isrstealer | 7be45f5f89a98f22c8cd858540497c5da3dba7cbec0fc49b4ec6eff435ee317f

Analysis

max time kernel
150s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
03-12-2024 01:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bb266dc5dede36e0d96e4f55b76f016e_JaffaCakes118.exe
Size

1.5MB
MD5

bb266dc5dede36e0d96e4f55b76f016e
SHA1

4d17702da9f5548e4673081f84b13298c0949fc0
SHA256

7be45f5f89a98f22c8cd858540497c5da3dba7cbec0fc49b4ec6eff435ee317f
SHA512

f139ce61dfcbb51a7d3a947976d5e2600b2875faafd2c7fdcf6791db45546b46b34f9634bba406e1380343d288e707251921ea350d97079522662ac4a01bbf98
SSDEEP

24576:PKnGctxx3lwkjQ7h3l1PVXUi9VF0tb5xQbn1wcJCRcsawHLkH7XgRbeZ:PK3v3a77xVLjF8Fx2n1wpRcsjHLkrz

Score

10^/10

isrstealer collection discovery persistence stealer trojan upx

Malware Config

Signatures

ISR Stealer
ISR Stealer is a modified version of Hackhound Stealer written in visual basic.
trojan stealer isrstealer

ISR Stealer payload 2 IoCs

resource	yara_rule
behavioral2/memory/1320-40-0x0000000000400000-0x0000000000442000-memory.dmp	family_isrstealer
behavioral2/memory/1320-41-0x0000000000400000-0x0000000000442000-memory.dmp	family_isrstealer

Isrstealer family
isrstealer

Detected Nirsoft tools 1 IoCs

Free utilities often used by attackers which can steal passwords, product keys, etc.

resource	yara_rule
behavioral2/memory/2640-55-0x0000000000400000-0x000000000041F000-memory.dmp	Nirsoft

NirSoft MailPassView 1 IoCs

Password recovery tool for various email clients

resource	yara_rule
behavioral2/memory/2640-55-0x0000000000400000-0x000000000041F000-memory.dmp	MailPassView

Executes dropped EXE 2 IoCs

pid	Process
2108	ZIGPLW~1.EXE
4040	NZFN.exe

Accesses Microsoft Outlook accounts 1 TTPs 11 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	RegSvcs.exe
Key opened	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	RegSvcs.exe
Key opened	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	RegSvcs.exe
Key opened	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	RegSvcs.exe
Key opened	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	RegSvcs.exe
Key opened	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	RegSvcs.exe
Key opened	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	RegSvcs.exe
Key opened	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	RegSvcs.exe
Key opened	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	RegSvcs.exe
Key opened	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	RegSvcs.exe
Key opened	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	RegSvcs.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	bb266dc5dede36e0d96e4f55b76f016e_JaffaCakes118.exe

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/files/0x0008000000023ca7-3.dat	autoit_exe

