\LU\PCT = "133590082428722526" svchost.exe Key created \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI svchost.exe Set value (int) \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App\V1\LU\PTT = "133590082099191501" svchost.exe Key created \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.Search_cw5n1h2txyewy svchost.exe Key created \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.Search_cw5n1h2txyewy\HAM\AUI\CortanaUI svchost.exe Set value (int) \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.Search_cw5n1h2txyewy\HAM\AUI\CortanaUI\V1\LU\PCT = "133579883954402836" svchost.exe Key created \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\HAM\AUI svchost.exe Key created \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\HAM\AUI\App\V1 svchost.exe Set value (int) \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\HAM\AUI\App\V1\LU\PTT = "133590083158253856" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App\V1\LU\PCT = "133590082082785528" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App\V1\LU\PCT = "133590082423253689" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App\V1\LU\PTT = "133590082758566541" svchost.exe Key created \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy svchost.exe Key created \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.Search_cw5n1h2txyewy\HAM\AUI svchost.exe Key created \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy svchost.exe Key created \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.Search_cw5n1h2txyewy\HAM\AUI\CortanaUI\V1\LU svchost.exe Set value (int) \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App\V1\LU\PCT = "133590082757472467" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App\V1\LU\PCT = "133590082768410047" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App\V1\LU\PCT = "133590083155441354" svchost.exe Key created \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\HAM\AUI\App svchost.exe Key created \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App\V1\LU svchost.exe Set value (int) \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App\V1\LU\PTT = "133590082433097517" svchost.exe Key created \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App svchost.exe Key created \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App\V1 svchost.exe Key created \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.Search_cw5n1h2txyewy\HAM\AUI\CortanaUI\V1 svchost.exe Set value (int) \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.Search_cw5n1h2txyewy\HAM\AUI\CortanaUI\V1\LU\ICT = "133579883957059138" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App\V1\LU\PCT = "133590082746847558" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App\V1\LU\PTT = "133590082775129047" svchost.exe Key created \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\HAM\AUI\App\V1\LU svchost.exe Set value (int) \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\HAM\AUI\App\V1\LU\PCT = "133590083157159953" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App\V1\LU\PTT = "133590083165128992" svchost.exe - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 2144 Fattura 00384788-0849838.pdf.exe 2144 Fattura 00384788-0849838.pdf.exe 2320 dkyedvf.exe 2320 dkyedvf.exe 2320 dkyedvf.exe 2320 dkyedvf.exe 2320 dkyedvf.exe 2320 dkyedvf.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2320 dkyedvf.exe Token: SeTcbPrivilege 780 svchost.exe Token: SeTcbPrivilege 780 svchost.exe Token: SeTcbPrivilege 780 svchost.exe Token: SeTcbPrivilege 780 svchost.exe Token: SeTcbPrivilege 780 svchost.exe Token: SeTcbPrivilege 780 svchost.exe Token: SeTcbPrivilege 780 svchost.exe Token: SeTcbPrivilege 780 svchost.exe Token: SeTcbPrivilege 780 svchost.exe Token: SeTcbPrivilege 780 svchost.exe Token: SeTcbPrivilege 780 svchost.exe Token: SeTcbPrivilege 780 svchost.exe Token: SeTcbPrivilege 780 svchost.exe Token: SeTcbPrivilege 780 svchost.exe Token: SeTcbPrivilege 780 svchost.exe Token: SeTcbPrivilege 780 svchost.exe Token: SeTcbPrivilege 780 svchost.exe Token: SeTcbPrivilege 780 svchost.exe Token: SeTcbPrivilege 780 svchost.exe Token: SeTcbPrivilege 780 svchost.exe Token: SeTcbPrivilege 780 svchost.exe Token: SeTcbPrivilege 780 svchost.exe Token: SeTcbPrivilege 780 svchost.exe Token: SeTcbPrivilege 780 svchost.exe Token: SeTcbPrivilege 780 svchost.exe Token: SeTcbPrivilege 780 svchost.exe Token: SeTcbPrivilege 780 svchost.exe Token: SeTcbPrivilege 780 svchost.exe Token: SeTcbPrivilege 780 svchost.exe Token: SeTcbPrivilege 780 svchost.exe Token: SeTcbPrivilege 780 svchost.exe Token: SeTcbPrivilege 780 svchost.exe Token: SeTcbPrivilege 780 svchost.exe Token: SeTcbPrivilege 780 svchost.exe Token: SeTcbPrivilege 780 svchost.exe Token: SeTcbPrivilege 780 svchost.exe Token: SeTcbPrivilege 780 svchost.exe Token: SeTcbPrivilege 780 svchost.exe Token: SeTcbPrivilege 780 svchost.exe Token: SeTcbPrivilege 780 svchost.exe Token: SeTcbPrivilege 780 svchost.exe Token: SeTcbPrivilege 780 svchost.exe Token: SeTcbPrivilege 780 svchost.exe Token: SeTcbPrivilege 780 svchost.exe Token: SeTcbPrivilege 780 svchost.exe Token: SeTcbPrivilege 780 svchost.exe Token: SeTcbPrivilege 780 svchost.exe Token: SeTcbPrivilege 780 svchost.exe Token: SeTcbPrivilege 780 svchost.exe Token: SeTcbPrivilege 780 svchost.exe Token: SeTcbPrivilege 780 svchost.exe Token: SeTcbPrivilege 780 svchost.exe Token: SeTcbPrivilege 780 svchost.exe Token: SeTcbPrivilege 780 svchost.exe Token: SeTcbPrivilege 780 svchost.exe Token: SeTcbPrivilege 780 svchost.exe Token: SeTcbPrivilege 780 svchost.exe Token: SeTcbPrivilege 780 svchost.exe Token: SeTcbPrivilege 780 svchost.exe Token: SeTcbPrivilege 780 svchost.exe Token: SeTcbPrivilege 780 svchost.exe Token: SeTcbPrivilege 780 svchost.exe Token: SeTcbPrivilege 780 svchost.exe - Suspicious use of WriteProcessMemory 51 IoCs
description pid Process procid_target PID 3272 wrote to memory of 2144 3272 Fattura 00384788-0849838.pdf.exe 93 PID 3272 wrote to memory of 2144 3272 Fattura 00384788-0849838.pdf.exe 93 PID 3272 wrote to memory of 2144 3272 Fattura 00384788-0849838.pdf.exe 93 PID 3272 wrote to memory of 2144 3272 Fattura 00384788-0849838.pdf.exe 93 PID 3272 wrote to memory of 2144 3272 Fattura 00384788-0849838.pdf.exe 93 PID 3272 wrote to memory of 2144 3272 Fattura 00384788-0849838.pdf.exe 93 PID 4224 wrote to memory of 2320 4224 dkyedvf.exe 98 PID 4224 wrote to memory of 2320 4224 dkyedvf.exe 98 PID 4224 wrote to memory of 2320 4224 dkyedvf.exe 98 PID 4224 wrote to memory of 2320 4224 dkyedvf.exe 98 PID 4224 wrote to memory of 2320 4224 dkyedvf.exe 98 PID 4224 wrote to memory of 2320 4224 dkyedvf.exe 98 PID 2320 wrote to memory of 780 2320 dkyedvf.exe 8 PID 780 wrote to memory of 2020 780 svchost.exe 106 PID 780 wrote to memory of 2020 780 svchost.exe 106 PID 780 wrote to memory of 4860 780 svchost.exe 107 PID 780 wrote to memory of 4860 780 svchost.exe 107 PID 780 wrote to memory of 4860 780 svchost.exe 107 PID 780 wrote to memory of 5036 780 svchost.exe 108 PID 780 wrote to memory of 5036 780 svchost.exe 108 PID 780 wrote to memory of 5036 780 svchost.exe 108 PID 780 wrote to memory of 4152 780 svchost.exe 109 PID 780 wrote to memory of 4152 780 svchost.exe 109 PID 780 wrote to memory of 4152 780 svchost.exe 109 PID 780 wrote to memory of 4568 780 svchost.exe 110 PID 780 wrote to memory of 4568 780 svchost.exe 110 PID 780 wrote to memory of 4568 780 svchost.exe 110 PID 780 wrote to memory of 3304 780 svchost.exe 111 PID 780 wrote to memory of 3304 780 svchost.exe 111 PID 780 wrote to memory of 3304 780 svchost.exe 111 PID 780 wrote to memory of 1796 780 svchost.exe 113 PID 780 wrote to memory of 1796 780 svchost.exe 113 PID 780 wrote to memory of 1796 780 svchost.exe 113 PID 780 wrote to memory of 4140 780 svchost.exe 114 PID 780 wrote to memory of 4140 780 svchost.exe 114 PID 780 wrote to memory of 4140 780 svchost.exe 114 PID 780 wrote to memory of 4552 780 svchost.exe 115 PID 780 wrote to memory of 4552 780 svchost.exe 115 PID 780 wrote to memory of 4552 780 svchost.exe 115 PID 780 wrote to memory of 1800 780 svchost.exe 116 PID 780 wrote to memory of 1800 780 svchost.exe 116 PID 780 wrote to memory of 1800 780 svchost.exe 116 PID 780 wrote to memory of 4444 780 svchost.exe 117 PID 780 wrote to memory of 4444 780 svchost.exe 117 PID 780 wrote to memory of 4444 780 svchost.exe 117 PID 780 wrote to memory of 2976 780 svchost.exe 118 PID 780 wrote to memory of 2976 780 svchost.exe 118 PID 780 wrote to memory of 2976 780 svchost.exe 118 PID 780 wrote to memory of 436 780 svchost.exe 119 PID 780 wrote to memory of 436 780 svchost.exe 119 PID 780 wrote to memory of 436 780 svchost.exe 119
Processes
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p1⤵
- Drops desktop.ini file(s)
- Enumerates connected drives
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:780 -
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}2⤵PID:2020
-
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca2⤵PID:4860
-
-
C:\Windows\system32\BackgroundTransferHost.exe"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.12⤵PID:5036
-
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca2⤵PID:4152
-
-
C:\Windows\system32\BackgroundTransferHost.exe"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.12⤵PID:4568
-
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca2⤵PID:3304
-
-
C:\Windows\system32\BackgroundTransferHost.exe"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.12⤵PID:1796
-
-
C:\Windows\system32\BackgroundTransferHost.exe"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.12⤵PID:4140
-
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca2⤵PID:4552
-
-
C:\Windows\system32\BackgroundTransferHost.exe"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.12⤵PID:1800
-
-
C:\Windows\system32\BackgroundTransferHost.exe"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.12⤵PID:4444
-
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca2⤵PID:2976
-
-
C:\Windows\system32\BackgroundTaskHost.exe"C:\Windows\system32\BackgroundTaskHost.exe" -ServerName:BackgroundTaskHost.WebAccountProvider2⤵PID:436
-
-
C:\Users\Admin\AppData\Local\Temp\Fattura 00384788-0849838.pdf.exe"C:\Users\Admin\AppData\Local\Temp\Fattura 00384788-0849838.pdf.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3272 -
C:\Users\Admin\AppData\Local\Temp\Fattura 00384788-0849838.pdf.exe"C:\Users\Admin\AppData\Local\Temp\Fattura 00384788-0849838.pdf.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2144
-
-
C:\Users\Admin\AppData\Local\Temp\dkyedvf.exeC:\Users\Admin\AppData\Local\Temp\dkyedvf.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4224 -
C:\Users\Admin\AppData\Local\Temp\dkyedvf.exeC:\Users\Admin\AppData\Local\Temp\dkyedvf.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2320 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2320 -s 6363⤵
- Program crash
PID:3104
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2320 -s 6523⤵
- Program crash
PID:1960
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2320 -ip 23201⤵PID:3128
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 2320 -ip 23201⤵PID:216
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\suaiuka
- Size 654B
- SHA256 e97e45480be43f772878c2624d1548f2b6ad25db626a4ecdcd75285a3c8e810e
- MD5 2d18045636569317c440a98a1dfe8924
- SHA1 76c687fb67972b8f2e7277351b410f1270312a1a
- SHA512 6446c99a4f511415145a3888398557edd4197b65823382a34efb6aa4011e1a92a91553e96a3502e39833ef74c9955d08ab79040d73bb39b4aad24d4348ed56df
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\dkyedvf.exe
- Size 867KB
- SHA256 a2deb60615b3bd20beeb9253547a41c0a970139bfb59d9f88854b8b61880ead1
- MD5 921023d253b6dfac1eaabe38f3b36a45
- SHA1 82ae601f2eb5202a5314feffb2a9bd07c5f33327
- SHA512 86229692b51a24e3f29aec482f6aca2109cf98031011a5bc71b756ee1417fe0200c179bde3adfd9dd72dcb5edd553abb98a5c6845b1c42d3e7672038fb7bc115
- SSDEEP 24576:+XH+j3CgxpmJI+QhQ3r+HVqQUEHpGzOUPZ:Jj3CgxpNhN16EHpCx
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\nsb3190.tmp\System.dll
- Size 11KB
- SHA256 44e5dfd551b38e886214bd6b9c8ee913c4c4d1f085a6575d97c3e892b925da82
- MD5 883eff06ac96966270731e4e22817e11
- SHA1 523c87c98236cbc04430e87ec19b977595092ac8
- SHA512 60333253342476911c84bbc1d9bf8a29f811207787fdd6107dce8d2b6e031669303f28133ffc811971ed7792087fe90fb1faabc0af4e91c298ba51e28109a390
- SSDEEP 96:UPDYcJ+nx4vVp76JX7zBlkCg21Fxz4THxtrqw1at0JgwLEjo+OB3yUVCdl/wNj+l:UPtkuWJX7zB3kGwfy0nyUVsxCjOMb1u
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\LICENSE_en_US.TXT
- Size 2KB
- SHA256 f8dfac00ca2636f16dbb824c1626a607308bb582356fb736d1ee3f5f2656d861
- MD5 00d7ffb88aeb3f3fa5ae3178591139ef
- SHA1 b5edc99a205912d98207c1314d696dfe48192118
- SHA512 03e9df7a1cd6b214b03830b184bf0e7c0abb48da36a184402f2bb3590991bb027cff95cc8751d83cb5c7f7fcddc6969e746056a307d30cfc9fe937010f9a4fa7
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\NsResize.dll
- Size 60KB
- SHA256 ef2d114896f07fc20aed5c3045754de0103813aa31bedb188262cec6fb3263dd
- MD5 9c655b0c142db0494026c1ebb1b3923f
- SHA1 2dbebe42968e78200688e40ab5b8d25bf8e0b4df
- SHA512 51d7efab18f6909daf61534befa2e20eec437c24114f7c21b383004806d4b8869dc12395a972965c89dbeb66fe0282833207b5aa93ec7f085ca7054d0a0d9f1d
- SSDEEP 768:qGFZmKGqWJ0hYkuyws9yon9dmkVL8L+vR/2nArYDRjrn9To+:q6mfmYkuX3onDmkVLm+o7DB9To
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\README_kn_IN.TXT
- Size 409B
- SHA256 56c2ecc106829db1020d48fe49a4802a4ee24875a8a873fff86ff0c413a3e226
- MD5 ade6c65fd0eeb73a60e279fdc7da023b
- SHA1 4af90b3176b51d1e70e5561e27a2a2fd2277edcb
- SHA512 6bce13814640b256b83fa54b9d8df0e34076734baaa090b9aa433eefff87324b6782dd36567ea1c231480714c15df30dafb0cc665ea8194c1ada2f956ec0b83e
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\default_hash.JS
- Size 136B
- SHA256 c062646586359c92950920a9e5a51bcec73afeb863dc01337a88adadc789f05e
- MD5 06a09bda9d5dd7dba611b2dd460d545e
- SHA1 73946d0150e298464b8a55a107bb22be6368029c
- SHA512 b104418ebc3eabf7a3d4aae3a23bdeea63d0118f56397e3763318397baa0b59ed5756a354a922c2c6206636ab761197e379e6fa5b4aa7cf2a60c24416a2ad459
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\setup.ISS
- Size 241B
- SHA256 f19b204261a5524ed3f5204fbd01d91f06fe1b2181b2fa2c2c7629ccb4e54b16
- MD5 698f513c0c9d50ac789cfbe4bde1b467
- SHA1 122acd3c51b72fc2bf4dc556cac09f9e6c6445fa
- SHA512 c2b5ef941d332d2faa780d044ee5fee6f59d7852e5b0a5974fa47c9b9f03c2b3d867423004eae788ac765f30dbe65bc3b71cd9b679b1ff5dee78eb8fc82f41fc
- MD5 SHA1 SHA512
- Path C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\zy______.pfm
- Size 684B
- SHA256 1a5660f3f8bb9d18fd6a710d70af26cf1e167fe040d7daf3ce41e527236e1fec
- MD5 7d3be2ec810fa01a9ea7d2a26551cff7
- SHA1 7962465ce36a83666fe7a3edcb31e125ed597e93
- SHA512 cd4ba616364f37aa8294c9a2a6b64ed3cf0b011cfcffa9056295b5fc23348c2b3cfa96a25954c6dc472053daa1f9f4b08176a515c95abab6ffd7077deb8d7959
- MD5 SHA1 SHA512