Overview
overview
10Static
static
10keygen-pr.exe
windows7-x64
3keygen-pr.exe
windows10-2004-x64
3keygen-step-1.exe
windows7-x64
10keygen-step-1.exe
windows10-2004-x64
10keygen-step-3.exe
windows7-x64
3keygen-step-3.exe
windows10-2004-x64
3keygen-step-4.exe
windows7-x64
10keygen-step-4.exe
windows10-2004-x64
10keygen.bat
windows7-x64
10keygen.bat
windows10-2004-x64
10Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
06-11-2024 13:27
Behavioral task
behavioral1
Sample
keygen-pr.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
keygen-pr.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
keygen-step-1.exe
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
keygen-step-1.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
keygen-step-3.exe
Resource
win7-20241010-en
Behavioral task
behavioral6
Sample
keygen-step-3.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
keygen-step-4.exe
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
keygen-step-4.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
keygen.bat
Resource
win7-20240729-en
General
-
Target
keygen.bat
-
Size
123B
-
MD5
f2632c204f883c59805093720dfe5a78
-
SHA1
c96e3aa03805a84fec3ea4208104a25a2a9d037e
-
SHA256
f9458a661ecd6c7e8fae669be72497288472a11ac3e823d3074e58f7fe98cd68
-
SHA512
5a19c4a777899889381be64f190e50a23cceee0abb78776b6d041e2384ba88e692972e40cefa34c03ca1b7d029475a0afbc5ce006ce833a1665e52008671bae2
Malware Config
Extracted
azorult
http://kvaka.li/1210776429.php
Extracted
ffdroider
http://101.36.107.74
Signatures
-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
Azorult family
-
Detect Fabookie payload 1 IoCs
resource yara_rule behavioral9/files/0x000500000001a42d-395.dat family_fabookie -
Fabookie family
-
Ffdroider family
-
Pony family
-
Detected Nirsoft tools 3 IoCs
Free utilities often used by attackers which can steal passwords, product keys, etc.
resource yara_rule behavioral9/files/0x000500000001c875-230.dat Nirsoft behavioral9/memory/2028-410-0x0000000000400000-0x000000000045B000-memory.dmp Nirsoft behavioral9/memory/328-458-0x0000000000400000-0x0000000000422000-memory.dmp Nirsoft -
Executes dropped EXE 13 IoCs
pid Process 2440 key.exe 1048 Setup.exe 2964 key.exe 1532 6489A2274AE24900.exe 2572 6489A2274AE24900.exe 796 md2_2efs.exe 2996 file.exe 2824 BTRSetp.exe 2588 installer.exe 1488 ThunderFW.exe 2504 gdrrr.exe 2028 jfiag3g_gg.exe 328 jfiag3g_gg.exe -
Loads dropped DLL 40 IoCs
pid Process 2400 keygen-pr.exe 2400 keygen-pr.exe 2400 keygen-pr.exe 2400 keygen-pr.exe 1964 keygen-step-4.exe 1964 keygen-step-4.exe 1964 keygen-step-4.exe 1964 keygen-step-4.exe 2440 key.exe 1044 MsiExec.exe 1048 Setup.exe 1048 Setup.exe 1964 keygen-step-4.exe 1964 keygen-step-4.exe 1964 keygen-step-4.exe 1964 keygen-step-4.exe 688 msiexec.exe 1252 Process not Found 1252 Process not Found 1252 Process not Found 1252 Process not Found 1964 keygen-step-4.exe 1964 keygen-step-4.exe 1964 keygen-step-4.exe 1964 keygen-step-4.exe 1964 keygen-step-4.exe 1964 keygen-step-4.exe 2824 BTRSetp.exe 2824 BTRSetp.exe 2824 BTRSetp.exe 2824 BTRSetp.exe 2824 BTRSetp.exe 2572 6489A2274AE24900.exe 1964 keygen-step-4.exe 1964 keygen-step-4.exe 1964 keygen-step-4.exe 2504 gdrrr.exe 2504 gdrrr.exe 2504 gdrrr.exe 2504 gdrrr.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
-
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts key.exe -
Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook key.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\haleng = "C:\\Users\\Admin\\AppData\\Local\\Temp\\haleng.exe" gdrrr.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops Chrome extension 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\eenkljkhpoeacjofglngodibakkdjajh\1.0.0.0_0\manifest.json 6489A2274AE24900.exe -
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\X: msiexec.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs
flow ioc 36 iplogger.org 37 iplogger.org 47 iplogger.org 52 iplogger.org -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 53 ip-api.com -
Writes to the Master Boot Record (MBR) 1 TTPs 3 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 Setup.exe File opened for modification \??\PhysicalDrive0 6489A2274AE24900.exe File opened for modification \??\PhysicalDrive0 6489A2274AE24900.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 1048 Setup.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 2440 set thread context of 2964 2440 key.exe 38 PID 2572 set thread context of 2500 2572 6489A2274AE24900.exe 56 PID 2572 set thread context of 2996 2572 6489A2274AE24900.exe 61 -
resource yara_rule behavioral9/files/0x000600000001c8a3-401.dat upx behavioral9/memory/2504-402-0x00000000003A0000-0x00000000003FB000-memory.dmp upx behavioral9/memory/2028-410-0x0000000000400000-0x000000000045B000-memory.dmp upx behavioral9/memory/328-453-0x0000000000400000-0x0000000000422000-memory.dmp upx behavioral9/files/0x000d00000001933b-451.dat upx behavioral9/memory/328-458-0x0000000000400000-0x0000000000422000-memory.dmp upx -
Drops file in Program Files directory 3 IoCs
description ioc Process File created C:\Program Files (x86)\gdiview\gdiview\GDIView.chm msiexec.exe File created C:\Program Files (x86)\gdiview\gdiview\GDIView.exe msiexec.exe File created C:\Program Files (x86)\gdiview\gdiview\readme.txt msiexec.exe -
Drops file in Windows directory 10 IoCs
description ioc Process File opened for modification C:\Windows\INF\setupapi.ev3 DrvInst.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File opened for modification C:\Windows\Installer\f773015.msi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\INF\setupapi.ev1 DrvInst.exe File created C:\Windows\Installer\f773015.msi msiexec.exe File created C:\Windows\Installer\f773016.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSI30F0.tmp msiexec.exe File created C:\Windows\Installer\f773018.msi msiexec.exe File opened for modification C:\Windows\Installer\f773016.ipi msiexec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 28 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language keygen-step-3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jfiag3g_gg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msiexec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language key.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language key.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language gdrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language keygen-step-1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Setup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language file.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jfiag3g_gg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language keygen-step-4.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language keygen-pr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language md2_2efs.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BTRSetp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6489A2274AE24900.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ThunderFW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6489A2274AE24900.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 8 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 2980 cmd.exe 1980 PING.EXE 992 cmd.exe 692 PING.EXE 2952 cmd.exe 1080 PING.EXE 1936 cmd.exe 2612 PING.EXE -
Kills process with taskkill 1 IoCs
pid Process 1440 taskkill.exe -
Modifies data under HKEY_USERS 43 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs DrvInst.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\6C0CE2DD0584C47CAC18839F14055F19FA270CDD Setup.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\6C0CE2DD0584C47CAC18839F14055F19FA270CDD\Blob = 0300000001000000140000006c0ce2dd0584c47cac18839f14055f19fa270cdd2000000001000000500500003082054c30820434a0030201020206016de34cff62300d06092a864886f70d01010b05003081aa313b303906035504030c32436861726c65732050726f78792043412028313920e58d81e69c8820323031392c204445534b544f502d424e41543131552931253023060355040b0c1c68747470733a2f2f636861726c657370726f78792e636f6d2f73736c3111300f060355040a0c08584b3732204c74643111300f06035504070c084175636b6c616e643111300f06035504080c084175636b6c616e64310b3009060355040613024e5a301e170d3030303130313030303030305a170d3438313231353039313533375a3081aa313b303906035504030c32436861726c65732050726f78792043412028313920e58d81e69c8820323031392c204445534b544f502d424e41543131552931253023060355040b0c1c68747470733a2f2f636861726c657370726f78792e636f6d2f73736c3111300f060355040a0c08584b3732204c74643111300f06035504070c084175636b6c616e643111300f06035504080c084175636b6c616e64310b3009060355040613024e5a30820122300d06092a864886f70d01010105000382010f003082010a0282010100ae86c5043ed34d99f44fa3052ea34047a7fbbe33188b1dc2ca645ca3249e85e54b4921d4998fda6a22247c32d9087d742af3bf850803ae8c1e25faad53fb8fd823b7353d9a3ac992bf917f693826c790e53a540b120b6553508ec9585e467d310bd3ef9fb61731deb522eb78f43f824b34be36782db7a8cb162cd22247b14e4c5ae633ed66542354a59971bddc59160ecdc521b4477c93ca9e624e0af00298602300f5dc368819c3cb9f02604636888276b3a498570473b5328b0834f327c34285e333da9207e12f0edbb654c8cf11e3cc7cba17a52cd7cd42c10ae095a2e4eb9d3e3f361488243f0584af40e72d6e6e182149bfb8342384f60f12e14734258d0203010001a382017430820170300f0603551d130101ff040530030101ff3082012c06096086480186f842010d0482011d138201195468697320526f6f74206365727469666963617465207761732067656e65726174656420627920436861726c65732050726f787920666f722053534c2050726f7879696e672e20496620746869732063657274696669636174652069732070617274206f66206120636572746966696361746520636861696e2c2074686973206d65616e73207468617420796f752772652062726f7773696e67207468726f75676820436861726c65732050726f787920776974682053534c2050726f7879696e6720656e61626c656420666f72207468697320776562736974652e20506c656173652073656520687474703a2f2f636861726c657370726f78792e636f6d2f73736c20666f72206d6f726520696e666f726d6174696f6e2e300e0603551d0f0101ff040403020204301d0603551d0e04160414f8d0dc54367cf794020f8b92783a5d8a91251f9f300d06092a864886f70d01010b05000382010100662271eb9d5c744c88382de98ba37320e6312104d04273a92007a8670976d6530e6347d00bbded1319bb6754f36237596095922911e3661a70354f6ba0b797a76258be7adebb8c8dbeeed977760b80271d74b2444d92f6c1337a379b73545b251de5f8812b9625abbbfaedc15f8c6c374b9b26dd0fef035185f5899d8819e689dc6db5f0babbfd637c52b1bec80115b889faeed493d4112d744954ad3abe6607c41a4a2d657ba330ed131fa4e8c25bb28ee181dcef8da91c17bfd30a23c8eae81b152ed85ff938afc32b34ffdaffbdb72d9bb04067bfc87f579eba9637b165ea008ea7408bc8265f33c039bf60f506d245a6b53017afc8e161d70ed5b0d76576 Setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 file.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e file.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e file.exe -
Runs ping.exe 1 TTPs 4 IoCs
pid Process 692 PING.EXE 1080 PING.EXE 2612 PING.EXE 1980 PING.EXE -
Suspicious behavior: CmdExeWriteProcessMemorySpam 4 IoCs
pid Process 2400 keygen-pr.exe 328 keygen-step-1.exe 1440 keygen-step-3.exe 1964 keygen-step-4.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
pid Process 2440 key.exe 2440 key.exe 688 msiexec.exe 688 msiexec.exe 328 jfiag3g_gg.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2988 msiexec.exe Token: SeIncreaseQuotaPrivilege 2988 msiexec.exe Token: SeRestorePrivilege 688 msiexec.exe Token: SeTakeOwnershipPrivilege 688 msiexec.exe Token: SeSecurityPrivilege 688 msiexec.exe Token: SeCreateTokenPrivilege 2988 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2988 msiexec.exe Token: SeLockMemoryPrivilege 2988 msiexec.exe Token: SeIncreaseQuotaPrivilege 2988 msiexec.exe Token: SeMachineAccountPrivilege 2988 msiexec.exe Token: SeTcbPrivilege 2988 msiexec.exe Token: SeSecurityPrivilege 2988 msiexec.exe Token: SeTakeOwnershipPrivilege 2988 msiexec.exe Token: SeLoadDriverPrivilege 2988 msiexec.exe Token: SeSystemProfilePrivilege 2988 msiexec.exe Token: SeSystemtimePrivilege 2988 msiexec.exe Token: SeProfSingleProcessPrivilege 2988 msiexec.exe Token: SeIncBasePriorityPrivilege 2988 msiexec.exe Token: SeCreatePagefilePrivilege 2988 msiexec.exe Token: SeCreatePermanentPrivilege 2988 msiexec.exe Token: SeBackupPrivilege 2988 msiexec.exe Token: SeRestorePrivilege 2988 msiexec.exe Token: SeShutdownPrivilege 2988 msiexec.exe Token: SeDebugPrivilege 2988 msiexec.exe Token: SeAuditPrivilege 2988 msiexec.exe Token: SeSystemEnvironmentPrivilege 2988 msiexec.exe Token: SeChangeNotifyPrivilege 2988 msiexec.exe Token: SeRemoteShutdownPrivilege 2988 msiexec.exe Token: SeUndockPrivilege 2988 msiexec.exe Token: SeSyncAgentPrivilege 2988 msiexec.exe Token: SeEnableDelegationPrivilege 2988 msiexec.exe Token: SeManageVolumePrivilege 2988 msiexec.exe Token: SeImpersonatePrivilege 2988 msiexec.exe Token: SeCreateGlobalPrivilege 2988 msiexec.exe Token: SeCreateTokenPrivilege 2988 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2988 msiexec.exe Token: SeLockMemoryPrivilege 2988 msiexec.exe Token: SeIncreaseQuotaPrivilege 2988 msiexec.exe Token: SeMachineAccountPrivilege 2988 msiexec.exe Token: SeTcbPrivilege 2988 msiexec.exe Token: SeSecurityPrivilege 2988 msiexec.exe Token: SeTakeOwnershipPrivilege 2988 msiexec.exe Token: SeLoadDriverPrivilege 2988 msiexec.exe Token: SeSystemProfilePrivilege 2988 msiexec.exe Token: SeSystemtimePrivilege 2988 msiexec.exe Token: SeProfSingleProcessPrivilege 2988 msiexec.exe Token: SeIncBasePriorityPrivilege 2988 msiexec.exe Token: SeCreatePagefilePrivilege 2988 msiexec.exe Token: SeCreatePermanentPrivilege 2988 msiexec.exe Token: SeBackupPrivilege 2988 msiexec.exe Token: SeRestorePrivilege 2988 msiexec.exe Token: SeShutdownPrivilege 2988 msiexec.exe Token: SeDebugPrivilege 2988 msiexec.exe Token: SeAuditPrivilege 2988 msiexec.exe Token: SeSystemEnvironmentPrivilege 2988 msiexec.exe Token: SeChangeNotifyPrivilege 2988 msiexec.exe Token: SeRemoteShutdownPrivilege 2988 msiexec.exe Token: SeUndockPrivilege 2988 msiexec.exe Token: SeSyncAgentPrivilege 2988 msiexec.exe Token: SeEnableDelegationPrivilege 2988 msiexec.exe Token: SeManageVolumePrivilege 2988 msiexec.exe Token: SeImpersonatePrivilege 2988 msiexec.exe Token: SeCreateGlobalPrivilege 2988 msiexec.exe Token: SeCreateTokenPrivilege 2988 msiexec.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2988 msiexec.exe 2988 msiexec.