Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
23-05-2024 14:33
Static task
static1
Behavioral task
behavioral1
Sample
0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe
Resource
win10v2004-20240426-en
General
-
Target
0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe
-
Size
4.0MB
-
MD5
423a60edff840e9fe38ec71100707478
-
SHA1
8d5432a241847e90a5aa3a2ab99918d56ae2b4b2
-
SHA256
0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953
-
SHA512
db20925bff79c38b3862a68352ef6af1fdeba17aa533959debc4423da18249d290f8a4361325f6df654bc3c953be396df44909a02e04d4ecdaf07b2ee10bb28f
-
SSDEEP
98304:v2SVMD8Lnsmtk2aX3Ob9lG4TLaeOnTPia:/NLfdLzOz
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
Processes:
resource yara_rule \Windows\SysWOW64\259427431.bat family_gh0strat -
Sets DLL path for service in the registry 2 TTPs 1 IoCs
Processes:
look2.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\svchcst\Parameters\ServiceDll = "C:\\Windows\\system32\\259427431.bat" look2.exe -
Executes dropped EXE 6 IoCs
Processes:
look2.exeHD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe._cache_HD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exeSynaptics.exe._cache_Synaptics.exesvchcst.exepid process 2228 look2.exe 2552 HD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe 2568 ._cache_HD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe 2060 Synaptics.exe 628 ._cache_Synaptics.exe 536 svchcst.exe -
Loads dropped DLL 15 IoCs
Processes:
0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exelook2.exesvchost.exeHD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exeSynaptics.exesvchcst.exepid process 1664 0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe 2228 look2.exe 3024 svchost.exe 1664 0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe 1664 0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe 2552 HD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe 2552 HD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe 2552 HD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe 2552 HD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe 2552 HD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe 2060 Synaptics.exe 2060 Synaptics.exe 2060 Synaptics.exe 3024 svchost.exe 536 svchcst.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
HD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" HD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe -
Drops file in System32 directory 4 IoCs
Processes:
look2.exesvchost.exedescription ioc process File created C:\Windows\SysWOW64\259427431.bat look2.exe File opened for modification C:\Windows\SysWOW64\ini.ini look2.exe File created C:\Windows\SysWOW64\svchcst.exe svchost.exe File opened for modification C:\Windows\SysWOW64\svchcst.exe svchost.exe -
Drops file in Program Files directory 1 IoCs
Processes:
0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exedescription ioc process File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe 0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE -
Processes:
EXCEL.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\MenuExt EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor EXCEL.EXE -
Modifies registry class 64 IoCs
Processes:
EXCEL.EXEdescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shellex\IconHandler EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\ = "&Open" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon\mhtmlfile EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597} EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shellex\IconHandler\ = "{42042206-2D85-11D3-8CFF-005004838597}" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\application EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\DefaultIcon EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\ = "&Open" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application\ = "Excel" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32 EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\ = "&Print" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\ = "&Open" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ = "&Open" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\ = "&Open" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\ShellEx EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" %1" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\DefaultIcon\ = "\"%1\"" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon\htmlfile EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\ = "&Open" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\topic\ = "system" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\ = "&Edit" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\ = "&Edit" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\ = "[open(\"%1\")]" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\ = "[open(\"%1\")]" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" /p %1" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application\ = "Excel" EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\topic\ = "system" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ = "&Open" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 1508 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe._cache_HD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exepid process 1664 0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe 2568 ._cache_HD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe 2568 ._cache_HD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe 2568 ._cache_HD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe 2568 ._cache_HD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe 2568 ._cache_HD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe 2568 ._cache_HD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe 2568 ._cache_HD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe 2568 ._cache_HD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe 2568 ._cache_HD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe 2568 ._cache_HD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe 2568 ._cache_HD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe 2568 ._cache_HD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe 2568 ._cache_HD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe 2568 ._cache_HD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe 2568 ._cache_HD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe 2568 ._cache_HD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe 2568 ._cache_HD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe 2568 ._cache_HD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe 2568 ._cache_HD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe 2568 ._cache_HD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe 2568 ._cache_HD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe 2568 ._cache_HD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe 2568 ._cache_HD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe 2568 ._cache_HD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe 2568 ._cache_HD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe 2568 ._cache_HD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe 2568 ._cache_HD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe 2568 ._cache_HD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe 2568 ._cache_HD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe 2568 ._cache_HD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe 2568 ._cache_HD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe 2568 ._cache_HD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe 2568 ._cache_HD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe 2568 ._cache_HD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe 2568 ._cache_HD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe 2568 ._cache_HD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe 2568 ._cache_HD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe 2568 ._cache_HD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe 2568 ._cache_HD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe 2568 ._cache_HD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe 2568 ._cache_HD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe 2568 ._cache_HD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe 2568 ._cache_HD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe 2568 ._cache_HD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe 2568 ._cache_HD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe 2568 ._cache_HD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe 2568 ._cache_HD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe 2568 ._cache_HD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe 2568 ._cache_HD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe 2568 ._cache_HD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe 2568 ._cache_HD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe 2568 ._cache_HD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe 2568 ._cache_HD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe 2568 ._cache_HD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe 2568 ._cache_HD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe 2568 ._cache_HD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe 2568 ._cache_HD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe 2568 ._cache_HD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe 2568 ._cache_HD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe 2568 ._cache_HD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe 2568 ._cache_HD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe 2568 ._cache_HD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe 2568 ._cache_HD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe -
Suspicious use of SetWindowsHookEx 11 IoCs
Processes:
0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe._cache_HD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe._cache_Synaptics.exeEXCEL.EXEpid process 1664 0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe 1664 0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe 2568 ._cache_HD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe 2568 ._cache_HD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe 2568 ._cache_HD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe 2568 ._cache_HD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe 628 ._cache_Synaptics.exe 628 ._cache_Synaptics.exe 628 ._cache_Synaptics.exe 628 ._cache_Synaptics.exe 1508 EXCEL.EXE -
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exeHD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exeSynaptics.exesvchost.exedescription pid process target process PID 1664 wrote to memory of 2228 1664 0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe look2.exe PID 1664 wrote to memory of 2228 1664 0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe look2.exe PID 1664 wrote to memory of 2228 1664 0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe look2.exe PID 1664 wrote to memory of 2228 1664 0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe look2.exe PID 1664 wrote to memory of 2552 1664 0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe HD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe PID 1664 wrote to memory of 2552 1664 0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe HD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe PID 1664 wrote to memory of 2552 1664 0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe HD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe PID 1664 wrote to memory of 2552 1664 0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe HD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe PID 2552 wrote to memory of 2568 2552 HD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe ._cache_HD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe PID 2552 wrote to memory of 2568 2552 HD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe ._cache_HD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe PID 2552 wrote to memory of 2568 2552 HD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe ._cache_HD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe PID 2552 wrote to memory of 2568 2552 HD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe ._cache_HD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe PID 2552 wrote to memory of 2060 2552 HD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe Synaptics.exe PID 2552 wrote to memory of 2060 2552 HD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe Synaptics.exe PID 2552 wrote to memory of 2060 2552 HD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe Synaptics.exe PID 2552 wrote to memory of 2060 2552 HD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe Synaptics.exe PID 2060 wrote to memory of 628 2060 Synaptics.exe ._cache_Synaptics.exe PID 2060 wrote to memory of 628 2060 Synaptics.exe ._cache_Synaptics.exe PID 2060 wrote to memory of 628 2060 Synaptics.exe ._cache_Synaptics.exe PID 2060 wrote to memory of 628 2060 Synaptics.exe ._cache_Synaptics.exe PID 3024 wrote to memory of 536 3024 svchost.exe svchcst.exe PID 3024 wrote to memory of 536 3024 svchost.exe svchcst.exe PID 3024 wrote to memory of 536 3024 svchost.exe svchcst.exe PID 3024 wrote to memory of 536 3024 svchost.exe svchcst.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe"C:\Users\Admin\AppData\Local\Temp\0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\look2.exeC:\Users\Admin\AppData\Local\Temp\\look2.exe2⤵
- Sets DLL path for service in the registry
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
-
C:\Users\Admin\AppData\Local\Temp\HD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exeC:\Users\Admin\AppData\Local\Temp\HD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\._cache_HD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe"C:\Users\Admin\AppData\Local\Temp\._cache_HD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "svchcst"1⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "svchcst"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchcst.exeC:\Windows\system32\svchcst.exe "c:\windows\system32\259427431.bat",MainThread2⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\._cache_HD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exeFilesize
2.1MB
MD580a19f81da0f52108a5ca011314891a9
SHA1e02c8614c63e7d6bb1778eb2fd1902b63e6ee2b0
SHA256a4ea9a60b2a8d49dcd084aaa70992c3d6fb32f97f131ecdbdd05bfb027b67596
SHA512984ead0d2c53cdddaab913eeedc2238c6d3f61f79be4321f9aa53dec6ba23588bbdb8180249f26430445db339557b47eb55321d551c50fe6be7426ce6f151ed7
-
C:\Users\Admin\AppData\Local\Temp\HD_X.datFilesize
1.2MB
MD5fb6fa7ee6ee5cb1aacf540b2c7865d55
SHA12663b31b5127e40082ebb3c65b6a5062f9c64014
SHA2562cf07b948ef83a97b678841a1f658b089eccd4a9c5bcc0c171d9391fedd2235b
SHA5129f28471cc143011058aa9a959115a20262ec34d70f91965590dc9e3b2c82681df7795c3bc3520d811c85156cd076be7a5969a56a28c208a7588c75bff7500c0e
-
C:\Users\Admin\AppData\Local\Temp\l65odLyQ.xlsmFilesize
17KB
MD5e566fc53051035e1e6fd0ed1823de0f9
SHA100bc96c48b98676ecd67e81a6f1d7754e4156044
SHA2568e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15
SHA512a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04
-
C:\Users\Admin\AppData\Local\Temp\look2.exeFilesize
337KB
MD52f3b6f16e33e28ad75f3fdaef2567807
SHA185e907340faf1edfc9210db85a04abd43d21b741
SHA25686492ebf2d6f471a5ee92977318d099b3ea86175b5b7ae522237ae01d07a4857
SHA512db17e99e2df918cfc9ccbe934adfe73f0777ce1ce9f28b57a4b24ecd821efe2e0b976a634853247b77b16627d2bb3af4ba20306059d1d25ef38ffada7da3e3a4
-
C:\Windows\SysWOW64\svchcst.exeFilesize
43KB
MD551138beea3e2c21ec44d0932c71762a8
SHA18939cf35447b22dd2c6e6f443446acc1bf986d58
SHA2565ad3c37e6f2b9db3ee8b5aeedc474645de90c66e3d95f8620c48102f1eba4124
SHA512794f30fe452117ff2a26dc9d7086aaf82b639c2632ac2e381a81f5239caaec7c96922ba5d2d90bfd8d74f0a6cd4f79fbda63e14c6b779e5cf6834c13e4e45e7d
-
\Users\Admin\AppData\Local\Temp\HD_0f1fcae5afc3ae80abc3ae408f224dc29194ca054e34025cded8311c20ece953.exeFilesize
2.8MB
MD5390291a5e9a54e79b0d0f7aae99df9b5
SHA17744d645636441a0731b9f1342970319012a22ce
SHA256ae64f6d9a0080839eee44b702efb798ae5c28fdcb44af39c9595847d33846049
SHA512f760d69075c3ea393880f177cb43ddb23126eed34c7527ad49679f91190219ed89b40907b62c320bc147af95f029616d1b4d1311d40915322326105a30755cbe
-
\Windows\SysWOW64\259427431.batFilesize
51KB
MD5ace7e50c7492107e98a124e102b87e81
SHA1b39e067be1f9d8caa983c566c4d9b934cea24f38
SHA25610b0460d318cc478d62d3167cbb8a3bb85d9ada0c64cbe89cd679ad5e8c08f33
SHA512bc0c30fe005994b89f2581e8c9576c91e130fd5094dd76b0c2701863b23b7b207946b3cfbd8690accc2ea68646fa0cd4bfcaf10028c068ed1888ce1bd87f5803
-
memory/1508-82-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/2060-102-0x0000000000400000-0x00000000006DB000-memory.dmpFilesize
2.9MB
-
memory/2060-103-0x0000000000400000-0x00000000006DB000-memory.dmpFilesize
2.9MB
-
memory/2060-137-0x0000000000400000-0x00000000006DB000-memory.dmpFilesize
2.9MB
-
memory/2552-63-0x0000000000400000-0x00000000006DB000-memory.dmpFilesize
2.9MB