njrat | 2cdb40eac305ccd9d25319aab18d9af4f1be4068ab65dd5f18ba8841c71a9464

Analysis

max time kernel
95s
max time network
99s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 13:57

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

lol.exe
Size

4.3MB
MD5

db328f188ed341579a63b66c109670a1
SHA1

3ac3932b8b1696967e9a75da7f3b1cfcb2b22df5
SHA256

2cdb40eac305ccd9d25319aab18d9af4f1be4068ab65dd5f18ba8841c71a9464
SHA512

53e3c175ad68c66d9426e03bdb094ceb8febd89eae89b3b6f7f635efc78119f70723f08b30ee0752cb8ac33fba174d0efe46427f508906865eab86486366a59a
SSDEEP

49152:WoGapAv1vYjUbQgvdkMgl2Zu7jfWL2ntzMqS1MTetxQnVIqwlwHnEOGc:WoGapAv1vYjWSMy7PlnVw1/6q1ONB

Score

10^/10

njrat umbral discovery evasion persistence spyware stealer trojan

Malware Config

Signatures

Detect Umbral payload 1 IoCs

resource	yara_rule
behavioral1/files/0x0007000000023412-339.dat	family_umbral

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	anljwisfod.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	anljwisfod.exe

Umbral
Umbral stealer is an opensource moduler stealer written in C#.
stealer umbral

Windows security bypass 2 TTPs 5 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	anljwisfod.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	anljwisfod.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	anljwisfod.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	anljwisfod.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	anljwisfod.exe

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Disables RegEdit via registry modification 1 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	anljwisfod.exe

Modifies Installed Components in the registry 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}	unregmp2.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}\DontAsk = "2"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}\Version = "12,0,19041,1266"	unregmp2.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}\IsInstalled = "0"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}\Stubpath = "%SystemRoot%\\system32\\unregmp2.exe /ShowWMP"	unregmp2.exe

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	jaffa.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	lol.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	loader.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	cmd.exe

Executes dropped EXE 11 IoCs

pid	Process
4520	loader.exe
1172	ac3.exe
1276	jaffa.exe
1848	jkka.exe
2888	anljwisfod.exe
1080	dptlkhbbdfkcneh.exe
2868	dbxezquy.exe
1796	xhtinitncqcae.exe
4536	dbxezquy.exe
5324	packer.exe
5984	ac3.exe

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
4808	icacls.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Windows security modification 2 TTPs 6 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	anljwisfod.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	anljwisfod.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	anljwisfod.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	anljwisfod.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	anljwisfod.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirstRunDisabled = "1"	anljwisfod.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\tbwrnbtc = "anljwisfod.exe"	dptlkhbbdfkcneh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\wrnlfcpd = "dptlkhbbdfkcneh.exe"	dptlkhbbdfkcneh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ = "xhtinitncqcae.exe"	dptlkhbbdfkcneh.exe

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini	unregmp2.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\g:	dbxezquy.exe
File opened (read-only)	\??\r:	dbxezquy.exe
File opened (read-only)	\??\j:	anljwisfod.exe
File opened (read-only)	\??\i:	dbxezquy.exe
File opened (read-only)	\??\P:	unregmp2.exe
File opened (read-only)	\??\Y:	unregmp2.exe
File opened (read-only)	\??\p:	dbxezquy.exe
File opened (read-only)	\??\s:	anljwisfod.exe
File opened (read-only)	\??\x:	dbxezquy.exe
File opened (read-only)	\??\I:	unregmp2.exe
File opened (read-only)	\??\W:	unregmp2.exe
File opened (read-only)	\??\X:	unregmp2.exe
File opened (read-only)	\??\o:	anljwisfod.exe
File opened (read-only)	\??\q:	dbxezquy.exe
File opened (read-only)	\??\A:	unregmp2.exe
File opened (read-only)	\??\S:	wmplayer.exe
File opened (read-only)	\??\o:	dbxezquy.exe
File opened (read-only)	\??\A:	wmplayer.exe
File opened (read-only)	\??\Q:	wmplayer.exe
File opened (read-only)	\??\i:	dbxezquy.exe
File opened (read-only)	\??\g:	dbxezquy.exe
File opened (read-only)	\??\H:	wmplayer.exe
File opened (read-only)	\??\l:	dbxezquy.exe
File opened (read-only)	\??\M:	unregmp2.exe
File opened (read-only)	\??\T:	unregmp2.exe
File opened (read-only)	\??\h:	anljwisfod.exe
File opened (read-only)	\??\y:	anljwisfod.exe
File opened (read-only)	\??\h:	dbxezquy.exe
File opened (read-only)	\??\m:	dbxezquy.exe
File opened (read-only)	\??\j:	dbxezquy.exe
File opened (read-only)	\??\z:	dbxezquy.exe
File opened (read-only)	\??\Z:	wmplayer.exe
File opened (read-only)	\??\s:	dbxezquy.exe
File opened (read-only)	\??\K:	unregmp2.exe
File opened (read-only)	\??\M:	wmplayer.exe
File opened (read-only)	\??\l:	anljwisfod.exe
File opened (read-only)	\??\L:	unregmp2.exe
File opened (read-only)	\??\K:	wmplayer.exe
File opened (read-only)	\??\Y:	wmplayer.exe
File opened (read-only)	\??\e:	dbxezquy.exe
File opened (read-only)	\??\u:	dbxezquy.exe
File opened (read-only)	\??\x:	dbxezquy.exe
File opened (read-only)	\??\E:	wmplayer.exe
File opened (read-only)	\??\v:	dbxezquy.exe
File opened (read-only)	\??\H:	unregmp2.exe
File opened (read-only)	\??\m:	anljwisfod.exe
File opened (read-only)	\??\R:	unregmp2.exe
File opened (read-only)	\??\Z:	unregmp2.exe
File opened (read-only)	\??\n:	anljwisfod.exe
File opened (read-only)	\??\k:	dbxezquy.exe
File opened (read-only)	\??\p:	dbxezquy.exe
File opened (read-only)	\??\J:	unregmp2.exe
File opened (read-only)	\??\I:	wmplayer.exe
File opened (read-only)	\??\n:	dbxezquy.exe
File opened (read-only)	\??\r:	dbxezquy.exe
File opened (read-only)	\??\t:	anljwisfod.exe
File opened (read-only)	\??\w:	dbxezquy.exe
File opened (read-only)	\??\B:	unregmp2.exe
File opened (read-only)	\??\a:	anljwisfod.exe
File opened (read-only)	\??\N:	unregmp2.exe
File opened (read-only)	\??\U:	unregmp2.exe
File opened (read-only)	\??\U:	wmplayer.exe
File opened (read-only)	\??\x:	anljwisfod.exe
File opened (read-only)	\??\h:	dbxezquy.exe

Modifies WinLogon 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0"	anljwisfod.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197"	anljwisfod.exe

AutoIT Executable 12 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/files/0x0007000000023409-59.dat	autoit_exe
behavioral1/files/0x000700000002340c-68.dat	autoit_exe
behavioral1/memory/1276-69-0x0000000000400000-0x0000000000496000-memory.dmp	autoit_exe
behavioral1/files/0x000700000002342a-76.dat	autoit_exe
behavioral1/files/0x000700000002342c-98.dat	autoit_exe
behavioral1/files/0x000700000002342b-100.dat	autoit_exe
behavioral1/files/0x000700000002342e-105.dat	autoit_exe
behavioral1/files/0x0007000000023450-172.dat	autoit_exe
behavioral1/files/0x000800000002347c-302.dat	autoit_exe
behavioral1/files/0x000800000002347e-308.dat	autoit_exe
behavioral1/files/0x000c000000023357-364.dat	autoit_exe
behavioral1/files/0x000c000000023357-402.dat	autoit_exe

