Analysis
-
max time kernel
37s -
max time network
43s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
20-11-2024 00:25
Behavioral task
behavioral1
Sample
df935b9361d774ecac1e063264480ec45c833a99182f6934bedac4d58bcf14b9N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
df935b9361d774ecac1e063264480ec45c833a99182f6934bedac4d58bcf14b9N.exe
Resource
win10v2004-20241007-en
Errors
General
-
Target
df935b9361d774ecac1e063264480ec45c833a99182f6934bedac4d58bcf14b9N.exe
-
Size
2.3MB
-
MD5
e458deafb28333f548c26abb8ab87360
-
SHA1
0c1fdb03cfc6006c3c698fbfc853d1e9371cfe76
-
SHA256
df935b9361d774ecac1e063264480ec45c833a99182f6934bedac4d58bcf14b9
-
SHA512
eb62aedc33c5a9f48bc9153774fb91f71e2e160fc679f1b7eeb7982c1aab13a8dd206ea51ca39f143b6ed7dcf2660851d43109784639d6adec61bd4ebdaa8ad6
-
SSDEEP
49152:dnsHyjtk2MYC5GDNYTWPNykHuuSshTypt:dnsmtk2adeoiOln
Malware Config
Extracted
xred
xred.mooo.com
-
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1
http://xred.site50.net/syn/SUpdate.ini
https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1
http://xred.site50.net/syn/Synaptics.rar
https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1
http://xred.site50.net/syn/SSLLibrary.dll
Signatures
-
Xred family
-
Drops file in Drivers directory 2 IoCs
description ioc Process File opened for modification C:\Windows\system32\Drivers\ElbyCDIO.sys ._cache_df935b9361d774ecac1e063264480ec45c833a99182f6934bedac4d58bcf14b9N.exe File created C:\Windows\system32\Drivers\ElbyCDIO.sys ._cache_df935b9361d774ecac1e063264480ec45c833a99182f6934bedac4d58bcf14b9N.exe -
Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Executes dropped EXE 5 IoCs
pid Process 3008 ._cache_df935b9361d774ecac1e063264480ec45c833a99182f6934bedac4d58bcf14b9N.exe 2812 Synaptics.exe 2888 ._cache_Synaptics.exe 3032 DevCon.exe 988 DevCon.exe -
Loads dropped DLL 18 IoCs
pid Process 2204 df935b9361d774ecac1e063264480ec45c833a99182f6934bedac4d58bcf14b9N.exe 2204 df935b9361d774ecac1e063264480ec45c833a99182f6934bedac4d58bcf14b9N.exe 2204 df935b9361d774ecac1e063264480ec45c833a99182f6934bedac4d58bcf14b9N.exe 2812 Synaptics.exe 2812 Synaptics.exe 3008 ._cache_df935b9361d774ecac1e063264480ec45c833a99182f6934bedac4d58bcf14b9N.exe 3008 ._cache_df935b9361d774ecac1e063264480ec45c833a99182f6934bedac4d58bcf14b9N.exe 3008 ._cache_df935b9361d774ecac1e063264480ec45c833a99182f6934bedac4d58bcf14b9N.exe 3008 ._cache_df935b9361d774ecac1e063264480ec45c833a99182f6934bedac4d58bcf14b9N.exe 3008 ._cache_df935b9361d774ecac1e063264480ec45c833a99182f6934bedac4d58bcf14b9N.exe 3008 ._cache_df935b9361d774ecac1e063264480ec45c833a99182f6934bedac4d58bcf14b9N.exe 3008 ._cache_df935b9361d774ecac1e063264480ec45c833a99182f6934bedac4d58bcf14b9N.exe 3008 ._cache_df935b9361d774ecac1e063264480ec45c833a99182f6934bedac4d58bcf14b9N.exe 3008 ._cache_df935b9361d774ecac1e063264480ec45c833a99182f6934bedac4d58bcf14b9N.exe 1248 Process not Found 3008 ._cache_df935b9361d774ecac1e063264480ec45c833a99182f6934bedac4d58bcf14b9N.exe 816 Process not Found 3008 ._cache_df935b9361d774ecac1e063264480ec45c833a99182f6934bedac4d58bcf14b9N.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" df935b9361d774ecac1e063264480ec45c833a99182f6934bedac4d58bcf14b9N.exe -
Drops file in System32 directory 13 IoCs
description ioc Process File opened for modification C:\Windows\System32\DriverStore\Temp\{6c871e5c-6078-0da4-f66b-1f33b992bb24}\SET3267.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{6c871e5c-6078-0da4-f66b-1f33b992bb24}\SET3267.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{6c871e5c-6078-0da4-f66b-1f33b992bb24}\VClone.cat DrvInst.exe File created C:\Windows\SysWOW64\ElbyVCD.dll ._cache_df935b9361d774ecac1e063264480ec45c833a99182f6934bedac4d58bcf14b9N.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{6c871e5c-6078-0da4-f66b-1f33b992bb24}\amd64\SET3266.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{6c871e5c-6078-0da4-f66b-1f33b992bb24}\amd64\SET3266.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{6c871e5c-6078-0da4-f66b-1f33b992bb24}\amd64\VClone.sys DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{6c871e5c-6078-0da4-f66b-1f33b992bb24}\SET3268.