Overview
overview
10Static
static
10R B X 1 2 5.rar
windows7-x64
5R B X 1 2 5.rar
windows10-2004-x64
3R B X 1 2 ...nt.exe
windows7-x64
1R B X 1 2 ...nt.exe
windows10-2004-x64
3R B X 1 2 ...or.exe
windows7-x64
7R B X 1 2 ...or.exe
windows10-2004-x64
10R B X 1 2 5/ai.cfg
windows7-x64
3R B X 1 2 5/ai.cfg
windows10-2004-x64
3R B X 1 2 ...rt.pem
windows7-x64
3R B X 1 2 ...rt.pem
windows10-2004-x64
3R B X 1 2 ...ig.vdf
windows7-x64
3R B X 1 2 ...ig.vdf
windows10-2004-x64
3Analysis
-
max time kernel
150s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
15-08-2024 11:22
Behavioral task
behavioral1
Sample
R B X 1 2 5.rar
Resource
win7-20240704-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
R B X 1 2 5.rar
Resource
win10v2004-20240802-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral3
Sample
R B X 1 2 5/Client.exe
Resource
win7-20240708-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
R B X 1 2 5/Client.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral5
Sample
R B X 1 2 5/Roblox Executor.exe
Resource
win7-20240704-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral6
Sample
R B X 1 2 5/Roblox Executor.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral7
Sample
R B X 1 2 5/ai.cfg
Resource
win7-20240704-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral8
Sample
R B X 1 2 5/ai.cfg
Resource
win10v2004-20240802-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral9
Sample
R B X 1 2 5/cacert.pem
Resource
win7-20240729-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral10
Sample
R B X 1 2 5/cacert.pem
Resource
win10v2004-20240802-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral11
Sample
R B X 1 2 5/config.vdf
Resource
win7-20240708-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral12
Sample
R B X 1 2 5/config.vdf
Resource
win10v2004-20240802-en
windows10-2004-x64
3 signatures
150 seconds
General
-
Target
R B X 1 2 5.rar
-
Size
9.7MB
-
MD5
775d1f7409c0507d2864d7bd283ef914
-
SHA1
fc28466f13da0f88cde02bd70b79e8a3f093c4e3
-
SHA256
0bf30e9e9446bb909d3459669312f5982f6af0a3dd1d61eb141c386785b52331
-
SHA512
f3e190834aca8fa56683148ce012622360fdc575eccb6a667021df6d92cd260a57689fc7b9ca3ff47bcbeac1f2f4a8679fb46228751e8756a6925f4018cf6573
-
SSDEEP
196608:pzg44wZIYG1SyNmDfJjO8pMjHWXjBawNBxm2gMTHNV4Y/ry++jn5H9I:m5wZIL1TCEXjHwBawzxNnrG5j5G
Score
5/10
Malware Config
Signatures
-
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat SearchProtocolHost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\SampleRes.dll,-118 = "Sleep Away" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000803decd905efda01 SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006024f8d905efda01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Direct3D SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection" SearchIndexer.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script" SearchProtocolHost.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\NvpClientsCount = "32" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\MCTRes.dll,-200016 = "USA.gov" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\SampleRes.dll,-117 = "Maid with the Flaxen Hair" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\SampleRes.dll,-142 = "Wildlife" SearchProtocolHost.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\CommitMaxCheckPointPageCount = "7" SearchProtocolHost.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\LogInitialPageCount = "16" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\MCTRes.dll,-200005 = "Websites for United States" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008052f2cd05efda01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\SampleRes.dll,-106 = "Tulips" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer SearchFilterHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000604ab0dd05efda01 SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{993BE281-6695-4BA5-8A2A-7AACBFAAB69E} {0000013A-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000e0cc64cc05efda01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\xpsrchvw.exe,-106 = "XPS Document" SearchProtocolHost.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\ShadowFileMaxClients = "32" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones SearchIndexer.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine" SearchIndexer.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000048efd305efda01 SearchProtocolHost.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\NvpRecWaitForCounts = "32" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JScript Script File" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections SearchIndexer.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\MCTRes.dll,-200017 = "GobiernoUSA.gov" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration" SearchIndexer.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\SampleRes.dll,-103 = "Hydrangeas" SearchProtocolHost.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\CacheHashTableSize = "67" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration" SearchIndexer.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\SampleRes.dll,-101 = "Chrysanthemum" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Direct3D\MostRecentApplication SearchFilterHost.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\FileGrowthBudgetMs = "45000" SearchProtocolHost.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\CommitMaxCheckPoitnRateMs = "10000" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\My SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Multimedia SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie SearchFilterHost.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\FileInlineGrowthQuantumSeconds = "30" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\System32\isoburn.exe,-350 = "Disc Image File" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\eHome\ehepgres.dll,-304 = "Public Recorded TV" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration" SearchIndexer.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\SampleRes.dll,-108 = "Penguins" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 SearchIndexer.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration" SearchIndexer.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000204769ef05efda01 SearchProtocolHost.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\FileDiscontinuitiesPerSecond = "20" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\eHome\ehepgres.dll,-312 = "Sample Media" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\eHome\ehepgres.dll,-308 = "Landscapes" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 SearchProtocolHost.exe -
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_Classes\Local Settings rundll32.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 692 vlc.exe -
Suspicious behavior: EnumeratesProcesses 23 IoCs
pid Process 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 4 IoCs
pid Process 2744 rundll32.exe 3060 rundll32.exe 692 vlc.exe 2872 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeManageVolumePrivilege 1628 SearchIndexer.exe Token: 33 1628 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 1628 SearchIndexer.exe Token: SeDebugPrivilege 2872 taskmgr.exe -
Suspicious use of FindShellTrayWindow 63 IoCs
pid Process 692 vlc.exe 692 vlc.exe 692 vlc.exe 692 vlc.exe 692 vlc.exe 692 vlc.exe 692 vlc.exe 692 vlc.exe 692 vlc.exe 692 vlc.exe 692 vlc.exe 692 vlc.exe 692 vlc.exe 692 vlc.exe 692 vlc.exe 692 vlc.exe 692 vlc.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe -
Suspicious use of SendNotifyMessage 62 IoCs
pid Process 692 vlc.exe 692 vlc.exe 692 vlc.exe 692 vlc.exe 692 vlc.exe 692 vlc.exe 692 vlc.exe 692 vlc.exe 692 vlc.exe 692 vlc.exe 692 vlc.exe 692 vlc.exe 692 vlc.exe 692 vlc.exe 692 vlc.exe 692 vlc.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe 2872 taskmgr.exe -
Suspicious use of SetWindowsHookEx 24 IoCs
pid Process 692 vlc.exe 2508 SearchProtocolHost.exe 2508 SearchProtocolHost.exe 2508 SearchProtocolHost.exe 2508 SearchProtocolHost.exe 2508 SearchProtocolHost.exe 2864 SearchProtocolHost.exe 2864 SearchProtocolHost.exe 2864 SearchProtocolHost.exe 2864 SearchProtocolHost.exe 2864 SearchProtocolHost.exe 2864 SearchProtocolHost.exe 2864 SearchProtocolHost.exe 2864 SearchProtocolHost.exe 2864 SearchProtocolHost.exe 2864 SearchProtocolHost.exe 2864 SearchProtocolHost.exe 2864 SearchProtocolHost.exe 2864 SearchProtocolHost.exe 2864 SearchProtocolHost.exe 2508 SearchProtocolHost.exe 2864 SearchProtocolHost.exe 2864 SearchProtocolHost.exe 2864 SearchProtocolHost.exe -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 1412 wrote to memory of 2744 1412 cmd.exe 32 PID 1412 wrote to memory of 2744 1412 cmd.exe 32 PID 1412 wrote to memory of 2744 1412 cmd.exe 32 PID 2744 wrote to memory of 3060 2744 rundll32.exe 33 PID 2744 wrote to memory of 3060 2744 rundll32.exe 33 PID 2744 wrote to memory of 3060 2744 rundll32.exe 33 PID 3060 wrote to memory of 692 3060 rundll32.exe 35 PID 3060 wrote to memory of 692 3060 rundll32.exe 35 PID 3060 wrote to memory of 692 3060 rundll32.exe 35 PID 1628 wrote to memory of 2508 1628 SearchIndexer.exe 42 PID 1628 wrote to memory of 2508 1628 SearchIndexer.exe 42 PID 1628 wrote to memory of 2508 1628 SearchIndexer.exe 42 PID 1628 wrote to memory of 2948 1628 SearchIndexer.exe 43 PID 1628 wrote to memory of 2948 1628 SearchIndexer.exe 43 PID 1628 wrote to memory of 2948 1628 SearchIndexer.exe 43 PID 1628 wrote to memory of 2864 1628 SearchIndexer.exe 44 PID 1628 wrote to memory of 2864 1628 SearchIndexer.exe 44 PID 1628 wrote to memory of 2864 1628 SearchIndexer.exe 44
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\R B X 1 2 5.rar"1⤵
- Suspicious use of WriteProcessMemory
PID:1412 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\R B X 1 2 5.rar2⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:2744 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\R B X 1 2 5.rar3⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:3060 -
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\R B X 1 2 5.rar"4⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:692
-
-
-
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵PID:1476
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1628 -
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2212144002-1172735686-1556890956-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2212144002-1172735686-1556890956-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"2⤵
- Suspicious use of SetWindowsHookEx
PID:2508
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 512 516 524 65536 5202⤵
- Modifies data under HKEY_USERS
PID:2948
-
-
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:2864
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2872
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1024KB
MD5d10c27f59dfdc972c4de635687df4614
SHA13ebd0ac94d845bca26c36a05e3a70f75561fe3e4
SHA25671636872ba48e12fbf90eec49168337910ef98ad0ee00cda106f2904c83f8f65
SHA5124c649ed28619302cbad9f1a2455bd4f2970b05f59740d642c4691f073df9e195bd6fcbcda107ffe7ad7b095bcff68c1882744e86fb374c4224f804850010bf4c