181d7615af131fae7072e791cb1694ef1c1a62d735e80017406f1c7dc4f14303

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
03/09/2024, 13:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

c8420dc616a0e7b7966303fa2cce3dc0N.exe
Size

164KB
MD5

c8420dc616a0e7b7966303fa2cce3dc0
SHA1

1455345f2e7d340f3e69a3efed371278e3662389
SHA256

181d7615af131fae7072e791cb1694ef1c1a62d735e80017406f1c7dc4f14303
SHA512

7376cd6f5de1e25659433fa4dd4cd52a7434c4dbad695ed43e86e8ea00a861e98778d1fbbf1b09c2e575abb4b209015ddc182eab1c8f0928ddea957d007367ef
SSDEEP

3072:1qpMJFLXBpNum6V0P60/KV69R1Vu8ljAE+cQqCdXe8hTJz:1qGvN4V0Pt9R1Vu8l0B9e8hT1

Score

8^/10

defense_evasion discovery evasion persistence

Malware Config

Signatures

Sets file to hidden 1 TTPs 2 IoCs

Modifies file attributes to stop it showing in Explorer etc.

evasion

Hidden Files and Directories

T1564.001

pid	Process
576	attrib.exe
2928	attrib.exe

Deletes itself 1 IoCs

pid	Process
1312	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
1656	inl6CAA.tmp

Loads dropped DLL 2 IoCs

pid	Process
2112	c8420dc616a0e7b7966303fa2cce3dc0N.exe
2112	c8420dc616a0e7b7966303fa2cce3dc0N.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\hsdfasd = "\"C:\\Users\\Admin\\AppData\\Roaming\\PPLive\\tmp.\\a.{971C5380-92A0-5A69-B3EE-C3002B33309E}\" hh.exe"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\GrpConv = "grpconv -o"	rundll32.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\PROGRA~1\INTERN~1\ieframe.dll	cmd.exe
File opened for modification	C:\PROGRA~1\INTERN~1\ieframe.dll	cmd.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\INF\setupapi.app.log	rundll32.exe
File opened for modification	C:\Windows\INF\setupapi.app.log	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 20 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c8420dc616a0e7b7966303fa2cce3dc0N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	grpconv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	inl6CAA.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	runonce.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	runonce.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	runonce.exe

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "431532771"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{41CAB1B1-69FA-11EF-A742-6E295C7D81A3} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe

Modifies Internet Explorer start page 1 TTPs 2 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Start Page = "http://www.82133.com/?o"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://www.82133.com/?o"	reg.exe

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}\Shell\open(&H)\Command\ = "wscript -e:vbs \"C:\\Users\\Admin\\AppData\\Roaming\\PPLive\\3.bat\""	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}\Shell	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}\IsShortCut	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}\Shell\open(&H)\Command	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}\Shell\open(&H)	reg.exe

Suspicious use of AdjustPrivilegeToken 16 IoCs

description	pid	Process
Token: SeRestorePrivilege	1680	rundll32.exe
Token: SeRestorePrivilege	1680	rundll32.exe
Token: SeRestorePrivilege	1680	rundll32.exe
Token: SeRestorePrivilege	1680	rundll32.exe
Token: SeRestorePrivilege	1680	rundll32.exe
Token: SeRestorePrivilege	1680	rundll32.exe
Token: SeRestorePrivilege	1680	rundll32.exe
Token: SeRestorePrivilege	2016	rundll32.exe
Token: SeRestorePrivilege	2016	rundll32.exe
Token: SeRestorePrivilege	2016	rundll32.exe
Token: SeRestorePrivilege	2016	rundll32.exe
Token: SeRestorePrivilege	2016	rundll32.exe
Token: SeRestorePrivilege	2016	rundll32.exe
Token: SeRestorePrivilege	2016	rundll32.exe
Token: SeIncBasePriorityPrivilege	2112	c8420dc616a0e7b7966303fa2cce3dc0N.exe
Token: SeIncBasePriorityPrivilege	1656	inl6CAA.tmp

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2976	iexplore.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2976	iexplore.exe
2976	iexplore.exe
2028	IEXPLORE.EXE
2028	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2112 wrote to memory of 2604	2112	c8420dc616a0e7b7966303fa2cce3dc0N.exe	31
PID 2112 wrote to memory of 2604	2112	c8420dc616a0e7b7966303fa2cce3dc0N.exe	31
PID 2112 wrote to memory of 2604	2112	c8420dc616a0e7b7966303fa2cce3dc0N.exe	31
PID 2112 wrote to memory of 2604	2112	c8420dc616a0e7b7966303fa2cce3dc0N.exe	31
PID 2604 wrote to memory of 1808	2604	cmd.exe	33
PID 2604 wrote to memory of 1808	2604	cmd.exe	33
PID 2604 wrote to memory of 1808	2604	cmd.exe	33
PID 2604 wrote to memory of 1808	2604	cmd.exe	33
PID 1808 wrote to memory of 2976	1808	cmd.exe	35
PID 1808 wrote to memory of 2976	1808	cmd.exe	35
PID 1808 wrote to memory of 2976	1808	cmd.exe	35
PID 1808 wrote to memory of 2976	1808	cmd.exe	35
PID 2976 wrote to memory of 2028	2976	iexplore.exe	36
PID 2976 wrote to memory of 2028	2976	iexplore.exe	36
PID 2976 wrote to memory of 2028	2976	iexplore.exe	36
PID 2976 wrote to memory of 2028	2976	iexplore.exe	36
PID 1808 wrote to memory of 1680	1808	cmd.exe	37
PID 1808 wrote to memory of 1680	1808	cmd.exe	37
PID 1808 wrote to memory of 1680	1808	cmd.exe	37
PID 1808 wrote to memory of 1680	1808	cmd.exe	37
PID 1808 wrote to memory of 1680	1808	cmd.exe	37
PID 1808 wrote to memory of 1680	1808	cmd.exe	37
PID 1808 wrote to memory of 1680	1808	cmd.exe	37
PID 1808 wrote to memory of 2860	1808	cmd.exe	38
PID 1808 wrote to memory of 2860	1808	cmd.exe	38
PID 1808 wrote to memory of 2860	1808	cmd.exe	38
PID 1808 wrote to memory of 2860	1808	cmd.exe	38
PID 2860 wrote to memory of 1928	2860	cmd.exe	40
PID 2860 wrote to memory of 1928	2860	cmd.exe	40
PID 2860 wrote to memory of 1928	2860	cmd.exe	40
PID 2860 wrote to memory of 1928	2860	cmd.exe	40
PID 2860 wrote to memory of 592	2860	cmd.exe	41
PID 2860 wrote to memory of 592	2860	cmd.exe	41
PID 2860 wrote to memory of 592	2860	cmd.exe	41
PID 2860 wrote to memory of 592	2860	cmd.exe	41
PID 2860 wrote to memory of 1372	2860	cmd.exe	42
PID 2860 wrote to memory of 1372	2860	cmd.exe	42
PID 2860 wrote to memory of 1372	2860	cmd.exe	42
PID 2860 wrote to memory of 1372	2860	cmd.exe	42
PID 2860 wrote to memory of 2844	2860	cmd.exe	43
PID 2860 wrote to memory of 2844	2860	cmd.exe	43
PID 2860 wrote to memory of 2844	2860	cmd.exe	43
PID 2860 wrote to memory of 2844	2860	cmd.exe	43
PID 2860 wrote to memory of 2044	2860	cmd.exe	44
PID 2860 wrote to memory of 2044	2860	cmd.exe	44
PID 2860 wrote to memory of 2044	2860	cmd.exe	44
PID 2860 wrote to memory of 2044	2860	cmd.exe	44
PID 2860 wrote to memory of 576	2860	cmd.exe	45
PID 2860 wrote to memory of 576	2860	cmd.exe	45
PID 2860 wrote to memory of 576	2860	cmd.exe	45
PID 2860 wrote to memory of 576	2860	cmd.exe	45
PID 2860 wrote to memory of 2928	2860	cmd.exe	46
PID 2860 wrote to memory of 2928	2860	cmd.exe	46
PID 2860 wrote to memory of 2928	2860	cmd.exe	46
PID 2860 wrote to memory of 2928	2860	cmd.exe	46
PID 2860 wrote to memory of 2016	2860	cmd.exe	47
PID 2860 wrote to memory of 2016	2860	cmd.exe	47
PID 2860 wrote to memory of 2016	2860	cmd.exe	47
PID 2860 wrote to memory of 2016	2860	cmd.exe	47
PID 2860 wrote to memory of 2016	2860	cmd.exe	47
PID 2860 wrote to memory of 2016	2860	cmd.exe	47
PID 2860 wrote to memory of 2016	2860	cmd.exe	47
PID 2860 wrote to memory of 2396	2860	cmd.exe	48
PID 2860 wrote to memory of 2396	2860	cmd.exe	48

Views/modifies file attributes 1 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
576	attrib.exe
2928	attrib.exe

C:\Users\Admin\AppData\Local\Temp\c8420dc616a0e7b7966303fa2cce3dc0N.exe
"C:\Users\Admin\AppData\Local\Temp\c8420dc616a0e7b7966303fa2cce3dc0N.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2112
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\kage2011_check.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2604
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Roaming\PPLive\1.bat
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1808
  - - C:\PROGRA~1\INTERN~1\iexplore.exe
      C:\PROGRA~1\INTERN~1\IEXPLORE.EXE http://WWw.cnkankan.com/?82133
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2976
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2976 CREDAT:275457 /prefetch:2
        5⤵
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:2028
  - - C:\Windows\SysWOW64\rundll32.exe
      rundll32 syssetup,SetupInfObjectInstallAction DefaultInstall 128 C:\Users\Admin\AppData\Roaming\PPLive\1.inf
      4⤵
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1680
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Roaming\PPLive\2.bat
      4⤵
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2860
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\Software\Microsoft\Internet Explorer\Main" /v "Start Page" /d ""http://www.82133.com/?o"" /f
        5⤵
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        Modifies Internet Explorer start page
        
        PID:1928
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Internet Explorer\Main" /v "Start Page" /d ""http://www.82133.com/?o"" /f
        5⤵
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        Modifies Internet Explorer start page
        
        PID:592
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\tmp" /v "key" /d ""http://www.82133.com/?o"" /f
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1372
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCR\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}" /v "IsShortCut" /d "" /f
        5⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2844
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCR\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}\Shell\open(&H)\Command" /v "" /d "wscript -e:vbs ""C:\Users\Admin\AppData\Roaming\PPLive\3.bat""" /f
        5⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2044
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib +s +h C:\Users\Admin\AppData\Roaming\PPLive\tmp\a.{971C5380-92A0-5A69-B3EE-C3002B33309E}
        5⤵
        Sets file to hidden
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:576
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib +s +h C:\Users\Admin\AppData\Roaming\PPLive\tmp
        5⤵
        Sets file to hidden
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:2928
    - - C:\Windows\SysWOW64\rundll32.exe
        
        rundll32 syssetup,SetupInfObjectInstallAction DefaultInstall 128 C:\Users\Admin\AppData\Roaming\PPLive\2.inf
        5⤵
        Adds Run key to start application
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:2016
      - C:\Windows\SysWOW64\runonce.exe
        
        "C:\Windows\system32\runonce.exe" -r
        6⤵
        System Location Discovery: System Language Discovery
        Checks processor information in registry
        
        PID:2392
        
        C:\Windows\SysWOW64\grpconv.exe
        
        "C:\Windows\System32\grpconv.exe" -o
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2960
    - - C:\Windows\SysWOW64\rundll32.exe
        
        rundll32 D:\VolumeDH\inj.dat,MainLoad
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2396
- C:\Users\Admin\AppData\Local\Temp\inl6CAA.tmp
  C:\Users\Admin\AppData\Local\Temp\inl6CAA.tmp
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:1656
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\inl6CAA.tmp > nul
    3⤵
    - System Location Discovery: System Language Discovery
    PID:776
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\C8420D~1.EXE > nul
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  PID:1312

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
15ecc1eef11e48908b75f5b8a35da995

SHA1
433eb7a19c9ac074f8b03e0e69c28e9ca50dfcdf

SHA256
052cee97cc524319acd52e5b65fa49968ea1898d47c09bd443ba42bb2dc54b84

SHA512
6749a168380cfbb80b8d2cfccd38da3290abae529ee63e8026d2eec7c9e8165fab3310167180391fad4a07a6868de12957c330491e245a87e93b70fa0669521b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
06be4c359ac081641ee573f8a661e935

SHA1
dcf7f3898af0471d77e900d350af11352a055c9b

SHA256
3dc98402e69e1e3121783e444b1a1f8577e6d901a135059a97830367cfe9291b

SHA512
6fc2b56586745c18a2c78f7fa831799498c342c63febc2f277b0b7071a6cb7d6e8a0cf81763b4b5d50acae1f2fad9fd6176f65074910d5e93c15efd638c94f7f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a4755fa81dad66d7bffa76fadadb7718

SHA1
98b52f4d065f53ccc53814d2ca2a2526e181a075

SHA256
6c80bcf9b898d84ca1770aa3c0e5c18644e9ce988b7a417efbe769f395881e56

SHA512
3069fb2e9905c22fac76280209ffe931e14554c099701129f2983a5e399e12085780faa7883fbb0b4633c2b8310950d5ca746175e933c6ee5b0d1384c0ecb29e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c6d08e48c3a339ab2b1a0da4a78f1369

SHA1
878d8f66f918d80e71f6ec1e749931cc7eb9621e

SHA256
0430d689233f9e9754e1d4982167f07b7303cef14330e2c6b512fe3c0e989c94

SHA512
e97a8eba68c609cea05f1344efb9229ab64a94ca9569f4eb49a26210cc2d141837f10e69237ffe004cbc784df3c59dc66cc506f498af5c1b21c1db23891270af

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1352a65b22ef8d50e64a19f364fa25c7

SHA1
8b2d2c03873173a6add17d8ed8663465105545d7

SHA256
28d4bf7cbe8d42ff65ecd463132fe881df3ebbf6e7f875ce109f45c30f7fa72a

SHA512
dfaf6982614eec1b000fe80e8c1f9ccf6416c4acb1261b1af371cb777181af075b42d052dc87764ff7559677a7d5a8550ed4a1df97c7189904a6d66d2be8dcf8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
78bc5f14d5540027369f9baf1a01e371

SHA1
dc4881f1ce3ee30b0260b80444f3e773ea1a70df

SHA256
e7052c9fbf9b791d2d0776283e7cf27253a90272c2846f9531513eaf9257460b

SHA512
5615313ea6637a21821793d98e0cf84962388ca8c242debc8cd32cc8ff983c9032b25caa8671e1b796ff946e41754e4284ee647fbca981fb00fb342b0ea65079

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b6525bd9e5f1c2c1f4e414be63b4c216

SHA1
104f2f669f7aa2a05eaf2f82ab3b5c49c0ac70c4

SHA256
f8a0455135d4feee5a4ef5fdde20c3846d7ccd4f1b9b67d9bc0e51433c7d8d60

SHA512
9c6ccfda62e87f624b57258c81c39bbd99c1c3edf3ef5b20eb525cd841718e2d21c68257faa471f212fa47b534aee2169a6071ddc697ec32383f599d8e6dc6d8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6f6d74ff62855ff87c9c0b5ec23dc020

SHA1
02df46d90fbb784587e5c428458decb90e275be3

SHA256
a22a1e110df4ddf1daa7d01ab57c8beeb77910ff49e017a92348943b4b7f66af

SHA512
71d4d1ccc8438e1abf1a151706af62358470914349c877a35470c0b770334cf1695a339770fc7be0f13063c0584b21534c55c6ab6cd2f00b026ada951d3c5acf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ebc203096ce04703424782c0c76d9357

SHA1
bc373750eb0b7011654cadfee04a513d33eccb43

SHA256
fa08844fbf0caaba5be8aaf060908083f99676d6d0e8e2f6be60b6b86cda851d

SHA512
364e6631aa3907c5fd8ea85757cca28ed846ca652d1a4b678457f985651be5ef8b094d2233e163e6622bee0d29f8564de7179298c1d22d86bb8d69009be0d0e6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab6CC7.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar6D39.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\kage2011_check.bat

Filesize
53B

MD5
23962a245f75fe25510051582203aff1

SHA1
20832a3a1179bb2730194d2f7738d41d5d669a43

SHA256
1abcea214b9b2bd76cc04be07ae2d4d70371e6ca443d99f4f1327afe7a5fc647

SHA512
dc36b64f2dbb710652900a31295c148760b0c44eae13515aa29613916c9dffe3d8e55ba61568f7c27b43bf0c341f7dcd4b9c721f81627fc6bb915b15c358fe80

Download Submit
C:\Users\Admin\AppData\Local\Temp\winrar_config.tmp

Filesize
555B

MD5
458a331595f313d6bd4ac9cfd0a769c8

SHA1
74dffa252fbbf48b8f27900a0b77b339c4678115

SHA256
2387b151c34a6ee91d2f8a47976ec35c9fc6ea9ecbe0330e156a3a00d51cc0b2

SHA512
5b84b8bd34ab1816a2301330e6778fa1cb97c42eafee18c876aa73da26b4d7d1475def53558e2a69baf318c26b3227666a9c6fb4cb7d26d662ac2a7273970d26

Download Submit
C:\Users\Admin\AppData\Roaming\PPLive\1.bat

Filesize
3KB

MD5
b7c5e3b416b1d1b5541ef44662e1a764

SHA1
8bff7ea2be2f3cf29f2381d8007198b5991ca3ae

SHA256
f1a2f9fdebb3cac24756e53fa5e1628b2bd1cc130480c1878e3b3bc880575cd1

SHA512
65dbd6a7a7cf6fec00e6b0f1d7d5655769e6087ad09cad74c91c5a3395e675ac8f9df5c7185327e6f8dd03ddb60504400f54237d9e4b53c8b08e7e3d41ee61fc

Download Submit
C:\Users\Admin\AppData\Roaming\PPLive\1.inf

Filesize
492B

MD5
34c14b8530e1094e792527f7a474fe77

SHA1
f71c4e9091140256b34c18220d1dd1efab1f301d

SHA256
fe0dfb3458bfe2a3632d365e00765fa10f14d62e7dfa8b70a055c7eb9fdb6713

SHA512
25bb09b526e1e9f5c6052f1f7c36b37c956c1b5649936af8df3abfcf120c931f3d2603e17a061cb99d8c8074bfb1973a5423cce89762fca53cd46aeb3e8944a2

Download Submit
C:\Users\Admin\AppData\Roaming\PPLive\2.bat

Filesize
3KB

MD5
6b78cb8ced798ca5df5612dd62ce0965

SHA1
5a9c299393b96b0bf8f6770e3c7b0318a9e2e0cf

SHA256
81f64f42edfac2863a55db8fabd528c4eefc67f7e658cad6a57eeec862e444e3

SHA512
b387ba10021f3284d1406d520a2c8b3ba0c87922d67c79394c1aa50c631194519ac6bb5b898956533f040d48e1c7b202734e0075f8fc8c8bfab82c8ef359b28e

Download Submit
C:\Users\Admin\AppData\Roaming\PPLive\2.inf

Filesize
247B

MD5
ca436f6f187bc049f9271ecdcbf348fa

SHA1
bf8a548071cfc150f7affb802538edf03d281106

SHA256
6cdfa9b7f0e1e4ee16bc8ce5d7448d47ea8866c1f55f3e56be5c2a4d183ca534

SHA512
d19e20aabddad6b0284f8c1d473e9180f30b49d4d8b54f26e7c8630228e16b1f6ba04023c5e8b1993d8a10d97adcfff683b216f79b9981bf16181641aebdd591

Download Submit
C:\Users\Admin\AppData\Roaming\PPLive\4.bat

Filesize
12.3MB

MD5
f49d5c2345305a78635fdc2df992d771

SHA1
9de1e12cda0521c61435727fefa65e01cd517e84

SHA256
311a9b7637d0ef57aa5ef870088d30f181a58ab4afd0a048c511e0d736c5ecbf

SHA512
4a7ec4a083fb33b78182d4ebbb9d39ba1c5c32a9bc4ccdbc24e7cddbaaadc4156c121100dca9a0aa79fcee55acae1898d9f4c50aa6c96dc05f5ea60312bda6ac

Download Submit
memory/2112-0-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2112-93-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2976-47-0x0000000002BE0000-0x0000000002BF0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads