Overview
overview
10Static
static
6AES-NI.exe
windows7-x64
7AES-NI.exe
windows10-2004-x64
7Abrechnung.exe
windows7-x64
8Abrechnung.exe
windows10-2004-x64
8Box (2).exe
windows7-x64
3Box (2).exe
windows10-2004-x64
3Box.exe
windows7-x64
3Box.exe
windows10-2004-x64
3a66dde2298...43.exe
windows7-x64
9a66dde2298...43.exe
windows10-2004-x64
9a7768f4973...e0.exe
windows7-x64
10a7768f4973...e0.exe
windows10-2004-x64
10aa7ff3bc28...1e.exe
windows7-x64
7aa7ff3bc28...1e.exe
windows10-2004-x64
7aace43af8d...99.exe
windows7-x64
8aace43af8d...99.exe
windows10-2004-x64
8ad3cc219a8...ws.dll
windows7-x64
10ad3cc219a8...ws.dll
windows10-2004-x64
10aee03626b8...b1.exe
windows7-x64
6aee03626b8...b1.exe
windows10-2004-x64
6afd3b729cf...2e.exe
windows7-x64
10afd3b729cf...2e.exe
windows10-2004-x64
10b56c4569d6...ss.exe
windows7-x64
3b56c4569d6...ss.exe
windows10-2004-x64
30.84762379...67.exe
windows7-x64
70.84762379...67.exe
windows10-2004-x64
3zsgblrbrum...ke.exe
windows7-x64
7zsgblrbrum...ke.exe
windows10-2004-x64
3b7d9f11c16...b0.exe
windows7-x64
5b7d9f11c16...b0.exe
windows10-2004-x64
5b8f60c64c7...af.exe
windows7-x64
10b8f60c64c7...af.exe
windows10-2004-x64
10Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
22/11/2024, 03:27
Behavioral task
behavioral1
Sample
AES-NI.exe
Resource
win7-20240903-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
AES-NI.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral3
Sample
Abrechnung.exe
Resource
win7-20240903-en
windows7-x64
13 signatures
150 seconds
Behavioral task
behavioral4
Sample
Abrechnung.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral5
Sample
Box (2).exe
Resource
win7-20240903-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral6
Sample
Box (2).exe
Resource
win10v2004-20241007-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral7
Sample
Box.exe
Resource
win7-20241010-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral8
Sample
Box.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral9
Sample
a66dde22983583da6d3b1e5b9eb1e8fb019f5157eda508305942292c0d10fa43.exe
Resource
win7-20240729-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral10
Sample
a66dde22983583da6d3b1e5b9eb1e8fb019f5157eda508305942292c0d10fa43.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral11
Sample
a7768f4973ad7cf8217212a4d12dbae0.exe
Resource
win7-20240903-en
windows7-x64
16 signatures
150 seconds
Behavioral task
behavioral12
Sample
a7768f4973ad7cf8217212a4d12dbae0.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
14 signatures
150 seconds
Behavioral task
behavioral13
Sample
aa7ff3bc285bcb4ec48bf2f361f0ad0a1d9fc8f17b7323d2f0615ade68973c1e.exe
Resource
win7-20240708-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral14
Sample
aa7ff3bc285bcb4ec48bf2f361f0ad0a1d9fc8f17b7323d2f0615ade68973c1e.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral15
Sample
aace43af8d0932a7b01c5b8fb71c8199.exe
Resource
win7-20240903-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral16
Sample
aace43af8d0932a7b01c5b8fb71c8199.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral17
Sample
ad3cc219a818047d6d3c38a8e4662e21dfedc858578cb2bde2c127d66dfeb7de_PonyNews.dll
Resource
win7-20240903-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral18
Sample
ad3cc219a818047d6d3c38a8e4662e21dfedc858578cb2bde2c127d66dfeb7de_PonyNews.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral19
Sample
aee03626b83a88b71b06899116cb7ce4b8092365103d69792b0c2d7153f24cb1.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral20
Sample
aee03626b83a88b71b06899116cb7ce4b8092365103d69792b0c2d7153f24cb1.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral21
Sample
afd3b729cf99fb9ea441f42862a4835d1d6eeb36ee535f9b206e3a00382c972e.exe
Resource
win7-20241010-en
windows7-x64
20 signatures
150 seconds
Behavioral task
behavioral22
Sample
afd3b729cf99fb9ea441f42862a4835d1d6eeb36ee535f9b206e3a00382c972e.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
20 signatures
150 seconds
Behavioral task
behavioral23
Sample
b56c4569d639e8ce104d9e52dffeba6d18813c058887a3404350904811f32d54_not_packed_maybe_useless.exe
Resource
win7-20241023-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral24
Sample
b56c4569d639e8ce104d9e52dffeba6d18813c058887a3404350904811f32d54_not_packed_maybe_useless.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral25
Sample
0.8476237917779167.exe
Resource
win7-20240903-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral26
Sample
0.8476237917779167.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral27
Sample
zsgblrbrumorwxfizuke.exe
Resource
win7-20240708-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral28
Sample
zsgblrbrumorwxfizuke.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral29
Sample
b7d9f11c166fa1a4ceef446dd9c8561c77115cb3ce4910a056dd6a361338a2b0.exe
Resource
win7-20241010-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral30
Sample
b7d9f11c166fa1a4ceef446dd9c8561c77115cb3ce4910a056dd6a361338a2b0.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral31
Sample
b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe
Resource
win7-20240903-en
windows7-x64
17 signatures
150 seconds
Behavioral task
behavioral32
Sample
b8f60c64c70f03c263bf9e9261aa157a73864aaf.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
17 signatures
150 seconds
General
- Target aee03626b83a88b71b06899116cb7ce4b8092365103d69792b0c2d7153f24cb1.exe
- Size 218KB
- Sample241122-dz7tmazlan
- SHA256 aee03626b83a88b71b06899116cb7ce4b8092365103d69792b0c2d7153f24cb1
- MD5 35f68acc0c3d5761a61975ec77b49cbc
- SHA1 f6d03e713bc9b47265141d9f9b83ae634d43d204
- SHA512 6a9d131e7c4f310ec77cf3c9c07c75dca279b7ffd6c46b252c559947900f1d754400fc51ce12b8afde86a0fd758e1b68d00a2e5f9144ad019d51bff5c67a4656
- SSDEEP 3072:HfVD9B1hzRAjEdJNCQ4woDZD57Wr3FKajQNR9MiYbuWjqgdcnfKvdHmN5b3SM:/jlVEEbNtoPajxu85cfAG3
- MD5 SHA1 SHA512 SSDEEP
Score
6/10
Malware Config
Signatures
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 36 checkip.dyndns.org - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language aee03626b83a88b71b06899116cb7ce4b8092365103d69792b0c2d7153f24cb1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ielowutil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2953269209" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "439011090" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{DB695142-A881-11EF-BEF1-FE5A08828E79} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2951394777" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "2951394777" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "2953269209" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31145102" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31145102" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31145102" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31145102" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: 