Analysis

  • max time kernel
    115s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25-01-2025 01:28

General

  • Target

    476593e5222cc396c4852761aa580a89d60a955c7fbbd90f0d101b4cc35c30fe.exe

  • Size

    629KB

  • MD5

    c2a6426d169796711445246801bddd14

  • SHA1

    5bdebd71cc99c4289f8070aa7b19001ac35b542c

  • SHA256

    476593e5222cc396c4852761aa580a89d60a955c7fbbd90f0d101b4cc35c30fe

  • SHA512

    6badeb542ed98c256cfdaa5257c439c9155b218843b8cfdf51d6015da26c3385a065791534aee208ff27c244711023832ae195f0df44a3b9758be7e6b4ee360c

  • SSDEEP

    12288:/Xb25BA9vaLWhiAd6DxB/u6D1bgPSbcrCUxDWo43M3A:/XcO9iaiAdMNZbgqbcr1xMM

Malware Config

Extracted

Credentials

  • Protocol:
    smtp
  • Host:
    mail.privateemail.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    Unizik323$

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • Agenttesla family
  • Phoenix Keylogger

    Phoenix is a keylogger and info stealer first seen in July 2019.

  • Phoenix Keylogger payload 1 IoCs
  • Phoenix family
  • AgentTesla payload 1 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Reads WinSCP keys stored on the system 2 TTPs

    Tries to access WinSCP stored sessions.

  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

  • Accesses Microsoft Outlook profiles 1 TTPs 6 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 53 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 64 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 49 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of SetWindowsHookEx 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\476593e5222cc396c4852761aa580a89d60a955c7fbbd90f0d101b4cc35c30fe.exe
    "C:\Users\Admin\AppData\Local\Temp\476593e5222cc396c4852761aa580a89d60a955c7fbbd90f0d101b4cc35c30fe.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4392
    • C:\Users\Admin\AppData\Local\Temp\476593e5222cc396c4852761aa580a89d60a955c7fbbd90f0d101b4cc35c30fe.exe
      "C:/Users/Admin/AppData/Local/Temp/476593e5222cc396c4852761aa580a89d60a955c7fbbd90f0d101b4cc35c30fe.exe"
      2⤵
      • Checks computer location settings
      • Accesses Microsoft Outlook profiles
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:768
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\PxXyz.exe
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\PxXyz.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Accesses Microsoft Outlook profiles
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        • outlook_office_path
        • outlook_win_path
        PID:4188
        • C:\Windows\SysWOW64\explorer.exe
          "C:\Windows\System32\explorer.exe" C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
          4⤵
          • System Location Discovery: System Language Discovery
          PID:968
        • C:\Windows\SysWOW64\explorer.exe
          "C:\Windows\System32\explorer.exe" C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2216
        • C:\Windows\SysWOW64\explorer.exe
          "C:\Windows\System32\explorer.exe" C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
          4⤵
          • System Location Discovery: System Language Discovery
          PID:1768
        • C:\Windows\SysWOW64\explorer.exe
          "C:\Windows\System32\explorer.exe" C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
          4⤵
          • System Location Discovery: System Language Discovery
          PID:1464
        • C:\Windows\SysWOW64\explorer.exe
          "C:\Windows\System32\explorer.exe" C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
          4⤵
          • System Location Discovery: System Language Discovery
          PID:3452
        • C:\Windows\SysWOW64\explorer.exe
          "C:\Windows\System32\explorer.exe" C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
          4⤵
          • System Location Discovery: System Language Discovery
          PID:5012
        • C:\Windows\SysWOW64\explorer.exe
          "C:\Windows\System32\explorer.exe" C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
          4⤵
          • System Location Discovery: System Language Discovery
          PID:4184
        • C:\Windows\SysWOW64\explorer.exe
          "C:\Windows\System32\explorer.exe" C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
          4⤵
          • System Location Discovery: System Language Discovery
          PID:1732
        • C:\Windows\SysWOW64\explorer.exe
          "C:\Windows\System32\explorer.exe" C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
          4⤵
          • System Location Discovery: System Language Discovery
          PID:3680
        • C:\Windows\SysWOW64\explorer.exe
          "C:\Windows\System32\explorer.exe" C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
          4⤵
          • System Location Discovery: System Language Discovery
          PID:3996
        • C:\Windows\SysWOW64\explorer.exe
          "C:\Windows\System32\explorer.exe" C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2988
        • C:\Windows\SysWOW64\explorer.exe
          "C:\Windows\System32\explorer.exe" C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2792
        • C:\Windows\SysWOW64\explorer.exe
          "C:\Windows\System32\explorer.exe" C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
          4⤵
          • System Location Discovery: System Language Discovery
          PID:3452
        • C:\Windows\SysWOW64\explorer.exe
          "C:\Windows\System32\explorer.exe" C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
          4⤵
          • System Location Discovery: System Language Discovery
          PID:1860
        • C:\Windows\SysWOW64\explorer.exe
          "C:\Windows\System32\explorer.exe" C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
          4⤵
          • System Location Discovery: System Language Discovery
          PID:3680
        • C:\Windows\SysWOW64\explorer.exe
          "C:\Windows\System32\explorer.exe" C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
          4⤵
          • System Location Discovery: System Language Discovery
          PID:1304
        • C:\Windows\SysWOW64\explorer.exe
          "C:\Windows\System32\explorer.exe" C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
          4⤵
          • System Location Discovery: System Language Discovery
          PID:4784
        • C:\Windows\SysWOW64\explorer.exe
          "C:\Windows\System32\explorer.exe" C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
          4⤵
          • System Location Discovery: System Language Discovery
          PID:1428
        • C:\Windows\SysWOW64\explorer.exe
          "C:\Windows\System32\explorer.exe" C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
          4⤵
          • System Location Discovery: System Language Discovery
          PID:4364
        • C:\Windows\SysWOW64\explorer.exe
          "C:\Windows\System32\explorer.exe" C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
          4⤵
          • System Location Discovery: System Language Discovery
          PID:5180
        • C:\Windows\SysWOW64\explorer.exe
          "C:\Windows\System32\explorer.exe" C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
          4⤵
          • System Location Discovery: System Language Discovery
          PID:5372
        • C:\Windows\SysWOW64\explorer.exe
          "C:\Windows\System32\explorer.exe" C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
          4⤵
          • System Location Discovery: System Language Discovery
          PID:5476
        • C:\Windows\SysWOW64\explorer.exe
          "C:\Windows\System32\explorer.exe" C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
          4⤵
          • System Location Discovery: System Language Discovery
          PID:5592
        • C:\Windows\SysWOW64\explorer.exe
          "C:\Windows\System32\explorer.exe" C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
          4⤵
          • System Location Discovery: System Language Discovery
          PID:5724
        • C:\Windows\SysWOW64\explorer.exe
          "C:\Windows\System32\explorer.exe" C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
          4⤵
          • System Location Discovery: System Language Discovery
          PID:5820
        • C:\Windows\SysWOW64\explorer.exe
          "C:\Windows\System32\explorer.exe" C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
          4⤵
          • System Location Discovery: System Language Discovery
          PID:5940
        • C:\Windows\SysWOW64\explorer.exe
          "C:\Windows\System32\explorer.exe" C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
          4⤵
          • System Location Discovery: System Language Discovery
          PID:6064
        • C:\Windows\SysWOW64\explorer.exe
          "C:\Windows\System32\explorer.exe" C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2120
        • C:\Windows\SysWOW64\explorer.exe
          "C:\Windows\System32\explorer.exe" C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
          4⤵
          • System Location Discovery: System Language Discovery
          PID:5308
        • C:\Windows\SysWOW64\explorer.exe
          "C:\Windows\System32\explorer.exe" C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
          4⤵
          • System Location Discovery: System Language Discovery
          PID:5496
        • C:\Windows\SysWOW64\explorer.exe
          "C:\Windows\System32\explorer.exe" C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
          4⤵
          • System Location Discovery: System Language Discovery
          PID:5680
        • C:\Windows\SysWOW64\explorer.exe
          "C:\Windows\System32\explorer.exe" C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
          4⤵
          • System Location Discovery: System Language Discovery
          PID:1812
        • C:\Windows\SysWOW64\explorer.exe
          "C:\Windows\System32\explorer.exe" C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
          4⤵
          • System Location Discovery: System Language Discovery
          PID:5912
        • C:\Windows\SysWOW64\explorer.exe
          "C:\Windows\System32\explorer.exe" C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
          4⤵
          • System Location Discovery: System Language Discovery
          PID:5164
        • C:\Windows\SysWOW64\explorer.exe
          "C:\Windows\System32\explorer.exe" C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
          4⤵
          • System Location Discovery: System Language Discovery
          PID:5564
        • C:\Windows\SysWOW64\explorer.exe
          "C:\Windows\System32\explorer.exe" C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
          4⤵
          • System Location Discovery: System Language Discovery
          PID:752
        • C:\Windows\SysWOW64\explorer.exe
          "C:\Windows\System32\explorer.exe" C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
          4⤵
          • System Location Discovery: System Language Discovery
          PID:3048
        • C:\Windows\SysWOW64\explorer.exe
          "C:\Windows\System32\explorer.exe" C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
          4⤵
          • System Location Discovery: System Language Discovery
          PID:5164
        • C:\Windows\SysWOW64\explorer.exe
          "C:\Windows\System32\explorer.exe" C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
          4⤵
          • System Location Discovery: System Language Discovery
          PID:5848
        • C:\Windows\SysWOW64\explorer.exe
          "C:\Windows\System32\explorer.exe" C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
          4⤵
          • System Location Discovery: System Language Discovery
          PID:4648
        • C:\Windows\SysWOW64\explorer.exe
          "C:\Windows\System32\explorer.exe" C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2488
        • C:\Windows\SysWOW64\explorer.exe
          "C:\Windows\System32\explorer.exe" C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
          4⤵
          • System Location Discovery: System Language Discovery
          PID:3340
        • C:\Windows\SysWOW64\explorer.exe
          "C:\Windows\System32\explorer.exe" C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
          4⤵
          • System Location Discovery: System Language Discovery
          PID:4888
        • C:\Windows\SysWOW64\explorer.exe
          "C:\Windows\System32\explorer.exe" C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
          4⤵
          • System Location Discovery: System Language Discovery
          PID:6240
        • C:\Windows\SysWOW64\explorer.exe
          "C:\Windows\System32\explorer.exe" C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
          4⤵
          • System Location Discovery: System Language Discovery
          PID:6364
        • C:\Windows\SysWOW64\explorer.exe
          "C:\Windows\System32\explorer.exe" C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
          4⤵
          • System Location Discovery: System Language Discovery
          PID:6476
        • C:\Windows\SysWOW64\explorer.exe
          "C:\Windows\System32\explorer.exe" C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
          4⤵
          • System Location Discovery: System Language Discovery
          PID:6600
        • C:\Windows\SysWOW64\explorer.exe
          "C:\Windows\System32\explorer.exe" C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
          4⤵
          • System Location Discovery: System Language Discovery
          PID:6720
        • C:\Windows\SysWOW64\explorer.exe
          "C:\Windows\System32\explorer.exe" C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
          4⤵
          • System Location Discovery: System Language Discovery
          PID:6836
        • C:\Windows\SysWOW64\explorer.exe
          "C:\Windows\System32\explorer.exe" C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
          4⤵
          • System Location Discovery: System Language Discovery
          PID:6956
  • C:\Windows\explorer.exe
    C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
    1⤵
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:4612
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
    1⤵
      PID:2452
    • C:\Windows\explorer.exe
      C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      PID:540
    • C:\Windows\explorer.exe
      C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      PID:1968
    • C:\Windows\explorer.exe
      C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
      1⤵
      • Modifies Internet Explorer settings
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      PID:216
    • C:\Windows\explorer.exe
      C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
      1⤵
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      PID:2260
    • C:\Windows\explorer.exe
      C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      PID:4692
    • C:\Windows\explorer.exe
      C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
      1⤵
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      PID:2104
    • C:\Windows\explorer.exe
      C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
      1⤵
      • Modifies Internet Explorer settings
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      PID:4080
    • C:\Windows\explorer.exe
      C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
      1⤵
      • Modifies Internet Explorer settings
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      PID:3536
    • C:\Windows\explorer.exe
      C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      PID:1344
    • C:\Windows\explorer.exe
      C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
      1⤵
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      PID:1632
    • C:\Windows\explorer.exe
      C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      PID:4792
    • C:\Windows\explorer.exe
      C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
      1⤵
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      PID:4520
    • C:\Windows\explorer.exe
      C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      PID:1092
    • C:\Windows\explorer.exe
      C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      PID:3348
    • C:\Windows\explorer.exe
      C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
      1⤵
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      PID:1768
    • C:\Windows\explorer.exe
      C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      PID:844
    • C:\Windows\explorer.exe
      C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      PID:1304
    • C:\Windows\explorer.exe
      C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      PID:1428
    • C:\Windows\explorer.exe
      C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
      1⤵
      • Modifies Internet Explorer settings
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      PID:5224
    • C:\Windows\explorer.exe
      C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
      1⤵
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      PID:5404
    • C:\Windows\explorer.exe
      C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
      1⤵
      • Suspicious behavior: AddClipboardFormatListener
      PID:5520
    • C:\Windows\explorer.exe
      C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      PID:5636
    • C:\Windows\explorer.exe
      C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      PID:5752
    • C:\Windows\explorer.exe
      C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      PID:5868
    • C:\Windows\explorer.exe
      C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
      1⤵
      • Suspicious behavior: AddClipboardFormatListener
      PID:5980
    • C:\Windows\explorer.exe
      C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      PID:6104
    • C:\Windows\explorer.exe
      C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      PID:5212
    • C:\Windows\explorer.exe
      C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      PID:5400
    • C:\Windows\explorer.exe
      C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      PID:5556
    • C:\Windows\explorer.exe
      C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
      1⤵
      • Modifies Internet Explorer settings
      • Suspicious behavior: AddClipboardFormatListener
      PID:5728
    • C:\Windows\explorer.exe
      C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      PID:3164
    • C:\Windows\explorer.exe
      C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      PID:6060
    • C:\Windows\explorer.exe
      C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      PID:5336
    • C:\Windows\explorer.exe
      C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      PID:5588
    • C:\Windows\explorer.exe
      C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      PID:5852
    • C:\Windows\explorer.exe
      C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
      1⤵
      • Modifies Internet Explorer settings
      • Suspicious behavior: AddClipboardFormatListener
      PID:4640
    • C:\Windows\explorer.exe
      C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      PID:2224
    • C:\Windows\explorer.exe
      C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      PID:1560
    • C:\Windows\explorer.exe
      C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      PID:5476
    • C:\Windows\explorer.exe
      C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      PID:628
    • C:\Windows\explorer.exe
      C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      PID:752
    • C:\Windows\explorer.exe
      C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      PID:5840
    • C:\Windows\explorer.exe
      C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      PID:6268
    • C:\Windows\explorer.exe
      C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
      1⤵
      • Modifies Internet Explorer settings
      • Suspicious behavior: AddClipboardFormatListener
      PID:6392
    • C:\Windows\explorer.exe
      C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
      1⤵
      • Modifies Internet Explorer settings
      • Suspicious behavior: AddClipboardFormatListener
      PID:6512
    • C:\Windows\explorer.exe
      C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      PID:6636
    • C:\Windows\explorer.exe
      C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
      1⤵
      • Drops startup file
      • Modifies Internet Explorer settings
      • Suspicious behavior: AddClipboardFormatListener
      PID:6748
    • C:\Windows\explorer.exe
      C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
      1⤵
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      PID:6868
    • C:\Windows\explorer.exe
      C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
      1⤵
        PID:6988

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\PxXyz.exe

        Filesize

        116KB

        MD5

        a246aef6eae36566a757cb6fb0de2fea

        SHA1

        15f0a3654d9543d38c83d1a20bf15e0cee65c94f

        SHA256

        f10c83a8d6823ef9b182569828e6899eb317db5b9c75cd4819961a443b8f405d

        SHA512

        8b87289a1950bc1d378976e335568728734120bb7e555fa1e5ecd78e747db4f9fab039e885aab529a84af612772694306b9ab990c401d1a3c6d79f53802a1e1a

      • C:\Users\Admin\Documents\Debug.txt

        Filesize

        3B

        MD5

        ecaa88f7fa0bf610a5a26cf545dcd3aa

        SHA1

        57218c316b6921e2cd61027a2387edc31a2d9471

        SHA256

        f1945cd6c19e56b3c1c78943ef5ec18116907a4ca1efc40a57d48ab1db7adfc5

        SHA512

        37c783b80b1d458b89e712c2dfe2777050eff0aefc9f6d8beedee77807d9aeb2e27d14815cf4f0229b1d36c186bb5f2b5ef55e632b108cc41e9fb964c39b42a5

      • memory/768-12-0x0000000005F50000-0x0000000005FB6000-memory.dmp

        Filesize

        408KB

      • memory/768-32-0x00000000074E0000-0x00000000074EA000-memory.dmp

        Filesize

        40KB

      • memory/768-15-0x0000000074450000-0x0000000074C00000-memory.dmp

        Filesize

        7.7MB

      • memory/768-6-0x0000000000400000-0x000000000047C000-memory.dmp

        Filesize

        496KB

      • memory/768-7-0x0000000074450000-0x0000000074C00000-memory.dmp

        Filesize

        7.7MB

      • memory/768-8-0x00000000056E0000-0x0000000005772000-memory.dmp

        Filesize

        584KB

      • memory/768-9-0x0000000006010000-0x00000000065B4000-memory.dmp

        Filesize

        5.6MB

      • memory/768-10-0x0000000074450000-0x0000000074C00000-memory.dmp

        Filesize

        7.7MB

      • memory/768-11-0x0000000005EA0000-0x0000000005EB8000-memory.dmp

        Filesize

        96KB

      • memory/4188-29-0x0000000000250000-0x0000000000272000-memory.dmp

        Filesize

        136KB

      • memory/4188-30-0x0000000002420000-0x0000000002456000-memory.dmp

        Filesize

        216KB

      • memory/4188-69-0x0000000007150000-0x0000000007312000-memory.dmp

        Filesize

        1.8MB

      • memory/4188-36-0x0000000074450000-0x0000000074C00000-memory.dmp

        Filesize

        7.7MB

      • memory/4188-35-0x0000000074450000-0x0000000074C00000-memory.dmp

        Filesize

        7.7MB

      • memory/4188-31-0x0000000074450000-0x0000000074C00000-memory.dmp

        Filesize

        7.7MB

      • memory/4188-28-0x0000000074450000-0x0000000074C00000-memory.dmp

        Filesize

        7.7MB

      • memory/4392-0-0x000000007445E000-0x000000007445F000-memory.dmp

        Filesize

        4KB

      • memory/4392-13-0x000000007445E000-0x000000007445F000-memory.dmp

        Filesize

        4KB

      • memory/4392-3-0x0000000074450000-0x0000000074C00000-memory.dmp

        Filesize

        7.7MB

      • memory/4392-2-0x0000000005480000-0x000000000551C000-memory.dmp

        Filesize

        624KB

      • memory/4392-17-0x0000000074450000-0x0000000074C00000-memory.dmp

        Filesize

        7.7MB

      • memory/4392-4-0x0000000005520000-0x000000000559E000-memory.dmp

        Filesize

        504KB

      • memory/4392-14-0x0000000074450000-0x0000000074C00000-memory.dmp

        Filesize

        7.7MB

      • memory/4392-1-0x00000000009B0000-0x0000000000A54000-memory.dmp

        Filesize

        656KB