8f2453716a441978adf0f2854acafea836c61741aac0bd180ffa55dae92eab34

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
12-11-2024 18:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8f2453716a441978adf0f2854acafea836c61741aac0bd180ffa55dae92eab34.exe
Size

6.4MB
MD5

294233799eb3d7681e45da28026227f0
SHA1

eb97924a16f6c257ab73b4acaa9ee1038e2a574a
SHA256

8f2453716a441978adf0f2854acafea836c61741aac0bd180ffa55dae92eab34
SHA512

1c9acb1c4931b739209a9bc3133633f0c25c9d8ad05e7db173680f33b117b305585d5a7563665efb433ec66dea3f0cea17e72819657460718691f6c15142ad7f
SSDEEP

196608:47effIPEsy58doQaTxLhQyZbIly38doQalArdfehQM9rdQyZb9eMf1WIEnaryfh1:47effIPEsy58doQaTxLhQyZbIly38doC

Score

10^/10

adware discovery persistence stealer upx

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe"	8f2453716a441978adf0f2854acafea836c61741aac0bd180ffa55dae92eab34.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,"	8f2453716a441978adf0f2854acafea836c61741aac0bd180ffa55dae92eab34.exe

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\drivers\spools.exe	8f2453716a441978adf0f2854acafea836c61741aac0bd180ffa55dae92eab34.exe
File opened for modification	C:\Windows\SysWOW64\drivers\spools.exe	8f2453716a441978adf0f2854acafea836c61741aac0bd180ffa55dae92eab34.exe
File opened for modification	C:\Windows\SysWOW64\drivers\spools.exe	8f2453716a441978adf0f2854acafea836c61741aac0bd180ffa55dae92eab34.exe

Sets service image path in registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Schedule\ImagePath = "C:\\Windows\\system32\\drivers\\spools.exe"	8f2453716a441978adf0f2854acafea836c61741aac0bd180ffa55dae92eab34.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Schedule\ImagePath = "C:\\Windows\\system32\\drivers\\spools.exe"	8f2453716a441978adf0f2854acafea836c61741aac0bd180ffa55dae92eab34.exe

ACProtect 1.3x - 1.4x DLL software 4 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x000a000000023b58-15.dat	acprotect
behavioral2/memory/4932-18-0x0000000010000000-0x000000001010B000-memory.dmp	acprotect
behavioral2/memory/4520-34-0x0000000010000000-0x000000001010B000-memory.dmp	acprotect
behavioral2/memory/4520-39-0x0000000010000000-0x000000001010B000-memory.dmp	acprotect

Loads dropped DLL 2 IoCs

pid	Process
4932	8f2453716a441978adf0f2854acafea836c61741aac0bd180ffa55dae92eab34.exe
4520	8f2453716a441978adf0f2854acafea836c61741aac0bd180ffa55dae92eab34.exe