Drops file in System32 directory 12 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\dptlkhbbdfkcneh.exe	jaffa.exe
File created	C:\Windows\SysWOW64\dbxezquy.exe	jaffa.exe
File opened for modification	C:\Windows\SysWOW64\dbxezquy.exe	jaffa.exe
File created	C:\Windows\SysWOW64\xhtinitncqcae.exe	jaffa.exe
File created	\??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe	dbxezquy.exe
File opened for modification	\??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe	dbxezquy.exe
File opened for modification	C:\Windows\SysWOW64\anljwisfod.exe	jaffa.exe
File created	C:\Windows\SysWOW64\dptlkhbbdfkcneh.exe	jaffa.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	anljwisfod.exe
File opened for modification	\??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe	dbxezquy.exe
File created	C:\Windows\SysWOW64\anljwisfod.exe	jaffa.exe
File opened for modification	C:\Windows\SysWOW64\xhtinitncqcae.exe	jaffa.exe

Drops file in Program Files directory 15 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe	dbxezquy.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe	dbxezquy.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe	dbxezquy.exe
File created	\??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe	dbxezquy.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe	dbxezquy.exe
File opened for modification	C:\Program Files\Windows Media Player\wmplayer.exe	unregmp2.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe	dbxezquy.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal	dbxezquy.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal	dbxezquy.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal	dbxezquy.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe	dbxezquy.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe	dbxezquy.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe	dbxezquy.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal	dbxezquy.exe
File created	\??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe	dbxezquy.exe

Drops file in Windows directory 22 IoCs

description	ioc	Process
File opened for modification	C:\Windows\mydoc.rtf	jaffa.exe
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll	svchost.exe
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll	svchost.exe
File opened for modification	\??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe	dbxezquy.exe
File created	\??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe	dbxezquy.exe
File opened for modification	\??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe	dbxezquy.exe
File created	\??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe	dbxezquy.exe
File created	\??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe	dbxezquy.exe
File opened for modification	\??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe	dbxezquy.exe
File opened for modification	\??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe	dbxezquy.exe
File created	C:\Windows\~$mydoc.rtf	WINWORD.EXE
File opened for modification	\??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe	dbxezquy.exe
File opened for modification	\??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe	dbxezquy.exe
File created	\??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe	dbxezquy.exe
File created	\??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe	dbxezquy.exe
File created	C:\Windows\rescache\_merged\2229298842\1183240423.pri	LogonUI.exe
File opened for modification	C:\Windows\mydoc.rtf	WINWORD.EXE
File created	\??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe	dbxezquy.exe
File created	\??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe	dbxezquy.exe
File created	\??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe	dbxezquy.exe
File opened for modification	\??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe	dbxezquy.exe
File opened for modification	\??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe	dbxezquy.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5216	5324	WerFault.exe	134

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Kills process with taskkill 3 IoCs

evasion

pid	Process
1068	taskkill.exe
540	taskkill.exe
3196	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40b00f586054bf01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{84B854B2-190C-11EF-BCA5-62BC6A84A035} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50660d586054bf01	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\""	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d1e79f6d909f104fb1f0d8157143e287000000000200000000001066000000010000200000009812337936f09887c3bd3738c90914d61f816636ffb677397bb721dd77e385fa000000000e800000000200002000000065c9a215da22d0b0f7a6c8b59a33535ca4885a5068415148607a8d377774cfb720000000e13709bb86adbb00cc6c9aca4dd159dd416fd21bbd02d6adcca32aeb599a223b40000000d4bf2e53bd69df5f8b78a664866587feb34ce986b38c4593b08c52a445a162e371b2259c4b7db3dab7e5b536a016c483545003fda1473f3dffa8eefd1b77aea2	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d1e79f6d909f104fb1f0d8157143e2870000000002000000000010660000000100002000000079ffdea73c5d564b47d1c418a17d2847ec485a82eade5bf8ea44a98f9dcb7b02000000000e80000000020000200000009913c466d86c0d49ddf0400cde6a36d2235a61e7f6490bac4218f363ded9dad1200000008a76e603d495db35734efa80905e7d856a4f7ba3d19b6601440356a650aeba1240000000f8cf98532c60bc12d1650777b84c0d3f9a5d8ceb0b4beb2bc77d484b92e56b3519a93b6220924e8b1d172f1e7fb00ac9b126d5d3c55cabc58a8f239ca5acf98b	iexplore.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "233"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image\shellex\ContextMenuHandlers\PlayTo\ = "{7AD84985-87B4-4a16-BE58-8B72A5B390F7}"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shell\Play\ = "&Play with Windows Media Player"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shell\Play\command\DelegateExecute = "{ed1d0fdf-4414-470a-a56d-cfb68623fc58}"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shell\Play\MUIVerb = "@%SystemRoot%\\system32\\unregmp2.exe,-9801"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.wsf	anljwisfod.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\audio\shell\Enqueue\command	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shell\Enqueue\NeverDefault	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shell\Play\command\DelegateExecute = "{ed1d0fdf-4414-470a-a56d-cfb68623fc58}"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image\shell\Enqueue\NeverDefault	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.wsh	anljwisfod.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.wsc	anljwisfod.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shellex\ContextMenuHandlers\PlayTo\ = "{7AD84985-87B4-4a16-BE58-8B72A5B390F7}"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\audio\shell\Play\command	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Audio\shell\Enqueue\NeverDefault	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shell\Enqueue\NeverDefault	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.WSH\ = "txtfile"	anljwisfod.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\video\shellex\ContextMenuHandlers\PlayTo	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Video\shellex\ContextMenuHandlers\PlayTo\ = "{7AD84985-87B4-4a16-BE58-8B72A5B390F7}"	unregmp2.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image\shell\Play\command\DelegateExecute = "{ed1d0fdf-4414-470a-a56d-cfb68623fc58}"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Audio\shell\Play	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Audio\shellex\ContextMenuHandlers\PlayTo	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image\shell\Play\MUIVerb = "@%SystemRoot%\\system32\\unregmp2.exe,-9801"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shellex\ContextMenuHandlers\PlayTo\ = "{7AD84985-87B4-4a16-BE58-8B72A5B390F7}"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Audio\shell\Enqueue	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shell\Enqueue\command	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\image\shellex\ContextMenuHandlers\PlayTo	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\audio\shell\Enqueue\MUIVerb = "@%SystemRoot%\\system32\\unregmp2.exe,-9800"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Audio\shell\Play\NeverDefault	unregmp2.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLV.Classes	jaffa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\audio\shell\Play\ = "&Play with Windows Media Player"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\audio\shell\Play\MUIVerb = "@%SystemRoot%\\system32\\unregmp2.exe,-9801"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shell\Play\NeverDefault	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\NetworkExplorerPlugins\urn:schemas-upnp-org:device:MediaRenderer:1\ShellEx\ContextMenuHandlers\{17FC1A80-140E-4290-A64F-4A29A951A867}	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\audio\shell\Enqueue\command\DelegateExecute = "{45597c98-80f6-4549-84ff-752cf55e2d29}"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shell\Enqueue\command	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.bat	anljwisfod.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image\shell\Enqueue\MUIVerb = "@%SystemRoot%\\system32\\unregmp2.exe,-9800"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com1 = "33422C769C2583556D4476A077252CD87D8164DD"	jaffa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.wsc\ = "txtfile"	anljwisfod.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image\shell\Enqueue\ = "&Add to Windows Media Player list"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com3 = "2FB0B12844E6399852C4B9D333E9D4CF"	jaffa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Audio\shell\Enqueue\ = "&Add to Windows Media Player list"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\audio\shellex\ContextMenuHandlers\PlayTo	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shell\Enqueue\MUIVerb = "@%SystemRoot%\\system32\\unregmp2.exe,-9800"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom1 = "E0F56BB7FF1A22DAD27ED0D38B7D9110"	jaffa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shell\Enqueue\command\DelegateExecute = "{45597c98-80f6-4549-84ff-752cf55e2d29}"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shell\Play\command	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Audio\shell\Play\ = "&Play with Windows Media Player"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Audio\shell\Play\MUIVerb = "@%SystemRoot%\\system32\\unregmp2.exe,-9801"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image\shell\Play\ = "&Play with Windows Media Player"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.vbs	anljwisfod.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Audio\shell\Enqueue\command	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image\shell\Play\NeverDefault	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shell\Play	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\audio\shell\Enqueue	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shell\Enqueue\ = "&Add to Windows Media Player list"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shell\Enqueue\MUIVerb = "@%SystemRoot%\\system32\\unregmp2.exe,-9800"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image\shellex\ContextMenuHandlers\PlayTo	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom2 = "193EC70815ECDAB7B8B97CE7EC9E34CD"	jaffa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.reg	anljwisfod.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shell\Play\MUIVerb = "@%SystemRoot%\\system32\\unregmp2.exe,-9801"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com2 = "6AC8F9CBFE10F195837B3B3286993993B08B028B4363033AE1BF429E08A2"	jaffa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.WSF\ = "txtfile"	anljwisfod.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
3576	NOTEPAD.EXE

Suspicious behavior: AddClipboardFormatListener 3 IoCs

pid	Process
1092	WINWORD.EXE
1092	WINWORD.EXE
5544	vlc.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1836	msedge.exe
1836	msedge.exe
4656	msedge.exe
4656	msedge.exe
1276	jaffa.exe
1276	jaffa.exe
1276	jaffa.exe
1276	jaffa.exe
1276	jaffa.exe
1276	jaffa.exe
1276	jaffa.exe
1276	jaffa.exe
1276	jaffa.exe
1276	jaffa.exe
1276	jaffa.exe
1276	jaffa.exe
1276	jaffa.exe
1276	jaffa.exe
1276	jaffa.exe
1276	jaffa.exe
2868	dbxezquy.exe
2868	dbxezquy.exe
2868	dbxezquy.exe
2868	dbxezquy.exe
2868	dbxezquy.exe
2868	dbxezquy.exe
2868	dbxezquy.exe
2868	dbxezquy.exe
2888	anljwisfod.exe
2888	anljwisfod.exe
2888	anljwisfod.exe
2888	anljwisfod.exe
2888	anljwisfod.exe
2888	anljwisfod.exe
2888	anljwisfod.exe
2888	anljwisfod.exe
2888	anljwisfod.exe
2888	anljwisfod.exe
1080	dptlkhbbdfkcneh.exe
1080	dptlkhbbdfkcneh.exe
1080	dptlkhbbdfkcneh.exe
1080	dptlkhbbdfkcneh.exe
1080	dptlkhbbdfkcneh.exe
1080	dptlkhbbdfkcneh.exe
1080	dptlkhbbdfkcneh.exe
1080	dptlkhbbdfkcneh.exe
1080	dptlkhbbdfkcneh.exe
1080	dptlkhbbdfkcneh.exe
1796	xhtinitncqcae.exe
1796	xhtinitncqcae.exe
1796	xhtinitncqcae.exe
1796	xhtinitncqcae.exe
1796	xhtinitncqcae.exe
1796	xhtinitncqcae.exe
1796	xhtinitncqcae.exe
1796	xhtinitncqcae.exe
1796	xhtinitncqcae.exe
1796	xhtinitncqcae.exe
1796	xhtinitncqcae.exe
1796	xhtinitncqcae.exe
1080	dptlkhbbdfkcneh.exe
1080	dptlkhbbdfkcneh.exe
1796	xhtinitncqcae.exe
1796	xhtinitncqcae.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5544	vlc.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
4656	msedge.exe
4656	msedge.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeDebugPrivilege	540	taskkill.exe
Token: SeDebugPrivilege	3196	taskkill.exe
Token: SeDebugPrivilege	1068	taskkill.exe
Token: SeSystemtimePrivilege	3036	cmd.exe
Token: SeSystemtimePrivilege	3036	cmd.exe
Token: SeShutdownPrivilege	4832	unregmp2.exe
Token: SeCreatePagefilePrivilege	4832	unregmp2.exe
Token: SeShutdownPrivilege	5316	wmplayer.exe
Token: SeCreatePagefilePrivilege	5316	wmplayer.exe

Suspicious use of FindShellTrayWindow 58 IoCs

pid	Process
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
1932	iexplore.exe
1276	jaffa.exe
1276	jaffa.exe
1276	jaffa.exe
2888	anljwisfod.exe
2888	anljwisfod.exe
2888	anljwisfod.exe
2868	dbxezquy.exe
1080	dptlkhbbdfkcneh.exe
2868	dbxezquy.exe
1080	dptlkhbbdfkcneh.exe
2868	dbxezquy.exe
1080	dptlkhbbdfkcneh.exe
1796	xhtinitncqcae.exe
1796	xhtinitncqcae.exe
1796	xhtinitncqcae.exe
4536	dbxezquy.exe
4536	dbxezquy.exe
4536	dbxezquy.exe
1092	WINWORD.EXE
1092	WINWORD.EXE
4656	msedge.exe
5316	wmplayer.exe
5544	vlc.exe
5544	vlc.exe
5544	vlc.exe
5544	vlc.exe
5544	vlc.exe
5544	vlc.exe
5544	vlc.exe
5544	vlc.exe
5544	vlc.exe
5544	vlc.exe

Suspicious use of SendNotifyMessage 51 IoCs

pid	Process
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
1276	jaffa.exe
1276	jaffa.exe
1276	jaffa.exe
2888	anljwisfod.exe
2888	anljwisfod.exe
2888	anljwisfod.exe
2868	dbxezquy.exe
1080	dptlkhbbdfkcneh.exe
2868	dbxezquy.exe
1080	dptlkhbbdfkcneh.exe
2868	dbxezquy.exe
1080	dptlkhbbdfkcneh.exe
1796	xhtinitncqcae.exe
1796	xhtinitncqcae.exe
1796	xhtinitncqcae.exe
4536	dbxezquy.exe
4536	dbxezquy.exe
4536	dbxezquy.exe
5544	vlc.exe
5544	vlc.exe
5544	vlc.exe
5544	vlc.exe
5544	vlc.exe
5544	vlc.exe
5544	vlc.exe
5544	vlc.exe
5544	vlc.exe

