Malware Analysis Report

2024-11-30 14:55

Sample ID 241029-paandatphs
Target ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.exe
SHA256 72292a987383f0079a0a846bae4ee6345f008f991a50f5f6d7fed2cad91339ad
Tags
vipkeylogger collection discovery evasion keylogger persistence stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

72292a987383f0079a0a846bae4ee6345f008f991a50f5f6d7fed2cad91339ad

Threat Level: Known bad

The file ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.exe was found to be: Known bad.

Malicious Activity Summary

vipkeylogger collection discovery evasion keylogger persistence stealer

Modifies WinLogon for persistence

Modifies visiblity of hidden/system files in Explorer

Vipkeylogger family

VIPKeylogger

Boot or Logon Autostart Execution: Active Setup

Executes dropped EXE

Loads dropped DLL

Looks up external IP address via web service

Adds Run key to start application

Accesses Microsoft Outlook profiles

Suspicious use of SetThreadContext

AutoIT Executable

Drops file in Windows directory

System Location Discovery: System Language Discovery

Unsigned PE

Program crash

Enumerates physical storage devices

Browser Information Discovery

Suspicious use of SetWindowsHookEx

outlook_office_path

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious behavior: GetForegroundWindowSpam

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

outlook_win_path

Suspicious use of WriteProcessMemory

Suspicious use of SendNotifyMessage

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-10-29 12:07

Signatures

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-10-29 12:07

Reported

2024-10-29 12:09

Platform

win7-20241010-en

Max time kernel

150s

Max time network

153s

Command Line

"C:\Users\Admin\AppData\Local\Temp\ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.exe"

Signatures

Modifies WinLogon for persistence

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" \??\c:\windows\system\explorer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" \??\c:\windows\system\svchost.exe N/A

Modifies visiblity of hidden/system files in Explorer

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" \??\c:\windows\system\explorer.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" \??\c:\windows\system\svchost.exe N/A

VIPKeylogger

stealer keylogger vipkeylogger

Vipkeylogger family

vipkeylogger

Boot or Logon Autostart Execution: Active Setup

persistence
Description Indicator Process Target
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} \??\c:\windows\system\svchost.exe N/A
Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} \??\c:\windows\system\explorer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" \??\c:\windows\system\explorer.exe N/A
Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} \??\c:\windows\system\svchost.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" \??\c:\windows\system\svchost.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} \??\c:\windows\system\svchost.exe N/A
Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} \??\c:\windows\system\svchost.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" \??\c:\windows\system\svchost.exe N/A

Accesses Microsoft Outlook profiles

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" \??\c:\windows\system\explorer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" \??\c:\windows\system\explorer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" \??\c:\windows\system\svchost.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" \??\c:\windows\system\svchost.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A checkip.dyndns.org N/A N/A

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2024 set thread context of 2824 N/A \??\c:\users\admin\appdata\local\temp\zapytanie ofertowe st-2024-s315 cpa9170385.exe  C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Drops file in Windows directory

Description Indicator Process Target
File opened for modification \??\c:\windows\system\explorer.exe \??\c:\windows\system\explorer.exe N/A
File opened for modification \??\c:\windows\system\svchost.exe \??\c:\windows\system\svchost.exe N/A
File opened for modification C:\Windows\system\udsys.exe \??\c:\windows\system\explorer.exe N/A
File opened for modification \??\c:\windows\system\explorer.exe C:\Users\Admin\AppData\Local\icsys.icn.exe N/A
File opened for modification \??\c:\windows\system\spoolsv.exe \??\c:\windows\system\explorer.exe N/A
File opened for modification \??\c:\windows\system\svchost.exe \??\c:\windows\system\spoolsv.exe N/A

Browser Information Discovery

discovery

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language \??\c:\windows\system\explorer.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language \??\c:\windows\system\spoolsv.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\at.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\at.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\at.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language \??\c:\users\admin\appdata\local\temp\zapytanie ofertowe st-2024-s315 cpa9170385.exe  N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\icsys.icn.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language \??\c:\windows\system\spoolsv.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language \??\c:\windows\system\svchost.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\icsys.icn.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A \??\c:\users\admin\appdata\local\temp\zapytanie ofertowe st-2024-s315 cpa9170385.exe  N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1832 wrote to memory of 2024 N/A C:\Users\Admin\AppData\Local\Temp\ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.exe \??\c:\users\admin\appdata\local\temp\zapytanie ofertowe st-2024-s315 cpa9170385.exe 
PID 1832 wrote to memory of 2024 N/A C:\Users\Admin\AppData\Local\Temp\ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.exe \??\c:\users\admin\appdata\local\temp\zapytanie ofertowe st-2024-s315 cpa9170385.exe 
PID 1832 wrote to memory of 2024 N/A C:\Users\Admin\AppData\Local\Temp\ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.exe \??\c:\users\admin\appdata\local\temp\zapytanie ofertowe st-2024-s315 cpa9170385.exe 
PID 1832 wrote to memory of 2024 N/A C:\Users\Admin\AppData\Local\Temp\ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.exe \??\c:\users\admin\appdata\local\temp\zapytanie ofertowe st-2024-s315 cpa9170385.exe 
PID 1832 wrote to memory of 1692 N/A C:\Users\Admin\AppData\Local\Temp\ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.exe C:\Users\Admin\AppData\Local\icsys.icn.exe
PID 1832 wrote to memory of 1692 N/A C:\Users\Admin\AppData\Local\Temp\ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.exe C:\Users\Admin\AppData\Local\icsys.icn.exe
PID 1832 wrote to memory of 1692 N/A C:\Users\Admin\AppData\Local\Temp\ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.exe C:\Users\Admin\AppData\Local\icsys.icn.exe
PID 1832 wrote to memory of 1692 N/A C:\Users\Admin\AppData\Local\Temp\ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.exe C:\Users\Admin\AppData\Local\icsys.icn.exe
PID 1692 wrote to memory of 2860 N/A C:\Users\Admin\AppData\Local\icsys.icn.exe \??\c:\windows\system\explorer.exe
PID 1692 wrote to memory of 2860 N/A C:\Users\Admin\AppData\Local\icsys.icn.exe \??\c:\windows\system\explorer.exe
PID 1692 wrote to memory of 2860 N/A C:\Users\Admin\AppData\Local\icsys.icn.exe \??\c:\windows\system\explorer.exe
PID 1692 wrote to memory of 2860 N/A C:\Users\Admin\AppData\Local\icsys.icn.exe \??\c:\windows\system\explorer.exe
PID 2860 wrote to memory of 2872 N/A \??\c:\windows\system\explorer.exe \??\c:\windows\system\spoolsv.exe
PID 2860 wrote to memory of 2872 N/A \??\c:\windows\system\explorer.exe \??\c:\windows\system\spoolsv.exe
PID 2860 wrote to memory of 2872 N/A \??\c:\windows\system\explorer.exe \??\c:\windows\system\spoolsv.exe
PID 2860 wrote to memory of 2872 N/A \??\c:\windows\system\explorer.exe \??\c:\windows\system\spoolsv.exe
PID 2872 wrote to memory of 2720 N/A \??\c:\windows\system\spoolsv.exe \??\c:\windows\system\svchost.exe
PID 2872 wrote to memory of 2720 N/A \??\c:\windows\system\spoolsv.exe \??\c:\windows\system\svchost.exe
PID 2872 wrote to memory of 2720 N/A \??\c:\windows\system\spoolsv.exe \??\c:\windows\system\svchost.exe
PID 2872 wrote to memory of 2720 N/A \??\c:\windows\system\spoolsv.exe \??\c:\windows\system\svchost.exe
PID 2720 wrote to memory of 2676 N/A \??\c:\windows\system\svchost.exe \??\c:\windows\system\spoolsv.exe
PID 2720 wrote to memory of 2676 N/A \??\c:\windows\system\svchost.exe \??\c:\windows\system\spoolsv.exe
PID 2720 wrote to memory of 2676 N/A \??\c:\windows\system\svchost.exe \??\c:\windows\system\spoolsv.exe
PID 2720 wrote to memory of 2676 N/A \??\c:\windows\system\svchost.exe \??\c:\windows\system\spoolsv.exe
PID 2720 wrote to memory of 2612 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 2720 wrote to memory of 2612 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 2720 wrote to memory of 2612 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 2720 wrote to memory of 2612 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 2024 wrote to memory of 2824 N/A \??\c:\users\admin\appdata\local\temp\zapytanie ofertowe st-2024-s315 cpa9170385.exe  C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 2024 wrote to memory of 2824 N/A \??\c:\users\admin\appdata\local\temp\zapytanie ofertowe st-2024-s315 cpa9170385.exe  C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 2024 wrote to memory of 2824 N/A \??\c:\users\admin\appdata\local\temp\zapytanie ofertowe st-2024-s315 cpa9170385.exe  C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 2024 wrote to memory of 2824 N/A \??\c:\users\admin\appdata\local\temp\zapytanie ofertowe st-2024-s315 cpa9170385.exe  C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 2024 wrote to memory of 2824 N/A \??\c:\users\admin\appdata\local\temp\zapytanie ofertowe st-2024-s315 cpa9170385.exe  C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 2024 wrote to memory of 2824 N/A \??\c:\users\admin\appdata\local\temp\zapytanie ofertowe st-2024-s315 cpa9170385.exe  C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 2024 wrote to memory of 2824 N/A \??\c:\users\admin\appdata\local\temp\zapytanie ofertowe st-2024-s315 cpa9170385.exe  C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 2024 wrote to memory of 2824 N/A \??\c:\users\admin\appdata\local\temp\zapytanie ofertowe st-2024-s315 cpa9170385.exe  C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 2720 wrote to memory of 3000 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 2720 wrote to memory of 3000 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 2720 wrote to memory of 3000 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 2720 wrote to memory of 3000 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 2720 wrote to memory of 2608 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 2720 wrote to memory of 2608 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 2720 wrote to memory of 2608 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 2720 wrote to memory of 2608 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe

outlook_office_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A

outlook_win_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.exe

"C:\Users\Admin\AppData\Local\Temp\ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.exe"

\??\c:\users\admin\appdata\local\temp\zapytanie ofertowe st-2024-s315 cpa9170385.exe 

"c:\users\admin\appdata\local\temp\zapytanie ofertowe st-2024-s315 cpa9170385.exe "

C:\Users\Admin\AppData\Local\icsys.icn.exe

C:\Users\Admin\AppData\Local\icsys.icn.exe

\??\c:\windows\system\explorer.exe

c:\windows\system\explorer.exe

\??\c:\windows\system\spoolsv.exe

c:\windows\system\spoolsv.exe SE

\??\c:\windows\system\svchost.exe

c:\windows\system\svchost.exe

\??\c:\windows\system\spoolsv.exe

c:\windows\system\spoolsv.exe PR

C:\Windows\SysWOW64\at.exe

at 12:09 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

"c:\users\admin\appdata\local\temp\zapytanie ofertowe st-2024-s315 cpa9170385.exe "

C:\Windows\SysWOW64\at.exe

at 12:10 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe

C:\Windows\SysWOW64\at.exe

at 12:11 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 checkip.dyndns.org udp
JP 132.226.8.169:80 checkip.dyndns.org tcp
US 8.8.8.8:53 reallyfreegeoip.org udp
US 104.21.67.152:443 reallyfreegeoip.org tcp
US 8.8.8.8:53 api.telegram.org udp
NL 149.154.167.220:443 api.telegram.org tcp
US 8.8.8.8:53 mail.tlakovec.si udp
SI 212.44.112.138:587 mail.tlakovec.si tcp
SI 212.44.112.138:587 mail.tlakovec.si tcp

Files

memory/1832-0-0x0000000000400000-0x000000000043E000-memory.dmp

\Users\Admin\AppData\Local\Temp\zapytanie ofertowe st-2024-s315 cpa9170385.exe 

MD5 6a6157cd22cd9558f8579c30632e62c1
SHA1 7451d8e77a65ff7e9ddebdf73183cbd684d3fdfd
SHA256 c3e272af01d2b5739d8f91ce17d80e13818a59fe50f5545d09fea9a669520667
SHA512 4e41562a7279af1b4b4a0513b4f75965f04729fc3d6d71a9c74634a24257143bee308c942abb3e5de5b29bdafde86ccfac5f906f1c26b4a0b40c54b0fe47fa3a

memory/1832-19-0x00000000026D0000-0x000000000270E000-memory.dmp

memory/1832-18-0x00000000026D0000-0x000000000270E000-memory.dmp

C:\Users\Admin\AppData\Local\icsys.icn.exe

MD5 30957be4d1d5957a9d6433367cef30ef
SHA1 df2d8a795bd221d77b0bc167d05203ab6b6b2fca
SHA256 cedcf4e2ffc34660e6e4bdd8e3cab70b2c805704ceb302f29e3b5a3c4e6eac5c
SHA512 36382e3597704764ae1300ca3c857b50f2fabe7f557c36240206749dfa89fb435f313511d72d5ded60db9b38237f0d983f0af78f3440ac7dfaa7014e3085e161

