010565e86b027a3ca698879ce968900c706ac328ddb81e29adbb092598ef61f7

Analysis

max time kernel
140s
max time network
119s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
24/05/2024, 18:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

010565e86b027a3ca698879ce968900c706ac328ddb81e29adbb092598ef61f7.exe
Size

26KB
MD5

918a6b9b6dfc81bfe266130ad30b21ad
SHA1

aa0bd70c8291b5d76d001cb17e4cb3ea6129fe7e
SHA256

010565e86b027a3ca698879ce968900c706ac328ddb81e29adbb092598ef61f7
SHA512

995b973b5cb0603c201bc83ce496c08edfdeb12cd6b62350a409d87ea678808c909133b1387fbe511ac0ccd4fbbb14d1637d346f2eaa9e7c47030ae079bc7380
SSDEEP

768:qq3G3q83wdv7GLGS1R9TNoINEx9jnhwrw:Jkq83wdv7Gti

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
940	Krnl32.exe

Loads dropped DLL 2 IoCs

pid	Process
624	010565e86b027a3ca698879ce968900c706ac328ddb81e29adbb092598ef61f7.exe
624	010565e86b027a3ca698879ce968900c706ac328ddb81e29adbb092598ef61f7.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WinKernel = "C:\\Users\\Admin\\AppData\\Local\\Temp\\010565e86b027a3ca698879ce968900c706ac328ddb81e29adbb092598ef61f7.exe"	010565e86b027a3ca698879ce968900c706ac328ddb81e29adbb092598ef61f7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WinKernel = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Krnl32.exe"	Krnl32.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\pirch98\pirch98.ini	Krnl32.exe
File opened for modification	C:\Program Files\pirch98\events.ini	Krnl32.exe
File opened for modification	C:\Program Files\mirc\script.ini	Krnl32.exe
File opened for modification	C:\Program Files\mirc\ \.dcc send $nick	Krnl32.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\ehome\wow\ehexthost32.exe	Krnl32.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe	Krnl32.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\ServiceModelReg.exe	Krnl32.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v3.5\vbc.exe	Krnl32.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe	Krnl32.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ilasm.exe	Krnl32.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\ComSvcConfig.exe	Krnl32.exe
File opened for modification	C:\Windows\ehome\loadmxf.exe	Krnl32.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe	Krnl32.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen.exe	Krnl32.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\ComSvcConfig.exe	Krnl32.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\WsatConfig.exe	Krnl32.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_regsql.exe	Krnl32.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Krnl32.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe	Krnl32.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\InstallUtil.exe	Krnl32.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\infocard.exe	Krnl32.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe	Krnl32.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v3.5\csc.exe	Krnl32.exe
File opened for modification	C:\Windows\ehome\ehrec.exe	Krnl32.exe
File opened for modification	C:\Windows\ehome\MediaCenterWebLauncher.exe	Krnl32.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Krnl32.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Krnl32.exe
File created	C:\Windows\Microsoft.NET\Framework\v3.5\MSBuild.exe	Krnl32.exe
File created	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\MSBuild.exe	Krnl32.exe
File opened for modification	C:\Windows\ehome\ehtray.exe	Krnl32.exe
File opened for modification	C:\Windows\ehome\Mcx2Prov.exe	Krnl32.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\EdmGen.exe	Krnl32.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v3.5\vbc.exe	Krnl32.exe
File opened for modification	C:\Windows\ehome\ehrecvr.exe	Krnl32.exe
File opened for modification	C:\Windows\ehome\WTVConverter.exe	Krnl32.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_compiler.exe	Krnl32.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_regiis.exe	Krnl32.exe
File opened for modification	C:\Windows\ehome\McrMgr.exe	Krnl32.exe
File opened for modification	C:\Windows\hh.exe	Krnl32.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe	Krnl32.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_compiler.exe	Krnl32.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_regbrowsers.exe	Krnl32.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v3.5\MSBuild.exe	Krnl32.exe
File opened for modification	C:\Windows\fveupdate.exe	Krnl32.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe	Krnl32.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\WsatConfig.exe	Krnl32.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\SMSvcHost.exe	Krnl32.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\XamlViewer\XamlViewer_v0300.exe	Krnl32.exe
File opened for modification	C:\Windows\bfsvc.exe	Krnl32.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v2.0.50727\IEExec.exe	Krnl32.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe	Krnl32.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\Microsoft.Workflow.Compiler.exe	Krnl32.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_regiis.exe	Krnl32.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe	Krnl32.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ServiceModelReg.exe	Krnl32.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v3.5\DataSvcUtil.exe	Krnl32.exe
File opened for modification	C:\Windows\ehome\ehshell.exe	Krnl32.exe
File opened for modification	C:\Windows\ehome\mcspad.exe	Krnl32.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe	Krnl32.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v3.5\csc.exe	Krnl32.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInUtil.exe	Krnl32.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regsql.exe	Krnl32.exe
File created	C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Krnl32.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Krnl32.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe	Krnl32.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\regtlibv12.exe	Krnl32.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_state.exe	Krnl32.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_wp.exe	Krnl32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	Iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	Iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000027d6fff4db7d8b4eace4536ee2f39ead00000000020000000000106600000001000020000000eab8fc8ccbec794bc1d3671b8a4f5b4649bad65d4a66502d3ebeb54087e7a5c7000000000e8000000002000020000000c3fc0ac0dc4153986aae35073bd87a0e0784e3622083a04d810db2f9061717409000000066f6fca7d74ad9193f13aa34c3e088a06f300a03dc1545ed3ff409958bb00c0dbe9a1a09528c2af846c3b6577444728dda2f8738dd302115c52ec5027bedd684678a27866752822ade846b915be099b276c34538860ce199624d0a7e0ba44db5c06655a8c454e1729632ea5db34128a20ec62b48449c60b6f601d3560422bd93673fc00a4615d2395b75d9e0933264f84000000044fd1c9fffefd9fb1e1c16dcd559ff49c44976a1984f8f330e97c4d43a1b173ebbbf3225e4c5ba74de46c75e97363eb66bea9a5e1ab57bc80149d20f022b62ad	Iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	Iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	Iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	Iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	Iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c091565405aeda01	Iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	Iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	Iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7C9C3311-19F8-11EF-B9A1-EE87AAC3DDB6} = "0"	Iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	Iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000027d6fff4db7d8b4eace4536ee2f39ead000000000200000000001066000000010000200000005e71985db2abc94a133846ad3753413043fedbfdcd2440e15d422f363d28115d000000000e8000000002000020000000e9c701584aa3fb46a9d34b4b34c89c977f378bf32f4dc437e4b428ef14d065f7200000001eca40b6fee818d590189e3d9b912485e61da0cba7a61b55c37426a5f42dbf21400000001a9951d7bca7fd01b708aefef48160c0c32f53a2f27dbb3432a9ceb22e21799044f3f51ea168f21c8aecb438d85118c78a93c17907d0288a4bb8da1f9960e7f6	Iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422735918"	Iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	Iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	Iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	Iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	Iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	Iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico"	Iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	Iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	Iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	Iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	Iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}	Iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	Iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	Iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	Iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	Iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	Iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	Iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes	Iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	Iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	Iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	Iexplore.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
2292	NOTEPAD.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2488	Iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2488	Iexplore.exe
2488	Iexplore.exe
2448	IEXPLORE.EXE
2448	IEXPLORE.EXE
2448	IEXPLORE.EXE
2448	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 624 wrote to memory of 940	624	010565e86b027a3ca698879ce968900c706ac328ddb81e29adbb092598ef61f7.exe	28
PID 624 wrote to memory of 940	624	010565e86b027a3ca698879ce968900c706ac328ddb81e29adbb092598ef61f7.exe	28
PID 624 wrote to memory of 940	624	010565e86b027a3ca698879ce968900c706ac328ddb81e29adbb092598ef61f7.exe	28
PID 624 wrote to memory of 940	624	010565e86b027a3ca698879ce968900c706ac328ddb81e29adbb092598ef61f7.exe	28
PID 624 wrote to memory of 2292	624	010565e86b027a3ca698879ce968900c706ac328ddb81e29adbb092598ef61f7.exe	29
PID 624 wrote to memory of 2292	624	010565e86b027a3ca698879ce968900c706ac328ddb81e29adbb092598ef61f7.exe	29
PID 624 wrote to memory of 2292	624	010565e86b027a3ca698879ce968900c706ac328ddb81e29adbb092598ef61f7.exe	29
PID 624 wrote to memory of 2292	624	010565e86b027a3ca698879ce968900c706ac328ddb81e29adbb092598ef61f7.exe	29
PID 940 wrote to memory of 2488	940	Krnl32.exe	30
PID 940 wrote to memory of 2488	940	Krnl32.exe	30
PID 940 wrote to memory of 2488	940	Krnl32.exe	30
PID 940 wrote to memory of 2488	940	Krnl32.exe	30
PID 2488 wrote to memory of 2448	2488	Iexplore.exe	32
PID 2488 wrote to memory of 2448	2488	Iexplore.exe	32
PID 2488 wrote to memory of 2448	2488	Iexplore.exe	32
PID 2488 wrote to memory of 2448	2488	Iexplore.exe	32

