Analysis
-
max time kernel
131s -
max time network
131s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
23-05-2024 22:48
Behavioral task
behavioral1
Sample
5b000e9be237f8c914e7c5292f5387ad269e0ddb57ff8acbc63bae6aa6f07e14.exe
Resource
win7-20240508-en
General
-
Target
5b000e9be237f8c914e7c5292f5387ad269e0ddb57ff8acbc63bae6aa6f07e14.exe
-
Size
3.5MB
-
MD5
484173528bb1a9acca132455e421923f
-
SHA1
81d09d930580ddaa790d0188f38f377a28feb7a4
-
SHA256
5b000e9be237f8c914e7c5292f5387ad269e0ddb57ff8acbc63bae6aa6f07e14
-
SHA512
43af002a53f57792ffa341ea6069b97c648e93ecec693171167dfe21d90af9a47cb42818523325ee6d005f6fef31aa73bcbc8aec90874374248eeb29f62a18a3
-
SSDEEP
24576:TNIPd/zHfWWrwPC6zwXFEc4GdDrGnrdEROGHOhABoaQW8O0C/hRJHOhYa6EZ76d1:TNIlvFEedDqnroHO8wOZHOzH51IGgik
Malware Config
Signatures
-
Detect Blackmoon payload 33 IoCs
Processes:
resource yara_rule behavioral1/memory/2180-2-0x00000000020E0000-0x0000000002305000-memory.dmp family_blackmoon behavioral1/memory/2180-1-0x00000000020E0000-0x0000000002305000-memory.dmp family_blackmoon behavioral1/memory/2180-0-0x00000000020E0000-0x0000000002305000-memory.dmp family_blackmoon behavioral1/memory/2180-3-0x00000000020E0000-0x0000000002305000-memory.dmp family_blackmoon behavioral1/memory/2180-5-0x00000000020E0000-0x0000000002305000-memory.dmp family_blackmoon behavioral1/memory/2180-19-0x00000000029D0000-0x00000000029E1000-memory.dmp family_blackmoon behavioral1/memory/2180-18-0x00000000029D0000-0x00000000029E1000-memory.dmp family_blackmoon behavioral1/memory/2180-31-0x00000000029D0000-0x00000000029E1000-memory.dmp family_blackmoon behavioral1/memory/2180-33-0x00000000020E0000-0x0000000002305000-memory.dmp family_blackmoon behavioral1/memory/2180-10-0x0000000000B70000-0x0000000000B7F000-memory.dmp family_blackmoon behavioral1/memory/2180-20-0x00000000020E0000-0x0000000002305000-memory.dmp family_blackmoon behavioral1/memory/2180-36-0x00000000020E0000-0x0000000002305000-memory.dmp family_blackmoon behavioral1/memory/2180-37-0x0000000000400000-0x0000000000798000-memory.dmp family_blackmoon behavioral1/memory/2180-42-0x00000000020E0000-0x0000000002305000-memory.dmp family_blackmoon behavioral1/memory/2180-47-0x00000000020E0000-0x0000000002305000-memory.dmp family_blackmoon behavioral1/memory/2180-51-0x00000000020E0000-0x0000000002305000-memory.dmp family_blackmoon behavioral1/memory/1572-56-0x00000000020E0000-0x0000000002305000-memory.dmp family_blackmoon behavioral1/memory/1572-54-0x00000000020E0000-0x0000000002305000-memory.dmp family_blackmoon behavioral1/memory/1572-53-0x00000000020E0000-0x0000000002305000-memory.dmp family_blackmoon behavioral1/memory/2180-49-0x0000000000400000-0x0000000000798000-memory.dmp family_blackmoon behavioral1/memory/1572-55-0x00000000020E0000-0x0000000002305000-memory.dmp family_blackmoon behavioral1/memory/1572-58-0x00000000020E0000-0x0000000002305000-memory.dmp family_blackmoon behavioral1/memory/1572-76-0x00000000020E0000-0x0000000002305000-memory.dmp