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ntuser = "C:\\Windows\\system32\\drivers\\spools.exe"	8f2453716a441978adf0f2854acafea836c61741aac0bd180ffa55dae92eab34.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\autoload = "C:\\Users\\Admin\\Local Settings\\Application Data\\cftmon.exe"	8f2453716a441978adf0f2854acafea836c61741aac0bd180ffa55dae92eab34.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ntuser = "C:\\Windows\\system32\\drivers\\spools.exe"	8f2453716a441978adf0f2854acafea836c61741aac0bd180ffa55dae92eab34.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\autoload = "C:\\Users\\Admin\\Local Settings\\Application Data\\cftmon.exe"	8f2453716a441978adf0f2854acafea836c61741aac0bd180ffa55dae92eab34.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ntuser = "C:\\Windows\\system32\\drivers\\spools.exe"	8f2453716a441978adf0f2854acafea836c61741aac0bd180ffa55dae92eab34.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\autoload = "C:\\Users\\Admin\\Local Settings\\Application Data\\cftmon.exe"	8f2453716a441978adf0f2854acafea836c61741aac0bd180ffa55dae92eab34.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ntuser = "C:\\Windows\\system32\\drivers\\spools.exe"	8f2453716a441978adf0f2854acafea836c61741aac0bd180ffa55dae92eab34.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\autoload = "C:\\Users\\Admin\\Local Settings\\Application Data\\cftmon.exe"	8f2453716a441978adf0f2854acafea836c61741aac0bd180ffa55dae92eab34.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\V:	8f2453716a441978adf0f2854acafea836c61741aac0bd180ffa55dae92eab34.exe
File opened (read-only)	\??\X:	8f2453716a441978adf0f2854acafea836c61741aac0bd180ffa55dae92eab34.exe
File opened (read-only)	\??\S:	8f2453716a441978adf0f2854acafea836c61741aac0bd180ffa55dae92eab34.exe
File opened (read-only)	\??\M:	8f2453716a441978adf0f2854acafea836c61741aac0bd180ffa55dae92eab34.exe
File opened (read-only)	\??\V:	8f2453716a441978adf0f2854acafea836c61741aac0bd180ffa55dae92eab34.exe
File opened (read-only)	\??\S:	8f2453716a441978adf0f2854acafea836c61741aac0bd180ffa55dae92eab34.exe
File opened (read-only)	\??\M:	8f2453716a441978adf0f2854acafea836c61741aac0bd180ffa55dae92eab34.exe
File opened (read-only)	\??\O:	8f2453716a441978adf0f2854acafea836c61741aac0bd180ffa55dae92eab34.exe
File opened (read-only)	\??\I:	8f2453716a441978adf0f2854acafea836c61741aac0bd180ffa55dae92eab34.exe
File opened (read-only)	\??\K:	8f2453716a441978adf0f2854acafea836c61741aac0bd180ffa55dae92eab34.exe
File opened (read-only)	\??\R:	8f2453716a441978adf0f2854acafea836c61741aac0bd180ffa55dae92eab34.exe
File opened (read-only)	\??\E:	8f2453716a441978adf0f2854acafea836c61741aac0bd180ffa55dae92eab34.exe
File opened (read-only)	\??\P:	8f2453716a441978adf0f2854acafea836c61741aac0bd180ffa55dae92eab34.exe
File opened (read-only)	\??\U:	8f2453716a441978adf0f2854acafea836c61741aac0bd180ffa55dae92eab34.exe
File opened (read-only)	\??\V:	8f2453716a441978adf0f2854acafea836c61741aac0bd180ffa55dae92eab34.exe
File opened (read-only)	\??\O:	8f2453716a441978adf0f2854acafea836c61741aac0bd180ffa55dae92eab34.exe
File opened (read-only)	\??\H:	8f2453716a441978adf0f2854acafea836c61741aac0bd180ffa55dae92eab34.exe
File opened (read-only)	\??\M:	8f2453716a441978adf0f2854acafea836c61741aac0bd180ffa55dae92eab34.exe
File opened (read-only)	\??\R:	8f2453716a441978adf0f2854acafea836c61741aac0bd180ffa55dae92eab34.exe
File opened (read-only)	\??\H:	8f2453716a441978adf0f2854acafea836c61741aac0bd180ffa55dae92eab34.exe
File opened (read-only)	\??\U:	8f2453716a441978adf0f2854acafea836c61741aac0bd180ffa55dae92eab34.exe
File opened (read-only)	\??\T:	8f2453716a441978adf0f2854acafea836c61741aac0bd180ffa55dae92eab34.exe
File opened (read-only)	\??\X:	8f2453716a441978adf0f2854acafea836c61741aac0bd180ffa55dae92eab34.exe
File opened (read-only)	\??\O:	8f2453716a441978adf0f2854acafea836c61741aac0bd180ffa55dae92eab34.exe
File opened (read-only)	\??\R:	8f2453716a441978adf0f2854acafea836c61741aac0bd180ffa55dae92eab34.exe
File opened (read-only)	\??\T:	8f2453716a441978adf0f2854acafea836c61741aac0bd180ffa55dae92eab34.exe
File opened (read-only)	\??\K:	8f2453716a441978adf0f2854acafea836c61741aac0bd180ffa55dae92eab34.exe
File opened (read-only)	\??\S:	8f2453716a441978adf0f2854acafea836c61741aac0bd180ffa55dae92eab34.exe
File opened (read-only)	\??\X:	8f2453716a441978adf0f2854acafea836c61741aac0bd180ffa55dae92eab34.exe
File opened (read-only)	\??\W:	8f2453716a441978adf0f2854acafea836c61741aac0bd180ffa55dae92eab34.exe
File opened (read-only)	\??\N:	8f2453716a441978adf0f2854acafea836c61741aac0bd180ffa55dae92eab34.exe
File opened (read-only)	\??\E:	8f2453716a441978adf0f2854acafea836c61741aac0bd180ffa55dae92eab34.exe
File opened (read-only)	\??\I:	8f2453716a441978adf0f2854acafea836c61741aac0bd180ffa55dae92eab34.exe
File opened (read-only)	\??\L:	8f2453716a441978adf0f2854acafea836c61741aac0bd180ffa55dae92eab34.exe
File opened (read-only)	\??\G:	8f2453716a441978adf0f2854acafea836c61741aac0bd180ffa55dae92eab34.exe
File opened (read-only)	\??\N:	8f2453716a441978adf0f2854acafea836c61741aac0bd180ffa55dae92eab34.exe
File opened (read-only)	\??\P:	8f2453716a441978adf0f2854acafea836c61741aac0bd180ffa55dae92eab34.exe
File opened (read-only)	\??\U:	8f2453716a441978adf0f2854acafea836c61741aac0bd180ffa55dae92eab34.exe
File opened (read-only)	\??\Q:	8f2453716a441978adf0f2854acafea836c61741aac0bd180ffa55dae92eab34.exe
File opened (read-only)	\??\J:	8f2453716a441978adf0f2854acafea836c61741aac0bd180ffa55dae92eab34.exe
File opened (read-only)	\??\W:	8f2453716a441978adf0f2854acafea836c61741aac0bd180ffa55dae92eab34.exe
File opened (read-only)	\??\Q:	8f2453716a441978adf0f2854acafea836c61741aac0bd180ffa55dae92eab34.exe
File opened (read-only)	\??\E:	8f2453716a441978adf0f2854acafea836c61741aac0bd180ffa55dae92eab34.exe
File opened (read-only)	\??\I:	8f2453716a441978adf0f2854acafea836c61741aac0bd180ffa55dae92eab34.exe
File opened (read-only)	\??\K:	8f2453716a441978adf0f2854acafea836c61741aac0bd180ffa55dae92eab34.exe
File opened (read-only)	\??\N:	8f2453716a441978adf0f2854acafea836c61741aac0bd180ffa55dae92eab34.exe
File opened (read-only)	\??\V:	8f2453716a441978adf0f2854acafea836c61741aac0bd180ffa55dae92eab34.exe
File opened (read-only)	\??\I:	8f2453716a441978adf0f2854acafea836c61741aac0bd180ffa55dae92eab34.exe
File opened (read-only)	\??\K:	8f2453716a441978adf0f2854acafea836c61741aac0bd180ffa55dae92eab34.exe
File opened (read-only)	\??\M:	8f2453716a441978adf0f2854acafea836c61741aac0bd180ffa55dae92eab34.exe
File opened (read-only)	\??\X:	8f2453716a441978adf0f2854acafea836c61741aac0bd180ffa55dae92eab34.exe
File opened (read-only)	\??\P:	8f2453716a441978adf0f2854acafea836c61741aac0bd180ffa55dae92eab34.exe
File opened (read-only)	\??\L:	8f2453716a441978adf0f2854acafea836c61741aac0bd180ffa55dae92eab34.exe
File opened (read-only)	\??\H:	8f2453716a441978adf0f2854acafea836c61741aac0bd180ffa55dae92eab34.exe
File opened (read-only)	\??\J:	8f2453716a441978adf0f2854acafea836c61741aac0bd180ffa55dae92eab34.exe
File opened (read-only)	\??\L:	8f2453716a441978adf0f2854acafea836c61741aac0bd180ffa55dae92eab34.exe
File opened (read-only)	\??\H:	8f2453716a441978adf0f2854acafea836c61741aac0bd180ffa55dae92eab34.exe
File opened (read-only)	\??\J:	8f2453716a441978adf0f2854acafea836c61741aac0bd180ffa55dae92eab34.exe
File opened (read-only)	\??\Q:	8f2453716a441978adf0f2854acafea836c61741aac0bd180ffa55dae92eab34.exe
File opened (read-only)	\??\R:	8f2453716a441978adf0f2854acafea836c61741aac0bd180ffa55dae92eab34.exe
File opened (read-only)	\??\O:	8f2453716a441978adf0f2854acafea836c61741aac0bd180ffa55dae92eab34.exe
File opened (read-only)	\??\T:	8f2453716a441978adf0f2854acafea836c61741aac0bd180ffa55dae92eab34.exe
File opened (read-only)	\??\P:	8f2453716a441978adf0f2854acafea836c61741aac0bd180ffa55dae92eab34.exe
File opened (read-only)	\??\I:	8f2453716a441978adf0f2854acafea836c61741aac0bd180ffa55dae92eab34.exe

Installs/modifies Browser Helper Object 2 TTPs 3 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	reg.exe

Modifies WinLogon 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\UIHost = "logonui.exe"	8f2453716a441978adf0f2854acafea836c61741aac0bd180ffa55dae92eab34.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\ftpdll.dll	8f2453716a441978adf0f2854acafea836c61741aac0bd180ffa55dae92eab34.exe
File opened for modification	C:\Windows\SysWOW64\ftpdll.dll	8f2453716a441978adf0f2854acafea836c61741aac0bd180ffa55dae92eab34.exe

UPX packed file 23 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4932-0-0x0000000000400000-0x0000000000426000-memory.dmp	upx
behavioral2/files/0x0012000000023a02-5.dat	upx
behavioral2/files/0x000a000000023b58-15.dat	upx
behavioral2/memory/4932-18-0x0000000010000000-0x000000001010B000-memory.dmp	upx
behavioral2/memory/4932-21-0x0000000000400000-0x0000000000426000-memory.dmp	upx
behavioral2/files/0x0002000000022ef8-22.dat	upx
behavioral2/memory/4520-34-0x0000000010000000-0x000000001010B000-memory.dmp	upx
behavioral2/memory/812-35-0x0000000000400000-0x0000000000426000-memory.dmp	upx
behavioral2/memory/4520-37-0x0000000000400000-0x0000000000426000-memory.dmp	upx
behavioral2/memory/4520-38-0x0000000000400000-0x0000000000426000-memory.dmp	upx
behavioral2/memory/2232-40-0x0000000000400000-0x0000000000426000-memory.dmp	upx
behavioral2/memory/4520-39-0x0000000010000000-0x000000001010B000-memory.dmp	upx
behavioral2/memory/3852-41-0x0000000000400000-0x0000000000426000-memory.dmp	upx
behavioral2/memory/3852-43-0x0000000000400000-0x0000000000426000-memory.dmp	upx
behavioral2/memory/4520-50-0x0000000000400000-0x0000000000426000-memory.dmp	upx
behavioral2/memory/2232-52-0x0000000000400000-0x0000000000426000-memory.dmp	upx
behavioral2/memory/4520-55-0x0000000000400000-0x0000000000426000-memory.dmp	upx
behavioral2/memory/812-69-0x0000000000400000-0x0000000000426000-memory.dmp	upx
behavioral2/memory/4520-70-0x0000000000400000-0x0000000000426000-memory.dmp	upx
behavioral2/memory/4520-80-0x0000000000400000-0x0000000000426000-memory.dmp	upx
behavioral2/memory/4520-85-0x0000000000400000-0x0000000000426000-memory.dmp	upx
behavioral2/memory/4520-90-0x0000000000400000-0x0000000000426000-memory.dmp	upx
behavioral2/memory/4520-95-0x0000000000400000-0x0000000000426000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8f2453716a441978adf0f2854acafea836c61741aac0bd180ffa55dae92eab34.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8f2453716a441978adf0f2854acafea836c61741aac0bd180ffa55dae92eab34.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8f2453716a441978adf0f2854acafea836c61741aac0bd180ffa55dae92eab34.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4932	8f2453716a441978adf0f2854acafea836c61741aac0bd180ffa55dae92eab34.exe
4932	8f2453716a441978adf0f2854acafea836c61741aac0bd180ffa55dae92eab34.exe
4932	8f2453716a441978adf0f2854acafea836c61741aac0bd180ffa55dae92eab34.exe
4932	8f2453716a441978adf0f2854acafea836c61741aac0bd180ffa55dae92eab34.exe
4932	8f2453716a441978adf0f2854acafea836c61741aac0bd180ffa55dae92eab34.exe
4932	8f2453716a441978adf0f2854acafea836c61741aac0bd180ffa55dae92eab34.exe
4932	8f2453716a441978adf0f2854acafea836c61741aac0bd180ffa55dae92eab34.exe
4932	8f2453716a441978adf0f2854acafea836c61741aac0bd180ffa55dae92eab34.exe
4932	8f2453716a441978adf0f2854acafea836c61741aac0bd180ffa55dae92eab34.exe
4932	8f2453716a441978adf0f2854acafea836c61741aac0bd180ffa55dae92eab34.exe
4932	8f2453716a441978adf0f2854acafea836c61741aac0bd180ffa55dae92eab34.exe
4932	8f2453716a441978adf0f2854acafea836c61741aac0bd180ffa55dae92eab34.exe
4932	8f2453716a441978adf0f2854acafea836c61741aac0bd180ffa55dae92eab34.exe
4932	8f2453716a441978adf0f2854acafea836c61741aac0bd180ffa55dae92eab34.exe
4932	8f2453716a441978adf0f2854acafea836c61741aac0bd180ffa55dae92eab34.exe
4932	8f2453716a441978adf0f2854acafea836c61741aac0bd180ffa55dae92eab34.exe
4932	8f2453716a441978adf0f2854acafea836c61741aac0bd180ffa55dae92eab34.exe
4932	8f2453716a441978adf0f2854acafea836c61741aac0bd180ffa55dae92eab34.exe
4932	8f2453716a441978adf0f2854acafea836c61741aac0bd180ffa55dae92eab34.exe
4932	8f2453716a441978adf0f2854acafea836c61741aac0bd180ffa55dae92eab34.exe
4932	8f2453716a441978adf0f2854acafea836c61741aac0bd180ffa55dae92eab34.exe
4932	8f2453716a441978adf0f2854acafea836c61741aac0bd180ffa55dae92eab34.exe
4932	8f2453716a441978adf0f2854acafea836c61741aac0bd180ffa55dae92eab34.exe
4932	8f2453716a441978adf0f2854acafea836c61741aac0bd180ffa55dae92eab34.exe
4932	8f2453716a441978adf0f2854acafea836c61741aac0bd180ffa55dae92eab34.exe
4932	8f2453716a441978adf0f2854acafea836c61741aac0bd180ffa55dae92eab34.exe
4932	8f2453716a441978adf0f2854acafea836c61741aac0bd180ffa55dae92eab34.exe
4932	8f2453716a441978adf0f2854acafea836c61741aac0bd180ffa55dae92eab34.exe
4932	8f2453716a441978adf0f2854acafea836c61741aac0bd180ffa55dae92eab34.exe
4932	8f2453716a441978adf0f2854acafea836c61741aac0bd180ffa55dae92eab34.exe
4932	8f2453716a441978adf0f2854acafea836c61741aac0bd180ffa55dae92eab34.exe
4932	8f2453716a441978adf0f2854acafea836c61741aac0bd180ffa55dae92eab34.exe
4932	8f2453716a441978adf0f2854acafea836c61741aac0bd180ffa55dae92eab34.exe
4932	8f2453716a441978adf0f2854acafea836c61741aac0bd180ffa55dae92eab34.exe
4932	8f2453716a441978adf0f2854acafea836c61741aac0bd180ffa55dae92eab34.exe
4932	8f2453716a441978adf0f2854acafea836c61741aac0bd180ffa55dae92eab34.exe
4932	8f2453716a441978adf0f2854acafea836c61741aac0bd180ffa55dae92eab34.exe
4932	8f2453716a441978adf0f2854acafea836c61741aac0bd180ffa55dae92eab34.exe
4932	8f2453716a441978adf0f2854acafea836c61741aac0bd180ffa55dae92eab34.exe
4932	8f2453716a441978adf0f2854acafea836c61741aac0bd180ffa55dae92eab34.exe
4932	8f2453716a441978adf0f2854acafea836c61741aac0bd180ffa55dae92eab34.exe
4932	8f2453716a441978adf0f2854acafea836c61741aac0bd180ffa55dae92eab34.exe
4932	8f2453716a441978adf0f2854acafea836c61741aac0bd180ffa55dae92eab34.exe
4932	8f2453716a441978adf0f2854acafea836c61741aac0bd180ffa55dae92eab34.exe
4932	8f2453716a441978adf0f2854acafea836c61741aac0bd180ffa55dae92eab34.exe
4932	8f2453716a441978adf0f2854acafea836c61741aac0bd180ffa55dae92eab34.exe
812	8f2453716a441978adf0f2854acafea836c61741aac0bd180ffa55dae92eab34.exe
812	8f2453716a441978adf0f2854acafea836c61741aac0bd180ffa55dae92eab34.exe
4932	8f2453716a441978adf0f2854acafea836c61741aac0bd180ffa55dae92eab34.exe
4932	8f2453716a441978adf0f2854acafea836c61741aac0bd180ffa55dae92eab34.exe
4932	8f2453716a441978adf0f2854acafea836c61741aac0bd180ffa55dae92eab34.exe
4932	8f2453716a441978adf0f2854acafea836c61741aac0bd180ffa55dae92eab34.exe
4932	8f2453716a441978adf0f2854acafea836c61741aac0bd180ffa55dae92eab34.exe
4932	8f2453716a441978adf0f2854acafea836c61741aac0bd180ffa55dae92eab34.exe
4932	8f2453716a441978adf0f2854acafea836c61741aac0bd180ffa55dae92eab34.exe
4932	8f2453716a441978adf0f2854acafea836c61741aac0bd180ffa55dae92eab34.exe
4932	8f2453716a441978adf0f2854acafea836c61741aac0bd180ffa55dae92eab34.exe
4932	8f2453716a441978adf0f2854acafea836c61741aac0bd180ffa55dae92eab34.exe
812	8f2453716a441978adf0f2854acafea836c61741aac0bd180ffa55dae92eab34.exe
812	8f2453716a441978adf0f2854acafea836c61741aac0bd180ffa55dae92eab34.exe
4520	8f2453716a441978adf0f2854acafea836c61741aac0bd180ffa55dae92eab34.exe
4520	8f2453716a441978adf0f2854acafea836c61741aac0bd180ffa55dae92eab34.exe
4520	8f2453716a441978adf0f2854acafea836c61741aac0bd180ffa55dae92eab34.exe
4520	8f2453716a441978adf0f2854acafea836c61741aac0bd180ffa55dae92eab34.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4520	8f2453716a441978adf0f2854acafea836c61741aac0bd180ffa55dae92eab34.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 4932 wrote to memory of 812	4932	8f2453716a441978adf0f2854acafea836c61741aac0bd180ffa55dae92eab34.exe	88
PID 4932 wrote to memory of 812	4932	8f2453716a441978adf0f2854acafea836c61741aac0bd180ffa55dae92eab34.exe	88
PID 4932 wrote to memory of 812	4932	8f2453716a441978adf0f2854acafea836c61741aac0bd180ffa55dae92eab34.exe	88
PID 4932 wrote to memory of 2920	4932	8f2453716a441978adf0f2854acafea836c61741aac0bd180ffa55dae92eab34.exe	92
PID 4932 wrote to memory of 2920	4932	8f2453716a441978adf0f2854acafea836c61741aac0bd180ffa55dae92eab34.exe	92
PID 4932 wrote to memory of 2920	4932	8f2453716a441978adf0f2854acafea836c61741aac0bd180ffa55dae92eab34.exe	92
PID 812 wrote to memory of 4520	812	8f2453716a441978adf0f2854acafea836c61741aac0bd180ffa55dae92eab34.exe	95
PID 812 wrote to memory of 4520	812	8f2453716a441978adf0f2854acafea836c61741aac0bd180ffa55dae92eab34.exe	95
PID 812 wrote to memory of 4520	812	8f2453716a441978adf0f2854acafea836c61741aac0bd180ffa55dae92eab34.exe	95
PID 812 wrote to memory of 2232	812	8f2453716a441978adf0f2854acafea836c61741aac0bd180ffa55dae92eab34.exe	97
PID 812 wrote to memory of 2232	812	8f2453716a441978adf0f2854acafea836c61741aac0bd180ffa55dae92eab34.exe	97
PID 812 wrote to memory of 2232	812	8f2453716a441978adf0f2854acafea836c61741aac0bd180ffa55dae92eab34.exe	97
PID 4520 wrote to memory of 3852	4520	8f2453716a441978adf0f2854acafea836c61741aac0bd180ffa55dae92eab34.exe	99
PID 4520 wrote to memory of 3852	4520	8f2453716a441978adf0f2854acafea836c61741aac0bd180ffa55dae92eab34.exe	99
PID 4520 wrote to memory of 3852	4520	8f2453716a441978adf0f2854acafea836c61741aac0bd180ffa55dae92eab34.exe	99

C:\Users\Admin\AppData\Local\Temp\8f2453716a441978adf0f2854acafea836c61741aac0bd180ffa55dae92eab34.exe
"C:\Users\Admin\AppData\Local\Temp\8f2453716a441978adf0f2854acafea836c61741aac0bd180ffa55dae92eab34.exe"
1⤵
- Modifies WinLogon for persistence
- Drops file in Drivers directory
- Sets service image path in registry
- Loads dropped DLL
- Adds Run key to start application
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4932
- C:\Users\Admin\AppData\Local\Temp\8f2453716a441978adf0f2854acafea836c61741aac0bd180ffa55dae92eab34.exe
  C:\Users\Admin\AppData\Local\Temp\8f2453716a441978adf0f2854acafea836c61741aac0bd180ffa55dae92eab34.exe
  2⤵
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:812
- - C:\Users\Admin\AppData\Local\Temp\8f2453716a441978adf0f2854acafea836c61741aac0bd180ffa55dae92eab34.exe
    C:\Users\Admin\AppData\Local\Temp\8f2453716a441978adf0f2854acafea836c61741aac0bd180ffa55dae92eab34.exe
    3⤵
    - Drops file in Drivers directory
    - Sets service image path in registry
    - Loads dropped DLL
    - Adds Run key to start application
    - Enumerates connected drives
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4520
  - - C:\Users\Admin\AppData\Local\Temp\8f2453716a441978adf0f2854acafea836c61741aac0bd180ffa55dae92eab34.exe
      C:\Users\Admin\AppData\Local\Temp\8f2453716a441978adf0f2854acafea836c61741aac0bd180ffa55dae92eab34.exe
      4⤵
      Enumerates connected drives
      PID:3852
- - C:\Users\Admin\AppData\Local\Temp\8f2453716a441978adf0f2854acafea836c61741aac0bd180ffa55dae92eab34.exe
    C:\Users\Admin\AppData\Local\Temp\8f2453716a441978adf0f2854acafea836c61741aac0bd180ffa55dae92eab34.exe
    3⤵
    - Enumerates connected drives
    PID:2232
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects" /f
  2⤵
  - Installs/modifies Browser Helper Object
  - System Location Discovery: System Language Discovery
  PID:2920

