Resubmissions
29/05/2024, 02:24
240529-cv1dbaeg8y 1029/05/2024, 02:23
240529-ct89tsff35 1029/05/2024, 02:22
240529-ctvrfaeg5s 1029/05/2024, 02:18
240529-crpseaef6s 1029/05/2024, 02:15
240529-cpnsbsfd57 1029/05/2024, 02:14
240529-cpgn1see6y 10Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
29/05/2024, 02:15
General
-
Target
fd8ff9de932932bf7264ba598c7ae899b9cea81f998e3eb5e9d9f18dc2b428b2.elf
-
Size
98KB
-
MD5
102e77b70024942c692b36b962e9803b
-
SHA1
8b2f2c397432ac5799a56e16e14d19f8dd428aad
-
SHA256
fd8ff9de932932bf7264ba598c7ae899b9cea81f998e3eb5e9d9f18dc2b428b2
-
SHA512
a232c523c59d020fec10303aa98b3ee04bac5bb49084fb8f0f6d5e226a62f5366742d00f58f8b905a20b9705cdd00bdf299e14004af400316ce8fc5be4a645f4
-
SSDEEP
3072:RucT7B75gVPUbcj6/k6Sdz3DqzUNa0jLmCP:Ruc3d5ujCSp3Oaa0jv
Malware Config
Signatures
-
Detected Echobot 1 IoCs
resource yara_rule behavioral1/files/0x0008000000023426-9.dat family_echobot -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Modifies Internet Explorer Phishing Filter 1 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Software\Microsoft\Internet Explorer\PhishingFilter iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Internet Explorer\PhishingFilter\ClientSupported_MigrationTime = 18cff2cd1098da01 iexplore.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{613034B0-1D61-11EF-B865-F25A6F8D7CFB} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Internet Explorer\RepId\PublicId = "{B004CEA1-5E7A-454B-BE76-EDE878744305}" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1112237341" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Key created \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "900049543" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31109486" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31109486" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31109486" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423713930" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Software\Microsoft\Internet Explorer\RepId iexplore.exe Key created \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "900205756" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe -
Modifies registry class 45 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\elf_auto_file\shell\open\command OpenWith.exe Set value (str) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\elf_auto_file\shell\open\CommandId = "IE.File" OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView = "4294967295" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\.elf\ = "elf_auto_file" OpenWith.exe Set value (data) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff iexplore.exe Key created \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags iexplore.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Downloads" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff iexplore.exe Key created \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\elf_auto_file\shell\open OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\.elf OpenWith.exe Set value (str) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\elf_auto_file\shell\open\command\ = "\"C:\\Program Files\\Internet Explorer\\iexplore.exe\" %1" OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259} iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\elf_auto_file\shell\open\command\DelegateExecute = "{17FE9752-0B5A-4665-84CD-569794602F5C}" OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616257" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\elf_auto_file\shell OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\Local Settings iexplore.exe Key created \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e8005398e082303024b98265d99428e115f0000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\Local Settings OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\elf_auto_file OpenWith.exe Set value (data) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\KnownFolderDerivedFolderType = "{885A186E-A440-4ADA-812B-DB871B942259}" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Mode = "4" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14" iexplore.exe -
