Analysis
- max time kernel
150s - max time network
134s - platform
windows11-21h2_x64 - resource
win11-20251231-en - resource tags
arch:x64arch:x86image:win11-20251231-enlocale:en-usos:windows11-21h2-x64system - submitted
06/01/2026, 09:14
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
file.exe
Resource
win10v2004-20251231-en
windows10-2004-x64
36 signatures
150 seconds
Behavioral task
behavioral2
Sample
file.exe
Resource
win11-20251231-en
windows11-21h2-x64
33 signatures
150 seconds
General
- Target file.exe
- Size 269KB
- Sample260106-k7mxrayqat
- SHA256 fe33c0f159c8d2f37c694215f63a95f55b498da024863b87f7f5601e0c6c42b9
- MD5 91763fd6a0da2fb89df38b3ed2ee1f69
- SHA1 342376bf7b63e62ba57c69df68b1cf0e5ececa27
- SHA512 a3cf8b812e667e0d92dce886ba2c3347897fdfd76bf04efb9aab8b7648192437a344953407d263f8f0276739447a2f0c09bec4f385194fd65fb00d3fdcbc2c86
- SSDEEP 6144:CZVkCIQMIQzzQ25XqH+ADmHbXJpxaEK+CS:CPkCIxIQz1qiLjkS
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
stealc
Botnet
-
crypt
C2
-
http://196.251.107.23
Attributes
-
url_path
/7ffc7a279c17c091.php
rc4.plain
rc4.plain
Signatures
- Detects SvcStealer Payload 1 IoCs
SvcStealer aka Diamotrix Clipper is a stealer/downloader written in C++.
resource yara_rule behavioral2/files/0x001a00000002b349-82.dat family_svcstealer - Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1879222327-309181551-1066679662-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" file.exe - Stealc family
- SvcStealer, Diamotrix
SvcStealer aka Diamotrix Clipper is a stealer/downloader written in C++.
- Svcstealer family
- Downloads MZ/PE file 7 IoCs
flow pid Process 1 2640 file.exe 1 2640 file.exe 1 2640 file.exe 1 2640 file.exe 1 2640 file.exe 1 2640 file.exe 9 2992 helpPane.exe - Executes dropped EXE 19 IoCs
pid Process 960 1_240626109.exe 1756 2_240627421.exe 32 2_240627421.tmp 1564 2_240627421.exe 3648 2_240627421.tmp 1324 3_240629984.exe 2708 FnHotkeyUtility.exe 4736 4_240632781.exe 1216 5_240636281.exe 3776 6_240637234.exe 2976 9CD108CD2DC08600.exe 2428 9CD108CD2DC08600.exe 5108 qw6jHZkFPpf8.exe 3628 qw6jHZkFPpf8.tmp 2128 0T4ENoE6zuNZ.exe 1780 gjFypOuao9Q5.exe 4836 FnHotkeyUtility.exe 3068 9CD108CD2DC08600.exe 3252 FnHotkeyUtility.exe - Loads dropped DLL 22 IoCs
pid Process 32 2_240627421.tmp 32 2_240627421.tmp 3648 2_240627421.tmp 3648 2_240627421.tmp 2708 FnHotkeyUtility.exe 2708 FnHotkeyUtility.exe 2708 FnHotkeyUtility.exe 2708 FnHotkeyUtility.exe 2708 FnHotkeyUtility.exe 2708 FnHotkeyUtility.exe 3628 qw6jHZkFPpf8.tmp 3628 qw6jHZkFPpf8.tmp 4836 FnHotkeyUtility.exe 4836 FnHotkeyUtility.exe 4836 FnHotkeyUtility.exe 4836 FnHotkeyUtility.exe 4836 FnHotkeyUtility.exe 3252 FnHotkeyUtility.exe 3252 FnHotkeyUtility.exe 3252 FnHotkeyUtility.exe 3252 FnHotkeyUtility.exe 3252 FnHotkeyUtility.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Enumerates connected drives 3 TTPs 44 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\G: 4_240632781.exe File opened (read-only) \??\W: 4_240632781.exe File opened (read-only) \??\B: file.exe File opened (read-only) \??\N: file.exe File opened (read-only) \??\O: 4_240632781.exe File opened (read-only) \??\V: 4_240632781.exe File opened (read-only) \??\Y: file.exe File opened (read-only) \??\J: file.exe File opened (read-only) \??\L: 4_240632781.exe File opened (read-only) \??\P: 4_240632781.exe File opened (read-only) \??\Z: 4_240632781.exe File opened (read-only) \??\E: file.exe File opened (read-only) \??\M: file.exe File opened (read-only) \??\S: file.exe File opened (read-only) \??\U: file.exe File opened (read-only) \??\J: 4_240632781.exe File opened (read-only) \??\K: 4_240632781.exe File opened (read-only) \??\Q: 4_240632781.exe File opened (read-only) \??\X: 4_240632781.exe File opened (read-only) \??\Y: 4_240632781.exe File opened (read-only) \??\H: file.exe File opened (read-only) \??\I: file.exe File opened (read-only) \??\L: file.exe File opened (read-only) \??\S: 4_240632781.exe File opened (read-only) \??\R: 4_240632781.exe File opened (read-only) \??\O: file.exe File opened (read-only) \??\Q: file.exe File opened (read-only) \??\T: file.exe File opened (read-only) \??\W: file.exe File opened (read-only) \??\Z: file.exe File opened (read-only) \??\T: 4_240632781.exe File opened (read-only) \??\A: file.exe File opened (read-only) \??\G: file.exe File opened (read-only) \??\K: file.exe File opened (read-only) \??\R: file.exe File opened (read-only) \??\X: file.exe File opened (read-only) \??\E: 4_240632781.exe File opened (read-only) \??\H: 4_240632781.exe File opened (read-only) \??\I: 4_240632781.exe File opened (read-only) \??\N: 4_240632781.exe File opened (read-only) \??\U: 4_240632781.exe File opened (read-only) \??\P: file.exe File opened (read-only) \??\M: 4_240632781.exe File opened (read-only) \??\V: file.exe - Drops autorun.inf file 1 TTPs 1 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File created F:\autorun.inf file.