Resubmissions
28-11-2024 02:19
241128-cr9sks1kht 1027-11-2024 21:08
241127-zyzyaawqgn 1027-11-2024 20:16
241127-y145caymbs 1027-11-2024 20:13
241127-yzlxdavlen 1027-11-2024 19:53
241127-yl61dsxpcs 1027-11-2024 19:38
241127-ycrjcaxkfx 1027-11-2024 19:03
241127-xqsswsslej 1027-11-2024 19:03
241127-xqf44aslcr 327-11-2024 19:02
241127-xpxqfsslan 327-11-2024 18:32
241127-w6pkqs1mek 10Analysis
-
max time kernel
751s -
max time network
2146s -
platform
windows11-21h2_x64 -
resource
win11-20241007-en -
resource tags
arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system -
submitted
27-11-2024 19:03
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Downloaders.zip
Resource
win11-20241007-en
lummaxmrigxwormmicrosoftcollectioncredential_accessdefense_evasiondiscoveryevasionexecutionminerpersistencephishingprivilege_escalationratspywarestealertrojanupx
windows11-21h2-x64
81 signatures
1800 seconds
General
-
Target
Downloaders.zip
-
Size
12KB
-
MD5
94fe78dc42e3403d06477f995770733c
-
SHA1
ea6ba4a14bab2a976d62ea7ddd4940ec90560586
-
SHA256
16930620b3b9166e0ffbd98f5d5b580c9919fd6ccdcc74fb996f53577f508267
-
SHA512
add85726e7d2c69068381688fe84defe820f600e6214eff029042e3002e9f4ad52dde3b8bb28f4148cca1b950cd54d3999ce9e8445c4562d1ef2efdb1c6bdeff
-
SSDEEP
384:6BfwcSEp9ZjKXSBIDv4dDfjlMJ7HWTHWB:efACW6Dr8HWTHWB
Malware Config
Extracted
Language
ps1
Deobfuscated
URLs
exe.dropper
https://bitbucket.org/superappsss/1/downloads/papa_hr_build.exe
Extracted
Language
ps1
Deobfuscated
URLs
ps1.dropper
http://176.113.115.178/FF/2.png
Extracted
Language
ps1
Deobfuscated
URLs
ps1.dropper
http://176.113.115.178/FF/3.png
Extracted
Language
hta
Source
URLs
hta.dropper
http://176.113.115.178/Windows-Update
Extracted
Language
ps1
Deobfuscated
URLs
ps1.dropper
http://176.113.115.178/FF/1.png
Extracted
Credentials
Protocol: ftp- Host:
72.52.244.4 - Port:
21 - Username:
ftp - Password:
999999
Extracted
Credentials
Protocol: ftp- Host:
103.67.236.20 - Port:
21 - Username:
user - Password:
!root!
Extracted
Credentials
Protocol: ftp- Host:
193.227.116.49 - Port:
21 - Username:
user - Password:
egoiste
Extracted
Family
lumma
C2
https://powerful-avoids.sbs
https://motion-treesz.sbs
https://disobey-curly.sbs
https://leg-sate-boat.sbs
https://story-tense-faz.sbs
https://blade-govern.sbs
https://occupy-blushi.sbs
https://frogs-severz.sbs
https://property-imper.sbs
https://p3ar11fter.sbs
https://3xp3cts1aim.sbs
https://owner-vacat10n.sbs
https://peepburry828.sbs
https://p10tgrace.sbs
https://befall-sm0ker.sbs
https://librari-night.sbs
https://processhol.sbs
https://cook-rain.sbs
Extracted
Family
xworm
Version
5.0
C2
68.178.207.33:7000
Mutex
sSM7p4MT4JctLnRS
Attributes
-
install_file
USB.exe
aes.plain
Extracted
Family
xworm
Version
3.1
C2
18.181.154.24:7000
Mutex
w8DsMRIhXrOmk0Gn
Attributes
-
Install_directory
%AppData%
-
install_file
USB.exe
aes.plain
Signatures
-
Detect Xworm Payload 6 IoCs
Processes:
resource yara_rule behavioral1/memory/7948-7190-0x0000000000B40000-0x0000000000B4E000-memory.dmp family_xworm behavioral1/memory/1544-9276-0x0000000000400000-0x0000000000410000-memory.dmp family_xworm behavioral1/memory/7948-7190-0x0000000000B40000-0x0000000000B4E000-memory.dmp family_xworm behavioral1/memory/1544-9276-0x0000000000400000-0x0000000000410000-memory.dmp family_xworm behavioral1/memory/7948-7190-0x0000000000B40000-0x0000000000B4E000-memory.dmp family_xworm behavioral1/memory/1544-9276-0x0000000000400000-0x0000000000410000-memory.dmp family_xworm -
Lumma family
-
Suspicious use of NtCreateProcessExOtherParentProcess 3 IoCs
Processes:
