resource	yara_rule
behavioral1/memory/2288-0-0x0000000000230000-0x000000000027E000-memory.dmp	upx
behavioral1/memory/3056-6-0x0000000000790000-0x00000000007DE000-memory.dmp	upx
behavioral1/memory/2348-10-0x0000000000D10000-0x0000000000D5E000-memory.dmp	upx

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\2500 = "3"	notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\2500 = "3"	notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\2500 = "3"	notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\2500 = "3"	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2500 = "3"	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\2500 = "3"	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2500 = "3"	notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\2500 = "3"	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\2500 = "3"	notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\2500 = "3"	notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\2500 = "3"	notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\2500 = "3"	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\2500 = "3"	notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2500 = "3"	notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\2500 = "3"	notepad.exe

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0f9753758d4da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	notepad.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{48D8DF01-404B-11EF-880F-D61F2295B977} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	notepad.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b7000000000020000000000106600000001000020000000de4ddd190900d82dc4f0699609518ecff1d83a8ee577c593e3ff0e209b8f654c000000000e8000000002000020000000c7a6fb4b0109fa72e3f3a835006f29f11af842f45f054b76845253e7557cf6629000000005898be12a0cd62ca3d0dbcf5bce250cc93fc5ce173bd5dce2c6200a601ab7ed860a86bef9fad88ff143b9481e9a58413246fa5d2a79bce8fd22bd0116f391d2c627745ccd5d333880338dc3eac38578bfdd6d0b1569ab1a564f8b3c68fd6676856888dcd326afd04763af3c3eb75b865db1477c5ffdb3f0d3e82a4aa64d4b2543744e57187f205be1f592714e1170cc40000000ee502572d9f0246afe321395bdd595f4ba62c9dfc298aac3fc0d1698ba73ca08713a50b4f9e4845ddb9e4ae9abebb04fcc84aaa35c8a9bfe47d5af46812f0944	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426949625"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b7000000000020000000000106600000001000020000000d596694eda1d18c67560f641fcb70a96d2b6852e59bf526f47a3df22265f3d94000000000e8000000002000020000000ea9e42c1eb2d2d7014231ab76a237fe9f81d99b4aa76f64c45f5d99e5d3274b020000000d6b4d5192b78710055ecff5752c47069715c53e4259c9141efbe92bbae5c6ae840000000e166522060c32cc974a93eb1873b56f4ecd7afc471eea30fdf20b7e2eadacc2bfe60f40a5499b8f460ac94e3073ec3bca48617d1113091506fe5497da489b59f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe

pid	Process
2288	rundll32.exe
3056	notepad.exe
3056	notepad.exe
3056	notepad.exe
3056	notepad.exe
3056	notepad.exe
3056	notepad.exe
2348	notepad.exe
3056	notepad.exe
3056	notepad.exe
3056	notepad.exe
3056	notepad.exe
3056	notepad.exe
2288	rundll32.exe
2288	rundll32.exe
3056	notepad.exe
3056	notepad.exe
3056	notepad.exe
3056	notepad.exe
3056	notepad.exe
3056	notepad.exe
3056	notepad.exe
3056	notepad.exe
3056	notepad.exe
3056	notepad.exe
3056	notepad.exe
3056	notepad.exe
3056	notepad.exe
3056	notepad.exe
3056	notepad.exe
3056	notepad.exe
3056	notepad.exe
3056	notepad.exe
3056	notepad.exe
3056	notepad.exe
3056	notepad.exe
3056	notepad.exe
3056	notepad.exe
3056	notepad.exe
3056	notepad.exe
3056	notepad.exe
3056	notepad.exe
3056	notepad.exe
3056	notepad.exe
3056	notepad.exe
3056	notepad.exe
3056	notepad.exe
3056	notepad.exe
3056	notepad.exe
3056	notepad.exe
3056	notepad.exe
3056	notepad.exe
3056	notepad.exe
3056	notepad.exe
3056	notepad.exe
3056	notepad.exe
3056	notepad.exe
3056	notepad.exe
3056	notepad.exe
3056	notepad.exe
3056	notepad.exe
3056	notepad.exe
3056	notepad.exe
3056	notepad.exe

pid	Process
2656	iexplore.exe
2656	iexplore.exe
2656	iexplore.exe
2656	iexplore.exe
2656	iexplore.exe
2656	iexplore.exe
2656	iexplore.exe
2656	iexplore.exe
2656	iexplore.exe
2656	iexplore.exe
2796	ctfmon.exe
2796	ctfmon.exe

description	pid	Process	procid_target
PID 1668 wrote to memory of 2288	1668	rundll32.exe	30
PID 1668 wrote to memory of 2288	1668	rundll32.exe	30
PID 1668 wrote to memory of 2288	1668	rundll32.exe	30
PID 1668 wrote to memory of 2288	1668	rundll32.exe	30
PID 1668 wrote to memory of 2288	1668	rundll32.exe	30
PID 1668 wrote to memory of 2288	1668	rundll32.exe	30
PID 1668 wrote to memory of 2288	1668	rundll32.exe	30
PID 2288 wrote to memory of 2884	2288	rundll32.exe	31
PID 2288 wrote to memory of 2884	2288	rundll32.exe	31
PID 2288 wrote to memory of 2884	2288	rundll32.exe	31
PID 2288 wrote to memory of 2884	2288	rundll32.exe	31
PID 2288 wrote to memory of 3056	2288	rundll32.exe	32
PID 2288 wrote to memory of 3056	2288	rundll32.exe	32
PID 2288 wrote to memory of 3056	2288	rundll32.exe	32
PID 2288 wrote to memory of 3056	2288	rundll32.exe	32
PID 3052 wrote to memory of 2796	3052	explorer.exe	34
PID 3052 wrote to memory of 2796	3052	explorer.exe	34
PID 3052 wrote to memory of 2796	3052	explorer.exe	34
PID 2288 wrote to memory of 3056	2288	rundll32.exe	32
PID 2656 wrote to memory of 2612	2656	iexplore.exe	36
PID 2656 wrote to memory of 2612	2656	iexplore.exe	36
PID 2656 wrote to memory of 2612	2656	iexplore.exe	36
PID 2656 wrote to memory of 2612	2656	iexplore.exe	36
PID 2288 wrote to memory of 2348	2288	rundll32.exe	37
PID 2288 wrote to memory of 2348	2288	rundll32.exe	37
PID 2288 wrote to memory of 2348	2288	rundll32.exe	37
PID 2288 wrote to memory of 2348	2288	rundll32.exe	37
PID 2288 wrote to memory of 2348	2288	rundll32.exe	37
PID 2288 wrote to memory of 2656	2288	rundll32.exe	35

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.