Overview
overview
10Static
static
106ee09985aa...0N.exe
windows7-x64
106ee09985aa...0N.exe
windows10-2004-x64
10$0.dll
windows7-x64
3$0.dll
windows10-2004-x64
3$2.exe
windows7-x64
3$2.exe
windows10-2004-x64
3$3.exe
windows7-x64
3$3.exe
windows10-2004-x64
3$COMMONFIL...st.exe
windows7-x64
3$COMMONFIL...st.exe
windows10-2004-x64
3$COMMONFIL...64.exe
windows7-x64
1$COMMONFIL...64.exe
windows10-2004-x64
1$COMMONFIL...dr.dll
windows7-x64
1$COMMONFIL...dr.dll
windows10-2004-x64
1$COMMONFIL...dr.sys
windows7-x64
1$COMMONFIL...dr.sys
windows10-2004-x64
1$COMMONFIL...dr.dll
windows7-x64
3$COMMONFIL...dr.dll
windows10-2004-x64
3$COMMONFIL...dr.sys
windows7-x64
1$COMMONFIL...dr.sys
windows10-2004-x64
1$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3ssranghk.dll
windows7-x64
3ssranghk.dll
windows10-2004-x64
3Analysis
-
max time kernel
117s -
max time network
121s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
24-07-2024 09:36
Behavioral task
behavioral1
Sample
6ee09985aad01926c5ec335e48c36950N.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
6ee09985aad01926c5ec335e48c36950N.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral3
Sample
$0.dll
Resource
win7-20240708-en
Behavioral task
behavioral4
Sample
$0.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral5
Sample
$2.exe
Resource
win7-20240705-en
Behavioral task
behavioral6
Sample
$2.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral7
Sample
$3.exe
Resource
win7-20240704-en
Behavioral task
behavioral8
Sample
$3.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral9
Sample
$COMMONFILES/supportdotcom/rang/driverinst.exe
Resource
win7-20240704-en
Behavioral task
behavioral10
Sample
$COMMONFILES/supportdotcom/rang/driverinst.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral11
Sample
$COMMONFILES/supportdotcom/rang/driverinst64.exe
Resource
win7-20240708-en
Behavioral task
behavioral12
Sample
$COMMONFILES/supportdotcom/rang/driverinst64.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral13
Sample
$COMMONFILES/supportdotcom/rang/nt_amd64/ssmirrdr.dll
Resource
win7-20240708-en
Behavioral task
behavioral14
Sample
$COMMONFILES/supportdotcom/rang/nt_amd64/ssmirrdr.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral15
Sample
$COMMONFILES/supportdotcom/rang/nt_amd64/ssmirrdr.sys
Resource
win7-20240705-en
Behavioral task
behavioral16
Sample
$COMMONFILES/supportdotcom/rang/nt_amd64/ssmirrdr.sys
Resource
win10v2004-20240709-en
Behavioral task
behavioral17
Sample
$COMMONFILES/supportdotcom/rang/nt_x86/ssmirrdr.dll
Resource
win7-20240704-en
Behavioral task
behavioral18
Sample
$COMMONFILES/supportdotcom/rang/nt_x86/ssmirrdr.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral19
Sample
$COMMONFILES/supportdotcom/rang/nt_x86/ssmirrdr.sys
Resource
win7-20240704-en
Behavioral task
behavioral20
Sample
$COMMONFILES/supportdotcom/rang/nt_x86/ssmirrdr.sys
Resource
win10v2004-20240709-en
Behavioral task
behavioral21
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240708-en
Behavioral task
behavioral22
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral23
Sample
ssranghk.dll
Resource
win7-20240704-en
Behavioral task
behavioral24
Sample
ssranghk.dll
Resource
win10v2004-20240709-en
General
-
Target
6ee09985aad01926c5ec335e48c36950N.exe
-
Size
1.9MB
-
MD5
6ee09985aad01926c5ec335e48c36950
-
SHA1
e21abc81cb0516782168eda2bc1706f7bf1a3614
-
SHA256
49a7d26eb8022c5edc59707b013f38d41ba8838f987e676f6385c3d46c7ab998
-
SHA512
dafa5a6b7a4408f2e3d9b920ce4e03e45638ca767cb9dd585d7417bb6ce11b092287f08c7b97e9f8c9d2af7cdb6585dcb3c2bec36afdc22c460a5f0299e36a1a
-
SSDEEP
49152:Q8t9VWdeTu1rsEJHCPwVmb8AKe3kAIugoiau0zZEjafp:Q8qeTUsRP+AKSZzJR
Malware Config
Signatures
-
Detects Strela Stealer payload 1 IoCs
resource yara_rule behavioral2/files/0x00070000000234c7-29.dat family_strela -
Drops file in Drivers directory 3 IoCs
description ioc Process File created C:\Windows\System32\drivers\SETAC3E.tmp DrvInst.exe File opened for modification C:\Windows\System32\drivers\ssmirrdr.sys DrvInst.exe File opened for modification C:\Windows\System32\drivers\SETAC3E.tmp DrvInst.exe -
Executes dropped EXE 5 IoCs
pid Process 1580 driverinst64.exe 2124 ssrangsv.exe 3104 ssrangsv.exe 2500 ssrangsv.exe 4448 ssrangui.exe -
Loads dropped DLL 1 IoCs
pid Process 2240 6ee09985aad01926c5ec335e48c36950N.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory 30 IoCs
description ioc Process File opened for modification C:\Windows\System32\DriverStore\FileRepository\ssmirrdr.inf_amd64_f60e4a3bb7f7b95a\ssmirrdr-nt_amd64.cat DrvInst.exe File opened for modification C:\Windows\System32\CatRoot2\dberr.txt DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{01dd3742-a332-b248-a6ee-065c3e1788e0}\nt_amd64\SETAA69.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{01dd3742-a332-b248-a6ee-065c3e1788e0}\nt_amd64\SETAA79.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\drvstore.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{01dd3742-a332-b248-a6ee-065c3e1788e0}\SETAA7A.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{01dd3742-a332-b248-a6ee-065c3e1788e0}\SETAA7B.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\ssmirrdr.inf_amd64_f60e4a3bb7f7b95a\nt_amd64\ssmirrdr.sys DrvInst.exe File opened for modification C:\Windows\System32\SETAC3F.tmp DrvInst.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE ssrangsv.exe File created C:\Windows\System32\DriverStore\Temp\{01dd3742-a332-b248-a6ee-065c3e1788e0}\SETAA7A.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{01dd3742-a332-b248-a6ee-065c3e1788e0}\ssmirrdr.inf DrvInst.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies ssrangsv.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\T6V5CGVG.htm ssrangsv.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\ssmirrdr.inf_amd64_f60e4a3bb7f7b95a\nt_amd64\ssmirrdr.dll DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\ssmirrdr.inf_amd64_f60e4a3bb7f7b95a\ssmirrdr.inf DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{01dd3742-a332-b248-a6ee-065c3e1788e0}\nt_amd64\ssmirrdr.dll DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{01dd3742-a332-b248-a6ee-065c3e1788e0}\nt_amd64\ssmirrdr.sys DrvInst.exe File created C:\Windows\System32\SETAC3F.tmp DrvInst.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 ssrangsv.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{01dd3742-a332-b248-a6ee-065c3e1788e0} DrvInst.exe File created C:\Windows\System32\DriverStore\FileRepository\ssmirrdr.inf_amd64_f60e4a3bb7f7b95a\ssmirrdr.PNF driverinst64.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{01dd3742-a332-b248-a6ee-065c3e1788e0}\ssmirrdr-nt_amd64.cat DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{01dd3742-a332-b248-a6ee-065c3e1788e0}\nt_amd64\SETAA69.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{01dd3742-a332-b248-a6ee-065c3e1788e0}\SETAA7B.tmp DrvInst.exe File opened for modification C:\Windows\System32\ssmirrdr.dll DrvInst.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 ssrangsv.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\current_time_in_US-CA[1].aspx ssrangsv.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{01dd3742-a332-b248-a6ee-065c3e1788e0}\nt_amd64\SETAA79.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{01dd3742-a332-b248-a6ee-065c3e1788e0}\nt_amd64 DrvInst.exe -
Drops file in Program Files directory 20 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\supportdotcom\rang\nsiA838.tmp 6ee09985aad01926c5ec335e48c36950N.exe File opened for modification C:\Program Files (x86)\supportdotcom\rang\nsiA839.tmp 6ee09985aad01926c5ec335e48c36950N.exe File created C:\Program Files (x86)\supportdotcom\rang\logs\ssrangsv_[7-24-2024 - 9.36.44].log ssrangsv.exe File opened for modification C:\Program Files (x86)\supportdotcom\rang\logs\ssrangsv_[7-24-2024 - 9.36.45].log ssrangsv.exe File created C:\Program Files (x86)\Common Files\supportdotcom\rang\ssmirrdr-nt_x86.cat 6ee09985aad01926c5ec335e48c36950N.exe File created C:\Program Files (x86)\Common Files\supportdotcom\rang\ssmirrdr.inf 6ee09985aad01926c5ec335e48c36950N.exe File created C:\Program Files (x86)\Common Files\supportdotcom\rang\nt_x86\ssmirrdr.sys 6ee09985aad01926c5ec335e48c36950N.exe File created C:\Program Files (x86)\Common Files\supportdotcom\rang\nt_amd64\ssmirrdr.dll 6ee09985aad01926c5ec335e48c36950N.exe File created C:\Program Files (x86)\Common Files\supportdotcom\rang\nt_amd64\ssmirrdr.sys 6ee09985aad01926c5ec335e48c36950N.exe File opened for modification C:\Program Files (x86)\supportdotcom\rang\nsoA8A8.tmp 6ee09985aad01926c5ec335e48c36950N.exe File created C:\Program Files (x86)\Common Files\supportdotcom\rang\driverinst.exe 6ee09985aad01926c5ec335e48c36950N.exe File created C:\Program Files (x86)\Common Files\supportdotcom\rang\driverinst64.exe 6ee09985aad01926c5ec335e48c36950N.exe File created C:\Program Files (x86)\Common Files\supportdotcom\rang\ssmirrdr-nt_amd64.cat 6ee09985aad01926c5ec335e48c36950N.exe File created C:\Program Files (x86)\supportdotcom\rang\uninst.exe 6ee09985aad01926c5ec335e48c36950N.exe File created C:\Program Files (x86)\Common Files\supportdotcom\rang\nt_x86\ssmirrdr.dll 6ee09985aad01926c5ec335e48c36950N.exe File created C:\Program Files (x86)\supportdotcom\rang\ssranghk.dll 6ee09985aad01926c5ec335e48c36950N.exe File created C:\Program Files (x86)\supportdotcom\rang\ca-bundle.crt 6ee09985aad01926c5ec335e48c36950N.exe File opened for modification C:\Program Files (x86)\supportdotcom\rang\ 6ee09985aad01926c5ec335e48c36950N.exe File created C:\Program Files (x86)\supportdotcom\rang\support.ico 6ee09985aad01926c5ec335e48c36950N.exe File created C:\Program Files (x86)\supportdotcom\rang\logs\ssrangsv_[7-24-2024 - 9.36.45].log ssrangsv.exe -
Drops file in Windows directory 7 IoCs
description ioc Process File opened for modification C:\Windows\INF\setupapi.dev.log svchost.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File opened for modification C:\Windows\inf\oem3.inf DrvInst.exe File created C:\Windows\inf\oem3.inf DrvInst.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File created C:\Windows\INF\c_display.PNF driverinst64.exe File opened for modification C:\Windows\INF\setupapi.dev.log driverinst64.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ssrangsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ssrangsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ssrangsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ssrangui.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6ee09985aad01926c5ec335e48c36950N.exe -
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\LowerFilters DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Filters DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 driverinst64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Service DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom driverinst64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Phantom DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID driverinst64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags driverinst64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\UpperFilters DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Filters DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\UpperFilters DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags dwm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 driverinst64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID dwm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Filters DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\UpperFilters DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\UpperFilters DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000 dwm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 driverinst64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID dwm.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\LowerFilters DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Service DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Filters DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 dwm.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags dwm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\LowerFilters DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\CompatibleIDs driverinst64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Service DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID driverinst64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs driverinst64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000 DrvInst.exe -
Enumerates system info in registry 2 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS dwm.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU dwm.exe -
Modifies Control Panel 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Control Panel\Desktop\ScreenSaveActive = "0" ssrangui.exe Set value (str) \REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Control Panel\Desktop\ScreenSaveTimeOut = "0" ssrangui.exe -
Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" ssrangsv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root dwm.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@%SystemRoot%\system32\powrprof.dll,-13 = "High performance" ssrangsv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P ssrangsv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History ssrangsv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed dwm.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" ssrangsv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust dwm.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" ssrangsv.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" ssrangsv.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix ssrangsv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing ssrangsv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings ssrangsv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\CertificateRevocation = "0" ssrangsv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" ssrangsv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ ssrangsv.exe -
Modifies registry class 64 IoCs
description ioc Process Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\LIVESCRIPT AUTHOR\OLESCRIPT ssrangsv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{f414c262-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32\ = "C:\\Windows\\SysWow64\\jscript.dll" ssrangsv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{cc5bbec3-db4a-4bed-828d-08d78ee3e1ed}\OLEScript ssrangsv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\ScriptHostEncode ssrangsv.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\JScript Author ssrangsv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.cdx ssrangsv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\LiveScript Author\CLSID ssrangsv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\JavaScript Author\CLSID\ = "{f414c261-6ac0-11cf-b6d1-00aa00bbbb58}" ssrangsv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{cc5bbec3-db4a-4bed-828d-08d78ee3e1ed} ssrangsv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{c733e4af-576e-11d0-b28c-00c04fd7cd22}\ = "Thread NotificationMgr" ssrangsv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\local\CLSID = "{79eac9e7-baf9-11ce-8c82-00aa004ba90b}" ssrangsv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\cdl\CLSID = "{3dd53d40-7b8b-11D0-b013-00aa0059ce02}" ssrangsv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ECMAScript Author ssrangsv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\JScript.Encode\OLEScript ssrangsv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0CF774D1-F077-11D1-B1BC-00C04F86C324}\InprocServer32 ssrangsv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile.HostEncode\CLSID ssrangsv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\local ssrangsv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79eac9f2-baf9-11ce-8c82-00aa004ba90b} ssrangsv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{32B533BB-EDAE-11d0-BD5A-00AA00B92AF1} ssrangsv.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\JavaScript ssrangsv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\JavaScript1.2\ = "JScript Language" ssrangsv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\JavaScript1.1 Author\CLSID\ = "{f414c261-6ac0-11cf-b6d1-00aa00bbbb58}" ssrangsv.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Scripting.Encoder ssrangsv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0968e258-16c7-4dba-aa86-462dd61e31a3}\InprocServer32 ssrangsv.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\JScript ssrangsv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\JScript.Encode\CLSID ssrangsv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C90250F3-4D7D-4991-9B69-A5C5BC1C2AE6} ssrangsv.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\JScript.Compact ssrangsv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\JScript.Compact ssrangsv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Scripting.FileSystemObject ssrangsv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{32DA2B15-CFED-11D1-B747-00C04FC2B085}\InprocServer32 ssrangsv.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\ECMAScript Author ssrangsv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\JavaScript\CLSID\ = "{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}" ssrangsv.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\ECMASCRIPT AUTHOR\OLESCRIPT ssrangsv.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\HTMLFILE\SCRIPTHOSTENCODE ssrangsv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EE09B103-97E0-11CF-978F-00A02463E06F}\Implemented Categories ssrangsv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79eac9e7-baf9-11ce-8c82-00aa004ba90b} ssrangsv.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\LiveScript ssrangsv.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{F414C260-6AC0-11CF-B6D1-00AA00BBBB58}\PROGID ssrangsv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\ProgID\ = "JScript" ssrangsv.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{F414C261-6AC0-11CF-B6D1-00AA00BBBB58}\PROGID ssrangsv.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{f414c262-6ac0-11cf-b6d1-00aa00bbbb58} ssrangsv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\https\ = "https: Asychronous Pluggable Protocol Handler" ssrangsv.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\JSCRIPT\CLSID ssrangsv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\JavaScript ssrangsv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\JavaScript\OLEScript ssrangsv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\JavaScript1.1\CLSID\ = "{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}" ssrangsv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{f414c261-6ac0-11cf-b6d1-00aa00bbbb58}\ = "JScript Language Authoring" ssrangsv.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{CC5BBEC3-DB4A-4BED-828D-08D78EE3E1ED}\OLESCRIPT ssrangsv.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{cc5bbec3-db4a-4bed-828d-08d78ee3e1ed}\Implemented Categories ssrangsv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79eac9e2-baf9-11ce-8c82-00aa004ba90b}\InprocServer32 ssrangsv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\ScriptHostEncode ssrangsv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\JavaScript1.2 AuthorJavaScript1.3 Author ssrangsv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{cc5bbec3-db4a-4bed-828d-08d78ee3e1ed}\ProgID ssrangsv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EE09B103-97E0-11CF-978F-00A02463E06F}\Version ssrangsv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\LiveScript Author\CLSID\ = "{f414c261-6ac0-11cf-b6d1-00aa00bbbb58}" ssrangsv.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\JavaScript1.1 ssrangsv.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\ECMASCRIPT\OLESCRIPT ssrangsv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\JScript\OLEScript ssrangsv.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\JScript.Compact Author ssrangsv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{f414c262-6ac0-11cf-b6d1-00aa00bbbb58}\OLEScript ssrangsv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7b8a2d94-0ac9-11d1-896c-00c04Fb6bfc4}\InprocServer32 ssrangsv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79eac9e5-baf9-11ce-8c82-00aa004ba90b}\InprocServer32 ssrangsv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\file\ = "file:, local: Asychronous Pluggable Protocol Handler" ssrangsv.exe -
Suspicious use of AdjustPrivilegeToken 16 IoCs
description pid Process Token: SeAuditPrivilege 3776 svchost.exe Token: SeSecurityPrivilege 3776 svchost.exe Token: SeLoadDriverPrivilege 1580 driverinst64.exe Token: SeRestorePrivilege 1068 DrvInst.exe Token: SeBackupPrivilege 1068 DrvInst.exe Token: SeRestorePrivilege 1068 DrvInst.exe Token: SeBackupPrivilege 1068 DrvInst.exe Token: SeLoadDriverPrivilege 1068 DrvInst.exe Token: SeLoadDriverPrivilege 1068 DrvInst.exe Token: SeLoadDriverPrivilege 1068 DrvInst.exe Token: SeCreateGlobalPrivilege 3632 dwm.exe Token: SeChangeNotifyPrivilege 3632 dwm.exe Token: 33 3632 dwm.exe Token: SeIncBasePriorityPrivilege 3632 dwm.exe Token: SeShutdownPrivilege 3632 dwm.exe Token: SeCreatePagefilePrivilege 3632 dwm.exe -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 2240 wrote to memory of 1580 2240 6ee09985aad01926c5ec335e48c36950N.exe 84 PID 2240 wrote to memory of 1580 2240 6ee09985aad01926c5ec335e48c36950N.exe 84 PID 2240 wrote to memory of 2124 2240 6ee09985aad01926c5ec335e48c36950N.exe 85 PID 2240 wrote to memory of 2124 2240 6ee09985aad01926c5ec335e48c36950N.exe 85 PID 2240 wrote to memory of 2124 2240 6ee09985aad01926c5ec335e48c36950N.exe 85 PID 3776 wrote to memory of 4396 3776 svchost.exe 88 PID 3776 wrote to memory of 4396 3776 svchost.exe 88 PID 3776 wrote to memory of 1068 3776 svchost.exe 91 PID 3776 wrote to memory of 1068 3776 svchost.exe 91 PID 2240 wrote to memory of 3104 2240 6ee09985aad01926c5ec335e48c36950N.exe 94 PID 2240 wrote to memory of 3104 2240 6ee09985aad01926c5ec335e48c36950N.exe 94 PID 2240 wrote to memory of 3104 2240 6ee09985aad01926c5ec335e48c36950N.exe 94 PID 2500 wrote to memory of 4448 2500 ssrangsv.exe 97 PID 2500 wrote to memory of 4448 2500 ssrangsv.exe 97 PID 2500 wrote to memory of 4448 2500 ssrangsv.exe 97
Processes
-
C:\Users\Admin\AppData\Local\Temp\6ee09985aad01926c5ec335e48c36950N.exe"C:\Users\Admin\AppData\Local\Temp\6ee09985aad01926c5ec335e48c36950N.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2240 -
C:\Program Files (x86)\Common Files\supportdotcom\rang\driverinst64.exe"C:\Program Files (x86)\Common Files\supportdotcom\rang/driverinst64.exe" /Install2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:1580
-
-
C:\Program Files (x86)\supportdotcom\rang\ssrangsv.exe"C:\Program Files (x86)\supportdotcom\rang\ssrangsv.exe" /provider supportdotcom /setup2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2124
-
-
C:\Program Files (x86)\supportdotcom\rang\ssrangsv.exe"C:\Program Files (x86)\supportdotcom\rang\ssrangsv.exe" /provider supportdotcom /regserver /start2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3104
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3776 -
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{a9681305-690b-8645-8931-02c9e7b027a5}\ssmirrdr.inf" "9" "47bd61347" "00000000000000E8" "WinSta0\Default" "0000000000000158" "208" "c:\program files (x86)\common files\supportdotcom\rang"2⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:4396
-
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "2" "211" "ROOT\SSMIRR_DRIVER\0000" "C:\Windows\INF\oem3.inf" "oem3.inf:10ef38c379e44436:ssmirrdr:2.0.0.0:ssmirr_driver," "47bd61347" "00000000000000E8"2⤵
- Drops file in Drivers directory
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:1068
-
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3632
-
C:\Program Files (x86)\supportdotcom\rang\ssrangsv.exe"C:\Program Files (x86)\supportdotcom\rang\ssrangsv.exe" -service "-provider" "supportdotcom"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:2500 -
C:\Program Files (x86)\supportdotcom\rang\ssrangui.exe"ssrangui.exe" -start -ec 1 2764248246 -agentFriendlyName 'ATS Agent'2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies Control Panel
PID:4448
-
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵PID:5164
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
16KB
MD538377a28f213b6bb042e60e4b457f516
SHA10499b92faa65cd1d00640715c998d2500ff4eebc
SHA256ca67f164a2ee8be79fb156ac3cdbc154ea8a761bf49e88197c4c07a3a325a2a9
SHA512e522e4a4157849612017af61b8e6db94c67503872a76fdfa1e342908f9292f296e7e462b8bf02155028e10e1860288bc5acb5490fa7b3136b19d6b8b68fe3319
-
Filesize
251KB
MD5478f2561ec0658265a01993e00ee89f2
SHA13845dc7fd32fb08600ebd5902bc1bd7e7bfa63a1
SHA256d42fa29fd8a06ea428d041a26d4e6831bbf8538f83032e922287832c39b06b86
SHA51282636f4317d561a38134f919d6197abbeea56c2a2c750350148b54fb5b864babd8711876d6e322ffdd12489305ca96b9d209335998b922d2c9e4f198ae84f470
-
Filesize
648B
MD53d44744f7dda4a094b90cff3440b459b
SHA1aa82d2021cf8dd5c209d8b6b230bfd1e85d16682
SHA2565f8ae2ce6ea6355614c263ea5ff63a797a3201decddd39671c67e51057f618ea
SHA51274ac16a4fbb3f45f8fe55c7abd0fb0ac1af0b33cbe29052ae5ae55ca0c9a8c6e2a6cd8d2940076ca71458660bf3722cc422b5b1324b19a08fe1c1f07e77f9f66
-
Filesize
2.2MB
MD58e1f07c8ec91b5c63eccd0c6cb00a027
SHA189afb7d39ed1935f25f8c43b60ab2fdcba58447f
SHA256d82c089a395db0691c1c845b68c1b1743de8985feb47ec5e03f0db80a5c1b195
SHA512138f90453e58a34f53cbd7d1700fbc9377c4d67f55119df5198d5575a1ab07e2d00e51562c14d9f8f8120169f2d977948a06cb600ba16c5d53e141b76e39f497
-
Filesize
1.7MB
MD569d7734b204b81b646d0f8576e7dc8d6
SHA1a37786dcab45c963d44a135db52b21177847508b
SHA25624316fd026bcf76caa990e27e3dfd38126fa5b71763fa576ccab43cba6eafb2e
SHA5120d93c3b9f664c36af3568484352aa09925cf04f9ccdf07bf7a1c7dbd791cbb98b8c18043c8220fce0c9b3defab90586a86d2cddf225980518a3b9e854026c79d
-
Filesize
11KB
MD5c17103ae9072a06da581dec998343fc1
SHA1b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA256dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
SHA512d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
-
Filesize
31KB
MD528b26600204f79045eda8f7fd8ca3c86
SHA1b9f19e36b80eb862370d99b466664380440af6d5
SHA2565140f07b878efd1b74ee9f5821a207d1cee65952702ff75c49a4522face230c6
SHA512aebd4425b846883e1f49da18edf3b7c96a9fb9ddb7ce709938b21eae169bdaeb5ce6bf8593638b5c887b26de7476b793a4691a7d56e46796bb658f1e516ad3c1
-
Filesize
9KB
MD51100066057fbf612b573efd3b21383f1
SHA1f95db83ea936f1fe70583a4eca810da807167dfe
SHA256894f5a999e03807dffea67938d2e456d50d9e5511fe91d2e2293c51d98b3d87d
SHA51262850de88b00daeab3299fec2bbd9aa0b07f766b96f42392310cb4f23c9e50f0aa8bc87f82e28cd99c195ea205a26c083d048cbac3341861dcee4a5eabb9dea8
-
Filesize
8KB
MD531f007d8f2de5e945dc2e2234628bc37
SHA176fb2cd66c869bae25589298a971b458bd06c18e
SHA256a179d2176962ff702eb57417f931deb3e8c9f2cfb61311d767b243e111b83973
SHA512170e8ac2cb4decb9fe07f8811c58155c377fc20af3748bcc33cdb203a2780c749f0cc721ba293874ecab1e0423682679ff7a1bccc26caa185af279796112dc18
-
Filesize
2KB
MD56c4423d9cb9921a25de76b2d9f390f74
SHA15abdfd7b7d0e454a6ac117c90077b3379e48d666
SHA2563cb8307e59f4483ec329cd2b92690a877eb4b3a0c3633c9e012a4f8aac249c82
SHA5129f28e9a824e0983e180bcefdd347ee145c406e920f660622e34bedf5c3b7e7cd083c3f60528f135e341621248a53ad16cca5ebbb6c8b66af166304ab8b94628c