family_blackmoon behavioral1/memory/1572-85-0x0000000000A40000-0x0000000000A51000-memory.dmp family_blackmoon behavioral1/memory/1572-75-0x0000000000A40000-0x0000000000A51000-memory.dmp family_blackmoon behavioral1/memory/1572-74-0x0000000000A40000-0x0000000000A51000-memory.dmp family_blackmoon behavioral1/memory/1572-67-0x0000000000970000-0x000000000097F000-memory.dmp family_blackmoon behavioral1/memory/1572-66-0x00000000020E0000-0x0000000002305000-memory.dmp family_blackmoon behavioral1/memory/1572-92-0x00000000020E0000-0x0000000002305000-memory.dmp family_blackmoon behavioral1/memory/1572-102-0x00000000020E0000-0x0000000002305000-memory.dmp family_blackmoon behavioral1/memory/1572-101-0x00000000020E0000-0x0000000002305000-memory.dmp family_blackmoon behavioral1/memory/1572-104-0x0000000000400000-0x0000000000798000-memory.dmp family_blackmoon behavioral1/memory/1572-108-0x00000000020E0000-0x0000000002305000-memory.dmp family_blackmoon -
Drops file in Drivers directory 2 IoCs
Processes:
5b000e9be237f8c914e7c5292f5387ad269e0ddb57ff8acbc63bae6aa6f07e14.exe5b000e9be237f8c914e7c5292f5387ad269e0ddb57ff8acbc63bae6aa6f07e14.exedescription ioc process File opened for modification C:\WINDOWS\system32\drivers\etc\hosts 5b000e9be237f8c914e7c5292f5387ad269e0ddb57ff8acbc63bae6aa6f07e14.exe File opened for modification C:\WINDOWS\system32\drivers\etc\hosts 5b000e9be237f8c914e7c5292f5387ad269e0ddb57ff8acbc63bae6aa6f07e14.exe -
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
Processes:
resource yara_rule \Windows\SysWOW64\msvcp30.dll acprotect -
Loads dropped DLL 2 IoCs
Processes:
5b000e9be237f8c914e7c5292f5387ad269e0ddb57ff8acbc63bae6aa6f07e14.exe5b000e9be237f8c914e7c5292f5387ad269e0ddb57ff8acbc63bae6aa6f07e14.exepid process 2180 5b000e9be237f8c914e7c5292f5387ad269e0ddb57ff8acbc63bae6aa6f07e14.exe 1572 5b000e9be237f8c914e7c5292f5387ad269e0ddb57ff8acbc63bae6aa6f07e14.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
resource yara_rule behavioral1/memory/2180-19-0x00000000029D0000-0x00000000029E1000-memory.dmp upx behavioral1/memory/2180-18-0x00000000029D0000-0x00000000029E1000-memory.dmp upx \Windows\SysWOW64\msvcp30.dll upx behavioral1/memory/2180-32-0x00000000745F0000-0x000000007462C000-memory.dmp upx behavioral1/memory/2180-31-0x00000000029D0000-0x00000000029E1000-memory.dmp upx behavioral1/memory/2180-16-0x00000000029D0000-0x00000000029E1000-memory.dmp upx behavioral1/memory/2180-38-0x00000000745F0000-0x000000007462C000-memory.dmp upx behavioral1/memory/2180-52-0x00000000745F0000-0x000000007462C000-memory.dmp upx behavioral1/memory/1572-85-0x0000000000A40000-0x0000000000A51000-memory.dmp upx behavioral1/memory/1572-89-0x0000000074910000-0x000000007494C000-memory.dmp upx behavioral1/memory/1572-75-0x0000000000A40000-0x0000000000A51000-memory.dmp upx behavioral1/memory/1572-74-0x0000000000A40000-0x0000000000A51000-memory.dmp upx behavioral1/memory/1572-71-0x0000000000A40000-0x0000000000A51000-memory.dmp upx behavioral1/memory/1572-94-0x0000000074910000-0x000000007494C000-memory.dmp upx behavioral1/memory/1572-105-0x0000000074910000-0x000000007494C000-memory.dmp upx behavioral1/memory/1572-109-0x0000000074910000-0x000000007494C000-memory.dmp upx -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
5b000e9be237f8c914e7c5292f5387ad269e0ddb57ff8acbc63bae6aa6f07e14.exedescription ioc process File opened (read-only) \??\H: 5b000e9be237f8c914e7c5292f5387ad269e0ddb57ff8acbc63bae6aa6f07e14.exe File opened (read-only) \??\I: 5b000e9be237f8c914e7c5292f5387ad269e0ddb57ff8acbc63bae6aa6f07e14.exe File opened (read-only) \??\T: 5b000e9be237f8c914e7c5292f5387ad269e0ddb57ff8acbc63bae6aa6f07e14.exe File opened (read-only) \??\X: 5b000e9be237f8c914e7c5292f5387ad269e0ddb57ff8acbc63bae6aa6f07e14.exe File opened (read-only) \??\J: 5b000e9be237f8c914e7c5292f5387ad269e0ddb57ff8acbc63bae6aa6f07e14.exe File opened (read-only) \??\S: 5b000e9be237f8c914e7c5292f5387ad269e0ddb57ff8acbc63bae6aa6f07e14.exe File opened (read-only) \??\U: 5b000e9be237f8c914e7c5292f5387ad269e0ddb57ff8acbc63bae6aa6f07e14.exe File opened (read-only) \??\Q: 5b000e9be237f8c914e7c5292f5387ad269e0ddb57ff8acbc63bae6aa6f07e14.exe File opened (read-only) \??\R: 5b000e9be237f8c914e7c5292f5387ad269e0ddb57ff8acbc63bae6aa6f07e14.exe File opened (read-only) \??\V: 5b000e9be237f8c914e7c5292f5387ad269e0ddb57ff8acbc63bae6aa6f07e14.exe File opened (read-only) \??\Z: 5b000e9be237f8c914e7c5292f5387ad269e0ddb57ff8acbc63bae6aa6f07e14.exe File opened (read-only) \??\K: 5b000e9be237f8c914e7c5292f5387ad269e0ddb57ff8acbc63bae6aa6f07e14.exe File opened (read-only) \??\L: 5b000e9be237f8c914e7c5292f5387ad269e0ddb57ff8acbc63bae6aa6f07e14.exe File opened (read-only) \??\M: 5b000e9be237f8c914e7c5292f5387ad269e0ddb57ff8acbc63bae6aa6f07e14.exe File opened (read-only) \??\G: 5b000e9be237f8c914e7c5292f5387ad269e0ddb57ff8acbc63bae6aa6f07e14.exe File opened (read-only) \??\N: 5b000e9be237f8c914e7c5292f5387ad269e0ddb57ff8acbc63bae6aa6f07e14.exe File opened (read-only) \??\O: 5b000e9be237f8c914e7c5292f5387ad269e0ddb57ff8acbc63bae6aa6f07e14.exe File opened (read-only) \??\P: 5b000e9be237f8c914e7c5292f5387ad269e0ddb57ff8acbc63bae6aa6f07e14.exe File opened (read-only) \??\W: 5b000e9be237f8c914e7c5292f5387ad269e0ddb57ff8acbc63bae6aa6f07e14.exe File opened (read-only) \??\A: 5b000e9be237f8c914e7c5292f5387ad269e0ddb57ff8acbc63bae6aa6f07e14.exe File opened (read-only) \??\B: 5b000e9be237f8c914e7c5292f5387ad269e0ddb57ff8acbc63bae6aa6f07e14.exe File opened (read-only) \??\E: 5b000e9be237f8c914e7c5292f5387ad269e0ddb57ff8acbc63bae6aa6f07e14.exe File opened (read-only) \??\Y: 5b000e9be237f8c914e7c5292f5387ad269e0ddb57ff8acbc63bae6aa6f07e14.exe -
Drops file in System32 directory 4 IoCs
Processes:
5b000e9be237f8c914e7c5292f5387ad269e0ddb57ff8acbc63bae6aa6f07e14.exe5b000e9be237f8c914e7c5292f5387ad269e0ddb57ff8acbc63bae6aa6f07e14.exedescription ioc process File opened for modification C:\Windows\SysWOW64\msvcp30.ini 5b000e9be237f8c914e7c5292f5387ad269e0ddb57ff8acbc63bae6aa6f07e14.exe File created C:\Windows\SysWOW64\msvcp30.dll 5b000e9be237f8c914e7c5292f5387ad269e0ddb57ff8acbc63bae6aa6f07e14.exe File opened for modification C:\Windows\SysWOW64\msvcp30.ini 5b000e9be237f8c914e7c5292f5387ad269e0ddb57ff8acbc63bae6aa6f07e14.exe File opened for modification C:\Windows\SysWOW64\msvcp30.dll 5b000e9be237f8c914e7c5292f5387ad269e0ddb57ff8acbc63bae6aa6f07e14.exe -
Drops file in Windows directory 6 IoCs
Processes:
5b000e9be237f8c914e7c5292f5387ad269e0ddb57ff8acbc63bae6aa6f07e14.exe5b000e9be237f8c914e7c5292f5387ad269e0ddb57ff8acbc63bae6aa6f07e14.exedescription ioc process File created C:\Windows\msvcp30.ico 5b000e9be237f8c914e7c5292f5387ad269e0ddb57ff8acbc63bae6aa6f07e14.exe File opened for modification C:\Windows\msvcp30.ini 5b000e9be237f8c914e7c5292f5387ad269e0ddb57ff8acbc63bae6aa6f07e14.exe File created C:\Windows\msvcp30.dll 5b000e9be237f8c914e7c5292f5387ad269e0ddb57ff8acbc63bae6aa6f07e14.exe File opened for modification C:\Windows\msvcp30.ico 5b000e9be237f8c914e7c5292f5387ad269e0ddb57ff8acbc63bae6aa6f07e14.exe File opened for modification C:\Windows\msvcp30.ini 5b000e9be237f8c914e7c5292f5387ad269e0ddb57ff8acbc63bae6aa6f07e14.exe File opened for modification C:\Windows\msvcp30.dll 5b000e9be237f8c914e7c5292f5387ad269e0ddb57ff8acbc63bae6aa6f07e14.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000272760bd934871cba4066d95dc1c0e9887a91f158c7e787a11ec0ff2bc6ca66a000000000e800000000200002000000096c2385109491c77b2cc7a0f3255c08fe008d34637c3aa300dcb9664d1501f40200000000ee91f8e591ebae4fb5ab5a83135043c6e9ebe5ddeb1bc6465532cbb2883c21740000000132386ca92749895efc4cb0ec74f22a65370518f051da11bfced0883d172da2921ad6f96acfd1d4abdeb1b503421533a653e8a0ef20de56af7dd09259acc2deb iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CD0CB291-1956-11EF-ACD5-4635F953E0C8} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 301b39a263adda01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000283423c348df6741a0589d4e4f32c5e67480de06508d834e9dc759e75bb0d8d5000000000e8000000002000020000000c1ed550294efb3b43a11bfa97a37e072bf9b90473978459160a4f096356fd2c690000000e38afe72a30edc3eccd093d5c0181c926fc7afbe80fa226791ab9f0351158e1bbab2e615413ba60acf3d1afadca4528720942519a476996fe2e1e70fcf5491d8bb3137d83aec87c99b4cdf28eb3dd16e4f2e3db144744f7ab1456e15f34a7f6008837d3e23d07047e2faf280f4526b1f9276ae0a35b75130c015c4674514f94436132bad2c7ff74199a5ca208608a65c40000000813af9ac4db1aba142dd574f80bc31375591a048f7308c19b14f13ef86e9c0ccb45027abebaee59abbebdfdbb08b30ba93a3a74c734e87dedebca608e30140b4 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe -
Suspicious behavior: LoadsDriver 2 IoCs
Processes:
pid process 476 476 -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
