c3727dff978310eecbe3db8dbfe1e478f88827d8410a1659cf9678569c0722f0

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
11/06/2024, 03:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
NEW_TRANSFER_POLICY.exe
Size 727KB
Sample240611-d97avatemk
SHA256 46e60512755fdc8319ba4ad65c930837fb67f04bffef2a7ed666299d9bbbbc7a
MD5 a56995ae31324b33e1090857aa42af1b
SHA1 78f8d9c527f04102d782bcfe00b58ad4d6716653
SHA512 1f59386f382fda5e46e1aecd2be11231085ebf88ec6cfaffd7ab2e428a6b4040e85e2228b4f48c9a2bbe3eafb3158ce3fbb514dde555d16cf92a3e6f6a438b71
SSDEEP 12288:kK7x1L5giv5sYAGRcHA3mhkFX2bpbQab/Q62jHSnGmD/nv:k+z6a55KHA3XFabInSFb
MD5 SHA1 SHA512 SSDEEP

Score

9^/10

collection persistence upx

Malware Config

Signatures

NirSoft MailPassView 3 IoCs

Password recovery tool for various email clients

resource	yara_rule
behavioral2/memory/1696-58-0x0000000000400000-0x000000000041B000-memory.dmp	MailPassView
behavioral2/memory/1696-59-0x0000000000400000-0x000000000041B000-memory.dmp	MailPassView
behavioral2/memory/1696-60-0x0000000000400000-0x000000000041B000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 3 IoCs

Password recovery tool for various web browsers

resource	yara_rule
behavioral2/memory/3316-49-0x0000000000400000-0x0000000000459000-memory.dmp	WebBrowserPassView
behavioral2/memory/3316-50-0x0000000000400000-0x0000000000459000-memory.dmp	WebBrowserPassView
behavioral2/memory/3316-57-0x0000000000400000-0x0000000000459000-memory.dmp	WebBrowserPassView

Nirsoft 12 IoCs

resource	yara_rule
behavioral2/memory/3316-49-0x0000000000400000-0x0000000000459000-memory.dmp	Nirsoft
behavioral2/memory/3316-50-0x0000000000400000-0x0000000000459000-memory.dmp	Nirsoft
behavioral2/memory/3316-57-0x0000000000400000-0x0000000000459000-memory.dmp	Nirsoft
behavioral2/memory/1696-58-0x0000000000400000-0x000000000041B000-memory.dmp	Nirsoft
behavioral2/memory/1696-59-0x0000000000400000-0x000000000041B000-memory.dmp	Nirsoft
behavioral2/memory/1696-60-0x0000000000400000-0x000000000041B000-memory.dmp	Nirsoft
behavioral2/memory/4516-67-0x0000000000400000-0x0000000000426000-memory.dmp	Nirsoft
behavioral2/memory/4516-64-0x0000000000400000-0x0000000000426000-memory.dmp	Nirsoft
behavioral2/memory/4516-63-0x0000000000400000-0x0000000000426000-memory.dmp	Nirsoft
behavioral2/memory/2272-68-0x0000000000400000-0x0000000000415000-memory.dmp	Nirsoft
behavioral2/memory/2272-69-0x0000000000400000-0x0000000000415000-memory.dmp	Nirsoft
behavioral2/memory/2272-73-0x0000000000400000-0x0000000000415000-memory.dmp	Nirsoft