33 1620 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1620 AUDIODG.EXE Token: SeTcbPrivilege 2028 aee03626b83a88b71b06899116cb7ce4b8092365103d69792b0c2d7153f24cb1.exe Token: SeTcbPrivilege 2028 aee03626b83a88b71b06899116cb7ce4b8092365103d69792b0c2d7153f24cb1.exe Token: SeTcbPrivilege 2028 aee03626b83a88b71b06899116cb7ce4b8092365103d69792b0c2d7153f24cb1.exe Token: SeTcbPrivilege 2028 aee03626b83a88b71b06899116cb7ce4b8092365103d69792b0c2d7153f24cb1.exe Token: SeTcbPrivilege 2028 aee03626b83a88b71b06899116cb7ce4b8092365103d69792b0c2d7153f24cb1.exe Token: SeTcbPrivilege 2028 aee03626b83a88b71b06899116cb7ce4b8092365103d69792b0c2d7153f24cb1.exe Token: SeTcbPrivilege 2028 aee03626b83a88b71b06899116cb7ce4b8092365103d69792b0c2d7153f24cb1.exe Token: SeTcbPrivilege 2028 aee03626b83a88b71b06899116cb7ce4b8092365103d69792b0c2d7153f24cb1.exe Token: SeTcbPrivilege 2028 aee03626b83a88b71b06899116cb7ce4b8092365103d69792b0c2d7153f24cb1.exe Token: SeTcbPrivilege 2028 aee03626b83a88b71b06899116cb7ce4b8092365103d69792b0c2d7153f24cb1.exe Token: SeTcbPrivilege 2028 aee03626b83a88b71b06899116cb7ce4b8092365103d69792b0c2d7153f24cb1.exe Token: SeTcbPrivilege 2028 aee03626b83a88b71b06899116cb7ce4b8092365103d69792b0c2d7153f24cb1.exe Token: SeTcbPrivilege 2028 aee03626b83a88b71b06899116cb7ce4b8092365103d69792b0c2d7153f24cb1.exe Token: SeTcbPrivilege 2028 aee03626b83a88b71b06899116cb7ce4b8092365103d69792b0c2d7153f24cb1.exe Token: SeTcbPrivilege 2028 aee03626b83a88b71b06899116cb7ce4b8092365103d69792b0c2d7153f24cb1.exe Token: SeTcbPrivilege 2028 aee03626b83a88b71b06899116cb7ce4b8092365103d69792b0c2d7153f24cb1.exe Token: SeTcbPrivilege 2028 aee03626b83a88b71b06899116cb7ce4b8092365103d69792b0c2d7153f24cb1.exe Token: SeTcbPrivilege 2028 aee03626b83a88b71b06899116cb7ce4b8092365103d69792b0c2d7153f24cb1.exe Token: SeTcbPrivilege 2028 aee03626b83a88b71b06899116cb7ce4b8092365103d69792b0c2d7153f24cb1.exe Token: SeTcbPrivilege 2028 aee03626b83a88b71b06899116cb7ce4b8092365103d69792b0c2d7153f24cb1.exe Token: SeTcbPrivilege 2028 aee03626b83a88b71b06899116cb7ce4b8092365103d69792b0c2d7153f24cb1.exe Token: SeTcbPrivilege 2028 aee03626b83a88b71b06899116cb7ce4b8092365103d69792b0c2d7153f24cb1.exe Token: SeTcbPrivilege 2028 aee03626b83a88b71b06899116cb7ce4b8092365103d69792b0c2d7153f24cb1.exe Token: SeTcbPrivilege 2028 aee03626b83a88b71b06899116cb7ce4b8092365103d69792b0c2d7153f24cb1.exe Token: SeTcbPrivilege 2028 aee03626b83a88b71b06899116cb7ce4b8092365103d69792b0c2d7153f24cb1.exe Token: SeTcbPrivilege 2028 aee03626b83a88b71b06899116cb7ce4b8092365103d69792b0c2d7153f24cb1.exe Token: SeTcbPrivilege 2028 aee03626b83a88b71b06899116cb7ce4b8092365103d69792b0c2d7153f24cb1.exe Token: SeTcbPrivilege 2028 aee03626b83a88b71b06899116cb7ce4b8092365103d69792b0c2d7153f24cb1.exe Token: SeTcbPrivilege 2028 aee03626b83a88b71b06899116cb7ce4b8092365103d69792b0c2d7153f24cb1.exe Token: SeTcbPrivilege 2028 aee03626b83a88b71b06899116cb7ce4b8092365103d69792b0c2d7153f24cb1.exe Token: SeTcbPrivilege 2028 aee03626b83a88b71b06899116cb7ce4b8092365103d69792b0c2d7153f24cb1.exe Token: SeTcbPrivilege 2028 aee03626b83a88b71b06899116cb7ce4b8092365103d69792b0c2d7153f24cb1.exe Token: SeTcbPrivilege 2028 aee03626b83a88b71b06899116cb7ce4b8092365103d69792b0c2d7153f24cb1.exe Token: SeTcbPrivilege 2028 aee03626b83a88b71b06899116cb7ce4b8092365103d69792b0c2d7153f24cb1.exe Token: SeTcbPrivilege 2028 aee03626b83a88b71b06899116cb7ce4b8092365103d69792b0c2d7153f24cb1.exe Token: SeTcbPrivilege 2028 aee03626b83a88b71b06899116cb7ce4b8092365103d69792b0c2d7153f24cb1.exe Token: SeTcbPrivilege 2028 aee03626b83a88b71b06899116cb7ce4b8092365103d69792b0c2d7153f24cb1.exe Token: SeTcbPrivilege 2028 aee03626b83a88b71b06899116cb7ce4b8092365103d69792b0c2d7153f24cb1.exe Token: SeTcbPrivilege 2028 aee03626b83a88b71b06899116cb7ce4b8092365103d69792b0c2d7153f24cb1.exe Token: SeTcbPrivilege 2028 aee03626b83a88b71b06899116cb7ce4b8092365103d69792b0c2d7153f24cb1.exe Token: SeTcbPrivilege 2028 aee03626b83a88b71b06899116cb7ce4b8092365103d69792b0c2d7153f24cb1.exe Token: SeTcbPrivilege 2028 aee03626b83a88b71b06899116cb7ce4b8092365103d69792b0c2d7153f24cb1.exe Token: SeTcbPrivilege 2028 aee03626b83a88b71b06899116cb7ce4b8092365103d69792b0c2d7153f24cb1.exe Token: SeTcbPrivilege 2028 aee03626b83a88b71b06899116cb7ce4b8092365103d69792b0c2d7153f24cb1.exe Token: SeTcbPrivilege 2028 aee03626b83a88b71b06899116cb7ce4b8092365103d69792b0c2d7153f24cb1.exe Token: SeTcbPrivilege 2028 aee03626b83a88b71b06899116cb7ce4b8092365103d69792b0c2d7153f24cb1.exe Token: SeTcbPrivilege 2028 aee03626b83a88b71b06899116cb7ce4b8092365103d69792b0c2d7153f24cb1.exe Token: SeTcbPrivilege 2028 aee03626b83a88b71b06899116cb7ce4b8092365103d69792b0c2d7153f24cb1.exe Token: SeTcbPrivilege 2028 aee03626b83a88b71b06899116cb7ce4b8092365103d69792b0c2d7153f24cb1.exe Token: SeTcbPrivilege 2028 aee03626b83a88b71b06899116cb7ce4b8092365103d69792b0c2d7153f24cb1.exe Token: SeTcbPrivilege 2028 aee03626b83a88b71b06899116cb7ce4b8092365103d69792b0c2d7153f24cb1.exe Token: SeTcbPrivilege 2028 aee03626b83a88b71b06899116cb7ce4b8092365103d69792b0c2d7153f24cb1.exe Token: SeTcbPrivilege 2028 aee03626b83a88b71b06899116cb7ce4b8092365103d69792b0c2d7153f24cb1.exe Token: SeTcbPrivilege 2028 aee03626b83a88b71b06899116cb7ce4b8092365103d69792b0c2d7153f24cb1.exe Token: SeTcbPrivilege 2028 aee03626b83a88b71b06899116cb7ce4b8092365103d69792b0c2d7153f24cb1.exe Token: SeTcbPrivilege 2028 aee03626b83a88b71b06899116cb7ce4b8092365103d69792b0c2d7153f24cb1.exe Token: SeTcbPrivilege 2028 aee03626b83a88b71b06899116cb7ce4b8092365103d69792b0c2d7153f24cb1.exe Token: SeTcbPrivilege 2028 aee03626b83a88b71b06899116cb7ce4b8092365103d69792b0c2d7153f24cb1.exe Token: SeTcbPrivilege 2028 aee03626b83a88b71b06899116cb7ce4b8092365103d69792b0c2d7153f24cb1.exe Token: SeTcbPrivilege 2028 aee03626b83a88b71b06899116cb7ce4b8092365103d69792b0c2d7153f24cb1.exe Token: SeTcbPrivilege 2028 aee03626b83a88b71b06899116cb7ce4b8092365103d69792b0c2d7153f24cb1.exe Token: SeTcbPrivilege 2028 aee03626b83a88b71b06899116cb7ce4b8092365103d69792b0c2d7153f24cb1.