6a12985870ef12f2468d40d260e5b7da5e84f51368a8b55aad79022fcd4f4217

Analysis

max time kernel
152s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
07/06/2024, 02:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9949c5620de261099f10a01f9e8039ad.exe
Size 6.8MB
Sample240607-cnajbaha88
SHA256 6a12985870ef12f2468d40d260e5b7da5e84f51368a8b55aad79022fcd4f4217
MD5 9949c5620de261099f10a01f9e8039ad
SHA1 32ba3db4ed0f1d27484d6b6b75a58caae42f858e
SHA512 6e9c2705406da8a6ff52ce8ae8a79f290c1fde5827d2e161cbc927423c8aa3c353b7202aeccd00a6a68ab71635cc41c64a118dac66194352af7b39670806822b
SSDEEP 196608:N7effIPEsy58doQaTzwZ8Jq3QKnqVtxQw818dmXEQl1llLmiwlyif8cHQlk8nP+P:N7effIPEsy58doQaTzwZ8Jq3QKnqVtx/
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

adware persistence stealer upx

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe"	9949c5620de261099f10a01f9e8039ad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,"	9949c5620de261099f10a01f9e8039ad.exe

Drops file in Drivers directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\drivers\spools.exe	9949c5620de261099f10a01f9e8039ad.exe
File opened for modification	C:\Windows\SysWOW64\drivers\spools.exe	9949c5620de261099f10a01f9e8039ad.exe
File opened for modification	C:\Windows\SysWOW64\drivers\spools.exe	9949c5620de261099f10a01f9e8039ad.exe
File opened for modification	C:\Windows\SysWOW64\drivers\spools.exe	9949c5620de261099f10a01f9e8039ad.exe

Sets service image path in registry 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Schedule\ImagePath = "C:\\Windows\\system32\\drivers\\spools.exe"	9949c5620de261099f10a01f9e8039ad.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Schedule\ImagePath = "C:\\Windows\\system32\\drivers\\spools.exe"	9949c5620de261099f10a01f9e8039ad.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Schedule\ImagePath = "C:\\Windows\\system32\\drivers\\spools.exe"	9949c5620de261099f10a01f9e8039ad.exe

ACProtect 1.3x - 1.4x DLL software 6 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x0007000000023253-9.dat	acprotect
behavioral2/memory/112-12-0x0000000010000000-0x000000001010B000-memory.dmp	acprotect
behavioral2/memory/112-14-0x0000000010000000-0x000000001010B000-memory.dmp	acprotect
behavioral2/memory/2760-27-0x0000000010000000-0x000000001010B000-memory.dmp	acprotect
behavioral2/memory/2760-30-0x0000000010000000-0x000000001010B000-memory.dmp	acprotect
behavioral2/memory/3508-43-0x0000000010000000-0x000000001010B000-memory.dmp	acprotect

Loads dropped DLL 3 IoCs

pid	Process
112	9949c5620de261099f10a01f9e8039ad.exe
2760	9949c5620de261099f10a01f9e8039ad.exe
3508	9949c5620de261099f10a01f9e8039ad.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x0007000000023253-9.dat	upx
behavioral2/memory/112-12-0x0000000010000000-0x000000001010B000-memory.dmp	upx
behavioral2/memory/112-14-0x0000000010000000-0x000000001010B000-memory.dmp	upx
behavioral2/memory/2760-27-0x0000000010000000-0x000000001010B000-memory.dmp	upx
behavioral2/memory/2760-30-0x0000000010000000-0x000000001010B000-memory.dmp	upx
behavioral2/memory/3508-43-0x0000000010000000-0x000000001010B000-memory.dmp	upx

Adds Run key to start application 2 TTPs 12 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\autoload = "C:\\Users\\Admin\\Local Settings\\Application Data\\cftmon.exe"	9949c5620de261099f10a01f9e8039ad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ntuser = "C:\\Windows\\system32\\drivers\\spools.exe"	9949c5620de261099f10a01f9e8039ad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ntuser = "C:\\Windows\\system32\\drivers\\spools.exe"	9949c5620de261099f10a01f9e8039ad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\autoload = "C:\\Users\\Admin\\Local Settings\\Application Data\\cftmon.exe"	9949c5620de261099f10a01f9e8039ad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ntuser = "C:\\Windows\\system32\\drivers\\spools.exe"	9949c5620de261099f10a01f9e8039ad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\autoload = "C:\\Users\\Admin\\Local Settings\\Application Data\\cftmon.exe"	9949c5620de261099f10a01f9e8039ad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ntuser = "C:\\Windows\\system32\\drivers\\spools.exe"	9949c5620de261099f10a01f9e8039ad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\autoload = "C:\\Users\\Admin\\Local Settings\\Application Data\\cftmon.exe"	9949c5620de261099f10a01f9e8039ad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\autoload = "C:\\Users\\Admin\\Local Settings\\Application Data\\cftmon.exe"	9949c5620de261099f10a01f9e8039ad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\autoload = "C:\\Users\\Admin\\Local Settings\\Application Data\\cftmon.exe"	9949c5620de261099f10a01f9e8039ad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ntuser = "C:\\Windows\\system32\\drivers\\spools.exe"	9949c5620de261099f10a01f9e8039ad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ntuser = "C:\\Windows\\system32\\drivers\\spools.exe"	9949c5620de261099f10a01f9e8039ad.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\V:	9949c5620de261099f10a01f9e8039ad.exe
File opened (read-only)	\??\J:	9949c5620de261099f10a01f9e8039ad.exe
File opened (read-only)	\??\V:	9949c5620de261099f10a01f9e8039ad.exe
File opened (read-only)	\??\Q:	9949c5620de261099f10a01f9e8039ad.exe
File opened (read-only)	\??\Q:	9949c5620de261099f10a01f9e8039ad.exe
File opened (read-only)	\??\Q:	9949c5620de261099f10a01f9e8039ad.exe
File opened (read-only)	\??\N:	9949c5620de261099f10a01f9e8039ad.exe
File opened (read-only)	\??\O:	9949c5620de261099f10a01f9e8039ad.exe
File opened (read-only)	\??\H:	9949c5620de261099f10a01f9e8039ad.exe
File opened (read-only)	\??\L:	9949c5620de261099f10a01f9e8039ad.exe
File opened (read-only)	\??\N:	9949c5620de261099f10a01f9e8039ad.exe
File opened (read-only)	\??\S:	9949c5620de261099f10a01f9e8039ad.exe
File opened (read-only)	\??\E:	9949c5620de261099f10a01f9e8039ad.exe
File opened (read-only)	\??\G:	9949c5620de261099f10a01f9e8039ad.exe
File opened (read-only)	\??\X:	9949c5620de261099f10a01f9e8039ad.exe
File opened (read-only)	\??\G:	9949c5620de261099f10a01f9e8039ad.exe
File opened (read-only)	\??\J:	9949c5620de261099f10a01f9e8039ad.exe
File opened (read-only)	\??\T:	9949c5620de261099f10a01f9e8039ad.exe
File opened (read-only)	\??\N:	9949c5620de261099f10a01f9e8039ad.exe
File opened (read-only)	\??\G:	9949c5620de261099f10a01f9e8039ad.exe
File opened (read-only)	\??\T:	9949c5620de261099f10a01f9e8039ad.exe
File opened (read-only)	\??\E:	9949c5620de261099f10a01f9e8039ad.exe
File opened (read-only)	\??\L:	9949c5620de261099f10a01f9e8039ad.exe
File opened (read-only)	\??\N:	9949c5620de261099f10a01f9e8039ad.exe
File opened (read-only)	\??\M:	9949c5620de261099f10a01f9e8039ad.exe
File opened (read-only)	\??\H:	9949c5620de261099f10a01f9e8039ad.exe
File opened (read-only)	\??\S:	9949c5620de261099f10a01f9e8039ad.exe
File opened (read-only)	\??\K:	9949c5620de261099f10a01f9e8039ad.exe
File opened (read-only)	\??\K:	9949c5620de261099f10a01f9e8039ad.exe
File opened (read-only)	\??\O:	9949c5620de261099f10a01f9e8039ad.exe
File opened (read-only)	\??\Q:	9949c5620de261099f10a01f9e8039ad.exe
File opened (read-only)	\??\R:	9949c5620de261099f10a01f9e8039ad.exe
File opened (read-only)	\??\E:	9949c5620de261099f10a01f9e8039ad.exe
File opened (read-only)	\??\G:	9949c5620de261099f10a01f9e8039ad.exe
File opened (read-only)	\??\S:	9949c5620de261099f10a01f9e8039ad.exe
File opened (read-only)	\??\I:	9949c5620de261099f10a01f9e8039ad.exe
File opened (read-only)	\??\Q:	9949c5620de261099f10a01f9e8039ad.exe
File opened (read-only)	\??\R:	9949c5620de261099f10a01f9e8039ad.exe
File opened (read-only)	\??\K:	9949c5620de261099f10a01f9e8039ad.exe
File opened (read-only)	\??\K:	9949c5620de261099f10a01f9e8039ad.exe
File opened (read-only)	\??\P:	9949c5620de261099f10a01f9e8039ad.exe
File opened (read-only)	\??\H:	9949c5620de261099f10a01f9e8039ad.exe
File opened (read-only)	\??\X:	9949c5620de261099f10a01f9e8039ad.exe
File opened (read-only)	\??\W:	9949c5620de261099f10a01f9e8039ad.exe
File opened (read-only)	\??\V:	9949c5620de261099f10a01f9e8039ad.exe
File opened (read-only)	\??\S:	9949c5620de261099f10a01f9e8039ad.exe
File opened (read-only)	\??\J:	9949c5620de261099f10a01f9e8039ad.exe
File opened (read-only)	\??\P:	9949c5620de261099f10a01f9e8039ad.exe
File opened (read-only)	\??\R:	9949c5620de261099f10a01f9e8039ad.exe
File opened (read-only)	\??\U:	9949c5620de261099f10a01f9e8039ad.exe
File opened (read-only)	\??\U:	9949c5620de261099f10a01f9e8039ad.exe
File opened (read-only)	\??\W:	9949c5620de261099f10a01f9e8039ad.exe
File opened (read-only)	\??\O:	9949c5620de261099f10a01f9e8039ad.exe
File opened (read-only)	\??\V:	9949c5620de261099f10a01f9e8039ad.exe
File opened (read-only)	\??\W:	9949c5620de261099f10a01f9e8039ad.exe
File opened (read-only)	\??\V:	9949c5620de261099f10a01f9e8039ad.exe
File opened (read-only)	\??\E:	9949c5620de261099f10a01f9e8039ad.exe
File opened (read-only)	\??\E:	9949c5620de261099f10a01f9e8039ad.exe
File opened (read-only)	\??\P:	9949c5620de261099f10a01f9e8039ad.exe
File opened (read-only)	\??\Q:	9949c5620de261099f10a01f9e8039ad.exe
File opened (read-only)	\??\J:	9949c5620de261099f10a01f9e8039ad.exe
File opened (read-only)	\??\K:	9949c5620de261099f10a01f9e8039ad.exe
File opened (read-only)	\??\W:	9949c5620de261099f10a01f9e8039ad.exe
File opened (read-only)	\??\U:	9949c5620de261099f10a01f9e8039ad.exe

Installs/modifies Browser Helper Object 2 TTPs 3 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}	reg.exe

Modifies WinLogon 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\UIHost = "logonui.exe"	9949c5620de261099f10a01f9e8039ad.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\ftpdll.dll	9949c5620de261099f10a01f9e8039ad.exe
File opened for modification	C:\Windows\SysWOW64\ftpdll.dll	9949c5620de261099f10a01f9e8039ad.exe
File opened for modification	C:\Windows\SysWOW64\ftpdll.dll	9949c5620de261099f10a01f9e8039ad.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3332	2760	WerFault.exe	98

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
112	9949c5620de261099f10a01f9e8039ad.exe
112	9949c5620de261099f10a01f9e8039ad.exe
112	9949c5620de261099f10a01f9e8039ad.exe
112	9949c5620de261099f10a01f9e8039ad.exe
112	9949c5620de261099f10a01f9e8039ad.exe
112	9949c5620de261099f10a01f9e8039ad.exe
112	9949c5620de261099f10a01f9e8039ad.exe
112	9949c5620de261099f10a01f9e8039ad.exe
112	9949c5620de261099f10a01f9e8039ad.exe
112	9949c5620de261099f10a01f9e8039ad.exe
112	9949c5620de261099f10a01f9e8039ad.exe
112	9949c5620de261099f10a01f9e8039ad.exe
112	9949c5620de261099f10a01f9e8039ad.exe
112	9949c5620de261099f10a01f9e8039ad.exe
112	9949c5620de261099f10a01f9e8039ad.exe
112	9949c5620de261099f10a01f9e8039ad.exe
112	9949c5620de261099f10a01f9e8039ad.exe
112	9949c5620de261099f10a01f9e8039ad.exe
112	9949c5620de261099f10a01f9e8039ad.exe
112	9949c5620de261099f10a01f9e8039ad.exe
112	9949c5620de261099f10a01f9e8039ad.exe
112	9949c5620de261099f10a01f9e8039ad.exe
112	9949c5620de261099f10a01f9e8039ad.exe
112	9949c5620de261099f10a01f9e8039ad.exe
112	9949c5620de261099f10a01f9e8039ad.exe
112	9949c5620de261099f10a01f9e8039ad.exe
112	9949c5620de261099f10a01f9e8039ad.exe
112	9949c5620de261099f10a01f9e8039ad.exe
112	9949c5620de261099f10a01f9e8039ad.exe
112	9949c5620de261099f10a01f9e8039ad.exe
112	9949c5620de261099f10a01f9e8039ad.exe
112	9949c5620de261099f10a01f9e8039ad.exe
112	9949c5620de261099f10a01f9e8039ad.exe
112	9949c5620de261099f10a01f9e8039ad.exe
112	9949c5620de261099f10a01f9e8039ad.exe
112	9949c5620de261099f10a01f9e8039ad.exe
112	9949c5620de261099f10a01f9e8039ad.exe
112	9949c5620de261099f10a01f9e8039ad.exe
112	9949c5620de261099f10a01f9e8039ad.exe
112	9949c5620de261099f10a01f9e8039ad.exe
4128	9949c5620de261099f10a01f9e8039ad.exe
4128	9949c5620de261099f10a01f9e8039ad.exe
112	9949c5620de261099f10a01f9e8039ad.exe
112	9949c5620de261099f10a01f9e8039ad.exe
112	9949c5620de261099f10a01f9e8039ad.exe
112	9949c5620de261099f10a01f9e8039ad.exe
112	9949c5620de261099f10a01f9e8039ad.exe
112	9949c5620de261099f10a01f9e8039ad.exe
112	9949c5620de261099f10a01f9e8039ad.exe
112	9949c5620de261099f10a01f9e8039ad.exe
112	9949c5620de261099f10a01f9e8039ad.exe
112	9949c5620de261099f10a01f9e8039ad.exe
112	9949c5620de261099f10a01f9e8039ad.exe
112	9949c5620de261099f10a01f9e8039ad.exe
112	9949c5620de261099f10a01f9e8039ad.exe
112	9949c5620de261099f10a01f9e8039ad.exe
112	9949c5620de261099f10a01f9e8039ad.exe
112	9949c5620de261099f10a01f9e8039ad.exe
112	9949c5620de261099f10a01f9e8039ad.exe
112	9949c5620de261099f10a01f9e8039ad.exe
112	9949c5620de261099f10a01f9e8039ad.exe
112	9949c5620de261099f10a01f9e8039ad.exe
112	9949c5620de261099f10a01f9e8039ad.exe
112	9949c5620de261099f10a01f9e8039ad.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
112	9949c5620de261099f10a01f9e8039ad.exe
2760	9949c5620de261099f10a01f9e8039ad.exe
3508	9949c5620de261099f10a01f9e8039ad.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 112 wrote to memory of 4128	112	9949c5620de261099f10a01f9e8039ad.exe	93
PID 112 wrote to memory of 4128	112	9949c5620de261099f10a01f9e8039ad.exe	93
PID 112 wrote to memory of 4128	112	9949c5620de261099f10a01f9e8039ad.exe	93
PID 112 wrote to memory of 3120	112	9949c5620de261099f10a01f9e8039ad.exe	95
PID 112 wrote to memory of 3120	112	9949c5620de261099f10a01f9e8039ad.exe	95
PID 112 wrote to memory of 3120	112	9949c5620de261099f10a01f9e8039ad.exe	95
PID 112 wrote to memory of 4028	112	9949c5620de261099f10a01f9e8039ad.exe	96
PID 112 wrote to memory of 4028	112	9949c5620de261099f10a01f9e8039ad.exe	96
PID 112 wrote to memory of 4028	112	9949c5620de261099f10a01f9e8039ad.exe	96
PID 4128 wrote to memory of 2760	4128	9949c5620de261099f10a01f9e8039ad.exe	98
PID 4128 wrote to memory of 2760	4128	9949c5620de261099f10a01f9e8039ad.exe	98
PID 4128 wrote to memory of 2760	4128	9949c5620de261099f10a01f9e8039ad.exe	98
PID 4028 wrote to memory of 3348	4028	9949c5620de261099f10a01f9e8039ad.exe	103
PID 4028 wrote to memory of 3348	4028	9949c5620de261099f10a01f9e8039ad.exe	103
PID 4028 wrote to memory of 3348	4028	9949c5620de261099f10a01f9e8039ad.exe	103
PID 4128 wrote to memory of 3508	4128	9949c5620de261099f10a01f9e8039ad.exe	105
PID 4128 wrote to memory of 3508	4128	9949c5620de261099f10a01f9e8039ad.exe	105
PID 4128 wrote to memory of 3508	4128	9949c5620de261099f10a01f9e8039ad.exe	105

C:\Users\Admin\AppData\Local\Temp\9949c5620de261099f10a01f9e8039ad.exe
"C:\Users\Admin\AppData\Local\Temp\9949c5620de261099f10a01f9e8039ad.exe"
1⤵
- Modifies WinLogon for persistence
- Drops file in Drivers directory
- Sets service image path in registry
- Loads dropped DLL
- Adds Run key to start application
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:112
- C:\Users\Admin\AppData\Local\Temp\9949c5620de261099f10a01f9e8039ad.exe
  C:\Users\Admin\AppData\Local\Temp\9949c5620de261099f10a01f9e8039ad.exe
  2⤵
  - Enumerates connected drives
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4128
- - C:\Users\Admin\AppData\Local\Temp\9949c5620de261099f10a01f9e8039ad.exe
    C:\Users\Admin\AppData\Local\Temp\9949c5620de261099f10a01f9e8039ad.exe
    3⤵
    - Drops file in Drivers directory
    - Sets service image path in registry
    - Loads dropped DLL
    - Adds Run key to start application
    - Enumerates connected drives
    - Drops file in System32 directory
    - Suspicious use of SetWindowsHookEx
    PID:2760
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2760 -s 1788
      4⤵
      Program crash
      PID:3332
- - C:\Users\Admin\AppData\Local\Temp\9949c5620de261099f10a01f9e8039ad.exe
    C:\Users\Admin\AppData\Local\Temp\9949c5620de261099f10a01f9e8039ad.exe
    3⤵
    - Drops file in Drivers directory
    - Sets service image path in registry
    - Loads dropped DLL
    - Adds Run key to start application
    - Enumerates connected drives
    - Drops file in System32 directory
    - Suspicious use of SetWindowsHookEx
    PID:3508
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects" /f
  2⤵
  - Installs/modifies Browser Helper Object
  PID:3120
- C:\Users\Admin\AppData\Local\Temp\9949c5620de261099f10a01f9e8039ad.exe
  C:\Users\Admin\AppData\Local\Temp\9949c5620de261099f10a01f9e8039ad.exe
  2⤵
  - Enumerates connected drives
  - Suspicious use of WriteProcessMemory
  PID:4028
- - C:\Users\Admin\AppData\Local\Temp\9949c5620de261099f10a01f9e8039ad.exe
    C:\Users\Admin\AppData\Local\Temp\9949c5620de261099f10a01f9e8039ad.exe
    3⤵
    - Enumerates connected drives
    PID:3348

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2760 -ip 2760
1⤵
PID:3396

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4092 --field-trial-handle=2276,i,11674642242468042059,14711253743544118298,262144 --variations-seed-version /prefetch:8
1⤵
PID:1884

