Analysis
-
max time kernel
109s -
max time network
113s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
07-12-2024 00:28
General
-
Target
bdf83a97175f2d99a9408f829c7958bc0c66b34867b6cfaffbda9b4a42b1ff81.exe
-
Size
128KB
-
MD5
bd4b0a5bb039e6d4a4a2e9ec9460a46e
-
SHA1
40dd6334c5a77763e388aa22551fe6cff79d66ab
-
SHA256
bdf83a97175f2d99a9408f829c7958bc0c66b34867b6cfaffbda9b4a42b1ff81
-
SHA512
7dad94e84a1c48a82ecbd925e52e5f409f8547119a827ab1d46a1e333a3eca643bddea8ca80b4f1921d3b22cceda19b40cf28cfe197cd6d259cef91ce3f6fd28
-
SSDEEP
1536:C+hzRsibKplyXTq8OGRnsPFG+RODTb7MXL5uXZnzE6whdYpY6RDXCDMmjs2pxSPq:5ROzoTq0+RO7IwnY6w7DZ6/HGCH2
Malware Config
Extracted
bdaejec
ddos.dnsnb8.net
Signatures
-
Bdaejec family
-
Detects Bdaejec Backdoor. 1 IoCs
Bdaejec is backdoor written in C++.
resource yara_rule behavioral1/memory/5000-67-0x0000000000660000-0x0000000000669000-memory.dmp family_bdaejec_backdoor -
Ramnit family
-
resource yara_rule behavioral1/files/0x000c000000023b10-3.dat aspack_v212_v242 -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation mseul.exe -
Executes dropped EXE 5 IoCs
pid Process 5000 mseul.exe 1156 bdf83a97175f2d99a9408f829c7958bc0c66b34867b6cfaffbda9b4a42b1ff81Srv.exe 4404 DesktopLayer.exe 212 DesktopLayerSrv.exe 2204 DesktopLayer.exe -
resource yara_rule behavioral1/memory/4084-0-0x0000000000400000-0x0000000000442000-memory.dmp upx behavioral1/files/0x000a000000023b64-10.dat upx behavioral1/memory/4404-22-0x0000000000400000-0x0000000000442000-memory.dmp upx behavioral1/memory/4404-19-0x0000000000400000-0x0000000000442000-memory.dmp upx behavioral1/files/0x000b000000023b65-23.dat upx behavioral1/memory/1156-20-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/files/0x000b000000023b65-15.dat upx behavioral1/memory/1156-14-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/4084-13-0x0000000000400000-0x0000000000442000-memory.dmp upx behavioral1/memory/4404-26-0x0000000000400000-0x0000000000442000-memory.dmp upx behavioral1/memory/212-33-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/2204-38-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/2204-40-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/2204-35-0x0000000000400000-0x000000000042E000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe mseul.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe mseul.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe mseul.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE mseul.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdateOnDemand.exe mseul.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe mseul.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe mseul.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE mseul.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE mseul.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstaller.exe mseul.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe mseul.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe mseul.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxCalendarAppImm.exe mseul.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe mseul.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe mseul.exe File created C:\Program Files (x86)\Microsoft\DesktopLayer.exe bdf83a97175f2d99a9408f829c7958bc0c66b34867b6cfaffbda9b4a42b1ff81.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe mseul.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE mseul.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe mseul.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe mseul.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe mseul.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Win32Bridge.Server.exe mseul.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Microsoft.WebMediaExtensions.exe mseul.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe mseul.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe mseul.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE mseul.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.123\notification_helper.exe mseul.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe mseul.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe mseul.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE mseul.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE mseul.exe File opened for modification C:\Program Files\7-Zip\7zG.exe mseul.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.123\chrome_pwa_launcher.exe mseul.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe mseul.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe mseul.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdateCore.exe mseul.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.34.28001.0_x64__8wekyb3d8bbwe\GameBar.exe mseul.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdateComRegisterShell64.exe mseul.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe mseul.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe mseul.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe mseul.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe mseul.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe mseul.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe mseul.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe mseul.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeBackgroundHost.exe mseul.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe mseul.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe mseul.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe mseul.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe mseul.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe mseul.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\3DViewer.exe mseul.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe mseul.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe mseul.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe mseul.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Time.exe mseul.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxIdentityProvider_12.50.6001.0_x64__8wekyb3d8bbwe\XboxIdp.exe mseul.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe mseul.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe mseul.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe mseul.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE mseul.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdate.exe mseul.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\SoundRec.exe mseul.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe mseul.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mseul.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DesktopLayerSrv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bdf83a97175f2d99a9408f829c7958bc0c66b34867b6cfaffbda9b4a42b1ff81.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bdf83a97175f2d99a9408f829c7958bc0c66b34867b6cfaffbda9b4a42b1ff81Srv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DesktopLayer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DesktopLayer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{36891B6E-B432-11EF-B9D5-E24E87F0D14E} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{3681F458-B432-11EF-B9D5-E24E87F0D14E} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31148095" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31148095" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3e0000003e000000c4040000a3020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "183987127" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "183987127" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "440296298" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31148095" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31148095" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "187736912" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "187736912" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe -
Suspicious behavior: EnumeratesProcesses 24 IoCs
pid Process 1156 bdf83a97175f2d99a9408f829c7958bc0c66b34867b6cfaffbda9b4a42b1ff81Srv.exe 1156 bdf83a97175f2d99a9408f829c7958bc0c66b34867b6cfaffbda9b4a42b1ff81Srv.exe 4404 DesktopLayer.exe 4404 DesktopLayer.exe 4404 DesktopLayer.exe 4404 DesktopLayer.exe 4404 DesktopLayer.exe 4404 DesktopLayer.exe 4404 DesktopLayer.exe 4404 DesktopLayer.exe 1156 bdf83a97175f2d99a9408f829c7958bc0c66b34867b6cfaffbda9b4a42b1ff81Srv.exe 1156 bdf83a97175f2d99a9408f829c7958bc0c66b34867b6cfaffbda9b4a42b1ff81Srv.exe 1156 bdf83a97175f2d99a9408f829c7958bc0c66b34867b6cfaffbda9b4a42b1ff81Srv.exe 1156 bdf83a97175f2d99a9408f829c7958bc0c66b34867b6cfaffbda9b4a42b1ff81Srv.exe 1156 bdf83a97175f2d99a9408f829c7958bc0c66b34867b6cfaffbda9b4a42b1ff81Srv.exe 1156 bdf83a97175f2d99a9408f829c7958bc0c66b34867b6cfaffbda9b4a42b1ff81Srv.exe 2204 DesktopLayer.exe 2204 DesktopLayer.exe 2204 DesktopLayer.exe 2204 DesktopLayer.exe 2204 DesktopLayer.exe 2204 DesktopLayer.exe 2204 DesktopLayer.exe 2204 DesktopLayer.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 3616 iexplore.exe 4516 iexplore.exe -
Suspicious use of SetWindowsHookEx 10 IoCs
pid Process 4516 iexplore.exe 4516 iexplore.exe 3616 iexplore.exe 3616 iexplore.exe 220 IEXPLORE.EXE 220 IEXPLORE.EXE 2524 IEXPLORE.EXE 2524 IEXPLORE.EXE 2524 IEXPLORE.EXE 2524 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 30 IoCs
description pid Process procid_target PID 4084 wrote to memory of 5000 4084 bdf83a97175f2d99a9408f829c7958bc0c66b34867b6cfaffbda9b4a42b1ff81.exe 83 PID 4084 wrote to memory of 5000 4084 bdf83a97175f2d99a9408f829c7958bc0c66b34867b6cfaffbda9b4a42b1ff81.exe 83 PID 4084 wrote to memory of 5000 4084 bdf83a97175f2d99a9408f829c7958bc0c66b34867b6cfaffbda9b4a42b1ff81.exe 83 PID 4084 wrote to memory of 1156 4084 bdf83a97175f2d99a9408f829c7958bc0c66b34867b6cfaffbda9b4a42b1ff81.exe 84 PID 4084 wrote to memory of 1156 4084 bdf83a97175f2d99a9408f829c7958bc0c66b34867b6cfaffbda9b4a42b1ff81.exe 84 PID 4084 wrote to memory of 1156 4084 bdf83a97175f2d99a9408f829c7958bc0c66b34867b6cfaffbda9b4a42b1ff81.exe 84 PID 4084 wrote to memory of 4404 4084 bdf83a97175f2d99a9408f829c7958bc0c66b34867b6cfaffbda9b4a42b1ff81.exe 85 PID 4084 wrote to memory of 4404 4084 bdf83a97175f2d99a9408f829c7958bc0c66b34867b6cfaffbda9b4a42b1ff81.exe 85 PID 4084 wrote to memory of 4404 4084 bdf83a97175f2d99a9408f829c7958bc0c66b34867b6cfaffbda9b4a42b1ff81.exe 85 PID 4404 wrote to memory of 212 4404 DesktopLayer.exe 86 PID 4404 wrote to memory of 212 4404 DesktopLayer.exe 86 PID 4404 wrote to memory of 212 4404 DesktopLayer.exe 86 PID 4404 wrote to memory of 4516 4404 DesktopLayer.exe 87 PID 4404 wrote to memory of 4516 4404 DesktopLayer.exe 87 PID 1156 wrote to memory of 3616 1156 bdf83a97175f2d99a9408f829c7958bc0c66b34867b6cfaffbda9b4a42b1ff81Srv.exe 88 PID 1156 wrote to memory of 3616 1156 bdf83a97175f2d99a9408f829c7958bc0c66b34867b6cfaffbda9b4a42b1ff81Srv.exe 88 PID 212 wrote to memory of 2204 212 DesktopLayerSrv.exe 89 PID 212 wrote to memory of 2204 212 DesktopLayerSrv.exe 89 PID 212 wrote to memory of 2204 212 DesktopLayerSrv.exe 89 PID 2204 wrote to memory of 1964 2204 DesktopLayer.exe 90 PID 2204 wrote to memory of 1964 2204 DesktopLayer.exe 90 PID 3616 wrote to memory of 220 3616 iexplore.exe 92 PID 3616 wrote to memory of 220 3616 iexplore.exe 92 PID 3616 wrote to memory of 220 3616 iexplore.exe 92 PID 4516 wrote to memory of 2524 4516 iexplore.exe 91 PID 4516 wrote to memory of 2524 4516 iexplore.exe 91 PID 4516 wrote to memory of 2524 4516 iexplore.exe 91 PID 5000 wrote to memory of 1804 5000 mseul.exe 102 PID 5000 wrote to memory of 1804 5000 mseul.exe 102 PID 5000 wrote to memory of 1804 5000 mseul.exe 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\bdf83a97175f2d99a9408f829c7958bc0c66b34867b6cfaffbda9b4a42b1ff81.exe"C:\Users\Admin\AppData\Local\Temp\bdf83a97175f2d99a9408f829c7958bc0c66b34867b6cfaffbda9b4a42b1ff81.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4084 -
C:\Users\Admin\AppData\Local\Temp\mseul.exeC:\Users\Admin\AppData\Local\Temp\mseul.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5000 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\34e56bf4.bat" "3⤵
- System Location Discovery: System Language Discovery
PID:1804
-
-
-
C:\Users\Admin\AppData\Local\Temp\bdf83a97175f2d99a9408f829c7958bc0c66b34867b6cfaffbda9b4a42b1ff81Srv.exeC:\Users\Admin\AppData\Local\Temp\bdf83a97175f2d99a9408f829c7958bc0c66b34867b6cfaffbda9b4a42b1ff81Srv.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1156 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3616 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3616 CREDAT:17410 /prefetch:24⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:220
-
-
-
-
C:\Program Files (x86)\Microsoft\DesktopLayer.exe"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4404 -
C:\Program Files (x86)\Microsoft\DesktopLayerSrv.exe"C:\Program Files (x86)\Microsoft\DesktopLayerSrv.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:212 -
C:\Program Files (x86)\Microsoft\DesktopLayer.exe"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2204 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"5⤵
- Modifies Internet Explorer settings
PID:1964
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4516 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4516 CREDAT:17410 /prefetch:24⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2524
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
128KB
MD5c8c15e8ec3023d00a8e8dd097d69e860
SHA126ab885bd15ad8ee174b94c13a2b0bfdf36289f5
SHA2564be5fbb396096daf3ca50b11ae732113787ca43256904369b12cd97246a43cda
SHA5122ed6a29630a4a3a7a191dc5d59079702c0fef1047ec4939ec376201cb3dbd64be5ededa48fa4a111519b1f3973025372e66fb3103c16d85b3448acfab55bcfcc
-
Filesize
128KB
MD5bd4b0a5bb039e6d4a4a2e9ec9460a46e
SHA140dd6334c5a77763e388aa22551fe6cff79d66ab
SHA256bdf83a97175f2d99a9408f829c7958bc0c66b34867b6cfaffbda9b4a42b1ff81
SHA5127dad94e84a1c48a82ecbd925e52e5f409f8547119a827ab1d46a1e333a3eca643bddea8ca80b4f1921d3b22cceda19b40cf28cfe197cd6d259cef91ce3f6fd28
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize471B
MD5043565b7c83bfd884eb1fde2e7ccdcc5
SHA11a3239dfa9752084ed7465130943c5d912df308d
SHA25680a1700dd6e600a6b8fa4a0f2a118778c903d2966690103d7e582407fb447126
SHA5121c987485aed7cbe03747cb28f035f799c78b48781991da89a09462e190b2aff3ec1eae0ba0c8a6be9cedde19387b4ed95394ca9d01dac24632aa48f8a3e22257
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize404B
MD5f96a9b7886fbafb948de26862207209e
SHA16ed9a4e040a6fb882457b7c0a1b45737e77e43bc
SHA2563c7a25bb332589ecf80106c97455936c750c04892a79628f773177dc811aeeb2
SHA51298de39b38d27f4cddc2795401873d84e029fe02cd6d9eef714e33e1f618cf957cc057140521f02cbc0e3ea9af54d36d84e7feae5202ce47c1477706aadee3ecd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize404B
MD5f27ffb27e12c4791eaf8b12f3d2fecfe
SHA104b58798222bd9f8f81a7f8edceecf7db69bb899
SHA2562a3f0e64f28a119a107b3ddc6019f348932f3660574a00de40fee85590a56f8c
SHA51289c40a6f02ace847a00c415a6ed16b01561174c8524833aea334d58881f4ca2770b490ccae2f3f091c1cdb68c941937e63a397e5a9f5ff7c11050e0517ceaffa
-
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{3681F458-B432-11EF-B9D5-E24E87F0D14E}.dat
Filesize4KB
MD5e0f31d2f9ddaceb2dfca8ff95f4be629
SHA1beaf88ce978b45af1199041b46b98d1cba3bf208
SHA2564d51428a5ff63df60a5e14b2fbb587a1ba1d9acbf55e590d5b16fef4b0b132cb
SHA512cc748bf5942e5806e23372754a15994c03e9761033d63d26595fa38f875f2f3e352a7385e00757610bb256817ac094b7c693fb910d16df23004c016ae055e0ee
-
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{36891B6E-B432-11EF-B9D5-E24E87F0D14E}.dat
Filesize5KB
MD57b253e38019c9b4bb70aa11f81140c74
SHA1661afaa1ac9a3dff2057fb62d5ef2d0cc4d9d2c6
SHA2564a450da8c46a8a29d5eea9e629f736fcf477a7616213acaab2bb6e43fb901ac2
SHA5123abc3df3bbd1523f354808be373c326b91add1c111a75e420b90e4c06b68aa28ef55f19109fae35775cfe1431333392cd8dc1e27c5cbf2d7bd19df2521c4a9bd
-
Filesize
15KB
MD51a545d0052b581fbb2ab4c52133846bc
SHA162f3266a9b9925cd6d98658b92adec673cbe3dd3
SHA256557472aeaebf4c1c800b9df14c190f66d62cbabb011300dbedde2dcddd27a6c1
SHA512bd326d111589d87cd6d019378ec725ac9ac7ad4c36f22453941f7d52f90b747ede4783a83dfff6cae1b3bb46690ad49cffa77f2afda019b22863ac485b406e8d
-
Filesize
4B
MD5d3b07384d113edec49eaa6238ad5ff00
SHA1f1d2d2f924e986ac86fdf7b36c94bcdf32beec15
SHA256b5bb9d8014a0f9b1d61e21e796d78dccdf1352f23cd32812f4850b878ae4944c
SHA5120cf9180a764aba863a67b6d72f0918bc131c6772642cb2dce5a34f0a702f9470ddc2bf125c12198b1995c233c34b4afd346c54a2334c350a948a51b6e8b4e6b6
-
Filesize
17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
-
Filesize
4B
MD520879c987e2f9a916e578386d499f629
SHA1c7b33ddcc42361fdb847036fc07e880b81935d5d
SHA2569f2981a7cc4d40a2a409dc895de64253acd819d7c0011c8e80b86fe899464e31
SHA512bcdde1625364dd6dd143b45bdcec8d59cf8982aff33790d390b839f3869e0e815684568b14b555a596d616252aeeaa98dac2e6e551c9095ea11a575ff25ff84f
-
Filesize
185B
MD5fe757ca2edcecd3f18e2e38e64dda817
SHA1e2843625922960528192a721f0bd41a7876a3fbd
SHA25616d293a6cafd5a7009ce790386b8f3717429c186e787f5b28ab89d494747707d
SHA512b837b9e00566b5796e2ad8c2797870368f96f7cca201dcf6a2b3a80bc9cb02abc6f0840c06ac2474b5cc1260e26c55afa6b0ad26bf5e835b790358a3d4733c52
-
C:\Users\Admin\AppData\Local\Temp\bdf83a97175f2d99a9408f829c7958bc0c66b34867b6cfaffbda9b4a42b1ff81Srv.exe
Filesize55KB
MD5ff5e1f27193ce51eec318714ef038bef
SHA1b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6
SHA256fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320
SHA512c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a
-
Filesize
15KB
MD556b2c3810dba2e939a8bb9fa36d3cf96
SHA199ee31cd4b0d6a4b62779da36e0eeecdd80589fc
SHA2564354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07
SHA51227812a9a034d7bd2ca73b337ae9e0b6dc79c38cfd1a2c6ac9d125d3cc8fa563c401a40d22155811d5054e5baa8cf8c8e7e03925f25fa856a9ba9dea708d15b4e