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2684 wrote to memory of 2400 2684 cmd.exe 32 PID 2684 wrote to memory of 2400 2684 cmd.exe 32 PID 2684 wrote to memory of 2400 2684 cmd.exe 32 PID 2684 wrote to memory of 2400 2684 cmd.exe 32 PID 2684 wrote to memory of 2400 2684 cmd.exe 32 PID 2684 wrote to memory of 2400 2684 cmd.exe 32 PID 2684 wrote to memory of 2400 2684 cmd.exe 32 PID 2684 wrote to memory of 328 2684 cmd.exe 33 PID 2684 wrote to memory of 328 2684 cmd.exe 33 PID 2684 wrote to memory of 328 2684 cmd.exe 33 PID 2684 wrote to memory of 328 2684 cmd.exe 33 PID 2684 wrote to memory of 1440 2684 cmd.exe 34 PID 2684 wrote to memory of 1440 2684 cmd.exe 34 PID 2684 wrote to memory of 1440 2684 cmd.exe 34 PID 2684 wrote to memory of 1440 2684 cmd.exe 34 PID 2684 wrote to memory of 1964 2684 cmd.exe 35 PID 2684 wrote to memory of 1964 2684 cmd.exe 35 PID 2684 wrote to memory of 1964 2684 cmd.exe 35 PID 2684 wrote to memory of 1964 2684 cmd.exe 35 PID 2400 wrote to memory of 2440 2400 keygen-pr.exe 36 PID 2400 wrote to memory of 2440 2400 keygen-pr.exe 36 PID 2400 wrote to memory of 2440 2400 keygen-pr.exe 36 PID 2400 wrote to memory of 2440 2400 keygen-pr.exe 36 PID 2400 wrote to memory of 2440 2400 keygen-pr.exe 36 PID 2400 wrote to memory of 2440 2400 keygen-pr.exe 36 PID 2400 wrote to memory of 2440 2400 keygen-pr.exe 36 PID 1964 wrote to memory of 1048 1964 keygen-step-4.exe 37 PID 1964 wrote to memory of 1048 1964 keygen-step-4.exe 37 PID 1964 wrote to memory of 1048 1964 keygen-step-4.exe 37 PID 1964 wrote to memory of 1048 1964 keygen-step-4.exe 37 PID 1964 wrote to memory of 1048 1964 keygen-step-4.exe 37 PID 1964 wrote to memory of 1048 1964 keygen-step-4.exe 37 PID 1964 wrote to memory of 1048 1964 keygen-step-4.exe 37 PID 2440 wrote to memory of 2964 2440 key.exe 38 PID 2440 wrote to memory of 2964 2440 key.exe 38 PID 2440 wrote to memory of 2964 2440 key.exe 38 PID 2440 wrote to memory of 2964 2440 key.exe 38 PID 2440 wrote to memory of 2964 2440 key.exe 38 PID 2440 wrote to memory of 2964 2440 key.exe 38 PID 2440 wrote to memory of 2964 2440 key.exe 38 PID 2440 wrote to memory of 2964 2440 key.exe 38 PID 2440 wrote to memory of 2964 2440 key.exe 38 PID 2440 wrote to memory of 2964 2440 key.exe 38 PID 2440 wrote to memory of 2964 2440 key.exe 38 PID 2440 wrote to memory of 2964 2440 key.exe 38 PID 2440 wrote to memory of 2964 2440 key.exe 38 PID 2440 wrote to memory of 2964 2440 key.exe 38 PID 2440 wrote to memory of 2964 2440 key.exe 38 PID 2440 wrote to memory of 2964 2440 key.exe 38 PID 2440 wrote to memory of 2964 2440 key.exe 38 PID 1048 wrote to memory of 2988 1048 Setup.exe 40 PID 1048 wrote to memory of 2988 1048 Setup.exe 40 PID 1048 wrote to memory of 2988 1048 Setup.exe 40 PID 1048 wrote to memory of 2988 1048 Setup.exe 40 PID 1048 wrote to memory of 2988 1048 Setup.exe 40 PID 1048 wrote to memory of 2988 1048 Setup.exe 40 PID 1048 wrote to memory of 2988 1048 Setup.exe 40 PID 688 wrote to memory of 1044 688 msiexec.exe 45 PID 688 wrote to memory of 1044 688 msiexec.exe 45 PID 688 wrote to memory of 1044 688 msiexec.exe 45 PID 688 wrote to memory of 1044 688 msiexec.exe 45 PID 688 wrote to memory of 1044 688 msiexec.exe 45 PID 688 wrote to memory of 1044 688 msiexec.exe 45 PID 688 wrote to memory of 1044 688 msiexec.exe 45 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
-
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook key.exe
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\keygen.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:2684 -
C:\Users\Admin\AppData\Local\Temp\keygen-pr.exekeygen-pr.exe -p83fsase3Ge2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious use of WriteProcessMemory
PID:2400 -
C:\Users\Admin\AppData\Local\Temp\RarSFX0\key.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\key.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Accesses Microsoft Outlook accounts
- Accesses Microsoft Outlook profiles
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- outlook_win_path
PID:2440 -
C:\Users\Admin\AppData\Local\Temp\RarSFX0\key.exeC:\Users\Admin\AppData\Local\Temp\RarSFX0\key.exe -txt -scanlocal -file:potato.dat4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2964
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\keygen-step-1.exekeygen-step-1.exe2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: CmdExeWriteProcessMemorySpam
PID:328
-
-
C:\Users\Admin\AppData\Local\Temp\keygen-step-3.exekeygen-step-3.exe2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: CmdExeWriteProcessMemorySpam
PID:1440
-
-
C:\Users\Admin\AppData\Local\Temp\keygen-step-4.exekeygen-step-4.exe2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious use of WriteProcessMemory
PID:1964 -
C:\Users\Admin\AppData\Local\Temp\RarSFX1\Setup.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX1\Setup.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:1048 -
C:\Windows\SysWOW64\msiexec.exemsiexec.exe /i "C:\Users\Admin\AppData\Local\Temp\gdiview.msi"4⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2988
-
-
C:\Users\Admin\AppData\Local\Temp\6489A2274AE24900.exeC:\Users\Admin\AppData\Local\Temp\6489A2274AE24900.exe 0011 installp14⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:2572 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"5⤵PID:2500
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"5⤵PID:2996
-
-
C:\Users\Admin\AppData\Local\Temp\download\ThunderFW.exeC:\Users\Admin\AppData\Local\Temp\download\ThunderFW.exe ThunderFW "C:\Users\Admin\AppData\Local\Temp\download\MiniThunderPlatform.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1488
-
-
C:\Windows\SysWOW64\cmd.execmd /c ping 127.0.0.1 -n 3 & del "C:\Users\Admin\AppData\Local\Temp\6489A2274AE24900.exe"5⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
PID:2980 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 36⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:1980
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\6489A2274AE24900.exeC:\Users\Admin\AppData\Local\Temp\6489A2274AE24900.exe 200 installp14⤵
- Executes dropped EXE
- Drops Chrome extension
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
PID:1532 -
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe5⤵
- System Location Discovery: System Language Discovery
PID:1884 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe6⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
PID:1440
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ping 127.0.0.1 -n 3 & del "C:\Users\Admin\AppData\Local\Temp\6489A2274AE24900.exe"5⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
PID:2952 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 36⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:1080
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ping 127.0.0.1 -n 3 & del "C:\Users\Admin\AppData\Local\Temp\RarSFX1\Setup.exe"4⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
PID:992 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 35⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:692
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\md2_2efs.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX1\md2_2efs.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:796
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\file.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX1\file.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies system certificate store
PID:2996 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 && del "C:\Users\Admin\AppData\Local\Temp\RarSFX1\file.exe" >> NUL4⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
PID:1936 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.15⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:2612
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\BTRSetp.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX1\BTRSetp.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2824 -
C:\Users\Admin\AppData\Local\Temp\RarSFX0\installer.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\installer.exe"4⤵
- Executes dropped EXE
PID:2588
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\gdrrr.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX1\gdrrr.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:2504 -
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2028
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:328
-
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Loads dropped DLL
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:688 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 99B25CC105D063C176A415D9D01281F3 C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1044
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵PID:2920
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000003E8" "00000000000005AC"1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:1816
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Pre-OS Boot
1Bootkit
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Modify Registry
2Pre-OS Boot
1Bootkit
1Subvert Trust Controls
1Install Root Certificate
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
4Credentials In Files
4Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
MD51f045165d66202b7effbe44454a1f55d
SHA11420be5e376e4a55d3113ef1270e3d085e157cac
SHA256dd9b9da116f11bf08d8708f80dfb0f40f9cfdcb6d8b3a4ebe6724fdfa57bcf8e
SHA51242a245b86b8fae4196d71b60224eee5db6c67dc20ff20bf5a2cd0321ea1591dd52c58226178a299474de54d9be307e6784f8bfb129fc6b3f6a8331c33c590fc5
-
Filesize
46KB
MD502d2c46697e3714e49f46b680b9a6b83
SHA184f98b56d49f01e9b6b76a4e21accf64fd319140
SHA256522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9
SHA51260348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
1.5MB
MD512476321a502e943933e60cfb4429970
SHA1c71d293b84d03153a1bd13c560fca0f8857a95a7
SHA25614a0fbd7eab461e49ee161ac3bd9ad8055086dbe56848dbaba9ec2034b3dea29
SHA512f222de8febc705146394fd389e6cece95b077a0629e18eab91c49b139bf5b686435e28a6ada4a0dbb951fd24ec3db692e7a5584d57ffd0e851739e595f2bbfdc
-
Filesize
58KB
MD551ef03c9257f2dd9b93bfdd74e96c017
SHA13baa7bee4b4b7d3ace13409d69dc7bcd0399ac34
SHA25682a022b29bda763ef9f2ce01c82c82e199182d1d0243cca9811eccc1d993cecf
SHA5122c97e5d08c9be89ca45153511e0976abfabf41e25d4187dcb7586ba125b6d8d763b99e79043ac1504203c26c7ab47a9246d9a0235b469f6c611703d4e2ae00e1
-
Filesize
715B
MD575e60ef89ecc910055472854c6879be0
SHA15c247e1ebfcdfabba35841f3a10c8e6f9259ac10
SHA2560b343170c8279aff7006ba6c0981128c66c9ed378446dc9f80796b9eac40c7cc
SHA5124707eada759e3a55e3de70c4c7618e58454c33a56e0559ce99e71e1d1224ed106fcbc19ed5dae29536010c631505abbb75f0507061e2945f6e7f9ee578e98996
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
231KB
MD57cc103f6fd70c6f3a2d2b9fca0438182
SHA1699bd8924a27516b405ea9a686604b53b4e23372
SHA256dbd9f2128f0b92b21ef99a1d7a0f93f14ebe475dba436d8b1562677821b918a1
SHA51292ec9590e32a0cf810fc5d15ca9d855c86e5b8cb17cf45dd68bcb972bd78692436535adf9f510259d604e0a8ba2e25c6d2616df242261eb7b09a0ca5c6c2c128
-
Filesize
61KB
MD5a6279ec92ff948760ce53bba817d6a77
SHA15345505e12f9e4c6d569a226d50e71b5a572dce2
SHA2568b581869bf8944a8e0aa169adea2a4afe47434123da477132880aff6a5032181
SHA512213cb374f1273c899e0c88a20c0101a7c28024ce5046a2e0d7898bd182d918288bb80367fea4454c437c057ff9ed4fffd42be48a13ca73653021a6d63e1cfa9c
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n3lsnn48.Admin\storage\default\moz-extension+++c9cdd9b2-a8a6-4f4c-8167-86f19e1820e6^userContextId=4294967295\idb\3647222921wleabcEoxlt-eengsairo.sqlite
Filesize48KB
MD52eab03c24e521ee22c08a3e3bab16d7f
SHA1d8ea20c5d4e7866c66ef36201e27fce4e10ad12b
SHA2565c1fffc1e126ebbc19e4ef0cff60d5a0278cc57868737157746827acf7248ba2
SHA512916cefe311d2b01d58062a022f5172880bd99c817b421f354a75a5c09e013676da7e2c16f333f1be121d62cb848b9739b0f2c4d2f45c56789574b93a97c7685b
-
Filesize
108KB
MD5292ce5c1baa3da54f5bfd847bdd92fa1
SHA14d98e3522790a9408e7e85d0e80c3b54a43318e1
SHA256c49560f7a206b6b55d89c205a4631dfedd2b4a78ab81fea8706989a5627f95a1
SHA51287df5d622d8f0685edf93f97b8213c893b203d1c6d064af238f0bdc0dc985c9968be6f0907aff4fb64a320b0886ef2bed2339694aca12f0bcd9502ce3d6f089d
-
Filesize
6KB
MD584878b1a26f8544bda4e069320ad8e7d
SHA151c6ee244f5f2fa35b563bffb91e37da848a759c
SHA256809aab5eace34dfbfb2b3d45462d42b34fcb95b415201d0d625414b56e437444
SHA5124742b84826961f590e0a2d6cc85a60b59ca4d300c58be5d0c33eb2315cefaf5627ae5ed908233ad51e188ce53ca861cf5cf8c1aa2620dc2667f83f98e627b549
-
Filesize
169KB
MD5874d5bd8807cebd41fd65ea12f4f9252
SHA1d3833cf480b3d6bdd05be3e837cdebabfc6cdb5d
SHA2562b1503e2375fcd64699867b513e8e51a6f15a1fbc461755249bff01adb658985
SHA512b2e47db04d8bc92037e1d1492df161f1e66a75ef99e3c77b3ae6b9b74e270cb7b705f02b26ca9edf63a138244ca013fb4b7d41d4ade66404d1ec77433bbe1b48
-
Filesize
678KB
MD5b2d8ce7b40730bc6615728b1b1795ce9
SHA15cf7a63f3ecc2184e7b2894c78538d89f7063fe1
SHA256ee4b58514316c6fc928e60245384560a24723e690a3311e8c2dd9e8efd5de7ca
SHA512cc79016627fb17a864ca3414f8bc598d52a9d17ec64ee1005b059a84597fe16493203879ff1c5a5ed46cf15a9e590098672a4b21a38852cace9bb02d8f1c531e
-
Filesize
5.0MB
MD5edeb50f0b803732a581ab558bf87d968
SHA135858ce564d4c8b080bae606bf67292f5b9b2201
SHA256ee9743026ad49017735e58c3d9ee9198db87eb6a3ab77242aa9d15155a9504b6
SHA5128c47a7964791452fc499046d60b08b99f7a986b3827cddeba88b20e91c0ff69475314f17662c33286f421d433fb507a9c673bcce75f0c5bb333ca6e58b219273
-
Filesize
143KB
MD526baf1dd4e0c44975cf943b6d5269b07
SHA14648e9a79c7a4fd5be622128ddc5af68697f3121
SHA2569117de15747527123f93284c821ea2e681b574639112532e66ad37a8246d98c9
SHA51257adccbf3424849a19291e9e4ec018a4f3b1ca5fbdfedd16592fadae5c7664249eafcff85e916dd2342ab47b6440ac314af63360aaafba1a11c7356c0f27fcef
-
Filesize
975KB
MD56a714c56525073f78181129ce52175db
SHA1eb7a9356e9cc40368e1774035c23b15b7c8d792b
SHA25657c417f53d9032a2f256cee17c274df2d411858abb14789406671c1dca6017c4
SHA51204a183bddeeaa6fe316596fad52a6e707549ca2e93b2b294c618b4381018bf5791582e2ac08e0f5e5cea86ac980a56208e54e1e310945614e00524d50a00c550
-
Filesize
1.3MB
MD56f3b825f098993be0b5dbd0e42790b15
SHA1cb6b13faf195f76f064c19d5b1a08b5d0633d3ea
SHA256c6ee0d49bdb6580c6a972e1b087ba4973984843c94832082cb0454e17386ab2e
SHA512bff72b5587ce20201e08919456726872aa253eceb7836884995f2807aaf1d6dc9ebd681c3aa6e34a56be18f1f3369bea4876df6836329dd43202103db7b7d34c
-
Filesize
71KB
MD5f0372ff8a6148498b19e04203dbb9e69
SHA127fe4b5f8cb9464ab5ddc63e69c3c180b77dbde8
SHA256298d334b630c77b70e66cf5e9c1924c7f0d498b02c2397e92e2d9efdff2e1bdf
SHA51265d84817cdddb808b6e0ab964a4b41e96f7ce129e3cc8c253a31642efe73a9b7070638c22c659033e1479322aceea49d1afdceff54f8ed044b1513bffd33f865
-
Filesize
184KB
MD57fee8223d6e4f82d6cd115a28f0b6d58
SHA11b89c25f25253df23426bd9ff6c9208f1202f58b
SHA256a45317c374d54e322153afd73f0e90f1486638d77b7fd85746d091071bbecd59
SHA5123ed900b83dd178637c2fd4e8444a899f17f12c4ec92a6f4de4fe544fe8d41b521c69b8f348343cb397d0e160f23e27429042d758b5fa5acac0bab5c3584bace4