Analysis
-
max time kernel
92s -
max time network
114s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
07-12-2024 03:01
General
-
Target
4be5fbb396096daf3ca50b11ae732113787ca43256904369b12cd97246a43cdaN.exe
-
Size
128KB
-
MD5
c8c15e8ec3023d00a8e8dd097d69e860
-
SHA1
26ab885bd15ad8ee174b94c13a2b0bfdf36289f5
-
SHA256
4be5fbb396096daf3ca50b11ae732113787ca43256904369b12cd97246a43cda
-
SHA512
2ed6a29630a4a3a7a191dc5d59079702c0fef1047ec4939ec376201cb3dbd64be5ededa48fa4a111519b1f3973025372e66fb3103c16d85b3448acfab55bcfcc
-
SSDEEP
1536:C+hzRsibKplyXTq8OGRnsPFG+RODTb7MXL5uXZnzE6whdYpY6RDXCDMmjs2pxSPX:5ROzoTq0+RO7IwnY6w7DZ6/HGCH
Malware Config
Extracted
bdaejec
ddos.dnsnb8.net
Signatures
-
Bdaejec family
-
Detects Bdaejec Backdoor. 1 IoCs
Bdaejec is backdoor written in C++.
resource yara_rule behavioral1/memory/3064-79-0x0000000000B00000-0x0000000000B09000-memory.dmp family_bdaejec_backdoor -
Ramnit family
-
resource yara_rule behavioral1/files/0x0008000000023cce-3.dat aspack_v212_v242 -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation mseul.exe -
Executes dropped EXE 4 IoCs
pid Process 3064 mseul.exe 3876 4be5fbb396096daf3ca50b11ae732113787ca43256904369b12cd97246a43cdaNSrv.exe 3884 DesktopLayer.exe 2224 DesktopLayerSrv.exe -
resource yara_rule behavioral1/memory/2008-0-0x0000000000400000-0x0000000000442000-memory.dmp upx behavioral1/files/0x0008000000023cd1-9.dat upx behavioral1/memory/3876-16-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/3876-29-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/3884-27-0x0000000000400000-0x0000000000442000-memory.dmp upx behavioral1/memory/3884-28-0x0000000000400000-0x0000000000442000-memory.dmp upx behavioral1/memory/3876-24-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/3884-23-0x0000000000400000-0x0000000000442000-memory.dmp upx behavioral1/files/0x0008000000023cd5-21.dat upx behavioral1/memory/2224-34-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/3876-13-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/2008-12-0x0000000000400000-0x0000000000442000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe mseul.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoasb.exe mseul.exe File opened for modification C:\Program Files (x86)\Windows Mail\wabmig.exe mseul.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.123\chrome_pwa_launcher.exe mseul.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe mseul.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe mseul.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE mseul.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe mseul.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe mseul.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe mseul.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe mseul.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe mseul.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe mseul.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe mseul.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe mseul.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe mseul.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoev.exe mseul.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe mseul.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE mseul.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Microsoft.Msn.Weather.exe mseul.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe mseul.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe mseul.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe mseul.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe mseul.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxCalendarAppImm.exe mseul.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\createdump.exe mseul.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe mseul.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe mseul.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE mseul.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\LocalBridge.exe mseul.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\3DViewer.exe mseul.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\onenoteshare.exe mseul.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\PeopleApp.exe mseul.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe mseul.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe mseul.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe mseul.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe mseul.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe mseul.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\WinStore.App.exe mseul.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe mseul.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe mseul.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe mseul.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe mseul.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe mseul.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe mseul.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe mseul.exe File opened for modification C:\Program Files (x86)\Microsoft\pxD561.tmp DesktopLayerSrv.exe File created C:\Program Files (x86)\Microsoft\DesktopLayer.exe DesktopLayerSrv.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE mseul.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe mseul.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Wallet_2.4.18324.0_x64__8wekyb3d8bbwe\Microsoft.Wallet.exe mseul.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe mseul.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe mseul.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe mseul.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe mseul.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE mseul.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\View3D.ResourceResolver.exe mseul.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe mseul.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe mseul.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE mseul.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_11811.1001.18.0_x64__8wekyb3d8bbwe\StoreExperienceHost.exe mseul.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Calculator.exe mseul.exe File opened for modification C:\Program Files\7-Zip\7z.exe mseul.exe File created C:\Program Files (x86)\Microsoft\DesktopLayerSrv.exe DesktopLayer.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mseul.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DesktopLayer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DesktopLayerSrv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4be5fbb396096daf3ca50b11ae732113787ca43256904369b12cd97246a43cdaN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4be5fbb396096daf3ca50b11ae732113787ca43256904369b12cd97246a43cdaNSrv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1782165236" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1782165236" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31148116" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31148116" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31148116" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1786071403" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "440305477" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1782321245" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1782165236" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Key created \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{95AEC34D-B447-11EF-AF2A-FA9F886F8D04} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31148116" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31148116" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{95AC63B3-B447-11EF-AF2A-FA9F886F8D04} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31148116" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{95BD1038-B447-11EF-AF2A-FA9F886F8D04} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1786853480" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31148116" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1782321245" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3e0000003e000000c4040000a3020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3e0000003e000000c4040000a3020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1782165236" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31148116" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1785915204" IEXPLORE.EXE -
Suspicious behavior: EnumeratesProcesses 24 IoCs
pid Process 3876 4be5fbb396096daf3ca50b11ae732113787ca43256904369b12cd97246a43cdaNSrv.exe 3876 4be5fbb396096daf3ca50b11ae732113787ca43256904369b12cd97246a43cdaNSrv.exe 3876 4be5fbb396096daf3ca50b11ae732113787ca43256904369b12cd97246a43cdaNSrv.exe 3876 4be5fbb396096daf3ca50b11ae732113787ca43256904369b12cd97246a43cdaNSrv.exe 3884 DesktopLayer.exe 3884 DesktopLayer.exe 3884 DesktopLayer.exe 3884 DesktopLayer.exe 3884 DesktopLayer.exe 3884 DesktopLayer.exe 3876 4be5fbb396096daf3ca50b11ae732113787ca43256904369b12cd97246a43cdaNSrv.exe 3876 4be5fbb396096daf3ca50b11ae732113787ca43256904369b12cd97246a43cdaNSrv.exe 3876 4be5fbb396096daf3ca50b11ae732113787ca43256904369b12cd97246a43cdaNSrv.exe 3876 4be5fbb396096daf3ca50b11ae732113787ca43256904369b12cd97246a43cdaNSrv.exe 3884 DesktopLayer.exe 3884 DesktopLayer.exe 2224 DesktopLayerSrv.exe 2224 DesktopLayerSrv.exe 2224 DesktopLayerSrv.exe 2224 DesktopLayerSrv.exe 2224 DesktopLayerSrv.exe 2224 DesktopLayerSrv.exe 2224 DesktopLayerSrv.exe 2224 DesktopLayerSrv.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 4604 iexplore.exe 224 iexplore.exe 3988 iexplore.exe -
Suspicious use of SetWindowsHookEx 14 IoCs
pid Process 3988 iexplore.exe 3988 iexplore.exe 4604 iexplore.exe 4604 iexplore.exe 224 iexplore.exe 224 iexplore.exe 1264 IEXPLORE.EXE 1264 IEXPLORE.EXE 4072 IEXPLORE.EXE 4072 IEXPLORE.EXE 4812 IEXPLORE.EXE 4812 IEXPLORE.EXE 1264 IEXPLORE.EXE 1264 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 30 IoCs
description pid Process procid_target PID 2008 wrote to memory of 3064 2008 4be5fbb396096daf3ca50b11ae732113787ca43256904369b12cd97246a43cdaN.exe 85 PID 2008 wrote to memory of 3064 2008 4be5fbb396096daf3ca50b11ae732113787ca43256904369b12cd97246a43cdaN.exe 85 PID 2008 wrote to memory of 3064 2008 4be5fbb396096daf3ca50b11ae732113787ca43256904369b12cd97246a43cdaN.exe 85 PID 2008 wrote to memory of 3876 2008 4be5fbb396096daf3ca50b11ae732113787ca43256904369b12cd97246a43cdaN.exe 86 PID 2008 wrote to memory of 3876 2008 4be5fbb396096daf3ca50b11ae732113787ca43256904369b12cd97246a43cdaN.exe 86 PID 2008 wrote to memory of 3876 2008 4be5fbb396096daf3ca50b11ae732113787ca43256904369b12cd97246a43cdaN.exe 86 PID 2008 wrote to memory of 3884 2008 4be5fbb396096daf3ca50b11ae732113787ca43256904369b12cd97246a43cdaN.exe 87 PID 2008 wrote to memory of 3884 2008 4be5fbb396096daf3ca50b11ae732113787ca43256904369b12cd97246a43cdaN.exe 87 PID 2008 wrote to memory of 3884 2008 4be5fbb396096daf3ca50b11ae732113787ca43256904369b12cd97246a43cdaN.exe 87 PID 3884 wrote to memory of 2224 3884 DesktopLayer.exe 89 PID 3884 wrote to memory of 2224 3884 DesktopLayer.exe 89 PID 3884 wrote to memory of 2224 3884 DesktopLayer.exe 89 PID 3884 wrote to memory of 224 3884 DesktopLayer.exe 90 PID 3884 wrote to memory of 224 3884 DesktopLayer.exe 90 PID 3876 wrote to memory of 4604 3876 4be5fbb396096daf3ca50b11ae732113787ca43256904369b12cd97246a43cdaNSrv.exe 88 PID 3876 wrote to memory of 4604 3876 4be5fbb396096daf3ca50b11ae732113787ca43256904369b12cd97246a43cdaNSrv.exe 88 PID 2224 wrote to memory of 3988 2224 DesktopLayerSrv.exe 91 PID 2224 wrote to memory of 3988 2224 DesktopLayerSrv.exe 91 PID 3988 wrote to memory of 4812 3988 iexplore.exe 92 PID 3988 wrote to memory of 4812 3988 iexplore.exe 92 PID 3988 wrote to memory of 4812 3988 iexplore.exe 92 PID 4604 wrote to memory of 1264 4604 iexplore.exe 94 PID 4604 wrote to memory of 1264 4604 iexplore.exe 94 PID 4604 wrote to memory of 1264 4604 iexplore.exe 94 PID 224 wrote to memory of 4072 224 iexplore.exe 93 PID 224 wrote to memory of 4072 224 iexplore.exe 93 PID 224 wrote to memory of 4072 224 iexplore.exe 93 PID 3064 wrote to memory of 1360 3064 mseul.exe 95 PID 3064 wrote to memory of 1360 3064 mseul.exe 95 PID 3064 wrote to memory of 1360 3064 mseul.exe 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\4be5fbb396096daf3ca50b11ae732113787ca43256904369b12cd97246a43cdaN.exe"C:\Users\Admin\AppData\Local\Temp\4be5fbb396096daf3ca50b11ae732113787ca43256904369b12cd97246a43cdaN.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\Users\Admin\AppData\Local\Temp\mseul.exeC:\Users\Admin\AppData\Local\Temp\mseul.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3064 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\09523cf0.bat" "3⤵
- System Location Discovery: System Language Discovery
PID:1360
-
-
-
C:\Users\Admin\AppData\Local\Temp\4be5fbb396096daf3ca50b11ae732113787ca43256904369b12cd97246a43cdaNSrv.exeC:\Users\Admin\AppData\Local\Temp\4be5fbb396096daf3ca50b11ae732113787ca43256904369b12cd97246a43cdaNSrv.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3876 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4604 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4604 CREDAT:17410 /prefetch:24⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1264
-
-
-
-
C:\Program Files (x86)\Microsoft\DesktopLayer.exe"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3884 -
C:\Program Files (x86)\Microsoft\DesktopLayerSrv.exe"C:\Program Files (x86)\Microsoft\DesktopLayerSrv.exe"3⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2224 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"4⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3988 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3988 CREDAT:17410 /prefetch:25⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4812
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:224 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:224 CREDAT:17410 /prefetch:24⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4072
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
128KB
MD5c8c15e8ec3023d00a8e8dd097d69e860
SHA126ab885bd15ad8ee174b94c13a2b0bfdf36289f5
SHA2564be5fbb396096daf3ca50b11ae732113787ca43256904369b12cd97246a43cda
SHA5122ed6a29630a4a3a7a191dc5d59079702c0fef1047ec4939ec376201cb3dbd64be5ededa48fa4a111519b1f3973025372e66fb3103c16d85b3448acfab55bcfcc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize471B
MD5043565b7c83bfd884eb1fde2e7ccdcc5
SHA11a3239dfa9752084ed7465130943c5d912df308d
SHA25680a1700dd6e600a6b8fa4a0f2a118778c903d2966690103d7e582407fb447126
SHA5121c987485aed7cbe03747cb28f035f799c78b48781991da89a09462e190b2aff3ec1eae0ba0c8a6be9cedde19387b4ed95394ca9d01dac24632aa48f8a3e22257
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize404B
MD51732ac1fa51975a919944d5d77eb4f11
SHA1973299bd589a241fe620d3af7136c2ef5455a00c
SHA25665372a401282e3f1b064cd9d09dc3f93af4276abcd1f594e0adb9070eccf3c99
SHA51247795983a3d8c18abcb120e13d1a82f682ac6ca080ff12203e46d13a00c0f9a90900b9f78f334bd17edd0929a886c3613087b6e49d23ea24b8f4d166fbedf5c1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize404B
MD5e0156eb1658451dc86c0edd80df8129f
SHA18a9b16d2ee6866dbb4b0bddfa9592930a83de94e
SHA256b005fbe8f89160b1a9c42ac0efdeba1e10abeb8da96e3d2782555efc97a5c0ac
SHA5123b40e54808b11c239bdc7338f7bc8eab88b1a9ba321295186bb99f8a1967a5bce95e181fb37a079e728e73ecd6835c3cdcc6f453121961240ef673fc8a8c23a5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize404B
MD53e2614266059766da444a50f634abad2
SHA1b330f5f0dbdd484d32135c4e21c51c3c94b75d02
SHA25620a242dc691c673d7645a2049cd19d838a45fcba2055736ba33fa223d7792757
SHA512d10f1bcfd8fe58df27740ffe7fbb3e8365cfdbac182d6ac963a381f5456c97cda4b5ba96d7911e2737c252bae3422e241a07eccc284bd5445868735c0d65a2e0
-
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{95AC63B3-B447-11EF-AF2A-FA9F886F8D04}.dat
Filesize3KB
MD5482cf5b60f5a2450b5732e4156a652bc
SHA124649cae8953cf10f53c9d4d13107846c1eda733
SHA256950e8f351138a47ec9d34998ab712a381fe425c26da54ff6b513c22a69f4425d
SHA51253faf2b14ddc1935930f4b888b19e9269226e6580bc529edccafbb0ff0be925c30f322d32c96f724b8d1690c0390f7128672c1c4f584f7f72d85992d519c5af7
-
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{95BD1038-B447-11EF-AF2A-FA9F886F8D04}.dat
Filesize3KB
MD5062e88cb83a32ed861dc392a3ee98307
SHA1fee82b2b3e3f587fd50d9437df01e5dfe316d4b7
SHA2564897b6815b002a13c875e8e46f20db10e7a57cdda219337aefe571326894b691
SHA51246cf595e92bcaa5d12c115ca6dc5453328a9259e38c9fbce7b55264ca34b8aeaa8d410c88c52a5db7c107be90340a29be8babacd849976d250f970596340c4f4
-
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{95BD1038-B447-11EF-AF2A-FA9F886F8D04}.dat
Filesize5KB
MD5418be01720c62950e1fb504faf64b098
SHA133594ead9a6cad937d340de0ae16da3b219c1d4e
SHA2561c92e3c690556ae74f551e1e3b1ae7f3187344853638d2367866c58fdaadb75d
SHA512c00048c2dc4f996fac2cf462ef04d5e666669618a3a401b625543b0958c2c81c06d17bac7964edf7dfb200a48c53957eadb6f70118971f310c7bcc409e2b3264
-
Filesize
15KB
MD51a545d0052b581fbb2ab4c52133846bc
SHA162f3266a9b9925cd6d98658b92adec673cbe3dd3
SHA256557472aeaebf4c1c800b9df14c190f66d62cbabb011300dbedde2dcddd27a6c1
SHA512bd326d111589d87cd6d019378ec725ac9ac7ad4c36f22453941f7d52f90b747ede4783a83dfff6cae1b3bb46690ad49cffa77f2afda019b22863ac485b406e8d
-
Filesize
4B
MD5d3b07384d113edec49eaa6238ad5ff00
SHA1f1d2d2f924e986ac86fdf7b36c94bcdf32beec15
SHA256b5bb9d8014a0f9b1d61e21e796d78dccdf1352f23cd32812f4850b878ae4944c
SHA5120cf9180a764aba863a67b6d72f0918bc131c6772642cb2dce5a34f0a702f9470ddc2bf125c12198b1995c233c34b4afd346c54a2334c350a948a51b6e8b4e6b6
-
Filesize
17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
-
Filesize
185B
MD56c866f17051403df1155d07fc391fd41
SHA1e8b9390cb4d231f3ab70a7bdd971cc35b6e26c77
SHA256c1a638af066fcf1053f69badf0a93e386a2e6c517daa1b4998f80b26ecab36f4
SHA512374615b6f4e599c444507352c466dffad224fa5e07dec7ca0e89aae9083eb614b3b26d4fce3ff7f7c0b32747708b7a1f415fa705a1e8997fee4d45e7b15ec247
-
C:\Users\Admin\AppData\Local\Temp\4be5fbb396096daf3ca50b11ae732113787ca43256904369b12cd97246a43cdaNSrv.exe
Filesize55KB
MD5ff5e1f27193ce51eec318714ef038bef
SHA1b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6
SHA256fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320
SHA512c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a
-
Filesize
4B
MD520879c987e2f9a916e578386d499f629
SHA1c7b33ddcc42361fdb847036fc07e880b81935d5d
SHA2569f2981a7cc4d40a2a409dc895de64253acd819d7c0011c8e80b86fe899464e31
SHA512bcdde1625364dd6dd143b45bdcec8d59cf8982aff33790d390b839f3869e0e815684568b14b555a596d616252aeeaa98dac2e6e551c9095ea11a575ff25ff84f
-
Filesize
15KB
MD556b2c3810dba2e939a8bb9fa36d3cf96
SHA199ee31cd4b0d6a4b62779da36e0eeecdd80589fc
SHA2564354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07
SHA51227812a9a034d7bd2ca73b337ae9e0b6dc79c38cfd1a2c6ac9d125d3cc8fa563c401a40d22155811d5054e5baa8cf8c8e7e03925f25fa856a9ba9dea708d15b4e