\Windows\system\explorer.exe

MD5 8fa7d263ffdca2e55800fcb028ba9efe
SHA1 bcab86c8669fa13515bf5f0796fbd42a3cd9f9a5
SHA256 6ebb9f9da6f036d502a91530f31621d7e101527a7d990f3385adb8e38a1519cb
SHA512 f445424ea0b77aa850db3e2803b8c77ef592ae5db554cd762dae93405084a9dcaffe55db77038ea80b6dc26462a60c00a4620f5532eb3595217707702fc63b43

memory/2860-36-0x0000000000400000-0x000000000043E000-memory.dmp

memory/1692-35-0x0000000000750000-0x000000000078E000-memory.dmp

memory/1692-34-0x0000000000750000-0x000000000078E000-memory.dmp

\Windows\system\spoolsv.exe

MD5 7921eefb748759cad31a372eb51f7865
SHA1 116842c0b2cf33ab09adfbdf37b0494d02ce6189
SHA256 6d411dfcb37aaef29b8770eab41749bdc9777d830cc0b1adb934ddfb0db7a817
SHA512 7c1c9197e9447d7e2aa4aaa6608c5769bad7dfe309581ce95457721b63640e2d5e3f252cff9221c176bb9a1a56dca5ca38d7b8cf52d2da2a4df982403d190873

memory/2872-52-0x0000000000400000-0x000000000043E000-memory.dmp

\Windows\system\svchost.exe

MD5 a6ffc474a82d96ec4264314246719844
SHA1 750a81361130496847f7290145bbb80f2e77711c
SHA256 77374dcb7066a8ce30ccc5d6fb4af57be5c17977a0cc243a46b1c32f75e8ee65
SHA512 5a7c1178a1c53d5655f4b4488e2103026d3792ce7252ae594ea9b795ce749abcb615fe5a502639b4c158a184b6e145a62591aeb4b8786bb635477a1dd667b978

memory/2720-69-0x0000000000400000-0x000000000043E000-memory.dmp

memory/2872-68-0x0000000002460000-0x000000000249E000-memory.dmp

memory/2872-67-0x0000000002460000-0x000000000249E000-memory.dmp

memory/2676-77-0x0000000000400000-0x000000000043E000-memory.dmp

memory/2872-80-0x0000000000400000-0x000000000043E000-memory.dmp

memory/2024-83-0x00000000036E0000-0x00000000038E0000-memory.dmp

memory/1692-82-0x0000000000400000-0x000000000043E000-memory.dmp

memory/1832-81-0x0000000000400000-0x000000000043E000-memory.dmp

C:\Users\Admin\AppData\Roaming\mrsys.exe

MD5 dd5c50d1945282445bce69d087824fbf
SHA1 12d774da916521ad3b3ca23485e86c8f86fd343a
SHA256 ac372ad3a339edd03cf36660b72436838788e4047872db56dd3b25ca3daa70ed
SHA512 0960624769b0e61c7ffb389c33e6bb3a3ca0828a6f43a846c8f44dfa2862652736943788bcfeeec453e9a6a1b680372ca0c2abf41c83c534186f7fbf92ea3e84

memory/2824-85-0x0000000000400000-0x000000000044A000-memory.dmp

memory/2824-86-0x0000000000400000-0x000000000044A000-memory.dmp

memory/2824-87-0x0000000000400000-0x000000000044A000-memory.dmp

memory/2860-88-0x0000000000400000-0x000000000043E000-memory.dmp

memory/2720-89-0x0000000000400000-0x000000000043E000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-10-29 12:07

Reported

2024-10-29 12:09

Platform

win10v2004-20241007-en

Max time kernel

150s

Max time network

144s

Command Line

"C:\Users\Admin\AppData\Local\Temp\ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.exe"

Signatures

Modifies WinLogon for persistence

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" \??\c:\windows\system\explorer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" \??\c:\windows\system\svchost.exe N/A

Modifies visiblity of hidden/system files in Explorer

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" \??\c:\windows\system\explorer.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" \??\c:\windows\system\svchost.exe N/A

VIPKeylogger

stealer keylogger vipkeylogger

Vipkeylogger family

vipkeylogger

Boot or Logon Autostart Execution: Active Setup

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" \??\c:\windows\system\svchost.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} \??\c:\windows\system\svchost.exe N/A
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} \??\c:\windows\system\svchost.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" \??\c:\windows\system\svchost.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\ACTIVE SETUP\INSTALLED COMPONENTS\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} \??\c:\windows\system\svchost.exe N/A
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} \??\c:\windows\system\explorer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" \??\c:\windows\system\explorer.exe N/A
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} \??\c:\windows\system\svchost.exe N/A

Accesses Microsoft Outlook profiles

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" \??\c:\windows\system\svchost.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" \??\c:\windows\system\explorer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" \??\c:\windows\system\explorer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" \??\c:\windows\system\svchost.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A checkip.dyndns.org N/A N/A

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 372 set thread context of 3124 N/A \??\c:\users\admin\appdata\local\temp\zapytanie ofertowe st-2024-s315 cpa9170385.exe  C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Drops file in Windows directory

Description Indicator Process Target
File opened for modification \??\c:\windows\system\spoolsv.exe \??\c:\windows\system\explorer.exe N/A
File opened for modification \??\c:\windows\system\svchost.exe \??\c:\windows\system\spoolsv.exe N/A
File opened for modification \??\c:\windows\system\explorer.exe \??\c:\windows\system\explorer.exe N/A
File opened for modification \??\c:\windows\system\svchost.exe \??\c:\windows\system\svchost.exe N/A
File opened for modification C:\Windows\system\udsys.exe \??\c:\windows\system\explorer.exe N/A
File opened for modification \??\c:\windows\system\explorer.exe C:\Users\Admin\AppData\Local\icsys.icn.exe N/A

Browser Information Discovery

discovery

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language \??\c:\windows\system\spoolsv.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language \??\c:\windows\system\svchost.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\at.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language \??\c:\users\admin\appdata\local\temp\zapytanie ofertowe st-2024-s315 cpa9170385.exe  N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\icsys.icn.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language \??\c:\windows\system\explorer.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language \??\c:\windows\system\spoolsv.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\at.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\at.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\icsys.icn.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\icsys.icn.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A \??\c:\users\admin\appdata\local\temp\zapytanie ofertowe st-2024-s315 cpa9170385.exe  N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1780 wrote to memory of 372 N/A C:\Users\Admin\AppData\Local\Temp\ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.exe \??\c:\users\admin\appdata\local\temp\zapytanie ofertowe st-2024-s315 cpa9170385.exe 
PID 1780 wrote to memory of 372 N/A C:\Users\Admin\AppData\Local\Temp\ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.exe \??\c:\users\admin\appdata\local\temp\zapytanie ofertowe st-2024-s315 cpa9170385.exe 
PID 1780 wrote to memory of 372 N/A C:\Users\Admin\AppData\Local\Temp\ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.exe \??\c:\users\admin\appdata\local\temp\zapytanie ofertowe st-2024-s315 cpa9170385.exe 
PID 1780 wrote to memory of 2688 N/A C:\Users\Admin\AppData\Local\Temp\ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.exe C:\Users\Admin\AppData\Local\icsys.icn.exe
PID 1780 wrote to memory of 2688 N/A C:\Users\Admin\AppData\Local\Temp\ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.exe C:\Users\Admin\AppData\Local\icsys.icn.exe
PID 1780 wrote to memory of 2688 N/A C:\Users\Admin\AppData\Local\Temp\ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.exe C:\Users\Admin\AppData\Local\icsys.icn.exe
PID 2688 wrote to memory of 4952 N/A C:\Users\Admin\AppData\Local\icsys.icn.exe \??\c:\windows\system\explorer.exe
PID 2688 wrote to memory of 4952 N/A C:\Users\Admin\AppData\Local\icsys.icn.exe \??\c:\windows\system\explorer.exe
PID 2688 wrote to memory of 4952 N/A C:\Users\Admin\AppData\Local\icsys.icn.exe \??\c:\windows\system\explorer.exe
PID 4952 wrote to memory of 4420 N/A \??\c:\windows\system\explorer.exe \??\c:\windows\system\spoolsv.exe
PID 4952 wrote to memory of 4420 N/A \??\c:\windows\system\explorer.exe \??\c:\windows\system\spoolsv.exe
PID 4952 wrote to memory of 4420 N/A \??\c:\windows\system\explorer.exe \??\c:\windows\system\spoolsv.exe
PID 4420 wrote to memory of 1212 N/A \??\c:\windows\system\spoolsv.exe \??\c:\windows\system\svchost.exe
PID 4420 wrote to memory of 1212 N/A \??\c:\windows\system\spoolsv.exe \??\c:\windows\system\svchost.exe
PID 4420 wrote to memory of 1212 N/A \??\c:\windows\system\spoolsv.exe \??\c:\windows\system\svchost.exe
PID 1212 wrote to memory of 4964 N/A \??\c:\windows\system\svchost.exe \??\c:\windows\system\spoolsv.exe
PID 1212 wrote to memory of 4964 N/A \??\c:\windows\system\svchost.exe \??\c:\windows\system\spoolsv.exe
PID 1212 wrote to memory of 4964 N/A \??\c:\windows\system\svchost.exe \??\c:\windows\system\spoolsv.exe
PID 1212 wrote to memory of 3768 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 1212 wrote to memory of 3768 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 1212 wrote to memory of 3768 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 372 wrote to memory of 3124 N/A \??\c:\users\admin\appdata\local\temp\zapytanie ofertowe st-2024-s315 cpa9170385.exe  C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 372 wrote to memory of 3124 N/A \??\c:\users\admin\appdata\local\temp\zapytanie ofertowe st-2024-s315 cpa9170385.exe  C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 372 wrote to memory of 3124 N/A \??\c:\users\admin\appdata\local\temp\zapytanie ofertowe st-2024-s315 cpa9170385.exe  C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 372 wrote to memory of 3124 N/A \??\c:\users\admin\appdata\local\temp\zapytanie ofertowe st-2024-s315 cpa9170385.exe  C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 1212 wrote to memory of 2444 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 1212 wrote to memory of 2444 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 1212 wrote to memory of 2444 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 1212 wrote to memory of 2164 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 1212 wrote to memory of 2164 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 1212 wrote to memory of 2164 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe

outlook_office_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A

outlook_win_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.exe

"C:\Users\Admin\AppData\Local\Temp\ZAPYTANIE OFERTOWE ST-2024-S315 CPA9170385.exe"

\??\c:\users\admin\appdata\local\temp\zapytanie ofertowe st-2024-s315 cpa9170385.exe 

"c:\users\admin\appdata\local\temp\zapytanie ofertowe st-2024-s315 cpa9170385.exe "

C:\Users\Admin\AppData\Local\icsys.icn.exe

C:\Users\Admin\AppData\Local\icsys.icn.exe

\??\c:\windows\system\explorer.exe

c:\windows\system\explorer.exe

\??\c:\windows\system\spoolsv.exe

c:\windows\system\spoolsv.exe SE

\??\c:\windows\system\svchost.exe

c:\windows\system\svchost.exe

\??\c:\windows\system\spoolsv.exe

c:\windows\system\spoolsv.exe PR

C:\Windows\SysWOW64\at.exe

at 12:09 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

"c:\users\admin\appdata\local\temp\zapytanie ofertowe st-2024-s315 cpa9170385.exe "

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 372 -ip 372

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 372 -s 788

C:\Windows\SysWOW64\at.exe

at 12:10 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe

C:\Windows\SysWOW64\at.exe

at 12:11 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 150.171.29.10:443 g.bing.com tcp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 10.29.171.150.in-addr.arpa udp
US 8.8.8.8:53 22.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 checkip.dyndns.org udp
US 193.122.130.0:80 checkip.dyndns.org tcp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 reallyfreegeoip.org udp
US 172.67.177.134:443 reallyfreegeoip.org tcp
US 8.8.8.8:53 0.130.122.193.in-addr.arpa udp
US 8.8.8.8:53 134.177.67.172.in-addr.arpa udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 api.telegram.org udp
NL 149.154.167.220:443 api.telegram.org tcp
US 8.8.8.8:53 220.167.154.149.in-addr.arpa udp
US 8.8.8.8:53 mail.tlakovec.si udp
SI 212.44.112.138:587 mail.tlakovec.si tcp
US 8.8.8.8:53 138.112.44.212.in-addr.arpa udp
SI 212.44.112.138:587 mail.tlakovec.si tcp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 69.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 23.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp

Files

memory/1780-0-0x0000000000400000-0x000000000043E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\zapytanie ofertowe st-2024-s315 cpa9170385.exe 

MD5 6a6157cd22cd9558f8579c30632e62c1
SHA1 7451d8e77a65ff7e9ddebdf73183cbd684d3fdfd
SHA256 c3e272af01d2b5739d8f91ce17d80e13818a59fe50f5545d09fea9a669520667
SHA512 4e41562a7279af1b4b4a0513b4f75965f04729fc3d6d71a9c74634a24257143bee308c942abb3e5de5b29bdafde86ccfac5f906f1c26b4a0b40c54b0fe47fa3a

C:\Users\Admin\AppData\Local\icsys.icn.exe

MD5 30957be4d1d5957a9d6433367cef30ef
SHA1 df2d8a795bd221d77b0bc167d05203ab6b6b2fca
SHA256 cedcf4e2ffc34660e6e4bdd8e3cab70b2c805704ceb302f29e3b5a3c4e6eac5c
SHA512 36382e3597704764ae1300ca3c857b50f2fabe7f557c36240206749dfa89fb435f313511d72d5ded60db9b38237f0d983f0af78f3440ac7dfaa7014e3085e161

C:\Windows\System\explorer.exe

MD5 5f5155adb137d3e0df7d5d496b73a4e4
SHA1 94da44a0ddf916d69797d17f5f49e4a2854384fe
SHA256 64dd94f9a6a6977ed2dd45d289d7233915939374a19865dbc42cf455a2fb6c99
SHA512 8970a1f28e433fa15565ce98e21e7ec373f5b187ad7cc09a1e427df5b8b438a79396d444475e08d67a4f9f400e0c32bad484973f207ce94d05bd426b641689aa

memory/4952-21-0x0000000000400000-0x000000000043E000-memory.dmp

C:\Windows\System\spoolsv.exe

MD5 762928ed3904414f0ed7976b752e70e3
SHA1 5af4b254345fcd0659d2aec1f9b00fa35b789db4
SHA256 005d8a61ab2673eeaa6598a9bb64f5ab1ea7736294038ce0b61b162732e2d3da
SHA512 04c8b1485026827969f8c7e04eb6639f6ec452bfedd4d791ca69dd4a48f93a8999c28f83b1e9c9fc4ffb524bdf27a3994790a1952b77bce16e09193459765558

C:\Windows\System\svchost.exe

MD5 f52b1552c4501c74fea6e940b6c243ef
SHA1 b7a2591983291631f23ca4be7ca843e776d07d00
SHA256 213e4ba963757e54397fad5ccbc8013bd14dda9f5f646179cebd2a779605cbc2
SHA512 fe9346a7435a4c1a46672c7b9441b5bc89e8adae25458041576d38aecdf6c1beadac40a5eda6213717a0adbf497bf72d5ce4adb7a1f2307754de824633710066

memory/4964-45-0x0000000000400000-0x000000000043E000-memory.dmp

memory/4420-48-0x0000000000400000-0x000000000043E000-memory.dmp

C:\Users\Admin\AppData\Roaming\mrsys.exe

MD5 c20bef355403140ddb977504c32d6e2e
SHA1 dc8cec597397a25f1dc4ae99ce6f08c98aa5d765
SHA256 3aca0f893cf3153f33a5667adc9ea151fd2ac2aee63cfbca43294da4f66779b9
SHA512 49d2511087b8299f3557a47c544235f76cadc4bdd165fdeb98ef5ad8952932e4ca90efbabbfac43e26519e3e2231b52abf7ff3b9b9aea27caf30d254526a3ebc

memory/1780-51-0x0000000000400000-0x000000000043E000-memory.dmp

memory/2688-50-0x0000000000400000-0x000000000043E000-memory.dmp

memory/3124-53-0x0000000000400000-0x000000000044A000-memory.dmp

memory/3124-54-0x0000000005B20000-0x00000000060C4000-memory.dmp

memory/3124-55-0x0000000005670000-0x000000000570C000-memory.dmp

memory/3124-56-0x00000000069E0000-0x0000000006BA2000-memory.dmp

memory/3124-57-0x0000000006860000-0x00000000068B0000-memory.dmp

memory/3124-58-0x00000000070E0000-0x000000000760C000-memory.dmp

memory/3124-59-0x0000000006BB0000-0x0000000006C42000-memory.dmp

memory/3124-60-0x00000000069D0000-0x00000000069DA000-memory.dmp

memory/4952-61-0x0000000000400000-0x000000000043E000-memory.dmp

memory/1212-62-0x0000000000400000-0x000000000043E000-memory.dmp