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\System32\symbols\dll\vcruntime140_clr0400.amd64.pdb FnHotkeyUtility.exe File opened for modification C:\Windows\System32\symbols\dll\mscoreei.pdb FnHotkeyUtility.exe File opened for modification C:\Windows\System32\symbols\dll\oleaut32.pdb FnHotkeyUtility.exe File opened for modification C:\Windows\System32\crypt32.pdb FnHotkeyUtility.exe File opened for modification C:\Windows\System32\dll\kernelbase.pdb FnHotkeyUtility.exe File opened for modification C:\Windows\System32\symbols\DLL\hid.pdb FnHotkeyUtility.exe File opened for modification C:\Windows\System32\symbols\dll\combase.pdb FnHotkeyUtility.exe File opened for modification C:\Windows\System32\dll\win32u.pdb FnHotkeyUtility.exe File opened for modification C:\Windows\System32\symbols\dll\shell32.pdb FnHotkeyUtility.exe File opened for modification C:\Windows\System32\msasn1.pdb FnHotkeyUtility.exe File opened for modification C:\Windows\System32\dll\shlwapi.pdb FnHotkeyUtility.exe File opened for modification C:\Windows\System32\dll\ucrtbase_clr0400.amd64.pdb FnHotkeyUtility.exe File opened for modification C:\Windows\System32\symbols\dll\psapi.pdb FnHotkeyUtility.exe File opened for modification C:\Windows\System32\symbols\dll\gdi32.pdb FnHotkeyUtility.exe File opened for modification C:\Windows\System32\symbols\dll\sechost.pdb FnHotkeyUtility.exe File opened for modification C:\Windows\System32\dll\vcruntime140_1.amd64.spectre.pdb FnHotkeyUtility.exe File opened for modification C:\Windows\System32\symbols\dll\vcruntime140.amd64.pdb FnHotkeyUtility.exe File opened for modification C:\Windows\System32\clrjit.pdb FnHotkeyUtility.exe File opened for modification C:\Windows\System32\clrjit.pdb FnHotkeyUtility.exe File opened for modification C:\Windows\System32\ntdll.pdb FnHotkeyUtility.exe File opened for modification C:\Windows\System32\oleaut32.pdb FnHotkeyUtility.exe File opened for modification C:\Windows\System32\dll\UMPDC.pdb FnHotkeyUtility.exe File opened for modification C:\Windows\System32\symbols\dll\gdi32full.pdb FnHotkeyUtility.exe File opened for modification C:\Windows\System32\psapi.pdb FnHotkeyUtility.exe File opened for modification C:\Windows\System32\wtsapi32.pdb FnHotkeyUtility.exe File opened for modification C:\Windows\System32\hid.pdb FnHotkeyUtility.exe File opened for modification C:\Windows\System32\dll\mscoreei.pdb FnHotkeyUtility.exe File opened for modification C:\Windows\System32\sechost.pdb FnHotkeyUtility.exe File opened for modification C:\Windows\System32\powrprof.pdb FnHotkeyUtility.exe File opened for modification C:\Windows\System32\symbols\dll\vcruntime140_1.amd64.spectre.pdb FnHotkeyUtility.exe File opened for modification C:\Windows\System32\dll\mscorlib.ni.pdb FnHotkeyUtility.exe File opened for modification C:\Windows\System32\symbols\dll\kernelbase.pdb FnHotkeyUtility.exe File opened for modification C:\Windows\System32\symbols\dll\clr.pdb FnHotkeyUtility.exe File opened for modification C:\Windows\System32\dll\vcruntime140_clr0400.amd64.pdb FnHotkeyUtility.exe File opened for modification C:\Windows\System32\mscoree.pdb FnHotkeyUtility.exe File opened for modification C:\Windows\System32\sechost.pdb FnHotkeyUtility.exe File opened for modification C:\Windows\System32\dll\combase.pdb FnHotkeyUtility.exe File opened for modification C:\Windows\System32\oleaut32.pdb FnHotkeyUtility.exe File opened for modification C:\Windows\System32\dll\msvcp140.amd64.pdb FnHotkeyUtility.exe File opened for modification C:\Windows\System32\DLL\hid.pdb FnHotkeyUtility.exe File opened for modification C:\Windows\System32\symbols\dll\SensApi.pdb FnHotkeyUtility.exe File opened for modification C:\Windows\System32\gdi32.pdb FnHotkeyUtility.exe File opened for modification C:\Windows\System32\dll\setupapi.pdb FnHotkeyUtility.exe File opened for modification C:\Windows\System32\dll\ludp.pdb FnHotkeyUtility.exe File opened for modification C:\Windows\System32\symbols\dll\advapi32.pdb FnHotkeyUtility.exe File opened for modification C:\Windows\System32\msvcrt.pdb FnHotkeyUtility.exe File opened for modification C:\Windows\System32\symbols\dll\shlwapi.pdb FnHotkeyUtility.exe File opened for modification C:\Windows\System32\dll\psapi.pdb FnHotkeyUtility.exe File opened for modification C:\Windows\System32\iphlpapi.pdb FnHotkeyUtility.exe File opened for modification C:\Windows\System32\ucrtbase_clr0400.amd64.pdb FnHotkeyUtility.exe File opened for modification C:\Windows\System32\symbols\dll\userenv.pdb FnHotkeyUtility.exe File opened for modification C:\Windows\System32\DLL\imm32.pdb FnHotkeyUtility.exe File opened for modification C:\Windows\System32\symbols\dll\ucrtbase_clr0400.amd64.pdb FnHotkeyUtility.exe File opened for modification C:\Windows\System32\dll\win32u.pdb FnHotkeyUtility.exe File opened for modification C:\Windows\System32\dll\shell32.pdb FnHotkeyUtility.exe File opened for modification C:\Windows\System32\dll\sechost.pdb FnHotkeyUtility.exe File opened for modification C:\Windows\System32\symbols\dll\wintrust.pdb FnHotkeyUtility.exe File opened for modification C:\Windows\System32\dll\spkvol.pdb FnHotkeyUtility.exe File opened for modification C:\Windows\System32\dll\ntdll.pdb FnHotkeyUtility.exe File opened for modification C:\Windows\System32\symbols\dll\advapi32.pdb FnHotkeyUtility.exe File opened for modification C:\Windows\System32\vcruntime140.amd64.pdb FnHotkeyUtility.exe File opened for modification C:\Windows\System32\imm32.pdb FnHotkeyUtility.exe File opened for modification C:\Windows\System32\psapi.pdb FnHotkeyUtility.exe File opened for modification C:\Windows\System32\dll\gdi32.pdb FnHotkeyUtility.exe - Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 960 set thread context of 2992 960 1_240626109.exe 78 PID 1216 set thread context of 2016 1216 5_240636281.exe 95 -