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Browser Extensions

T1176

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
Size 1KB
SHA256 1ef2e5e560e26c438b8ab801ff5dee6b5acaeb8d8b66c5a0fb3fe75b0124cf8f
MD5 6ca16ec94429226823393b805facbc1b
SHA1 963a9fa166605dcc2ce0d0ef15acc414a633a14e
SHA512 e560bc883d068b48ebba63a616c8d0bdd9ccefa694d75b6bf14312752d56c59a12a2f3bec9eb984ef1a0093cbf30bfb8d35097030b02659cb7b2ab727720fdc1
MD5 SHA1 SHA512

Submit Download

24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
Size 410B
SHA256 1d89c56da20b8ef9dd2e2719769a411cdd97e9c007a230edde2a1354f4ae75e9
MD5 9254c23b915465458a076603dbd8d40a
SHA1 398a73e5898dfbd1989cf90cae526ee771dcbf55
SHA512 1bba9d497dd4b3ff30b620042b411e2e0f6336c35503fea98e68c633eee9cdcf3a5a6e99936b1852c55d5e561521b69b07b05c36b24fb76c754f9ff6da412c98
MD5 SHA1 SHA512

Submit Download

cftmon.exe

Path C:\Users\Admin\AppData\Local\cftmon.exe
Size 6.8MB
SHA256 f5ae1c58f678cad4cc34f71be19c9e918390e3add04080611f0036f37f294d1f
MD5 8970445138cfce98e42fc541010fb0da
SHA1 8e9a07393daf5ca5306d8d11bd8ffec2279158c2
SHA512 db4a9dffaab42a38aa94aae696ce0723740a4e68b5bf2019fb2f15804caf3a577561fd7ca0bf54c9ee0ad07055a865c2bcc1ed45c359db9348886471f33135c1
SSDEEP 196608:N7effIPEsy58doQaTzwZ8Jq3QKnqVtxQw818dmXEQl1llLmiwlyif8cHQlk8nP+H:N7effIPEsy58doQaTzwZ8Jq3QKnqVtx3
MD5 SHA1 SHA512 SSDEEP

Submit Download

spools.exe

Path C:\Windows\SysWOW64\drivers\spools.exe
Size 6.8MB
SHA256 d67d2a98da598d33519def6612f594cadcc9afa57137519192cf5f7a5d468831
MD5 3dfeecb1e0a3d212dc9c2fea9af2f44f
SHA1 6c45605eae6f4bf87540e0afcb59d84917c736ee
SHA512 fa97ac4fc8ddcee5002f8174ad7f25085aa56b608d16c9e5e9bee59ddebcc264570482dcc077a19e9dafd61bdb9ffec4a0e1fa618b7cf7c8f9cdf6d0f27e6002
SSDEEP 196608:N7effIPEsy58doQaTzwZ8Jq3QKnqVtxQw818dmXEQl1llLmiwlyif8cHQlk8nP+g:N7effIPEsy58doQaTzwZ8Jq3QKnqVtxQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

ftpdll.dll

Path C:\Windows\SysWOW64\ftpdll.dll
Size 5KB
SHA256 eddf092d901afe128322910c3ff41a3f242d33d6b4cdf91ece327076b324ccbb
MD5 d807aa04480d1d149f7a4cac22984188
SHA1 ffd5be65fd10017e34c11cecd105ebf4aa6c0cd9
SHA512 875543583c20ab164f37a4fb2587d234ce0a15d649d22b0d1dae5933f0a7683db170578746ea4458c51fec26e2243c6ec00dc10db8d4289789e50d5800cf863e
SSDEEP 48:SUKBtiM6VLLJRT4fi+z/JH5eGES4e8d+q2fShltiINGRKu6+BYhAf7kZydxS7Nbo:CJkPjTY15ezS4e8OfSx+BBq0Pmev
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/112-12-0x0000000010000000-0x000000001010B000-memory.dmp

Download

memory/112-15-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/112-14-0x0000000010000000-0x000000001010B000-memory.dmp

Download

memory/112-0-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/2760-27-0x0000000010000000-0x000000001010B000-memory.dmp

Download

memory/2760-29-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/2760-30-0x0000000010000000-0x000000001010B000-memory.dmp

Download

memory/3348-47-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/3508-43-0x0000000010000000-0x000000001010B000-memory.dmp

Download

memory/3508-48-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/4028-13-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/4028-44-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/4128-42-0x0000000000400000-0x0000000000423000-memory.dmp

Download