Suspicious use of SetThreadContext 44 IoCs

description	pid	Process	procid_target
PID 4040 set thread context of 2412	4040	NZFN.exe	86
PID 2412 set thread context of 4084	2412	RegSvcs.exe	87
PID 2412 set thread context of 2284	2412	RegSvcs.exe	89
PID 4040 set thread context of 1320	4040	NZFN.exe	100
PID 1320 set thread context of 2676	1320	RegSvcs.exe	101
PID 1320 set thread context of 2640	1320	RegSvcs.exe	109
PID 4040 set thread context of 4500	4040	NZFN.exe	111
PID 4500 set thread context of 4056	4500	RegSvcs.exe	112
PID 4500 set thread context of 948	4500	RegSvcs.exe	114
PID 4040 set thread context of 4904	4040	NZFN.exe	118
PID 4904 set thread context of 3512	4904	RegSvcs.exe	119
PID 4904 set thread context of 2096	4904	RegSvcs.exe	121
PID 4040 set thread context of 3740	4040	NZFN.exe	122
PID 3740 set thread context of 3748	3740	RegSvcs.exe	123
PID 3740 set thread context of 1992	3740	RegSvcs.exe	125
PID 4040 set thread context of 3708	4040	NZFN.exe	126
PID 3708 set thread context of 536	3708	RegSvcs.exe	127
PID 3708 set thread context of 4084	3708	RegSvcs.exe	129
PID 4040 set thread context of 3116	4040	NZFN.exe	133
PID 3116 set thread context of 1688	3116	RegSvcs.exe	134
PID 3116 set thread context of 628	3116	RegSvcs.exe	136
PID 4040 set thread context of 960	4040	NZFN.exe	137
PID 960 set thread context of 1980	960	RegSvcs.exe	138
PID 960 set thread context of 4716	960	RegSvcs.exe	140
PID 4040 set thread context of 2640	4040	NZFN.exe	141
PID 2640 set thread context of 2040	2640	RegSvcs.exe	142
PID 2640 set thread context of 2636	2640	RegSvcs.exe	144
PID 4040 set thread context of 4808	4040	NZFN.exe	145
PID 4808 set thread context of 3132	4808	RegSvcs.exe	146
PID 4808 set thread context of 2124	4808	RegSvcs.exe	148
PID 4040 set thread context of 4648	4040	NZFN.exe	149
PID 4648 set thread context of 232	4648	RegSvcs.exe	150
PID 4648 set thread context of 3164	4648	RegSvcs.exe	152
PID 4040 set thread context of 1572	4040	NZFN.exe	154
PID 1572 set thread context of 764	1572	RegSvcs.exe	155
PID 1572 set thread context of 1928	1572	RegSvcs.exe	158
PID 4040 set thread context of 4848	4040	NZFN.exe	159
PID 4848 set thread context of 2180	4848	RegSvcs.exe	160
PID 4848 set thread context of 3592	4848	RegSvcs.exe	162
PID 4040 set thread context of 3852	4040	NZFN.exe	163
PID 3852 set thread context of 920	3852	RegSvcs.exe	164
PID 3852 set thread context of 2044	3852	RegSvcs.exe	167
PID 4040 set thread context of 3372	4040	NZFN.exe	170
PID 3372 set thread context of 1456	3372	RegSvcs.exe	171

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4084-32-0x0000000000400000-0x0000000000453000-memory.dmp	upx
behavioral2/memory/4084-33-0x0000000000400000-0x0000000000453000-memory.dmp	upx
behavioral2/memory/4084-35-0x0000000000400000-0x0000000000453000-memory.dmp	upx
behavioral2/memory/4084-36-0x0000000000400000-0x0000000000453000-memory.dmp	upx
behavioral2/memory/2640-51-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral2/memory/2640-54-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral2/memory/2640-52-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral2/memory/2640-55-0x0000000000400000-0x000000000041F000-memory.dmp	upx

Program crash 5 IoCs

pid	pid_target	Process	procid_target
1264	2284	WerFault.exe	89
2412	4084	WerFault.exe	129
1072	764	WerFault.exe	155
2388	920	WerFault.exe	164
1700	2044	WerFault.exe	167

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NZFN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ZIGPLW~1.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bb266dc5dede36e0d96e4f55b76f016e_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2108	ZIGPLW~1.EXE
2108	ZIGPLW~1.EXE
2108	ZIGPLW~1.EXE
2108	ZIGPLW~1.EXE
2108	ZIGPLW~1.EXE
2108	ZIGPLW~1.EXE
2108	ZIGPLW~1.EXE
2108	ZIGPLW~1.EXE
4040	NZFN.exe
4040	NZFN.exe
4040	NZFN.exe
4040	NZFN.exe
4040	NZFN.exe
4040	NZFN.exe
4040	NZFN.exe
4040	NZFN.exe
4040	NZFN.exe
4040	NZFN.exe
4040	NZFN.exe
4040	NZFN.exe
4040	NZFN.exe
4040	NZFN.exe
4040	NZFN.exe
4040	NZFN.exe
4040	NZFN.exe
4040	NZFN.exe
4040	NZFN.exe
4040	NZFN.exe
4040	NZFN.exe
4040	NZFN.exe
4040	NZFN.exe
4040	NZFN.exe
4040	NZFN.exe
4040	NZFN.exe
4040	NZFN.exe
4040	NZFN.exe
4040	NZFN.exe
4040	NZFN.exe
4040	NZFN.exe
4040	NZFN.exe
4040	NZFN.exe
4040	NZFN.exe
4040	NZFN.exe
4040	NZFN.exe
4040	NZFN.exe
4040	NZFN.exe
4040	NZFN.exe
4040	NZFN.exe
4040	NZFN.exe
4040	NZFN.exe
4040	NZFN.exe
4040	NZFN.exe
4040	NZFN.exe
4040	NZFN.exe
4040	NZFN.exe
4040	NZFN.exe
4040	NZFN.exe
4040	NZFN.exe
4040	NZFN.exe
4040	NZFN.exe
4040	NZFN.exe
4040	NZFN.exe
4040	NZFN.exe
4040	NZFN.exe

Suspicious use of SetWindowsHookEx 15 IoCs

pid	Process
2412	RegSvcs.exe
1320	RegSvcs.exe
4500	RegSvcs.exe
4904	RegSvcs.exe
3740	RegSvcs.exe
3708	RegSvcs.exe
3116	RegSvcs.exe
960	RegSvcs.exe
2640	RegSvcs.exe
4808	RegSvcs.exe
4648	RegSvcs.exe
1572	RegSvcs.exe
4848	RegSvcs.exe
3852	RegSvcs.exe
3372	RegSvcs.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5056 wrote to memory of 2108	5056	bb266dc5dede36e0d96e4f55b76f016e_JaffaCakes118.exe	83
PID 5056 wrote to memory of 2108	5056	bb266dc5dede36e0d96e4f55b76f016e_JaffaCakes118.exe	83
PID 5056 wrote to memory of 2108	5056	bb266dc5dede36e0d96e4f55b76f016e_JaffaCakes118.exe	83
PID 2108 wrote to memory of 4040	2108	ZIGPLW~1.EXE	84
PID 2108 wrote to memory of 4040	2108	ZIGPLW~1.EXE	84
PID 2108 wrote to memory of 4040	2108	ZIGPLW~1.EXE	84
PID 4040 wrote to memory of 2372	4040	NZFN.exe	85
PID 4040 wrote to memory of 2372	4040	NZFN.exe	85
PID 4040 wrote to memory of 2372	4040	NZFN.exe	85
PID 4040 wrote to memory of 2412	4040	NZFN.exe	86
PID 4040 wrote to memory of 2412	4040	NZFN.exe	86
PID 4040 wrote to memory of 2412	4040	NZFN.exe	86
PID 4040 wrote to memory of 2412	4040	NZFN.exe	86
PID 4040 wrote to memory of 2412	4040	NZFN.exe	86
PID 2412 wrote to memory of 4084	2412	RegSvcs.exe	87
PID 2412 wrote to memory of 4084	2412	RegSvcs.exe	87
PID 2412 wrote to memory of 4084	2412	RegSvcs.exe	87
PID 2412 wrote to memory of 4084	2412	RegSvcs.exe	87
PID 2412 wrote to memory of 4084	2412	RegSvcs.exe	87
PID 2412 wrote to memory of 4084	2412	RegSvcs.exe	87
PID 2412 wrote to memory of 4084	2412	RegSvcs.exe	87
PID 2412 wrote to memory of 4084	2412	RegSvcs.exe	87
PID 2412 wrote to memory of 2284	2412	RegSvcs.exe	89
PID 2412 wrote to memory of 2284	2412	RegSvcs.exe	89
PID 2412 wrote to memory of 2284	2412	RegSvcs.exe	89
PID 2412 wrote to memory of 2284	2412	RegSvcs.exe	89
PID 2412 wrote to memory of 2284	2412	RegSvcs.exe	89
PID 2412 wrote to memory of 2284	2412	RegSvcs.exe	89
PID 2412 wrote to memory of 2284	2412	RegSvcs.exe	89
PID 2412 wrote to memory of 2284	2412	RegSvcs.exe	89
PID 4040 wrote to memory of 1320	4040	NZFN.exe	100
PID 4040 wrote to memory of 1320	4040	NZFN.exe	100
PID 4040 wrote to memory of 1320	4040	NZFN.exe	100
PID 4040 wrote to memory of 1320	4040	NZFN.exe	100
PID 4040 wrote to memory of 1320	4040	NZFN.exe	100
PID 1320 wrote to memory of 2676	1320	RegSvcs.exe	101
PID 1320 wrote to memory of 2676	1320	RegSvcs.exe	101
PID 1320 wrote to memory of 2676	1320	RegSvcs.exe	101
PID 1320 wrote to memory of 2676	1320	RegSvcs.exe	101
PID 1320 wrote to memory of 2676	1320	RegSvcs.exe	101
PID 1320 wrote to memory of 2676	1320	RegSvcs.exe	101
PID 1320 wrote to memory of 2676	1320	RegSvcs.exe	101
PID 1320 wrote to memory of 2676	1320	RegSvcs.exe	101
PID 1320 wrote to memory of 2640	1320	RegSvcs.exe	109
PID 1320 wrote to memory of 2640	1320	RegSvcs.exe	109
PID 1320 wrote to memory of 2640	1320	RegSvcs.exe	109
PID 1320 wrote to memory of 2640	1320	RegSvcs.exe	109
PID 1320 wrote to memory of 2640	1320	RegSvcs.exe	109
PID 1320 wrote to memory of 2640	1320	RegSvcs.exe	109
PID 1320 wrote to memory of 2640	1320	RegSvcs.exe	109
PID 1320 wrote to memory of 2640	1320	RegSvcs.exe	109
PID 4040 wrote to memory of 4500	4040	NZFN.exe	111
PID 4040 wrote to memory of 4500	4040	NZFN.exe	111
PID 4040 wrote to memory of 4500	4040	NZFN.exe	111
PID 4040 wrote to memory of 4500	4040	NZFN.exe	111
PID 4040 wrote to memory of 4500	4040	NZFN.exe	111
PID 4500 wrote to memory of 4056	4500	RegSvcs.exe	112
PID 4500 wrote to memory of 4056	4500	RegSvcs.exe	112
PID 4500 wrote to memory of 4056	4500	RegSvcs.exe	112
PID 4500 wrote to memory of 4056	4500	RegSvcs.exe	112
PID 4500 wrote to memory of 4056	4500	RegSvcs.exe	112
PID 4500 wrote to memory of 4056	4500	RegSvcs.exe	112
PID 4500 wrote to memory of 4056	4500	RegSvcs.exe	112
PID 4500 wrote to memory of 4056	4500	RegSvcs.exe	112

C:\Users\Admin\AppData\Local\Temp\bb266dc5dede36e0d96e4f55b76f016e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\bb266dc5dede36e0d96e4f55b76f016e_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5056
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ZIGPLW~1.EXE
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ZIGPLW~1.EXE
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2108
- - C:\Users\Admin\AppData\Roaming\NZFN.exe
    "C:\Users\Admin\AppData\Roaming\NZFN.exe" "C:\Users\Admin\AppData\Roaming\aOLbK"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:4040
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
      4⤵
      PID:2372
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
      4⤵
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2412
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        
        /scomma "C:\Users\Admin\AppData\Local\Temp\apNLLaIMEP.ini"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4084
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        
        /scomma "C:\Users\Admin\AppData\Local\Temp\1jiMqZcg1t.ini"
        5⤵
        
        PID:2284
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2284 -s 80
        6⤵
        Program crash
        
        PID:1264
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
      4⤵
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1320
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        
        /scomma "C:\Users\Admin\AppData\Local\Temp\YKeBrxQ8RB.ini"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2676
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        
        /scomma "C:\Users\Admin\AppData\Local\Temp\cx4J02B01s.ini"
        5⤵
        Accesses Microsoft Outlook accounts
        System Location Discovery: System Language Discovery
        
        PID:2640
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
      4⤵
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4500
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        
        /scomma "C:\Users\Admin\AppData\Local\Temp\qnOcXxIxhD.ini"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4056
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        
        /scomma "C:\Users\Admin\AppData\Local\Temp\Z4hOlmzZKy.ini"
        5⤵
        Accesses Microsoft Outlook accounts
        System Location Discovery: System Language Discovery
        