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{6c871e5c-6078-0da4-f66b-1f33b992bb24}\SET3268.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{6c871e5c-6078-0da4-f66b-1f33b992bb24}\vclone.inf DrvInst.exe File opened for modification C:\Windows\SysWOW64\ElbyCDIO.dll ._cache_df935b9361d774ecac1e063264480ec45c833a99182f6934bedac4d58bcf14b9N.exe File created C:\Windows\SysWOW64\ElbyCDIO.dll ._cache_df935b9361d774ecac1e063264480ec45c833a99182f6934bedac4d58bcf14b9N.exe File opened for modification C:\Windows\SysWOW64\ElbyVCD.dll ._cache_df935b9361d774ecac1e063264480ec45c833a99182f6934bedac4d58bcf14b9N.exe -
resource yara_rule behavioral1/files/0x00090000000120f1-4.dat upx behavioral1/memory/3008-9-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2812-38-0x0000000004170000-0x0000000004198000-memory.dmp upx behavioral1/memory/2888-43-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/3008-48-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/3008-51-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/files/0x0005000000019622-63.dat upx behavioral1/memory/3008-449-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/3008-461-0x0000000000400000-0x0000000000428000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\manual\el\images\drive_shell.gif ._cache_df935b9361d774ecac1e063264480ec45c833a99182f6934bedac4d58bcf14b9N.exe File created C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\manual\jp\img\install03.jpg ._cache_df935b9361d774ecac1e063264480ec45c833a99182f6934bedac4d58bcf14b9N.exe File opened for modification C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\manual\jp\img\install05.jpg ._cache_df935b9361d774ecac1e063264480ec45c833a99182f6934bedac4d58bcf14b9N.exe File created C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\manual\de\images\drive_shell.gif ._cache_df935b9361d774ecac1e063264480ec45c833a99182f6934bedac4d58bcf14b9N.exe File created C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\manual\images\pixel.gif ._cache_df935b9361d774ecac1e063264480ec45c833a99182f6934bedac4d58bcf14b9N.exe File created C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\manual\jp\img\setting01.jpg ._cache_df935b9361d774ecac1e063264480ec45c833a99182f6934bedac4d58bcf14b9N.exe File created C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\manual\jp\img\uninst02.jpg ._cache_df935b9361d774ecac1e063264480ec45c833a99182f6934bedac4d58bcf14b9N.exe File created C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\manual\ua\images\drive_verify.jpg ._cache_df935b9361d774ecac1e063264480ec45c833a99182f6934bedac4d58bcf14b9N.exe File opened for modification C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\Texts\VCDPrefsFR.lng ._cache_df935b9361d774ecac1e063264480ec45c833a99182f6934bedac4d58bcf14b9N.exe File opened for modification C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\Texts\VCDShellAR.lng ._cache_df935b9361d774ecac1e063264480ec45c833a99182f6934bedac4d58bcf14b9N.exe File created C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\Texts\VCDShellPL.lng ._cache_df935b9361d774ecac1e063264480ec45c833a99182f6934bedac4d58bcf14b9N.exe File opened for modification C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\manual\de\images\drive_shell.gif ._cache_df935b9361d774ecac1e063264480ec45c833a99182f6934bedac4d58bcf14b9N.exe File opened for modification C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\Daemon.exe ._cache_df935b9361d774ecac1e063264480ec45c833a99182f6934bedac4d58bcf14b9N.exe File created C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\manual\jp\img\elby.gif ._cache_df935b9361d774ecac1e063264480ec45c833a99182f6934bedac4d58bcf14b9N.exe File created C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\manual\jp\img\mount01.jpg ._cache_df935b9361d774ecac1e063264480ec45c833a99182f6934bedac4d58bcf14b9N.exe File opened for modification C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\Texts\VCDPrefsDA.lng ._cache_df935b9361d774ecac1e063264480ec45c833a99182f6934bedac4d58bcf14b9N.exe File created C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\vcd-uninst.exe ._cache_df935b9361d774ecac1e063264480ec45c833a99182f6934bedac4d58bcf14b9N.exe File created C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\ElbyDVD.exe ._cache_df935b9361d774ecac1e063264480ec45c833a99182f6934bedac4d58bcf14b9N.exe File opened for modification C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\manual\jp\img\elby.gif ._cache_df935b9361d774ecac1e063264480ec45c833a99182f6934bedac4d58bcf14b9N.exe File created C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\manual\jp\img\spacer_01.gif ._cache_df935b9361d774ecac1e063264480ec45c833a99182f6934bedac4d58bcf14b9N.exe File created C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\Texts\VCDPrefsStrings.h ._cache_df935b9361d774ecac1e063264480ec45c833a99182f6934bedac4d58bcf14b9N.exe File opened for modification C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\Texts\VCDShellRU.lng ._cache_df935b9361d774ecac1e063264480ec45c833a99182f6934bedac4d58bcf14b9N.exe File created C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\ExecuteWithUAC.exe ._cache_df935b9361d774ecac1e063264480ec45c833a99182f6934bedac4d58bcf14b9N.exe File opened for modification C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\manual\ua\images\drive_shell.JPG ._cache_df935b9361d774ecac1e063264480ec45c833a99182f6934bedac4d58bcf14b9N.exe File created C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\manual\images\left_light.gif ._cache_df935b9361d774ecac1e063264480ec45c833a99182f6934bedac4d58bcf14b9N.exe File created C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe ._cache_df935b9361d774ecac1e063264480ec45c833a99182f6934bedac4d58bcf14b9N.exe File opened for modification C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\manual\ua\images\drive_verify.jpg ._cache_df935b9361d774ecac1e063264480ec45c833a99182f6934bedac4d58bcf14b9N.exe File created C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\manual\en\images\drive_shell.gif ._cache_df935b9361d774ecac1e063264480ec45c833a99182f6934bedac4d58bcf14b9N.exe File created C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\manual\en\index.html ._cache_df935b9361d774ecac1e063264480ec45c833a99182f6934bedac4d58bcf14b9N.exe File opened for modification C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\manual\jp\img\spacer_01.gif ._cache_df935b9361d774ecac1e063264480ec45c833a99182f6934bedac4d58bcf14b9N.exe File opened for modification C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\Texts\VCDShellNL.lng ._cache_df935b9361d774ecac1e063264480ec45c833a99182f6934bedac4d58bcf14b9N.exe File opened for modification C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\manual\de\images\drive_install.gif ._cache_df935b9361d774ecac1e063264480ec45c833a99182f6934bedac4d58bcf14b9N.exe File opened for modification C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\ExecuteWithUAC.exe ._cache_df935b9361d774ecac1e063264480ec45c833a99182f6934bedac4d58bcf14b9N.exe File created C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\Texts\VCDPrefsEN.lng ._cache_df935b9361d774ecac1e063264480ec45c833a99182f6934bedac4d58bcf14b9N.exe File opened for modification C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\Texts\VCDPrefsSV.lng ._cache_df935b9361d774ecac1e063264480ec45c833a99182f6934bedac4d58bcf14b9N.exe File created C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\Texts\VCDShellIT.lng ._cache_df935b9361d774ecac1e063264480ec45c833a99182f6934bedac4d58bcf14b9N.exe File opened for modification C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe ._cache_df935b9361d774ecac1e063264480ec45c833a99182f6934bedac4d58bcf14b9N.exe File created C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDMount.exe ._cache_df935b9361d774ecac1e063264480ec45c833a99182f6934bedac4d58bcf14b9N.exe File opened for modification C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\Texts\VCDPrefsCZ.lng ._cache_df935b9361d774ecac1e063264480ec45c833a99182f6934bedac4d58bcf14b9N.exe File opened for modification C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\manual\jp\img\setting04.jpg ._cache_df935b9361d774ecac1e063264480ec45c833a99182f6934bedac4d58bcf14b9N.exe File opened for modification C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\manual\jp\mount.html ._cache_df935b9361d774ecac1e063264480ec45c833a99182f6934bedac4d58bcf14b9N.exe File created C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\manual\ru\index.html ._cache_df935b9361d774ecac1e063264480ec45c833a99182f6934bedac4d58bcf14b9N.exe File opened for modification C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\manual\ua\index.html ._cache_df935b9361d774ecac1e063264480ec45c833a99182f6934bedac4d58bcf14b9N.exe File created C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\Texts\VCDPrefsPL.lng ._cache_df935b9361d774ecac1e063264480ec45c833a99182f6934bedac4d58bcf14b9N.exe File opened for modification C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\manual\jp\img\install01.jpg ._cache_df935b9361d774ecac1e063264480ec45c833a99182f6934bedac4d58bcf14b9N.exe File created C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\manual\images\elby_medium.gif ._cache_df935b9361d774ecac1e063264480ec45c833a99182f6934bedac4d58bcf14b9N.exe File opened for modification C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\manual\ua\images\drive_install.JPG ._cache_df935b9361d774ecac1e063264480ec45c833a99182f6934bedac4d58bcf14b9N.exe File created C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\Texts\VCDShellJP.lng ._cache_df935b9361d774ecac1e063264480ec45c833a99182f6934bedac4d58bcf14b9N.exe File opened for modification C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\manual\de\images\drive_verify.gif ._cache_df935b9361d774ecac1e063264480ec45c833a99182f6934bedac4d58bcf14b9N.exe File created C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\Texts\VCDShellEL.lng ._cache_df935b9361d774ecac1e063264480ec45c833a99182f6934bedac4d58bcf14b9N.exe File opened for modification C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\Texts\VCDPrefsSK.lng ._cache_df935b9361d774ecac1e063264480ec45c833a99182f6934bedac4d58bcf14b9N.exe File created C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\manual\jp\toc.html ._cache_df935b9361d774ecac1e063264480ec45c833a99182f6934bedac4d58bcf14b9N.exe File opened for modification C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\Texts\VCDPrefsES.lng ._cache_df935b9361d774ecac1e063264480ec45c833a99182f6934bedac4d58bcf14b9N.exe File opened for modification C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\Texts\VCDPrefsUA.lng ._cache_df935b9361d774ecac1e063264480ec45c833a99182f6934bedac4d58bcf14b9N.exe File opened for modification C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\Texts\VCDShellTR.lng ._cache_df935b9361d774ecac1e063264480ec45c833a99182f6934bedac4d58bcf14b9N.exe File opened for modification C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\manual\jp\img\ttl_02.gif ._cache_df935b9361d774ecac1e063264480ec45c833a99182f6934bedac4d58bcf14b9N.exe File created C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\manual\jp\setting.html ._cache_df935b9361d774ecac1e063264480ec45c833a99182f6934bedac4d58bcf14b9N.exe File created C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\manual\ru\drive.html ._cache_df935b9361d774ecac1e063264480ec45c833a99182f6934bedac4d58bcf14b9N.exe File opened for modification C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\SetRegACL.exe ._cache_df935b9361d774ecac1e063264480ec45c833a99182f6934bedac4d58bcf14b9N.exe File created C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\SetRegACL.exe ._cache_df935b9361d774ecac1e063264480ec45c833a99182f6934bedac4d58bcf14b9N.exe File opened for modification C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDMount.exe ._cache_df935b9361d774ecac1e063264480ec45c833a99182f6934bedac4d58bcf14b9N.exe File created C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\InstallHelp.dll ._cache_df935b9361d774ecac1e063264480ec45c833a99182f6934bedac4d58bcf14b9N.exe File opened for modification C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\manual\sv\index.html ._cache_df935b9361d774ecac1e063264480ec45c833a99182f6934bedac4d58bcf14b9N.exe File created C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\Texts\VCDPrefsBR.lng ._cache_df935b9361d774ecac1e063264480ec45c833a99182f6934bedac4d58bcf14b9N.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\INF\setupapi.app.log DevCon.exe File opened for modification C:\Windows\INF\setupapi.dev.log DevCon.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EXCEL.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language df935b9361d774ecac1e063264480ec45c833a99182f6934bedac4d58bcf14b9N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ._cache_df935b9361d774ecac1e063264480ec45c833a99182f6934bedac4d58bcf14b9N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Synaptics.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ._cache_Synaptics.exe -
Enumerates system info in registry 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE -
Modifies data under HKEY_USERS 51 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPublisher\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPublisher\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPublisher\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPublisher DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe -
Modifies registry class 21 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\elby.VCDMount.1\shell ._cache_df935b9361d774ecac1e063264480ec45c833a99182f6934bedac4d58bcf14b9N.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\elby.VCDMount.1\shell\open ._cache_df935b9361d774ecac1e063264480ec45c833a99182f6934bedac4d58bcf14b9N.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B7056B8E-4F99-44f8-8CBD-282390FE5428} ._cache_df935b9361d774ecac1e063264480ec45c833a99182f6934bedac4d58bcf14b9N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B7056B8E-4F99-44f8-8CBD-282390FE5428}\InProcServer32\ = "C:\\Program Files (x86)\\Elaborate Bytes\\VirtualCloneDrive\\ElbyVCDShell.dll" ._cache_df935b9361d774ecac1e063264480ec45c833a99182f6934bedac4d58bcf14b9N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B7056B8E-4F99-44f8-8CBD-282390FE5428}\InProcServer32\ThreadingModel = "Apartment" ._cache_df935b9361d774ecac1e063264480ec45c833a99182f6934bedac4d58bcf14b9N.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Applications\VCDMount.exe\shell ._cache_df935b9361d774ecac1e063264480ec45c833a99182f6934bedac4d58bcf14b9N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\elby.VCDMount.1\ = "Virtual CloneDrive" ._cache_df935b9361d774ecac1e063264480ec45c833a99182f6934bedac4d58bcf14b9N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\elby.VCDMount.1\shell\open\command\ = "\"C:\\Program Files (x86)\\Elaborate Bytes\\VirtualCloneDrive\\VCDMount.exe\" \"%1\"" ._cache_df935b9361d774ecac1e063264480ec45c833a99182f6934bedac4d58bcf14b9N.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B7056B8E-4F99-44f8-8CBD-282390FE5428}\InProcServer32 ._cache_df935b9361d774ecac1e063264480ec45c833a99182f6934bedac4d58bcf14b9N.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\VirtualCloneDrive ._cache_df935b9361d774ecac1e063264480ec45c833a99182f6934bedac4d58bcf14b9N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B7056B8E-4F99-44f8-8CBD-282390FE5428}\ = "VirtualCloneDrive Shell Extension" ._cache_df935b9361d774ecac1e063264480ec45c833a99182f6934bedac4d58bcf14b9N.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\ContextMenuHandlers\VirtualCloneDrive ._cache_df935b9361d774ecac1e063264480ec45c833a99182f6934bedac4d58bcf14b9N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\VirtualCloneDrive\ = "{B7056B8E-4F99-44f8-8CBD-282390FE5428}" ._cache_df935b9361d774ecac1e063264480ec45c833a99182f6934bedac4d58bcf14b9N.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Applications\VCDMount.exe\shell\open\command ._cache_df935b9361d774ecac1e063264480ec45c833a99182f6934bedac4d58bcf14b9N.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Applications\VCDMount.exe ._cache_df935b9361d774ecac1e063264480ec45c833a99182f6934bedac4d58bcf14b9N.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Applications\VCDMount.exe\shell\open ._cache_df935b9361d774ecac1e063264480ec45c833a99182f6934bedac4d58bcf14b9N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Applications\VCDMount.exe\shell\open\command\ = "\"C:\\Program Files (x86)\\Elaborate Bytes\\VirtualCloneDrive\\VCDMount.exe\" \"%1\"" ._cache_df935b9361d774ecac1e063264480ec45c833a99182f6934bedac4d58bcf14b9N.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\elby.VCDMount.1 ._cache_df935b9361d774ecac1e063264480ec45c833a99182f6934bedac4d58bcf14b9N.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Applications ._cache_df935b9361d774ecac1e063264480ec45c833a99182f6934bedac4d58bcf14b9N.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\elby.VCDMount.1\shell\open\command ._cache_df935b9361d774ecac1e063264480ec45c833a99182f6934bedac4d58bcf14b9N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\ContextMenuHandlers\VirtualCloneDrive\ = "{B7056B8E-4F99-44f8-8CBD-282390FE5428}" ._cache_df935b9361d774ecac1e063264480ec45c833a99182f6934bedac4d58bcf14b9N.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2536 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 3008 ._cache_df935b9361d774ecac1e063264480ec45c833a99182f6934bedac4d58bcf14b9N.exe 3008 ._cache_df935b9361d774ecac1e063264480ec45c833a99182f6934bedac4d58bcf14b9N.exe 3008 ._cache_df935b9361d774ecac1e063264480ec45c833a99182f6934bedac4d58bcf14b9N.exe 3008 ._cache_df935b9361d774ecac1e063264480ec45c833a99182f6934bedac4d58bcf14b9N.exe -
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 476 Process not Found -
Suspicious use of AdjustPrivilegeToken 43 IoCs
description pid Process Token: SeDebugPrivilege 3008 ._cache_df935b9361d774ecac1e063264480ec45c833a99182f6934bedac4d58bcf14b9N.exe Token: SeDebugPrivilege 3008 ._cache_df935b9361d774ecac1e063264480ec45c833a99182f6934bedac4d58bcf14b9N.exe Token: SeRestorePrivilege 988 DevCon.exe Token: SeRestorePrivilege 988 DevCon.exe Token: SeRestorePrivilege 988 DevCon.exe Token: SeRestorePrivilege 988 DevCon.exe Token: SeRestorePrivilege 988 DevCon.exe Token: SeRestorePrivilege 988 DevCon.exe Token: SeRestorePrivilege 988 DevCon.exe Token: SeRestorePrivilege 988 DevCon.exe Token: SeRestorePrivilege 988 DevCon.exe Token: SeRestorePrivilege 988 DevCon.exe Token: SeRestorePrivilege 988 DevCon.exe Token: SeRestorePrivilege 988 DevCon.exe Token: SeRestorePrivilege 988 DevCon.exe Token: SeRestorePrivilege 988 DevCon.exe Token: SeRestorePrivilege 760 DrvInst.exe Token: SeRestorePrivilege 760 DrvInst.exe Token: SeRestorePrivilege 760 DrvInst.exe Token: SeRestorePrivilege 760 DrvInst.exe Token: SeRestorePrivilege 760 DrvInst.exe Token: SeRestorePrivilege 760 DrvInst.exe Token: SeRestorePrivilege 760 DrvInst.exe Token: SeRestorePrivilege 760 DrvInst.exe Token: SeRestorePrivilege 760 DrvInst.exe Token: SeRestorePrivilege 760 DrvInst.exe Token: SeRestorePrivilege 760 DrvInst.exe Token: SeRestorePrivilege 760 DrvInst.exe Token: SeRestorePrivilege 760 DrvInst.exe Token: SeRestorePrivilege 760 DrvInst.exe Token: SeRestorePrivilege 1700 rundll32.exe Token: SeRestorePrivilege 1700 rundll32.exe Token: SeRestorePrivilege 1700 rundll32.exe Token: SeRestorePrivilege 1700 rundll32.exe Token: SeRestorePrivilege 1700 rundll32.exe Token: SeRestorePrivilege 1700 rundll32.exe Token: SeRestorePrivilege 1700 rundll32.exe Token: SeBackupPrivilege 3064 vssvc.exe Token: SeRestorePrivilege 3064 vssvc.exe Token: SeAuditPrivilege 3064 vssvc.exe Token: SeBackupPrivilege 760 DrvInst.exe Token: SeRestorePrivilege 760 DrvInst.exe Token: SeShutdownPrivilege 3008 ._cache_df935b9361d774ecac1e063264480ec45c833a99182f6934bedac4d58bcf14b9N.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2536 EXCEL.EXE -
Suspicious use of WriteProcessMemory 23 IoCs
description pid Process procid_target PID 2204 wrote to memory of 3008 2204 df935b9361d774ecac1e063264480ec45c833a99182f6934bedac4d58bcf14b9N.exe 30 PID 2204 wrote to memory of 3008 2204 df935b9361d774ecac1e063264480ec45c833a99182f6934bedac4d58bcf14b9N.exe 30 PID 2204 wrote to memory of 3008 2204 df935b9361d774ecac1e063264480ec45c833a99182f6934bedac4d58bcf14b9N.exe 30 PID 2204 wrote to memory of 3008 2204 df935b9361d774ecac1e063264480ec45c833a99182f6934bedac4d58bcf14b9N.exe 30 PID 2204 wrote to memory of 2812 2204 df935b9361d774ecac1e063264480ec45c833a99182f6934bedac4d58bcf14b9N.exe 32 PID 2204 wrote to memory of 2812 2204 df935b9361d774ecac1e063264480ec45c833a99182f6934bedac4d58bcf14b9N.exe 32 PID 2204 wrote to memory of 2812 2204 df935b9361d774ecac1e063264480ec45c833a99182f6934bedac4d58bcf14b9N.exe 32 PID 2204 wrote to memory of 2812 2204 df935b9361d774ecac1e063264480ec45c833a99182f6934bedac4d58bcf14b9N.exe 32 PID 2812 wrote to memory of 2888 2812 Synaptics.exe 33 PID 2812 wrote to memory of 2888 2812 Synaptics.exe 33 PID 2812 wrote to memory of 2888 2812 Synaptics.exe 33 PID 2812 wrote to memory of 2888 2812 Synaptics.exe 33 PID 3008 wrote to memory of 3032 3008 ._cache_df935b9361d774ecac1e063264480ec45c833a99182f6934bedac4d58bcf14b9N.exe 36 PID 3008 wrote to memory of 3032 3008 ._cache_df935b9361d774ecac1e063264480ec45c833a99182f6934bedac4d58bcf14b9N.exe 36 PID 3008 wrote to memory of 3032 3008 ._cache_df935b9361d774ecac1e063264480ec45c833a99182f6934bedac4d58bcf14b9N.exe 36 PID 3008 wrote to memory of 3032 3008 ._cache_df935b9361d774ecac1e063264480ec45c833a99182f6934bedac4d58bcf14b9N.exe 36 PID 3008 wrote to memory of 988 3008 ._cache_df935b9361d774ecac1e063264480ec45c833a99182f6934bedac4d58bcf14b9N.exe 38 PID 3008 wrote to memory of 988 3008 ._cache_df935b9361d774ecac1e063264480ec45c833a99182f6934bedac4d58bcf14b9N.exe 38 PID 3008 wrote to memory of 988 3008 ._cache_df935b9361d774ecac1e063264480ec45c833a99182f6934bedac4d58bcf14b9N.exe 38 PID 3008 wrote to memory of 988 3008 ._cache_df935b9361d774ecac1e063264480ec45c833a99182f6934bedac4d58bcf14b9N.exe 38 PID 760 wrote to memory of 1700 760 DrvInst.exe 42 PID 760 wrote to memory of 1700 760 DrvInst.exe 42 PID 760 wrote to memory of 1700 760 DrvInst.exe 42 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\df935b9361d774ecac1e063264480ec45c833a99182f6934bedac4d58bcf14b9N.exe"C:\Users\Admin\AppData\Local\Temp\df935b9361d774ecac1e063264480ec45c833a99182f6934bedac4d58bcf14b9N.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2204 -
C:\Users\Admin\AppData\Local\Temp\._cache_df935b9361d774ecac1e063264480ec45c833a99182f6934bedac4d58bcf14b9N.exe"C:\Users\Admin\AppData\Local\Temp\._cache_df935b9361d774ecac1e063264480ec45c833a99182f6934bedac4d58bcf14b9N.exe"2⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3008 -
C:\Users\Admin\AppData\Local\Temp\nstCCB1.tmp\DevCon.exe"C:\Users\Admin\AppData\Local\Temp\nstCCB1.tmp\DevCon.exe" status "root\vclone"3⤵
- Executes dropped EXE
PID:3032
-
-
C:\Users\Admin\AppData\Local\Temp\nstCCB1.tmp\DevCon.exe"C:\Users\Admin\AppData\Local\Temp\nstCCB1.tmp\DevCon.exe" install VClone.inf "root\vclone"3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:988
-
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2812 -
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2888
-
-
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding1⤵
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2536
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{4c5657e9-3fa1-1c4c-6f62-e10190806926}\vclone.inf" "9" "64f288aa3" "00000000000005A4" "WinSta0\Default" "0000000000000390" "208" "c:\users\admin\appdata\local\temp\nstccb1.tmp"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:760 -
C:\Windows\system32\rundll32.exerundll32.exe C:\Windows\system32\pnpui.dll,InstallSecurityPromptRunDllW 20 Global\{19d404db-1bfe-440a-3bcd-db124e79495b} Global\{24bb92b9-825d-25d5-d8e2-ad1019417e52} C:\Windows\System32\DriverStore\Temp\{6c871e5c-6078-0da4-f66b-1f33b992bb24}\vclone.inf C:\Windows\System32\DriverStore\Temp\{6c871e5c-6078-0da4-f66b-1f33b992bb24}\VClone.cat2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1700
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3064
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x01⤵PID:1032
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x11⤵PID:2852
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Component Object Model Hijacking
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Component Object Model Hijacking
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD5b93f0173071839a84b41fee58889eeb6
SHA1f98d8adacf5e85e2070f526e3590326f446cba81
SHA2567f05a7811894c65bf136431a6a6590eaa1e9a4ac3a419934bc4539536f9f83ba
SHA512890d11dea423b126a9f3ff65c4caf327723f4200e47c239b65e151d48ca326ddbf7b73bc3043fa1be8032ac2065bd5ca4a7e8c2a858a415976081f60ec658b65
-
Filesize
2.3MB
MD5e458deafb28333f548c26abb8ab87360
SHA10c1fdb03cfc6006c3c698fbfc853d1e9371cfe76
SHA256df935b9361d774ecac1e063264480ec45c833a99182f6934bedac4d58bcf14b9
SHA512eb62aedc33c5a9f48bc9153774fb91f71e2e160fc679f1b7eeb7982c1aab13a8dd206ea51ca39f143b6ed7dcf2660851d43109784639d6adec61bd4ebdaa8ad6
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
17KB
MD5af4d37aad8b34471da588360a43e768a
SHA183ed64667d4e68ea531b8bcf58aab3ed4a5ca998
SHA256e7550c3453156531308fda255a198c3710aa4bc7412819c180b103c11e85cef1
SHA51274f5000038c47b7c909c4ee5740e0e87cac12c9c96fff8b1c7ec749541ee3d4b7efd80f9ac02cd39809dca3f2707d0063fa852a3a541342d93a9d03de08823da
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
1KB
MD5b66a6496cd83f4cd091d4a2e0ef2b4f5
SHA148a5ae4b5904410638ca1991900a027a28e07480
SHA256a669b9cb7694e1177b072dfc5eaaff94d14571c13def16d0d4b8520d64556e29
SHA5121d5a9c75c294c0c7388c798117496881309495a0dfdf1a85aa106db896040c4ac72699444a256eaca02801f7c87361b497ba5c07b0d0f835eeb4a2d9593aa150
-
Filesize
29KB
MD5d59a6b36c5a94916241a3ead50222b6f
SHA1e274e9486d318c383bc4b9812844ba56f0cff3c6
SHA256a38d01d3f024e626d579cf052ac3bd4260bb00c34bc6085977a5f4135ab09b53
SHA51217012307955fef045e7c13bf0613bd40df27c29778ba6572640b76c18d379e02dc478e855c9276737363d0ad09b9a94f2adaa85da9c77ebb3c2d427aa68e2489
-
Filesize
81KB
MD5b13f51572f55a2d31ed9f266d581e9ea
SHA17eef3111b878e159e520f34410ad87adecf0ca92
SHA256725980edc240c928bec5a5f743fdabeee1692144da7091cf836dc7d0997cef15
SHA512f437202723b2817f2fef64b53d4eb67f782bdc61884c0c1890b46deca7ca63313ee2ad093428481f94edfcecd9c77da6e72b604998f7d551af959dbd6915809c
-
Filesize
8KB
MD50aa17500408d2b557a0f7393eb6fde6b
SHA1fb04802c8782d7512cd282f16d26c40d5bbeea03
SHA2560f8d8d64a423480a0f87fa18fe1a5022010bb1596ec200ca68a9210af8d0bc60
SHA5125510923c50c3191bacf441451f99f352867d9477c2bd18695688b0b79d3486ad018163986f06fab495eac950e3ede23b965fe9aadfea8f5a5d149311b321db28
-
Filesize
34KB
MD5f257a2737280f0076eae3ab489c06474
SHA1ab722536518592e73ed43c3f9243c7a07a3e29aa
SHA256a02e37292d86e675d55c13097e9f107c73ddfd8aac69310f7d9910a811a541d8
SHA512ecc3e55e7cd42d21a34cfb9353f05ebc38b6998ad9aad3c5888321182b4239ee270e0715ccd2308a80a7aad6f556747302994f2d4a3827af12e649f07ef8ce1d
-
Filesize
29KB
MD5b9957aa5ab846d609bc6a5ad0e4207bc
SHA133b6a0538d3d785eb6ea88c245ae388cd9a0ae9a
SHA256f1de5def45ebee13b5de7b8f12b417cc213503aff8bfce14c42fdd3218f49126
SHA51228d01f93fb5a47cf28c6c0f908d99b737f850fb2b4093a7dc3c1c8850dfbf4cb7964817d9616cae5c75881a920455919e82c8cd3e428d62d17d594bbf5ba85cd
-
\Users\Admin\AppData\Local\Temp\._cache_df935b9361d774ecac1e063264480ec45c833a99182f6934bedac4d58bcf14b9N.exe
Filesize1.6MB
MD506fae12ee71de1dd3535162b86bdf4f1
SHA1c9230cfb03529d1a8732986f79548fe66f0ac7f6
SHA2567d9d787c5b1af4625441fec2d58058dc4e5a0d8d952c28e0d197074b937cddcf
SHA5123c81a44b6f46b1c56f738702743396afe49dc59f0e8fbeb83463fb4b468c93dfb3059c218a734f6bd90f2711c38e8247b3475e5d442cf32076ec57db8e795363
-
Filesize
130KB
MD5f459bddabb3531c0a6581252ca1b29df
SHA18989d7c60c69036ae8ba76f8880383b0b49f3153
SHA256dd328dc994d3a32c310d483328fd1e57d36dd0a95994ec8932e91fd8db22b6cb
SHA51248110470b49108c742f78c56a65b497669035f7f92eebd23b7a08f344779eecca70893af5e390d2685b3e664d1f3b85a748bd31d87c9394e31c1ba3898220284
-
Filesize
100KB
MD5d8c4815356ad88371670b7dd2707da4a
SHA194b96a4c465df5d94b3260c4a4263ecdabd0d0cf
SHA2562f8b9bbeb76de603fa8b46f325cf2bdde6f8172772dc45df3fb1458d5c5cc347
SHA5120cc7be4c7bb16c716c53a6ab33e3359184490eb3daf82c2242ed90c6a8c2d06c6406829d397ceff517b0e82cceef7a74ed3c16298689237c549734e153a025bb