Overview
overview
9Static
static
830bc4934d7...f0.exe
windows7-x64
630bc4934d7...f0.exe
windows10-2004-x64
6338fdf3626...13.exe
windows7-x64
1338fdf3626...13.exe
windows10-2004-x64
1342933cb4c...20.exe
windows7-x64
7342933cb4c...20.exe
windows10-2004-x64
9343ace5874...03.exe
windows7-x64
3343ace5874...03.exe
windows10-2004-x64
834818CE171...49.dll
windows7-x64
834818CE171...49.dll
windows10-2004-x64
8360390_crypt.exe
windows7-x64
1360390_crypt.exe
windows10-2004-x64
3360390_tree.cmd
windows7-x64
7360390_tree.cmd
windows10-2004-x64
73896f8a370...e_.exe
windows7-x64
83896f8a370...e_.exe
windows10-2004-x64
73a061ee07d...8c.dll
windows7-x64
33a061ee07d...8c.dll
windows10-2004-x64
33af4fa2bff...d1.dll
windows7-x64
33af4fa2bff...d1.dll
windows10-2004-x64
33bb691982d...21.exe
windows7-x64
13bb691982d...21.exe
windows10-2004-x64
93e3f980ab6...95.exe
windows7-x64
73e3f980ab6...95.exe
windows10-2004-x64
73e3f980ab6...26.exe
windows7-x64
73e3f980ab6...26.exe
windows10-2004-x64
33e75e8238a..._2.exe
windows7-x64
63e75e8238a..._2.exe
windows10-2004-x64
6400cad56ff...9a.exe
windows7-x64
9400cad56ff...9a.exe
windows10-2004-x64
940b3cb2a21...0c.exe
windows7-x64
740b3cb2a21...0c.exe
windows10-2004-x64
9Analysis
-
max time kernel
150s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20250314-en -
resource tags
arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system -
submitted
28/03/2025, 16:52
Behavioral task
behavioral1
Sample
30bc4934d7e29c8c4c4c9be0510fc7558fddf8db666a0343784c5cf1587b3af0.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
30bc4934d7e29c8c4c4c9be0510fc7558fddf8db666a0343784c5cf1587b3af0.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral3
Sample
338fdf3626aa4a48a5972f291aacf3d6172dd920fe16ac4da4dd6c5b999d2f13.exe
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
338fdf3626aa4a48a5972f291aacf3d6172dd920fe16ac4da4dd6c5b999d2f13.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral5
Sample
342933cb4cbb31a2c30ac1733afc318a6e5cd0226160a59197686d635ec71b20.exe
Resource
win7-20241010-en
Behavioral task
behavioral6
Sample
342933cb4cbb31a2c30ac1733afc318a6e5cd0226160a59197686d635ec71b20.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral7
Sample
343ace5874a5854858e11e6c196007bffc045717ed29db9b03f23d01568e8303.exe
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
343ace5874a5854858e11e6c196007bffc045717ed29db9b03f23d01568e8303.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral9
Sample
34818CE171EA150B91429AC1DD6FBE49.dll
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
34818CE171EA150B91429AC1DD6FBE49.dll
Resource
win10v2004-20250314-en
Behavioral task
behavioral11
Sample
360390_crypt.exe
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
360390_crypt.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral13
Sample
360390_tree.cmd
Resource
win7-20241010-en
Behavioral task
behavioral14
Sample
360390_tree.cmd
Resource
win10v2004-20250314-en
Behavioral task
behavioral15
Sample
3896f8a37034429e9784d767765d85ef6dcde105320568516fac4e31400514db.exe_.exe
Resource
win7-20240903-en
Behavioral task
behavioral16
Sample
3896f8a37034429e9784d767765d85ef6dcde105320568516fac4e31400514db.exe_.exe
Resource
win10v2004-20250313-en
Behavioral task
behavioral17
Sample
3a061ee07d87a6bb13e613e000e9f685cbffb96bd7024a9e7b4cb0be9a4af38c.dll
Resource
win7-20241010-en
Behavioral task
behavioral18
Sample
3a061ee07d87a6bb13e613e000e9f685cbffb96bd7024a9e7b4cb0be9a4af38c.dll
Resource
win10v2004-20250314-en
Behavioral task
behavioral19
Sample
3af4fa2bffaab37fd557ae8146ae0a29ba0faf6d99ad8a1a8d5bf598ac9a23d1.dll
Resource
win7-20240729-en
Behavioral task
behavioral20
Sample
3af4fa2bffaab37fd557ae8146ae0a29ba0faf6d99ad8a1a8d5bf598ac9a23d1.dll
Resource
win10v2004-20250314-en
Behavioral task
behavioral21
Sample
3bb691982de416a7a4e57b91211e80bea82dcca7b4bdbf25c0c80451dc138421.exe
Resource
win7-20250207-en
Behavioral task
behavioral22
Sample
3bb691982de416a7a4e57b91211e80bea82dcca7b4bdbf25c0c80451dc138421.exe
Resource
