Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
13-08-2024 08:36
Static task
static1
Behavioral task
behavioral1
Sample
Payment Advice-BCS_ECROWNS9522024072510026_AUG_13_2024_PDF.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
Payment Advice-BCS_ECROWNS9522024072510026_AUG_13_2024_PDF.exe
Resource
win10v2004-20240802-en
General
-
Target
Payment Advice-BCS_ECROWNS9522024072510026_AUG_13_2024_PDF.exe
-
Size
1.2MB
-
MD5
d70fa5471771d18888f0861ac060a914
-
SHA1
83ef28ef9e4850629433f497fd0360120449e297
-
SHA256
31a7e70deb8af07d7b76b5dea8cbf90ec63bea24bffdd5ebac6f223c02f55753
-
SHA512
af89922e5a24a12522603e4a034b2e1aef911d5cf6399de426aa95b971dcf70513a99f45033895939f0475d7b001054717c9b0d38278ff45ee2b41376f3da31b
-
SSDEEP
24576:UMa3J1TbjIuI1OHXTXYYPajiFGoI3ajHucOWVQy/vrAFGSi29kQXY1Max2AnE:UMk27eayHaAnE
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
-
ModiLoader Second Stage 1 IoCs
Processes:
resource yara_rule behavioral2/memory/3656-2-0x00000000028E0000-0x00000000038E0000-memory.dmp modiloader_stage2 -
Executes dropped EXE 9 IoCs
Processes:
alpha.pifalpha.pifalpha.pifxpha.pifper.exepha.pifalpha.pifalpha.pifalpha.pifpid Process 3432 alpha.pif 3932 alpha.pif 1360 alpha.pif 3192 xpha.pif 3824 per.exe 3164 pha.pif 1816 alpha.pif 4080 alpha.pif 4472 alpha.pif -
Loads dropped DLL 1 IoCs
Processes:
per.exepid Process 3824 per.exe -
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
Processes:
colorcpl.exedescription ioc Process Key opened \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts colorcpl.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
Payment Advice-BCS_ECROWNS9522024072510026_AUG_13_2024_PDF.exedescription ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Wclbjzkj = "C:\\Users\\Public\\Wclbjzkj.url" Payment Advice-BCS_ECROWNS9522024072510026_AUG_13_2024_PDF.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
colorcpl.exedescription pid Process procid_target PID 3532 set thread context of 4896 3532 colorcpl.exe 117 PID 3532 set thread context of 3192 3532 colorcpl.exe 118 PID 3532 set thread context of 536 3532 colorcpl.exe 120 -
System Location Discovery: System Language Discovery 1 TTPs 13 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
alpha.pifalpha.pifcolorcpl.exePayment Advice-BCS_ECROWNS9522024072510026_AUG_13_2024_PDF.exealpha.pifalpha.pifcolorcpl.execmd.exealpha.pifxpha.pifcolorcpl.exealpha.pifcolorcpl.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language alpha.pif Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language alpha.pif Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language colorcpl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Payment Advice-BCS_ECROWNS9522024072510026_AUG_13_2024_PDF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language alpha.pif Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language alpha.pif Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language colorcpl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language alpha.pif Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xpha.pif Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language colorcpl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language alpha.pif Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language colorcpl.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
-
Processes:
pha.pifdescription ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 190000000100000010000000ea6089055218053dd01e37e1d806eedf0300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e0b00000001000000100000005300650063007400690067006f0000001d0000000100000010000000885010358d29a38f059b028559c95f901400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd253000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd9796254832000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd pha.pif Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E pha.pif Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 0f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd979625483090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd21400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb1d0000000100000010000000885010358d29a38f059b028559c95f900b00000001000000100000005300650063007400690067006f0000000300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e2000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd pha.pif -
Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.
Processes:
description flow ioc HTTP User-Agent header 24 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
pha.pifPayment Advice-BCS_ECROWNS9522024072510026_AUG_13_2024_PDF.execolorcpl.execolorcpl.exepid Process 3164 pha.pif 3164 pha.pif 3656 Payment Advice-BCS_ECROWNS9522024072510026_AUG_13_2024_PDF.exe 3656 Payment Advice-BCS_ECROWNS9522024072510026_AUG_13_2024_PDF.exe 4896 colorcpl.exe 4896 colorcpl.exe 536 colorcpl.exe 536 colorcpl.exe 4896 colorcpl.exe 4896 colorcpl.exe -
Suspicious behavior: MapViewOfSection 4 IoCs
Processes:
colorcpl.exepid Process 3532 colorcpl.exe 3532 colorcpl.exe 3532 colorcpl.exe 3532 colorcpl.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
pha.pifcolorcpl.exedescription pid Process Token: SeDebugPrivilege 3164 pha.pif Token: SeDebugPrivilege 536 colorcpl.exe -
Suspicious use of WriteProcessMemory 58 IoCs
Processes:
Payment Advice-BCS_ECROWNS9522024072510026_AUG_13_2024_PDF.execmd.exealpha.pifper.execolorcpl.exedescription pid Process procid_target PID 3656 wrote to memory of 1756 3656 Payment Advice-BCS_ECROWNS9522024072510026_AUG_13_2024_PDF.exe 94 PID 3656 wrote to memory of 1756 3656 Payment Advice-BCS_ECROWNS9522024072510026_AUG_13_2024_PDF.exe 94 PID 3656 wrote to memory of 1756 3656 Payment Advice-BCS_ECROWNS9522024072510026_AUG_13_2024_PDF.exe 94 PID 1756 wrote to memory of 2456 1756 cmd.exe 96 PID 1756 wrote to memory of 2456 1756 cmd.exe 96 PID 1756 wrote to memory of 2456 1756 cmd.exe 96 PID 1756 wrote to memory of 2568 1756 cmd.exe 97 PID 1756 wrote to memory of 2568 1756 cmd.exe 97 PID 1756 wrote to memory of 2568 1756 cmd.exe 97 PID 1756 wrote to memory of 3432 1756 cmd.exe 98 PID 1756 wrote to memory of 3432 1756 cmd.exe 98 PID 1756 wrote to memory of 3432 1756 cmd.exe 98 PID 1756 wrote to memory of 3932 1756 cmd.exe 99 PID 1756 wrote to memory of 3932 1756 cmd.exe 99 PID 1756 wrote to memory of 3932 1756 cmd.exe 99 PID 1756 wrote to memory of 1360 1756 cmd.exe 100 PID 1756 wrote to memory of 1360 1756 cmd.exe 100 PID 1756 wrote to memory of 1360 1756 cmd.exe 100 PID 1360 wrote to memory of 3192 1360 alpha.pif 101 PID 1360 wrote to memory of 3192 1360 alpha.pif 101 PID 1360 wrote to memory of 3192 1360 alpha.pif 101 PID 1756 wrote to memory of 3824 1756 cmd.exe 102 PID 1756 wrote to memory of 3824 1756 cmd.exe 102 PID 3824 wrote to memory of 728 3824 per.exe 103 PID 3824 wrote to memory of 728 3824 per.exe 103 PID 3824 wrote to memory of 3164 3824 per.exe 105 PID 3824 wrote to memory of 3164 3824 per.exe 105 PID 1756 wrote to memory of 1816 1756 cmd.exe 107 PID 1756 wrote to memory of 1816 1756 cmd.exe 107 PID 1756 wrote to memory of 1816 1756 cmd.exe 107 PID 1756 wrote to memory of 4080 1756 cmd.exe 108 PID 1756 wrote to memory of 4080 1756 cmd.exe 108 PID 1756 wrote to memory of 4080 1756 cmd.exe 108 PID 1756 wrote to memory of 4472 1756 cmd.exe 109 PID 1756 wrote to memory of 4472 1756 cmd.exe 109 PID 1756 wrote to memory of 4472 1756 cmd.exe 109 PID 3656 wrote to memory of 4904 3656 Payment Advice-BCS_ECROWNS9522024072510026_AUG_13_2024_PDF.exe 114 PID 3656 wrote to memory of 4904 3656 Payment Advice-BCS_ECROWNS9522024072510026_AUG_13_2024_PDF.exe 114 PID 3656 wrote to memory of 4904 3656 Payment Advice-BCS_ECROWNS9522024072510026_AUG_13_2024_PDF.exe 114 PID 3656 wrote to memory of 3532 3656 Payment Advice-BCS_ECROWNS9522024072510026_AUG_13_2024_PDF.exe 116 PID 3656 wrote to memory of 3532 3656 Payment Advice-BCS_ECROWNS9522024072510026_AUG_13_2024_PDF.exe 116 PID 3656 wrote to memory of 3532 3656 Payment Advice-BCS_ECROWNS9522024072510026_AUG_13_2024_PDF.exe 116 PID 3656 wrote to memory of 3532 3656 Payment Advice-BCS_ECROWNS9522024072510026_AUG_13_2024_PDF.exe 116 PID 3532 wrote to memory of 4896 3532 colorcpl.exe 117 PID 3532 wrote to memory of 4896 3532 colorcpl.exe 117 PID 3532 wrote to memory of 4896 3532 colorcpl.exe 117 PID 3532 wrote to memory of 4896 3532 colorcpl.exe 117 PID 3532 wrote to memory of 3192 3532 colorcpl.exe 118 PID 3532 wrote to memory of 3192 3532 colorcpl.exe 118 PID 3532 wrote to memory of 3192 3532 colorcpl.exe 118 PID 3532 wrote to memory of 3192 3532 colorcpl.exe 118 PID 3532 wrote to memory of 4624 3532 colorcpl.exe 119 PID 3532 wrote to memory of 4624 3532 colorcpl.exe 119 PID 3532 wrote to memory of 4624 3532 colorcpl.exe 119 PID 3532 wrote to memory of 536 3532 colorcpl.exe 120 PID 3532 wrote to memory of 536 3532 colorcpl.exe 120 PID 3532 wrote to memory of 536 3532 colorcpl.exe 120 PID 3532 wrote to memory of 536 3532 colorcpl.exe 120
Processes
-
C:\Users\Admin\AppData\Local\Temp\Payment Advice-BCS_ECROWNS9522024072510026_AUG_13_2024_PDF.exe"C:\Users\Admin\AppData\Local\Temp\Payment Advice-BCS_ECROWNS9522024072510026_AUG_13_2024_PDF.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3656 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Public\Libraries\jkzjblcW.cmd" "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1756 -
C:\Windows\SysWOW64\esentutl.exeC:\\Windows\\System32\\esentutl /y C:\\Windows\\System32\\cmd.exe /d C:\\Users\\Public\\alpha.pif /o3⤵PID:2456
-
-
C:\Windows\SysWOW64\esentutl.exeC:\\Windows\\System32\\esentutl /y C:\\Windows\\System32\\ping.exe /d C:\\Users\\Public\\xpha.pif /o3⤵
- System Network Configuration Discovery: Internet Connection Discovery
PID:2568
-
-
C:\Users\Public\alpha.pifC:\\Users\\Public\\alpha.pif /c mkdir "\\?\C:\Windows "3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3432
-
-
C:\Users\Public\alpha.pifC:\\Users\\Public\\alpha.pif /c mkdir "\\?\C:\Windows \SysWOW64"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3932
-
-
C:\Users\Public\alpha.pifC:\\Users\\Public\\alpha.pif /c C:\\Users\\Public\\xpha.pif 127.0.0.1 -n 103⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1360 -
C:\Users\Public\xpha.pifC:\\Users\\Public\\xpha.pif 127.0.0.1 -n 104⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3192
-
-
-
C:\Windows \SysWOW64\per.exe"C:\\Windows \\SysWOW64\\per.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3824 -
C:\Windows\SYSTEM32\esentutl.exeesentutl /y C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe /d C:\\Users\\Public\\pha.pif /o4⤵PID:728
-
-
C:\Users\Public\pha.pifC:\\Users\\Public\\pha.pif -WindowStyle hidden -Command Add-MpPreference -ExclusionExtension '.exe','bat','.pif'4⤵
- Executes dropped EXE
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3164
-
-
-
C:\Users\Public\alpha.pifC:\\Users\\Public\\alpha.pif /c del "C:\Users\Public\xpha.pif"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1816
-
-
C:\Users\Public\alpha.pifC:\\Users\\Public\\alpha.pif /c rmdir "C:\Windows \SysWOW643⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4080
-
-
C:\Users\Public\alpha.pifC:\\Users\\Public\\alpha.pif /c rmdir "C:\Windows \"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4472
-
-
-
C:\Windows\SysWOW64\esentutl.exeC:\\Windows\\System32\\esentutl.exe /y C:\Users\Admin\AppData\Local\Temp\Payment Advice-BCS_ECROWNS9522024072510026_AUG_13_2024_PDF.exe /d C:\\Users\\Public\\Libraries\\Wclbjzkj.PIF /o2⤵PID:4904
-
-
C:\Windows\SysWOW64\colorcpl.exeC:\Windows\System32\colorcpl.exe2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3532 -
C:\Windows\SysWOW64\colorcpl.exeC:\Windows\SysWOW64\colorcpl.exe /stext "C:\Users\Admin\AppData\Local\Temp\nzvtjehfyc"3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4896
-
-
C:\Windows\SysWOW64\colorcpl.exeC:\Windows\SysWOW64\colorcpl.exe /stext "C:\Users\Admin\AppData\Local\Temp\xubmkxshmkiqc"3⤵
- Accesses Microsoft Outlook accounts
- System Location Discovery: System Language Discovery
PID:3192
-
-
C:\Windows\SysWOW64\colorcpl.exeC:\Windows\SysWOW64\colorcpl.exe /stext "C:\Users\Admin\AppData\Local\Temp\awoekpdaasavmwovr"3⤵PID:4624
-
-
C:\Windows\SysWOW64\colorcpl.exeC:\Windows\SysWOW64\colorcpl.exe /stext "C:\Users\Admin\AppData\Local\Temp\awoekpdaasavmwovr"3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:536
-
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Modify Registry
2Subvert Trust Controls
1Install Root Certificate
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
146B
MD5476b0bc82c3d0201373a1ce713f1fccb
SHA131a21feac18297b427487b16f57489bbc5761b5e
SHA256f148ab05d411137381cb20452316729e3abe646035fedc0c8fc6ad25797fcba1
SHA512cab717eed38af22406b972c8dd0bef9d9e8682ea83e612f206dcebdafd39c89c83e7e94a54b35a5201100ec35e77e2cdd9a567e3bcee9b488b7f99f1768b0440
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
4KB
MD58b8277c8f03c24d1f290dbe476e961d2
SHA12e13baf3a4b708277d550dc3dd1e0f99b131f78e
SHA2569af6881f6dbffba028a7a977f4c0a43c764f840332986993ad66de7b816c2f9e
SHA5127367a0236cd0d6cd731caf1ba1f4ea8f851ea1018a9c6b49db6e9d13b2aaba92767774da9169481918e4287021ff5c3a58c3143eaa5e7fe9fa88383208615948
-
Filesize
60KB
MD5b87f096cbc25570329e2bb59fee57580
SHA1d281d1bf37b4fb46f90973afc65eece3908532b2
SHA256d08ccc9b1e3acc205fe754bad8416964e9711815e9ceed5e6af73d8e9035ec9e
SHA51272901adde38f50cf6d74743c0a546c0fea8b1cd4a18449048a0758a7593a176fc33aad1ebfd955775eefc2b30532bcc18e4f2964b3731b668dd87d94405951f7
-
Filesize
231KB
MD5d0fce3afa6aa1d58ce9fa336cc2b675b
SHA14048488de6ba4bfef9edf103755519f1f762668f
SHA2564d89fc34d5f0f9babd022271c585a9477bf41e834e46b991deaa0530fdb25e22
SHA51280e127ef81752cd50f9ea2d662dc4d3bf8db8d29680e75fa5fc406ca22cafa5c4d89ef2eac65b486413d3cdd57a2c12a1cb75f65d1e312a717d262265736d1c2
-
Filesize
442KB
MD504029e121a0cfa5991749937dd22a1d9
SHA1f43d9bb316e30ae1a3494ac5b0624f6bea1bf054
SHA2569f914d42706fe215501044acd85a32d58aaef1419d404fddfa5d3b48f66ccd9f
SHA5126a2fb055473033fd8fdb8868823442875b5b60c115031aaeda688a35a092f6278e8687e2ae2b8dc097f8f3f35d23959757bf0c408274a2ef5f40ddfa4b5c851b
-
Filesize
18KB
MD5b3624dd758ccecf93a1226cef252ca12
SHA1fcf4dad8c4ad101504b1bf47cbbddbac36b558a7
SHA2564aaa74f294c15aeb37ada8185d0dead58bd87276a01a814abc0c4b40545bf2ef
SHA512c613d18511b00fa25fc7b1bdde10d96debb42a99b5aaab9e9826538d0e229085bb371f0197f6b1086c4f9c605f01e71287ffc5442f701a95d67c232a5f031838
-
Filesize
115KB
MD5c5db31551cb21105e3f0b3e467b91cc7
SHA1c66fd7732973d9803ba0fd4323e8507876892310
SHA2563fa23d8f7b7eeac6443e107bd70d0c6371afc1f8082d3d58fffd8685cf9e2193
SHA5126d1ee4b55fb74dc093f52caf1e093ec2742af263ff8fa264cd61eea48c021c3438150ba12a8e9d694e7246fe296ea011d8b6313e8ee4476a63c7072c2990685e
-
Filesize
94KB
MD5869640d0a3f838694ab4dfea9e2f544d
SHA1bdc42b280446ba53624ff23f314aadb861566832
SHA2560db4d3ffdb96d13cf3b427af8be66d985728c55ae254e4b67d287797e4c0b323
SHA5126e775cfb350415434b18427d5ff79b930ed3b0b3fc3466bc195a796c95661d4696f2d662dd0e020c3a6c3419c2734468b1d7546712ecec868d2bbfd2bc2468a7