WerFault.exedescription pid Process procid_target PID 6380 created 6256 6380 WerFault.exe 531 PID 6380 created 6256 6380 WerFault.exe 531 PID 6380 created 6256 6380 WerFault.exe 531 -
Suspicious use of NtCreateUserProcessOtherParentProcess 9 IoCs
Processes:
Winsvc.exe1465331686.exeReynolds.comdescription pid Process procid_target PID 3540 created 3288 3540 Winsvc.exe 52 PID 8252 created 3288 8252 1465331686.exe 52 PID 8204 created 3288 8204 Reynolds.com 52 PID 3540 created 3288 3540 Winsvc.exe 52 PID 8252 created 3288 8252 1465331686.exe 52 PID 8204 created 3288 8204 Reynolds.com 52 PID 3540 created 3288 3540 Winsvc.exe 52 PID 8252 created 3288 8252 1465331686.exe 52 PID 8204 created 3288 8204 Reynolds.com 52 -
Processes:
powershell.exedescription ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" powershell.exe -
Xmrig family
-
Xworm family
-
Contacts a large (5745) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 6 IoCs
Processes:
L.exerandom.exeURGMwM6.exerandom.exeunik.exerandom.exedescription ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ L.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ random.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ URGMwM6.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ random.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ unik.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ random.exe -
XMRig Miner payload 6 IoCs
Processes:
resource yara_rule behavioral1/memory/5208-3864-0x00007FF6B7040000-0x00007FF6B7C90000-memory.dmp xmrig behavioral1/memory/5208-6514-0x00007FF6B7040000-0x00007FF6B7C90000-memory.dmp xmrig behavioral1/memory/5208-3864-0x00007FF6B7040000-0x00007FF6B7C90000-memory.dmp xmrig behavioral1/memory/5208-6514-0x00007FF6B7040000-0x00007FF6B7C90000-memory.dmp xmrig behavioral1/memory/5208-3864-0x00007FF6B7040000-0x00007FF6B7C90000-memory.dmp xmrig behavioral1/memory/5208-6514-0x00007FF6B7040000-0x00007FF6B7C90000-memory.dmp xmrig -
Blocklisted process makes network request 21 IoCs
Processes:
powershell.exepowershell.exepowershell.exemshta.exepowershell.exeflow pid Process 242 7580 powershell.exe 244 7580 powershell.exe 837 5308 powershell.exe 838 2584 powershell.exe 838 2584 powershell.exe 857 5548 mshta.exe 863 4860 powershell.exe 242 7580 powershell.exe 244 7580 powershell.exe 837 5308 powershell.exe 838 2584 powershell.exe 838 2584 powershell.exe 857 5548 mshta.exe 863 4860 powershell.exe 242 7580 powershell.exe 244 7580 powershell.exe 837 5308 powershell.exe 838 2584 powershell.exe 838 2584 powershell.exe 857 5548 mshta.exe 863 4860 powershell.exe -
Processes:
powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepid Process 6984 powershell.exe 7580 powershell.exe 5308 powershell.exe 2584 powershell.exe 4860 powershell.exe 5992 powershell.exe 7060 powershell.exe 3016 powershell.exe 5196 powershell.exe 6560 powershell.exe 3736 powershell.exe 8320 powershell.exe 8884 powershell.exe -
Creates new service(s) 2 TTPs
-
Downloads MZ/PE file
-
Drops file in Drivers directory 1 IoCs
Processes:
procexp64.exedescription ioc Process File created C:\Windows\system32\Drivers\PROCEXP152.SYS procexp64.exe -
Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs
Processes:
procexp64.exedescription ioc Process Key created \REGISTRY\MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe procexp64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "\"C:\\PROGRAM FILES (X86)\\PROCEXP64.EXE\"" procexp64.exe -
Indicator Removal: Network Share Connection Removal 1 TTPs 3 IoCs
Adversaries may remove share connections that are no longer useful in order to clean up traces of their operation.
Processes:
cmd.exenet.exenet.exepid Process 5464 cmd.exe 5304 net.exe 7076 net.exe -
Sets service image path in registry 2 TTPs 1 IoCs
Processes:
procexp64.exedescription ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\PROCEXP152\ImagePath = "\\??\\C:\\Windows\\system32\\Drivers\\PROCEXP152.SYS" procexp64.exe -
Uses browser remote debugging 2 TTPs 9 IoCs
Can be used control the browser and steal sensitive information such as credentials and session cookies.
Processes:
chrome.exechrome.exechrome.exemsedge.exemsedge.exechrome.exemsedge.exemsedge.exemsedge.exepid Process 2984 chrome.exe 6440 chrome.exe 5328 chrome.exe 6868 msedge.exe 5888 msedge.exe 6756 chrome.exe 8312 msedge.exe 6688 msedge.exe 5692 msedge.exe -
Checks BIOS information in registry 2 TTPs 16 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
Mig.exerandom.exerandom.exeLB31.exeL.exerandom.exeURGMwM6.exeunik.exedescription ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion Mig.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion random.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion random.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion LB31.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion L.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion Mig.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion random.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion random.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion L.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion LB31.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion random.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion URGMwM6.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion unik.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion URGMwM6.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion random.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion unik.exe -
Drops startup file 6 IoCs
Processes:
9758xBqgE1azKnB.exeWinsvc.execmd.exeIMG001.exedescription ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9758xBqgE1azKnB.lnk 9758xBqgE1azKnB.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StackTrace.vbs Winsvc.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ZeusChat.url cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ZeusChat.url cmd.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Run.lnk IMG001.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9758xBqgE1azKnB.lnk 9758xBqgE1azKnB.exe -
Executes dropped EXE 64 IoCs
Processes:
pei.exerandom.exehack1226.exetdrpload.exe1352515001.exeURGMwM6.exeWinsvc.exesysnldcvmr.exeTPB-1.exegvndxfghs.exegvndxfghs.exegvndxfghs.exegvndxfghs.exerandom.exeunik.exexblkpfZ8Y4.exetest28.exe3245516675.exetest26.exetest27.exetest29.exetest25.exetest24.exe166715695.exetik-tok-1.0.5.0-installer_iPXA-F1.exe1465331686.exe79144613.exemain_v4.exeTikTok18.exeTikTok18.exe262792613.exe2433825779.exe1989520276.exehack1226.exemain_v4.exerandom.exetest24.exetest25.exetest26.exetest27.exetest28.exetest29.exefHR9z2C.exeAmLzNi.exe2785416532.exesysnldcvmr.exe211929483.exe2704917330.exe89648440.exeXworm%20V5.6.exeXClient.exeVBVEd6f.exetest12.exe1223029666.exetest6.exeMesa.comtest14.exepantest.exetest9.exetest10-29.exe1810918076.exetest19.exetest10.exetest_again4.exepid Process 2044 pei.exe 5996 random.exe 5284 hack1226.exe 5968 tdrpload.exe 704 1352515001.exe 1092 URGMwM6.exe 3540 Winsvc.exe 2568 sysnldcvmr.exe 4652 TPB-1.exe 6212 gvndxfghs.exe 6404 gvndxfghs.exe 5384 gvndxfghs.exe 6900 gvndxfghs.exe 3036 random.exe 6796 unik.exe 5208 xblkpfZ8Y4.exe 4488 test28.exe 7020 3245516675.exe 6084 test26.exe 7164 test27.exe 1456 test29.exe 6804 test25.exe 5976 test24.exe 2416 166715695.exe 9140 tik-tok-1.0.5.0-installer_iPXA-F1.exe 8252 1465331686.exe 8348 79144613.exe 8916 main_v4.exe 7676 TikTok18.exe 7788 TikTok18.exe 7780 262792613.exe 7832 2433825779.exe 7448 1989520276.exe 6628 hack1226.exe 9200 main_v4.exe 5616 random.exe 6836 test24.exe 8740 test25.exe 6600 test26.exe 8764 test27.exe 7272 test28.exe 5588 test29.exe 8316 fHR9z2C.exe 8852 AmLzNi.exe 1920 2785416532.exe 5008 sysnldcvmr.exe 8640 211929483.exe 7460 2704917330.exe 6228 89648440.exe 5244 Xworm%20V5.6.exe 7948 XClient.exe 6808 VBVEd6f.exe 5328 test12.exe 4452 1223029666.exe 6464 test6.exe 8356 Mesa.com 7912 test14.exe 1876 pantest.exe 8172 test9.exe 3056 test10-29.exe 7896 1810918076.exe 6096 test19.exe 6256 test10.exe 5740 test_again4.exe -