resource yara_rule behavioral2/files/0x001900000002b380-142.dat upx behavioral2/memory/2708-153-0x00007FFA18760000-0x00007FFA189C6000-memory.dmp upx behavioral2/memory/2708-230-0x00007FFA18760000-0x00007FFA189C6000-memory.dmp upx behavioral2/memory/2708-310-0x00007FFA18760000-0x00007FFA189C6000-memory.dmp upx behavioral2/memory/2708-313-0x00007FFA18760000-0x00007FFA189C6000-memory.dmp upx behavioral2/memory/2708-315-0x00007FFA18760000-0x00007FFA189C6000-memory.dmp upx behavioral2/memory/4836-448-0x00007FFA18990000-0x00007FFA18BF6000-memory.dmp upx behavioral2/memory/4836-457-0x00007FFA18990000-0x00007FFA18BF6000-memory.dmp upx behavioral2/memory/4836-491-0x00007FFA18990000-0x00007FFA18BF6000-memory.dmp upx behavioral2/memory/3252-508-0x00007FFA18990000-0x00007FFA18BF6000-memory.dmp upx - Drops file in Windows directory 42 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\web.config 4_240632781.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\CONFIG\web.config 4_240632781.exe File created C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\cache\Desktop\27.txt 4_240632781.exe File created C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\cache\Local\Desktop\2.html 4_240632781.exe File created C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\cache\Local\Desktop\3.html 4_240632781.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..e.desktop.searchapp_31bf3856ad364e35_10.0.22000.1_none_e4512f709bf99514\25.txt 4_240632781.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-userexperience-desktop_31bf3856ad364e35_10.0.22000.318_none_82292a5c4e657627\Cortana.UI\cache\Local\Desktop\2.html 4_240632781.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-userexperience-desktop_31bf3856ad364e35_10.0.22000.493_none_81cdab704eaad423\data\prod\navigation.json 4_240632781.exe File opened for modification C:\Windows\Logs\CBS\CbsPersist_20251231212936.log 4_240632781.exe File created C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\cache\Desktop\1.txt 4_240632781.exe File created C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\cache\Desktop\23.txt 4_240632781.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.22000.176_none_fded9bd0d2f09976\navigation.json 4_240632781.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..e.desktop.searchapp_31bf3856ad364e35_10.0.22000.1_none_e4512f709bf99514\1.txt 4_240632781.exe File created C:\Windows\WinSxS\amd64_multipoint-wmsmanager_31bf3856ad364e35_10.0.22000.1_none_72526c5b8ceef21d\Logging.config 4_240632781.exe File created C:\Windows\WinSxS\amd64_netfx-aspnet_web_config_b03f5f7f11d50a3a_10.0.22000.1_none_f3353133c8031245\web.config 4_240632781.exe File created C:\Windows\WinSxS\x86_netfx-aspnet_web_config_b03f5f7f11d50a3a_10.0.22000.1_none_3ae2680adc7f3b4b\web.config 4_240632781.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..e.desktop.searchapp_31bf3856ad364e35_10.0.22000.1_none_e4512f709bf99514\22.txt 4_240632781.exe File created C:\Windows\DiagTrack\Settings\utc.app.json 4_240632781.exe File created C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\cache\Desktop\28.txt 4_240632781.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.22000.469_none_fdfb724cd2e5c0ff\navigation.json 4_240632781.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..e.desktop.searchapp_31bf3856ad364e35_10.0.22000.1_none_e4512f709bf99514\27.txt 4_240632781.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..l.desktop.searchapp_31bf3856ad364e35_10.0.22000.1_none_d7fb8c7bd4b1b9b1\2.html 4_240632781.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-userexperience-desktop_31bf3856ad364e35_10.0.22000.318_none_82292a5c4e657627\Cortana.UI\cache\SVLocal\Desktop\2.html 4_240632781.exe File opened for modification C:\Windows\Logs\CBS\CBS.log 4_240632781.exe File opened for modification C:\Windows\Panther\setupact.log 4_240632781.exe File created C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Cortana.UI\cache\Local\Desktop\2.html 4_240632781.exe File created C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\data\prod\navigation.json 4_240632781.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..e.desktop.searchapp_31bf3856ad364e35_10.0.22000.1_none_e4512f709bf99514\28.txt 4_240632781.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..l.desktop.searchapp_31bf3856ad364e35_10.0.22000.1_none_d7fb8c7bd4b1b9b1\3.html 4_240632781.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..e.desktop.searchapp_31bf3856ad364e35_10.0.22000.1_none_e4512f709bf99514\23.txt 4_240632781.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\Config\web.config 4_240632781.exe File created C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\cache\Desktop\2.txt 4_240632781.exe File created C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Cortana.UI\cache\SVLocal\Desktop\2.html 4_240632781.exe File created C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\data\prod\navigation.json 4_240632781.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..e.desktop.searchapp_31bf3856ad364e35_10.0.22000.1_none_e4512f709bf99514\2.txt 4_240632781.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-userexperience-desktop_31bf3856ad364e35_10.0.22000.493_none_81cdab704eaad423\Cortana.UI\cache\Local\Desktop\2.html 4_240632781.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-userexperience-desktop_31bf3856ad364e35_10.0.22000.493_none_81cdab704eaad423\Cortana.UI\cache\SVLocal\Desktop\2.html 4_240632781.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\web.config 4_240632781.exe File created C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\cache\Desktop\22.txt 4_240632781.exe File created C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\cache\Desktop\25.txt 4_240632781.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..tings-windowsclient_31bf3856ad364e35_10.0.22000.1_none_d08f2366c88c9e59\utc.app.json 4_240632781.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-userexperience-desktop_31bf3856ad364e35_10.0.22000.318_none_82292a5c4e657627\data\prod\navigation.json 4_240632781.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 14 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language qw6jHZkFPpf8.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language qw6jHZkFPpf8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language file.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2_240627421.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4_240632781.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2_240627421.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2_240627421.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2_240627421.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5_240636281.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6_240637234.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9CD108CD2DC08600.exe - Inno Setup is an open-source installation builder for Windows applications. 6 IoCs
Inno Setup installer
resource yara_rule behavioral2/files/0x001d00000002b262-41.dat innosetup behavioral2/memory/1756-51-0x00000000006B0000-0x0000000000799000-memory.dmp innosetup behavioral2/memory/1564-65-0x00000000006B0000-0x0000000000799000-memory.dmp innosetup behavioral2/memory/1756-68-0x00000000006B0000-0x0000000000799000-memory.dmp innosetup behavioral2/memory/1564-155-0x00000000006B0000-0x0000000000799000-memory.dmp innosetup behavioral2/memory/5108-339-0x0000000000E10000-0x0000000000EF9000-memory.dmp innosetup - Checks SCSI registry key(s) 3 TTPs 18 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 FnHotkeyUtility.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 FnHotkeyUtility.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs FnHotkeyUtility.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 FnHotkeyUtility.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID FnHotkeyUtility.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID FnHotkeyUtility.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID FnHotkeyUtility.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs FnHotkeyUtility.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 FnHotkeyUtility.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs FnHotkeyUtility.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 FnHotkeyUtility.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID FnHotkeyUtility.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs FnHotkeyUtility.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs FnHotkeyUtility.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID FnHotkeyUtility.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID FnHotkeyUtility.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs FnHotkeyUtility.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 FnHotkeyUtility.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 helpPane.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString helpPane.exe - Delays execution with timeout.exe 1 IoCs
pid Process 2272 timeout.exe - Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-1879222327-309181551-1066679662-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ Explorer.EXE - Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 904 schtasks.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2992 helpPane.exe 2992 helpPane.exe 32 2_240627421.tmp 32 2_240627421.tmp 3648 2_240627421.tmp 3648 2_240627421.tmp 1324 3_240629984.exe 1324 3_240629984.exe 1324 3_240629984.exe 1324 3_240629984.exe 1324 3_240629984.exe 1324 3_240629984.exe 1324 3_240629984.exe 1324 3_240629984.exe 1324 3_240629984.exe 1324 3_240629984.exe 1324 3_240629984.exe 1324 3_240629984.exe 1324 3_240629984.exe 1324 3_240629984.exe 1324 3_240629984.exe 1324 3_240629984.exe 1324 3_240629984.exe 1324 3_240629984.exe 3648 2_240627421.tmp 3648 2_240627421.tmp 1324 3_240629984.exe 1324 3_240629984.exe 1324 3_240629984.exe 1324 3_240629984.exe 1324 3_240629984.exe 1324 3_240629984.exe 1324 3_240629984.exe 1324 3_240629984.exe 1324 3_240629984.exe 1324 3_240629984.exe 1324 3_240629984.exe 1324 3_240629984.exe 1324 3_240629984.exe 1324 3_240629984.exe 1324 3_240629984.exe 1324 3_240629984.exe 1324 3_240629984.exe 1324 3_240629984.exe 1324 3_240629984.exe 1324 3_240629984.exe 1324 3_240629984.exe 1324 3_240629984.exe 1324 3_240629984.exe 1324 3_240629984.exe 1324 3_240629984.exe 1324 3_240629984.exe 1324 3_240629984.exe 1324 3_240629984.exe 1324 3_240629984.exe 1324 3_240629984.exe 1324 3_240629984.exe 1324 3_240629984.exe 1324 3_240629984.exe 1324 3_240629984.exe 1324 3_240629984.exe 1324 3_240629984.exe 1324 3_240629984.exe 1324 3_240629984.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3084 Explorer.EXE - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3084 Explorer.EXE Token: SeCreatePagefilePrivilege 3084 Explorer.EXE Token: SeShutdownPrivilege 3084 Explorer.EXE Token: SeCreatePagefilePrivilege 3084 Explorer.EXE Token: SeShutdownPrivilege 3084 Explorer.EXE Token: SeCreatePagefilePrivilege 3084 Explorer.EXE Token: SeIncreaseQuotaPrivilege 1216 5_240636281.exe Token: SeSecurityPrivilege 1216 5_240636281.exe Token: SeTakeOwnershipPrivilege 1216 5_240636281.exe Token: SeLoadDriverPrivilege 1216 5_240636281.exe Token: SeSystemProfilePrivilege 1216 5_240636281.exe Token: SeSystemtimePrivilege 1216 5_240636281.exe Token: SeProfSingleProcessPrivilege 1216 5_240636281.exe Token: SeIncBasePriorityPrivilege 1216 5_240636281.exe Token: SeCreatePagefilePrivilege 1216 5_240636281.exe Token: SeBackupPrivilege 1216 5_240636281.exe Token: SeRestorePrivilege 1216 5_240636281.exe Token: SeShutdownPrivilege 1216 5_240636281.exe Token: SeDebugPrivilege 1216 5_240636281.exe Token: SeSystemEnvironmentPrivilege 1216 5_240636281.exe Token: SeRemoteShutdownPrivilege 1216 5_240636281.exe Token: SeUndockPrivilege 1216 5_240636281.exe Token: SeManageVolumePrivilege 1216 5_240636281.exe Token: 33 1216 5_240636281.exe Token: 34 1216 5_240636281.exe Token: 35 1216 5_240636281.exe Token: 36 1216 5_240636281.exe Token: SeShutdownPrivilege 3084 Explorer.EXE Token: SeCreatePagefilePrivilege 3084 Explorer.EXE Token: SeShutdownPrivilege 3084 Explorer.EXE Token: SeCreatePagefilePrivilege 3084 Explorer.EXE Token: SeShutdownPrivilege 3084 Explorer.EXE Token: SeCreatePagefilePrivilege 3084 Explorer.EXE Token: SeShutdownPrivilege 3084 Explorer.EXE Token: SeCreatePagefilePrivilege 3084 Explorer.EXE Token: SeShutdownPrivilege 3084 Explorer.EXE Token: SeCreatePagefilePrivilege 3084 Explorer.EXE Token: SeShutdownPrivilege 3084 Explorer.EXE Token: SeCreatePagefilePrivilege 3084 Explorer.EXE Token: SeShutdownPrivilege 3084 Explorer.EXE Token: SeCreatePagefilePrivilege 3084 Explorer.EXE Token: SeShutdownPrivilege 3084 Explorer.EXE Token: SeCreatePagefilePrivilege 3084 Explorer.EXE Token: SeShutdownPrivilege 3084 Explorer.EXE Token: SeCreatePagefilePrivilege 3084 Explorer.EXE Token: SeShutdownPrivilege 3084 Explorer.EXE Token: SeCreatePagefilePrivilege 3084 Explorer.EXE Token: SeShutdownPrivilege 3084 Explorer.EXE Token: SeCreatePagefilePrivilege 3084 Explorer.EXE Token: SeShutdownPrivilege 3084 Explorer.EXE Token: SeCreatePagefilePrivilege 3084 Explorer.EXE Token: SeShutdownPrivilege 3084 Explorer.EXE Token: SeCreatePagefilePrivilege 3084 Explorer.EXE Token: SeShutdownPrivilege 3084 Explorer.EXE Token: SeCreatePagefilePrivilege 3084 Explorer.EXE Token: SeShutdownPrivilege 3084 Explorer.EXE Token: SeCreatePagefilePrivilege 3084 Explorer.EXE Token: SeShutdownPrivilege 3084 Explorer.EXE Token: SeCreatePagefilePrivilege 3084 Explorer.EXE Token: SeShutdownPrivilege 3084 Explorer.EXE Token: SeCreatePagefilePrivilege 3084 Explorer.EXE Token: SeShutdownPrivilege 3084 Explorer.EXE Token: SeCreatePagefilePrivilege 3084 Explorer.EXE Token: SeShutdownPrivilege 3084 Explorer.EXE - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3648 2_240627421.tmp - Suspicious use of UnmapMainImage 1 IoCs
pid Process 3084 Explorer.EXE - Suspicious use of WriteProcessMemory 39 IoCs
description pid Process procid_target PID 2640 wrote to memory of 960 2640 file.exe 77 PID 960 wrote to memory of 2992 960 1_240626109.exe 78 PID 960 wrote to memory of 2992 960 1_240626109.exe 78 PID 960 wrote to memory of 2992 960 1_240626109.exe 78 PID 960 wrote to memory of 2992 960 1_240626109.exe 78 PID 960 wrote to memory of 2992 960 1_240626109.exe 78 PID 960 wrote to memory of 2992 960 1_240626109.exe 78 PID 960 wrote to memory of 2992 960 1_240626109.exe 78 PID 960 wrote to memory of 2992 960 1_240626109.exe 78 PID 2992 wrote to memory of 3056 2992 helpPane.exe 79 PID 2992 wrote to memory of 3056 2992 helpPane.exe 79 PID 2640 wrote to memory of 1756 2640 file.exe 81 PID 1756 wrote to memory of 32 1756 2_240627421.exe 82 PID 32 wrote to memory of 1564 32 2_240627421.tmp 83 PID 1564 wrote to memory of 3648 1564 2_240627421.exe 84 PID 2992 wrote to memory of 2344 2992 helpPane.exe 85 PID 2992 wrote to memory of 2344 2992 helpPane.exe 85 PID 2640 wrote to memory of 1324 2640 file.exe 87 PID 3648 wrote to memory of 2708 3648 2_240627421.tmp 89 PID 1324 wrote to memory of 3084 1324 3_240629984.exe 51 PID 1324 wrote to memory of 3084 1324 3_240629984.exe 51 PID 2640 wrote to memory of 4736 2640 file.exe 90 PID 2640 wrote to memory of 1216 2640 file.exe 93 PID 1216 wrote to memory of 904 1216 5_240636281.exe 94 PID 1216 wrote to memory of 2016 1216 5_240636281.exe 95 PID 1216 wrote to memory of 2016 1216 5_240636281.exe 95 PID 3084 wrote to memory of 2676 3084 Explorer.EXE PID 2640 wrote to memory of 3776 2640 file.exe 98 PID 2992 wrote to memory of 4476 2992 helpPane.exe 101 PID 2992 wrote to memory of 4476 2992 helpPane.exe 101 PID 2992 wrote to memory of 5092 2992 helpPane.exe 103 PID 2992 wrote to memory of 5092 2992 helpPane.exe 103 PID 2992 wrote to memory of 5108 2992 helpPane.exe 109 PID 5108 wrote to memory of 3628 5108 qw6jHZkFPpf8.exe 110 PID 2992 wrote to memory of 2128 2992 helpPane.exe 111 PID 3628 wrote to memory of 2272 3628 qw6jHZkFPpf8.tmp 112 PID 2992 wrote to memory of 1780 2992 helpPane.exe 114 PID 2128 wrote to memory of 3084 2128 0T4ENoE6zuNZ.exe 51 PID 2128 wrote to memory of 3084 2128 0T4ENoE6zuNZ.exe 51 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3084 -
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"2⤵
- Modifies visibility of file extensions in Explorer
- Downloads MZ/PE file
- Enumerates connected drives
- Drops autorun.inf file
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\Users\Admin\AppData\Local\Temp\1_240626109.exe"C:\Users\Admin\AppData\Local\Temp\1_240626109.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:960 -
C:\Windows\helpPane.exe"C:\Windows\helpPane.exe"4⤵
- Downloads MZ/PE file
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2992 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"5⤵PID:3056
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"5⤵PID:2344
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"5⤵PID:4476
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"5⤵PID:5092
-
-
C:\Users\Admin\AppData\Local\qw6jHZkFPpf8.exe"C:\Users\Admin\AppData\Local\qw6jHZkFPpf8.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5108 -
C:\Users\Admin\AppData\Local\Temp\is-OVABKS2PZ8.tmp\qw6jHZkFPpf8.tmp"C:\Users\Admin\AppData\Local\Temp\is-OVABKS2PZ8.tmp\qw6jHZkFPpf8.tmp" /SL5="$7026A,3851360,893440,C:\Users\Admin\AppData\Local\qw6jHZkFPpf8.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3628 -
C:\Windows\SysWOW64\timeout.exe"C:\Windows\System32\timeout.exe" /t 120 /nobreak7⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:2272
-
-
-
-
C:\Users\Admin\AppData\Local\0T4ENoE6zuNZ.exe"C:\Users\Admin\AppData\Local\0T4ENoE6zuNZ.exe"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2128
-
-
C:\Users\Admin\AppData\Local\gjFypOuao9Q5.exe"C:\Users\Admin\AppData\Local\gjFypOuao9Q5.exe"5⤵
- Executes dropped EXE
PID:1780
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\2_240627421.exe"C:\Users\Admin\AppData\Local\Temp\2_240627421.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1756 -
C:\Users\Admin\AppData\Local\Temp\is-3IE3L7VQ22.tmp\2_240627421.tmp"C:\Users\Admin\AppData\Local\Temp\is-3IE3L7VQ22.tmp\2_240627421.tmp" /SL5="$8021E,3851360,893440,C:\Users\Admin\AppData\Local\Temp\2_240627421.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:32 -
C:\Users\Admin\AppData\Local\Temp\2_240627421.exe"C:\Users\Admin\AppData\Local\Temp\2_240627421.exe" /VERYSILENT /PASSWORD=11d4712e-0c58-4cfb-a314-ac5f5c2c80985⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1564 -
C:\Users\Admin\AppData\Local\Temp\is-CABS1VFAS0.tmp\2_240627421.tmp"C:\Users\Admin\AppData\Local\Temp\is-CABS1VFAS0.tmp\2_240627421.tmp" /SL5="$9021E,3851360,893440,C:\Users\Admin\AppData\Local\Temp\2_240627421.exe" /VERYSILENT /PASSWORD=11d4712e-0c58-4cfb-a314-ac5f5c2c80986⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3648 -
C:\ProgramData\12f3d840-d52a-413c-9420-9a9bf187ce92\FnHotkeyUtility.exe"C:\ProgramData\12f3d840-d52a-413c-9420-9a9bf187ce92\FnHotkeyUtility.exe" -Embedding7⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
PID:2708
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\3_240629984.exe"C:\Users\Admin\AppData\Local\Temp\3_240629984.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1324
-
-
C:\Users\Admin\AppData\Local\Temp\4_240632781.exe"C:\Users\Admin\AppData\Local\Temp\4_240632781.exe"3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4736
-
-
C:\Users\Admin\AppData\Local\Temp\5_240636281.exe"C:\Users\Admin\AppData\Local\Temp\5_240636281.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1216 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /tn "9CD108CD2DC08600" /tr "C:\Users\Admin\AppData\Roaming\9CD108CD2DC08600\9CD108CD2DC08600.exe"4⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:904
-
-
C:\Windows\SysWOW64\svchost.exe-k netsvcs4⤵
- System Location Discovery: System Language Discovery
PID:2016
-
-
-
C:\Users\Admin\AppData\Local\Temp\6_240637234.exe"C:\Users\Admin\AppData\Local\Temp\6_240637234.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3776
-
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:3180
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵PID:3660
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵PID:2816
-
C:\Users\Admin\AppData\Roaming\9CD108CD2DC08600\9CD108CD2DC08600.exeC:\Users\Admin\AppData\Roaming\9CD108CD2DC08600\9CD108CD2DC08600.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2976
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵PID:5064
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵PID:4304
-
C:\Users\Admin\AppData\Roaming\9CD108CD2DC08600\9CD108CD2DC08600.exeC:\Users\Admin\AppData\Roaming\9CD108CD2DC08600\9CD108CD2DC08600.exe1⤵
- Executes dropped EXE
PID:2428
-
C:\ProgramData\12f3d840-d52a-413c-9420-9a9bf187ce92\FnHotkeyUtility.exeC:\ProgramData\12f3d840-d52a-413c-9420-9a9bf187ce92\FnHotkeyUtility.exe -Embedding1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4836
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵PID:1116
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵PID:1656
-
C:\Users\Admin\AppData\Roaming\9CD108CD2DC08600\9CD108CD2DC08600.exeC:\Users\Admin\AppData\Roaming\9CD108CD2DC08600\9CD108CD2DC08600.exe1⤵
- Executes dropped EXE
PID:3068
-
C:\ProgramData\12f3d840-d52a-413c-9420-9a9bf187ce92\FnHotkeyUtility.exeC:\ProgramData\12f3d840-d52a-413c-9420-9a9bf187ce92\FnHotkeyUtility.exe -Embedding1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3252
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵PID:3508
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵PID:3940
Network
MITRE ATT&CK Enterprise v16
Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
2Credentials In Files
2Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\12f3d840-d52a-413c-9420-9a9bf187ce92\FnHotkeyUtility.exe
- Size 1.3MB
- SHA256 2728e26af764a64dd31f6df20bad9ce68f27a1c54628abf7353a62f5e67a9dff
- MD5 ac01b1efe9bdd6c127bcb489765e935d
- SHA1 2ba7bbcf28c0171e51bd31ed8f4c9695134de3dc
- SHA512 3ada07d1a35e80f726229ca3266eabc296500853274cc04be76d59461a80fc9ee8a1bc28678a20423f1fcf0ff194de5b629452250dd5be7a08c25bf52df84a35
- SSDEEP 24576:RHGG1DQA1jJiCmuz8OPzbWFa4WbaMrres:R2A1lXyQbWFbw
- MD5 SHA1 SHA512 SSDEEP
- Path C:\ProgramData\12f3d840-d52a-413c-9420-9a9bf187ce92\MSVCP140.dll
- Size 571KB
- SHA256 a68a9ac35aa1e183fe3bd9e7144259631530db07502112a339e5e1c8dccc9a31
- MD5 990a590eb079f420946fde91975798b9
- SHA1 e78619eea4699bbb24a32051842ae15a971f7107
- SHA512 6ccf8b198986de3478411233514803b22750560da419cbcb052ff963ebfea40386d54db6c335d7cd771503eb93693b872ff3c1bf39385eabc7fdd06ca40f6296
- SSDEEP 12288:jSTTigI46Bb3SUPvRgrKtzL4oaQEKZm+jWodEEVPLwtQN:jUStZaQEKZm+jWodEE9CQN
- MD5 SHA1 SHA512 SSDEEP
- Path C:\ProgramData\12f3d840-d52a-413c-9420-9a9bf187ce92\ludp.dll
- Size 1.6MB
- SHA256 a62f73b7cef738ebd9963744665aa85772b428aef214f07f8112ff3816b09241
- MD5 084f247502e6054ada4a65a8935a4396
- SHA1 1794e9b5e818cbcc378f48cdc336e055020fa321
- SHA512 f1fcddbe75d98ad5d1d7d3951730d0451663aab00a355ad38298a33e36df7be057f9cddc97e38fab9368a804b97c3af6893eaa84b25b16fab21e692fad45fe47
- SSDEEP 49152:/Gtlq7kjBH5M5QMSA7i57S3OD8CK6Iwg:JA0iSe
- MD5 SHA1 SHA512 SSDEEP
- Path C:\ProgramData\12f3d840-d52a-413c-9420-9a9bf187ce92\spkvol.dll
- Size 4.2MB
- SHA256 40129767e7985b4c7aedf0827e669c059b90c834dddb4a0d40eeaf495a8c5846
- MD5 ad61adc8f8e3bfb13b0722de763dc562
- SHA1 921b951275ae77efbeb95adfb70fb532bc1737f3
- SHA512 21d75216037f67c182288e66960227d128dc0107fc2324197aef2a4e2871b27a48bc3fe5219f8037ef52fa90bdf258421d486deada3e31b2a5612f4f30459d11
- SSDEEP 24576:bHGJGQoIqtWimgiIxOegtKDSRRV5svwGI1+28sgonuA:bGJGQoI+mw8KSRv5g/2tzu
- MD5 SHA1 SHA512 SSDEEP
- Path C:\ProgramData\12f3d840-d52a-413c-9420-9a9bf187ce92\vcruntime140.dll
- Size 101KB
- SHA256 5dc711b1f190df5b1257b92883e9c3f10cb4e953591da13dd50d9f0c7a4af695
- MD5 c5bc6d2136f51d438af4dbe8ef8103d1
- SHA1 186e176ad2df3df728acd5c5b0dee6dcdf036e80
- SHA512 2ae122c612882a4a5f16bd5c69e5ed4b3e5e87d52f979d2e0e34254f397c63ae1dbeb5ab64c35c640b17d626aa4feafc6927f745102e1ac13f1837f1e665eeaa
- SSDEEP 1536:m3qPWvVCMgfw2eeWqjOebgk0jIpePxd76LGYU8j6ecbolG8E/4xPcj888iiBg9z:m66dsFeeBGPj1L6LGY+ecboCN78iZ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\ProgramData\12f3d840-d52a-413c-9420-9a9bf187ce92\vcruntime140_1.dll
- Size 46KB
- SHA256 e30874ceaf6b8dfe72ba67e5c1f21027d79cb3a873a32eb12c5ed89bfa660d1f
- MD5 f17586db47571622455a6f57fecdda53
- SHA1 5ca5ef3ca3eb244174a5b912b6c7ea607247e6eb
- SHA512 d942964b65b1df656025b848ed2f6b423c6cdffd6626855b7f39a7152fc4ffa20672214e7c0ff1075130363127a5db35b98831ada51596d4d322387a7d0a0708
- SSDEEP 768:Ime4gSbOzTRU2RESkCW89wf9fV49zBA9USp9HPisSg:cO0r9KfWzB4Dx5P
- MD5 SHA1 SHA512 SSDEEP
- Path C:\ProgramData\8711A39F-CF84-815B-9837-0C33E04F148B.txt
- Size 64B
- SHA256 ee9b54752bfe271bdc98591e153f563ad2a67e870586f9987ce75fbeaa89f01f
- MD5 985ca746b0f87241bf14495ee500bd51
- SHA1 f79c70b524163d2bbb2769f3172b865ea343bc92
- SHA512 d22ad5fd717f2a453904f982cab08c4386fe81990ed615e9532e53471c4f2e265a6a01dc45cf7501d2b7400a7627f53023a2bda69579ee7ff153e3add62aa449
- MD5 SHA1 SHA512
- Path C:\ProgramData\{bc5bb0bb-e6ce-11f0-9913-806e6f6e6963}\Browsers\Chrome_History
- Size 160KB
- SHA256 9091ac11406f559b228639a023f638aa4461083cf4151878f781b85acde0e2ba
- MD5 ea2f1147ca310fa5d8e3dc3cca218f60
- SHA1 fd7e6239dac6d57876fc8536feb7bbf2307b0bc1
- SHA512 7427e2055015af3721dfaa2f3e16dd12b158dfa3ea8c75130bd66a6610b657d51a5d7fad8c1f2e27e79ba05bdfef1e961171611c2668759bc09dd79cb97cbc9b
- SSDEEP 96:JY/uejzH+bF+UIYysX0fxQp97YEHt/DfLcLq2piRk/E0:JY/tH+bF+UI3iWGVYWNkqp3
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.99.1_0\_metadata\computed_hashes.json
- Size 6KB
- SHA256 8b5f74223532bb72cb4fc5ae8fead80e07701133d2bf0d08653f64687837019e
- MD5 0c544764802883995f2c84db51cef3f8
- SHA1 6ac941b48cdc2c7eccd1d3727c445fb85d4d4ab6
- SHA512 9415da41c603d99b26f70d8a64695e6e8e7136ae402955d73fd856100384af55abff9bfa491e139b074a0e424169ba503f9aab9685b4d6a9950a6714a25ac6c2
- SSDEEP 96:CbLBlwtH4zry5dOSZSVWDupxFdnMSmuxyw0iZ1zbqW12:mLB7ryiSZ+UutiSmMym3mW12
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_metadata\computed_hashes.json
- Size 10KB
- SHA256 adc74ae6ab36b894e94b96be6f64d5631aa020e12c948ea6cfbcfca0675f733a
- MD5 f4592a558b7fdcdaba8e33363ae2fd4c
- SHA1 b0681246742640c5fe707216c9190a117e4fade7
- SHA512 2d9bd75a7a3df48a50bc159d34e16a92961535a4d460e9c8b440d4020768e52311fdbab6aa602776cf1bdd7ddfcdcb44d3405202231771d40f02210014d81992
- SSDEEP 192:GbylJnfTwGB7h9Hne4qasKxXItmLG48gcLg/PkI:Gb+nfdBuaFx4toj8VEPT
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\arbitration_service_config.json
- Size 19KB
- SHA256 2397794f5be914318cf55d1e8cbc2a0bf641406d52f8fb79f2dcd503feddaedd
- MD5 a718dd61ba463c2ec89b9e9fb914a9eb
- SHA1 2e759cdfaf39673d2376975a5b961b534c570852
- SHA512 3afae1e62807f1b78639124ccf4326193e6ff05f78cdc910a571da19d55bededa9617568b7e914eebb84ba9423b0a53800b460bc7f6ad4c452cf6133a451e71e
- SSDEEP 192:vQeqfRR+nft0joCxc/i4utSfXzYOq59/Z2ef8Hw54ecoaSbqG/I5zT8/:vQeiKF0jojq4uGDigefsSraSbqG/d
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\default_cloud_config.json
- Size 8KB
- SHA256 a2aeb64cc83fc2a6f76b603838f76bda552674e7216a84c59fe9197c7ce14947
- MD5 d95978b7e24859bab2fb2749fa2f37d0
- SHA1 aacde49c447372f62551e7fee06e765c317fa2c4
- SHA512 fb9744f8d8e190a39668e0c4c69f429c259a1c1cb33c32d499bee2391cd880a192c59b2d82ee64ed41b17f034767f5bc0e051634fb67b5886ae8cf966286564e
- SSDEEP 96:RR2F2jKrEFYNSdJeRgPAn8XckvgGVFqAQ2ghEFq9Q2gEtflbPER4u0IqoY0dwWtS:weggaRIskvFalkwIEn4GpU7REH9z0YN
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{e00603b6-966a-4e97-aac4-fb9b215daba7}\appsglobals.txt
- Size 343KB
- SHA256 fc44a1e29369da7d23299a7921416467015a1da650994cd3208ceac37f11ee14
- MD5 8819cfcc1fe426986129f86898baca21
- SHA1 32101d8a4382bf5654ddde906f893f3899af6f77
- SHA512 7bd8ba6d6b29ef6fb8c7d3a1aefcae0a93dcdacc0ade152c5027b7e50279d4d3fcda71f8c36543d5cb8dd6a968f21e5987777aa2c242143be019b08e211612e6
- SSDEEP 3072:+rNHn+auvNDrohmXLI7E8FAtXQkun1907oL6hq65sRQsqbmfEV+1+b:qNH+auvJohmXLIQfhI1FL6hB5PsqCfU
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\1_240626109.exe
- Size 2.2MB
- SHA256 a548b65783231dc2d4a936ac0cdde7ae373ac84e1142a7678bd045b9d129cc06
- MD5 75914207c89e01520ec7905774192f04
- SHA1 e8e1b890692083e893de4c8eec718200ce00ca14
- SHA512 f025a3223195b659f0af309865cb08607aedc597d67e666b3afc00aeb4a3d795c4d608382ab25c0458ee38de98cd308953a3c3070fa47e69295f154cbd67a3f2
- SSDEEP 49152:ZaBNlIwxb3uCrb/TMvO90d7HjmAFd4A64nsfJt0udLClUBr4HyfZhsRoYg15Q6Eb:ut3unArwYh
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\2_240627421.exe
- Size 4.7MB
- SHA256 1f0f46dc270ea7e929b2ae662a8480f5766df7e17ff76816bba7a07865b2806d
- MD5 6b18bc2388eb1162da48c366fc90bedc
- SHA1 c759351e55b66f8f1c2f5c7ce5ce975dd05d4561
- SHA512 de4d0992e1d0517dd5eebecb68780bd762b42c378a4320cf660fdfbca4c2d24b9dc09df0fe5904b12aa771841813129d84eaf5de6b10219a5004ea05c6455aa3
- SSDEEP 98304:HN66h+qY9CLppI6cmLB6/EGv+e+6QX0/RSLOEAN3v5Ilb:/ZgCLrI6cmLw/Rv+e+6dZ1PN3ip
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\3_240629984.exe
- Size 1.6MB
- SHA256 7b2620cf008268fa8eff18c136ca020fa948634e646f7301ab48a5dd936033fd
- MD5 2df6951b9ef238bfb1c879e18221db30
- SHA1 c019d8c7cb1760958f44c7e3dcdd5b040ddf517e
- SHA512 5399577cd5a9d704a0c3328cdb9fbc3bf0b5095ce7d9db8d3c52c1e0e920bf06536467e95b333a24252adb779bac102e5a61cf57827341d437c8dadd7c33c0fa
- SSDEEP 24576:402+h4Q8qAjv6qfjq1nJAfPVHDClF7rDheENnlBtSqlOqrXtd0RlgbCpS:+Q8FDjWJAfPVHCpheENnd75r03gb
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\4_240632781.exe
- Size 237KB
- SHA256 95116f138582eef8a962fb96612c1d9c55b3815ddd32eb3b838cc8fe2ec1e838
- MD5 4543da4cd28611d29836ce0b99145e58
- SHA1 d51df7d8732d6c46ec8110c7343770a6017e6bda
- SHA512 ed9d665883351f9a1f266912a1bfebd06e197ed6947a0a4ccbd89dc0ecf76d1889908a76f75ae81fe29170051b13c03ac74926aea1c297b906b4832775fff3ef
- SSDEEP 6144:ZdWB5yRPCOvNcSVe3r6r7DmTKfjz4oH9nnkBQXW:nOyRPCOvNcSVe3r4fHRxnbm
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\5_240636281.exe
- Size 83KB
- SHA256 fd1ce709645e820d6347b03a688cc2a5c1b4fd79c3138ddcc66d3da50e654030
- MD5 7144bfd369c6070f8723bb8523cd9246
- SHA1 a4c14422ee001d4a6e35570707554d0e55d63c66
- SHA512 1c9e067b54b652aefd82968631895c3af9e5f4300920890b16c2c3f12498cc4be9ee9ccc32ef022a1f89dbf678ae0dd14adcf3ec70b3d3469d1c3a5000a58a16
- SSDEEP 1536:Z148CrfdXNM840VhyGzirik7okuAhoB2y:Z1zmM92yrCksB2y
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\History
- Size 204KB
- SHA256 720685dd6ca97e57e27256ab84b17a2d72519d090a1e54b0196b06ea72e058ee
- MD5 4d2ceadf82e4c90d4a69b9d5929b68fd
- SHA1 f6e6c46c0bbe0daeb80f7d2033448e4c1fbc835b
- SHA512 e30b33fbac285d3967015c3c7425248e6d6f94dd8196a8f749c4561f3c208773b3c94e84d8b95c9b671459a990bc85d0ccb37d814978f0b6935d59c850b8cef5
- SSDEEP 96:B9HU+bGz83uxDLjGQLBK31NfR4J+MCXkFr+MFcjtk4Q9/2jdEbjBHMsDETbiIqOp:B90+G83uxXBBK31GkSJYEJH7DNspU
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\is-3IE3L7VQ22.tmp\2_240627421.tmp
- Size 3.6MB
- SHA256 cc127c89698ba84f6965a0c177776affbf52ed07e9222e589ddb307c84d40d82
- MD5 901ffea60915cebef6768295a9563e5f
- SHA1 79f82756574fe121a80d77870d7ae8d5f1038d0c
- SHA512 87f88ad0d8d6f39b11f78e67a2e200b4c427508ee802b6cc09a03507b079f796cc25ee2fc67c26be54b6f35684c92c4e8ef7e6107300de2c3d1c5caa73024a8b
- SSDEEP 49152:K3SA9I3bZxTZElVySH6UNoO7zjQynN4s7UUZyE8eECaN2MU333uy:KCbWroSkynN4sQ+TdMU333N
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\is-I1CW0796SA.tmp\_isetup\_isdecmp.dll
- Size 34KB
- SHA256 31d04c1e4bfdfa34704c142fa98f80c0a3076e4b312d6ada57c4be9d9c7dcf26
- MD5 c6ae924ad02500284f7e4efa11fa7cfc
- SHA1 2a7770b473b0a7dc9a331d017297ff5af400fed8
- SHA512 f321e4820b39d1642fc43bf1055471a323edcc0c4cbd3ddd5ad26a7b28c4fb9fc4e57c00ae7819a4f45a3e0bb9c7baa0ba19c3ceedacf38b911cdf625aa7ddae
- SSDEEP 768:Z4NHPfHCs6GNOpiM+RFjFyzcN23A4F+OiR9riuujF+X4UriXiRF:Zanvc+R9F4s8/RiPWuUs4UWXiv
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\gjFypOuao9Q5.exe
- Size 253KB
- SHA256 baf43d31ee9e62706ca5a894735202bbaf918729a09bcd91b5066b8e820dbc90
- MD5 e5f76b2db75723b2803f5d4a5b5187e8
- SHA1 23e0ceb34a9d968465054fb7fb32e205f9ac786e
- SHA512 805850bc4647f91db633014536c359c241c17536b5f91b13e460e2c1d6e9b063e6f0bb453490c3543e53f87440cb98954dea2a5916672c3adc8364934d3e1f45
- SSDEEP 3072:mNOwqK4rgK11DQFhjFs5zlwuSnXrZNkxIEAL9DVdUr6RFhPp3YVKrw90C8/NHLXI:8ORK4rg+1DOpskTXlNkxM/smwn8BobE
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\Contacts\Update.exe
- Size 269KB
- SHA256 fe33c0f159c8d2f37c694215f63a95f55b498da024863b87f7f5601e0c6c42b9
- MD5 91763fd6a0da2fb89df38b3ed2ee1f69
- SHA1 342376bf7b63e62ba57c69df68b1cf0e5ececa27
- SHA512 a3cf8b812e667e0d92dce886ba2c3347897fdfd76bf04efb9aab8b7648192437a344953407d263f8f0276739447a2f0c09bec4f385194fd65fb00d3fdcbc2c86
- SSDEEP 6144:CZVkCIQMIQzzQ25XqH+ADmHbXJpxaEK+CS:CPkCIxIQz1qiLjkS
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\Desktop\Documents Backup.lnk
- Size 1KB
- SHA256 0e8978a9bbc3740f04e80c0dc0772d8f9a7ff41ff8f010b79337f20031deb8e3
- MD5 d1119e852db222c0cf7259d0fc8ed4aa
- SHA1 8e697b85ae2715f041c1d748bbef3bf96f3a967a
- SHA512 57a87210b99847a2db1d07916d9530d4a7ff80bd34318de985a8c3544844c5de97821b456c1578b767c2a5893f9250affa0effa3893cc7c851bbddf26bf9fc63
- MD5 SHA1 SHA512