Suspicious behavior: EnumeratesProcesses 58 IoCs
pid Process 4476 taskmgr.exe 4476 taskmgr.exe 4476 taskmgr.exe 4476 taskmgr.exe 4476 taskmgr.exe 4476 taskmgr.exe 4476 taskmgr.exe 4476 taskmgr.exe 4476 taskmgr.exe 4476 taskmgr.exe 4476 taskmgr.exe 4476 taskmgr.exe 4476 taskmgr.exe 4476 taskmgr.exe 4476 taskmgr.exe 4476 taskmgr.exe 4476 taskmgr.exe 4476 taskmgr.exe 4476 taskmgr.exe 4476 taskmgr.exe 4476 taskmgr.exe 4476 taskmgr.exe 4476 taskmgr.exe 4476 taskmgr.exe 4476 taskmgr.exe 4476 taskmgr.exe 4476 taskmgr.exe 4476 taskmgr.exe 4476 taskmgr.exe 4476 taskmgr.exe 4476 taskmgr.exe 4476 taskmgr.exe 4476 taskmgr.exe 4476 taskmgr.exe 4476 taskmgr.exe 4476 taskmgr.exe 4476 taskmgr.exe 4476 taskmgr.exe 4476 taskmgr.exe 4476 taskmgr.exe 4476 taskmgr.exe 4476 taskmgr.exe 4476 taskmgr.exe 4476 taskmgr.exe 4476 taskmgr.exe 4476 taskmgr.exe 4476 taskmgr.exe 4476 taskmgr.exe 4476 taskmgr.exe 4476 taskmgr.exe 4476 taskmgr.exe 4476 taskmgr.exe 4476 taskmgr.exe 4476 taskmgr.exe 4476 taskmgr.exe 4476 taskmgr.exe 4476 taskmgr.exe 4476 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 3604 OpenWith.exe 2580 iexplore.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 4476 taskmgr.exe Token: SeSystemProfilePrivilege 4476 taskmgr.exe Token: SeCreateGlobalPrivilege 4476 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2580 iexplore.exe 2580 iexplore.exe 2580 iexplore.exe 2580 iexplore.exe 2580 iexplore.exe 2580 iexplore.exe 2580 iexplore.exe 2580 iexplore.exe 2580 iexplore.exe 2580 iexplore.exe 2580 iexplore.exe 2580 iexplore.exe 2580 iexplore.exe 4476 taskmgr.exe 4476 taskmgr.exe 4476 taskmgr.exe 4476 taskmgr.exe 4476 taskmgr.exe 4476 taskmgr.exe 4476 taskmgr.exe 4476 taskmgr.exe 4476 taskmgr.exe 4476 taskmgr.exe 4476 taskmgr.exe 4476 taskmgr.exe 4476 taskmgr.exe 4476 taskmgr.exe 4476 taskmgr.exe 4476 taskmgr.exe 4476 taskmgr.exe 4476 taskmgr.exe 4476 taskmgr.exe 4476 taskmgr.exe 4476 taskmgr.exe 4476 taskmgr.exe 4476 taskmgr.exe 4476 taskmgr.exe 4476 taskmgr.exe 4476 taskmgr.exe 4476 taskmgr.exe 4476 taskmgr.exe 4476 taskmgr.exe 4476 taskmgr.exe 4476 taskmgr.exe 4476 taskmgr.exe 2580 iexplore.exe 4476 taskmgr.exe 4476 taskmgr.exe 4476 taskmgr.exe 4476 taskmgr.exe 4476 taskmgr.exe 4476 taskmgr.exe 4476 taskmgr.exe 4476 taskmgr.exe 4476 taskmgr.exe 4476 taskmgr.exe 4476 taskmgr.exe 4476 taskmgr.exe 4476 taskmgr.exe 4476 taskmgr.exe 4476 taskmgr.exe 4476 taskmgr.exe 4476 taskmgr.exe 4476 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 4476 taskmgr.exe 4476 taskmgr.exe 4476 taskmgr.exe 4476 taskmgr.exe 4476 taskmgr.exe 4476 taskmgr.exe 4476 taskmgr.exe 4476 taskmgr.exe 4476 taskmgr.exe 4476 taskmgr.exe 4476 taskmgr.exe 4476 taskmgr.exe 4476 taskmgr.exe 4476 taskmgr.exe 4476 taskmgr.exe 4476 taskmgr.exe 4476 taskmgr.exe 4476 taskmgr.exe 4476 taskmgr.exe 4476 taskmgr.exe 4476 taskmgr.exe 4476 taskmgr.exe 4476 taskmgr.exe 4476 taskmgr.exe 4476 taskmgr.exe 4476 taskmgr.exe 4476 taskmgr.exe 4476 taskmgr.exe 4476 taskmgr.exe 4476 taskmgr.exe 4476 taskmgr.exe 4476 taskmgr.exe 4476 taskmgr.exe 4476 taskmgr.exe 4476 taskmgr.exe 4476 taskmgr.exe 4476 taskmgr.exe 4476 taskmgr.exe 4476 taskmgr.exe 4476 taskmgr.exe 4476 taskmgr.exe 4476 taskmgr.exe 4476 taskmgr.exe 4476 taskmgr.exe 4476 taskmgr.exe 4476 taskmgr.exe 4476 taskmgr.exe 4476 taskmgr.exe 4476 taskmgr.exe 4476 taskmgr.exe 4476 taskmgr.exe 4476 taskmgr.exe 4476 taskmgr.exe 4476 taskmgr.exe 4476 taskmgr.exe 4476 taskmgr.exe 4476 taskmgr.exe 4476 taskmgr.exe 4476 taskmgr.exe 4476 taskmgr.exe 4476 taskmgr.exe 4476 taskmgr.exe 4476 taskmgr.exe 4476 taskmgr.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 3604 OpenWith.exe 3604 OpenWith.exe 3604 OpenWith.exe 3604 OpenWith.exe 3604 OpenWith.exe 3604 OpenWith.exe 3604 OpenWith.exe 3604 OpenWith.exe 3604 OpenWith.exe 3604 OpenWith.exe 3604 OpenWith.exe 3604 OpenWith.exe 3604 OpenWith.exe 3604 OpenWith.exe 3604 OpenWith.exe 3604 OpenWith.exe 3604 OpenWith.exe 3604 OpenWith.exe 3604 OpenWith.exe 3604 OpenWith.exe 3604 OpenWith.exe 3604 OpenWith.exe 3604 OpenWith.exe 3604 OpenWith.exe 3604 OpenWith.exe 3604 OpenWith.exe 3604 OpenWith.exe 3604 OpenWith.exe 3604 OpenWith.exe 3604 OpenWith.exe 3604 OpenWith.exe 3604 OpenWith.exe 3604 OpenWith.exe 3604 OpenWith.exe 3604 OpenWith.exe 3604 OpenWith.exe 3604 OpenWith.exe 3604 OpenWith.exe 3604 OpenWith.exe 3604 OpenWith.exe 3604 OpenWith.exe 2580 iexplore.exe 2580 iexplore.exe 3336 IEXPLORE.EXE 3336 IEXPLORE.EXE 2580 iexplore.exe 2580 iexplore.exe 2032 IEXPLORE.EXE 2032 IEXPLORE.EXE 2580 iexplore.exe 2580 iexplore.exe 2580 iexplore.exe 2580 iexplore.exe 2580 iexplore.exe 2580 iexplore.exe 2580 iexplore.exe 2580 iexplore.exe 2580 iexplore.exe 2580 iexplore.exe 2580 iexplore.exe 2580 iexplore.exe 2580 iexplore.exe 2580 iexplore.exe 2580 iexplore.exe -
Suspicious use of WriteProcessMemory 31 IoCs
description pid Process procid_target PID 3604 wrote to memory of 2580 3604 OpenWith.exe 94 PID 3604 wrote to memory of 2580 3604 OpenWith.exe 94 PID 2580 wrote to memory of 3336 2580 iexplore.exe 96 PID 2580 wrote to memory of 3336 2580 iexplore.exe 96 PID 2580 wrote to memory of 3336 2580 iexplore.exe 96 PID 2580 wrote to memory of 2372 2580 iexplore.exe 99 PID 2580 wrote to memory of 2372 2580 iexplore.exe 99 PID 2580 wrote to memory of 2032 2580 iexplore.exe 100 PID 2580 wrote to memory of 2032 2580 iexplore.exe 100 PID 2580 wrote to memory of 2032 2580 iexplore.exe 100 PID 2580 wrote to memory of 888 2580 iexplore.exe 101 PID 2580 wrote to memory of 888 2580 iexplore.exe 101 PID 2580 wrote to memory of 4960 2580 iexplore.exe 102 PID 2580 wrote to memory of 4960 2580 iexplore.exe 102 PID 2580 wrote to memory of 4960 2580 iexplore.exe 102 PID 2580 wrote to memory of 1152 2580 iexplore.exe 103 PID 2580 wrote to memory of 1152 2580 iexplore.exe 103 PID 2580 wrote to memory of 2424 2580 iexplore.exe 104 PID 2580 wrote to memory of 2424 2580 iexplore.exe 104 PID 2580 wrote to memory of 2184 2580 iexplore.exe 105 PID 2580 wrote to memory of 2184 2580 iexplore.exe 105 PID 2580 wrote to memory of 1652 2580 iexplore.exe 106 PID 2580 wrote to memory of 1652 2580 iexplore.exe 106 PID 2580 wrote to memory of 1280 2580 iexplore.exe 107 PID 2580 wrote to memory of 1280 2580 iexplore.exe 107 PID 2580 wrote to memory of 4312 2580 iexplore.exe 108 PID 2580 wrote to memory of 4312 2580 iexplore.exe 108 PID 2580 wrote to memory of 3604 2580 iexplore.exe 109 PID 2580 wrote to memory of 3604 2580 iexplore.exe 109 PID 2580 wrote to memory of 3772 2580 iexplore.exe 116 PID 2580 wrote to memory of 3772 2580 iexplore.exe 116 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\fd8ff9de932932bf7264ba598c7ae899b9cea81f998e3eb5e9d9f18dc2b428b2.elf1⤵
- Modifies registry class
PID:4600
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3604 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\fd8ff9de932932bf7264ba598c7ae899b9cea81f998e3eb5e9d9f18dc2b428b2.elf2⤵
- Modifies Internet Explorer Phishing Filter
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2580 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2580 CREDAT:17410 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3336
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\fd8ff9de932932bf7264ba598c7ae899b9cea81f998e3eb5e9d9f18dc2b428b2.elf3⤵
- Modifies Internet Explorer settings
PID:2372
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2580 CREDAT:82948 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2032
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Downloads\fd8ff9de932932bf7264ba598c7ae899b9cea81f998e3eb5e9d9f18dc2b428b2.elf3⤵
- Modifies Internet Explorer settings
PID:888
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2580 CREDAT:17422 /prefetch:23⤵
- Modifies Internet Explorer settings
PID:4960
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Downloads\fd8ff9de932932bf7264ba598c7ae899b9cea81f998e3eb5e9d9f18dc2b428b2.elf3⤵
- Modifies Internet Explorer settings
PID:1152
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Downloads\fd8ff9de932932bf7264ba598c7ae899b9cea81f998e3eb5e9d9f18dc2b428b2.elf3⤵
- Modifies Internet Explorer settings
PID:2424
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Downloads\fd8ff9de932932bf7264ba598c7ae899b9cea81f998e3eb5e9d9f18dc2b428b2.elf3⤵
- Modifies Internet Explorer settings
PID:2184
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Downloads\fd8ff9de932932bf7264ba598c7ae899b9cea81f998e3eb5e9d9f18dc2b428b2.elf3⤵
- Modifies Internet Explorer settings
PID:1652
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Downloads\fd8ff9de932932bf7264ba598c7ae899b9cea81f998e3eb5e9d9f18dc2b428b2.elf3⤵
- Modifies Internet Explorer settings
PID:1280
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Downloads\fd8ff9de932932bf7264ba598c7ae899b9cea81f998e3eb5e9d9f18dc2b428b2.elf3⤵
- Modifies Internet Explorer settings
PID:4312
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Downloads\fd8ff9de932932bf7264ba598c7ae899b9cea81f998e3eb5e9d9f18dc2b428b2.elf3⤵
- Modifies Internet Explorer settings
PID:3604
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Downloads\fd8ff9de932932bf7264ba598c7ae899b9cea81f998e3eb5e9d9f18dc2b428b2.elf3⤵
- Modifies Internet Explorer settings
PID:3772
-
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /71⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4476
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
-
Filesize
16KB
MD5fcc8ffdb4e1eeed4e60dd320b94461dc
SHA183b2f398a763e004fde0cc67e9d148e8f829241d
SHA25628ee3d89a2a6a6bbf08fbed3c7145c62a1df65a6d9448517e790ef616f00c0b7
SHA5120118246331c6ad37e8437d50a88998e5df60a6ebae8b8cdd5fd4a43183f4102cd438cf98ac0e9fd182b88325d1dab954e6e9eae68fd0333cf86ad5a02d5765cc
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\28c8b86deab549a1.customDestinations-ms
Filesize3KB
MD5ceb4fd131ecad542ea8f3270ef86f451
SHA1623e6d1e9d1698b9cef6edc453ec56ab30a20a54
SHA2562caba0d56335361ecc931ebd32c4dce7a43b84515e24000bedd5cd5970ea4f28
SHA512389843744dcbdbf2afc9376cf291ca27325efe1b3b24ea0d202540c6f5b6874f06f360e0df3e9e8477a21ce7d25e3d43d9e3558e6b426ca969890aa679ab67be
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\28c8b86deab549a1.customDestinations-ms
Filesize3KB
MD5bb54f78c683dd2d7925a0c4d564e690b
SHA1c0e886946073a51bd47ee69207a4e7df5c80d3c5
SHA2566457a1fc1f1e7a48bc32abad5f17404513023754b3af519582670d3d464dc464
SHA512ebd02551e8365e69ed000de5351207fec2c018b3b4819187e99e692b9d742adac8db3567e6e0f1340bb7502ce0191963728e7d4599bb4f6e14cac9778d6bca54
-
Filesize
98KB
MD5102e77b70024942c692b36b962e9803b
SHA18b2f2c397432ac5799a56e16e14d19f8dd428aad
SHA256fd8ff9de932932bf7264ba598c7ae899b9cea81f998e3eb5e9d9f18dc2b428b2
SHA512a232c523c59d020fec10303aa98b3ee04bac5bb49084fb8f0f6d5e226a62f5366742d00f58f8b905a20b9705cdd00bdf299e14004af400316ce8fc5be4a645f4