gh0strat | 1ca73cd5afdea64c01d33f652c47a9c6c3ee446fd5dd49bd6e8ff96fd89772d4

Analysis

max time kernel
150s
max time network
153s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
24-05-2024 02:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1ca73cd5afdea64c01d33f652c47a9c6c3ee446fd5dd49bd6e8ff96fd89772d4.exe
Size

12.1MB
MD5

320a85f96d37a11e753425e694a27307
SHA1

c6c892b3993e384ca6747233bb6722350aa40ad3
SHA256

1ca73cd5afdea64c01d33f652c47a9c6c3ee446fd5dd49bd6e8ff96fd89772d4
SHA512

717d072dc382abb00f12461f3e5b666936d6330dd1669df56987d5b73859fbd9b50959951a7f03005457b542cb49baa7fc52b9dbfbd01a39980385186ebcad0d
SSDEEP

196608:BKXbeO7yL9YE0SCI4rbECIwBbiL4c7NxIYaK+GutOHpDRw0nptlVOmpFEMSesg:S7yhYn/8Ch1vnGutMpDDnpnVVp6fesg

Score

10^/10

gh0strat purplefox evasion persistence rat rootkit trojan upx

Malware Config

Signatures

Detect PurpleFox Rootkit 5 IoCs

Detect PurpleFox Rootkit.

rootkit

Processes:

resource	yara_rule
behavioral1/memory/2556-20-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral1/memory/2556-21-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral1/memory/2524-41-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral1/memory/2524-49-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral1/memory/2524-54-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit

Gh0st RAT payload 6 IoCs

Processes:

resource	yara_rule
\Windows\SysWOW64\259423625.txt	family_gh0strat
behavioral1/memory/2556-20-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral1/memory/2556-21-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral1/memory/2524-41-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral1/memory/2524-49-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral1/memory/2524-54-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
PurpleFox
PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.
rootkit trojan purplefox
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

Runner.exe

description ioc process

Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Runner.exe
Drops file in Drivers directory 1 IoCs

Processes:

TXPlatfor.exe

description ioc process

File created C:\Windows\system32\drivers\QAssist.sys TXPlatfor.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Runner.exe

description	ioc	process
File created	C:\Windows\system32\drivers\QAssist.sys	TXPlatfor.exe

Sets DLL path for service in the registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

R.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Remote Data\Parameters\ServiceDll = "C:\\Windows\\system32\\259423625.txt"	R.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

TXPlatfor.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys"	TXPlatfor.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Runner.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Runner.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Runner.exe

Executes dropped EXE 11 IoCs

Processes:

R.exeN.exeTXPlatfor.exeTXPlatfor.exeHD_1ca73cd5afdea64c01d33f652c47a9c6c3ee446fd5dd49bd6e8ff96fd89772d4.exe._cache_HD_1ca73cd5afdea64c01d33f652c47a9c6c3ee446fd5dd49bd6e8ff96fd89772d4.exeRemote Data.exeSynaptics.exe._cache_Synaptics.exeRunner.exebinding.exe

pid	process
2488	R.exe
2556	N.exe
2756	TXPlatfor.exe
2524	TXPlatfor.exe
2572	HD_1ca73cd5afdea64c01d33f652c47a9c6c3ee446fd5dd49bd6e8ff96fd89772d4.exe
1360	._cache_HD_1ca73cd5afdea64c01d33f652c47a9c6c3ee446fd5dd49bd6e8ff96fd89772d4.exe
2320	Remote Data.exe
1876	Synaptics.exe
2148	._cache_Synaptics.exe
1272	Runner.exe
480	binding.exe

Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

Runner.exe

description ioc process

Key opened \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Wine Runner.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Wine	Runner.exe

Loads dropped DLL 23 IoCs

Processes:

1ca73cd5afdea64c01d33f652c47a9c6c3ee446fd5dd49bd6e8ff96fd89772d4.exeR.exesvchost.exeTXPlatfor.exeHD_1ca73cd5afdea64c01d33f652c47a9c6c3ee446fd5dd49bd6e8ff96fd89772d4.exeRemote Data.exeSynaptics.exe._cache_HD_1ca73cd5afdea64c01d33f652c47a9c6c3ee446fd5dd49bd6e8ff96fd89772d4.exeRunner.exe

pid	process
2744	1ca73cd5afdea64c01d33f652c47a9c6c3ee446fd5dd49bd6e8ff96fd89772d4.exe
2488	R.exe
2264	svchost.exe
2744	1ca73cd5afdea64c01d33f652c47a9c6c3ee446fd5dd49bd6e8ff96fd89772d4.exe
2756	TXPlatfor.exe
2744	1ca73cd5afdea64c01d33f652c47a9c6c3ee446fd5dd49bd6e8ff96fd89772d4.exe
2744	1ca73cd5afdea64c01d33f652c47a9c6c3ee446fd5dd49bd6e8ff96fd89772d4.exe
2572	HD_1ca73cd5afdea64c01d33f652c47a9c6c3ee446fd5dd49bd6e8ff96fd89772d4.exe
2572	HD_1ca73cd5afdea64c01d33f652c47a9c6c3ee446fd5dd49bd6e8ff96fd89772d4.exe
2264	svchost.exe
2320	Remote Data.exe
2572	HD_1ca73cd5afdea64c01d33f652c47a9c6c3ee446fd5dd49bd6e8ff96fd89772d4.exe
2572	HD_1ca73cd5afdea64c01d33f652c47a9c6c3ee446fd5dd49bd6e8ff96fd89772d4.exe
1876	Synaptics.exe
1876	Synaptics.exe
1360	._cache_HD_1ca73cd5afdea64c01d33f652c47a9c6c3ee446fd5dd49bd6e8ff96fd89772d4.exe
1360	._cache_HD_1ca73cd5afdea64c01d33f652c47a9c6c3ee446fd5dd49bd6e8ff96fd89772d4.exe
1360	._cache_HD_1ca73cd5afdea64c01d33f652c47a9c6c3ee446fd5dd49bd6e8ff96fd89772d4.exe
1272	Runner.exe
1272	Runner.exe
1272	Runner.exe
1272	Runner.exe
1360	._cache_HD_1ca73cd5afdea64c01d33f652c47a9c6c3ee446fd5dd49bd6e8ff96fd89772d4.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/2556-20-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral1/memory/2556-21-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral1/memory/2556-18-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral1/memory/2524-41-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral1/memory/2524-49-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral1/memory/2524-54-0x0000000010000000-0x00000000101B6000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

HD_1ca73cd5afdea64c01d33f652c47a9c6c3ee446fd5dd49bd6e8ff96fd89772d4.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe"	HD_1ca73cd5afdea64c01d33f652c47a9c6c3ee446fd5dd49bd6e8ff96fd89772d4.exe

Drops file in System32 directory 6 IoCs

Processes:

svchost.exeN.exeR.exe

description	ioc	process
File created	C:\Windows\SysWOW64\Remote Data.exe	svchost.exe
File opened for modification	C:\Windows\SysWOW64\Remote Data.exe	svchost.exe
File created	C:\Windows\SysWOW64\TXPlatfor.exe	N.exe
File opened for modification	C:\Windows\SysWOW64\TXPlatfor.exe	N.exe
File created	C:\Windows\SysWOW64\259423625.txt	R.exe
File opened for modification	C:\Windows\SysWOW64\ini.ini	R.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry
T1012

System Information Discovery
T1082

Processes:

EXCEL.EXE

description ioc process

Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor	EXCEL.EXE

Modifies Internet Explorer settings 1 TTPs 33 IoCs

adware spyware

Modify Registry

T1112

Processes:

._cache_HD_1ca73cd5afdea64c01d33f652c47a9c6c3ee446fd5dd49bd6e8ff96fd89772d4.exeEXCEL.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	._cache_HD_1ca73cd5afdea64c01d33f652c47a9c6c3ee446fd5dd49bd6e8ff96fd89772d4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Ver = "ea7a66e2"	._cache_HD_1ca73cd5afdea64c01d33f652c47a9c6c3ee446fd5dd49bd6e8ff96fd89772d4.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit"	EXCEL.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\MenuExt	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	EXCEL.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit"	EXCEL.EXE

Modifies registry class 64 IoCs

Processes:

EXCEL.EXERunner.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList	EXCEL.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C07DB6A3-34FC-4084-BE2E-76BB9203B049}\InProcServer32\ = "C:\\Users\\Admin\\AppData\\Roaming\\mymacro\\qdisp.dll"	Runner.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{241D7F03-9232-4024-8373-149860BE27C0}\InprocServer32	Runner.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C07DB6A3-34FC-4084-BE2E-76BB9203B049}\InProcServer32	Runner.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QMDispatch.QMLibrary	Runner.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon\htmlfile	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32\ThreadingModel = "Apartment"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\ = "&Open"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QMDispatch.QMVBSRoutine\CLSID	Runner.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\ShellEx	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C07DB6A3-34FC-4084-BE2E-76BB9203B049}\ProgID	Runner.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\QMDispatch.QMLibrary\ = "QMDispatch.QMLibrary"	Runner.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\ = "&Open"	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\ = "&Open"	EXCEL.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	EXCEL.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000	EXCEL.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C07DB6A3-34FC-4084-BE2E-76BB9203B049}\InProcServer32\ThreadingModel = "Apartment"	Runner.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon\ = "\"%1\""	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde"	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ = "&Open"	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\ = "[open(\"%1\")]"	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application\ = "Excel"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{241D7F03-9232-4024-8373-149860BE27C0}	Runner.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EBEB87A6-E151-4054-AB45-A6E094C5334B}\InProcServer32\ThreadingModel = "Apartment"	Runner.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\ShellEx	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\QMDispatch.QMRoutine\CLSID\ = "{C07DB6A3-34FC-4084-BE2E-76BB9203B049}"	Runner.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\ = "&Open"	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{241D7F03-9232-4024-8373-149860BE27C0}\InProcServer32\ = "C:\\Users\\Admin\\AppData\\Roaming\\mymacro\\qdisp.dll"	Runner.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\ = "&Open"	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\application\ = "Excel"	EXCEL.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C07DB6A3-34FC-4084-BE2E-76BB9203B049}\ = "QMDispatch.QMRoutine"	Runner.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\ = "&Open"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QMDispatch.QMVBSRoutine	Runner.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{241D7F03-9232-4024-8373-149860BE27C0}\ProgID\ = "QMDispatch.QMVBSRoutine"	Runner.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe"	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic\ = "system"	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\ = "[open(\"%1\")]"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C07DB6A3-34FC-4084-BE2E-76BB9203B049}	Runner.exe

Runs ping.exe 1 TTPs 4 IoCs

Remote System Discovery
T1018

Processes:

PING.EXEPING.EXEPING.EXEPING.EXE

pid process

2836 PING.EXE
3032 PING.EXE
1976 PING.EXE
2644 PING.EXE
Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

EXCEL.EXE

pid process

1800 EXCEL.EXE

pid	process
2836	PING.EXE
3032	PING.EXE
1976	PING.EXE
2644	PING.EXE

pid	process
1800	EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

1ca73cd5afdea64c01d33f652c47a9c6c3ee446fd5dd49bd6e8ff96fd89772d4.exe._cache_HD_1ca73cd5afdea64c01d33f652c47a9c6c3ee446fd5dd49bd6e8ff96fd89772d4.exe

pid	process
2744	1ca73cd5afdea64c01d33f652c47a9c6c3ee446fd5dd49bd6e8ff96fd89772d4.exe
1360	._cache_HD_1ca73cd5afdea64c01d33f652c47a9c6c3ee446fd5dd49bd6e8ff96fd89772d4.exe

Suspicious behavior: LoadsDriver 1 IoCs

Processes:

TXPlatfor.exe

pid process

2524 TXPlatfor.exe

pid	process
2524	TXPlatfor.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

N.exeTXPlatfor.exe

description	pid	process
Token: SeIncBasePriorityPrivilege	2556	N.exe
Token: SeLoadDriverPrivilege	2524	TXPlatfor.exe
Token: 33	2524	TXPlatfor.exe
Token: SeIncBasePriorityPrivilege	2524	TXPlatfor.exe
Token: 33	2524	TXPlatfor.exe
Token: SeIncBasePriorityPrivilege	2524	TXPlatfor.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

._cache_HD_1ca73cd5afdea64c01d33f652c47a9c6c3ee446fd5dd49bd6e8ff96fd89772d4.exe

pid process

1360 ._cache_HD_1ca73cd5afdea64c01d33f652c47a9c6c3ee446fd5dd49bd6e8ff96fd89772d4.exe
Suspicious use of SendNotifyMessage 1 IoCs

Processes:

._cache_HD_1ca73cd5afdea64c01d33f652c47a9c6c3ee446fd5dd49bd6e8ff96fd89772d4.exe

pid process

1360 ._cache_HD_1ca73cd5afdea64c01d33f652c47a9c6c3ee446fd5dd49bd6e8ff96fd89772d4.exe

pid	process
1360	._cache_HD_1ca73cd5afdea64c01d33f652c47a9c6c3ee446fd5dd49bd6e8ff96fd89772d4.exe

pid	process
1360	._cache_HD_1ca73cd5afdea64c01d33f652c47a9c6c3ee446fd5dd49bd6e8ff96fd89772d4.exe

Suspicious use of SetWindowsHookEx 32 IoCs

Processes:

1ca73cd5afdea64c01d33f652c47a9c6c3ee446fd5dd49bd6e8ff96fd89772d4.exe._cache_HD_1ca73cd5afdea64c01d33f652c47a9c6c3ee446fd5dd49bd6e8ff96fd89772d4.exe._cache_Synaptics.exeRunner.exeEXCEL.EXEbinding.exe

pid	process
2744	1ca73cd5afdea64c01d33f652c47a9c6c3ee446fd5dd49bd6e8ff96fd89772d4.exe
2744	1ca73cd5afdea64c01d33f652c47a9c6c3ee446fd5dd49bd6e8ff96fd89772d4.exe
1360	._cache_HD_1ca73cd5afdea64c01d33f652c47a9c6c3ee446fd5dd49bd6e8ff96fd89772d4.exe
1360	._cache_HD_1ca73cd5afdea64c01d33f652c47a9c6c3ee446fd5dd49bd6e8ff96fd89772d4.exe
1360	._cache_HD_1ca73cd5afdea64c01d33f652c47a9c6c3ee446fd5dd49bd6e8ff96fd89772d4.exe
1360	._cache_HD_1ca73cd5afdea64c01d33f652c47a9c6c3ee446fd5dd49bd6e8ff96fd89772d4.exe
1360	._cache_HD_1ca73cd5afdea64c01d33f652c47a9c6c3ee446fd5dd49bd6e8ff96fd89772d4.exe
1360	._cache_HD_1ca73cd5afdea64c01d33f652c47a9c6c3ee446fd5dd49bd6e8ff96fd89772d4.exe
1360	._cache_HD_1ca73cd5afdea64c01d33f652c47a9c6c3ee446fd5dd49bd6e8ff96fd89772d4.exe
1360	._cache_HD_1ca73cd5afdea64c01d33f652c47a9c6c3ee446fd5dd49bd6e8ff96fd89772d4.exe
1360	._cache_HD_1ca73cd5afdea64c01d33f652c47a9c6c3ee446fd5dd49bd6e8ff96fd89772d4.exe
2148	._cache_Synaptics.exe
1360	._cache_HD_1ca73cd5afdea64c01d33f652c47a9c6c3ee446fd5dd49bd6e8ff96fd89772d4.exe
1272	Runner.exe
1272	Runner.exe
1272	Runner.exe
1272	Runner.exe
1272	Runner.exe
1272	Runner.exe
1272	Runner.exe
1272	Runner.exe
1272	Runner.exe
1272	Runner.exe
1800	EXCEL.EXE
1272	Runner.exe
1272	Runner.exe
1360	._cache_HD_1ca73cd5afdea64c01d33f652c47a9c6c3ee446fd5dd49bd6e8ff96fd89772d4.exe
1360	._cache_HD_1ca73cd5afdea64c01d33f652c47a9c6c3ee446fd5dd49bd6e8ff96fd89772d4.exe
1360	._cache_HD_1ca73cd5afdea64c01d33f652c47a9c6c3ee446fd5dd49bd6e8ff96fd89772d4.exe
480	binding.exe
480	binding.exe
480	binding.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

1ca73cd5afdea64c01d33f652c47a9c6c3ee446fd5dd49bd6e8ff96fd89772d4.exeN.exeTXPlatfor.execmd.exeHD_1ca73cd5afdea64c01d33f652c47a9c6c3ee446fd5dd49bd6e8ff96fd89772d4.exesvchost.exe._cache_HD_1ca73cd5afdea64c01d33f652c47a9c6c3ee446fd5dd49bd6e8ff96fd89772d4.exeSynaptics.exe

description	pid	process	target process
PID 2744 wrote to memory of 2488	2744	1ca73cd5afdea64c01d33f652c47a9c6c3ee446fd5dd49bd6e8ff96fd89772d4.exe	R.exe
PID 2744 wrote to memory of 2488	2744	1ca73cd5afdea64c01d33f652c47a9c6c3ee446fd5dd49bd6e8ff96fd89772d4.exe	R.exe
PID 2744 wrote to memory of 2488	2744	1ca73cd5afdea64c01d33f652c47a9c6c3ee446fd5dd49bd6e8ff96fd89772d4.exe	R.exe
PID 2744 wrote to memory of 2488	2744	1ca73cd5afdea64c01d33f652c47a9c6c3ee446fd5dd49bd6e8ff96fd89772d4.exe	R.exe
PID 2744 wrote to memory of 2556	2744	1ca73cd5afdea64c01d33f652c47a9c6c3ee446fd5dd49bd6e8ff96fd89772d4.exe	N.exe
PID 2744 wrote to memory of 2556	2744	1ca73cd5afdea64c01d33f652c47a9c6c3ee446fd5dd49bd6e8ff96fd89772d4.exe	N.exe
PID 2744 wrote to memory of 2556	2744	1ca73cd5afdea64c01d33f652c47a9c6c3ee446fd5dd49bd6e8ff96fd89772d4.exe	N.exe
PID 2744 wrote to memory of 2556	2744	1ca73cd5afdea64c01d33f652c47a9c6c3ee446fd5dd49bd6e8ff96fd89772d4.exe	N.exe
PID 2744 wrote to memory of 2556	2744	1ca73cd5afdea64c01d33f652c47a9c6c3ee446fd5dd49bd6e8ff96fd89772d4.exe	N.exe
PID 2744 wrote to memory of 2556	2744	1ca73cd5afdea64c01d33f652c47a9c6c3ee446fd5dd49bd6e8ff96fd89772d4.exe	N.exe
PID 2744 wrote to memory of 2556	2744	1ca73cd5afdea64c01d33f652c47a9c6c3ee446fd5dd49bd6e8ff96fd89772d4.exe	N.exe
PID 2556 wrote to memory of 2600	2556	N.exe	cmd.exe
PID 2556 wrote to memory of 2600	2556	N.exe	cmd.exe
PID 2556 wrote to memory of 2600	2556	N.exe	cmd.exe
PID 2556 wrote to memory of 2600	2556	N.exe	cmd.exe
PID 2756 wrote to memory of 2524	2756	TXPlatfor.exe	TXPlatfor.exe
PID 2756 wrote to memory of 2524	2756	TXPlatfor.exe	TXPlatfor.exe
PID 2756 wrote to memory of 2524	2756	TXPlatfor.exe	TXPlatfor.exe
PID 2756 wrote to memory of 2524	2756	TXPlatfor.exe	TXPlatfor.exe
PID 2756 wrote to memory of 2524	2756	TXPlatfor.exe	TXPlatfor.exe
PID 2756 wrote to memory of 2524	2756	TXPlatfor.exe	TXPlatfor.exe
PID 2756 wrote to memory of 2524	2756	TXPlatfor.exe	TXPlatfor.exe
PID 2744 wrote to memory of 2572	2744	1ca73cd5afdea64c01d33f652c47a9c6c3ee446fd5dd49bd6e8ff96fd89772d4.exe	HD_1ca73cd5afdea64c01d33f652c47a9c6c3ee446fd5dd49bd6e8ff96fd89772d4.exe
PID 2744 wrote to memory of 2572	2744	1ca73cd5afdea64c01d33f652c47a9c6c3ee446fd5dd49bd6e8ff96fd89772d4.exe	HD_1ca73cd5afdea64c01d33f652c47a9c6c3ee446fd5dd49bd6e8ff96fd89772d4.exe
PID 2744 wrote to memory of 2572	2744	1ca73cd5afdea64c01d33f652c47a9c6c3ee446fd5dd49bd6e8ff96fd89772d4.exe	HD_1ca73cd5afdea64c01d33f652c47a9c6c3ee446fd5dd49bd6e8ff96fd89772d4.exe
PID 2744 wrote to memory of 2572	2744	1ca73cd5afdea64c01d33f652c47a9c6c3ee446fd5dd49bd6e8ff96fd89772d4.exe	HD_1ca73cd5afdea64c01d33f652c47a9c6c3ee446fd5dd49bd6e8ff96fd89772d4.exe
PID 2600 wrote to memory of 2836	2600	cmd.exe	PING.EXE
PID 2600 wrote to memory of 2836	2600	cmd.exe	PING.EXE
PID 2600 wrote to memory of 2836	2600	cmd.exe	PING.EXE
PID 2600 wrote to memory of 2836	2600	cmd.exe	PING.EXE
PID 2572 wrote to memory of 1360	2572	HD_1ca73cd5afdea64c01d33f652c47a9c6c3ee446fd5dd49bd6e8ff96fd89772d4.exe	._cache_HD_1ca73cd5afdea64c01d33f652c47a9c6c3ee446fd5dd49bd6e8ff96fd89772d4.exe
PID 2572 wrote to memory of 1360	2572	HD_1ca73cd5afdea64c01d33f652c47a9c6c3ee446fd5dd49bd6e8ff96fd89772d4.exe	._cache_HD_1ca73cd5afdea64c01d33f652c47a9c6c3ee446fd5dd49bd6e8ff96fd89772d4.exe
PID 2572 wrote to memory of 1360	2572	HD_1ca73cd5afdea64c01d33f652c47a9c6c3ee446fd5dd49bd6e8ff96fd89772d4.exe	._cache_HD_1ca73cd5afdea64c01d33f652c47a9c6c3ee446fd5dd49bd6e8ff96fd89772d4.exe
PID 2572 wrote to memory of 1360	2572	HD_1ca73cd5afdea64c01d33f652c47a9c6c3ee446fd5dd49bd6e8ff96fd89772d4.exe	._cache_HD_1ca73cd5afdea64c01d33f652c47a9c6c3ee446fd5dd49bd6e8ff96fd89772d4.exe
PID 2264 wrote to memory of 2320	2264	svchost.exe	Remote Data.exe
PID 2264 wrote to memory of 2320	2264	svchost.exe	Remote Data.exe
PID 2264 wrote to memory of 2320	2264	svchost.exe	Remote Data.exe
PID 2264 wrote to memory of 2320	2264	svchost.exe	Remote Data.exe
PID 2572 wrote to memory of 1876	2572	HD_1ca73cd5afdea64c01d33f652c47a9c6c3ee446fd5dd49bd6e8ff96fd89772d4.exe	Synaptics.exe
PID 2572 wrote to memory of 1876	2572	HD_1ca73cd5afdea64c01d33f652c47a9c6c3ee446fd5dd49bd6e8ff96fd89772d4.exe	Synaptics.exe
PID 2572 wrote to memory of 1876	2572	HD_1ca73cd5afdea64c01d33f652c47a9c6c3ee446fd5dd49bd6e8ff96fd89772d4.exe	Synaptics.exe
PID 2572 wrote to memory of 1876	2572	HD_1ca73cd5afdea64c01d33f652c47a9c6c3ee446fd5dd49bd6e8ff96fd89772d4.exe	Synaptics.exe
PID 1360 wrote to memory of 3032	1360	._cache_HD_1ca73cd5afdea64c01d33f652c47a9c6c3ee446fd5dd49bd6e8ff96fd89772d4.exe	PING.EXE
PID 1360 wrote to memory of 3032	1360	._cache_HD_1ca73cd5afdea64c01d33f652c47a9c6c3ee446fd5dd49bd6e8ff96fd89772d4.exe	PING.EXE
PID 1360 wrote to memory of 3032	1360	._cache_HD_1ca73cd5afdea64c01d33f652c47a9c6c3ee446fd5dd49bd6e8ff96fd89772d4.exe	PING.EXE
PID 1360 wrote to memory of 3032	1360	._cache_HD_1ca73cd5afdea64c01d33f652c47a9c6c3ee446fd5dd49bd6e8ff96fd89772d4.exe	PING.EXE
PID 1876 wrote to memory of 2148	1876	Synaptics.exe	._cache_Synaptics.exe
PID 1876 wrote to memory of 2148	1876	Synaptics.exe	._cache_Synaptics.exe
PID 1876 wrote to memory of 2148	1876	Synaptics.exe	._cache_Synaptics.exe
PID 1876 wrote to memory of 2148	1876	Synaptics.exe	._cache_Synaptics.exe
PID 1360 wrote to memory of 1272	1360	._cache_HD_1ca73cd5afdea64c01d33f652c47a9c6c3ee446fd5dd49bd6e8ff96fd89772d4.exe	Runner.exe
PID 1360 wrote to memory of 1272	1360	._cache_HD_1ca73cd5afdea64c01d33f652c47a9c6c3ee446fd5dd49bd6e8ff96fd89772d4.exe	Runner.exe
PID 1360 wrote to memory of 1272	1360	._cache_HD_1ca73cd5afdea64c01d33f652c47a9c6c3ee446fd5dd49bd6e8ff96fd89772d4.exe	Runner.exe
PID 1360 wrote to memory of 1272	1360	._cache_HD_1ca73cd5afdea64c01d33f652c47a9c6c3ee446fd5dd49bd6e8ff96fd89772d4.exe	Runner.exe
PID 1360 wrote to memory of 1976	1360	._cache_HD_1ca73cd5afdea64c01d33f652c47a9c6c3ee446fd5dd49bd6e8ff96fd89772d4.exe	PING.EXE
PID 1360 wrote to memory of 1976	1360	._cache_HD_1ca73cd5afdea64c01d33f652c47a9c6c3ee446fd5dd49bd6e8ff96fd89772d4.exe	PING.EXE
PID 1360 wrote to memory of 1976	1360	._cache_HD_1ca73cd5afdea64c01d33f652c47a9c6c3ee446fd5dd49bd6e8ff96fd89772d4.exe	PING.EXE
PID 1360 wrote to memory of 1976	1360	._cache_HD_1ca73cd5afdea64c01d33f652c47a9c6c3ee446fd5dd49bd6e8ff96fd89772d4.exe	PING.EXE
PID 1360 wrote to memory of 2644	1360	._cache_HD_1ca73cd5afdea64c01d33f652c47a9c6c3ee446fd5dd49bd6e8ff96fd89772d4.exe	PING.EXE
PID 1360 wrote to memory of 2644	1360	._cache_HD_1ca73cd5afdea64c01d33f652c47a9c6c3ee446fd5dd49bd6e8ff96fd89772d4.exe	PING.EXE
PID 1360 wrote to memory of 2644	1360	._cache_HD_1ca73cd5afdea64c01d33f652c47a9c6c3ee446fd5dd49bd6e8ff96fd89772d4.exe	PING.EXE
PID 1360 wrote to memory of 2644	1360	._cache_HD_1ca73cd5afdea64c01d33f652c47a9c6c3ee446fd5dd49bd6e8ff96fd89772d4.exe	PING.EXE
PID 1360 wrote to memory of 480	1360	._cache_HD_1ca73cd5afdea64c01d33f652c47a9c6c3ee446fd5dd49bd6e8ff96fd89772d4.exe	binding.exe
PID 1360 wrote to memory of 480	1360	._cache_HD_1ca73cd5afdea64c01d33f652c47a9c6c3ee446fd5dd49bd6e8ff96fd89772d4.exe	binding.exe

C:\Users\Admin\AppData\Local\Temp\1ca73cd5afdea64c01d33f652c47a9c6c3ee446fd5dd49bd6e8ff96fd89772d4.exe
"C:\Users\Admin\AppData\Local\Temp\1ca73cd5afdea64c01d33f652c47a9c6c3ee446fd5dd49bd6e8ff96fd89772d4.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2744

C:\Users\Admin\AppData\Local\Temp\R.exe
C:\Users\Admin\AppData\Local\Temp\\R.exe
2⤵
- Sets DLL path for service in the registry
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:2488

C:\Users\Admin\AppData\Local\Temp\N.exe
C:\Users\Admin\AppData\Local\Temp\\N.exe
2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2556

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\N.exe > nul
3⤵
- Suspicious use of WriteProcessMemory
PID:2600

C:\Windows\SysWOW64\PING.EXE
ping -n 2 127.0.0.1
4⤵
- Runs ping.exe
PID:2836

C:\Users\Admin\AppData\Local\Temp\HD_1ca73cd5afdea64c01d33f652c47a9c6c3ee446fd5dd49bd6e8ff96fd89772d4.exe
C:\Users\Admin\AppData\Local\Temp\HD_1ca73cd5afdea64c01d33f652c47a9c6c3ee446fd5dd49bd6e8ff96fd89772d4.exe
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2572

C:\Users\Admin\AppData\Local\Temp\._cache_HD_1ca73cd5afdea64c01d33f652c47a9c6c3ee446fd5dd49bd6e8ff96fd89772d4.exe
"C:\Users\Admin\AppData\Local\Temp\._cache_HD_1ca73cd5afdea64c01d33f652c47a9c6c3ee446fd5dd49bd6e8ff96fd89772d4.exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1360

C:\Windows\SysWOW64\PING.EXE
"C:\Windows\System32\PING.EXE" www.baidu.com -n 2
4⤵
- Runs ping.exe
PID:3032

C:\Users\Admin\AppData\Roaming\MyMacro\Runner.exe
--host_id 3 --verify_key NJXWU4ZEh8Ut --product "C:\Users\Admin\AppData\Local\Temp\._cache_HD_1ca73cd5afdea64c01d33f652c47a9c6c3ee446fd5dd49bd6e8ff96fd89772d4.exe" --version 2014.05.17762
4⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Loads dropped DLL
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1272

C:\Windows\SysWOW64\PING.EXE
"C:\Windows\System32\PING.EXE" www.baidu.com -n 2
4⤵
- Runs ping.exe
PID:1976

C:\Windows\SysWOW64\PING.EXE
"C:\Windows\System32\PING.EXE" www.baidu.com -n 2
4⤵
- Runs ping.exe
PID:2644

C:\Users\Admin\AppData\Roaming\MyMacro\binding.exe
C:\Users\Admin\AppData\Roaming\MyMacro\binding.exe
4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:480

C:\ProgramData\Synaptics\Synaptics.exe
"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1876

C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2148

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k "Remote Data"
1⤵
PID:3036

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k "Remote Data"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2264

C:\Windows\SysWOW64\Remote Data.exe
"C:\Windows\system32\Remote Data.exe" "c:\windows\system32\259423625.txt",MainThread
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2320

C:\Windows\SysWOW64\TXPlatfor.exe
C:\Windows\SysWOW64\TXPlatfor.exe -auto
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2756

C:\Windows\SysWOW64\TXPlatfor.exe
C:\Windows\SysWOW64\TXPlatfor.exe -acsi
2⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Executes dropped EXE
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
PID:2524

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1800

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\HD_X.dat
Filesize
2.5MB

MD5
acec13aa01bc10d2ca43979c01aa1a72

SHA1
da28ccda34fd599f50a72ee3efd7c4e8a63c1579

SHA256
142abca126fc1ba2c7f3633872a28828a4042107f6145a158a7eab99238d24bb

SHA512
7f2d24fa49703f97a1a6ea0d80cef14aba2bb095358bf836ceb95477954110711157fef7afda97eaef5922e33b19ba7937847165304bedac410cff5f8def67e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\QMLog\20240524.log
Filesize
324B

MD5
d5184ceb6948daacc7686a6e2208b7c8

SHA1
51a75e525d881506b9d717c04517603c262ed167

SHA256
d28aa7c448f27c9121925931469f774da20acd0d2e1834d49d159baa2f4b4abe

SHA512
5744ca3ab5686e6e24d843f8b2d1a8593da6bbee2f015bad1c32dcb223293071bfe4619c7ef1f6fe79f490bf19f45d58c4c351315fc4eb9075dba971954d085a

Download Submit
C:\Users\Admin\AppData\Local\Temp\macA2B5.tmp
Filesize
358B

MD5
14739f7d86ebc59524d1f379b32397f0

SHA1
884acc0579970c637f02370b5fafabdbb4c1c1cf

SHA256
1f4978fd9ab8cdbafb5f8457b97b0feb4217d19d9fea49af9caa6bd46b58f9f1

SHA512
f2e7650ecce616ab0fac4c832f67322f78021cbe2e4a08d117f9a2c2aefc0d31114914570bb5a36a077d62e1b29f67fb5e2e25ec05bc231ed62955d8de4c4e52

Download Submit
C:\Users\Admin\AppData\Local\Temp\vULb3Uqr.xlsm
Filesize
17KB

MD5
e566fc53051035e1e6fd0ed1823de0f9

SHA1
00bc96c48b98676ecd67e81a6f1d7754e4156044

SHA256
8e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15

SHA512
a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04

Download Submit
C:\Users\Admin\AppData\Roaming\MyMacro\Runner.exe
Filesize
7.2MB

MD5
bf194c1f69ea179613a00c300a537fd6

SHA1
d88ca448d3cb748f0bb8488cf2779adafb19170c

SHA256
774dd36da750db779d107b39e7f6f6f4c6f0766b2722d8d234971639d6e16fbf

SHA512
59e2ef379bafe0a4bc62bcf299776f1a837e0e86ef42651cd8c309a13e4a3d434a7cd4f844bb7346669a84a8d905b44e5ab9da9de557d11ef6e74210306039c4

Download Submit
C:\Windows\SysWOW64\Remote Data.exe
Filesize
43KB

MD5
51138beea3e2c21ec44d0932c71762a8

SHA1
8939cf35447b22dd2c6e6f443446acc1bf986d58

SHA256
5ad3c37e6f2b9db3ee8b5aeedc474645de90c66e3d95f8620c48102f1eba4124

SHA512
794f30fe452117ff2a26dc9d7086aaf82b639c2632ac2e381a81f5239caaec7c96922ba5d2d90bfd8d74f0a6cd4f79fbda63e14c6b779e5cf6834c13e4e45e7d

Download Submit
\Users\Admin\AppData\Local\Temp\._cache_HD_1ca73cd5afdea64c01d33f652c47a9c6c3ee446fd5dd49bd6e8ff96fd89772d4.exe
Filesize
8.9MB

MD5
b36e16fa438970508f45003f96db3fad

SHA1
7c603bf2a00da0873eaa28306a0242dfdb2ff6b6

SHA256
22ac8239eb13919b2df924d2fd401a0f680aa04344fb1d736529d7459ef871c7

SHA512
bca069aa983df6924f1f2a9f21bc7644d5c0540af521f34d5a8eabdc1ea78f85a5188ca7794a2ae3bfce9734bbe7b8c15cead12d91e4c52cef3ef4337c041623

Download Submit
\Users\Admin\AppData\Local\Temp\HD_1ca73cd5afdea64c01d33f652c47a9c6c3ee446fd5dd49bd6e8ff96fd89772d4.exe
Filesize
9.7MB

MD5
1ecb6542eeece9094ae447f5ad6a9323

SHA1
e91a40252e966f1defe12e5483de56ca0867c19e

SHA256
a653a6264fc3618cb11792861e56703a268b6873033ad777d4f708ad73471b94

SHA512
11135e11fc6c53b87e3eef6b1bf47c75506c8f1617f3146c64c94cbd27e54568a5081b4d87aab806329864c330fc49c3d950055ecf5aa8e932c17858883aa2b5

Download Submit
\Users\Admin\AppData\Local\Temp\N.exe
Filesize
377KB

MD5
4a36a48e58829c22381572b2040b6fe0

SHA1
f09d30e44ff7e3f20a5de307720f3ad148c6143b

SHA256
3de6c02f52a661b8f934f59541d0cf297bb489eb2155e346b63c7338e09aeaf8

SHA512
5d0ea398792f6b9eb3f188813c50b7f43929183b5733d2b595b2fd1c78722764fd15f62db1086b5c7edfb157661a6dcd544ddd80907ee7699dddbca1ef4022d0

Download Submit
\Users\Admin\AppData\Local\Temp\R.exe
Filesize
941KB

MD5
8dc3adf1c490211971c1e2325f1424d2

SHA1
4eec4a4e7cb97c5efa6c72e0731cd090c0c4adc5

SHA256
bc29f2022ab3b812e50c8681ff196f090c038b5ab51e37daffac4469a8c2eb2c

SHA512
ae92ea20b359849dcdba4808119b154e3af5ef3687ee09de1797610fe8c4d3eb9065b068074d35adddb4b225d17c619baff3944cb137ad196bcef7a6507f920d

Download Submit
\Users\Admin\AppData\Roaming\MyMacro\binding.exe
Filesize
1.7MB

MD5
6abd36f782e36bcf9e90a3230d6ca97f

SHA1
3c3d5760a8db6c66f4c5b8c31cbf2613a8a7d6b9

SHA256
13652dae4ec58de8a20da51c7455f34144554b91d25ac1c72bec9cbe361ca752

SHA512
05463e3c0028e8e39787465e4529ad22c9c64c2a29701c4673f983b50852573aa3c197c2307fdf58d9ab514cca06f058cc17a8b53d28e76957792be7ac1acce6

Download Submit
\Users\Admin\AppData\Roaming\MyMacro\cfgdll.dll
Filesize
59KB

MD5
b35416c2b3e818894df95608b76934f7

SHA1
bbdd1c0f49e9ce54e9312f5edfead76d343c21cf

SHA256
8147481d1c93da5ce5de7ff7a72a45756d45ea1f27d27bb8c9944642f42549a3

SHA512
92382562761b36b4ed2ec0bba832c66c8f720e190630596ff830a047a498889e7a0f3628d1a3ffac066b06ccd8c2d3840e82b4304b636e1b1ee434910c6f0bdf

Download Submit
\Users\Admin\AppData\Roaming\MyMacro\qdisp.dll
Filesize
303KB

MD5
014c01cd6522778e1e15be0e696dfe0c

SHA1
c908376fcc4525ec5c4b35d289ef1361ea5cb2d9

SHA256
259eaf1ddc9bf610d11a22413853b3d4386fc5a8412c6e602c74eb43f1a32d46

SHA512
3b8d040b4a6e879ecf3bafba336b2fc8d793d4f6931902faf87e8f64faf6eca7f1f21485794cffe16c7d0ea907b9f6db93df0b4bae8cb3684733e95608523fd9

Download Submit
\Windows\SysWOW64\259423625.txt
Filesize
899KB

MD5
9e1d97f2afa28a34ee6776f5974192e4

SHA1
a2ba1ae20079a7e6b5fe61e1e3a7f0b092799bd6

SHA256
91c160408144ae6cdaff8f7a2a5060dc7c9c6d1123e448c6becdbee309ee1d36

SHA512
c5b8f7d07e22d46a29db600a9a2af4ed9fd16d87cdd9c7b9c7e05f1da08092049861c7a6844dd6051e80f280bda4b23d2a4d0c72095d0dd1752bf3621da9b61e

Download Submit
memory/1272-209-0x0000000000400000-0x0000000000B31000-memory.dmp

Filesize
7.2MB

Download
memory/1272-258-0x0000000000400000-0x0000000000B31000-memory.dmp

Filesize
7.2MB

Download
memory/1272-267-0x0000000000400000-0x0000000000B31000-memory.dmp

Filesize
7.2MB

Download
memory/1272-154-0x0000000000400000-0x0000000000B31000-memory.dmp

Filesize
7.2MB

Download
memory/1272-278-0x0000000000400000-0x0000000000B31000-memory.dmp

Filesize
7.2MB

Download
memory/1272-276-0x0000000000400000-0x0000000000B31000-memory.dmp

Filesize
7.2MB

Download
memory/1272-261-0x0000000000400000-0x0000000000B31000-memory.dmp

Filesize
7.2MB

Download
memory/1272-273-0x0000000000400000-0x0000000000B31000-memory.dmp

Filesize
7.2MB

Download
memory/1272-270-0x0000000000400000-0x0000000000B31000-memory.dmp

Filesize
7.2MB

Download
memory/1272-216-0x0000000000400000-0x0000000000B31000-memory.dmp

Filesize
7.2MB

Download
memory/1272-197-0x0000000000400000-0x0000000000B31000-memory.dmp

Filesize
7.2MB

Download
memory/1272-220-0x0000000000400000-0x0000000000B31000-memory.dmp

Filesize
7.2MB

Download
memory/1272-202-0x0000000000400000-0x0000000000B31000-memory.dmp

Filesize
7.2MB

Download
memory/1272-206-0x0000000000400000-0x0000000000B31000-memory.dmp

Filesize
7.2MB

Download
memory/1272-204-0x0000000000400000-0x0000000000B31000-memory.dmp

Filesize
7.2MB

Download
memory/1360-203-0x0000000004E10000-0x0000000005541000-memory.dmp

Filesize
7.2MB

Download
memory/1360-152-0x0000000004E10000-0x0000000005541000-memory.dmp

Filesize
7.2MB

Download
memory/1360-153-0x0000000004E10000-0x0000000005541000-memory.dmp

Filesize
7.2MB

Download
memory/1800-169-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/1876-201-0x0000000000400000-0x0000000000DB0000-memory.dmp

Filesize
9.7MB

Download
memory/1876-196-0x0000000000400000-0x0000000000DB0000-memory.dmp

Filesize
9.7MB

Download
memory/1876-257-0x0000000000400000-0x0000000000DB0000-memory.dmp

Filesize
9.7MB

Download
memory/2524-41-0x0000000010000000-0x00000000101B6000-memory.dmp

Filesize
1.7MB

Download
memory/2524-49-0x0000000010000000-0x00000000101B6000-memory.dmp

Filesize
1.7MB

Download
memory/2524-54-0x0000000010000000-0x00000000101B6000-memory.dmp

Filesize
1.7MB

Download
memory/2556-20-0x0000000010000000-0x00000000101B6000-memory.dmp

Filesize
1.7MB

Download
memory/2556-21-0x0000000010000000-0x00000000101B6000-memory.dmp

Filesize
1.7MB

Download
memory/2556-18-0x0000000010000000-0x00000000101B6000-memory.dmp

Filesize
1.7MB

Download
memory/2572-102-0x0000000000400000-0x0000000000DB0000-memory.dmp

Filesize
9.7MB

Download