C:\Users\Admin\AppData\Local\Temp\010565e86b027a3ca698879ce968900c706ac328ddb81e29adbb092598ef61f7.exe
"C:\Users\Admin\AppData\Local\Temp\010565e86b027a3ca698879ce968900c706ac328ddb81e29adbb092598ef61f7.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:624
- C:\Users\Admin\AppData\Local\Temp\Krnl32.exe
  "C:\Users\Admin\AppData\Local\Temp\Krnl32.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:940
- - C:\Program Files\Internet Explorer\Iexplore.exe
    "C:\Program Files\Internet Explorer\Iexplore.exe" http://wwp.icq.com/scripts/WWPMsg.dll?from=M4TrIx&fromemail=_&subject=MATRIX&body=THE%20MATRIX%20HAS%20COME...&to=90019603%20HTTP/1.0
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2488
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2488 CREDAT:275457 /prefetch:2
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:2448
- C:\Windows\SysWOW64\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\HELPME.TXT
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:2292

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
d3008215e14e0e11ffe717199ef776c5

SHA1
4775f6d5cabd4b0b736c0dd49bcb087c267f5f9f

SHA256
37c805ab34ce08d3bad54d3c1b8de618a5f0e78dac38306c26e36616c2439ced

SHA512
8ab9eb772a13d892569b7fb917ddcc25e1dee16c6f620619c8c64c7944aab93d978ad78b8400ec734b17054243c329dbacfda84737feb9b514dbd12149488160

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4a96eded1455264e67eb6991cabe04dd

SHA1
0f2aba658a84422abe8a4012281acb63d11490cc

SHA256
6850e9abf4bd311d58765c73f3e90a285fba280ead81aa6924b01a81565e848f

SHA512
1b4e24c835cb1b9086822790f7bcb90c1cda4760537aa47317adbc1d9143ee4ba428faa9add4afee2d9630756fba9190edcc9ead3c8fabdd786e8b5b6749a2e5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3b8ff3c9c1fe91e32870157a200b91ab

SHA1
00847d450e638c967756be40ba41ac3274d41faa

SHA256
6c66df0af8916371ccd09b7e2039227cb9b208fa0e06028219c0c75d9f2c057d

SHA512
e371cd284a602be5bc03c65983ffbb1c8544fb971254efd21085151abfbabc2f2a57c26f6353713a375dfcbedc21e8d348ce2f25e6a7e99a2f1a84f72e5f7446

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c8e22daa866e21be62be121750ef43a2

SHA1
d8d763d7c78b6b89d429eec2acc896f047a73187

SHA256
c76648a11150c2ac3c1d54fe25c429f97760426c5213baa3fc5d2a8c871f4fea

SHA512
171152e32b6c48d88aa8b79ca3eff4cddc7c42a241de2d1873366786eba08561bb23743986ceb40f3f5b5119903b8093b43af4f3556ec3a46283036a13faeb48

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5fcac9275524a3af51f0b2181cd44dde

SHA1
0720246e8ca70fd1b2d18987bbca862eee352c78

SHA256
416c247463fcb75c12fa358aca2311c8b15d84a82012485f16601bbe260be040

SHA512
d121d4e2c72626f96d3a72b8f12d2c642acc50fdbd939c4c323c362106613f69b0c2268761c8a215adbc9dc8fe00ea9b1368b2ebe06270e20c37786c275749fe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
465a4780a42c6ed9da32e61cb4ed2d52

SHA1
c83615cbd8ed441ad1ed74e153971a7a6fd673f8

SHA256
2d68bc326aa74693a66af11153a49cfbf90930a80d92551d2c64dc3ca2da0784

SHA512
4fbd69bb643e98f11f717219e927a8de095eb7a2d6cde6f6a171f3611080134b56012960a7bc532b644138f7f8b25874dd0af8df78a836a5fb4a61b4e3f25b5d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
75adb3b5e34eacf282671131070f065d

SHA1
f53543995b9a0d1457197af024542038e751288f

SHA256
489c58f7c20559e2b140512e19905dd59e2d1c49b059c7e5ec760c9ed1e7a80e

SHA512
2e5559a377522ee075bbb055e490c5a95ae429db4ea9b0afdaa43e3a4a70fb7f24497e2ae7df5931f27f79d05fc1c998e73959ecc6fcddab1fccf196e037412d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2f745fd9b9a1087082b783bfa8a7ae97

SHA1
7681244769fbb10de49c802d96122521a9ce2a3b

SHA256
86752a9639428e139eb00b87d8a356cfd8aaf9d13bbfd51066b9511e2e2e31f9

SHA512
1d25f112bc3af058392f71fb53f179aa8f2a7e3c8e2b45a007265958f958ddf00d316caa1951fe90c06b3f30caeccb399b7e8c0679fda0d3e0d81cd6624f86c2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6b4a605feed6100e38355bac9fb9436e

SHA1
d530b3c9be45e27b8798f7467156e2b191b7e637

SHA256
45b0af8d58864364af9f811868cc050ef28f8d816dfdfd79a64604c01278dbaf

SHA512
ef1aff51f14f1701ca12778764ea7bbe1a3c882ec5829eb9992c0c4797a443ab68ec2372b24b3355cd34a35d49bc7988a8cbfe31c9b332ce9b1d188b4be3dae7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ad1685f1c3190baf35cadb4f0b6c9a00

SHA1
efccd534cd3c545acce07b4ece057e8175794bf0

SHA256
5fdaf9a6fd6a406592e97c1b9df78fcdcd11c4de3859bf29509f06418ff4e0ff

SHA512
0977422c056379336b2ab9d3265fb826699f8da9fdc580d17558c67a23b3ebd6fda2d6c4d8a386fa664deb946dabc8e4fcea0fbcbb526f0f7a119c26f4d7499b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3d2db8db110d3caff067358d837e6252

SHA1
0f31a921780ebfb0a8b2e4bd89f3725ebaeafb5b

SHA256
1a84013a19e2012e67a8d95a3127143d8971034fa74006675d15d06683a95375

SHA512
fc300be61823f3db18649a19e5f91eca1af4a58259d6524273a6b4a7ea241d800329e36b018c56e8290c23aaa26f9b5788b209f0105b5bd0d86d8ea6af5d5706

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0a29760b81ca18a88c72c406593044a4

SHA1
66b8f504964b326ec50e9af7e34a41c9896659b7

SHA256
5ff67bd65279b04b3db9c9b54edbdf6d4883dfe5d4d84d5ef8cc1ae4a6eb8701

SHA512
834de961f3c87526705152dc482333ee464561046eb1685607ab181b18e244a55790530e9baacf3b6cb4a2de81adf254f68d31155346dd2d1d5ca783fb6b0437

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cbcb5ad43faa2684feebed9824433ab2

SHA1
36ca8bd80de2a5c277057e877dfc4fc4f899407f

SHA256
a93b0124660904f453f285b51a25216885e5f01f1708eff445396a6187cc1817

SHA512
10668706bb25b4ce988ac5958d7c746f885e843671236122fe6f2bba7c7ac7beb4d66aecfcc742ef71430d4aa067ff13562a6602335b78746e9ba080f720f519

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7eb028632cfd9bf52368698b409834b0

SHA1
563141b3f6cda515d73a09de534aec80ee1f0fac

SHA256
a36365bdd0766fd2e76fcd3ddf255b5fd53e1fb386c699348e37486380af9f2a

SHA512
88c055cb712ee6702274c57d0b68b5d916eeba34d8d47bd34fc75f80aae8f1e9e225569ea48a350b184097ae5d9b74103493ac4e20825cc7ee45a74d828f43b6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e15be906114379586191aa4675b89a7e

SHA1
88ca028ff18019511fd8fab4bd861b76245ded0c

SHA256
22f8722f2c976f72043d1fb5a7a3a9824d2e43924f22abb8831a6d0f969805ae

SHA512
3ece6303490fe2d595f4a5d1eaf128f02698d41af29a03515127d3610b0e0dd411dfc23c4827524575a88d47b0499efea4ae2026862eada62e1673eab6b40f9b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d6f6f4c68dac4da2784f278cb8afa7f7