Identifies Wine through registry keys 2 TTPs 6 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
Processes:
L.exerandom.exeURGMwM6.exerandom.exeunik.exerandom.exedescription ioc Process Key opened \REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000\Software\Wine L.exe Key opened \REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000\Software\Wine random.exe Key opened \REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000\Software\Wine URGMwM6.exe Key opened \REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000\Software\Wine random.exe Key opened \REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000\Software\Wine unik.exe Key opened \REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000\Software\Wine random.exe -
Loads dropped DLL 3 IoCs
Processes:
ttl.exepid Process 6256 ttl.exe 6256 ttl.exe 6256 ttl.exe -
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
gvndxfghs.exedescription ioc Process Key opened \REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook gvndxfghs.exe Key opened \REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook gvndxfghs.exe Key opened \REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook gvndxfghs.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 6 IoCs
Processes:
tdrpload.exe2785416532.exewin.exeIMG001.exereg.exe9758xBqgE1azKnB.exedescription ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Settings = "C:\\Windows\\sysnldcvmr.exe" tdrpload.exe Set value (str) \REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Settings = "C:\\Users\\Admin\\sysnldcvmr.exe" 2785416532.exe Set value (str) \REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000\Software\Microsoft\Windows\CurrentVersion\Run\Administrator = "C:\\ProgramData\\Microsoft\\csrss.exe" win.exe Set value (str) \REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000\Software\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Users\\Admin\\AppData\\Roaming\\NsMiner\\IMG001.exe" IMG001.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Users\\Admin\\AppData\\Roaming\\NsMiner\\IMG001.exe" reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000\Software\Microsoft\Windows\CurrentVersion\Run\9758xBqgE1azKnB = "C:\\Users\\Admin\\AppData\\Roaming\\9758xBqgE1azKnB.exe" 9758xBqgE1azKnB.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
procexp64.exedescription ioc Process File opened (read-only) \??\S: procexp64.exe File opened (read-only) \??\T: procexp64.exe File opened (read-only) \??\V: procexp64.exe File opened (read-only) \??\H: procexp64.exe File opened (read-only) \??\I: procexp64.exe File opened (read-only) \??\M: procexp64.exe File opened (read-only) \??\N: procexp64.exe File opened (read-only) \??\O: procexp64.exe File opened (read-only) \??\E: procexp64.exe File opened (read-only) \??\G: procexp64.exe File opened (read-only) \??\J: procexp64.exe File opened (read-only) \??\R: procexp64.exe File opened (read-only) \??\X: procexp64.exe File opened (read-only) \??\W: procexp64.exe File opened (read-only) \??\Y: procexp64.exe File opened (read-only) \??\A: procexp64.exe File opened (read-only) \??\B: procexp64.exe File opened (read-only) \??\K: procexp64.exe File opened (read-only) \??\P: procexp64.exe File opened (read-only) \??\Q: procexp64.exe File opened (read-only) \??\L: procexp64.exe File opened (read-only) \??\U: procexp64.exe File opened (read-only) \??\Z: procexp64.exe -
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
-
Processes:
arp.execmd.exeARP.EXEpid Process 2648 arp.exe 4868 cmd.exe 3620 ARP.EXE -
Power Settings 1 TTPs 12 IoCs
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
Processes:
powercfg.execmd.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepid Process 4940 powercfg.exe 7972 cmd.exe 3752 powercfg.exe 6212 powercfg.exe 4100 powercfg.exe 660 powercfg.exe 5192 powercfg.exe 5644 powercfg.exe 8684 powercfg.exe 3352 powercfg.exe 4200 powercfg.exe 6828 powercfg.exe -
Drops file in System32 directory 2 IoCs
Processes:
LB31.exeprocexp64.exedescription ioc Process File opened for modification C:\Windows\system32\MRT.exe LB31.exe File opened for modification C:\Windows\System32\CatRoot2\dberr.txt procexp64.exe -
Enumerates processes with tasklist 1 TTPs 7 IoCs
Processes:
tasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exepid Process 9184 tasklist.exe 5564 tasklist.exe 6792 tasklist.exe 7592 tasklist.exe 6468 tasklist.exe 5288 tasklist.exe 6016 tasklist.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 18 IoCs
Processes:
random.exeURGMwM6.exerandom.exeunik.exerandom.exeL.exepid Process 5996 random.exe 1092 URGMwM6.exe 3036 random.exe 6796 unik.exe 5616 random.exe 6140 L.exe 5996 random.exe 1092 URGMwM6.exe 3036 random.exe 6796 unik.exe 5616 random.exe 6140 L.exe 5996 random.exe 1092 URGMwM6.exe 3036 random.exe 6796 unik.exe 5616 random.exe 6140 L.exe -
Suspicious use of SetThreadContext 33 IoCs
Processes:
gvndxfghs.exeWinsvc.exeInstallUtil.exevg9qcBa.exe7mpPLxE.exeReynolds.comReynolds.com9758xBqgE1azKnB.exeLB31.exedescription pid Process procid_target PID 6212 set thread context of 6404 6212 gvndxfghs.exe 126 PID 6212 set thread context of 5384 6212 gvndxfghs.exe 127 PID 6212 set thread context of 6900 6212 gvndxfghs.exe 128 PID 3540 set thread context of 6624 3540 Winsvc.exe 157 PID 6624 set thread context of 7276 6624 InstallUtil.exe 203 PID 4808 set thread context of 8228 4808 vg9qcBa.exe 394 PID 5616 set thread context of 6512 5616 7mpPLxE.exe 420 PID 8204 set thread context of 4200 8204 Reynolds.com 446 PID 4200 set thread context of 4972 4200 Reynolds.com 452 PID 5172 set thread context of 1544 5172 9758xBqgE1azKnB.exe 476 PID 8968 set thread context of 2976 8968 LB31.exe 512 PID 6212 set thread context of 6404 6212 gvndxfghs.exe 126 PID 6212 set thread context of 5384 6212 gvndxfghs.exe 127 PID 6212 set thread context of 6900 6212 gvndxfghs.exe 128 PID 3540 set thread context of 6624 3540 Winsvc.exe 157 PID 6624 set thread context of 7276 6624 InstallUtil.exe 203 PID 4808 set thread context of 8228 4808 vg9qcBa.exe 394 PID 5616 set thread context of 6512 5616 7mpPLxE.exe 420 PID 8204 set thread context of 4200 8204 Reynolds.com 446 PID 4200 set thread context of 4972 4200 Reynolds.com 452 PID 5172 set thread context of 1544 5172 9758xBqgE1azKnB.exe 476 PID 8968 set thread context of 2976 8968 LB31.exe 512 PID 6212 set thread context of 6404 6212 gvndxfghs.exe 126 PID 6212 set thread context of 5384 6212 gvndxfghs.exe 127 PID 6212 set thread context of 6900 6212 gvndxfghs.exe 128 PID 3540 set thread context of 6624 3540 Winsvc.exe 157 PID 6624 set thread context of 7276 6624 InstallUtil.exe 203 PID 4808 set thread context of 8228 4808 vg9qcBa.exe 394 PID 5616 set thread context of 6512 5616 7mpPLxE.exe 420 PID 8204 set thread context of 4200 8204 Reynolds.com 446 PID 4200 set thread context of 4972 4200 Reynolds.com 452 PID 5172 set thread context of 1544 5172 9758xBqgE1azKnB.exe 476 PID 8968 set thread context of 2976 8968 LB31.exe 512 -
Processes:
resource yara_rule behavioral1/memory/5208-2259-0x00007FF6B7040000-0x00007FF6B7C90000-memory.dmp upx behavioral1/memory/5208-3864-0x00007FF6B7040000-0x00007FF6B7C90000-memory.dmp upx behavioral1/memory/5208-6514-0x00007FF6B7040000-0x00007FF6B7C90000-memory.dmp upx behavioral1/memory/5208-2259-0x00007FF6B7040000-0x00007FF6B7C90000-memory.dmp upx behavioral1/memory/5208-3864-0x00007FF6B7040000-0x00007FF6B7C90000-memory.dmp upx behavioral1/memory/5208-6514-0x00007FF6B7040000-0x00007FF6B7C90000-memory.dmp upx behavioral1/memory/5208-2259-0x00007FF6B7040000-0x00007FF6B7C90000-memory.dmp upx behavioral1/memory/5208-3864-0x00007FF6B7040000-0x00007FF6B7C90000-memory.dmp upx behavioral1/memory/5208-6514-0x00007FF6B7040000-0x00007FF6B7C90000-memory.dmp upx -
Drops file in Program Files directory 3 IoCs
Processes:
procexp64.exedescription ioc Process File opened for modification C:\Program Files (x86)\ntkrnlmp.pdb procexp64.exe File opened for modification C:\Program Files (x86)\exe\ntkrnlmp.pdb procexp64.exe File opened for modification C:\Program Files (x86)\symbols\exe\ntkrnlmp.pdb procexp64.exe -
