Analysis
-
max time kernel
150s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
04-11-2024 19:05
Static task
static1
Behavioral task
behavioral1
Sample
setup_x86_x64_install.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
setup_x86_x64_install.exe
Resource
win10v2004-20241007-en
General
-
Target
setup_x86_x64_install.exe
-
Size
4.8MB
-
MD5
af731b30910bac47cdd0974c662a490c
-
SHA1
243d8250836f5c3f14c6ef41a2c627728ebde372
-
SHA256
6df17c7749ef2051fe3e97d23958e277a4febcf48c0179a3ae2fff1b4038640f
-
SHA512
3ff71df7b4bf790e5598ae5e2bacdb325b6458c1a7f7b97ed585279edf96890b1d97394a7618878448e7621cd068f344608d418181ad719bfa0922ff7a9ecaab
-
SSDEEP
98304:yWN+wY/DEU5lsIopxgVcEn5tbb5CggBGyslZMwr4+Kc36gBo3rCWAb0WPIoR66L:yPwsDqpxgBn5t/4KXlZD4PGKhsJPIoEy
Malware Config
Extracted
privateloader
http://37.0.10.214/proxies.txt
http://37.0.10.244/server.txt
http://wfsdragon.ru/api/setStats.php
37.0.10.237
Extracted
nullmixer
http://sornx.xyz/
Extracted
redline
pub1
viacetequn.site:80
Signatures
-
Nullmixer family
-
PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
-
Privateloader family
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 2 IoCs
resource yara_rule behavioral2/memory/3300-156-0x00000000049E0000-0x0000000004A02000-memory.dmp family_redline behavioral2/memory/3300-158-0x0000000007220000-0x0000000007240000-memory.dmp family_redline -
Redline family
-
SectopRAT payload 2 IoCs
resource yara_rule behavioral2/memory/3300-156-0x00000000049E0000-0x0000000004A02000-memory.dmp family_sectoprat behavioral2/memory/3300-158-0x0000000007220000-0x0000000007240000-memory.dmp family_sectoprat -
Sectoprat family
-
Vidar family
-
Vidar Stealer 1 IoCs
resource yara_rule behavioral2/memory/2844-191-0x0000000000400000-0x0000000002402000-memory.dmp family_vidar -
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 4068 powershell.exe -
resource yara_rule behavioral2/files/0x000a000000023b8b-55.dat aspack_v212_v242 behavioral2/files/0x000a000000023b8a-54.dat aspack_v212_v242 behavioral2/files/0x000a000000023b8d-61.dat aspack_v212_v242 -
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation setup_x86_x64_install.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation setup_installer.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation Mon14585024febb5.exe -
Executes dropped EXE 14 IoCs
pid Process 2640 setup_installer.exe 3716 setup_install.exe 824 Mon141f1ef356ba1.exe 4024 Mon14585024febb5.exe 2316 Mon1467890ab07c10e.exe 3300 Mon14095335954ba1f.exe 2916 Mon14365bf6c89d2abf.exe 2844 Mon14f40f9f7773345d.exe 3848 Mon14541c639b30ce5.exe 2984 Mon1469355885.exe 1348 Mon14b0530bbd5cb.exe 4964 Mon14585024febb5.exe 4872 Prendero.exe.com 1736 Prendero.exe.com -
Loads dropped DLL 6 IoCs
pid Process 3716 setup_install.exe 3716 setup_install.exe 3716 setup_install.exe 3716 setup_install.exe 3716 setup_install.exe 3716 setup_install.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" Mon14b0530bbd5cb.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 2 IoCs
pid pid_target Process procid_target 2328 2984 WerFault.exe 109 4812 2844 WerFault.exe 107 -
System Location Discovery: System Language Discovery 1 TTPs 27 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mon1469355885.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language setup_installer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mon14585024febb5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mon14095335954ba1f.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Prendero.exe.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language setup_install.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mon14f40f9f7773345d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language setup_x86_x64_install.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language findstr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Prendero.exe.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mon14365bf6c89d2abf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mon14b0530bbd5cb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mon14585024febb5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 428 PING.EXE -
Checks SCSI registry key(s) 3 TTPs 13 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags dwm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000 dwm.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI Mon1469355885.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 dwm.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags dwm.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID dwm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 dwm.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags dwm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI Mon1469355885.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI Mon1469355885.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000 dwm.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags dwm.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID dwm.exe -
Enumerates system info in registry 2 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS dwm.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU dwm.exe -
Modifies data under HKEY_USERS 44 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentEcs\all\Overrides OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentEcs\Overrides OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\ExternalFeatureOverrides\officeclicktorun OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentEcs\officeclicktorun\Overrides OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\FirstSession\officeclicktorun OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA dwm.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 428 PING.EXE -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 4068 powershell.exe 4068 powershell.exe 4068 powershell.exe -
Suspicious use of AdjustPrivilegeToken 16 IoCs
description pid Process Token: SeDebugPrivilege 3848 Mon14541c639b30ce5.exe Token: SeDebugPrivilege 4068 powershell.exe Token: SeDebugPrivilege 824 Mon141f1ef356ba1.exe Token: SeDebugPrivilege 3300 Mon14095335954ba1f.exe Token: SeCreateGlobalPrivilege 2716 dwm.exe Token: SeChangeNotifyPrivilege 2716 dwm.exe Token: 33 2716 dwm.exe Token: SeIncBasePriorityPrivilege 2716 dwm.exe Token: SeCreateGlobalPrivilege 4484 dwm.exe Token: SeChangeNotifyPrivilege 4484 dwm.exe Token: 33 4484 dwm.exe Token: SeIncBasePriorityPrivilege 4484 dwm.exe Token: SeCreateGlobalPrivilege 2460 dwm.exe Token: SeChangeNotifyPrivilege 2460 dwm.exe Token: 33 2460 dwm.exe Token: SeIncBasePriorityPrivilege 2460 dwm.exe -
Suspicious use of FindShellTrayWindow 6 IoCs
pid Process 4872 Prendero.exe.com 4872 Prendero.exe.com 4872 Prendero.exe.com 1736 Prendero.exe.com 1736 Prendero.exe.com 1736 Prendero.exe.com -
Suspicious use of SendNotifyMessage 6 IoCs
pid Process 4872 Prendero.exe.com 4872 Prendero.exe.com 4872 Prendero.exe.com 1736 Prendero.exe.com 1736 Prendero.exe.com 1736 Prendero.exe.com -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3688 wrote to memory of 2640 3688 setup_x86_x64_install.exe 87 PID 3688 wrote to memory of 2640 3688 setup_x86_x64_install.exe 87 PID 3688 wrote to memory of 2640 3688 setup_x86_x64_install.exe 87 PID 2640 wrote to memory of 3716 2640 setup_installer.exe 88 PID 2640 wrote to memory of 3716 2640 setup_installer.exe 88 PID 2640 wrote to memory of 3716 2640 setup_installer.exe 88 PID 3716 wrote to memory of 4456 3716 setup_install.exe 91 PID 3716 wrote to memory of 4456 3716 setup_install.exe 91 PID 3716 wrote to memory of 4456 3716 setup_install.exe 91 PID 3716 wrote to memory of 1828 3716 setup_install.exe 92 PID 3716 wrote to memory of 1828 3716 setup_install.exe 92 PID 3716 wrote to memory of 1828 3716 setup_install.exe 92 PID 3716 wrote to memory of 800 3716 setup_install.exe 93 PID 3716 wrote to memory of 800 3716 setup_install.exe 93 PID 3716 wrote to memory of 800 3716 setup_install.exe 93 PID 3716 wrote to memory of 3852 3716 setup_install.exe 94 PID 3716 wrote to memory of 3852 3716 setup_install.exe 94 PID 3716 wrote to memory of 3852 3716 setup_install.exe 94 PID 3716 wrote to memory of 4956 3716 setup_install.exe 95 PID 3716 wrote to memory of 4956 3716 setup_install.exe 95 PID 3716 wrote to memory of 4956 3716 setup_install.exe 95 PID 3716 wrote to memory of 3624 3716 setup_install.exe 96 PID 3716 wrote to memory of 3624 3716 setup_install.exe 96 PID 3716 wrote to memory of 3624 3716 setup_install.exe 96 PID 3716 wrote to memory of 1780 3716 setup_install.exe 97 PID 3716 wrote to memory of 1780 3716 setup_install.exe 97 PID 3716 wrote to memory of 1780 3716 setup_install.exe 97 PID 3716 wrote to memory of 760 3716 setup_install.exe 98 PID 3716 wrote to memory of 760 3716 setup_install.exe 98 PID 3716 wrote to memory of 760 3716 setup_install.exe 98 PID 3716 wrote to memory of 4988 3716 setup_install.exe 99 PID 3716 wrote to memory of 4988 3716 setup_install.exe 99 PID 3716 wrote to memory of 4988 3716 setup_install.exe 99 PID 3716 wrote to memory of 3060 3716 setup_install.exe 100 PID 3716 wrote to memory of 3060 3716 setup_install.exe 100 PID 3716 wrote to memory of 3060 3716 setup_install.exe 100 PID 760 wrote to memory of 824 760 cmd.exe 101 PID 760 wrote to memory of 824 760 cmd.exe 101 PID 4456 wrote to memory of 4068 4456 cmd.exe 102 PID 4456 wrote to memory of 4068 4456 cmd.exe 102 PID 4456 wrote to memory of 4068 4456 cmd.exe 102 PID 1828 wrote to memory of 4024 1828 cmd.exe 104 PID 1828 wrote to memory of 4024 1828 cmd.exe 104 PID 1828 wrote to memory of 4024 1828 cmd.exe 104 PID 3852 wrote to memory of 2316 3852 cmd.exe 105 PID 3852 wrote to memory of 2316 3852 cmd.exe 105 PID 3624 wrote to memory of 3300 3624 cmd.exe 106 PID 3624 wrote to memory of 3300 3624 cmd.exe 106 PID 3624 wrote to memory of 3300 3624 cmd.exe 106 PID 1780 wrote to memory of 2916 1780 cmd.exe 103 PID 1780 wrote to memory of 2916 1780 cmd.exe 103 PID 1780 wrote to memory of 2916 1780 cmd.exe 103 PID 4956 wrote to memory of 2844 4956 cmd.exe 107 PID 4956 wrote to memory of 2844 4956 cmd.exe 107 PID 4956 wrote to memory of 2844 4956 cmd.exe 107 PID 3060 wrote to memory of 3848 3060 cmd.exe 108 PID 3060 wrote to memory of 3848 3060 cmd.exe 108 PID 800 wrote to memory of 2984 800 cmd.exe 109 PID 800 wrote to memory of 2984 800 cmd.exe 109 PID 800 wrote to memory of 2984 800 cmd.exe 109 PID 4988 wrote to memory of 1348 4988 cmd.exe 111 PID 4988 wrote to memory of 1348 4988 cmd.exe 111 PID 4988 wrote to memory of 1348 4988 cmd.exe 111 PID 1348 wrote to memory of 4880 1348 Mon14b0530bbd5cb.exe 114
Processes
-
C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe"C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3688 -
C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\Users\Admin\AppData\Local\Temp\7zS05AAFE47\setup_install.exe"C:\Users\Admin\AppData\Local\Temp\7zS05AAFE47\setup_install.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3716 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4456 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"5⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4068
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Mon14585024febb5.exe4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1828 -
C:\Users\Admin\AppData\Local\Temp\7zS05AAFE47\Mon14585024febb5.exeMon14585024febb5.exe5⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4024 -
C:\Users\Admin\AppData\Local\Temp\7zS05AAFE47\Mon14585024febb5.exe"C:\Users\Admin\AppData\Local\Temp\7zS05AAFE47\Mon14585024febb5.exe" -a6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4964
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Mon1469355885.exe4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:800 -
C:\Users\Admin\AppData\Local\Temp\7zS05AAFE47\Mon1469355885.exeMon1469355885.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Checks SCSI registry key(s)
PID:2984 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2984 -s 3606⤵
- Program crash
PID:2328
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Mon1467890ab07c10e.exe4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3852 -
C:\Users\Admin\AppData\Local\Temp\7zS05AAFE47\Mon1467890ab07c10e.exeMon1467890ab07c10e.exe5⤵
- Executes dropped EXE
PID:2316
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Mon14f40f9f7773345d.exe4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4956 -
C:\Users\Admin\AppData\Local\Temp\7zS05AAFE47\Mon14f40f9f7773345d.exeMon14f40f9f7773345d.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2844 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2844 -s 17846⤵
- Program crash
PID:4812
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Mon14095335954ba1f.exe4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3624 -
C:\Users\Admin\AppData\Local\Temp\7zS05AAFE47\Mon14095335954ba1f.exeMon14095335954ba1f.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3300
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Mon14365bf6c89d2abf.exe4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1780 -
C:\Users\Admin\AppData\Local\Temp\7zS05AAFE47\Mon14365bf6c89d2abf.exeMon14365bf6c89d2abf.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2916
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Mon141f1ef356ba1.exe4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:760 -
C:\Users\Admin\AppData\Local\Temp\7zS05AAFE47\Mon141f1ef356ba1.exeMon141f1ef356ba1.exe5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:824
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Mon14b0530bbd5cb.exe4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4988 -
C:\Users\Admin\AppData\Local\Temp\7zS05AAFE47\Mon14b0530bbd5cb.exeMon14b0530bbd5cb.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1348 -
C:\Windows\SysWOW64\dllhost.exedllhost.exe6⤵PID:4880
-
-
C:\Windows\SysWOW64\cmd.execmd /c cmd < Mummia.wmz6⤵
- System Location Discovery: System Language Discovery
PID:1440 -
C:\Windows\SysWOW64\cmd.execmd7⤵
- System Location Discovery: System Language Discovery
PID:4852 -
C:\Windows\SysWOW64\findstr.exefindstr /V /R "^utIhAQXzKFfZwKOfdWFWGYOHgvUbutPplngusOenUcoCKjfoSNGytadifqZtVmhGQyOCcHYBTuwlPjXeuMFabKtSouQdPYDxoCLEbNMlPtkXdusrrWXoUUouqWxgRHLUDGwhAaEzZcDzniBeO$" Pensavo.wmz8⤵
- System Location Discovery: System Language Discovery
PID:3088
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Prendero.exe.comPrendero.exe.com z8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4872 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Prendero.exe.comC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Prendero.exe.com z9⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1736
-
-
-
C:\Windows\SysWOW64\PING.EXEping GUMLNLFE -n 308⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:428
-
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Mon14541c639b30ce5.exe4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3060 -
C:\Users\Admin\AppData\Local\Temp\7zS05AAFE47\Mon14541c639b30ce5.exeMon14541c639b30ce5.exe5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3848
-
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2984 -ip 29841⤵PID:5108
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 2844 -ip 28441⤵PID:3336
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2716
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4484
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2460
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:3748
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:1136
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service1⤵
- Modifies data under HKEY_USERS
PID:1396
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
248KB
MD5d23c06e25b4bd295e821274472263572
SHA19ad295ec3853dc465ae77f9479f8c4f76e2748b8
SHA256f02c1351a8b3dc296cf815bb4cd2bcc2d25b3b9a258ab2ad95e8be3d9602322c
SHA512122b0ef44682f83651d81df622bbff5ad9fa0f5bbd6b925e35add9568825c0316c0f9921dac21cf92cb44658fc854f7829c01ae3b84aa0745929f8ef5e6ae1ae
-
Filesize
192KB
MD5ea5d2a70de26a3f2ce92d1b02b2f3052
SHA166045b40d6aebc6a2930c76c6d492fb5fc81426f
SHA2567abf7953b1532eec5dd50fb9098269a8cd7b65e9afc9d84031039ff9da63f909
SHA5121437877ea36bf59eb74eef0415f820507fa55bb07b17b59679454e02a99bf48884bfdd0706175a168a005ce9a672b0fbdc904da7a35242402567f06bf22d322b
-
Filesize
1.5MB
MD5df80b76857b74ae1b2ada8efb2a730ee
SHA15653be57533c6eb058fed4963a25a676488ef832
SHA2565545c43eb14b0519ab997673efa379343f98d2b6b1578d9fdeb369234789f9dd
SHA512060b04536003ce4a91e5847d487701eed7e093408e427198be552f0af37aee498929586f3a0110c78173873a28d95c6c0a4cdd01c7218274f5849a4730f9efdd
-
Filesize
8KB
MD5408f2c9252ad66429a8d5401f1833db3
SHA13829d2d03a728ecd59b38cc189525220a60c05db
SHA256890db580fac738971bc7c714735ff6f1f2ee31edccd7881044da3e98452af664
SHA512d4c89dfd928023b9f4380808b27e032342d2a85963b95bbed3191cc03b455dbc6f5ffecf29828a53b1d9011b3881f1cda9d15d269a2cbcbd4be5c993bcd9643b
-
Filesize
56KB
MD53263859df4866bf393d46f06f331a08f
SHA15b4665de13c9727a502f4d11afb800b075929d6c
SHA2569dcacda3913e30cafd92c909648b5bffde14b8e39e6adbfb15628006c0d4d3c2
SHA51258205110a017f5d73dd131fefb1e3bbbcc670ed0c645aeefebe5281579c7b1dceffa56671cd7b186554bdb81710e21018ed0d7088a27517dfc5e48d6d3578cf6
-
Filesize
900KB
MD50a0d22f1c9179a67d04166de0db02dbb
SHA1106e55bd898b5574f9bd33dac9f3c0b95cecd90d
SHA256a59457fbfaf3d1b2e17463d0ffd50680313b1905aff69f13694cfc3fffd5a4ac
SHA5128abf8dc0da25c0fdbaa1ca39db057db80b9a135728fed9cd0f45b0f06d5652cee8d309b92e7cb953c0c4e8b38ffa2427c33f4865f1eb985a621316f9eb187b8b
-
Filesize
272KB
MD5fa37623638231d4c2b671b04a021a984
SHA17a446ffddc37e4a6dafd3f45d3d7c34c26885ce6
SHA25626a9fde966bc459d278a1ce94d59cb95b1a152efb217164ca62fc15a15c68fbe
SHA512730ba1cc1d9febba94572669a424695c06f03ac478255a61202f68eab45d8cdc60b0c341c005fc0b48b9f2048c7ebdfeaec8e28cf8b040be345790c930f6588b
-
Filesize
1.3MB
MD512b8842dded9134ad0cae031c4f06530
SHA1c0ecd0ac8cf3e4851661f62fe283ecec0e6ca25e
SHA256abd87ec324df8d74245e1671f21e832b563eb8dc3c13b1688a9e85a2f809fe17
SHA512967d70105549641beaa3283c42143aac22e016c911f99ab1c7ef5b4eff2577790fc679a74af6d2df14e87c278762e2c39c96bbdeabeaa1b62fb9072f0baa1825
-
Filesize
609KB
MD53b2ca1aae0f3a277efde19ed66785e07
SHA1edfd0bb11c0baec2475149259c8a88a61a669de9
SHA256c65369fd8f5f8a6bcee8325879e912f7f5e5f37e40281077a4902668458887b1
SHA512191aa807ec2c9a663eef6439084fcc68cdba245d9924773d65f42286af1df31238931425de1c18a4b643c7cd9ac4e98e638994630af440b7a1556c1497c8bb25
-
Filesize
218KB
MD5d09be1f47fd6b827c81a4812b4f7296f
SHA1028ae3596c0790e6d7f9f2f3c8e9591527d267f7
SHA2560de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e
SHA512857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595
-
Filesize
54KB
MD5e6e578373c2e416289a8da55f1dc5e8e
SHA1b601a229b66ec3d19c2369b36216c6f6eb1c063e
SHA25643e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f
SHA5129df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89
-
Filesize
113KB
MD59aec524b616618b0d3d00b27b6f51da1
SHA164264300801a353db324d11738ffed876550e1d3
SHA25659a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e
SHA5120648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0
-
Filesize
647KB
MD55e279950775baae5fea04d2cc4526bcc
SHA18aef1e10031c3629512c43dd8b0b5d9060878453
SHA25697de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87
SHA512666325e9ed71da4955058aea31b91e2e848be43211e511865f393b7f537c208c6b31c182f7d728c2704e9fc87e7d1be3f98f5fee4d34f11c56764e1c599afd02
-
Filesize
69KB
MD51e0d62c34ff2e649ebc5c372065732ee
SHA1fcfaa36ba456159b26140a43e80fbd7e9d9af2de
SHA256509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723
SHA5123653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61
-
Filesize
2.1MB
MD5febbfc26db3b9b63c26a253d83685c61
SHA196efbac726821400049db0a1508566e0bce7ce1a
SHA25676b67dbf3cdf622e3266419e7acbbf9d7e3e22c1a3ef5eceec90ebda296b65ff
SHA512f14bf151bf40064f3ef9bee9671c7f5f3689a17bbfaa9319394f8b7178c82fdb29a133f48c8d0ad3ae89b63733667ff695d762dc031659a01714d823320b556c
-
Filesize
4.3MB
MD5a1ac3489d2401d26e3aea9bcb0a85b10
SHA16a4c4004ef746ed16d25c3fe425a6c78fcefe9b4
SHA2561cb9452373f7b755b1c64b41bd7ffcfe4fe0ab92fd08c61c283c5deccfd89146
SHA512293a84faadb89219945fde5836786cbcf4bdcaf36638603a5e95e80df4f5daf0b180d1f768deecee77b828ef736a337925479c37ae1e1f7126934f80be7b5e2e
-
Filesize
576B
MD56f6fe96279c933c2170e75f49cf43718
SHA1bbe211eaebbeb120b9ca3cd204aacbbeef20cb7e
SHA256e6919da4e2658c82ebbcca670053d77e1231a5a600bf5aeaba71e5852e09022f
SHA51276160b79d3cbe2fca6d95b096043641a96b13007f287f8e55b94eab16cbb98691a8e8fa8d035da434e84f689bb8d36478f632976481b56c7170889553a629748
-
Filesize
872KB
MD53928f9cc043cfb53823761dac703fd04
SHA1c825e75ae21b995996763487de07176230c2535e
SHA256c2d4ebb0b7be8eb8683cc1fdcd0b95c834888c56d555e6d23497ae211835f412
SHA5128739619195c9d1409819822ae3c53415ac57a1c485b6947022d81981c9a0c7811ea5a30af0ef32e0a34aacf589f74366866dc1e7e03cd4addf56b71b6b25d9c5
-
Filesize
872KB
MD5c56b5f0201a3b3de53e561fe76912bfd
SHA12a4062e10a5de813f5688221dbeb3f3ff33eb417
SHA256237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d
SHA512195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
4.8MB
MD5ec02f21e9609989b9dc71c981be1b38d
SHA1b06e15ef538626113b9a5cfbe70cb31480f2ca65
SHA256ffb56fbf4fcddd75123912dc66dab62c57bb790bb3f66fbff5f247760755fd06
SHA51220d8b49e3b770c92d084b319c6c1f0e4e643b42f0e9cb8b5d117344abce63607b30cbcdfb391ce7a82cf03aa0f4c20c419129d5394ecea4f40ed495bd3dbbd46