Sets file execution options in registry 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AvastUI.exe	NEW_TRANSFER_POLICY.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgwdsvc.exe	NEW_TRANSFER_POLICY.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSASCui.exe\Debugger = "rundll32.exe"	NEW_TRANSFER_POLICY.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avp.exe\Debugger = "rundll32.exe"	NEW_TRANSFER_POLICY.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ComboFix.exe\Debugger = "rundll32.exe"	NEW_TRANSFER_POLICY.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mbam.exe\Debugger = "rundll32.exe"	NEW_TRANSFER_POLICY.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mbamgui.exe	NEW_TRANSFER_POLICY.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ccuac.exe	NEW_TRANSFER_POLICY.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgrsx.exe\Debugger = "rundll32.exe"	NEW_TRANSFER_POLICY.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mbamscheduler.exe	NEW_TRANSFER_POLICY.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgnt.exe	NEW_TRANSFER_POLICY.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\keyscrambler.exe	NEW_TRANSFER_POLICY.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MsMpEng.exe	NEW_TRANSFER_POLICY.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe	NEW_TRANSFER_POLICY.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgcsrvx.exe\Debugger = "rundll32.exe"	NEW_TRANSFER_POLICY.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\egui.exe\Debugger = "rundll32.exe"	NEW_TRANSFER_POLICY.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msseces.exe	NEW_TRANSFER_POLICY.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avconfig.exe\Debugger = "rundll32.exe"	NEW_TRANSFER_POLICY.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\egui.exe	NEW_TRANSFER_POLICY.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mbamservice.exe\Debugger = "rundll32.exe"	NEW_TRANSFER_POLICY.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bdagent.exe\Debugger = "rundll32.exe"	NEW_TRANSFER_POLICY.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\keyscrambler.exe\Debugger = "rundll32.exe"	NEW_TRANSFER_POLICY.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ccuac.exe\Debugger = "rundll32.exe"	NEW_TRANSFER_POLICY.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avcenter.exe	NEW_TRANSFER_POLICY.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avguard.exe\Debugger = "rundll32.exe"	NEW_TRANSFER_POLICY.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgwdsvc.exe\Debugger = "rundll32.exe"	NEW_TRANSFER_POLICY.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AvastUI.exe\Debugger = "rundll32.exe"	NEW_TRANSFER_POLICY.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MpCmdRun.exe\Debugger = "rundll32.exe"	NEW_TRANSFER_POLICY.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\spybotsd.exe\Debugger = "rundll32.exe"	NEW_TRANSFER_POLICY.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgcsrvx.exe	NEW_TRANSFER_POLICY.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wireshark.exe	NEW_TRANSFER_POLICY.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mbam.exe	NEW_TRANSFER_POLICY.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\hijackthis.exe\Debugger = "rundll32.exe"	NEW_TRANSFER_POLICY.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avguard.exe	NEW_TRANSFER_POLICY.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MsMpEng.exe\Debugger = "rundll32.exe"	NEW_TRANSFER_POLICY.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgrsx.exe	NEW_TRANSFER_POLICY.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\zlclient.exe	NEW_TRANSFER_POLICY.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avconfig.exe	NEW_TRANSFER_POLICY.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mbampt.exe	NEW_TRANSFER_POLICY.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mbampt.exe\Debugger = "rundll32.exe"	NEW_TRANSFER_POLICY.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avcenter.exe\Debugger = "rundll32.exe"	NEW_TRANSFER_POLICY.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AvastSvc.exe\Debugger = "rundll32.exe"	NEW_TRANSFER_POLICY.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mbamscheduler.exe\Debugger = "rundll32.exe"	NEW_TRANSFER_POLICY.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\hijackthis.exe	NEW_TRANSFER_POLICY.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSASCui.exe	NEW_TRANSFER_POLICY.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe\Debugger = "rundll32.exe"	NEW_TRANSFER_POLICY.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mbamgui.exe\Debugger = "rundll32.exe"	NEW_TRANSFER_POLICY.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgnt.exe\Debugger = "rundll32.exe"	NEW_TRANSFER_POLICY.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ComboFix.exe	NEW_TRANSFER_POLICY.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avscan.exe\Debugger = "rundll32.exe"	NEW_TRANSFER_POLICY.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\instup.exe\Debugger = "rundll32.exe"	NEW_TRANSFER_POLICY.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mbamservice.exe	NEW_TRANSFER_POLICY.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgidsagent.exe\Debugger = "rundll32.exe"	NEW_TRANSFER_POLICY.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bdagent.exe	NEW_TRANSFER_POLICY.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wireshark.exe\Debugger = "rundll32.exe"	NEW_TRANSFER_POLICY.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MpCmdRun.exe	NEW_TRANSFER_POLICY.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msseces.exe\Debugger = "rundll32.exe"	NEW_TRANSFER_POLICY.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\instup.exe	NEW_TRANSFER_POLICY.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgui.exe	NEW_TRANSFER_POLICY.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgui.exe\Debugger = "rundll32.exe"	NEW_TRANSFER_POLICY.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgidsagent.exe	NEW_TRANSFER_POLICY.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avp.exe	NEW_TRANSFER_POLICY.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AvastSvc.exe	NEW_TRANSFER_POLICY.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avscan.exe	NEW_TRANSFER_POLICY.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation	bthserv.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation	NEW_TRANSFER_POLICY.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation	BsBhvScan.exe

Executes dropped EXE 4 IoCs

pid	Process
5012	BsBhvScan.exe
3440	bthserv.exe
3824	bthserv.exe
3168	BsBhvScan.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4516-62-0x0000000000400000-0x0000000000426000-memory.dmp	upx
behavioral2/memory/4516-61-0x0000000000400000-0x0000000000426000-memory.dmp	upx
behavioral2/memory/4516-67-0x0000000000400000-0x0000000000426000-memory.dmp	upx
behavioral2/memory/4516-64-0x0000000000400000-0x0000000000426000-memory.dmp	upx
behavioral2/memory/4516-63-0x0000000000400000-0x0000000000426000-memory.dmp	upx

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	vbc.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
2	checkip.dyndns.org

Suspicious use of SetThreadContext 6 IoCs

description	pid	Process	procid_target
PID 4180 set thread context of 468	4180	NEW_TRANSFER_POLICY.exe	86
PID 3440 set thread context of 3824	3440	bthserv.exe	90
PID 468 set thread context of 3316	468	NEW_TRANSFER_POLICY.exe	93
PID 468 set thread context of 1696	468	NEW_TRANSFER_POLICY.exe	96
PID 468 set thread context of 4516	468	NEW_TRANSFER_POLICY.exe	98
PID 468 set thread context of 2272	468	NEW_TRANSFER_POLICY.exe	100

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4180	NEW_TRANSFER_POLICY.exe
4180	NEW_TRANSFER_POLICY.exe
4180	NEW_TRANSFER_POLICY.exe
5012	BsBhvScan.exe
4180	NEW_TRANSFER_POLICY.exe
4180	NEW_TRANSFER_POLICY.exe
4180	NEW_TRANSFER_POLICY.exe
4180	NEW_TRANSFER_POLICY.exe
5012	BsBhvScan.exe
3440	bthserv.exe
3440	bthserv.exe
3440	bthserv.exe
3168	BsBhvScan.exe
3440	bthserv.exe
3168	BsBhvScan.exe
3440	bthserv.exe
3440	bthserv.exe
3168	BsBhvScan.exe
3440	bthserv.exe
3168	BsBhvScan.exe
3440	bthserv.exe
3168	BsBhvScan.exe
3440	bthserv.exe
3168	BsBhvScan.exe
3440	bthserv.exe
3168	BsBhvScan.exe
3440	bthserv.exe
3168	BsBhvScan.exe
3440	bthserv.exe
3168	BsBhvScan.exe
3440	bthserv.exe
3168	BsBhvScan.exe
3440	bthserv.exe
3168	BsBhvScan.exe
3440	bthserv.exe
3168	BsBhvScan.exe
3440	bthserv.exe
3168	BsBhvScan.exe
3440	bthserv.exe
3168	BsBhvScan.exe
3440	bthserv.exe
3168	BsBhvScan.exe
3440	bthserv.exe
3168	BsBhvScan.exe
3440	bthserv.exe
3168	BsBhvScan.exe
3440	bthserv.exe
3168	BsBhvScan.exe
3440	bthserv.exe
3168	BsBhvScan.exe
3440	bthserv.exe
3168	BsBhvScan.exe
3440	bthserv.exe
3168	BsBhvScan.exe
3440	bthserv.exe
3168	BsBhvScan.exe
3440	bthserv.exe
3168	BsBhvScan.exe
3440	bthserv.exe
3168	BsBhvScan.exe
3440	bthserv.exe
3168	BsBhvScan.exe
3440	bthserv.exe
3168	BsBhvScan.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	4180	NEW_TRANSFER_POLICY.exe
Token: SeDebugPrivilege	5012	BsBhvScan.exe
Token: SeDebugPrivilege	3440	bthserv.exe
Token: SeDebugPrivilege	3168	BsBhvScan.exe
Token: SeDebugPrivilege	4516	vbc.exe
Token: SeDebugPrivilege	468	NEW_TRANSFER_POLICY.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
468	NEW_TRANSFER_POLICY.exe

Suspicious use of WriteProcessMemory 59 IoCs

description	pid	Process	procid_target
PID 4180 wrote to memory of 468	4180	NEW_TRANSFER_POLICY.exe	86
PID 4180 wrote to memory of 468	4180	NEW_TRANSFER_POLICY.exe	86
PID 4180 wrote to memory of 468	4180	NEW_TRANSFER_POLICY.exe	86
PID 4180 wrote to memory of 468	4180	NEW_TRANSFER_POLICY.exe	86
PID 4180 wrote to memory of 468	4180	NEW_TRANSFER_POLICY.exe	86
PID 4180 wrote to memory of 468	4180	NEW_TRANSFER_POLICY.exe	86
PID 4180 wrote to memory of 468	4180	NEW_TRANSFER_POLICY.exe	86
PID 4180 wrote to memory of 468	4180	NEW_TRANSFER_POLICY.exe	86
PID 4180 wrote to memory of 5012	4180	NEW_TRANSFER_POLICY.exe	87
PID 4180 wrote to memory of 5012	4180	NEW_TRANSFER_POLICY.exe	87
PID 4180 wrote to memory of 5012	4180	NEW_TRANSFER_POLICY.exe	87
PID 5012 wrote to memory of 3440	5012	BsBhvScan.exe	89
PID 5012 wrote to memory of 3440	5012	BsBhvScan.exe	89
PID 5012 wrote to memory of 3440	5012	BsBhvScan.exe	89
PID 3440 wrote to memory of 3824	3440	bthserv.exe	90
PID 3440 wrote to memory of 3824	3440	bthserv.exe	90
PID 3440 wrote to memory of 3824	3440	bthserv.exe	90
PID 3440 wrote to memory of 3824	3440	bthserv.exe	90
PID 3440 wrote to memory of 3824	3440	bthserv.exe	90
PID 3440 wrote to memory of 3824	3440	bthserv.exe	90
PID 3440 wrote to memory of 3824	3440	bthserv.exe	90
PID 3440 wrote to memory of 3824	3440	bthserv.exe	90
PID 3440 wrote to memory of 3168	3440	bthserv.exe	91
PID 3440 wrote to memory of 3168	3440	bthserv.exe	91
PID 3440 wrote to memory of 3168	3440	bthserv.exe	91
PID 468 wrote to memory of 3316	468	NEW_TRANSFER_POLICY.exe	93
PID 468 wrote to memory of 3316	468	NEW_TRANSFER_POLICY.exe	93
PID 468 wrote to memory of 3316	468	NEW_TRANSFER_POLICY.exe	93
PID 468 wrote to memory of 3316	468	NEW_TRANSFER_POLICY.exe	93
PID 468 wrote to memory of 3316	468	NEW_TRANSFER_POLICY.exe	93
PID 468 wrote to memory of 3316	468	NEW_TRANSFER_POLICY.exe	93
PID 468 wrote to memory of 3316	468	NEW_TRANSFER_POLICY.exe	93
PID 468 wrote to memory of 3316	468	NEW_TRANSFER_POLICY.exe	93
PID 468 wrote to memory of 3316	468	NEW_TRANSFER_POLICY.exe	93
PID 468 wrote to memory of 1696	468	NEW_TRANSFER_POLICY.exe	96
PID 468 wrote to memory of 1696	468	NEW_TRANSFER_POLICY.exe	96
PID 468 wrote to memory of 1696	468	NEW_TRANSFER_POLICY.exe	96
PID 468 wrote to memory of 1696	468	NEW_TRANSFER_POLICY.exe	96
PID 468 wrote to memory of 1696	468	NEW_TRANSFER_POLICY.exe	96
PID 468 wrote to memory of 1696	468	NEW_TRANSFER_POLICY.exe	96
PID 468 wrote to memory of 1696	468	NEW_TRANSFER_POLICY.exe	96
PID 468 wrote to memory of 1696	468	NEW_TRANSFER_POLICY.exe	96
PID 468 wrote to memory of 1696	468	NEW_TRANSFER_POLICY.exe	96
PID 468 wrote to memory of 4516	468	NEW_TRANSFER_POLICY.exe	98
PID 468 wrote to memory of 4516	468	NEW_TRANSFER_POLICY.exe	98
PID 468 wrote to memory of 4516	468	NEW_TRANSFER_POLICY.exe	98
PID 468 wrote to memory of 4516	468	NEW_TRANSFER_POLICY.exe	98
PID 468 wrote to memory of 4516	468	NEW_TRANSFER_POLICY.exe	98
PID 468 wrote to memory of 4516	468	NEW_TRANSFER_POLICY.exe	98
PID 468 wrote to memory of 4516	468	NEW_TRANSFER_POLICY.exe	98
PID 468 wrote to memory of 2272	468	NEW_TRANSFER_POLICY.exe	100
PID 468 wrote to memory of 2272	468	NEW_TRANSFER_POLICY.exe	100
PID 468 wrote to memory of 2272	468	NEW_TRANSFER_POLICY.exe	100
PID 468 wrote to memory of 2272	468	NEW_TRANSFER_POLICY.exe	100
PID 468 wrote to memory of 2272	468	NEW_TRANSFER_POLICY.exe	100
PID 468 wrote to memory of 2272	468	NEW_TRANSFER_POLICY.exe	100
PID 468 wrote to memory of 2272	468	NEW_TRANSFER_POLICY.exe	100
PID 468 wrote to memory of 2272	468	NEW_TRANSFER_POLICY.exe	100
PID 468 wrote to memory of 2272	468	NEW_TRANSFER_POLICY.exe	100

C:\Users\Admin\AppData\Local\Temp\NEW_TRANSFER_POLICY.exe
"C:\Users\Admin\AppData\Local\Temp\NEW_TRANSFER_POLICY.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4180
- C:\Users\Admin\AppData\Local\Temp\NEW_TRANSFER_POLICY.exe
  "C:\Users\Admin\AppData\Local\Temp\NEW_TRANSFER_POLICY.exe"
  2⤵
  - Sets file execution options in registry
  - Suspicious use of SetThreadContext
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:468
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Roaming\Helper\Browser.txt"
    3⤵
    PID:3316
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Roaming\Helper\Mail.txt"
    3⤵
    - Accesses Microsoft Outlook accounts
    PID:1696
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Roaming\Helper\Mess.txt"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4516
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Roaming\Helper\OS.txt"
    3⤵
    PID:2272
- C:\Users\Admin\AppData\Local\Microsoft\Windows\BsBhvScan.exe
  "C:\Users\Admin\AppData\Local\Microsoft\Windows\BsBhvScan.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5012
- - C:\Users\Admin\AppData\Local\Microsoft\Windows\bthserv.exe
    "C:\Users\Admin\AppData\Local\Microsoft\Windows\bthserv.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3440
  - - C:\Users\Admin\AppData\Local\Microsoft\Windows\bthserv.exe
      "C:\Users\Admin\AppData\Local\Microsoft\Windows\bthserv.exe"
      4⤵
      Executes dropped EXE
      PID:3824
  - - C:\Users\Admin\AppData\Local\Microsoft\Windows\BsBhvScan.exe
      "C:\Users\Admin\AppData\Local\Microsoft\Windows\BsBhvScan.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3168

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scripting

T1064

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Scripting

T1064

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BsBhvScan.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\BsBhvScan.exe.log
Size 128B
SHA256 e24033ceec97fd03402b03acaaabd1d1e378e83bb1683afbccac760e00f8ead5
MD5 a5dcc7c9c08af7dddd82be5b036a4416
SHA1 4f998ca1526d199e355ffb435bae111a2779b994
SHA512 56035de734836c0c39f0b48641c51c26adb6e79c6c65e23ca96603f71c95b8673e2ef853146e87efc899dd1878d0bbc2c82d91fbf0fce81c552048e986f9bb5a
MD5 SHA1 SHA512

Submit Download

BsBhvScan.exe

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\BsBhvScan.exe
Size 17KB
SHA256 2fc624e247f4af6ee90337208f2995e15307cd4471e4a34a2911be93ba4dc0d9
MD5 21e463f297440f3e0d0b80c524970eab
SHA1 62488495418d5db6c919e67a07e9c1d58832878a
SHA512 b47466b52fc8b77a7069c86934c319c7d72200f1119e61cc38457de8c6b15885d130455234e2a23b05de232de024f457b7cb9662276142d25ad1e8f76006f0de
SSDEEP 384:Y1bVb0L8/nkEpUgAAemnhZZGKEVOt0hnxN6K49:Y110I/9pVAADawx9
MD5 SHA1 SHA512 SSDEEP

Submit Download

BsBhvScan.exe

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\BsBhvScan.exe
Size 17KB
SHA256 dcf489a0c09d60b511e02b950bfffecad64ed039c18b974bce2936d5499a64e8
MD5 4410f7e0d94f7fa4fc22a3418e30a8c0
SHA1 d40728b7a1319e9c88f0388e93ca4365b0550631
SHA512 11f9d985fd4e7deab606294fb87694fd7ee8b3626245a9be1c6adecc3e56ba2cc7098cd385bbf88857ea9c8e706099c525a2ddde682532f5346526120789bcb1
SSDEEP 384:Y1bVb0L8/nkEpUgAAemnhZZGKEVOt0hnxf6K49:Y110I/9pVAADawn9
MD5 SHA1 SHA512 SSDEEP

Submit Download

bthserv.exe

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\bthserv.exe
Size 727KB
SHA256 46e60512755fdc8319ba4ad65c930837fb67f04bffef2a7ed666299d9bbbbc7a
MD5 a56995ae31324b33e1090857aa42af1b
SHA1 78f8d9c527f04102d782bcfe00b58ad4d6716653
SHA512 1f59386f382fda5e46e1aecd2be11231085ebf88ec6cfaffd7ab2e428a6b4040e85e2228b4f48c9a2bbe3eafb3158ce3fbb514dde555d16cf92a3e6f6a438b71
SSDEEP 12288:kK7x1L5giv5sYAGRcHA3mhkFX2bpbQab/Q62jHSnGmD/nv:k+z6a55KHA3XFabInSFb
MD5 SHA1 SHA512 SSDEEP

Submit Download

Browser.txt

Path C:\Users\Admin\AppData\Roaming\Helper\Browser.txt
Size 3KB
SHA256 a3377ade83786c2bdff5db19ff4dbfd796da4312402b5e77c4c63e38cc6eff92
MD5 f94dc819ca773f1e3cb27abbc9e7fa27
SHA1 9a7700efadc5ea09ab288544ef1e3cd876255086
SHA512 72a2c10d7a53a7f9a319dab66d77ed65639e9aa885b551e0055fc7eaf6ef33bbf109205b42ae11555a0f292563914bc6edb63b310c6f9bda9564095f77ab9196
MD5 SHA1 SHA512

Submit Download

OS.txt

Path C:\Users\Admin\AppData\Roaming\Helper\OS.txt
Size 725B
SHA256 1f1ef528591b33dc88ec8efd85bd6f983e1c43445b86c099a28106c407db86fb
MD5 a707922df64b61bcdc022c64c6c7f1e1
SHA1 dacbf489a2d974c3ab2b0d7f6d94ae9ff3d8ece3
SHA512 f833e7d801acdd9c513e5fb21599138e141f6b9846fefbaad5e70962ee1ef6e86b34d693cf5a6b8690ababb0f04e1562fa98d30576b7c5c47b39f1eeb732c1ff
MD5 SHA1 SHA512

Submit Download

memory/468-47-0x0000000075460000-0x0000000075A11000-memory.dmp

Download

memory/468-9-0x0000000075460000-0x0000000075A11000-memory.dmp

Download

memory/468-21-0x0000000075460000-0x0000000075A11000-memory.dmp

Download

memory/468-12-0x0000000075460000-0x0000000075A11000-memory.dmp

Download

memory/468-4-0x0000000000400000-0x0000000000498000-memory.dmp

Download

memory/1696-58-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/1696-60-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/1696-59-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/2272-68-0x0000000000400000-0x0000000000415000-memory.dmp

Download

memory/2272-69-0x0000000000400000-0x0000000000415000-memory.dmp

Download

memory/2272-73-0x0000000000400000-0x0000000000415000-memory.dmp

Download

memory/3316-57-0x0000000000400000-0x0000000000459000-memory.dmp

Download

memory/3316-49-0x0000000000400000-0x0000000000459000-memory.dmp

Download

memory/3316-50-0x0000000000400000-0x0000000000459000-memory.dmp

Download

memory/4180-2-0x0000000075460000-0x0000000075A11000-memory.dmp

Download

memory/4180-0-0x0000000075462000-0x0000000075463000-memory.dmp

Download

memory/4180-3-0x0000000075460000-0x0000000075A11000-memory.dmp

Download

memory/4180-29-0x0000000075460000-0x0000000075A11000-memory.dmp

Download

memory/4180-1-0x0000000075460000-0x0000000075A11000-memory.dmp

Download

memory/4516-62-0x0000000000400000-0x0000000000426000-memory.dmp

Download

memory/4516-61-0x0000000000400000-0x0000000000426000-memory.dmp

Download

memory/4516-67-0x0000000000400000-0x0000000000426000-memory.dmp

Download

memory/4516-64-0x0000000000400000-0x0000000000426000-memory.dmp

Download

memory/4516-63-0x0000000000400000-0x0000000000426000-memory.dmp

Download

memory/5012-28-0x0000000075460000-0x0000000075A11000-memory.dmp

Download

memory/5012-23-0x0000000075460000-0x0000000075A11000-memory.dmp

Download

memory/5012-22-0x0000000075460000-0x0000000075A11000-memory.dmp

Download