        PID:948
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
      4⤵
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:4904
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        
        /scomma "C:\Users\Admin\AppData\Local\Temp\v0GWK5P5oO.ini"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3512
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        
        /scomma "C:\Users\Admin\AppData\Local\Temp\EyQynHe3Q1.ini"
        5⤵
        Accesses Microsoft Outlook accounts
        System Location Discovery: System Language Discovery
        
        PID:2096
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
      4⤵
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:3740
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        
        /scomma "C:\Users\Admin\AppData\Local\Temp\Aq1Hq6gKrl.ini"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3748
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        
        /scomma "C:\Users\Admin\AppData\Local\Temp\eiBfjT4p8v.ini"
        5⤵
        Accesses Microsoft Outlook accounts
        System Location Discovery: System Language Discovery
        
        PID:1992
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
      4⤵
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:3708
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        
        /scomma "C:\Users\Admin\AppData\Local\Temp\GYuelNslab.ini"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:536
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        
        /scomma "C:\Users\Admin\AppData\Local\Temp\ku6P0AS8gl.ini"
        5⤵
        
        PID:4084
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4084 -s 80
        6⤵
        Program crash
        
        PID:2412
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
      4⤵
      PID:3872
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
      4⤵
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:3116
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        
        /scomma "C:\Users\Admin\AppData\Local\Temp\xgvPyA92XR.ini"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1688
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        
        /scomma "C:\Users\Admin\AppData\Local\Temp\PkDHr8vgID.ini"
        5⤵
        Accesses Microsoft Outlook accounts
        System Location Discovery: System Language Discovery
        
        PID:628
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
      4⤵
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:960
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        
        /scomma "C:\Users\Admin\AppData\Local\Temp\ZwqVB9Pbnl.ini"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1980
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        
        /scomma "C:\Users\Admin\AppData\Local\Temp\kKeQxCfhWe.ini"
        5⤵
        Accesses Microsoft Outlook accounts
        System Location Discovery: System Language Discovery
        
        PID:4716
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
      4⤵
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2640
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        
        /scomma "C:\Users\Admin\AppData\Local\Temp\TE00fhmV7o.ini"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2040
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        
        /scomma "C:\Users\Admin\AppData\Local\Temp\aBtFyotk4s.ini"
        5⤵
        Accesses Microsoft Outlook accounts
        System Location Discovery: System Language Discovery
        
        PID:2636
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
      4⤵
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:4808
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        
        /scomma "C:\Users\Admin\AppData\Local\Temp\1Zy8HrIwnn.ini"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3132
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        
        /scomma "C:\Users\Admin\AppData\Local\Temp\oeBKkLjzAF.ini"
        5⤵
        Accesses Microsoft Outlook accounts
        System Location Discovery: System Language Discovery
        
        PID:2124
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
      4⤵
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:4648
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        
        /scomma "C:\Users\Admin\AppData\Local\Temp\vzNt2Suqt5.ini"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:232
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        
        /scomma "C:\Users\Admin\AppData\Local\Temp\YnZgAkc4ck.ini"
        5⤵
        Accesses Microsoft Outlook accounts
        System Location Discovery: System Language Discovery
        
        PID:3164
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
      4⤵
      PID:3504
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
      4⤵
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1572
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        
        /scomma "C:\Users\Admin\AppData\Local\Temp\5QRjTH1kN2.ini"
        5⤵
        
        PID:764
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 764 -s 80
        6⤵
        Program crash
        
        PID:1072
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        
        /scomma "C:\Users\Admin\AppData\Local\Temp\T8Dj3wSIi4.ini"
        5⤵
        Accesses Microsoft Outlook accounts
        System Location Discovery: System Language Discovery
        
        PID:1928
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
      4⤵
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:4848
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        
        /scomma "C:\Users\Admin\AppData\Local\Temp\uYDre6Rily.ini"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2180
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        
        /scomma "C:\Users\Admin\AppData\Local\Temp\WUfu3SPwHr.ini"
        5⤵
        Accesses Microsoft Outlook accounts
        System Location Discovery: System Language Discovery
        
        PID:3592
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
      4⤵
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:3852
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        
        /scomma "C:\Users\Admin\AppData\Local\Temp\1oeuTkG58S.ini"
        5⤵
        
        PID:920
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 920 -s 80
        6⤵
        Program crash
        
        PID:2388
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        
        /scomma "C:\Users\Admin\AppData\Local\Temp\hHPLiV7F7B.ini"
        5⤵
        
        PID:2044
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2044 -s 80
        6⤵
        Program crash
        
        PID:1700
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
      4⤵
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:3372
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        
        /scomma "C:\Users\Admin\AppData\Local\Temp\ocbuzcI6q1.ini"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1456

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2284 -ip 2284
1⤵
PID:3736

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4084 -ip 4084
1⤵
PID:4760

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 764 -ip 764
1⤵
PID:5004

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 920 -ip 920
1⤵
PID:1868

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 2044 -ip 2044
1⤵
PID:1528

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\NZFN1

Filesize
915KB

MD5
4744edba858885bfe4d513e5ba6030ac

SHA1
7706ebc3097465571daf5bc0c26721a79e8b50c2

SHA256
b71c08e936ab72a27a822e2984a60e798591d2b71b352875f6aede464245724b

SHA512
14cf08f1227f320e36ed9b50de68fffea72393f59b921e81ad987f8cd19d9b3766f601063df474b99b6b948a8431232c900577ab633a3d8f13de0b2f69a36685

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ZIGPLW~1.EXE

Filesize
1.8MB

MD5
91c3a3144ffc7eb4e31dcc26e1301dcd

SHA1
900cb5d4062f121a393a9f5e1ad0cae44a7f401f

SHA256
7f4ac188d059db1001070cf83635b00bfbdcb5c85fde88752dca479ffdefbd3c

SHA512
762d02d3de6dfef495fb44d51b2145ac48416a4123754c021fccfabf80f7b808e57129e5bacb78c5919ad4fa88b11ef555a3fb379c8a8d5f62ee94140b4584e7

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\aOLbK

Filesize
492KB

MD5
76896ab4efb7ebe843ab20b057417a94

SHA1
b2840a927224f8720ef5679ac1b33ffcbe97786a

SHA256
7bb7658d3556514c30c7d429ca98c4c484d318e1c338a371278f8deb5bb58fc5

SHA512
62c11f5775168c6ee9f5e2dd07efa31f801220ff494e537fd7f167b4a5115b9838ca7d159912f75d5d0ea4796b0716892e0d3787685399ad2841622d45b88a52

Download Submit
C:\Users\Admin\AppData\Local\Temp\apNLLaIMEP.ini

Filesize
5B

MD5
d1ea279fb5559c020a1b4137dc4de237

SHA1
db6f8988af46b56216a6f0daf95ab8c9bdb57400

SHA256
fcdcc2c46896915a1c695d6231f0fee336a668531b7a3da46178c80362546dba

SHA512
720e9c284f0559015312df7fe977563e5e16f48d3506e51eb4016adf7971924d352f740b030aa3adc81b6f65fd1dba12df06d10fa6c115074e5097e7ee0f08b3

Download Submit
C:\Users\Admin\AppData\Roaming\NZFN.exe

Filesize
915KB

MD5
b06e67f9767e5023892d9698703ad098

SHA1
acc07666f4c1d4461d3e1c263cf6a194a8dd1544

SHA256
8498900e57a490404e7ec4d8159bee29aed5852ae88bd484141780eaadb727bb

SHA512
7972c78acebdd86c57d879c12cb407120155a24a52fda23ddb7d9e181dd59dac1eb74f327817adbc364d37c8dc704f8236f3539b4d3ee5a022814924a1616943

Download Submit
C:\Users\Admin\AppData\Roaming\aOLbK

Filesize
369KB

MD5
f5c1b2bce1a97ddb44b1db99bc912d3f

SHA1
750b5f15a4aad076ab884383ee9b6c9401b2dd46

SHA256
c862d73341d3ab363f21e978a320d4230576d555ccb3ba9e572a724bc4227092

SHA512
aafefc4a2e4615a31a0d76609ea465f19c0cf0241d849206bf49c9e9cebcfc3d770c299d5c31f8b519703b2823f95a61d5976b6f30f21db79e50479a0d24a2b4

Download Submit
memory/1320-41-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1320-40-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2640-51-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2640-54-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2640-52-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2640-55-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/4084-36-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4084-35-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4084-33-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4084-32-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download