5b000e9be237f8c914e7c5292f5387ad269e0ddb57ff8acbc63bae6aa6f07e14.exe5b000e9be237f8c914e7c5292f5387ad269e0ddb57ff8acbc63bae6aa6f07e14.exedescription pid process Token: SeDebugPrivilege 2180 5b000e9be237f8c914e7c5292f5387ad269e0ddb57ff8acbc63bae6aa6f07e14.exe Token: SeDebugPrivilege 1572 5b000e9be237f8c914e7c5292f5387ad269e0ddb57ff8acbc63bae6aa6f07e14.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 1728 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
5b000e9be237f8c914e7c5292f5387ad269e0ddb57ff8acbc63bae6aa6f07e14.exe5b000e9be237f8c914e7c5292f5387ad269e0ddb57ff8acbc63bae6aa6f07e14.exeiexplore.exeIEXPLORE.EXEpid process 2180 5b000e9be237f8c914e7c5292f5387ad269e0ddb57ff8acbc63bae6aa6f07e14.exe 1572 5b000e9be237f8c914e7c5292f5387ad269e0ddb57ff8acbc63bae6aa6f07e14.exe 1728 iexplore.exe 1728 iexplore.exe 896 IEXPLORE.EXE 896 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
5b000e9be237f8c914e7c5292f5387ad269e0ddb57ff8acbc63bae6aa6f07e14.exe5b000e9be237f8c914e7c5292f5387ad269e0ddb57ff8acbc63bae6aa6f07e14.exeiexplore.exedescription pid process target process PID 2180 wrote to memory of 1572 2180 5b000e9be237f8c914e7c5292f5387ad269e0ddb57ff8acbc63bae6aa6f07e14.exe 5b000e9be237f8c914e7c5292f5387ad269e0ddb57ff8acbc63bae6aa6f07e14.exe PID 2180 wrote to memory of 1572 2180 5b000e9be237f8c914e7c5292f5387ad269e0ddb57ff8acbc63bae6aa6f07e14.exe 5b000e9be237f8c914e7c5292f5387ad269e0ddb57ff8acbc63bae6aa6f07e14.exe PID 2180 wrote to memory of 1572 2180 5b000e9be237f8c914e7c5292f5387ad269e0ddb57ff8acbc63bae6aa6f07e14.exe 5b000e9be237f8c914e7c5292f5387ad269e0ddb57ff8acbc63bae6aa6f07e14.exe PID 2180 wrote to memory of 1572 2180 5b000e9be237f8c914e7c5292f5387ad269e0ddb57ff8acbc63bae6aa6f07e14.exe 5b000e9be237f8c914e7c5292f5387ad269e0ddb57ff8acbc63bae6aa6f07e14.exe PID 1572 wrote to memory of 1728 1572 5b000e9be237f8c914e7c5292f5387ad269e0ddb57ff8acbc63bae6aa6f07e14.exe iexplore.exe PID 1572 wrote to memory of 1728 1572 5b000e9be237f8c914e7c5292f5387ad269e0ddb57ff8acbc63bae6aa6f07e14.exe iexplore.exe PID 1572 wrote to memory of 1728 1572 5b000e9be237f8c914e7c5292f5387ad269e0ddb57ff8acbc63bae6aa6f07e14.exe iexplore.exe PID 1572 wrote to memory of 1728 1572 5b000e9be237f8c914e7c5292f5387ad269e0ddb57ff8acbc63bae6aa6f07e14.exe iexplore.exe PID 1728 wrote to memory of 896 1728 iexplore.exe IEXPLORE.EXE PID 1728 wrote to memory of 896 1728 iexplore.exe IEXPLORE.EXE PID 1728 wrote to memory of 896 1728 iexplore.exe IEXPLORE.EXE PID 1728 wrote to memory of 896 1728 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\5b000e9be237f8c914e7c5292f5387ad269e0ddb57ff8acbc63bae6aa6f07e14.exe"C:\Users\Admin\AppData\Local\Temp\5b000e9be237f8c914e7c5292f5387ad269e0ddb57ff8acbc63bae6aa6f07e14.exe"1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\5b000e9be237f8c914e7c5292f5387ad269e0ddb57ff8acbc63bae6aa6f07e14.exe"C:\Users\Admin\AppData\Local\Temp\5b000e9be237f8c914e7c5292f5387ad269e0ddb57ff8acbc63bae6aa6f07e14.exe" Master2⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://www.30my.com/3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1728 CREDAT:275457 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD53b65f45974605192c20e073c9debaaeb
SHA19f91c14c6101942efb0a5046d47087c05a700688
SHA2563acc3ee07a400ce03b08ab479256f4128785c76d105ba53ad34d864e66bb9ee6
SHA512709268526bb15ab4f14ad03f82ca61526adfd86a53e696a2f4ca99b3d08391e068fa7106d89ba6e08c1862afddf2848bce7cc33c95812d0a8d815fcd4d74147a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD59fbd9ae2574a2d968b91a38014b388ae
SHA18d638713285c33ff87ae8042523178ceae35cc2d
SHA256d34d8ec65af5b9899d0ad29da4db136e30f8f2e5ac6052565eef314fd7b4d185
SHA5125a18699b7dcea1ef1bb95ebd6cb1f181f3badd37054b1948e7450db8559592c38b9acf7d96f17726275902d7d5920a2f7ab924ec83a9ec9922856e5ac1a6e498
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD55c9fc060f4e59390639dffc489aae50c
SHA143811f8d9afd9777d8af8b5882e67e4fcd14cb71
SHA25675c16fad44252cad94fbc155a9c159bf0ab183a15c54558a5c584fe255c6f995
SHA51229a0e02d4a99bbf97698b8665ba9fbffa3a610f692de7e1f2f12f05b6f87b07be03266606cf80a29fb92b84511fba0f99a373dbcdf2c28cfa03b3578317e266c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5c1242697976405d47a46f3a4337edd27
SHA198cdabc8157ecf120f7cb49139dd251ef1266df6
SHA25662e76ba4365012912ab45b720d5651b70481cefef68d565f4d9f3aeae8741e19
SHA512bf06e837e18cbe410954c328e59a64470cc32f1d2089e271e2bbdaedeb8f101c8b1ca7aa44ef3706e8d0821ea4d99b9bdb4b476e2d7e9e8f485b72569d396329
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5b93a083ec70c8f22b95d5bcfe850e03c
SHA1ce52edcf8f49d196c9f0b80f09e3d43bc33bc0b0
SHA256ac592877aa83252af9cde903da49400a5a1e490a37d04cea329ada752d6dba3b
SHA512266fee4e2ad88a4e358dfea84ce7c0b5483a773ebddff899a8a5ef33ff187cad235b120cfa6ed7990ec05f0ee0cb819a0985fba98ec93e178d25febda203e143
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5ba966bd185557927ae8a422676891990
SHA1bb13ed6656818c41e8f23005de66bd6ee869ee84
SHA256c1916f580b5071b804db217ae472d9488b82f6c03c4a3ee135121f21ce45ba79
SHA512a34dbfa17c917eaa9ba125496a9e0420e7ee0f5df068f808b63b1c8f42da03e6e60959b3fbaf0844cde4af02f35501e2a7129b262eb6d5eed35645e1efa9df1b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD52ba3cd3649800f2616f9e01c08683c01
SHA1741acbbc51bfefb8f0d490f16620a1c9ed2f7130
SHA2562bbe64916f7e2ca88c21fa19e343c778c609e0c313be5f36b81ed1f4cd776a89
SHA5123161c2e877aea52504329a9b5a3f1867e559a018a565a7243b08bf3ac1a5f36d1a2f94f234ad1daa1aa073b4045f7beb8321136405da80fd5a4552654a0420aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD50bb222e0edcb7ae902d1b6e498e0d10c
SHA1df02948baee6c00a5fd699f6e0b8f18707b95473
SHA256e54c67f69444ec63dc664fcb5558a23c1fb988eee87e88a3b292738fd30a9aed
SHA512a8193fc585c2e18579b52125d11f351897393dd0e09c190461ff0040d4fc52d08b9a9c8b7bd2e1aa829ae91fa773c0005e1cb56583d647ecaa0553a316ea2f54
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5c4c936e08c0249eab1a271887bc98c33
SHA1f53c95d2593c8d993db724d6302618308e51eed7
SHA2569811c340c1d76602459a9bec552fe88ecd1375f7fc0abc6ba4a68eb756b13d20
SHA512e71aa6a231cb28947cffc0fb0c85b2813ac959893b4b0442787e44af092dcb07cf995f82bd533d6e8813b2151501b8045cd1e43e213ca01aacab7b4d16c291b6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5624b1b21652ceda63cd96603f8b42ac9
SHA14f637b100fe2b04ae3897a45c5d97a268b7c6251
SHA25690b75e2cbc57c12a40c3c64113c6916e2c97617f63d87f89fdb62c900f6a6c8d
SHA512cd3d035fdfd78041d2dac2f21f3e36f4a45ada917d1c9e5182a4256b389dedc14c993769a3f540de06860c1c82370466efce277b1b98f530e8457149c3534703
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD50518877ea34d2be7b7d195876caf1cf3
SHA1b4dbee64727a9e89c777a9d90be6f2fcff22f7fd
SHA256a4ba3ccd2cd3659de6f2c59d0c4516fff5d33e043eba03bdd6511252bb0f95db
SHA5124aa354857500dec9efb316a5ff12e09861386e920f31efff1c290ae8c2a6160eea3ff8de0957433e409742415254644da9c978fad32d4e1dfcaea22ebc7d3828
-
C:\Users\Admin\AppData\Local\Temp\CabA19E.tmpFilesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\Local\Temp\TarA1FF.tmpFilesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a
-
C:\Users\Admin\Desktop\ħÓò·¢²¼Íø.urlFilesize
120B
MD55c8c7c3ce78aa0a9d56f96ab77676682
SHA11a591e2d34152149274f46d754174aa7a7bb2694
SHA25640a172493bd1337c6bfd9c0af15be6d6e5d539135dd766577a05362e859ff806
SHA5128ef03cf1967157cf019d1e7b585a45042642d5a1d82c90ef68f1256e40fe162460e7c26919b1fdf8c33de9f95201ee6a13e69676436d7251a017c04fdf047a77
-
C:\Windows\SysWOW64\msvcp30.iniFilesize
18B
MD52cd7883782c594d2e2654f8fe988fcbe
SHA1042bcb87c29e901d70c0ad0f8fa53e0338c569fc
SHA256aa98ce751ef6ac5401a9278f30c06e250dbbd5e8c2e2c378b0fdf33a205d7037
SHA51288413dc63847682207d2b1e6cdfcb3de9cc73da5f900a1948e4aa262da20056bcb2486ee8a7c8a4f9b0aa3fdff6b99061262fbc67aebc99bf0b42e5bfc7db360
-
C:\Windows\msvcp30.icoFilesize
264KB
MD5bdccf3c42497089ae7001328305906ed
SHA1cf6f28e09d98ebe516b408e6b15f03f5891fdc79
SHA2565f191e3486c0bafdd237f8b79f6ce0f69d1f8c9f8c948d14ab061db36286b2f2
SHA512d7876d8d414ca48903393aa523296ffe35bfa3c6b5bfc4ce70adfc93d31efa61a9bfeea571754cde2e205416e57c13df5c45551b5e6aae6eb53b951065ebbf5d
-
\Windows\SysWOW64\msvcp30.dllFilesize
93KB
MD5a6c4f055c797a43def0a92e5a85923a7
SHA1efaa9c3a065aff6a64066f76e7c77ffcaaf779b2
SHA25673bd285ac6fba28108cdc0d7311e37c4c4fc3ba7d0069c4370778ac3099e21a9
SHA512d8120f7f59c212867c78af42f93db64d35f2d6eae7fc09021c0a6d8ca71a14bd2b2a3006027094ee2edcf65634dcdb3ac96da3ac810171fff021bed4c4254957
-
memory/1572-104-0x0000000000400000-0x0000000000798000-memory.dmpFilesize
3.6MB
-
memory/1572-92-0x00000000020E0000-0x0000000002305000-memory.dmpFilesize
2.1MB
-
memory/1572-108-0x00000000020E0000-0x0000000002305000-memory.dmpFilesize
2.1MB
-
memory/1572-109-0x0000000074910000-0x000000007494C000-memory.dmpFilesize
240KB
-
memory/1572-105-0x0000000074910000-0x000000007494C000-memory.dmpFilesize
240KB
-
memory/1572-103-0x00000000028B0000-0x00000000028B1000-memory.dmpFilesize
4KB
-
memory/1572-101-0x00000000020E0000-0x0000000002305000-memory.dmpFilesize
2.1MB
-
memory/1572-56-0x00000000020E0000-0x0000000002305000-memory.dmpFilesize
2.1MB
-
memory/1572-54-0x00000000020E0000-0x0000000002305000-memory.dmpFilesize
2.1MB
-
memory/1572-53-0x00000000020E0000-0x0000000002305000-memory.dmpFilesize
2.1MB
-
memory/1572-102-0x00000000020E0000-0x0000000002305000-memory.dmpFilesize
2.1MB
-
memory/1572-55-0x00000000020E0000-0x0000000002305000-memory.dmpFilesize
2.1MB
-
memory/1572-57-0x0000000010000000-0x0000000010008000-memory.dmpFilesize
32KB
-
memory/1572-58-0x00000000020E0000-0x0000000002305000-memory.dmpFilesize
2.1MB
-
memory/1572-76-0x00000000020E0000-0x0000000002305000-memory.dmpFilesize
2.1MB
-
memory/1572-85-0x0000000000A40000-0x0000000000A51000-memory.dmpFilesize
68KB
-
memory/1572-89-0x0000000074910000-0x000000007494C000-memory.dmpFilesize
240KB
-
memory/1572-94-0x0000000074910000-0x000000007494C000-memory.dmpFilesize
240KB
-
memory/1572-75-0x0000000000A40000-0x0000000000A51000-memory.dmpFilesize
68KB
-
memory/1572-74-0x0000000000A40000-0x0000000000A51000-memory.dmpFilesize
68KB
-
memory/1572-71-0x0000000000A40000-0x0000000000A51000-memory.dmpFilesize
68KB
-
memory/1572-67-0x0000000000970000-0x000000000097F000-memory.dmpFilesize
60KB
-
memory/1572-66-0x00000000020E0000-0x0000000002305000-memory.dmpFilesize
2.1MB
-
memory/2180-38-0x00000000745F0000-0x000000007462C000-memory.dmpFilesize
240KB
-
memory/2180-20-0x00000000020E0000-0x0000000002305000-memory.dmpFilesize
2.1MB
-
memory/2180-41-0x0000000010000000-0x0000000010008000-memory.dmpFilesize
32KB
-
memory/2180-37-0x0000000000400000-0x0000000000798000-memory.dmpFilesize
3.6MB
-
memory/2180-49-0x0000000000400000-0x0000000000798000-memory.dmpFilesize
3.6MB
-
memory/2180-52-0x00000000745F0000-0x000000007462C000-memory.dmpFilesize
240KB
-
memory/2180-51-0x00000000020E0000-0x0000000002305000-memory.dmpFilesize
2.1MB
-
memory/2180-48-0x0000000000AD0000-0x0000000000AD1000-memory.dmpFilesize
4KB
-
memory/2180-2-0x00000000020E0000-0x0000000002305000-memory.dmpFilesize
2.1MB
-
memory/2180-47-0x00000000020E0000-0x0000000002305000-memory.dmpFilesize
2.1MB
-
memory/2180-42-0x00000000020E0000-0x0000000002305000-memory.dmpFilesize
2.1MB
-
memory/2180-36-0x00000000020E0000-0x0000000002305000-memory.dmpFilesize
2.1MB
-
memory/2180-10-0x0000000000B70000-0x0000000000B7F000-memory.dmpFilesize
60KB
-
memory/2180-33-0x00000000020E0000-0x0000000002305000-memory.dmpFilesize
2.1MB
-
memory/2180-16-0x00000000029D0000-0x00000000029E1000-memory.dmpFilesize
68KB
-
memory/2180-31-0x00000000029D0000-0x00000000029E1000-memory.dmpFilesize
68KB
-
memory/2180-32-0x00000000745F0000-0x000000007462C000-memory.dmpFilesize
240KB
-
memory/2180-18-0x00000000029D0000-0x00000000029E1000-memory.dmpFilesize
68KB
-
memory/2180-19-0x00000000029D0000-0x00000000029E1000-memory.dmpFilesize
68KB
-
memory/2180-5-0x00000000020E0000-0x0000000002305000-memory.dmpFilesize
2.1MB
-
memory/2180-4-0x0000000010000000-0x0000000010008000-memory.dmpFilesize
32KB
-
memory/2180-3-0x00000000020E0000-0x0000000002305000-memory.dmpFilesize
2.1MB
-
memory/2180-0-0x00000000020E0000-0x0000000002305000-memory.dmpFilesize
2.1MB
-
memory/2180-1-0x00000000020E0000-0x0000000002305000-memory.dmpFilesize
2.1MB