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Browser Extensions

T1176

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12

Filesize
1KB

MD5
67e486b2f148a3fca863728242b6273e

SHA1
452a84c183d7ea5b7c015b597e94af8eef66d44a

SHA256
facaf1c3a4bf232abce19a2d534e495b0d3adc7dbe3797d336249aa6f70adcfb

SHA512
d3a37da3bb10a9736dc03e8b2b49baceef5d73c026e2077b8ebc1b786f2c9b2f807e0aa13a5866cf3b3cafd2bc506242ef139c423eaffb050bbb87773e53881e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8

Filesize
436B

MD5
971c514f84bba0785f80aa1c23edfd79

SHA1
732acea710a87530c6b08ecdf32a110d254a54c8

SHA256
f157ed17fcaf8837fa82f8b69973848c9b10a02636848f995698212a08f31895

SHA512
43dc1425d80e170c645a3e3bb56da8c3acd31bd637329e9e37094ac346ac85434df4edcdbefc05ae00aea33a80a88e2af695997a495611217fe6706075a63c58

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12

Filesize
174B

MD5
d0c2176c022b3aa2afa5e21fc421e54d

SHA1
826ae6aabd7531c552625047bdadd2cfd9f2f690

SHA256
caf5be28c4a0b3afbc3fad3d73385272fda99c003af368f66f6a68a64b5d1bbb

SHA512
f2b4196b399f1b4d98ca3fb09f4a8f344d63335c60e4aad6327b66799cf3be82a0ded8865c9e9ae49e28f775ea15a716a09d7342d3a2aae8a46b46b18b9c4b54

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8

Filesize
170B

MD5
ab541a290668cad2ad5ed47f51edfdac

SHA1
cba2ba5e76d677d0383862433e8f5dc6847f1a8b

SHA256
d426854c36929d7c4efa1ec3da422d271273fec0d898c43674c7f0b043f03452

SHA512
df463d2c478610419273747337606b90f9c07c09caaba6ac006848d07b710c2527efdc9519a5c4eed1cd1928bee114e47eb3c6e867c192f05335d1abdeb1dc4f

Download Submit
C:\Users\Admin\AppData\Local\cftmon.exe

Filesize
6.4MB

MD5
6af665d03c4f31e33803f326cfa5e1f5

SHA1
a95286713f8e47ae949d3a5be7a567a55aa3997b

SHA256
6a7d797191127d998a768fae426525f916acbc6723e5b69a1ca546d19c7e3b67

SHA512
d6a4f14be11c35b5d6cc02e7de26bc0cd7693f899c0f97414a94c8ea1d30cec1ce38417871a0a70ec6be10cf8d63e64258d6540577b86d1408cb38a385a61923

Download Submit
C:\Windows\SysWOW64\drivers\spools.exe

Filesize
6.4MB

MD5
a1c1cafd60bf27a08f9dc666d87a761b

SHA1
fcf7baddcc6d911de4a1efce9938b8512b10880a

SHA256
618d0dca37cb4e3db8c91dd8191c21971f8ea8a1feb766da30549237bdd9e551

SHA512
043819b0eaceff23ea8d0182348c6d4e944b6305b8cf8c5ddd56d77722e2f6c2e70e73da1c81ed84b953c185a8a5131160bbfc650fdab78777d95170a0712187

Download Submit
C:\Windows\SysWOW64\ftpdll.dll

Filesize
5KB

MD5
d807aa04480d1d149f7a4cac22984188

SHA1
ffd5be65fd10017e34c11cecd105ebf4aa6c0cd9

SHA256
eddf092d901afe128322910c3ff41a3f242d33d6b4cdf91ece327076b324ccbb

SHA512
875543583c20ab164f37a4fb2587d234ce0a15d649d22b0d1dae5933f0a7683db170578746ea4458c51fec26e2243c6ec00dc10db8d4289789e50d5800cf863e

Download Submit
memory/812-69-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/812-35-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/2232-52-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/2232-40-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/3852-43-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/3852-41-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/4520-37-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/4520-55-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/4520-39-0x0000000010000000-0x000000001010B000-memory.dmp

Filesize
1.0MB

Download
memory/4520-95-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/4520-34-0x0000000010000000-0x000000001010B000-memory.dmp

Filesize
1.0MB

Download
memory/4520-50-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/4520-90-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/4520-38-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/4520-85-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/4520-70-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/4520-80-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/4932-18-0x0000000010000000-0x000000001010B000-memory.dmp

Filesize
1.0MB

Download
memory/4932-21-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/4932-0-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download