Suspicious use of SetWindowsHookEx 14 IoCs

pid	Process
1932	iexplore.exe
1932	iexplore.exe
4160	IEXPLORE.EXE
4160	IEXPLORE.EXE
1092	WINWORD.EXE
1092	WINWORD.EXE
1092	WINWORD.EXE
1092	WINWORD.EXE
1092	WINWORD.EXE
1092	WINWORD.EXE
1092	WINWORD.EXE
5544	vlc.exe
3700	LogonUI.exe
3700	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1320 wrote to memory of 4520	1320	lol.exe	84
PID 1320 wrote to memory of 4520	1320	lol.exe	84
PID 4520 wrote to memory of 2988	4520	loader.exe	86
PID 4520 wrote to memory of 2988	4520	loader.exe	86
PID 2988 wrote to memory of 3036	2988	cmd.exe	88
PID 2988 wrote to memory of 3036	2988	cmd.exe	88
PID 3036 wrote to memory of 4656	3036	cmd.exe	91
PID 3036 wrote to memory of 4656	3036	cmd.exe	91
PID 4656 wrote to memory of 4980	4656	msedge.exe	94
PID 4656 wrote to memory of 4980	4656	msedge.exe	94
PID 3036 wrote to memory of 2056	3036	cmd.exe	95
PID 3036 wrote to memory of 2056	3036	cmd.exe	95
PID 3036 wrote to memory of 1932	3036	cmd.exe	96
PID 3036 wrote to memory of 1932	3036	cmd.exe	96
PID 3036 wrote to memory of 540	3036	cmd.exe	97
PID 3036 wrote to memory of 540	3036	cmd.exe	97
PID 4656 wrote to memory of 3336	4656	msedge.exe	98
PID 4656 wrote to memory of 3336	4656	msedge.exe	98
PID 4656 wrote to memory of 3336	4656	msedge.exe	98
PID 4656 wrote to memory of 3336	4656	msedge.exe	98
PID 4656 wrote to memory of 3336	4656	msedge.exe	98
PID 4656 wrote to memory of 3336	4656	msedge.exe	98
PID 4656 wrote to memory of 3336	4656	msedge.exe	98
PID 4656 wrote to memory of 3336	4656	msedge.exe	98
PID 4656 wrote to memory of 3336	4656	msedge.exe	98
PID 4656 wrote to memory of 3336	4656	msedge.exe	98
PID 4656 wrote to memory of 3336	4656	msedge.exe	98
PID 4656 wrote to memory of 3336	4656	msedge.exe	98
PID 4656 wrote to memory of 3336	4656	msedge.exe	98
PID 4656 wrote to memory of 3336	4656	msedge.exe	98
PID 4656 wrote to memory of 3336	4656	msedge.exe	98
PID 4656 wrote to memory of 3336	4656	msedge.exe	98
PID 4656 wrote to memory of 3336	4656	msedge.exe	98
PID 4656 wrote to memory of 3336	4656	msedge.exe	98
PID 4656 wrote to memory of 3336	4656	msedge.exe	98
PID 4656 wrote to memory of 3336	4656	msedge.exe	98
PID 4656 wrote to memory of 3336	4656	msedge.exe	98
PID 4656 wrote to memory of 3336	4656	msedge.exe	98
PID 4656 wrote to memory of 3336	4656	msedge.exe	98
PID 4656 wrote to memory of 3336	4656	msedge.exe	98
PID 4656 wrote to memory of 3336	4656	msedge.exe	98
PID 4656 wrote to memory of 3336	4656	msedge.exe	98
PID 4656 wrote to memory of 3336	4656	msedge.exe	98
PID 4656 wrote to memory of 3336	4656	msedge.exe	98
PID 4656 wrote to memory of 3336	4656	msedge.exe	98
PID 4656 wrote to memory of 3336	4656	msedge.exe	98
PID 4656 wrote to memory of 3336	4656	msedge.exe	98
PID 4656 wrote to memory of 3336	4656	msedge.exe	98
PID 4656 wrote to memory of 3336	4656	msedge.exe	98
PID 4656 wrote to memory of 3336	4656	msedge.exe	98
PID 4656 wrote to memory of 3336	4656	msedge.exe	98
PID 4656 wrote to memory of 3336	4656	msedge.exe	98
PID 4656 wrote to memory of 3336	4656	msedge.exe	98
PID 4656 wrote to memory of 3336	4656	msedge.exe	98
PID 4656 wrote to memory of 3336	4656	msedge.exe	98
PID 4656 wrote to memory of 3336	4656	msedge.exe	98
PID 4656 wrote to memory of 1836	4656	msedge.exe	99
PID 4656 wrote to memory of 1836	4656	msedge.exe	99
PID 4656 wrote to memory of 4676	4656	msedge.exe	100
PID 4656 wrote to memory of 4676	4656	msedge.exe	100
PID 4656 wrote to memory of 4676	4656	msedge.exe	100
PID 4656 wrote to memory of 4676	4656	msedge.exe	100
PID 4656 wrote to memory of 4676	4656	msedge.exe	100
PID 4656 wrote to memory of 4676	4656	msedge.exe	100

C:\Users\Admin\AppData\Local\Temp\lol.exe
"C:\Users\Admin\AppData\Local\Temp\lol.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1320
- C:\Users\Admin\Desktop\lol_c2e1b4a1-95f2-4440-acc7-2ab0e3f0a94f\loader.exe
  "C:\Users\Admin\Desktop\lol_c2e1b4a1-95f2-4440-acc7-2ab0e3f0a94f\loader.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4520
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\lol_c2e1b4a1-95f2-4440-acc7-2ab0e3f0a94f\temp.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2988
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K main.cmd
      4⤵
      Checks computer location settings
      Modifies registry class
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3036
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\lol_c2e1b4a1-95f2-4440-acc7-2ab0e3f0a94f\web.htm
        5⤵
        Enumerates system info in registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:4656
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd4c7646f8,0x7ffd4c764708,0x7ffd4c764718
        6⤵
        
        PID:4980
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2172,17979725885546411970,9305356807029521656,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2184 /prefetch:2
        6⤵
        
        PID:3336
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2172,17979725885546411970,9305356807029521656,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2256 /prefetch:3
        6⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1836
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2172,17979725885546411970,9305356807029521656,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2612 /prefetch:8
        6⤵
        
        PID:4676
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,17979725885546411970,9305356807029521656,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
        6⤵
        
        PID:4488
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,17979725885546411970,9305356807029521656,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
        6⤵
        
        PID:4904
      - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2172,17979725885546411970,9305356807029521656,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5064 /prefetch:8
        6⤵
        
        PID:5212
      - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2172,17979725885546411970,9305356807029521656,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5064 /prefetch:8
        6⤵
        
        PID:5476
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\lol_c2e1b4a1-95f2-4440-acc7-2ab0e3f0a94f\helper.vbs"
        5⤵
        
        PID:2056
    - - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\lol_c2e1b4a1-95f2-4440-acc7-2ab0e3f0a94f\spinner.gif
        5⤵
        Modifies Internet Explorer settings
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        
        PID:1932
      - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1932 CREDAT:17410 /prefetch:2
        6⤵
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:4160
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im taskmgr
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:540
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:3196
    - - C:\Users\Admin\Desktop\lol_c2e1b4a1-95f2-4440-acc7-2ab0e3f0a94f\ac3.exe
        
        ac3.exe
        5⤵
        Executes dropped EXE
        
        PID:1172
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im fontdrvhost
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1068
    - - C:\Windows\system32\icacls.exe
        
        icacls c:\Windows\explorer.exe /grant Admin:(F,M)
        5⤵
        Modifies file permissions
        
        PID:4808
    - - C:\Users\Admin\Desktop\lol_c2e1b4a1-95f2-4440-acc7-2ab0e3f0a94f\jaffa.exe
        
        jaffa.exe
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        Drops file in Windows directory
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:1276
      - C:\Windows\SysWOW64\anljwisfod.exe
        
        anljwisfod.exe
        6⤵
        Modifies visibility of file extensions in Explorer
        Modifies visiblity of hidden/system files in Explorer
        Windows security bypass
        Disables RegEdit via registry modification
        Executes dropped EXE
        Windows security modification
        Enumerates connected drives
        Modifies WinLogon
        Drops file in System32 directory
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:2888
        
        C:\Windows\SysWOW64\dbxezquy.exe
        
        C:\Windows\system32\dbxezquy.exe
        7⤵
        Executes dropped EXE
        Enumerates connected drives
        Drops file in System32 directory
        Drops file in Program Files directory
        Drops file in Windows directory
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:4536
      - C:\Windows\SysWOW64\dptlkhbbdfkcneh.exe
        
        dptlkhbbdfkcneh.exe
        6⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:1080
      - C:\Windows\SysWOW64\dbxezquy.exe
        
        dbxezquy.exe
        6⤵
        Executes dropped EXE
        Enumerates connected drives
        Drops file in System32 directory
        Drops file in Program Files directory
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:2868
      - C:\Windows\SysWOW64\xhtinitncqcae.exe
        
        xhtinitncqcae.exe
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:1796
      - C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
        
        "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""
        6⤵
        Drops file in Windows directory
        Checks processor information in registry
        Enumerates system info in registry
        Suspicious behavior: AddClipboardFormatListener
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        
        PID:1092
    - - C:\Windows\system32\iexpress.exe
        
        IEXPRESS.exe
        5⤵
        
        PID:4992
    - - C:\Users\Admin\Desktop\lol_c2e1b4a1-95f2-4440-acc7-2ab0e3f0a94f\jkka.exe
        
        jkka.exe
        5⤵
        Executes dropped EXE
        
        PID:1848
- C:\Users\Admin\AppData\Local\Temp\8b6add3b-22b4-4132-91f4-25ce66cb1a53\packer.exe
  "C:\Users\Admin\AppData\Local\Temp\8b6add3b-22b4-4132-91f4-25ce66cb1a53\packer.exe" "C:\Users\Admin\AppData\Local\Temp\8b6add3b-22b4-4132-91f4-25ce66cb1a53\unpacker.exe" "C:\Users\Admin\AppData\Local\Temp\lol.exe" "loader.exe" "C:\Users\Admin\Desktop\lol_c2e1b4a1-95f2-4440-acc7-2ab0e3f0a94f" "" True True False 1 -repack
  2⤵
  - Executes dropped EXE
  PID:5324
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5324 -s 1248
    3⤵
    - Program crash
    PID:5216

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1408

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1092

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 5324 -ip 5324
1⤵
PID:2112

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5864

C:\Users\Admin\Desktop\lol_c2e1b4a1-95f2-4440-acc7-2ab0e3f0a94f\ac3.exe
"C:\Users\Admin\Desktop\lol_c2e1b4a1-95f2-4440-acc7-2ab0e3f0a94f\ac3.exe"
1⤵
- Executes dropped EXE
PID:5984

C:\Program Files (x86)\Windows Media Player\wmplayer.exe
"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Play -Embedding
1⤵
PID:3588
- C:\Program Files (x86)\Windows Media Player\setup_wm.exe
  "C:\Program Files (x86)\Windows Media Player\setup_wm.exe" /RunOnce:"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Play -Embedding
  2⤵
  PID:4396
- - C:\Windows\SysWOW64\unregmp2.exe
    C:\Windows\system32\unregmp2.exe /ShowWMP /SetShowState /CreateMediaLibrary
    3⤵
    PID:5152
  - - C:\Windows\system32\unregmp2.exe
      "C:\Windows\SysNative\unregmp2.exe" /ShowWMP /SetShowState /CreateMediaLibrary /REENTRANT
      4⤵
      Modifies Installed Components in the registry
      Drops desktop.ini file(s)
      Drops file in Program Files directory
      Modifies registry class
      PID:5456
- - C:\Program Files (x86)\Windows Media Player\wmplayer.exe
    "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Relaunch /Play C:\Users\Admin\Desktop\TestCompare.mp2
    3⤵
    - Enumerates connected drives
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    PID:5316
- C:\Windows\SysWOW64\unregmp2.exe
  "C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon
  2⤵
  PID:5480
- - C:\Windows\system32\unregmp2.exe
    "C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT
    3⤵
    - Enumerates connected drives
    - Suspicious use of AdjustPrivilegeToken
    PID:4832

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s upnphost
1⤵
- Drops file in Windows directory
PID:5904

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\ResumeEnter.wmv"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:5544

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\CheckpointOut.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:3576

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa390b055 /state1:0x41c64e6d
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:3700

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

File and Directory Permissions Modification

T1222

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe

Filesize
512KB

MD5
4812b87604e5240a0880b6d7eb60aa48

SHA1
52f8b96805c7ae5caf1506c495a6231d804d2ed7

SHA256
f2bbb1ff55d37a0d7c45d829289e39be80ba66c6c7895d367f1d0620718d3037

SHA512
055dec08aed0be6f6021ac45002ae0a3f889a7dd8ce0f3e8f5bdb38b4e44f4e7aad6f7023c61c67ff1b86b8d03d063ed90d93ec7c524ad6c81f3935c220d49f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\8be07ae6-97a1-4c54-a0d0-f6cc95ab2b0d.tmp

Filesize
11KB

MD5
19fac300ab21131815790605b84a605f

SHA1
699b95ce526198a23c1eb11db4dac5337d704d83

SHA256
958b4027668eaecca44794092ba3f8f28ecf1e4bd45e981a2ac0af05dd20f384

SHA512
4f8e0d1e627b3f416d34b8b4d74e6c61a6d832918ed6768b9ca06dd5a3682163c298bb8b69d0981fb1ae9073ca6451e68882a1597700add2916abb0979617940

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4158365912175436289496136e7912c2

SHA1
813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59

SHA256
354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1

SHA512
74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ce4c898f8fc7601e2fbc252fdadb5115

SHA1
01bf06badc5da353e539c7c07527d30dccc55a91

SHA256
bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa

SHA512
80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
434f7b8de7a78140f731d9b00c7ec127

SHA1
061fdb0443cc85855e090dbf08253dacf8ae7aa6

SHA256
6b1db1eee4c88578da71c7dc0ca8b0ed2e5b69b72cc7ee66b837717c50636f25

SHA512
8da6e77c5f6edbe38673b24900884de2109ec5a06cb23cad48389b8e6953bd30a7a99f105dfeaa4ca962fa565e0204e3cbbf3e6894747265188719a1d359c9a2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
4995073cd89db465514ba67f718d4250

SHA1
4a8dc26a2fcc161b31716a3c7d0de61a3c53e406

SHA256
0fcae80778c16dde51f92a086ed92f0ddbe06d390c68bdff2688cf48fab5aa2d

SHA512
6b50d383c580fb8135bb1ee2c62f99f7eec048363dc6277334bd7ea7676d5fc6315fbebbfd2d935f70437b7643a1671e3f75fd827462faf333b6bf65fb9ab94b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8871a718fd3a5afbb1bfc4f0acce1ca3

SHA1
df1352035cde7d19f55bbe0f560233fc20a54637

SHA256
ccbc22a60a8d9c133d7e03850bd8330c7c4e716e2088697988c6e72a3c6a845c

SHA512
d6206c145a1eef300dcd3cc6cbcc4701436892a3bee99c70874a1b3d13f8f4b7d82d5ad8da447ed0b789218ccf3a66b3ca80f332f26b8d48f814edbe11d7a3e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
12e08aa8bdcbc0fe67fba1e2ec715425

SHA1
366ce67229a30cb3c957606435c5be7314d74433

SHA256
4b4afbafacab56540b25a6232de33738f776b405d66c6d2c47f00f7dea58ff95

SHA512
1bf6c608a89c19ab92000fce059a0ace32c29ce56b1ed279a6ab67050d9d3e9b8fd04a7420c6f75d23484b116800e0ca8bf5719ddb5e10b0afbee7afb447f1e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb

Filesize
896KB

MD5
c0cebb515ac4c426975e6479263b18bb

SHA1
a25bbd054b5aef1b1c863543a652976710ffec04

SHA256
9dbacf71e451f38e9ee405e3eeb715227064f98296682511d5dae1a46a75986f

SHA512
c7d08f6a0a3c06bbec42c5e2c1b53f55b3e78fcc769213460832353bc0f37a0125585030259db3eb2b14e6b3b8ebb3f01e3750c464ae62d0cf67949df085e296

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb

Filesize
1024KB

MD5
1efd58b6a398d273adab1625e73d672f

SHA1
8c586071583f20057d0464536af06dfcec67d51d

SHA256
698748decdadc60f0e80cd3cd680a4de0f5d361bae6cce02f4154f7f50c40497

SHA512
e93967d9fd178c6fd9c7db55173c215744fcf2f2e8446fde07f17408591d5751ab0b552c5772b4963c45ec1ccae17930db18e64244ba725f6fa886483c7d8f65

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\9cd93bc6dcf544bae69531052e64647ec02f2bb4.tbres

Filesize
4KB

MD5
4eab6eed3177f6570001b49ccd9a629c

SHA1
5916a1115d50ec4d7783d85c2dcdd55f0fc6f910

SHA256
7ea355f8df0c57f54d602df3279b57465a2941bb9bf1459b0b0ca83969cc0760

SHA512
2679ebd465a5d8a6e154195ad682b45660b1d3b4e39464452d291e8dcbb8d310614381deb2d9b34585a18ecd51aa0fb8cd46ca4c1a8678bc4259e02c417044f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML.bak

Filesize
9KB

MD5
7050d5ae8acfbe560fa11073fef8185d

SHA1
5bc38e77ff06785fe0aec5a345c4ccd15752560e

SHA256
cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b

SHA512
a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b

Download Submit
C:\Users\Admin\AppData\Local\Temp\8b6add3b-22b4-4132-91f4-25ce66cb1a53\ProgressBarSplash.exe

Filesize
87KB

MD5
ed001288c24f331c9733acf3ca3520b0

SHA1
1e935afba79825470c54afaec238402d068ddefa

SHA256
6c20ba0c24e2cf169fd9b0623e4a1abe3718824ff48085250dae8c019cc6cb06

SHA512
e6ba29aa9a8c61e8fd2823cf96343fa7c3c41e8f698a6be428b13923ed3f103ea7a7d613b8808a6447f37e54516b49f61976391a551ec4fa184cc7abe38b2444

Download Submit
C:\Users\Admin\AppData\Local\Temp\8b6add3b-22b4-4132-91f4-25ce66cb1a53\packer.exe

Filesize
50KB

MD5
dfda8e40e4c0b4830b211530d5c4fefd

SHA1
994aca829c6adbb4ca567e06119f0320c15d5dba

SHA256
131fc2c07992321f9ba4045aba20339e122bab73609d41dd7114f105f77f572e

SHA512
104e64d6dd2fd549c22cd36a4be83ccb2e0c85f5cc6d88ba2729b3c7e5d5f50cd244053c8cb3bdd5e294d1a4a1964825f3a7b7df83ee855615019dfc2b49f43f

Download Submit
C:\Users\Admin\AppData\Local\Temp\8b6add3b-22b4-4132-91f4-25ce66cb1a53\unpacker.exe

Filesize
817KB

MD5
e5faac1e35fa6a4ea009451807d6add3

SHA1
420aba8a3c4275d58d62a65390788acf22e25c0c

SHA256
9df16ee0ff61aa9bdf4811fac3cd1bd8120b74bbb7c6dc0bf1de58d46b6d4f08

SHA512
a71608bc48730001fa854e857c9145acd0a8413bacfb720467d72f4d95ab0c308a461284bbdcbf8817ea267bf9d06718ec42aa7c068f8664512c98b1b183ab4e

Download Submit
C:\Users\Admin\AppData\Local\Temp\wmsetup.log

Filesize
1KB

MD5
1c61804d0fabd27491fc879e9b5d298e

SHA1
73576da97d1ec4b75d9d8542cce437ead1c603d7

SHA256
5b631c3e07928e343568a0e23727b689d67d0b887f0417a3744ad7cfda0dc20b

SHA512
2ba05ffa625213ea47bcd02c123f8209f253718d4a056b277a4711bc994615934e22dd0b95b3d40a0d8367dc7247a3820e699801b714e659851c8b9371aa5c40

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat

Filesize
247B

MD5
1b529425a37b1334b8b33ebd890269a4

SHA1
84768e6475b45e3431d5dd62968dde9b92bcb799

SHA256
774609fb895e024729e533b8420e732453a0f7ad9cc4599a871157b4f2ca0440

SHA512
8d82cb100fb6e979061a2a86aedf2f77de9bb5abf4431ed7add5c75d04988a3cd747119ade26856e8c2fdf7fe75e6aedf0025f2015e525b6835c80cfa2eff295

Download Submit
C:\Users\Admin\AppData\Roaming\OutUnlock.doc.exe

Filesize
512KB

MD5
43a597a0fd009e08deaea0a5081dde4b

SHA1
6342dedafebebe994a70a56b3ee56290941de69b

SHA256
b1c419e6b64b71a727a54e2562d8325a84705d1c67fa0df655c0b54c88435d1b

SHA512
9e50dc605e8078cbf826b1d5f75aef5fe4e748bf1ec480e193a20a9ed53c09cb207acbf7d69c5d1671a434bf0847f766f9f9082533a61e017a32a29095995c0f

Download Submit
C:\Users\Admin\Desktop\lol_c2e1b4a1-95f2-4440-acc7-2ab0e3f0a94f\ACLib\playback.ico

Filesize
4KB

MD5
a20254ea7f9ef810c1681fa314edaa28

SHA1
fdd3040411043fa1d93efd4298db8668458b6fb8

SHA256
5375290e66a20bff81fb4d80346756f2d442184789681297cd1b84446a3fe80d

SHA512
4c52a7f77930e6f1bfaa1fee7e39133f74675a8666902c71be752758a29d8d167157e34f89f729ab29855990bc41757a11031adc7560c4d6b9cd77000bbcf87c

Download Submit
C:\Users\Admin\Desktop\lol_c2e1b4a1-95f2-4440-acc7-2ab0e3f0a94f\ACLib\record.ico

Filesize
4KB

MD5
1111e06679f96ff28c1e229b06ce7b41

SHA1
9fe5a6c6014b561060a640d0db02a303a35b8832

SHA256
59d5e9106e907fa61a560294a51c14abcde024fdd690e41a7f4d6c88db7287a6

SHA512
077aff77bbf827b9920cf53dff38427475e590c07ab8901fc34ce7b7fb9e9409207e53aff06fa7d1e3984bcf127507d0fc19284d8e7203c76d67c9b98c1c8f37

Download Submit
C:\Users\Admin\Desktop\lol_c2e1b4a1-95f2-4440-acc7-2ab0e3f0a94f\ACLib\stop.ico

Filesize
4KB

MD5
7824cefad2522be614ae5b7bdbf88339

SHA1
a0de5c71ac3cd42ca19ee2e4658d95b3f9082c60

SHA256
9e869f60ea0a0de06c7d562ff56d1ac53c534849c919e4b12344e73513649483

SHA512
6d377731bbda34f1875cd14e8ee896c9b8cb0aeb4133a5bc5ff460138b8b3a1b6647d3869b14a9f6949601fa37694bc38c764bf660fd877033296d9ccb0b6342

Download Submit
C:\Users\Admin\Desktop\lol_c2e1b4a1-95f2-4440-acc7-2ab0e3f0a94f\SolaraBootstraper.exe

Filesize
290KB

MD5
288a089f6b8fe4c0983259c6daf093eb

SHA1
8eafbc8e6264167bc73c159bea34b1cfdb30d34f

SHA256
3536c40290b9e7e9c3c47a96ab10fe3b737f334dd6779eaf70e35e91e10a677b

SHA512
c04bf3530cd471d589efb8f7e6bdddb39422fc4284afc7f2d3645a646ebbee170d57dc57eff30cee05ef091c64c6a98586c5a887d25fe53e49531c137d285448

Download Submit
C:\Users\Admin\Desktop\lol_c2e1b4a1-95f2-4440-acc7-2ab0e3f0a94f\ac3.exe

Filesize
844KB

MD5
7ecfc8cd7455dd9998f7dad88f2a8a9d

SHA1
1751d9389adb1e7187afa4938a3559e58739dce6

SHA256
2e67d5e7d96aec62a9dda4c0259167a44908af863c2b3af2a019723205abba9e

SHA512
cb05e82b17c0f7444d1259b661f0c1e6603d8a959da7475f35078a851d528c630366916c17a37db1a2490af66e5346309177c9e31921d09e7e795492868e678d

Download Submit
C:\Users\Admin\Desktop\lol_c2e1b4a1-95f2-4440-acc7-2ab0e3f0a94f\helper.vbs

Filesize
26B

MD5
7a97744bc621cf22890e2aebd10fd5c8

SHA1
1147c8df448fe73da6aa6c396c5c53457df87620

SHA256
153fed1733e81de7f9d221a1584a78999baa93bc8697500d8923550c774ed709

SHA512
89c73b73d4b52cf8e940fa2f1580fdc89f902b1eeb4b2abc17f09229a6130532a08cdb91205b9813a65cb7cd31ca020fe728b03d9a0fabb71131864c2966f967

Download Submit
C:\Users\Admin\Desktop\lol_c2e1b4a1-95f2-4440-acc7-2ab0e3f0a94f\jaffa.exe

Filesize
512KB

MD5
6b1b6c081780047b333e1e9fb8e473b6

SHA1
8c31629bd4a4ee29b7ec1e1487fed087f5e4b1de

SHA256
e649b6e4284404bfa04639b8bf06367777c48201ef27dcdc256fe59167935fac

SHA512
022d40c1801fa495c9298d896221c8eefbad342d41922df8d014f2f49c3fe7fa91d603e0ee0de6be6f2143f9e0c4a6756b19260166ebd62ec3e1c64ad22bc447

Download Submit
C:\Users\Admin\Desktop\lol_c2e1b4a1-95f2-4440-acc7-2ab0e3f0a94f\jkka.exe

Filesize
1002KB

MD5
42e4b26357361615b96afde69a5f0cc3

SHA1
35346fe0787f14236296b469bf2fed5c24a1a53d

SHA256
e58a07965ef711fc60ab82ac805cfc3926e105460356dbbea532ba3d9f2080eb

SHA512
fb8a2f4a9f280c0e3c0bb979016c11ea217bae9cebd06f7f2b5ef7b8973b98128ebc2e5cf76b824d71b889fca4510111a79b177dab592f332131f0d6789673a5

Download Submit
C:\Users\Admin\Desktop\lol_c2e1b4a1-95f2-4440-acc7-2ab0e3f0a94f\loader.bat

Filesize
14B

MD5
c09f87a03951b2c969162d196a3553ae

SHA1
b91818598f0e0d3e7b11ae85537859a78836549a

SHA256
5c4f1755dbbee5da95eccc5436768e7d973e5e9c3cbc506b62cc49d66bc9cd47

SHA512
80de5908d05e4d4d8a3b1bd75c9c0bc32db43743ef9ee8f878d3a6a7ef52314dd31a9e1332609ca0902f4a8e7b7d0ec95c1bc280ee437e4502a71d85eec948b2

Download Submit
C:\Users\Admin\Desktop\lol_c2e1b4a1-95f2-4440-acc7-2ab0e3f0a94f\loader.exe

Filesize
5KB

MD5
3a66b8c04d1437b4c4da631053a76bb5

SHA1
bcf8f381932d376f3f8e53c82b2b13ff31ee097b

SHA256
c3aa0c8ff9e3c7e10bcd3829f3e63b4cf9c59eb4964a7576f3ef5fca50c77cdc

SHA512
b24f3fb34aa293293d4f7bef247ca746608cb9ae54d214492276e7ef0fe0032944ea082f2bbf42f200359d38ed2af69f51ef5f3cb969a0ffb7176b27e0279fcf

Download Submit
C:\Users\Admin\Desktop\lol_c2e1b4a1-95f2-4440-acc7-2ab0e3f0a94f\main.cmd

Filesize
479B

MD5
0c5ca3855a9dd17276a6c0d6ad82a0a7

SHA1
8dbe84b76255dc6ab193f2f7eb7727c5cc356e84

SHA256
6f98349789f43fee7c6342c05782f0e60d145d357818db219c521b63850f1d13

SHA512
2773dd2ee6c11c98a3888382ddcfb05a50326165ddc680abe0fe52b2f8c39d025a5735f72880c9389fc65296659cee6551b129336e65d6c26e2633f6fbfb8f3a

Download Submit
C:\Users\Admin\Desktop\lol_c2e1b4a1-95f2-4440-acc7-2ab0e3f0a94f\selfaware.exe

Filesize
797KB

MD5
5cb9ba5071d1e96c85c7f79254e54908

SHA1
3470b95d97fb7f1720be55e033d479d6623aede2

SHA256
53b21dcfad586cdcb2bb08d0cfe62f0302662ebe48d3663d591800cf3e8469a5

SHA512
70d4f6c62492209d497848cf0e0204b463406c5d4edf7d5842a8aa2e7d4edb2090f2d27862841a217786e6813198d35ea29b055e0118b73af516edf0c79dcfad

Download Submit
C:\Users\Admin\Desktop\lol_c2e1b4a1-95f2-4440-acc7-2ab0e3f0a94f\spinner.gif

Filesize
44KB

MD5
324f8384507560259aaa182eb0c7f94a

SHA1
3b86304767e541ddb32fdda2e9996d8dbeca16ed

SHA256
f48c4f9c5fc87e8d7679948439544a97f1539b423860e7c7470bd9b563aceab5

SHA512
cc1b61df496cfb7c51d268139c6853d05bace6f733bc13c757c87cd64a11933c3a673b97fba778e515a9ff5f8c4ea52e7091f3beda1d8452bc3f6b59382f300d

Download Submit
C:\Users\Admin\Desktop\lol_c2e1b4a1-95f2-4440-acc7-2ab0e3f0a94f\temp.bat

Filesize
16B

MD5
683678b879bd775b775240fcb1cd495e

SHA1
10bc596b3d03e1ba328068305c8acee2745c731c

SHA256
64f28aef02c7fafbc9d80735a8b1d607c3996a2ddf9ba260d4c433c002efeaba

SHA512
3b2b9d231643a826183732a79489c6d2f4749ce25314c444364062c781627af59b572c082d811ae57a839cae94de77cf03eb81d99e1063e2191e884ccbaa0963

Download Submit
C:\Users\Admin\Desktop\lol_c2e1b4a1-95f2-4440-acc7-2ab0e3f0a94f\web.htm

Filesize
176B

MD5
1fab717c517da1c27e82a93edddf9390

SHA1
24b6cfda27c15c1d01ba5718106c18687ed77397

SHA256
bd035700f060a35c394600cabf0cf04c031927786c97cf41c55d78dddeffa11c

SHA512
5452938fa310396ecacae8eab64bdae624f617e19c0d742e10e088befb686c205b8db9ccec7d9de1c9360f341db8a701d5b8c6c4eb20aaa1c2deb831ab09fab5

Download Submit
C:\Users\Admin\Documents\DisableReceive.doc.exe

Filesize
512KB

MD5
6dca6176955655be80a9ee9c7c2eb401

SHA1
34aed9746236630cf4a928ddf46a4debc623d3b1

SHA256
264abcfd597773cd05d9947576dd2fdf2300a49d47d6074b1174b4dfbf25bad9

SHA512
1ff178afaf069951bc20d8cfd708587d635ef9e11cacbc6f700738385a560475c1c3779fa6d7c4df9cdd3a2f6f7028aaa368f44d16712910124ad0e0f6a23506

Download Submit
C:\Windows\SysWOW64\anljwisfod.exe

Filesize
512KB

MD5
3ab38d7d5c2efe607e1886f53951a3d7

SHA1
ce9478014c5250072b0b521d086ca4e764db45d3

SHA256
db9ac7c5a8e515264894cf7529b1fe564560db1aef81de289d643b9e03189050

SHA512
fd6cc7ff57f117868c15bcbf4d74c217e6057a2a5e7dac33b27ef6e3f6152c1b8fde708a1a8f24b86064bc18f4da4309a81f575a0e6bdedad774a41e97ac9152

Download Submit
C:\Windows\SysWOW64\dbxezquy.exe

Filesize
512KB

MD5
ff6e90eace9cad122d0da319d2813b52

SHA1
3e977fa91ea1359b1a6e0c83498f48d4b5c72681

SHA256
0668186fb720ccf9b01172b0157fd5a39703815c7fbef9ed108f062828f87f84

SHA512
936a921eefbea38b2b60aa211519885d520f0a86ebcc8ca3c6d706dfc6391b416b918e86f098fc5c7ead583006a0a8375d6b9a1942da98a5f55653265e55eea1

Download Submit
C:\Windows\SysWOW64\dptlkhbbdfkcneh.exe

Filesize
512KB

MD5
c0a45bfa7b0171dbb7cdab6245a73d6f

SHA1
a9563ca7084a1d44ceaa83f67439d7f18b86af06

SHA256
1d8c87b11150bb9501095fd94f0ed9b2bec40188f4b7eeacb457738438cbccbe

SHA512
2ada2b078d3ed4474deaa2c9f002530f8cf2d70d2d72f1c8a4d449dc2e4287a2a8e25dfeb19345ffc4bc0f68883c70a73212da5b10907cd1a7ab401a9f5c9a6e

Download Submit
C:\Windows\SysWOW64\xhtinitncqcae.exe

Filesize
512KB

MD5
a239432d65807d370d36251a4be879eb

SHA1
f338285b6f9bcd3b01f6e66a4f8f7cc257bd5b2e

SHA256
bb19beca2fa961c668d86395e4f8d64a2206855c5abdfd567f5f374ffbf4b915

SHA512
9b01eccc55d897a9cde8202797591962ee25548733f1fd0f8f9d154fcb9fd1d1f3ee6a250a4c33a359f3513a144895fd298f8f66f2430e4041bd34b9246eb707

Download Submit
C:\Windows\mydoc.rtf

Filesize
223B

MD5
06604e5941c126e2e7be02c5cd9f62ec

SHA1
4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

SHA256
85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

SHA512
803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

Download Submit
\??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe

Filesize
512KB

MD5
20bbd4142773b195507e698e9c9e0976

SHA1
261a3e6502103cc860726c4178c41fb9d8db91a2

SHA256
e6d942ae22fb2fb12f84620e7da1f70dd23f45dba9f30a8a255b46beaf022554

SHA512
a961debe1b239711792df487c36921bf8db0a0872f390025e7aea6eea500e79b38daa2fbfee748d1720ff2004bfce6313c35e9c0c26062f29ee7e9d820091938

Download Submit
\??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe

Filesize
512KB

MD5
f8f02bf245b6936f97a6b09386357a3f

SHA1
6edb7229483b92d6afcaa058760fd98f7d503824

SHA256
d12eb6936e8f1b99a59da5bd155a86cfb9c8fa15cb34384bcb0ecdde28d45d28

SHA512
804c2286a455a994571fb2d9a1853189e018982ae5f2aa0d54e5d66c9e29b3d661809a770597d3514a1dfa912e4cb3614b24992e09e45a41b3f293ea692dbd72

Download Submit
memory/1092-209-0x00007FFD2D290000-0x00007FFD2D2A0000-memory.dmp

Filesize
64KB

Download
memory/1092-119-0x00007FFD2D290000-0x00007FFD2D2A0000-memory.dmp

Filesize
64KB

Download
memory/1092-210-0x00007FFD2D290000-0x00007FFD2D2A0000-memory.dmp

Filesize
64KB

Download
memory/1092-116-0x00007FFD2D290000-0x00007FFD2D2A0000-memory.dmp

Filesize
64KB

Download
memory/1092-211-0x00007FFD2D290000-0x00007FFD2D2A0000-memory.dmp

Filesize
64KB

Download
memory/1092-123-0x00007FFD2B000000-0x00007FFD2B010000-memory.dmp

Filesize
64KB

Download
memory/1092-121-0x00007FFD2B000000-0x00007FFD2B010000-memory.dmp

Filesize
64KB

Download
memory/1092-118-0x00007FFD2D290000-0x00007FFD2D2A0000-memory.dmp

Filesize
64KB

Download
memory/1092-120-0x00007FFD2D290000-0x00007FFD2D2A0000-memory.dmp

Filesize
64KB

Download
memory/1092-208-0x00007FFD2D290000-0x00007FFD2D2A0000-memory.dmp

Filesize
64KB

Download
memory/1092-117-0x00007FFD2D290000-0x00007FFD2D2A0000-memory.dmp

Filesize
64KB

Download
memory/1276-69-0x0000000000400000-0x0000000000496000-memory.dmp

Filesize
600KB

Download
memory/1320-323-0x0000000074650000-0x0000000074E00000-memory.dmp

Filesize
7.7MB

Download
memory/1320-2-0x0000000003280000-0x00000000032A4000-memory.dmp

Filesize
144KB

Download
memory/1320-1-0x0000000000C50000-0x0000000000D22000-memory.dmp

Filesize
840KB

Download
memory/1320-3-0x0000000074650000-0x0000000074E00000-memory.dmp

Filesize
7.7MB

Download
memory/1320-4-0x0000000005D10000-0x00000000062B4000-memory.dmp

Filesize
5.6MB

Download
memory/1320-0-0x000000007465E000-0x000000007465F000-memory.dmp

Filesize
4KB

Download
memory/1848-73-0x0000000000400000-0x0000000000501000-memory.dmp

Filesize
1.0MB

Download
memory/4520-297-0x00007FFD4EC20000-0x00007FFD4F5C1000-memory.dmp

Filesize
9.6MB

Download
memory/4520-25-0x00007FFD4EC20000-0x00007FFD4F5C1000-memory.dmp

Filesize
9.6MB

Download
memory/4520-24-0x00007FFD4EC20000-0x00007FFD4F5C1000-memory.dmp

Filesize
9.6MB

Download
memory/4520-22-0x00007FFD4EED5000-0x00007FFD4EED6000-memory.dmp

Filesize
4KB

Download
memory/5316-425-0x0000000004A50000-0x0000000004A60000-memory.dmp

Filesize
64KB

Download
memory/5316-420-0x0000000004A50000-0x0000000004A60000-memory.dmp

Filesize
64KB

Download
memory/5316-426-0x0000000004A50000-0x0000000004A60000-memory.dmp

Filesize
64KB

Download
memory/5316-418-0x0000000003690000-0x00000000036A0000-memory.dmp

Filesize
64KB

Download
memory/5316-419-0x0000000004A50000-0x0000000004A60000-memory.dmp

Filesize
64KB

Download
memory/5316-424-0x0000000004A50000-0x0000000004A60000-memory.dmp

Filesize
64KB

Download
memory/5316-423-0x0000000004A50000-0x0000000004A60000-memory.dmp

Filesize
64KB

Download
memory/5316-422-0x0000000004A50000-0x0000000004A60000-memory.dmp

Filesize
64KB

Download
memory/5316-421-0x0000000004A50000-0x0000000004A60000-memory.dmp

Filesize
64KB

Download
memory/5324-322-0x0000000002FB0000-0x0000000002FD4000-memory.dmp

Filesize
144KB

Download
memory/5324-320-0x0000000000ED0000-0x0000000000EE2000-memory.dmp

Filesize
72KB

Download
memory/5324-326-0x0000000005EB0000-0x0000000005EC2000-memory.dmp

Filesize
72KB

Download
memory/5324-327-0x0000000005F10000-0x0000000005F4C000-memory.dmp

Filesize
240KB

Download
memory/5544-442-0x00007FF698BD0000-0x00007FF698CC8000-memory.dmp

Filesize
992KB

Download
memory/5544-444-0x00007FFD5E2A0000-0x00007FFD5E556000-memory.dmp

Filesize
2.7MB

Download
memory/5544-443-0x00007FFD5EA40000-0x00007FFD5EA74000-memory.dmp

Filesize
208KB

Download
memory/5544-445-0x00000150E6890000-0x00000150E7940000-memory.dmp

Filesize
16.7MB

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads