Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
13-08-2024 08:36
Static task
static1
Behavioral task
behavioral1
Sample
PAYMENT TRANSFER ERROR.PDF.bat
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
PAYMENT TRANSFER ERROR.PDF.bat
Resource
win10v2004-20240802-en
General
-
Target
PAYMENT TRANSFER ERROR.PDF.bat
-
Size
6.1MB
-
MD5
9981f8d217254ed2a4cb7a3356535cd5
-
SHA1
7ae24e3a9c0a28901c24958a17bdf8b344eab454
-
SHA256
de6f03e7fe7a7c5aa0462d01bd825650bd44acb38e130fc106de4b2c63d7f046
-
SHA512
6f2168d9e024df2e0e196ecc5896bd42046c16e0dae8bf20c6f16ae7f46ce89f88730847cb878dfe4079a851405456a8ad024a35f2642ed8442c721172465ac2
-
SSDEEP
49152:W8rzn3QeR6gIn+Sk954nuF83R5H93MUJBHeMrdrekrLwptyyD4kA+mfMea6Nc6:+
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
-
ModiLoader Second Stage 1 IoCs
Processes:
resource yara_rule behavioral2/memory/2364-29-0x0000000002920000-0x0000000003920000-memory.dmp modiloader_stage2 -
Executes dropped EXE 17 IoCs
Processes:
alpha.exealpha.exekn.exealpha.exekn.exeAHA.COMalpha.exealpha.exealpha.pifalpha.pifalpha.pifxpha.pifper.exepha.pifalpha.pifalpha.pifalpha.pifpid Process 1116 alpha.exe 4876 alpha.exe 5032 kn.exe 3676 alpha.exe 1668 kn.exe 2364 AHA.COM 4796 alpha.exe 2784 alpha.exe 3128 alpha.pif 1064 alpha.pif 4440 alpha.pif 3956 xpha.pif 1672 per.exe 2236 pha.pif 232 alpha.pif 1844 alpha.pif 5056 alpha.pif -
Loads dropped DLL 1 IoCs
Processes:
per.exepid Process 1672 per.exe -
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
Processes:
SndVol.exedescription ioc Process Key opened \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts SndVol.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
AHA.COMdescription ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Wclbjzkj = "C:\\Users\\Public\\Wclbjzkj.url" AHA.COM -
Suspicious use of SetThreadContext 3 IoCs
Processes:
SndVol.exedescription pid Process procid_target PID 1660 set thread context of 2892 1660 SndVol.exe 129 PID 1660 set thread context of 1116 1660 SndVol.exe 131 PID 1660 set thread context of 3668 1660 SndVol.exe 132 -
System Location Discovery: System Language Discovery 1 TTPs 13 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
alpha.pifSndVol.exeSndVol.exealpha.pifalpha.pifSndVol.execmd.exealpha.pifxpha.pifalpha.pifAHA.COMalpha.pifSndVol.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language alpha.pif Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SndVol.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SndVol.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language alpha.pif Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language alpha.pif Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SndVol.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language alpha.pif Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xpha.pif Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language alpha.pif Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AHA.COM Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language alpha.pif Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SndVol.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
-
Processes:
pha.pifdescription ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E pha.pif Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 0f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd979625483090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd21400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb1d0000000100000010000000885010358d29a38f059b028559c95f900b00000001000000100000005300650063007400690067006f0000000300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e2000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd pha.pif Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 190000000100000010000000ea6089055218053dd01e37e1d806eedf0300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e0b00000001000000100000005300650063007400690067006f0000001d0000000100000010000000885010358d29a38f059b028559c95f901400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd253000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd9796254832000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd pha.pif -
Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.
Processes:
description flow ioc HTTP User-Agent header 24 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
pha.pifAHA.COMSndVol.exeSndVol.exepid Process 2236 pha.pif 2236 pha.pif 2364 AHA.COM 2364 AHA.COM 2892 SndVol.exe 2892 SndVol.exe 3668 SndVol.exe 3668 SndVol.exe 2892 SndVol.exe 2892 SndVol.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
SndVol.exepid Process 1660 SndVol.exe 1660 SndVol.exe 1660 SndVol.exe 1660 SndVol.exe 1660 SndVol.exe 1660 SndVol.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
pha.pifSndVol.exedescription pid Process Token: SeDebugPrivilege 2236 pha.pif Token: SeDebugPrivilege 3668 SndVol.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
SndVol.exepid Process 1660 SndVol.exe -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
SndVol.exepid Process 1660 SndVol.exe 1660 SndVol.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
cmd.exealpha.exealpha.exealpha.exeAHA.COMcmd.exealpha.pifper.exedescription pid Process procid_target PID 5044 wrote to memory of 1856 5044 cmd.exe 87 PID 5044 wrote to memory of 1856 5044 cmd.exe 87 PID 5044 wrote to memory of 1116 5044 cmd.exe 89 PID 5044 wrote to memory of 1116 5044 cmd.exe 89 PID 1116 wrote to memory of 1012 1116 alpha.exe 90 PID 1116 wrote to memory of 1012 1116 alpha.exe 90 PID 5044 wrote to memory of 4876 5044 cmd.exe 91 PID 5044 wrote to memory of 4876 5044 cmd.exe 91 PID 4876 wrote to memory of 5032 4876 alpha.exe 92 PID 4876 wrote to memory of 5032 4876 alpha.exe 92 PID 5044 wrote to memory of 3676 5044 cmd.exe 93 PID 5044 wrote to memory of 3676 5044 cmd.exe 93 PID 3676 wrote to memory of 1668 3676 alpha.exe 94 PID 3676 wrote to memory of 1668 3676 alpha.exe 94 PID 5044 wrote to memory of 2364 5044 cmd.exe 95 PID 5044 wrote to memory of 2364 5044 cmd.exe 95 PID 5044 wrote to memory of 2364 5044 cmd.exe 95 PID 5044 wrote to memory of 4796 5044 cmd.exe 96 PID 5044 wrote to memory of 4796 5044 cmd.exe 96 PID 5044 wrote to memory of 2784 5044 cmd.exe 97 PID 5044 wrote to memory of 2784 5044 cmd.exe 97 PID 2364 wrote to memory of 4684 2364 AHA.COM 105 PID 2364 wrote to memory of 4684 2364 AHA.COM 105 PID 2364 wrote to memory of 4684 2364 AHA.COM 105 PID 4684 wrote to memory of 1984 4684 cmd.exe 107 PID 4684 wrote to memory of 1984 4684 cmd.exe 107 PID 4684 wrote to memory of 1984 4684 cmd.exe 107 PID 4684 wrote to memory of 1964 4684 cmd.exe 108 PID 4684 wrote to memory of 1964 4684 cmd.exe 108 PID 4684 wrote to memory of 1964 4684 cmd.exe 108 PID 4684 wrote to memory of 3128 4684 cmd.exe 109 PID 4684 wrote to memory of 3128 4684 cmd.exe 109 PID 4684 wrote to memory of 3128 4684 cmd.exe 109 PID 4684 wrote to memory of 1064 4684 cmd.exe 110 PID 4684 wrote to memory of 1064 4684 cmd.exe 110 PID 4684 wrote to memory of 1064 4684 cmd.exe 110 PID 4684 wrote to memory of 4440 4684 cmd.exe 111 PID 4684 wrote to memory of 4440 4684 cmd.exe 111 PID 4684 wrote to memory of 4440 4684 cmd.exe 111 PID 4440 wrote to memory of 3956 4440 alpha.pif 112 PID 4440 wrote to memory of 3956 4440 alpha.pif 112 PID 4440 wrote to memory of 3956 4440 alpha.pif 112 PID 4684 wrote to memory of 1672 4684 cmd.exe 113 PID 4684 wrote to memory of 1672 4684 cmd.exe 113 PID 1672 wrote to memory of 3624 1672 per.exe 114 PID 1672 wrote to memory of 3624 1672 per.exe 114 PID 1672 wrote to memory of 2236 1672 per.exe 117 PID 1672 wrote to memory of 2236 1672 per.exe 117 PID 4684 wrote to memory of 232 4684 cmd.exe 119 PID 4684 wrote to memory of 232 4684 cmd.exe 119 PID 4684 wrote to memory of 232 4684 cmd.exe 119 PID 4684 wrote to memory of 1844 4684 cmd.exe 120 PID 4684 wrote to memory of 1844 4684 cmd.exe 120 PID 4684 wrote to memory of 1844 4684 cmd.exe 120 PID 4684 wrote to memory of 5056 4684 cmd.exe 121 PID 4684 wrote to memory of 5056 4684 cmd.exe 121 PID 4684 wrote to memory of 5056 4684 cmd.exe 121 PID 2364 wrote to memory of 744 2364 AHA.COM 124 PID 2364 wrote to memory of 744 2364 AHA.COM 124 PID 2364 wrote to memory of 744 2364 AHA.COM 124 PID 2364 wrote to memory of 1660 2364 AHA.COM 126 PID 2364 wrote to memory of 1660 2364 AHA.COM 126 PID 2364 wrote to memory of 1660 2364 AHA.COM 126 PID 2364 wrote to memory of 1660 2364 AHA.COM 126
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\PAYMENT TRANSFER ERROR.PDF.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:5044 -
C:\Windows\System32\extrac32.exeC:\\Windows\\System32\\extrac32 /C /Y C:\\Windows\\System32\\cmd.exe "C:\\Users\\Public\\alpha.exe"2⤵PID:1856
-
-
C:\Users\Public\alpha.exeC:\\Users\\Public\\alpha /c extrac32 /C /Y C:\\Windows\\System32\\certutil.exe C:\\Users\\Public\\kn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1116 -
C:\Windows\system32\extrac32.exeextrac32 /C /Y C:\\Windows\\System32\\certutil.exe C:\\Users\\Public\\kn.exe3⤵PID:1012
-
-
-
C:\Users\Public\alpha.exeC:\\Users\\Public\\alpha /c C:\\Users\\Public\\kn -decodehex -F "C:\Users\Admin\AppData\Local\Temp\PAYMENT TRANSFER ERROR.PDF.bat" "C:\\Users\\Public\\AHA.GIF" 32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4876 -
C:\Users\Public\kn.exeC:\\Users\\Public\\kn -decodehex -F "C:\Users\Admin\AppData\Local\Temp\PAYMENT TRANSFER ERROR.PDF.bat" "C:\\Users\\Public\\AHA.GIF" 33⤵
- Executes dropped EXE
PID:5032
-
-
-
C:\Users\Public\alpha.exeC:\\Users\\Public\\alpha /c C:\\Users\\Public\\kn -decodehex -F "C:\\Users\\Public\\AHA.GIF" "C:\\Users\\Public\\Libraries\\AHA.COM" 102⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3676 -
C:\Users\Public\kn.exeC:\\Users\\Public\\kn -decodehex -F "C:\\Users\\Public\\AHA.GIF" "C:\\Users\\Public\\Libraries\\AHA.COM" 103⤵
- Executes dropped EXE
PID:1668
-
-
-
C:\Users\Public\Libraries\AHA.COMC:\Users\Public\Libraries\AHA.COM2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2364 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Public\Libraries\jkzjblcW.cmd" "3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4684 -
C:\Windows\SysWOW64\esentutl.exeC:\\Windows\\System32\\esentutl /y C:\\Windows\\System32\\cmd.exe /d C:\\Users\\Public\\alpha.pif /o4⤵PID:1984
-
-
C:\Windows\SysWOW64\esentutl.exeC:\\Windows\\System32\\esentutl /y C:\\Windows\\System32\\ping.exe /d C:\\Users\\Public\\xpha.pif /o4⤵
- System Network Configuration Discovery: Internet Connection Discovery
PID:1964
-
-
C:\Users\Public\alpha.pifC:\\Users\\Public\\alpha.pif /c mkdir "\\?\C:\Windows "4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3128
-
-
C:\Users\Public\alpha.pifC:\\Users\\Public\\alpha.pif /c mkdir "\\?\C:\Windows \SysWOW64"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1064
-
-
C:\Users\Public\alpha.pifC:\\Users\\Public\\alpha.pif /c C:\\Users\\Public\\xpha.pif 127.0.0.1 -n 104⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4440 -
C:\Users\Public\xpha.pifC:\\Users\\Public\\xpha.pif 127.0.0.1 -n 105⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3956
-
-
-
C:\Windows \SysWOW64\per.exe"C:\\Windows \\SysWOW64\\per.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1672 -
C:\Windows\SYSTEM32\esentutl.exeesentutl /y C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe /d C:\\Users\\Public\\pha.pif /o5⤵PID:3624
-
-
C:\Users\Public\pha.pifC:\\Users\\Public\\pha.pif -WindowStyle hidden -Command Add-MpPreference -ExclusionExtension '.exe','bat','.pif'5⤵
- Executes dropped EXE
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2236
-
-
-
C:\Users\Public\alpha.pifC:\\Users\\Public\\alpha.pif /c del "C:\Users\Public\xpha.pif"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:232
-
-
C:\Users\Public\alpha.pifC:\\Users\\Public\\alpha.pif /c rmdir "C:\Windows \SysWOW644⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1844
-
-
C:\Users\Public\alpha.pifC:\\Users\\Public\\alpha.pif /c rmdir "C:\Windows \"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5056
-
-
-
C:\Windows\SysWOW64\esentutl.exeC:\\Windows\\System32\\esentutl.exe /y C:\Users\Public\Libraries\AHA.COM /d C:\\Users\\Public\\Libraries\\Wclbjzkj.PIF /o3⤵PID:744
-
-
C:\Windows\SysWOW64\SndVol.exeC:\Windows\System32\SndVol.exe3⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1660 -
C:\Windows\SysWOW64\SndVol.exeC:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\emiy"4⤵PID:4348
-
-
C:\Windows\SysWOW64\SndVol.exeC:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\emiy"4⤵PID:4440
-
-
C:\Windows\SysWOW64\SndVol.exeC:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\emiy"4⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2892
-
-
C:\Windows\SysWOW64\SndVol.exeC:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\ppnitxd"4⤵PID:1572
-
-
C:\Windows\SysWOW64\SndVol.exeC:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\ppnitxd"4⤵
- Accesses Microsoft Outlook accounts
- System Location Discovery: System Language Discovery
PID:1116
-
-
C:\Windows\SysWOW64\SndVol.exeC:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\rjtbupnzxe"4⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3668
-
-
-
-
C:\Users\Public\alpha.exeC:\\Users\\Public\\alpha /c del /q "C:\Users\Public\kn.exe" / A / F / Q / S2⤵
- Executes dropped EXE
PID:4796
-
-
C:\Users\Public\alpha.exeC:\\Users\\Public\\alpha /c del /q "C:\Users\Public\AHA.GIF" / A / F / Q / S2⤵
- Executes dropped EXE
PID:2784
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Modify Registry
2Subvert Trust Controls
1Install Root Certificate
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
222B
MD5e8ac82413558862717d0c2c86eb86ef1
SHA10dfb235814745e6cd6c3ead4fe2f4a4278086ec0
SHA2560717378fe2be81cfb2641e32892fb02d41fb93945aae9f4df90f48e2d9005675
SHA512fc3916fb21c72f397bac4c02d96ef67b67f75471bd2c9e62f7fc98803dc50199ea55fecb54435577e819d4abe8a4acfb6faa1c7774b2f5ad629909bcfb79cb2e
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
4KB
MD5faaa2b16df1bfc1a3792faaa35786349
SHA1359534a59d7c5139ae205c24533ba60afdfb9f3f
SHA2563586befc3b8b4da223e2ee0dcb00965ba5c0a205c14f2acefdeec7e46efddd5a
SHA5122fbc79cace52a58e69ab983d034bb41ebb2496f767e18e5e4b31eefc4447c935d8614f744c71302e459350a05562fadc4c2355d76638b595e7cff1bb3d1618db
-
Filesize
4.2MB
MD52ddfa3ebd56847d40e59f092be0e6568
SHA13e56b1a986cd5600bc8dd134f1ff2ce5dbd53827
SHA25611693a473afe426024135c37b1013491c2e98d89e6c9da6edfcc0a8c28bf1d02
SHA51292816361505672a82452ed2036120a3d45e6abfa52577db819ba56318109da5242428bdf521751d6832976bc63831ddbaf0c10ad6563d26ed7b177f276421652
-
Filesize
1.2MB
MD5d70fa5471771d18888f0861ac060a914
SHA183ef28ef9e4850629433f497fd0360120449e297
SHA25631a7e70deb8af07d7b76b5dea8cbf90ec63bea24bffdd5ebac6f223c02f55753
SHA512af89922e5a24a12522603e4a034b2e1aef911d5cf6399de426aa95b971dcf70513a99f45033895939f0475d7b001054717c9b0d38278ff45ee2b41376f3da31b
-
Filesize
60KB
MD5b87f096cbc25570329e2bb59fee57580
SHA1d281d1bf37b4fb46f90973afc65eece3908532b2
SHA256d08ccc9b1e3acc205fe754bad8416964e9711815e9ceed5e6af73d8e9035ec9e
SHA51272901adde38f50cf6d74743c0a546c0fea8b1cd4a18449048a0758a7593a176fc33aad1ebfd955775eefc2b30532bcc18e4f2964b3731b668dd87d94405951f7
-
Filesize
283KB
MD58a2122e8162dbef04694b9c3e0b6cdee
SHA1f1efb0fddc156e4c61c5f78a54700e4e7984d55d
SHA256b99d61d874728edc0918ca0eb10eab93d381e7367e377406e65963366c874450
SHA51299e784141193275d4364ba1b8762b07cc150ca3cb7e9aa1d4386ba1fa87e073d0500e61572f8d1b071f2faa2a51bb123e12d9d07054b59a1a2fd768ad9f24397
-
Filesize
231KB
MD5d0fce3afa6aa1d58ce9fa336cc2b675b
SHA14048488de6ba4bfef9edf103755519f1f762668f
SHA2564d89fc34d5f0f9babd022271c585a9477bf41e834e46b991deaa0530fdb25e22
SHA51280e127ef81752cd50f9ea2d662dc4d3bf8db8d29680e75fa5fc406ca22cafa5c4d89ef2eac65b486413d3cdd57a2c12a1cb75f65d1e312a717d262265736d1c2
-
Filesize
1.6MB
MD5bd8d9943a9b1def98eb83e0fa48796c2
SHA170e89852f023ab7cde0173eda1208dbb580f1e4f
SHA2568de7b4eb1301d6cbe4ea2c8d13b83280453eb64e3b3c80756bbd1560d65ca4d2
SHA51295630fdddad5db60cc97ec76ee1ca02dbb00ee3de7d6957ecda8968570e067ab2a9df1cc07a3ce61161a994acbe8417c83661320b54d04609818009a82552f7b
-
Filesize
442KB
MD504029e121a0cfa5991749937dd22a1d9
SHA1f43d9bb316e30ae1a3494ac5b0624f6bea1bf054
SHA2569f914d42706fe215501044acd85a32d58aaef1419d404fddfa5d3b48f66ccd9f
SHA5126a2fb055473033fd8fdb8868823442875b5b60c115031aaeda688a35a092f6278e8687e2ae2b8dc097f8f3f35d23959757bf0c408274a2ef5f40ddfa4b5c851b
-
Filesize
18KB
MD5b3624dd758ccecf93a1226cef252ca12
SHA1fcf4dad8c4ad101504b1bf47cbbddbac36b558a7
SHA2564aaa74f294c15aeb37ada8185d0dead58bd87276a01a814abc0c4b40545bf2ef
SHA512c613d18511b00fa25fc7b1bdde10d96debb42a99b5aaab9e9826538d0e229085bb371f0197f6b1086c4f9c605f01e71287ffc5442f701a95d67c232a5f031838
-
Filesize
115KB
MD5c5db31551cb21105e3f0b3e467b91cc7
SHA1c66fd7732973d9803ba0fd4323e8507876892310
SHA2563fa23d8f7b7eeac6443e107bd70d0c6371afc1f8082d3d58fffd8685cf9e2193
SHA5126d1ee4b55fb74dc093f52caf1e093ec2742af263ff8fa264cd61eea48c021c3438150ba12a8e9d694e7246fe296ea011d8b6313e8ee4476a63c7072c2990685e
-
Filesize
94KB
MD5869640d0a3f838694ab4dfea9e2f544d
SHA1bdc42b280446ba53624ff23f314aadb861566832
SHA2560db4d3ffdb96d13cf3b427af8be66d985728c55ae254e4b67d287797e4c0b323
SHA5126e775cfb350415434b18427d5ff79b930ed3b0b3fc3466bc195a796c95661d4696f2d662dd0e020c3a6c3419c2734468b1d7546712ecec868d2bbfd2bc2468a7