12ca4ad8cd613c8d086cd39a5c6e787c12209f2271ba850817b72eae3cd559da

Analysis

max time kernel
150s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
submitted
30-11-2024 21:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dujkgsf.exe

Score

5^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	dujkgsf.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 26 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dujkgsf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dujkgsf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Modifies Internet Explorer Phishing Filter 1 TTPs 24 IoCs

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Microsoft\Internet Explorer\PhishingFilter	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Microsoft\Internet Explorer\PhishingFilter	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Microsoft\Internet Explorer\PhishingFilter	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Microsoft\Internet Explorer\PhishingFilter	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Microsoft\Internet Explorer\PhishingFilter	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Microsoft\Internet Explorer\PhishingFilter	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Microsoft\Internet Explorer\PhishingFilter	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Microsoft\Internet Explorer\PhishingFilter	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Microsoft\Internet Explorer\PhishingFilter	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Microsoft\Internet Explorer\PhishingFilter	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Microsoft\Internet Explorer\PhishingFilter	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Microsoft\Internet Explorer\PhishingFilter	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Microsoft\Internet Explorer\PhishingFilter	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Microsoft\Internet Explorer\PhishingFilter	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Microsoft\Internet Explorer\PhishingFilter	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Microsoft\Internet Explorer\PhishingFilter	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Microsoft\Internet Explorer\PhishingFilter	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Microsoft\Internet Explorer\PhishingFilter	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Microsoft\Internet Explorer\PhishingFilter	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Microsoft\Internet Explorer\PhishingFilter	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Microsoft\Internet Explorer\PhishingFilter	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Microsoft\Internet Explorer\PhishingFilter	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Microsoft\Internet Explorer\PhishingFilter	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Microsoft\Internet Explorer\PhishingFilter	rundll32.exe

Modifies Internet Explorer settings 1 TTPs 64 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Microsoft\Internet Explorer\Main	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\CaretBrowsing	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\SubSysId = "0"	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\Wow64-DeviceId = "0"	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\VersionHigh = "0"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\Control Panel	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\DeviceId = "0"	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\DeviceId = "0"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\Main	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\Wow64-SubSysId = "0"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\FlipAhead	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\Control Panel	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Microsoft\Internet Explorer\Main	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\Wow64-VersionLow = "0"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\Control Panel	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\VersionLow = "0"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\IEDevTools\Options	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\IEDevTools\Options	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\VersionLow = "0"	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\Wow64-SubSysId = "0"	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\Wow64-VersionLow = "0"	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\VersionHigh = "0"	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\DXFeatureLevel = "0"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\PrefetchPrerender	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\DeviceId = "0"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Microsoft\Internet Explorer\Main	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN\Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\Main	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\Wow64-VersionHigh = "0"	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\VendorId = "0"	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\DeviceId = "0"	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\Revision = "0"	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\Wow64-SubSysId = "0"	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\Revision = "0"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\CaretBrowsing	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\Wow64-DXFeatureLevel = "0"	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\VersionHigh = "0"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Microsoft\Internet Explorer\Recovery	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\Wow64-VersionHigh = "0"	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\Wow64-VersionHigh = "0"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\Wow64-Revision = "0"	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\VendorId = "0"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\CaretBrowsing	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN\Settings	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\Wow64-VendorId = "0"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\IEDevTools\Options	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\Wow64-SubSysId = "0"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Microsoft\Internet Explorer\Main	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\Main	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Microsoft\Internet Explorer\Recovery	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\Wow64-VendorId = "0"	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\Wow64-SubSysId = "0"	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\Wow64-VersionHigh = "0"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Microsoft\Internet Explorer\GPU	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\Control Panel	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\VersionLow = "0"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\IEDevTools\Options	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\Wow64-VersionLow = "0"	rundll32.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1248	dujkgsf.exe
1248	dujkgsf.exe
1248	dujkgsf.exe
1248	dujkgsf.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2960 wrote to memory of 1156	2960	dujkgsf.exe	83
PID 2960 wrote to memory of 1156	2960	dujkgsf.exe	83
PID 2960 wrote to memory of 1156	2960	dujkgsf.exe	83
PID 2960 wrote to memory of 3712	2960	dujkgsf.exe	89
PID 2960 wrote to memory of 3712	2960	dujkgsf.exe	89
PID 2960 wrote to memory of 3712	2960	dujkgsf.exe	89
PID 2960 wrote to memory of 2948	2960	dujkgsf.exe	92
PID 2960 wrote to memory of 2948	2960	dujkgsf.exe	92
PID 2960 wrote to memory of 2948	2960	dujkgsf.exe	92
PID 2960 wrote to memory of 440	2960	dujkgsf.exe	93
PID 2960 wrote to memory of 440	2960	dujkgsf.exe	93
PID 2960 wrote to memory of 440	2960	dujkgsf.exe	93
PID 2960 wrote to memory of 2200	2960	dujkgsf.exe	95
PID 2960 wrote to memory of 2200	2960	dujkgsf.exe	95
PID 2960 wrote to memory of 2200	2960	dujkgsf.exe	95
PID 2960 wrote to memory of 1240	2960	dujkgsf.exe	97
PID 2960 wrote to memory of 1240	2960	dujkgsf.exe	97
PID 2960 wrote to memory of 1240	2960	dujkgsf.exe	97
PID 2960 wrote to memory of 4112	2960	dujkgsf.exe	98
PID 2960 wrote to memory of 4112	2960	dujkgsf.exe	98
PID 2960 wrote to memory of 4112	2960	dujkgsf.exe	98
PID 2960 wrote to memory of 2396	2960	dujkgsf.exe	99
PID 2960 wrote to memory of 2396	2960	dujkgsf.exe	99
PID 2960 wrote to memory of 2396	2960	dujkgsf.exe	99
PID 2960 wrote to memory of 3728	2960	dujkgsf.exe	100
PID 2960 wrote to memory of 3728	2960	dujkgsf.exe	100
PID 2960 wrote to memory of 3728	2960	dujkgsf.exe	100
PID 2960 wrote to memory of 1592	2960	dujkgsf.exe	101
PID 2960 wrote to memory of 1592	2960	dujkgsf.exe	101
PID 2960 wrote to memory of 1592	2960	dujkgsf.exe	101
PID 2960 wrote to memory of 432	2960	dujkgsf.exe	102
PID 2960 wrote to memory of 432	2960	dujkgsf.exe	102
PID 2960 wrote to memory of 432	2960	dujkgsf.exe	102
PID 2960 wrote to memory of 3604	2960	dujkgsf.exe	103
PID 2960 wrote to memory of 3604	2960	dujkgsf.exe	103
PID 2960 wrote to memory of 3604	2960	dujkgsf.exe	103
PID 2960 wrote to memory of 2300	2960	dujkgsf.exe	104
PID 2960 wrote to memory of 2300	2960	dujkgsf.exe	104
PID 2960 wrote to memory of 2300	2960	dujkgsf.exe	104
PID 2960 wrote to memory of 1920	2960	dujkgsf.exe	105
PID 2960 wrote to memory of 1920	2960	dujkgsf.exe	105
PID 2960 wrote to memory of 1920	2960	dujkgsf.exe	105
PID 2960 wrote to memory of 1912	2960	dujkgsf.exe	106
PID 2960 wrote to memory of 1912	2960	dujkgsf.exe	106
PID 2960 wrote to memory of 1912	2960	dujkgsf.exe	106
PID 2960 wrote to memory of 376	2960	dujkgsf.exe	107
PID 2960 wrote to memory of 376	2960	dujkgsf.exe	107
PID 2960 wrote to memory of 376	2960	dujkgsf.exe	107
PID 2960 wrote to memory of 1628	2960	dujkgsf.exe	108
PID 2960 wrote to memory of 1628	2960	dujkgsf.exe	108
PID 2960 wrote to memory of 1628	2960	dujkgsf.exe	108
PID 2960 wrote to memory of 2444	2960	dujkgsf.exe	109
PID 2960 wrote to memory of 2444	2960	dujkgsf.exe	109
PID 2960 wrote to memory of 2444	2960	dujkgsf.exe	109
PID 2960 wrote to memory of 3192	2960	dujkgsf.exe	110
PID 2960 wrote to memory of 3192	2960	dujkgsf.exe	110
PID 2960 wrote to memory of 3192	2960	dujkgsf.exe	110
PID 2960 wrote to memory of 2088	2960	dujkgsf.exe	111
PID 2960 wrote to memory of 2088	2960	dujkgsf.exe	111
PID 2960 wrote to memory of 2088	2960	dujkgsf.exe	111
PID 2960 wrote to memory of 4244	2960	dujkgsf.exe	112
PID 2960 wrote to memory of 4244	2960	dujkgsf.exe	112
PID 2960 wrote to memory of 4244	2960	dujkgsf.exe	112
PID 2960 wrote to memory of 4556	2960	dujkgsf.exe	113

C:\Users\Admin\AppData\Local\Temp\dujkgsf.exe
"C:\Users\Admin\AppData\Local\Temp\dujkgsf.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1248
- C:\Users\Admin\AppData\Local\Temp\dujkgsf.exe
  "C:\Users\Admin\AppData\Local\Temp\dujkgsf.exe" /normal.priviledge
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2960
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\System32\rundll32.exe" shell32.dll,Control_RunDLL inetcpl.cpl,,6
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer Phishing Filter
    - Modifies Internet Explorer settings
    PID:1156
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\System32\rundll32.exe" shell32.dll,Control_RunDLL inetcpl.cpl,,6
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer Phishing Filter
    - Modifies Internet Explorer settings
    PID:3712
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\System32\rundll32.exe" shell32.dll,Control_RunDLL inetcpl.cpl,,6
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer Phishing Filter
    - Modifies Internet Explorer settings
    PID:2948
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\System32\rundll32.exe" shell32.dll,Control_RunDLL inetcpl.cpl,,6
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer Phishing Filter
    - Modifies Internet Explorer settings
    PID:440
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\System32\rundll32.exe" shell32.dll,Control_RunDLL inetcpl.cpl,,6
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer Phishing Filter
    - Modifies Internet Explorer settings
    PID:2200
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\System32\rundll32.exe" shell32.dll,Control_RunDLL inetcpl.cpl,,6
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer Phishing Filter
    - Modifies Internet Explorer settings
    PID:1240
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\System32\rundll32.exe" shell32.dll,Control_RunDLL inetcpl.cpl,,6
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer Phishing Filter
    - Modifies Internet Explorer settings
    PID:4112
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\System32\rundll32.exe" shell32.dll,Control_RunDLL inetcpl.cpl,,6
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer Phishing Filter
    - Modifies Internet Explorer settings
    PID:2396
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\System32\rundll32.exe" shell32.dll,Control_RunDLL inetcpl.cpl,,6
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer Phishing Filter
    - Modifies Internet Explorer settings
    PID:3728
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\System32\rundll32.exe" shell32.dll,Control_RunDLL inetcpl.cpl,,6
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer Phishing Filter
    - Modifies Internet Explorer settings
    PID:1592
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\System32\rundll32.exe" shell32.dll,Control_RunDLL inetcpl.cpl,,6
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer Phishing Filter
    - Modifies Internet Explorer settings
    PID:432
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\System32\rundll32.exe" shell32.dll,Control_RunDLL inetcpl.cpl,,6
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer Phishing Filter
    PID:3604
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\System32\rundll32.exe" shell32.dll,Control_RunDLL inetcpl.cpl,,6
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer Phishing Filter
    - Modifies Internet Explorer settings
    PID:2300
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\System32\rundll32.exe" shell32.dll,Control_RunDLL inetcpl.cpl,,6
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer Phishing Filter
    - Modifies Internet Explorer settings
    PID:1920
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\System32\rundll32.exe" shell32.dll,Control_RunDLL inetcpl.cpl,,6
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer Phishing Filter
    - Modifies Internet Explorer settings
    PID:1912
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\System32\rundll32.exe" shell32.dll,Control_RunDLL inetcpl.cpl,,6
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer Phishing Filter
    - Modifies Internet Explorer settings
    PID:376
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\System32\rundll32.exe" shell32.dll,Control_RunDLL inetcpl.cpl,,6
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer Phishing Filter
    - Modifies Internet Explorer settings
    PID:1628
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\System32\rundll32.exe" shell32.dll,Control_RunDLL inetcpl.cpl,,6
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer Phishing Filter
    - Modifies Internet Explorer settings
    PID:2444
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\System32\rundll32.exe" shell32.dll,Control_RunDLL inetcpl.cpl,,6
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer Phishing Filter
    PID:3192
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\System32\rundll32.exe" shell32.dll,Control_RunDLL inetcpl.cpl,,6
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer Phishing Filter
    - Modifies Internet Explorer settings
    PID:2088
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\System32\rundll32.exe" shell32.dll,Control_RunDLL inetcpl.cpl,,6
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer Phishing Filter
    - Modifies Internet Explorer settings
    PID:4244
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\System32\rundll32.exe" shell32.dll,Control_RunDLL inetcpl.cpl,,6
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer Phishing Filter
    - Modifies Internet Explorer settings
    PID:4556
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\System32\rundll32.exe" shell32.dll,Control_RunDLL inetcpl.cpl,,6
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer Phishing Filter
    - Modifies Internet Explorer settings
    PID:3944
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\System32\rundll32.exe" shell32.dll,Control_RunDLL inetcpl.cpl,,6
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer Phishing Filter
    - Modifies Internet Explorer settings
    PID:2224

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads