Overview
overview
10Static
static
7IESecurity.dll
windows7-x64
6IESecurity.dll
windows10-2004-x64
6ProcMon.dll
windows7-x64
1ProcMon.dll
windows10-2004-x64
1SpySheriff.exe
windows7-x64
8SpySheriff.exe
windows10-2004-x64
7Uninstall.exe
windows7-x64
1Uninstall.exe
windows10-2004-x64
1heur000.dll
windows7-x64
1heur000.dll
windows10-2004-x64
1heur001.dll
windows7-x64
1heur001.dll
windows10-2004-x64
1heur002.dll
windows7-x64
4heur002.dll
windows10-2004-x64
4heur003.dll
windows7-x64
10heur003.dll
windows10-2004-x64
10Analysis
-
max time kernel
149s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
24-05-2024 20:23
Behavioral task
behavioral1
Sample
IESecurity.dll
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
IESecurity.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral3
Sample
ProcMon.dll
Resource
win7-20240508-en
Behavioral task
behavioral4
Sample
ProcMon.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
SpySheriff.exe
Resource
win7-20240508-en
Behavioral task
behavioral6
Sample
SpySheriff.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral7
Sample
Uninstall.exe
Resource
win7-20240508-en
Behavioral task
behavioral8
Sample
Uninstall.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral9
Sample
heur000.dll
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
heur000.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral11
Sample
heur001.dll
Resource
win7-20240419-en
Behavioral task
behavioral12
Sample
heur001.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral13
Sample
heur002.dll
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
heur002.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral15
Sample
heur003.dll
Resource
win7-20240221-en
Behavioral task
behavioral16
Sample
heur003.dll
Resource
win10v2004-20240508-en
General
-
Target
SpySheriff.exe
-
Size
403KB
-
MD5
c899f93e8b753fedd068ef3fe2edb0fd
-
SHA1
144b1f18d0e307d14937c21ca1d7cbfc91828a10
-
SHA256
5c2a85fb56de2e0a1a1d260ef2177e0209477586c8a6740494bbaf40a9785f47
-
SHA512
1aceacb4eba0815322dd3fcd273d8703408362eee3b2d2b5981d2abbe4c2b02852608f46b2e7ce46a50e921871d445c239014b5957c6ba0606bd0334ce7bd41b
-
SSDEEP
12288:eBMDMf+ztV53y2k9I68iXDycz+rYIYsVRSHsDr:eS4S53h68eIZjD
Malware Config
Signatures
-
Modifies RDP port number used by Windows 1 TTPs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
SpySheriff.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion SpySheriff.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
SpySheriff.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Control Panel\International\Geo\Nation SpySheriff.exe -
Modifies system executable filetype association 2 TTPs 1 IoCs
Processes:
SpySheriff.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command SpySheriff.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
SpySheriff.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\SpySheriff = "C:\\Users\\Admin\\AppData\\Local\\Temp\\SpySheriff.exe" SpySheriff.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Processes:
SpySheriff.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA SpySheriff.exe -
Maps connected drives based on registry 3 TTPs 5 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
SpySheriff.exedescription ioc process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\NextInstance SpySheriff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum SpySheriff.exe Key value enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum SpySheriff.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 SpySheriff.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\Count SpySheriff.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 21 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
SpySheriff.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor SpySheriff.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz SpySheriff.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Identifier SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Configuration Data SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\VendorIdentifier SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\FeatureSet SpySheriff.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 SpySheriff.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor SpySheriff.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet SpySheriff.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Component Information SpySheriff.exe -
Enumerates system info in registry 2 TTPs 64 IoCs
Processes:
SpySheriff.exedescription ioc process Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses SpySheriff.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor SpySheriff.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0 SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\Configuration Data SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\Component Information SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\Configuration Data SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1\Component Information SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\0\Configuration Data SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\Component Information SpySheriff.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor SpySheriff.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0 SpySheriff.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0 SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0\Component Information SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Component Information SpySheriff.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral\0\Identifier SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2\Identifier SpySheriff.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses SpySheriff.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses SpySheriff.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\1 SpySheriff.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter SpySheriff.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController SpySheriff.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0 SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2\Component Information SpySheriff.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS SpySheriff.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController SpySheriff.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral SpySheriff.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses\PCIBus\0000 SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BootArchitecture SpySheriff.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\0 SpySheriff.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral SpySheriff.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0\Identifier SpySheriff.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2 SpySheriff.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2 SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\Identifier SpySheriff.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses\PCIBus SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\0\Component Information SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\1\Component Information SpySheriff.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController SpySheriff.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0\Configuration Data SpySheriff.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0 SpySheriff.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0 SpySheriff.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral\0\Configuration Data SpySheriff.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController SpySheriff.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0 SpySheriff.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses\PCIBus SpySheriff.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter SpySheriff.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1 SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1\Identifier SpySheriff.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses\PCIBus SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\1\Identifier SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\1\Configuration Data SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2\Configuration Data SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Configuration Data SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\Component Information SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\Configuration Data SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\0\Identifier SpySheriff.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\1 SpySheriff.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter SpySheriff.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral SpySheriff.exe -
Processes:
SpySheriff.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\SOFTWARE\Microsoft\Internet Explorer\Main SpySheriff.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\SOFTWARE\Microsoft\Internet Explorer\Search SpySheriff.exe -
Modifies registry class 5 IoCs
Processes:
SpySheriff.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile" SpySheriff.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{00C6D95F-329C-409a-81D7-C46C66EA7F33}\InprocServer32 SpySheriff.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command SpySheriff.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.key SpySheriff.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ SpySheriff.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
AUDIODG.EXEdescription pid process Token: 33 1468 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1468 AUDIODG.EXE Token: 33 1468 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1468 AUDIODG.EXE -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
SpySheriff.exepid process 1952 SpySheriff.exe 1952 SpySheriff.exe 1952 SpySheriff.exe 1952 SpySheriff.exe 1952 SpySheriff.exe 1952 SpySheriff.exe 1952 SpySheriff.exe 1952 SpySheriff.exe 1952 SpySheriff.exe 1952 SpySheriff.exe 1952 SpySheriff.exe 1952 SpySheriff.exe 1952 SpySheriff.exe 1952 SpySheriff.exe 1952 SpySheriff.exe 1952 SpySheriff.exe 1952 SpySheriff.exe 1952 SpySheriff.exe 1952 SpySheriff.exe 1952 SpySheriff.exe 1952 SpySheriff.exe 1952 SpySheriff.exe 1952 SpySheriff.exe 1952 SpySheriff.exe 1952 SpySheriff.exe 1952 SpySheriff.exe 1952 SpySheriff.exe 1952 SpySheriff.exe 1952 SpySheriff.exe 1952 SpySheriff.exe 1952 SpySheriff.exe 1952 SpySheriff.exe 1952 SpySheriff.exe 1952 SpySheriff.exe 1952 SpySheriff.exe 1952 SpySheriff.exe 1952 SpySheriff.exe 1952 SpySheriff.exe 1952 SpySheriff.exe 1952 SpySheriff.exe 1952 SpySheriff.exe 1952 SpySheriff.exe 1952 SpySheriff.exe 1952 SpySheriff.exe 1952 SpySheriff.exe 1952 SpySheriff.exe 1952 SpySheriff.exe 1952 SpySheriff.exe 1952 SpySheriff.exe 1952 SpySheriff.exe 1952 SpySheriff.exe 1952 SpySheriff.exe 1952 SpySheriff.exe 1952 SpySheriff.exe 1952 SpySheriff.exe 1952 SpySheriff.exe 1952 SpySheriff.exe 1952 SpySheriff.exe 1952 SpySheriff.exe 1952 SpySheriff.exe 1952 SpySheriff.exe 1952 SpySheriff.exe 1952 SpySheriff.exe 1952 SpySheriff.exe -
Suspicious use of SendNotifyMessage 64 IoCs
Processes:
SpySheriff.exepid process 1952 SpySheriff.exe 1952 SpySheriff.exe 1952 SpySheriff.exe 1952 SpySheriff.exe 1952 SpySheriff.exe 1952 SpySheriff.exe 1952 SpySheriff.exe 1952 SpySheriff.exe 1952 SpySheriff.exe 1952 SpySheriff.exe 1952 SpySheriff.exe 1952 SpySheriff.exe 1952 SpySheriff.exe 1952 SpySheriff.exe 1952 SpySheriff.exe 1952 SpySheriff.exe 1952 SpySheriff.exe 1952 SpySheriff.exe 1952 SpySheriff.exe 1952 SpySheriff.exe 1952 SpySheriff.exe 1952 SpySheriff.exe 1952 SpySheriff.exe 1952 SpySheriff.exe 1952 SpySheriff.exe 1952 SpySheriff.exe 1952 SpySheriff.exe 1952 SpySheriff.exe 1952 SpySheriff.exe 1952 SpySheriff.exe 1952 SpySheriff.exe 1952 SpySheriff.exe 1952 SpySheriff.exe 1952 SpySheriff.exe 1952 SpySheriff.exe 1952 SpySheriff.exe 1952 SpySheriff.exe 1952 SpySheriff.exe 1952 SpySheriff.exe 1952 SpySheriff.exe 1952 SpySheriff.exe 1952 SpySheriff.exe 1952 SpySheriff.exe 1952 SpySheriff.exe 1952 SpySheriff.exe 1952 SpySheriff.exe 1952 SpySheriff.exe 1952 SpySheriff.exe 1952 SpySheriff.exe 1952 SpySheriff.exe 1952 SpySheriff.exe 1952 SpySheriff.exe 1952 SpySheriff.exe 1952 SpySheriff.exe 1952 SpySheriff.exe 1952 SpySheriff.exe 1952 SpySheriff.exe 1952 SpySheriff.exe 1952 SpySheriff.exe 1952 SpySheriff.exe 1952 SpySheriff.exe 1952 SpySheriff.exe 1952 SpySheriff.exe 1952 SpySheriff.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\SpySheriff.exe"C:\Users\Admin\AppData\Local\Temp\SpySheriff.exe"1⤵
- Checks BIOS information in registry
- Checks computer location settings
- Modifies system executable filetype association
- Adds Run key to start application
- Checks whether UAC is enabled
- Maps connected drives based on registry
- Checks processor information in registry
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x55c1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Event Triggered Execution
1Change Default File Association
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Privilege Escalation
Event Triggered Execution
1Change Default File Association
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SpySheriff\SpySheriff.lnkFilesize
1KB
MD5a89c9ded5d45d47ee1f844d3d20865f6
SHA19f2a22f26a6739b5565e1e696a6fd488da958aca
SHA256d47c77d13586f2336c9b83fec7bb55f58a86e91bdf9c9a41f48b7dcdbde2bb44
SHA512754b3f6131d6c78d92272bea1a4bd7457a80b92ecd28f15b4611826640b638fbd75911c8fb43306b1dc97798ae89ece0250187595699a465c29db25b8ed4868b
-
memory/1952-9-0x00000000217A0000-0x00000000217C4000-memory.dmpFilesize
144KB
-
memory/1952-8-0x0000000020E20000-0x0000000020E43000-memory.dmpFilesize
140KB
-
memory/1952-7-0x000000001F820000-0x000000001F846000-memory.dmpFilesize
152KB
-
memory/1952-6-0x000000001E540000-0x000000001E568000-memory.dmpFilesize
160KB
-
memory/1952-5-0x0000000000400000-0x0000000001400000-memory.dmpFilesize
16.0MB
-
memory/1952-10-0x0000000000400000-0x0000000001400000-memory.dmpFilesize
16.0MB
-
memory/1952-14-0x00000000217A0000-0x00000000217C4000-memory.dmpFilesize
144KB
-
memory/1952-13-0x0000000020E20000-0x0000000020E43000-memory.dmpFilesize
140KB
-
memory/1952-12-0x000000001F820000-0x000000001F846000-memory.dmpFilesize
152KB
-
memory/1952-11-0x000000001E540000-0x000000001E568000-memory.dmpFilesize
160KB
-
memory/1952-21-0x0000000000400000-0x0000000001400000-memory.dmpFilesize
16.0MB
-
memory/1952-51-0x0000000000400000-0x0000000001400000-memory.dmpFilesize
16.0MB
-
memory/1952-61-0x0000000000400000-0x0000000001400000-memory.dmpFilesize
16.0MB
-
memory/1952-66-0x0000000000400000-0x0000000001400000-memory.dmpFilesize
16.0MB