SHA1
7da71ec826a84112bf513e74673d9114a35d7000

SHA256
e540a753e0230e8b9d8145062389efad353c36059e224c5cbfa1b96a4b405031

SHA512
50fcfec174b81fb70f668bb70fc2eb038c1da0a8a21065982f2d5876dcd027d04cf7a07fa8c3315482ba40b1acd2504ea811fa2a46d597fbb0f61516e1d67d2c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
95a9e2af81bf49cb3a4705a5522efc52

SHA1
bfd038faafd163a699a498b3ba4627c1dabdec70

SHA256
d7e981a5494aaf733285d885da5a55e0e0e1b0ab5c24545640e3de140f49be56

SHA512
3572cf05b2d72345605a8ac6e38fa9719fb2554ea76d191c3b56036b75f486599fe376945b3c8534dbfade3a82d2076fcdac995b485fae5b3740073909bc8ae8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
f1faa3697ceaf23f4ad599d9427a602d

SHA1
d71e774c659ae627d98a8a5fd5d931251e1fd1a9

SHA256
34b141e965effe725a31a1d7b88812ea4137705e9ecc5e1bbb8efe5d15993799

SHA512
3f87a3c5ab464282656b12a8673eed00da5d2b87cf203f6059c51d2ac92f03dbf024f527fd5f44981c508717072ed6e69c6cf4ff67d417d6ff2196b93b713791

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico

Filesize
4KB

MD5
da597791be3b6e732f0bc8b20e38ee62

SHA1
1125c45d285c360542027d7554a5c442288974de

SHA256
5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07

SHA512
d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\s8rbov0\imagestore.dat

Filesize
4KB

MD5
6074cee32430e392e978b876b09be7a4

SHA1
8fe2fa02431a66fb591a4562efde6a186eea480a

SHA256
68b20db5361c2a5cc66646bd37432c0bb167171de9fc197e2dc0e177ae758352

SHA512
e175b92256e935dc61577a536cc90e295ea44a2403f315f36634e496b7dbbddb32270111d17c18aa45fe5c29cc7802df58f07fe897d851207b79659c475e89f6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BCLQSOS4\icon_web_60[1].png

Filesize
4KB

MD5
e9dbf6c742169ea700f8386bf639911b

SHA1
2fce93e1b217283c3d7c8ef275748ad69f840815

SHA256
3ce3371ecd679c4e218474046aa2a2ab067dbac5370b983aa8e7d91b208d816b

SHA512
2809218b84cda633e6c5c2e47d8d65c23c1ea05a88b5ee970c6bc6265223ef6e94f0d30605e1f15601ecdc68700eca299990314468a37109cac87b30c575d234

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\X5YZDSFT\en[2].htm

Filesize
41KB

MD5
ee39185389dd344b465d52a2b00c24f4

SHA1
6391a8ec25edaf66de92720e113576892e92f149

SHA256
048b8193d25d826641ce4de886572d782f6b97da86e8c4549bc3fd5517ec8085

SHA512
e0897211866962072dfda695de412c58c424fea36787e39944decadd84029b2e9db58ae3107e1660a366e46cb8313bab114a36a0095031b474699fd184be6c76

Download Submit
C:\Users\Admin\AppData\Local\Temp\HELPME.TXT

Filesize
67B

MD5
057798d389930107a381a2690141ac1d

SHA1
e44f1c2475c0f2323507e141dcae53ffef51c624

SHA256
5ba8c75f08589b808a6e16225ea565734aeeb23edc40894174d2d135f5e8d3d2

SHA512
98b40b6a11027974b482cb645718d34c8ee707ad01d6eba05acbf15a3b8d7c762afc08fef6513623fefe6e297d77a838fbb980d944a4a8e864356dfabac473e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Krnl32.exe

Filesize
26KB

MD5
f9023ca13040083133761fea0a386f41

SHA1
087239358c4c38af96333a56c6cfe0f3c19f601d

SHA256
25ef3ab425f2567bc55b29a41b883343c09b00a5ae7ee034e5c4c08ae8805553

SHA512
eabd0944c55357701cf5ca29bbc45993a3810a8c91f7d489cbb1870f7423e9883dfa74f0295f37632a310304326ea7c19e0d68ba8088a8590a42ed4a92ea051e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8B73.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit
memory/624-24-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/624-17-0x0000000000520000-0x0000000000533000-memory.dmp

Filesize
76KB

Download
memory/624-10-0x0000000000520000-0x0000000000533000-memory.dmp

Filesize
76KB

Download
memory/624-0-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/940-30-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/940-18-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/940-677-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/940-674-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/940-26-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/940-214-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/940-1129-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/940-1131-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads