discordrat | d99a4d776f04dfd3e8004c466ab81788da8f0ba08b83430df4dd984fa1ef4e39

Analysis

max time kernel
149s
max time network
150s
platform
windows10-1703_x64
resource
win10-20240404-ja
resource tags

arch:x64arch:x86image:win10-20240404-jalocale:ja-jpos:windows10-1703-x64systemwindows
submitted
03-07-2024 15:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

veydovokna.exe
Size

78KB
MD5

7ee32f2553fa474e79b2f1a444172735
SHA1

fc17876384c197f73a7471850d13748aa6f659b0
SHA256

d99a4d776f04dfd3e8004c466ab81788da8f0ba08b83430df4dd984fa1ef4e39
SHA512

2789dc16e615f28c29f5e81ade9e4b03a47d9855cc9092bbcdf90ce7419fe38cabd729a87f038f4aa3d8e2f5317ac69a0637737f468dd8d05532dbd3dda738b9
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+APIC:5Zv5PDwbjNrmAE+kIC

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTI1NjYyNDkzOTk3MzQ4MDYzOA.GmmRJ5.-nbYbt2H8apuatUJNXT2gF-Pq4ZpLJRKwy0hls
server_id
1257063713945419826

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Legitimate hosting services abused for malware hosting/C2 1 TTPs 9 IoCs

Web Service

T1102

flow	ioc
4	discord.com
5	discord.com
9	discord.com
24	discord.com
25	discord.com
11	discord.com
13	discord.com
22	discord.com
23	discord.com

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	POWERPNT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	POWERPNT.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	POWERPNT.EXE

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	POWERPNT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	POWERPNT.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	POWERPNT.EXE

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 5091eb9061cdda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Internet Explorer\LowRegistry	PaintStudio.View.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "2388392746"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31116641"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006455a9ef3257ed4b9a53721a265dca76000000000200000000001066000000010000200000004302bf3d5c1a50f42a398a78bd57d5eb8842470d49ff4733a332f3f752af6a0a000000000e80000000020000200000004d16b3d4cb9f63a68637db419ebe3a3626c8a9268466b8b0d012a75ab7accca120000000edad62f6852498f48dab597fd208a0d4bdfafcd3223254deff831d135ef67fcc40000000c7ef6e21b333118a68bd53d3d13578d2059dc4e63d60f4fd9d8ee97b77c2f2c73475db7e98de5a52f1f69c8562bd9aa2d403f0988272c76f46b4adae55bd87cc	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B9F73525-3954-11EF-92F8-EA56F7F4DE82} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31116641"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 404cf09061cdda01	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff00000000000000002003000030020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Internet Explorer\LowRegistry\Shell Extensions\Cached	PaintStudio.View.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2388392746"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006455a9ef3257ed4b9a53721a265dca7600000000020000000000106600000001000020000000685b54d9e1ea883f6e46f9270e377397e99ef3d41d6b6b8992c587a306c248f4000000000e80000000020000200000004d572837cc19052293158da057d606d6945d04b372e93af85f5282b2c51c7e9a200000009e276b7ee6501ef85849c55994f3036a146ce39558dac8e4aa3299d1644abd1440000000c0f87e3efc882ee52fc37492df5c162e4739e47930ddb0435f0247a091bf140164710031d620a8bc8768b7e2c64b53df6bc41c23f98e39ba1cd489058d442d98	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Internet Explorer\LowRegistry\Shell Extensions	PaintStudio.View.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.15063.0\"hypervisor=\"No Hypervisor (No SLAT)\""	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe

Modifies registry class 12 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\Content\CachePrefix	PaintStudio.View.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\Content\CacheLimit = "51200"	PaintStudio.View.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\Cookies	PaintStudio.View.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	PaintStudio.View.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\Cookies\CacheLimit = "1"	PaintStudio.View.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\Extensible Cache	PaintStudio.View.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings	PaintStudio.View.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\Content	PaintStudio.View.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\History	PaintStudio.View.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\History\CachePrefix = "Visited:"	PaintStudio.View.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\History\CacheLimit = "1"	PaintStudio.View.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache	PaintStudio.View.exe

Suspicious behavior: AddClipboardFormatListener 4 IoCs

pid	Process
4920	PaintStudio.View.exe
2948	WINWORD.EXE
2948	WINWORD.EXE
4612	POWERPNT.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5028	mspaint.exe
5028	mspaint.exe
4920	PaintStudio.View.exe
4920	PaintStudio.View.exe
4920	PaintStudio.View.exe
4920	PaintStudio.View.exe
4920	PaintStudio.View.exe
4920	PaintStudio.View.exe
4920	PaintStudio.View.exe
4920	PaintStudio.View.exe
4920	PaintStudio.View.exe
4920	PaintStudio.View.exe
4920	PaintStudio.View.exe
4920	PaintStudio.View.exe
4920	PaintStudio.View.exe
4920	PaintStudio.View.exe
4920	PaintStudio.View.exe
4920	PaintStudio.View.exe
4920	PaintStudio.View.exe
4920	PaintStudio.View.exe
4920	PaintStudio.View.exe
4920	PaintStudio.View.exe
4920	PaintStudio.View.exe
4920	PaintStudio.View.exe
4920	PaintStudio.View.exe
4920	PaintStudio.View.exe
4920	PaintStudio.View.exe
4920	PaintStudio.View.exe
4920	PaintStudio.View.exe
4920	PaintStudio.View.exe
4920	PaintStudio.View.exe
4920	PaintStudio.View.exe
4920	PaintStudio.View.exe
4920	PaintStudio.View.exe
4920	PaintStudio.View.exe
4920	PaintStudio.View.exe
4920	PaintStudio.View.exe
4920	PaintStudio.View.exe
4920	PaintStudio.View.exe
4920	PaintStudio.View.exe
4920	PaintStudio.View.exe
4920	PaintStudio.View.exe
4920	PaintStudio.View.exe
4920	PaintStudio.View.exe
4920	PaintStudio.View.exe
4920	PaintStudio.View.exe
4920	PaintStudio.View.exe
4920	PaintStudio.View.exe
4920	PaintStudio.View.exe
4920	PaintStudio.View.exe
4920	PaintStudio.View.exe
4920	PaintStudio.View.exe
4920	PaintStudio.View.exe
4920	PaintStudio.View.exe
4920	PaintStudio.View.exe
4920	PaintStudio.View.exe
4920	PaintStudio.View.exe
4920	PaintStudio.View.exe
4920	PaintStudio.View.exe
4920	PaintStudio.View.exe
4920	PaintStudio.View.exe
4920	PaintStudio.View.exe
4920	PaintStudio.View.exe
4920	PaintStudio.View.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	200	veydovokna.exe
Token: SeDebugPrivilege	4920	PaintStudio.View.exe
Token: SeDebugPrivilege	4920	PaintStudio.View.exe
Token: SeDebugPrivilege	4920	PaintStudio.View.exe
Token: SeRestorePrivilege	212	7zFM.exe
Token: 35	212	7zFM.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
212	7zFM.exe
4348	iexplore.exe

Suspicious use of SetWindowsHookEx 30 IoCs

pid	Process
5028	mspaint.exe
4920	PaintStudio.View.exe
4920	PaintStudio.View.exe
200	veydovokna.exe
200	veydovokna.exe
200	veydovokna.exe
2948	WINWORD.EXE
2948	WINWORD.EXE
2948	WINWORD.EXE
2948	WINWORD.EXE
2948	WINWORD.EXE
2948	WINWORD.EXE
2948	WINWORD.EXE
2948	WINWORD.EXE
2948	WINWORD.EXE
2948	WINWORD.EXE
2948	WINWORD.EXE
2948	WINWORD.EXE
2948	WINWORD.EXE
2948	WINWORD.EXE
4348	iexplore.exe
4348	iexplore.exe
4380	IEXPLORE.EXE
4380	IEXPLORE.EXE
4380	IEXPLORE.EXE
4612	POWERPNT.EXE
4612	POWERPNT.EXE
4612	POWERPNT.EXE
4612	POWERPNT.EXE
4612	POWERPNT.EXE

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 200 wrote to memory of 4496	200	veydovokna.exe	86
PID 200 wrote to memory of 4496	200	veydovokna.exe	86
PID 4496 wrote to memory of 4684	4496	cmd.exe	88
PID 4496 wrote to memory of 4684	4496	cmd.exe	88
PID 4348 wrote to memory of 4380	4348	iexplore.exe	97
PID 4348 wrote to memory of 4380	4348	iexplore.exe	97
PID 4348 wrote to memory of 4380	4348	iexplore.exe	97

C:\Users\Admin\AppData\Local\Temp\veydovokna.exe
"C:\Users\Admin\AppData\Local\Temp\veydovokna.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:200
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /C notepad
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4496
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:4684

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Desktop\DebugSelect.png" /ForceBootstrapPaint3D
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:5028

C:\Program Files\WindowsApps\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\PaintStudio.View.exe
"C:\Program Files\WindowsApps\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\PaintStudio.View.exe" -ServerName:Microsoft.MSPaint.AppX437q68k2qc2asvaagas2prv9tjej6ja9.mca
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4920

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:212

C:\Windows\System32\IME\SHARED\imebroker.exe
C:\Windows\System32\IME\SHARED\imebroker.exe -Embedding
1⤵
PID:2104

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Documents\These.docx" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2948

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3764

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -nohome
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4348
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4348 CREDAT:82945 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:4380

C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE
"C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE" /n "C:\Users\Admin\Downloads\UpdateSave.potm"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4612

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\4F11BAC9-7E2B-45BD-BE40-FB947FE16720

Filesize
168KB

MD5
f64192fe685ad22718f4ea306fa8e5a2

SHA1
817dac34cec7bbce59cc3ed1aff9d16b4f96b703

SHA256
5a92e5720c0282c229b6903ca6c59f5d082cc85252ae9e692fb496954d01f2da

SHA512
d8c3cfc57385c64b75284e0181bea1f62732a1c033e6508295a4051533c3bc0fa0b42630b338b7c558bc81c82867d8c03e776db956066a7060681114d871f845

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\74a0ad00a184813f0b8867eb2f8dfef7227a18a4.tbres

Filesize
2KB

MD5
849028bb95b6b8892d3fd5da719f4faa

SHA1
4489570aa68a5a808b6de7bfb2b96d1fc3bace08

SHA256
d23f2abab0eea1e14740e0078d326abfed01383db21a688d8367821b009c7491

SHA512
8669b6226a4f7b793fca207026e8c1cb27ced021c6f72c8688c37a96b7943c94a87605e9b13a78a6271a84e6f12006b149b054f7c293ebec86766a920f694694

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MSPaint_8wekyb3d8bbwe\LocalState\Projects\Projects.json

Filesize
252B

MD5
af2427248b7e35101931d9ede5944280

SHA1
b208707c8fcea94714382f440a83aa4335347576

SHA256
3a78d84627e081ebce79f18ee9dd7a7d72c98d9d427169a5be92c95f5e88be7a

SHA512
bb7cf0b52812db2a9c498b1e638abd9ede1d628021ac5478934377483b42f922b969ee3fa72b1810d4b0486ddd21ba7ae9809b88291eec84d3c5cd4d6ef4f791

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MSPaint_8wekyb3d8bbwe\LocalState\Projects\Projects.json

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MSPaint_8wekyb3d8bbwe\LocalState\Projects\Projects.json

Filesize
253B

MD5
76dc830e4dc457285b6e413d90664f6b

SHA1
c6a6282364e96292d1102f1b8da300eb424617fc

SHA256
58ab75f7006b0d6e1eddd53dab8612546150e85b54671f06819012a72bc2c187

SHA512
c2ce9cbdc29f53c80e659120cd6558afa000d52f22c24fa74ae50d131824c708a9c10eda1dc791ffd07badfced50d7f8df6314060e425701100a50a6aaef8b29

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MSPaint_8wekyb3d8bbwe\LocalState\cloudCommunitySettings.json

Filesize
2KB

MD5
404a3ec24e3ebf45be65e77f75990825

SHA1
1e05647cf0a74cedfdeabfa3e8ee33b919780a61

SHA256
cc45905af3aaa62601a69c748a06a2fa48eca3b28d44d8ec18764a7e8e4c3da2

SHA512
a55382b72267375821b0a229d3529ed54cef0f295f550d1e95661bafccec606aa1cd72e059d37d78e7d2927ae72e2919941251d233152f5eeb32ffdfc96023e5

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat

Filesize
224B

MD5
e66d36cbcfd69fdf8db6e5c649137ef1

SHA1
c1ce08cca33347fe58f95f78f61c31ac6501f511

SHA256
15376656ff62df570727bcac73caf451fbe0599729bb4bf648b5e65b3e97f5f4

SHA512
78a8c44885ce2f1a035a3075a50027d6eff5c1adbc4d4d134880b1aced5e5d0f70fb6ca8cb037327ec4890a392b3be84eb85c72f38d4cfac985afab64b7c81bc

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Templates\~WRD0000.tmp

Filesize
18KB

MD5
88abdfda6adcb8adc7bda2f1cd9feb02

SHA1
35952ec032424c4c8452ae95d62a30b004d46fa6

SHA256
f9d9ec58e179451c86b9f468f465aec3103dd252e061acfa63bb64bef3f35336

SHA512
6209fa832c5835e6170cce35f4a225309b577a185b1abf9dbd15565eb968608436c4a121436ec92836bd71511f5593cbe59dc77834eecd1c544d523e18a3767b

Download Submit
C:\Users\Admin\Downloads\ReceiveUndo.zip

Filesize
421KB

MD5
b628e6dae4318591c99ae3be44c951c0

SHA1
4a59ee725301793c25073e940e62207ea2e37d58

SHA256
1aa3420e9a2bfc3fa221f0b602232febbbe14566d6c8efa940a743d1ff7f993a

SHA512
640f38b53638177c441dca7d3eadcaba944f0dec5c31eb395156b699a4ca6d991b584a2ee4d148e57d5e81c78f51623657c20b3d213e890b6946a23ddc809a20

Download Submit
memory/200-4-0x00007FFA0A290000-0x00007FFA0AC7C000-memory.dmp

Filesize
9.9MB

Download
memory/200-8-0x00007FFA0A290000-0x00007FFA0AC7C000-memory.dmp

Filesize
9.9MB

Download
memory/200-7-0x00007FFA0A293000-0x00007FFA0A294000-memory.dmp

Filesize
4KB

Download
memory/200-6-0x000001F5BE7A0000-0x000001F5BE8AE000-memory.dmp

Filesize
1.1MB

Download
memory/200-5-0x000001F5BEBC0000-0x000001F5BF0E6000-memory.dmp

Filesize
5.1MB

Download
memory/200-0-0x00007FFA0A293000-0x00007FFA0A294000-memory.dmp

Filesize
4KB

Download
memory/200-3-0x000001F5BE120000-0x000001F5BE168000-memory.dmp

Filesize
288KB

Download
memory/200-2-0x000001F5BE2F0000-0x000001F5BE4B2000-memory.dmp

Filesize
1.8MB

Download
memory/200-1-0x000001F5A3CD0000-0x000001F5A3CE8000-memory.dmp

Filesize
96KB

Download
memory/2948-92-0x00007FF9E3F30000-0x00007FF9E3F40000-memory.dmp

Filesize
64KB

Download
memory/2948-88-0x00007FF9E7AA0000-0x00007FF9E7AB0000-memory.dmp

Filesize
64KB

Download
memory/2948-87-0x00007FF9E7AA0000-0x00007FF9E7AB0000-memory.dmp

Filesize
64KB

Download
memory/2948-353-0x00007FF9E7AA0000-0x00007FF9E7AB0000-memory.dmp

Filesize
64KB

Download
memory/2948-352-0x00007FF9E7AA0000-0x00007FF9E7AB0000-memory.dmp

Filesize
64KB

Download
memory/2948-351-0x00007FF9E7AA0000-0x00007FF9E7AB0000-memory.dmp

Filesize
64KB

Download
memory/2948-350-0x00007FF9E7AA0000-0x00007FF9E7AB0000-memory.dmp

Filesize
64KB

Download
memory/2948-85-0x00007FF9E7AA0000-0x00007FF9E7AB0000-memory.dmp

Filesize
64KB

Download
memory/2948-86-0x00007FF9E7AA0000-0x00007FF9E7AB0000-memory.dmp

Filesize
64KB

Download
memory/2948-91-0x00007FF9E3F30000-0x00007FF9E3F40000-memory.dmp

Filesize
64KB

Download
memory/4612-363-0x00007FF9E7AA0000-0x00007FF9E7AB0000-memory.dmp

Filesize
64KB

Download
memory/4612-372-0x00007FF9E3F30000-0x00007FF9E3F40000-memory.dmp

Filesize
64KB

Download
memory/4612-373-0x00007FF9E3F30000-0x00007FF9E3F40000-memory.dmp

Filesize
64KB

Download
memory/4612-362-0x00007FF9E7AA0000-0x00007FF9E7AB0000-memory.dmp

Filesize
64KB

Download
memory/4612-361-0x00007FF9E7AA0000-0x00007FF9E7AB0000-memory.dmp

Filesize
64KB

Download
memory/4612-579-0x00007FF9E7AA0000-0x00007FF9E7AB0000-memory.dmp

Filesize
64KB

Download
memory/4612-581-0x00007FF9E7AA0000-0x00007FF9E7AB0000-memory.dmp

Filesize
64KB

Download
memory/4612-580-0x00007FF9E7AA0000-0x00007FF9E7AB0000-memory.dmp

Filesize
64KB

Download
memory/4612-578-0x00007FF9E7AA0000-0x00007FF9E7AB0000-memory.dmp

Filesize
64KB

Download
memory/4612-360-0x00007FF9E7AA0000-0x00007FF9E7AB0000-memory.dmp

Filesize
64KB

Download