win10v2004-20250313-en
Behavioral task
behavioral23
Sample
3e3f980ab668ccde6aafee60ce16e3c35cd91e9b59bff20ce1615d5fb362a458_Dumped_TDS=4FBA3695.exe
Resource
win7-20240903-en
Behavioral task
behavioral24
Sample
3e3f980ab668ccde6aafee60ce16e3c35cd91e9b59bff20ce1615d5fb362a458_Dumped_TDS=4FBA3695.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral25
Sample
3e3f980ab668ccde6aafee60ce16e3c35cd91e9b59bff20ce1615d5fb362a458_TDS=4FBADA26.exe
Resource
win7-20241010-en
Behavioral task
behavioral26
Sample
3e3f980ab668ccde6aafee60ce16e3c35cd91e9b59bff20ce1615d5fb362a458_TDS=4FBADA26.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral27
Sample
3e75e8238a6bbd8817164658696198af_72889f61171de37d6b4d59016c55ec52__2.exe
Resource
win7-20240903-en
Behavioral task
behavioral28
Sample
3e75e8238a6bbd8817164658696198af_72889f61171de37d6b4d59016c55ec52__2.exe
Resource
win10v2004-20250313-en
Behavioral task
behavioral29
Sample
400cad56ff3d210346cf6c4795aeb607e5b211b3dc4a8421b9437621c254239a.exe
Resource
win7-20240729-en
Behavioral task
behavioral30
Sample
400cad56ff3d210346cf6c4795aeb607e5b211b3dc4a8421b9437621c254239a.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral31
Sample
40b3cb2a210fafdaabdebefe1430862bd1192a80fcde84f51ceb387136d1410c.exe
Resource
win7-20241010-en
Behavioral task
behavioral32
Sample
40b3cb2a210fafdaabdebefe1430862bd1192a80fcde84f51ceb387136d1410c.exe
Resource
win10v2004-20250314-en
General
-
Target
34818CE171EA150B91429AC1DD6FBE49.dll
-
Size
170KB
-
MD5
34818ce171ea150b91429ac1dd6fbe49
-
SHA1
765f7cea9ae6e126181e5a78b897304913530d4d
-
SHA256
502386cb2288ce85af522da55916b5a05c71d9a32a80cec396bc4cdd0e0ac665
-
SHA512
e44b009eef9710787ddf63d5038e15112969ef5ac952520f772b5ab78dfe57c42f7562044642f573c9480c76569ef9a7912cc5cd1b0472e4d61c25e79a03bfb0
-
SSDEEP
3072:xUiScf7Taa44mVg6zMe4sfPZfE8dreM9aSW3OKojVbc7n4CRWLvSFlp6+qvv1:xUUm4mG6zwQLaM9aKjRg0SLlK1
Malware Config
Signatures
-
Disables Task Manager via registry modification
-
Drops file in Program Files directory 5 IoCs
description ioc Process File created C:\PROGRA~3\RUNDLL32.EXE-x.txt rundll32.exe File opened for modification C:\PROGRA~3\RUNDLL32.EXE-x.txt rundll32.exe File created C:\PROGRA~3\NOTEPAD.EXE-x.txt notepad.exe File opened for modification C:\PROGRA~3\NOTEPAD.EXE-x.txt notepad.exe File opened for modification C:\PROGRA~3\NOTEPAD.EXE-x.txt notepad.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language notepad.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ielowutil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language notepad.exe -
Modifies Internet Explorer Protected Mode 1 TTPs 15 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\2500 = "3" notepad.exe Set value (int) \REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2500 = "3" notepad.exe Set value (int) \REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\2500 = "3" rundll32.exe Set value (int) \REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2500 = "3" rundll32.exe Set value (int) \REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\2500 = "3" notepad.exe Set value (int) \REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\2500 = "3" notepad.exe Set value (int) \REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\2500 = "3" notepad.exe Set value (int) \REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\2500 = "3" notepad.exe Set value (int) \REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\2500 = "3" notepad.exe Set value (int) \REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\2500 = "3" rundll32.exe Set value (int) \REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\2500 = "3" rundll32.exe Set value (int) \REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\2500 = "3" rundll32.exe Set value (int) \REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\2500 = "3" notepad.exe Set value (int) \REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2500 = "3" notepad.exe Set value (int) \REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\2500 = "3" notepad.exe -