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4692 iexplore.exe - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 4692 iexplore.exe 4692 iexplore.exe 3552 IEXPLORE.EXE 3552 IEXPLORE.EXE - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4692 wrote to memory of 3552 4692 iexplore.exe 93 PID 4692 wrote to memory of 3552 4692 iexplore.exe 93 PID 4692 wrote to memory of 3552 4692 iexplore.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\aee03626b83a88b71b06899116cb7ce4b8092365103d69792b0c2d7153f24cb1.exe"C:\Users\Admin\AppData\Local\Temp\aee03626b83a88b71b06899116cb7ce4b8092365103d69792b0c2d7153f24cb1.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2028
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x308 0x2d41⤵
- Suspicious use of AdjustPrivilegeToken
PID:1620
-
C:\Program Files (x86)\Internet Explorer\ielowutil.exe"C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding1⤵
- System Location Discovery: System Language Discovery
PID:4536
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4692 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4692 CREDAT:17410 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3552
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
- Size 471B
- SHA256 1d11d5b7b9240006ea7860d39703d111fefaae92f3c67259f0c743417e634a8e
- MD5 55e40aa7a274d26f0bb8e2117239d1bd
- SHA1 3174d1748da1dea0226e5b485400c5a139b6dd9f
- SHA512 4b6de1f6ed69e04740b16428e984e1476c0e3ebb37ab8893454a1c271c2fce65fb5c4a355f1db0eb00560a6f951ee8102fb9629abfff5fd1ab363ef53cd2253d
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
- Size 404B
- SHA256 8cb25175c18bb76cb65201525cd5f160e0ae7a3b35fe99c62281c25225e62fb2
- MD5 cb8a82e1cd36e7e14f510c42d0361929
- SHA1 fe7b0bdfee4b9cb852c1da46450d48885511d189
- SHA512 1e45b3efbb1d052e7bbefb41d478f7c574b60110ae43f30bccb15727b312684fc109209d3bb04fe694880b96e398f96ff0fdaf5e33a2f147f49a1df2a373acf1
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\VersionManager\ver6F7E.tmp
- Size 15KB
- SHA256 557472aeaebf4c1c800b9df14c190f66d62cbabb011300dbedde2dcddd27a6c1
- MD5 1a545d0052b581fbb2ab4c52133846bc
- SHA1 62f3266a9b9925cd6d98658b92adec673cbe3dd3
- SHA512 bd326d111589d87cd6d019378ec725ac9ac7ad4c36f22453941f7d52f90b747ede4783a83dfff6cae1b3bb46690ad49cffa77f2afda019b22863ac485b406e8d
- SSDEEP 384:79Jv9DF9/C9qc9/J9V791T9TK9Xf9Nm9xQ95a9BR9fV:79Jv9DF9/C9qc9/J9V791T9TK9Xf9NmT
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\0GUUC90F\suggestions[1].en-US
- Size 17KB
- SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
- MD5 5a34cb996293fde2cb7a4ac89587393a
- SHA1 3c96c993500690d1a77873cd62bc639b3a10653f
- SHA512 e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
- SSDEEP 384:K4gN8sGygaEKfWYSJUKbO7UckxtBjCdY7mO3D0C5l+piEieDSV126ry1/XSGKwG3:K4gNFXiKfWfJ1Kockxbd7mAt5Mp5ie2F
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3756129449-3121373848-4276368241-1000\0f5007522459c86e95ffcc62f32308f1_a63d6fdc-08cb-4232-ab51-76cafdcb4d96
- Size 1KB
- SHA256 47e2e0224c3965d1abc9aef0364571e0c31bea471bb90866accb223d8b316440
- MD5 4d81ad0e6c8a48d4b6957eb2fb454bbb
- SHA1 f011964137e18e389ef60bf42f7550f33df5d76e
- SHA512 64a3c5721ecda5c33d249caf68afca4af8ebe4c24a02f9ec7570a4b9ca9fe12810106fc9d6892bcb50ce4909a1b1c58ce56d8674757c17c3167d7bd2d700f413
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3756129449-3121373848-4276368241-1000\0f5007522459c86e95ffcc62f32308f1_a63d6fdc-08cb-4232-ab51-76cafdcb4d96
- Size 1KB
- SHA256 2d6fab6f4224ba0d74218a44c08c53f0c8f179a9011d6a700f52036b558cfe9b
- MD5 1b4c02bf943aed64b3180043477bbe80
- SHA1 1b7773a3846ec83529b3bcc4f3bbf5c3a2e28533
- SHA512 5a602ff6613138e930e4cce693ba8534f30b3417557833e4c5190ce82a26902bb3fb4d49e32a2f4ae9994e8bb53f5df5cf0ebdcef8ee00e54d63894feca93a3a
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3756129449-3121373848-4276368241-1000\0f5007522459c86e95ffcc62f32308f1_a63d6fdc-08cb-4232-ab51-76cafdcb4d96
- Size 1KB
- SHA256 3a953ef549c23dfc5eeb770115b81afcf0091c0e72ad585e5e8d65cb71034241
- MD5 5d72ca81c3a5bc6143f80d8d4a594829
- SHA1 a3b8002939d408c9e506d65b2bf26644bc601993
- SHA512 6a51238f7afa8265f5839844da75779e8ea0210d426109629e827df3c3524ba6d1706a6fcc816317050fa0fe7fcacfca4e4458fc895b3698f08ad5ac1eb44d5b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3756129449-3121373848-4276368241-1000\0f5007522459c86e95ffcc62f32308f1_a63d6fdc-08cb-4232-ab51-76cafdcb4d96
- Size 1KB
- SHA256 eb56a033e3deff5e2574de2b7d0465bdc19fef9a8c2b1f61b6031332835832e9
- MD5 c1a6fc3a41e6e8b759da658768e86b0f
- SHA1 056c922300828cfedbae41e06b221762f5ab8dc3
- SHA512 fde9532b483e80a7a022389aeb488df679096984266693e214481cc08d0262380a3a43c6dbe748660eba979760f054055bac7fa4593c03a39fb3747b99d4d7b0
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3756129449-3121373848-4276368241-1000\0f5007522459c86e95ffcc62f32308f1_a63d6fdc-08cb-4232-ab51-76cafdcb4d96
- Size 1KB
- SHA256 1a4d6f2daca88f292c6b3787abc41c1abef8bb8b61c84690c52c6836cac42840
- MD5 52ac384f5bd167ba864373b1a017e85a
- SHA1 df915989b2c57a447bffb3389947711fd66719c4
- SHA512 78a0cb772af0ab9fe1fe7205e75d24a3d7659ed9d411325081cf712e8e4c0257bbbcdfe466c4ef2d1d5d294a9af93faa8b3630474144ab2f3443264e0dfbc698
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3756129449-3121373848-4276368241-1000\0f5007522459c86e95ffcc62f32308f1_a63d6fdc-08cb-4232-ab51-76cafdcb4d96
- Size 1KB
- SHA256 25b5b39597985023a38de897079d46c5472310220c8762e625038e18f7b59623
- MD5 0dde95d1e2ccfc89edfaed1f02cca693
- SHA1 c3de56e9bff2a268672f44d6c04bbf10c13cd608
- SHA512 15d5ab650219241c989963db4803853674e1022ba9d67ca5f2a32a55a6a0749da48542aa4866b303fdc074f243828d8b34d94182e746ba4b8a21e371ca7fe2ce
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3756129449-3121373848-4276368241-1000\0f5007522459c86e95ffcc62f32308f1_a63d6fdc-08cb-4232-ab51-76cafdcb4d96
- Size 1KB
- SHA256 96087067091dbd425b5cd1317a269e789fe8d9f5a2e079bf509b29d9f7f2ea92
- MD5 8e7f0443ecaa06a738697e188f860b47
- SHA1 666862e8b111629eba304b391f41ca623e7d942e
- SHA512 79ca89f34398227b62457d7b9387c8d432bb7a1a66228284c6f8ec99b4d5abfe89349abda383557e0e499b9f36a17ee31819aaeb21dc03c4fb758ec4dd89fe94
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3756129449-3121373848-4276368241-1000\0f5007522459c86e95ffcc62f32308f1_a63d6fdc-08cb-4232-ab51-76cafdcb4d96
- Size 1KB
- SHA256 c96cd5ad4b7cb77e592163683c41c2406e406fa017eb73d7f9726438e66e6e3d
- MD5 8258675d2d6263901e79070e0e048e38
- SHA1 87d5ffe259d5ec7a22c16ef192178b271cea8979
- SHA512 1a8421898e9b5da73ef75522bb47b24b387530ac777ec1a2aa560244f090f7aee1702fd7848dbf3d7f617a4e00f7598a27a757fd8aa52f363ac0a44aa2f87cb4
- MD5 SHA1 SHA512