Drops file in Windows directory 18 IoCs
Processes:
0fVlNye.exe2785416532.exeVBVEd6f.exetdrpload.exechrome.exeschtasks.exedescription ioc Process File opened for modification C:\Windows\VatBukkake 0fVlNye.exe File created C:\Windows\sysnldcvmr.exe 2785416532.exe File opened for modification C:\Windows\RipeHaiti VBVEd6f.exe File opened for modification C:\Windows\IdeasApp 0fVlNye.exe File opened for modification C:\Windows\TeddySecretariat 0fVlNye.exe File opened for modification C:\Windows\OrganDiscretion 0fVlNye.exe File created C:\Windows\sysnldcvmr.exe tdrpload.exe File opened for modification C:\Windows\SystemTemp chrome.exe File opened for modification C:\Windows\ComfortSick 0fVlNye.exe File opened for modification C:\Windows\CentralAvoiding 0fVlNye.exe File opened for modification C:\Windows\JoiningMazda 0fVlNye.exe File opened for modification C:\Windows\KeyboardsTwin 0fVlNye.exe File opened for modification C:\Windows\sysnldcvmr.exe tdrpload.exe File opened for modification C:\Windows\CoCurious VBVEd6f.exe File opened for modification C:\Windows\DownReceptor 0fVlNye.exe File opened for modification C:\Windows\UruguayNorthern 0fVlNye.exe File opened for modification C:\Windows\MozambiqueAppropriate 0fVlNye.exe File created C:\Windows\Tasks\UAC.job schtasks.exe -
Launches sc.exe 14 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exepid Process 2852 sc.exe 6264 sc.exe 9184 sc.exe 3864 sc.exe 5528 sc.exe 8256 sc.exe 5280 sc.exe 3100 sc.exe 1440 sc.exe 6560 sc.exe 7676 sc.exe 7664 sc.exe 9036 sc.exe 3488 sc.exe -
Command and Scripting Interpreter: JavaScript 1 TTPs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
Processes:
netsh.exenetsh.exedescription ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe -
Program crash 6 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target Process procid_target 7848 7448 WerFault.exe 204 7960 5616 WerFault.exe 235 7848 7448 WerFault.exe 204 7960 5616 WerFault.exe 235 7848 7448 WerFault.exe 204 7960 5616 WerFault.exe 235 -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
pei.exegvndxfghs.exe166715695.exe79144613.exewmic.exewmic.exe89648440.exeVBVEd6f.exe1810918076.exe7mpPLxE.exegvndxfghs.exetik-tok-1.0.5.0-installer_iPXA-F1.exehack1226.exewmic.exeL.exefindstr.exeschtasks.exehack1226.exe2433825779.exewmic.exewmic.exewmic.execmd.execmd.execmd.exeschtasks.exepowershell.exepowershell.exewmic.exesysnldcvmr.exeMesa.comtaskkill.exeIMG001.exe4363463463464363463463463.exeURGMwM6.exemain_v4.exemain_v4.exewmic.exewmic.execmd.exereg.exetdrpload.exepowershell.exetasklist.exewmic.exe7mpPLxE.execmd.exesysnldcvmr.exe262792613.exetasklist.exefindstr.execmd.exetaskkill.exegvndxfghs.exe0fVlNye.exechoice.execmd.exepowershell.exe9758xBqgE1azKnB.exeTikTok18.exe1989520276.exewmic.exerandom.exetasklist.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pei.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language gvndxfghs.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 166715695.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 79144613.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 89648440.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VBVEd6f.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1810918076.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7mpPLxE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language gvndxfghs.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tik-tok-1.0.5.0-installer_iPXA-F1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hack1226.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language L.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language findstr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hack1226.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2433825779.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sysnldcvmr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mesa.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IMG001.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4363463463464363463463463.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language URGMwM6.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language main_v4.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language main_v4.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tdrpload.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7mpPLxE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sysnldcvmr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 262792613.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language findstr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language gvndxfghs.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0fVlNye.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language choice.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9758xBqgE1azKnB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TikTok18.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1989520276.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language random.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
Processes:
PING.EXEPING.EXEpid Process 5944 PING.EXE 8672 PING.EXE -
Checks processor information in registry 2 TTPs 14 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
TPB-1.exetik-tok-1.0.5.0-installer_iPXA-F1.exefirefox.exefirefox.exeprocexp64.exedescription ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString TPB-1.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 tik-tok-1.0.5.0-installer_iPXA-F1.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz tik-tok-1.0.5.0-installer_iPXA-F1.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString firefox.exe Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 procexp64.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 TPB-1.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz procexp64.exe -
Detects videocard installed 1 TTPs 2 IoCs
Uses WMIC.exe to determine videocard installed.
Processes:
wmic.exewmic.exepid Process 3456 wmic.exe 7152 wmic.exe -
Discovers systems in the same network 1 TTPs 2 IoCs
-
Enumerates system info in registry 2 TTPs 15 IoCs
Processes:
msedge.exemsedge.exemsedge.exechrome.exemsedge.exedescription ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe -
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
Processes:
ipconfig.exepid Process 6692 ipconfig.exe -
Kills process with taskkill 3 IoCs
Processes:
taskkill.exetaskkill.exetaskkill.exepid Process 1920 taskkill.exe 6272 taskkill.exe 8008 taskkill.exe -
Modifies data under HKEY_USERS 46 IoCs
Processes:
powershell.exedescription ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" powershell.exe -
Modifies registry class 37 IoCs
Processes:
reg.exereg.exepowershell.exereg.exereg.exereg.exereg.exereg.exereg.exefirefox.exereg.exe7zFM.exedescription ioc Process Key created \REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\ms-settings reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\ms-settings\Shell\Open reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\ms-settings\Shell reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\ms-settings reg.exe Key created \REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings powershell.exe Key deleted \REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\ms-settings\Shell\Open\command reg.exe Key created \REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\ms-settings\Shell\Open\command reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\ms-settings\Shell\Open\command reg.exe Key created \REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\ms-settings\Shell\Open\command reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\ms-settings reg.exe Key created \REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\ms-settings\Shell\Open\command reg.exe Key created \REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\ms-settings\Shell\Open reg.exe Key created \REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\ms-settings\Shell reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\ms-settings\Shell\Open\command\ = "wscript.exe C:\\Users\\Admin\\AppData\\Local\\Temp\\3726.vbs" reg.exe Key created \REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\ms-settings\Shell\Open\command reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\ms-settings\Shell\Open\command\DelegateExecute reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\ms-settings reg.exe Key created \REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\ms-settings\Shell reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\ms-settings\Shell\Open\command\ = "wscript.exe C:\\Users\\Admin\\AppData\\Local\\Temp\\2599.vbs" reg.exe Key created \REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings firefox.exe Key deleted \REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\ms-settings\Shell reg.exe Key created \REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\ms-settings reg.exe Key created \REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\ms-settings\Shell\Open\command reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\ms-settings\Shell\Open\command\DelegateExecute reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\ms-settings\Shell\Open\command reg.exe Key created \REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\ms-settings reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\ms-settings\Shell\Open\command\DelegateExecute reg.exe Key created \REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\ms-settings\Shell\Open reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\ms-settings\Shell\Open reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\ms-settings\Shell\Open\command\ = "wscript.exe C:\\Users\\Admin\\AppData\\Local\\Temp\\2997.vbs" reg.exe Key created \REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ 7zFM.exe Key created \REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\ms-settings\Shell\Open\command reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\ms-settings\Shell\Open reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\ms-settings\Shell reg.exe Key created \REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\ms-settings\Shell reg.exe Key created \REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\ms-settings\Shell\Open reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ 7zFM.exe -
NTFS ADS 1 IoCs
Processes:
firefox.exedescription ioc Process File created C:\Users\Admin\Downloads\SysinternalsSuite.zip:Zone.Identifier firefox.exe -
Runs ping.exe 1 TTPs 2 IoCs
-
Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exepid Process 8296 schtasks.exe 4024 schtasks.exe 8416 schtasks.exe -
Suspicious behavior: AddClipboardFormatListener 3 IoCs
Processes:
URGMwM6.exepid Process 1092 URGMwM6.exe 1092 URGMwM6.exe 1092 URGMwM6.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
procexp64.exemsedge.exemsedge.exepid Process 2684 procexp64.exe 2684 procexp64.exe 2684 procexp64.exe 2684 procexp64.exe 2684 procexp64.exe 2684 procexp64.exe 2684 procexp64.exe 2684 procexp64.exe 2684 procexp64.exe 2684 procexp64.exe 2684 procexp64.exe 2684 procexp64.exe 2684 procexp64.exe 2684 procexp64.exe 2684 procexp64.exe 2684 procexp64.exe 2684 procexp64.exe 2684 procexp64.exe 2684 procexp64.exe 2684 procexp64.exe 2684 procexp64.exe 2684 procexp64.exe 2684 procexp64.exe 2684 procexp64.exe 2684 procexp64.exe 2684 procexp64.exe 2684 procexp64.exe 2684 procexp64.exe 2684 procexp64.exe 2684 procexp64.exe 2684 procexp64.exe 2152 msedge.exe 2152 msedge.exe 2684 procexp64.exe 2684 procexp64.exe 2156 msedge.exe 2156 msedge.exe 2684 procexp64.exe 2684 procexp64.exe 2684 procexp64.exe 2684 procexp64.exe 2684 procexp64.exe 2684 procexp64.exe 2684 procexp64.exe 2684 procexp64.exe 2684 procexp64.exe 2684 procexp64.exe 2684 procexp64.exe 2684 procexp64.exe 2684 procexp64.exe 2684 procexp64.exe 2684 procexp64.exe 2684 procexp64.exe 2684 procexp64.exe 2684 procexp64.exe 2684 procexp64.exe 2684 procexp64.exe 2684 procexp64.exe 2684 procexp64.exe 2684 procexp64.exe 2684 procexp64.exe 2684 procexp64.exe 2684 procexp64.exe 2684 procexp64.exe -
Suspicious behavior: GetForegroundWindowSpam 6 IoCs
Processes:
7zFM.exeprocexp64.exepid Process 744 7zFM.exe 2684 procexp64.exe 744 7zFM.exe 2684 procexp64.exe 744 7zFM.exe 2684 procexp64.exe -
Suspicious behavior: LoadsDriver 64 IoCs
Processes:
procexp64.exepid Process 2684 procexp64.exe 4