Modifies Internet Explorer Protected Mode Banner 1 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\SOFTWARE\Microsoft\Internet Explorer\Main\NoProtectedModeBanner = "1" notepad.exe Set value (int) \REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\SOFTWARE\Microsoft\Internet Explorer\Main\NoProtectedModeBanner = "1" rundll32.exe Set value (int) \REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\SOFTWARE\Microsoft\Internet Explorer\Main\NoProtectedModeBanner = "1" notepad.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\Software\Microsoft\Internet Explorer\Toolbar explorer.exe Key created \REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\Software\Microsoft\Internet Explorer\Main notepad.exe Set value (data) \REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b4ec966183fcbc45999aac05eefc7ee7000000000200000000001066000000010000200000009a49142a3d417efa77a66aa92c0d833209986224ab9112efa4212c71cc959f4d000000000e8000000002000020000000b912532450a30cf4e25f43e45a8b43bbde36997b5197d34f659b690a977e233520000000d3aa08fb2b2de3b8684a43efcc6fda3c71f62a2362b74250f42aaaa89d62b62d40000000e96127dc81ad5109c19b855d8e12b9f8b77397c2d4e402931eb8d1f7206425a6316699f98fa642cc068d2fb9549a236d4b70d50157b95ba3171123a9b6c50966 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "449945733" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b4ec966183fcbc45999aac05eefc7ee700000000020000000000106600000001000020000000ce39d1b3f6ebee54a900f8dc776138c36d516ea8f01e0666029c6a3e0264efd4000000000e8000000002000020000000b2bb8a9e0cfabd36e486d2686e46cecc458d2b73e0490625f75739d29b5df59f2000000050d187ebfdb10cb9b56bf0f4524d47571b4cce3857e5414eece278a1b47bec1b40000000cc3cdfaab478202de54deb5711ecc44e7dfd254b75020249299a4fe8f09af2d3957079c80069fd60c435dde6fc3e360e042aa67ae92d6ac2312d9ee78bacac91 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{0E5E9548-0BF5-11F0-AF5D-42A920109295} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\Software\Microsoft\Internet Explorer\Main rundll32.exe Set value (int) \REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1" explorer.exe Key created \REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\Software\Microsoft\Internet Explorer\Main notepad.exe Set value (int) \REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70a017ea01a0db01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 explorer.exe Key created \REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 605b1cea01a0db01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe -
Modifies registry class 8 IoCs
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 1936 explorer.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5600 rundll32.exe 5600 rundll32.exe 2532 notepad.exe 2532 notepad.exe 2532 notepad.exe 2532 notepad.exe 2532 notepad.exe 2532 notepad.exe 2532 notepad.exe 2532 notepad.exe 2532 notepad.exe 2532 notepad.exe 2532 notepad.exe 2532 notepad.exe 2532 notepad.exe 2532 notepad.exe 2532 notepad.exe 2532 notepad.exe 2532 notepad.exe 2532 notepad.exe 2532 notepad.exe 2532 notepad.exe 2532 notepad.exe 2532 notepad.exe 2532 notepad.exe 2532 notepad.exe 2656 notepad.exe 2656 notepad.exe 2532 notepad.exe 2532 notepad.exe 2532 notepad.exe 2532 notepad.exe 2532 notepad.exe 2532 notepad.exe 2532 notepad.exe 2532 notepad.exe 2532 notepad.exe 2532 notepad.exe 2532 notepad.exe 2532 notepad.exe 2532 notepad.exe 2532 notepad.exe 2532 notepad.exe 2532 notepad.exe 2532 notepad.exe 2532 notepad.exe 2532 notepad.exe 2532 notepad.exe 2532 notepad.exe 2532 notepad.exe 2532 notepad.exe 2532 notepad.exe 2532 notepad.exe 2532 notepad.exe 2532 notepad.exe 2532 notepad.exe 2532 notepad.exe 2532 notepad.exe 2532 notepad.exe 2532 notepad.exe 2532 notepad.exe 2532 notepad.exe 2532 notepad.exe 2532 notepad.exe -
Suspicious use of FindShellTrayWindow 10 IoCs
pid Process 4828 iexplore.exe 4828 iexplore.exe 4828 iexplore.exe 4828 iexplore.exe 4828 iexplore.exe 4828 iexplore.exe 4828 iexplore.exe 4828 iexplore.exe 4828 iexplore.exe 4828 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1936 explorer.exe 1936 explorer.exe 4828 iexplore.exe 4828 iexplore.exe 2240 IEXPLORE.EXE 2240 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 5784 wrote to memory of 5600 5784 rundll32.exe 86 PID 5784 wrote to memory of 5600 5784 rundll32.exe 86 PID 5784 wrote to memory of 5600 5784 rundll32.exe 86 PID 5600 wrote to memory of 2540 5600 rundll32.exe 88 PID 5600 wrote to memory of 2540 5600 rundll32.exe 88 PID 5600 wrote to memory of 2540 5600 rundll32.exe 88 PID 5600 wrote to memory of 2532 5600 rundll32.exe 89 PID 5600 wrote to memory of 2532 5600 rundll32.exe 89 PID 5600 wrote to memory of 2532 5600 rundll32.exe 89 PID 5600 wrote to memory of 2532 5600 rundll32.exe 89 PID 4828 wrote to memory of 2240 4828 iexplore.exe 97 PID 4828 wrote to memory of 2240 4828 iexplore.exe 97 PID 4828 wrote to memory of 2240 4828 iexplore.exe 97 PID 5600 wrote to memory of 2656 5600 rundll32.exe 103 PID 5600 wrote to memory of 2656 5600 rundll32.exe 103 PID 5600 wrote to memory of 2656 5600 rundll32.exe 103 PID 5600 wrote to memory of 2656 5600 rundll32.exe 103
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\34818CE171EA150B91429AC1DD6FBE49.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:5784 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\34818CE171EA150B91429AC1DD6FBE49.dll,#12⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer Protected Mode
- Modifies Internet Explorer Protected Mode Banner
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5600 -
C:\Windows\SysWOW64\explorer.exeexplorer.exe3⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2540
-
-
C:\Windows\SysWOW64\notepad.exenotepad.exe3⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer Protected Mode
- Modifies Internet Explorer Protected Mode Banner
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
PID:2532
-
-
C:\Windows\SysWOW64\notepad.exenotepad.exe3⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer Protected Mode
- Modifies Internet Explorer Protected Mode Banner
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
PID:2656
-
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{682159d9-c321-47ca-b3f1-30e36b2ec8b9} -Embedding1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1936
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {3eef301f-b596-4c0b-bd92-013beafce793} -Embedding1⤵PID:816
-
C:\Program Files (x86)\Internet Explorer\ielowutil.exe"C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding1⤵
- System Location Discovery: System Language Discovery
PID:4908
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4828 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4828 CREDAT:17410 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2240
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
545B
MD50695154188ba91a6820b3c441cf02660
SHA1f2a753d5fc6e45f79dc05b5fd7cc1b6434970f73
SHA25689a08f3a266908ded995a83b507d7648cd90480a7eac1e603390be10dbe5348b
SHA5123c3583351a98a1e9f4fc3d0bfcb54f6d0a86191dabc4513079d64ca60cd3ccbacd60043692ca37579c6d5d81c565525974d0b688704fb2e51a2f4917067f0453
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_363582827213C09529A76F35FB615187
Filesize471B
MD50c5ef9158dcdd3b41a7e84c5e760b59d
SHA19cb930588b30e4399d0fbf73a559b2d89373a6a9
SHA25695c2b916d5668f7823fc9222d4cac008570c4f1866a3ef2b4175cb1ea5bbd9d9
SHA51213cf19b192d4b6365ab09e13b5ffc6c26470ff51527d8e49fad7aa410df5a7bc6557e731d5b49fa7c19cd9b677764422d2f57c10d2578cdfdf91cd1120db9c4e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_363582827213C09529A76F35FB615187
Filesize412B
MD50996ac5d423664522a606aeffd4483b5
SHA16e404f1b090f716690d39689248bbd5717ef6694
SHA256f103af44f3370c9376e2f5284cfd6748b1e9a626af683ea4247967467aecdd46
SHA51276089e4ea299048ab4c6a4182e3d06de3ac4bed9132727d914c3c9f923660295cd34806dd7242ea4ab68fc3cfc99666869f0db400cee207a872b8e122be51009
-
Filesize
17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee