Analysis
-
max time kernel
119s -
max time network
129s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
21-11-2024 11:40
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe
Resource
win7-20240903-en
windows7-x64
11 signatures
120 seconds
Behavioral task
behavioral2
Sample
cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
10 signatures
120 seconds
General
-
Target
cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe
-
Size
472KB
-
MD5
d133cbea72078419724b6f11cc0e36f7
-
SHA1
2b2b850902e51f39d76c5a032b431e3ed675e5e3
-
SHA256
cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7
-
SHA512
c77c247c2502be6aea421153f57939b8cd89f69c7143f97d399dbc626746126340d4713906da5a12e0541635da122d9bf804f85b76b56a50ef2436a51907dda2
-
SSDEEP
6144:ppMMVVbsmffCpJipqLXRTvczBZBH6wGFzfw3DThRtUA7c50M5iDcp/h8CAM:UtmfaXioLXpUzPBaws7w3vV5KV5iDZM
Score
7/10
Malware Config
Signatures
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ati display driver = "ÔN@" cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\raserver.exe cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe File created C:\Windows\SysWOW64\typeperf.exe- cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe File created C:\Windows\SysWOW64\waitfor.exe- cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe File created C:\Windows\SysWOW64\instnm.exe_ cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe File created C:\Windows\SysWOW64\msdt.exe_ cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe File created C:\Windows\SysWOW64\ntprint.exe_ cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe File created C:\Windows\SysWOW64\shutdown.exe cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe File created C:\Windows\SysWOW64\sort.exe- cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe File created C:\Windows\SysWOW64\svchost.exe cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe File created C:\Windows\SysWOW64\upnpcont.exe cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe File created C:\Windows\SysWOW64\mfpmp.exe cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe File created C:\Windows\SysWOW64\ctfmon.exe cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe File created C:\Windows\SysWOW64\diskperf.exe cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe File created C:\Windows\SysWOW64\IME\IMEJP\imjpuexc.exe- cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe File created C:\Windows\SysWOW64\pcaui.exe_ cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe File created C:\Windows\SysWOW64\SpatialAudioLicenseSrv.exe_ cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe File created C:\Windows\SysWOW64\user.exe_ cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe File created C:\Windows\SysWOW64\winver.exe_ cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe File created C:\Windows\SysWOW64\cmstp.exe cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe File created C:\Windows\SysWOW64\WSManHTTPConfig.exe- cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe File created C:\Windows\SysWOW64\PING.EXE cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe File created C:\Windows\SysWOW64\SyncHost.exe- cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe File created C:\Windows\SysWOW64\tzutil.exe- cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe File created C:\Windows\SysWOW64\more.com- cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe File created C:\Windows\SysWOW64\Taskmgr.exe- cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe File created C:\Windows\SysWOW64\UserAccountControlSettings.exe- cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe File created C:\Windows\SysWOW64\wscadminui.exe- cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe File created C:\Windows\SysWOW64\secinit.exe_ cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe File created C:\Windows\SysWOW64\fc.exe_ cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe File created C:\Windows\SysWOW64\AtBroker.exe- cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe File created C:\Windows\SysWOW64\IME\IMETC\IMTCLNWZ.EXE_ cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe File created C:\Windows\SysWOW64\PkgMgr.exe_ cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe File created C:\Windows\SysWOW64\RunLegacyCPLElevated.exe_ cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe File created C:\Windows\SysWOW64\SearchProtocolHost.exe_ cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe File created C:\Windows\SysWOW64\F12\IEChooser.exe- cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe File created C:\Windows\SysWOW64\mountvol.exe_ cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe File created C:\Windows\SysWOW64\mspaint.exe cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe File created C:\Windows\SysWOW64\stordiag.exe_ cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe File created C:\Windows\SysWOW64\tasklist.exe cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe File created C:\Windows\SysWOW64\finger.exe_ cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe File created C:\Windows\SysWOW64\wextract.exe cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe File created C:\Windows\SysWOW64\sdbinst.exe cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe File created C:\Windows\SysWOW64\chkntfs.exe cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe File created C:\Windows\SysWOW64\help.exe cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe File created C:\Windows\SysWOW64\IME\IMETC\IMTCLNWZ.EXE cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe File created C:\Windows\SysWOW64\autoconv.exe- cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe File created C:\Windows\SysWOW64\RdpSaUacHelper.exe- cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe File created C:\Windows\SysWOW64\odbcad32.exe cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe File created C:\Windows\SysWOW64\net1.exe_ cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe File created C:\Windows\SysWOW64\reg.exe- cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe File created C:\Windows\SysWOW64\rundll32.exe_ cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe File created C:\Windows\SysWOW64\IME\SHARED\IMEPADSV.EXE_ cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe File created C:\Windows\SysWOW64\rasautou.exe_ cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe File created C:\Windows\SysWOW64\rasdial.exe_ cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe File created C:\Windows\SysWOW64\shrpubw.exe- cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe File created C:\Windows\SysWOW64\Dism\DismHost.exe- cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe File created C:\Windows\SysWOW64\isoburn.exe- cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe File created C:\Windows\SysWOW64\attrib.exe- cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe File created C:\Windows\SysWOW64\icacls.exe cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe File created C:\Windows\SysWOW64\PasswordOnWakeSettingFlyout.exe- cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe File created C:\Windows\SysWOW64\sort.exe_ cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe File created C:\Windows\SysWOW64\getmac.exe_ cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe File created C:\Windows\SysWOW64\mcbuilder.exe_ cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe File created C:\Windows\SysWOW64\mobsync.exe cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe File created C:\Program Files (x86)\Internet Explorer\iexplore.exe cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Microsoft.MicrosoftSolitaireCollection.exe- cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe File created C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.46.11001.0_x64__8wekyb3d8bbwe\GameBar.exe_ cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe- cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe- cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe File created C:\Program Files\Java\jdk-1.8\bin\jhat.exe- cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe File created C:\Program Files\Java\jdk-1.8\bin\klist.exe cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe File created C:\Program Files\Java\jdk-1.8\bin\unpack200.exe- cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\show_third_party_software_licenses.bat- cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe_ cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe_ cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe File created C:\Program Files\Google\Chrome\Application\chrome.exe cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe- cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe- cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\bin\Pester.bat cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe File created C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe_ cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe File created C:\Program Files\Java\jdk-1.8\bin\klist.exe_ cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe File created C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_x64__8wekyb3d8bbwe\GetHelp.exe_ cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\nacl_irt_x86_64.nexe cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe File created C:\Program Files\Java\jdk-1.8\bin\unpack200.exe cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe File created C:\Program Files\Java\jre-1.8\bin\ssvagent.exe- cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe- cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_80703\java.exe- cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe File created C:\Program Files\Java\jdk-1.8\bin\java.exe- cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe File created C:\Program Files\Java\jdk-1.8\bin\javaw.exe- cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java.exe- cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe File created C:\Program Files (x86)\Windows Media Player\wmprph.exe- cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe File created C:\Program Files\Java\jdk-1.8\bin\jps.exe_ cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe- cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe_ cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe File created C:\Program Files\Java\jre-1.8\bin\unpack200.exe- cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice.exe cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe File created C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Cortana.exe- cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe_ cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe- cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe File created C:\Program Files\Microsoft Office\root\Client\AppVLP.exe_ cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe File created C:\Program Files\Windows Media Player\wmprph.exe cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe- cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe File created C:\Program Files\Google\Chrome\Application\chrome_proxy.exe cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe File created C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe- cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe_ cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe File created C:\Program Files\VideoLAN\VLC\uninstall.exe- cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe File created C:\Program Files\Windows Media Player\wmpshare.exe_ cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe File created C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\MixedRealityPortal.Brokered.exe- cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\msedgewebview2.exe cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateSetup.exe cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe File created C:\Program Files\Java\jdk-1.8\bin\jps.exe cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe- cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe File created C:\Program Files\Mozilla Firefox\private_browsing.exe- cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe File created C:\Program Files\Mozilla Firefox\uninstall\helper.exe cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe File created C:\Program Files (x86)\Internet Explorer\ielowutil.exe_ cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\pwahelper.exe_ cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe_ cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE_ cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe File created C:\Program Files (x86)\Internet Explorer\ieinstal.exe_ cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe File created C:\Program Files\Windows Mail\wabmig.exe- cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe File created C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdate.exe_ cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-manager_31bf3856ad364e35_10.0.19041.1202_none_7cdad2e52790705d\f\hvsirpcd.exe_ cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmi-core_31bf3856ad364e35_10.0.19041.1081_none_2e31e8eed4b770c3\WmiApSrv.exe_ cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-audio-audiocore_31bf3856ad364e35_10.0.19041.1_none_36e57bfcb85e0850\SpatialAudioLicenseSrv.exe- cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe File created C:\Windows\WinSxS\amd64_microsoft-hyper-v-vstack-vmms_31bf3856ad364e35_10.0.19041.264_none_1477a882bdce0df2\vmms.exe- cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ktmutil_31bf3856ad364e35_10.0.19041.1_none_3e7b05a1a0865eeb\ktmutil.exe_ cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe File created C:\Windows\WinSxS\amd64_msbuild_b03f5f7f11d50a3a_10.0.19041.1_none_fa6e7f402dbc0227\MSBuild.exe_ cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-a..t-bytecodegenerator_31bf3856ad364e35_10.0.19041.1081_none_5f557b607e14f541\f\ByteCodeGenerator.exe- cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-bth-user_31bf3856ad364e35_10.0.19041.746_none_4d67350a685e1a3a\bthudtask.exe_ cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-onedrive-setup_31bf3856ad364e35_10.0.19041.1_none_e585f901f9ce93e6\OneDriveSetup.exe- cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-f..ysafety-refreshtask_31bf3856ad364e35_10.0.19041.153_none_3c9b504ec5293ad0\r\WpcTok.exe_ cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedfoldersui_31bf3856ad364e35_10.0.19041.746_none_96167fa49059f7a3\shrpubw.exe_ cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-systemreset_31bf3856ad364e35_10.0.19041.1266_none_5fd6523a3130632d\f\systemreset.exe- cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe File created C:\Windows\WinSxS\amd64_windowssearchengine_31bf3856ad364e35_7.0.19041.264_none_8bd2f5fc0c992e06\r\SearchFilterHost.exe- cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe File created C:\Windows\WinSxS\amd64_microsoft-hns-diagnosticstool_31bf3856ad364e35_10.0.19041.1_none_5c015a65c60d8097\hnsdiag.exe_ cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..cesframework-ctfmon_31bf3856ad364e35_10.0.19041.1_none_53219a572fef10a2\ctfmon.exe- cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-deployment_31bf3856ad364e35_10.0.19041.746_none_e43cebe9807e08e3\setupugc.exe_ cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe File created C:\Windows\Boot\PCAT\memtest.exe- cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_regsql.exe- cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe File created C:\Windows\WinSxS\amd64_netfx-applaunch_exe_b03f5f7f11d50a3a_10.0.19041.1_none_3e722592e777a760\AppLaunch.exe- cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-errorreportingfaults_31bf3856ad364e35_10.0.19041.1081_none_ef39acce2648e404\WerFault.exe- cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_regbrowsers.exe_ cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\IEExec.exe- cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe- cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-bootux.deployment_31bf3856ad364e35_10.0.19041.1_none_f4025a506f9e9f01\bootim.exe_ cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..daryauthfactor-task_31bf3856ad364e35_10.0.19041.1_none_81f73568e4ce1819\DeviceCredentialDeployment.exe_ cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-gdi_31bf3856ad364e35_10.0.19041.264_none_920963acedc8777d\fontdrvhost.exe_ cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-webcamexperience_31bf3856ad364e35_10.0.19041.746_none_4ae21b160a9d5bb2\f\CameraSettingsUIHost.exe_ cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe File created C:\Windows\WinSxS\amd64_windows-senseclient-service_31bf3856ad364e35_10.0.19041.1288_none_1cec63974464878f\f\SenseSampleUploader.exe- cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe File created C:\Windows\WinSxS\amd64_windows-senseclient-service_31bf3856ad364e35_10.0.19041.1288_none_1cec63974464878f\n\SenseSC.exe_ cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-tpm-tool_31bf3856ad364e35_10.0.19041.1202_none_7d4ea219d613c9d8\r\TpmTool.exe_ cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-appvwow_31bf3856ad364e35_10.0.19041.1202_none_27f9f931a79d1cbe\mavinject.exe_ cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe File created C:\Windows\WinSxS\amd64_security-octagon-broker_31bf3856ad364e35_10.0.19041.84_none_51ae5c25baf813ff\f\SgrmBroker.exe_ cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe File created C:\Windows\WinSxS\amd64_windows-senseclient-service_31bf3856ad364e35_10.0.19041.1288_none_1cec63974464878f\r\SenseIR.exe- cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe File created C:\Windows\WinSxS\amd64_microsoft-client-li..ing-platform-client_31bf3856ad364e35_10.0.19041.1266_none_7e2b6be969016c27\f\licensingdiag.exe- cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-commandline-dsacls_31bf3856ad364e35_10.0.19041.1_none_ff0c3fa49f6aa0fe\dsacls.exe_ cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..omerfeedbackmanager_31bf3856ad364e35_10.0.19041.844_none_ba2b07b5ed02761a\imecfmui.exe_ cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..ifiedwritefilter-ux_31bf3856ad364e35_10.0.19041.1_none_9fbebf8222c20a6d\uwfux.exe- cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..rnetprinting-client_31bf3856ad364e35_10.0.19041.1288_none_ff9a0c377d92f65b\r\wpnpinst.exe- cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..sktop.appxmain.root_31bf3856ad364e35_10.0.19041.264_none_a71c9f7fdcd899c5\SearchApp.exe_ cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-f..ysafety-refreshtask_31bf3856ad364e35_10.0.19041.153_none_3c9b504ec5293ad0\WpcTok.exe_ cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_10.0.19041.1_none_9aa166e99861c2bc\qprocess.exe- cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-i..atedusermode-kernel_31bf3856ad364e35_10.0.19041.1023_none_5c93ef2449c89609\f\securekernel.exe- cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..vironment-os-loader_31bf3856ad364e35_10.0.19041.1266_none_cfec8db821d83671\f\winresume.exe_ cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-blb-cli-main_31bf3856ad364e35_10.0.19041.1202_none_c0150a0a443c0ffc\r\wbadmin.exe_ cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ting-lprportmonitor_31bf3856ad364e35_10.0.19041.1_none_69f4af04dd2c1f80\lpq.exe_ cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmpdmc-ux_31bf3856ad364e35_10.0.19041.746_none_cc5cbb9556301da3\f\WMPDMC.exe_ cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-o..ssociationframework_31bf3856ad364e35_10.0.19041.746_none_88402ba139c8967e\dasHost.exe- cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..restartup-baaupdate_31bf3856ad364e35_10.0.19041.1_none_ec3fd410728598b3\baaupdate.exe_ cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedaccess_31bf3856ad364e35_10.0.19041.207_none_e2f2dfeea7fa44fc\f\icsunattend.exe_ cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-r..sistance-dcomserver_31bf3856ad364e35_10.0.19041.1110_none_af1474f55f209109\f\raserver.exe_ cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe File created C:\Windows\SystemApps\Windows.CBSPreview_cw5n1h2txyewy\CameraBarcodeScannerPreview.exe_ cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-international-unattend_31bf3856ad364e35_10.0.19041.1_none_760acfd88cf7390d\MuiUnattend.exe- cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-r..verycenter-platform_31bf3856ad364e35_10.0.19041.964_none_21209b01f08afd33\SystemResetPlatform.exe- cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..hreshold-adminflows_31bf3856ad364e35_10.0.19041.1023_none_9583d52fd3076014\f\SystemSettingsAdminFlows.exe- cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-whoami_31bf3856ad364e35_10.0.19041.1_none_846d8bda2133af3c\whoami.exe_ cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmi-core_31bf3856ad364e35_10.0.19041.1081_none_2e31e8eed4b770c3\f\mofcomp.exe- cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe File created C:\Windows\WinSxS\amd64_security-octagon-broker_31bf3856ad364e35_10.0.19041.546_none_380485edeba9f4c4\SgrmBroker.exe_ cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe File created C:\Windows\WinSxS\wow64_multimedia-rrinstaller_31bf3856ad364e35_10.0.19041.746_none_fb3ba1752084c5cf\rrinstaller.exe- cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe File created C:\Windows\WinSxS\x86_netfx-mscorsvw_exe_b03f5f7f11d50a3a_10.0.19041.1_none_e0dec3877978d84a\mscorsvw.exe- cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..artcard-tpm-manager_31bf3856ad364e35_10.0.19041.746_none_790f12933fbf7e0d\tpmvscmgrsvr.exe- cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-tokenbroker_31bf3856ad364e35_10.0.19041.264_none_81941817097d6ad9\TokenBrokerCookies.exe_ cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-setup-component_31bf3856ad364e35_10.0.19041.1237_none_a6ef3a2e62766c5c\r\Setup.exe_ cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" IEXPLORE.exe Set value (int) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1374567539" IEXPLORE.exe Set value (int) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31144970" IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Software\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.exe Set value (str) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.exe Set value (int) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" IEXPLORE.exe Set value (data) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000028e76085f1f7640a0643881d549bbfc00000000020000000000106600000001000020000000faba723ad242448f9019bbe12209d55ed3853a31569e17fbd128f478f1c452db000000000e8000000002000020000000ef6a67f3be3e15739fe2aee3db782729e9445fd189c3336989456fe1bea5083020000000b342e4c0bd8e5f048d2aaeab5904984a78fad6818ae793582a2c42605ed2c88340000000b229b3770627cb1df3828a1b27d84038ae13efffa4e0c3f44765a4ca31a117e8723a1fea0f901b2a12ee956b1c0c6eb66c99b1680533e8131683f33b2645827b IEXPLORE.exe Set value (data) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0f0ca530a3cdb01 IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames IEXPLORE.exe Set value (int) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" IEXPLORE.exe Set value (int) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31144970" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ IEXPLORE.exe Set value (int) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "438954239" IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery IEXPLORE.exe Set value (int) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1374567539" IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing IEXPLORE.exe Set value (int) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" IEXPLORE.exe Set value (data) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 100abf530a3cdb01 IEXPLORE.exe Set value (str) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.exe Set value (str) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" IEXPLORE.exe Set value (int) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.exe Set value (int) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{7D78C581-A7FD-11EF-A4B7-CA65FB447F0B} = "0" IEXPLORE.exe Set value (int) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31144970" IEXPLORE.exe Set value (int) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1383005448" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage IEXPLORE.exe Set value (data) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000028e76085f1f7640a0643881d549bbfc00000000020000000000106600000001000020000000bcde466730abfeeb394c2077a3e9ccf447a30682024cb25349b3c7cd4a7cbec3000000000e800000000200002000000069a482e405ddd15a64ca711d9181f1cd1d0660d8184e8298f92780098e8e502c20000000773b0609e4790b941530405328749866b4e127d0cf157eac223fe440b05739b440000000c83cf6dfecce78bca9686874418c1b4c93ed47ef3a7630f0efda8c20e8c2ee9df2f43c654fd8b0f297c54b71545d59df4773c890a269f3a5dab9b6589a78ea83 IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ IEXPLORE.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4160 IEXPLORE.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 4160 IEXPLORE.exe 4160 IEXPLORE.exe 2376 IEXPLORE.EXE 2376 IEXPLORE.EXE 2376 IEXPLORE.EXE 2376 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 3684 wrote to memory of 4160 3684 cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe 82 PID 3684 wrote to memory of 4160 3684 cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe 82 PID 4160 wrote to memory of 2376 4160 IEXPLORE.exe 83 PID 4160 wrote to memory of 2376 4160 IEXPLORE.exe 83 PID 4160 wrote to memory of 2376 4160 IEXPLORE.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe"C:\Users\Admin\AppData\Local\Temp\cbf539751e6ef7624de831aae2f1855870b11b47b15572536749349f65e9f5c7.exe"1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3684 -
C:\Program Files\Internet Explorer\IEXPLORE.exe"C:\Program Files\Internet Explorer\IEXPLORE" 212.33.237.86/images/1/report.php2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4160 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4160 CREDAT:17410 /prefetch:23⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2376
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1017KB
MD581837b9fa0c91072d9e7fefed37d1e4b
SHA1b873f206fb093201ba590e2c5a1af35a21274824
SHA2569e7117016c87076a31c5f78cb10f00eaa830d50cb5a8a198b00bc4014a5a3665
SHA5129e8831ece7fc7e1f17aa76f7c66004dd1725cf1e966fba9304ae2c3679cfd0d193750ed6380026a75fc1c9804f301c83cf62f44cbb0e5096a52be5afa7d4efbc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize471B
MD555e40aa7a274d26f0bb8e2117239d1bd
SHA13174d1748da1dea0226e5b485400c5a139b6dd9f
SHA2561d11d5b7b9240006ea7860d39703d111fefaae92f3c67259f0c743417e634a8e
SHA5124b6de1f6ed69e04740b16428e984e1476c0e3ebb37ab8893454a1c271c2fce65fb5c4a355f1db0eb00560a6f951ee8102fb9629abfff5fd1ab363ef53cd2253d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize404B
MD5c0ccd66b128967e12b18a087654a66a4
SHA11276303498329edb01bf12e302f8cdcacfb3a2ab
SHA256fc393714e0618c452a4f3bac1711b044702c012ac6e634b722b5e859e5f5b916
SHA512b8bedac564df312ef7a49f188e7cecbc6a6f88be8c8e491caa2817e3ebf403f73d9b2af3eff1579cdea104a7a3a6141b715a62106007fe4040f01ebaef440ff5
-
Filesize
17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee