resource	yara_rule
behavioral1/memory/3060-0-0x0000000000400000-0x000000000044D000-memory.dmp	upx
behavioral1/memory/2532-6-0x00000000002C0000-0x000000000030D000-memory.dmp	upx
behavioral1/memory/2080-9-0x00000000003C0000-0x000000000040D000-memory.dmp	upx

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\2500 = "3"	notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2500 = "3"	notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\2500 = "3"	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2500 = "3"	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\2500 = "3"	notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\2500 = "3"	notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\2500 = "3"	notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\2500 = "3"	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\2500 = "3"	notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2500 = "3"	notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\2500 = "3"	notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\2500 = "3"	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\2500 = "3"	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\2500 = "3"	notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\2500 = "3"	notepad.exe

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427189981"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main	notepad.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main	notepad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b055abd787d6da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003e1c4d4a7885794291b78de8e6dfadfd00000000020000000000106600000001000020000000d86725ebfaf336532ce25c1d3e1c41b877408992159f03e1f94c5f0ce880a340000000000e80000000020000200000001f822cfb5e2802826ec07b463b2ee9a4514ec03af8295b90e83033b10532aede90000000ab24beb09e4012b83699469171d763bea01e79e60f8637853c27585feae25df20d2c36b4f0392c879f4b4d9a934225fc7472ffe59d2ee4adc13ac4d749d2de119745bf6cfc2f58e951c88e88214628709b1d0c14539e3f3cf6ba265afa80213265b1138ed88dfba781e85bd0baa6fdc0bcf5c3ac6ad33421bec9e49ffddc5af8133f29d4130d26a4da82549637991d9840000000eb50c8160c5c4baaa08f40d621fcdb381429761fc40a377cae75a53f5800d5ff6a8d876c5e321a088d974d46aa51cf164f9e7a898dc6a03f2eddc74c3542396a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E80F9791-427A-11EF-B985-CA26F3F7E98A} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003e1c4d4a7885794291b78de8e6dfadfd00000000020000000000106600000001000020000000dd1367238a7abe2628609edd5e8400012820a8836d1100b64115680603bf33e9000000000e8000000002000020000000473d6d3f2343357871934d5ece69b32562fe40a65c23a6401949a465a80917dc2000000056030c6527e32a92319d02166c4f7dcd7596af3f8f54b5879315484170332d7a40000000923f78b344cecc70bb3790d2bcd9319b0f0bbc67bc8cab64187e59fa47c212204eb40709dec283ac792a150e1dc25d469fdccea76a12752b9cdf76b749181cfd	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe

pid	Process
3060	rundll32.exe
2532	notepad.exe
2532	notepad.exe
2532	notepad.exe
2532	notepad.exe
2532	notepad.exe
2532	notepad.exe
2080	notepad.exe
2532	notepad.exe
2532	notepad.exe
2532	notepad.exe
2532	notepad.exe
2532	notepad.exe
2532	notepad.exe
2532	notepad.exe
3060	rundll32.exe
3060	rundll32.exe
2532	notepad.exe
2532	notepad.exe
2532	notepad.exe
2532	notepad.exe
2532	notepad.exe
2532	notepad.exe
2532	notepad.exe
2532	notepad.exe
2532	notepad.exe
2532	notepad.exe
2532	notepad.exe
2532	notepad.exe
2532	notepad.exe
2532	notepad.exe
2532	notepad.exe
2532	notepad.exe
2532	notepad.exe
2532	notepad.exe
2532	notepad.exe
2532	notepad.exe
2532	notepad.exe
2532	notepad.exe
2532	notepad.exe
2532	notepad.exe
2532	notepad.exe
2532	notepad.exe
2532	notepad.exe
2532	notepad.exe
2532	notepad.exe
2532	notepad.exe
2532	notepad.exe
2532	notepad.exe
2532	notepad.exe
2532	notepad.exe
2532	notepad.exe
2532	notepad.exe
2532	notepad.exe
2532	notepad.exe
2532	notepad.exe
2532	notepad.exe
2532	notepad.exe
2532	notepad.exe
2532	notepad.exe
2532	notepad.exe
2532	notepad.exe
2532	notepad.exe
2532	notepad.exe

pid	Process
2644	iexplore.exe
2644	iexplore.exe
2644	iexplore.exe
2644	iexplore.exe
2644	iexplore.exe
2644	iexplore.exe
2644	iexplore.exe
2644	iexplore.exe
2644	iexplore.exe
2644	iexplore.exe
2756	ctfmon.exe
2756	ctfmon.exe
2756	ctfmon.exe

description	pid	Process	procid_target
PID 2352 wrote to memory of 3060	2352	rundll32.exe	30
PID 2352 wrote to memory of 3060	2352	rundll32.exe	30
PID 2352 wrote to memory of 3060	2352	rundll32.exe	30
PID 2352 wrote to memory of 3060	2352	rundll32.exe	30
PID 2352 wrote to memory of 3060	2352	rundll32.exe	30
PID 2352 wrote to memory of 3060	2352	rundll32.exe	30
PID 2352 wrote to memory of 3060	2352	rundll32.exe	30
PID 3060 wrote to memory of 2512	3060	rundll32.exe	31
PID 3060 wrote to memory of 2512	3060	rundll32.exe	31
PID 3060 wrote to memory of 2512	3060	rundll32.exe	31
PID 3060 wrote to memory of 2512	3060	rundll32.exe	31
PID 3060 wrote to memory of 2532	3060	rundll32.exe	32
PID 3060 wrote to memory of 2532	3060	rundll32.exe	32
PID 3060 wrote to memory of 2532	3060	rundll32.exe	32
PID 3060 wrote to memory of 2532	3060	rundll32.exe	32
PID 1868 wrote to memory of 2756	1868	explorer.exe	34
PID 1868 wrote to memory of 2756	1868	explorer.exe	34
PID 1868 wrote to memory of 2756	1868	explorer.exe	34
PID 3060 wrote to memory of 2532	3060	rundll32.exe	32
PID 2644 wrote to memory of 2656	2644	iexplore.exe	36
PID 2644 wrote to memory of 2656	2644	iexplore.exe	36
PID 2644 wrote to memory of 2656	2644	iexplore.exe	36
PID 2644 wrote to memory of 2656	2644	iexplore.exe	36
PID 3060 wrote to memory of 2080	3060	rundll32.exe	37
PID 3060 wrote to memory of 2080	3060	rundll32.exe	37
PID 3060 wrote to memory of 2080	3060	rundll32.exe	37
PID 3060 wrote to memory of 2080	3060	rundll32.exe	37
PID 3060 wrote to memory of 2080	3060	rundll32.exe	37
PID 3060 wrote to memory of 2644	3060	rundll32.exe	35

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.